Privacy Policy

In force since 28 August 2026. This page carries the version applicable today.

1. Introduction

1.1 This Privacy Policy explains how Lo On Shing Consultants Limited collects, uses, shares and protects personal data in the course of its consulting services dedicated to foreign direct investment in Mainland China, Hong Kong, Taiwan and Vietnam, and through this website.

1.2 We process personal data in accordance with the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong, and, where our processing falls within its scope — typically where we serve a client established in the European Union — in accordance with the General Data Protection Regulation. This website is hosted in Switzerland: the data collected through it is also handled in accordance with the Swiss Federal Act on Data Protection (FADP). Where a matter is carried out in Mainland China or in Vietnam, the personal information protection laws of those jurisdictions apply to the processing performed there.

1.3 This Policy applies to:

• visitors to this website;
• persons who write to us or complete the online questionnaire;
• our clients and their staff;
• matter handlers and administrators who hold an account in the client space.

1.4 Individuals whose data reaches us because they are named in a matter — directors, shareholders, beneficial owners — are addressed by the General Public Notice, which should be read alongside this Policy.

2. Data controller

Lo On Shing Consultants Limited (盧安誠顧問有限公司), a limited company incorporated in Hong Kong SAR under number 2229760, with registered office at 806, Capitol Centre, 5–19 Jardine’s Bazaar, Causeway Bay, Hong Kong SAR, is the data controller.

Requests concerning personal data: info@loonshing-consultants.hk.

3. Collection of personal data

3.1 Directly from you

• When you write to us — your name, e-mail address, and whatever you choose to tell us about your project.
• When you complete the questionnaire — the identity and contact details of the investor and of the persons who will hold office or shares; the intended activity, capital and address of the company; and the elements the deeds and the administrative forms require. The questionnaire asks for no supporting document: documents are requested only once a matter is engaged.
• When a matter is engaged — the supporting documents you upload to the client space or send us by post: identity documents, proof of address, corporate documents of the parent, notarised and legalised copies.
• When you hold an account — your e-mail address, the password you set (which we store only as a derived value that cannot be reversed), and the second factor you enrol.
• When you subscribe to the newsletter — your e-mail address, the name you give if you give one, the language of the page, the jurisdictions you are interested in, and your choice between the monthly news and the briefing notes. We also keep the date of your subscription and the page it came from: that is what evidences your consent. We do not keep your IP address.

3.2 From other sources

Public registers, when we verify a filing or a corporate document; public sanctions, politically-exposed-person and adverse-media sources, during the client due diligence we are required to perform; and our correspondents, where they act on the matter.

4. Purposes

4.1 Answering an enquiry and studying a project — reading the questionnaire, assessing feasibility, preparing the engagement proposal.

4.2 Client due diligence — verifying identity, establishing the chain of beneficial ownership, and running the sanctions and adverse-media checks that anti-money-laundering, counter-terrorist-financing and anti-tax-fraud (AML-FT) rules require of us and of our correspondents.

4.3 Performing the engagement — drafting the deeds, completing the administrative forms, making the filings, coordinating the local professionals, opening the bank account, following the matter to completion.

4.4 Billing and administration — issuing invoices, keeping accounting records, recovering sums due.

4.5 Running the client space — authenticating you, recording who opened which matter and when, and keeping the audit trail that a professional file requires.

4.6 Legal and regulatory compliance — answering an authority, meeting a retention obligation, defending or asserting a legal claim.

4.7 Keeping you informed, where you have asked to be — the monthly news on the four jurisdictions. Never without your consent, and every message carries the means to stop it.

5. Whether providing data is obligatory

Fields marked with an asterisk in our forms are necessary: without them we cannot study a project, engage a matter or make a filing. The rest is voluntary and simply helps us do the work better. Where a document is required by an authority rather than by us, we say which authority requires it.

6. Who receives the data

6.1 Registries and authorities of the jurisdiction concerned — this is the purpose of the engagement, and the filings are made in your name.

6.2 Local professionals acting on the matter: our corresponding law firms and licensed service providers in Hong Kong, Guangzhou and Đồng Nai, the company secretary and the auditor appointed to the new company. Each is bound by confidentiality and receives only what the matter requires.

6.3 Banks, where an account is opened, under their own account-opening and compliance rules.

6.4 Notaries, translators and legalisation services, for the chain by which foreign documents are made usable in the country of destination.

6.5 Our service providers, acting on our instructions and on no other: electronic signature (DocuSign), invoicing (Xero), electronic messaging, and hosting. A hosting provider stores the files and nothing more: it has no right of access to their content, and it is bound by contract to security and confidentiality obligations equivalent to our own.

6.6 Authorities and regulators, where the law requires it.

We do not sell personal data, and we do not share it for anyone else’s marketing.

7. Cross-border transfers

7.1 Our work is cross-border by nature. A file opened in Europe is processed in Hong Kong and, according to the matter, transferred to Mainland China or to Vietnam, where it is filed with the competent authority.

7.2 We transfer only what the recipient requires, we tell our clients where their file goes, and we bind our correspondents by confidentiality. Where the applicable law requires a transfer mechanism — standard contractual clauses, a specific consent, or an assessment — we put it in place before transferring.

7.3 Storage is itself a transfer. The documents of a matter and its archives are held on cloud infrastructure, part of which sits outside Hong Kong. What is said above applies to that infrastructure as it applies to a filing: only what the purpose requires leaves, and the purpose is the performance of the engagement and the safe keeping of the file — nothing else. Section 9.2 says who controls that infrastructure.

