Privacy & Data Governance — Travcon Consulting

Last updated: 15 October 2026

Travcon (HK) Limited ("Travcon", "we", "us") is committed to protecting your personal data. We follow the Personal Data (Privacy) Ordinance (Cap. 486) ("PDPO") and its six Data Protection Principles. This policy explains what we collect through this website, why, who we share it with, and the rights you have. It also forms our Personal Information Collection Statement.

1. What we collect

When you contact us. Through our contact form we collect your name, email address and message, and, if you choose to give them, your organisation, phone number and topic of interest. Your name, email address and message are required so that we can reply. If you don't provide them, we won't be able to respond to your enquiry.

To keep the form secure. When you submit the form, Cloudflare Turnstile checks that you're a person rather than a bot. This uses technical information such as your IP address and browser details. We don't use this information to identify you.

Website statistics. We use Cloudflare Web Analytics to understand how the site is used, such as which pages are visited. It does not use cookies, does not track you across other websites, and does not build a profile of you.

We do not knowingly collect personal data from children through this website.

2. Why we collect it

We use your personal data only for the purposes for which it was collected, or directly related purposes:

to respond to your enquiry and arrange any consultation you request;
to prepare proposals and provide our consulting and training services;
to register your interest in ACDClub, if you ask us to;
to send you updates, but only if you have given your consent (see Direct marketing);
to protect this website against spam and misuse; and
to meet our legal and regulatory obligations.

We will ask for your consent before using your personal data for any new purpose.

We do not sell your personal data. We may share it with:

Our team, on a need-to-know basis, to handle your enquiry;
Service providers who process data on our behalf, such as Cloudflare, Inc. (website hosting, form processing, spam protection, email delivery and analytics) and our email provider. They may only use your data to provide their services to us;
Delivery partners, such as Cubic Alpha for AI training or Ablyx for supply chain solutions, but only where needed to respond to your enquiry and with your agreement; and
Regulators, courts or law enforcement where required or permitted by law.

4. Direct marketing

We will not use your personal data for direct marketing unless you have given your consent, as required by Part 6A of the PDPO. If you tick the updates box on our contact form, we may use your name, email address and phone number to send you information about:

Travcon's consulting and AI training services;
ACDClub membership, events and programmes; and
events and publications related to AI, supply chain and communication training.

We will not provide your personal data to others for their own direct marketing. You can withdraw your consent at any time, free of charge, by using the unsubscribe option in any message or by contacting us. We will then stop using your data for direct marketing.

5. Cross-border transfer

Our service providers, including Cloudflare, operate global networks. Your personal data may therefore be processed or stored outside Hong Kong. We choose providers that commit by contract to protect personal data to a standard comparable to the PDPO, and we take reasonable steps to ensure your data is handled securely wherever it is processed.

6. How long we keep it

We keep personal data only as long as necessary for the purpose it was collected, in line with section 26 of the PDPO. Enquiries are generally kept for up to 24 months after our last contact with you, unless they become part of a client engagement or we must keep them longer by law. We then delete them securely. If you withdraw marketing consent, we keep only a record that you have opted out, so that we don't contact you again.

7. How we protect it

We take practical steps to protect personal data from unauthorised or accidental access, processing, loss or use. These include encrypted connections (HTTPS) across the site, spam and bot protection on our forms, restricted access to enquiry inboxes, and contracts with service providers that require them to protect your data.

8. Your rights

Under the PDPO you have the right to:

ask whether we hold personal data about you;
request a copy of that data (a data access request);
ask us to correct data that is inaccurate (a data correction request); and
withdraw consent to direct marketing at any time.

Send your request to our Privacy Team (see Contact us). You may use the Privacy Commissioner's standard Data Access Request Form. We will respond within 40 days, as the PDPO requires. We may charge a fee for providing a copy of your data, but it will not be excessive. Corrections are free.

9. Data incidents

If a data breach occurs, we will act promptly to contain it and assess the risk. Where there is a real risk of significant harm, we will notify the people affected and the Office of the Privacy Commissioner for Personal Data (PCPD), following the PCPD's guidance on data breach handling.

10. AI and data governance

We help organisations use AI responsibly, and we hold our own work to the same standard. Our approach follows the PCPD's Artificial Intelligence: Model Personal Data Protection Framework (2024) and its guidance on the use of generative AI by employees (2025).

People stay in control. AI supports decisions; people make them. Systems we build include approval rules, limits and human sign-off for consequential actions.
Every decision is recorded. We design AI systems to keep a record of what was suggested, what was approved, and why.
Client data serves the client. Data you share with us for an engagement is used only for that engagement, under a written agreement. Where we process personal data on your behalf, we act as your data processor and follow your instructions.
No training on your data without agreement. We do not use client data to train AI models, or allow our providers to do so, without your written agreement.
Least data necessary. We prefer anonymised or aggregated data, and limit access to the people who need it.
Careful use of AI tools. Our team does not enter personal or confidential client data into public AI tools. We assess AI tools for privacy and security before using them in client work.
Risk assessment first. Before deploying an AI system that involves personal data, we assess the privacy risks and the level of human oversight it needs.

11. Other sites and products

This website links to other sites, including partner products such as Abby (Ablyx) and Lango (Lango AI). Those sites have their own privacy policies, and we are not responsible for how they handle your data. Product and company names on this site belong to their respective owners.

12. Contact us

For privacy questions, data access or correction requests, or to withdraw marketing consent, contact our Privacy Team:

Privacy Team
Travcon (HK) Limited
Unit 801–803, Level 8, Core C, Cyberport 3
100 Cyberport Road, Hong Kong
Email: [email protected] (subject: "Personal data request")

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner for Personal Data, Hong Kong.

We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated.

Privacy & Data Governance.