This policy explains how Huayou International Lithium (Hong Kong) Limited handles personal data and review records while operating its lithium asset review practice from Hung Hom, Hong Kong. The website is published under the developer name SeekHigh, which operates this site on behalf of Huayou International Lithium (Hong Kong) Limited.
Huayou International Lithium (Hong Kong) Limited operates a lithium asset review practice from its office in Hung Hom, Hong Kong. The practice reads claims ledgers, assay reports, offtake notes, tenement records, resource estimates and shipment documentation on behalf of holders, traders and technical teams. That work brings us into contact with personal data about the people who send us instructions, the people named in the documents we review and the people who work alongside us.
This policy describes what we collect, why we collect it, how long we keep it and what you can ask us to do with it. It applies to this website and to all review engagements we accept. The website was developed and is maintained on our behalf by the developer known as SeekHigh, and the technical team behind that name applies the storage and security practices described in this document when building and supporting our online presence. The mention of SeekHigh here is a disclosure of a development role only, and it does not make that developer a controller of the data described below.
We have written this policy in plain English because the people who read it are usually busy and often reading a file in the middle of a transaction. If a sentence is unclear, write to us and we will explain it. We would rather answer a question than leave an ambiguity in a document that is meant to build trust.
This policy covers personal data processed through this website, through email sent to our published address, through telephone calls to our published number, through written correspondence sent to the Hung Hom office and through review work accepted under a written engagement note. It does not cover third party websites that we may link to, and it does not cover services provided by other firms who may be engaged alongside us on a transaction.
Where a client sends us a document containing personal data about a third party, that client is responsible for having a lawful basis to share the document with us. We process the document for the purpose of the engagement and for no other reason. If you are a third party named in a document and you want to know why we hold a reference to you, you may write to us and we will explain the engagement at a level that respects the confidentiality owed to our client.
This policy does not create rights against any entity other than Huayou International Lithium (Hong Kong) Limited. It is a description of practice, not a contract, and it does not override the terms of any engagement note signed by a client.
The controller of personal data described in this policy is Huayou International Lithium (Hong Kong) Limited, whose registered office is at Rm 15 5/F Hung Hom Commercial Centre Tower B, 37 Ma Tau Wai Rd, Hung Hom, Hong Kong - 999077, Hong Kong (HK). You may reach the controller by email at connect@haersinvest.lat or by telephone on +18509772246.
We are a Hong Kong company and we operate under the laws of Hong Kong, including the Personal Data (Privacy) Ordinance. Where an engagement requires us to handle data belonging to people in another jurisdiction, we apply the stricter of the Hong Kong requirements and the requirements of that jurisdiction where they can reasonably be applied to a small professional practice.
Our office is a working review room rather than a public shopfront. Visits are by appointment, and documents are not accepted at the door without a prior intake note. This is a privacy measure as much as an operational one, because it keeps uncontrolled paper out of the room.
We collect three broad categories of information. The first is contact information you choose to give us: your name, the organisation you represent, your role, your email address, your telephone number and the address you ask us to use for correspondence. You give this information when you send an enquiry through the contact form, when you email us, when you call us or when you hand over a business card at a meeting.
The second category is engagement information: the subject of the review you ask us to undertake, the claim identifiers involved, the date by which you need an output, the people you ask us to deal with on the other side and any billing or payment reference we need to record. We keep a short engagement note that records the scope agreed, the fee arrangement and the retention period.
The third category is technical information generated when you visit this website: the pages you request, the browser and operating system your device reports, the approximate region from which the request arrives and the date and time of the visit. Our hosting provider may keep short-lived server logs for security and troubleshooting. We do not use these logs to build a profile of you, and we do not combine them with your engagement records.
We do not ask for government identification numbers, financial account numbers, health information or any special category data. If a review requires us to see a document that contains such information, we ask the client to redact it before intake unless the engagement note specifically requires otherwise.
The heart of our practice is the vault file. A vault file begins when a bundle of documents arrives and is given a bay number. From that point, everything connected to the engagement is filed under the same number: the intake list, the reviewer notes, the findings, the support table, the open items list and the closing summary. Names of individuals appear in these files mainly in three places: correspondence, signatures on certificates and named contacts in tenement correspondence.
We treat a vault file as confidential client material. It is not used to train any model, it is not sold, it is not shared with other clients and it is not used as a sample in any marketing material without written consent. When a file is closed the bay number is retained in a register so that we can find the file again if a question arrives later, but the register itself contains only the bay number, the client reference, the date of closing and the agreed retention period.