7.4 The levels of protection afforded by the laws of the destination jurisdictions are not identical to those of the country of origin. We say so plainly rather than leave it to be discovered.

7.5 Switzerland. This website, and the client space through which you exchange documents with us, are hosted in Switzerland, with Infomaniak Network SA. Switzerland is covered by a European Union adequacy decision: personal data reaching it is recognised as enjoying a level of protection equivalent to the GDPR, and Swiss law is among the most protective of confidentiality in the world — one reason we host there rather than with a provider subject to United States law. An engagement nonetheless moves data in both directions between Switzerland and the Asian jurisdictions concerned — Hong Kong and, according to the matter, Mainland China or Vietnam — for which no such finding of equivalence exists. By engaging us, the client expressly consents to those transfers, in both directions, for the sole purposes stated in 7.3 and with the safeguards stated in 7.2, and acknowledges that the protection of the data in those Asian destinations rests on those safeguards; those transfers are in any event directly connected with the performance of the engagement. Where the data concerns the client’s directors, shareholders, beneficial owners or staff, the client warrants that it has informed them and, where the applicable law requires it, obtained their consent. Consent may be withdrawn at any time by writing to info@loonshing-consultants.hk; withdrawal does not affect transfers already made, and may prevent us from continuing the engagement. The same consent is recorded in the Services General Agreement.

8. Retention

8.1 We keep personal data for as long as the purpose requires, and afterwards for as long as we may be required to answer for the matter or to produce it.

8.2 As a general indication:

• An enquiry that leads nowhere — kept while it is being studied, then archived and erased.
• A matter we decline — archived and the personal data destroyed within six months, sooner on request.
• An engaged matter — kept for the duration of the engagement and afterwards for the period required by the AML-FT and accounting rules applicable to us and to our correspondents.
• Accounting records — for the statutory period.
• Account and audit-trail data — for as long as the account exists, and afterwards for the period necessary to evidence who did what.
• Newsletter subscription data — kept for as long as the subscription lasts. Unsubscribing stops every mailing at once; the entry is kept, with the date of the unsubscription, so as not to re-enrol you by mistake and to be able to show that your request was honoured. An address that never confirms receives nothing at all: the confirmation link ceases to be valid after seven days. You may ask for your entry to be erased by writing to info@loonshing-consultants.hk.

8.3 Where a retention period is imposed on us, we cannot shorten it at request. We will say which obligation applies and when it expires.

9. Your rights, and how we secure your data

9.1 Your rights

You may ask us whether we hold personal data about you, ask for a copy of it, ask for its correction, ask for its erasure where nothing obliges us to keep it, object to a processing based on our legitimate interest, withdraw a consent you have given, and — where the GDPR applies — ask for your data in a portable form or complain to a supervisory authority.

Write to info@loonshing-consultants.hk. We answer within the period the applicable law allows, we do not charge for a first request, and where we cannot grant a request we say why.

9.2 Security

Access to the client space requires a password and a second factor, every time. Passwords are stored only as a derived value. Access to a matter is granted matter by matter, and signing in opens nothing that has not been granted. Every consultation and every action on a matter is recorded.

Where the files are held. The dematerialised documents of a matter, and its archives, are held on cloud infrastructure rather than on a machine standing in our office. They remain under our exclusive control: we alone decide who is granted access, and we alone hold the means of decryption. Our hosting providers act on our instructions and on no others, have no right of access to the content of a file, and are bound by contract to security and confidentiality obligations equivalent to our own. We chose it this way because a single machine in one room is the easier thing to lose — to a fire, a theft, or a failed disk — and because infrastructure of this kind is held to a standard of availability and of physical security that we could not reproduce ourselves.

No system is beyond reach. Where a breach is likely to affect your rights, we will inform you and the competent authority as the applicable law requires.

10. Cookies

This website uses only what is necessary for it to work — remembering a chosen language, a filter, an open session. We do not use advertising cookies and we do not track visitors across other websites. Audience is measured with Matomo, installed on our own server and set to work without cookies: no identifier is placed in your browser, your IP address is truncated before it is stored, and the “Do Not Track” setting of your browser is honoured. What is counted is pages viewed, documents downloaded and the steps of the questionnaire reached — never who reached them. Nothing is shared with any third party.

11. Direct marketing

We send the monthly news only to those who have asked for it. Every message carries the means to stop it, and stopping costs nothing and changes nothing else in our relationship.

The newsletter. The site offers two separate mailings: the monthly news and the briefing notes. One is enrolled only by a two-step consent: you enter your address, we send a confirmation e-mail from info@loonshing-consultants.hk, and nothing is sent to you until you have clicked in that e-mail. An address entered by someone else therefore produces no mailing at all.

Every message carries an unsubscribe link that works in a single click — no intermediate page, no password, and nothing to write to us. Unsubscribing takes effect at once and for good; we do not re-enrol you on our own initiative, not even if you become a client again. You may also ask to be removed by writing to info@loonshing-consultants.hk.

This newsletter goes only to the people who asked for it. We do not rent, sell or exchange these addresses, and we do not use them for any purpose other than the two mailings named above.

12. Children

Our services are addressed to professionals. We do not knowingly collect data about minors, save where a minor is a shareholder or beneficial owner of a company being formed, in which case the data is that which the authority requires and no more.

13. Changes

This Policy may be amended. The version in force is the one published on this page, and it carries its date. Where a change materially affects your rights, we will tell you.

14. Contact

Lo On Shing Consultants Limited — 806, Capitol Centre, 5–19 Jardine’s Bazaar, Causeway Bay, Hong Kong SAR — info@loonshing-consultants.hk.