Where a document contains personal data that is not needed for the review, our reviewers are instructed to note that the data exists but not to copy it into the working notes. This keeps the file small and reduces the amount of personal data that has to be protected for the whole retention period.
We use personal data to respond to enquiries, to agree the scope of a review, to perform the review, to communicate findings, to invoice for work done, to meet record keeping obligations and to protect the practice against claims. Each of these purposes is narrow, and each is tied to something you have asked us to do or to something the law requires of us.
We may also use contact information to tell you about a change that affects a file you hold with us, such as a change of address, a change of reviewer or a change to this policy. We do not use contact information to send newsletters, promotional offers or third party advertising, and we do not sell contact information to anyone.
Where you have asked a specific question and we cannot answer it ourselves, we may pass your contact details to a specialist who can, but only after telling you that we intend to do so and only for the purpose of answering that question. You can decline at any point in that exchange.
Different processing activities rest on different lawful bases. Responding to an enquiry rests on steps taken at your request before entering a contract. Performing a review rests on the contract contained in the engagement note. Keeping records of work done rests on our legitimate interest in being able to demonstrate what was reviewed and when. Meeting tax, company and record keeping duties rests on legal obligation.
When we rely on legitimate interest we weigh our need against your reasonable expectations. A client who engages us expects us to keep a record of the work, so the balance is usually clear. Where the balance is not clear, we do not proceed with the processing until we have a better basis.
We do not rely on consent for the core work of a review, because consent can be withdrawn at any time and a review cannot be half performed. Where we ask for consent, it is for a discrete and optional purpose such as a testimonial or a reference, and it can be withdrawn without affecting the engagement.
Our office is in Hong Kong and our core records are kept there. Some service providers, including email and hosting providers, may store data on servers in other jurisdictions. When we use such a provider we look for one that offers contractual protections and a clear statement of where data sits, and we keep the volume of data sent to any provider to the minimum needed for the service.
Clients and correspondents are spread across several continents, so a message from you may cross a border before it reaches us even if we do nothing. We cannot prevent the ordinary routing of international email. We can, however, choose our providers carefully, and we can use encrypted archives for sensitive documents on request.
Where a transfer is made to a jurisdiction whose law offers less protection, we rely on the contractual terms offered by the provider and on the limited nature of the data transferred. We do not transfer vault files to any provider outside Hong Kong without the written agreement of the client.
Retention periods are agreed at intake and recorded in the engagement note. Our standard practice is to keep a closed vault file for six years from the date of closing, because that period covers the ordinary limitation period for professional claims in Hong Kong and the ordinary window in which a transaction question is raised. Longer periods are available where a client expects a question years later, and shorter periods can be agreed for a file that contains little personal data.
Contact information held for enquiries that do not become engagements is kept for two years from the last exchange, then deleted unless you ask us to keep it. Invoice records are kept for seven years to meet tax and company requirements. Server logs are kept by the hosting provider for a short technical window and are not copied into our own systems.
When a retention period ends, the file is destroyed. Paper is shredded and digital holdings are deleted from the working system and from backups within the ordinary backup cycle. The bay number in the closed register is retained so that a later question can be answered with a clear statement that the file no longer exists.
The physical vault and the digital holdings are protected by layered measures. Access to the review room is by appointment and by key. Paper files stay in the room and are not carried home. Digital holdings are kept in folders that are readable only by the reviewer assigned to the bay, with a second access path held by the practice lead for continuity.
Accounts that can reach client material require a strong password and a second factor. Devices used for review are encrypted at rest and lock when idle. Transfers of large document sets are made through encrypted archives rather than plain attachments. Backups are taken on a regular cycle and stored in a separate location so that a single failure does not destroy a file.
We test our own practice rather than assume it. A short review of access rights is carried out at the start of each quarter, and any person who leaves the practice loses access on the day of departure. If a security incident occurs, we contain it, assess the risk to the people concerned and notify affected clients and, where required, the relevant authority. We do not wait for a perfect picture before telling clients that something has happened.
You have the right to ask whether we hold personal data about you and to receive a copy of it. You have the right to ask us to correct data that is inaccurate. You have the right to ask us to stop using your data for a purpose you did not expect, such as marketing, and you have the right to object to processing based on legitimate interest. You have the right to ask for deletion where we no longer need the data and where no legal duty requires us to keep it.
Some rights are limited by the nature of our work. A request for deletion of a name inside a closed vault file may have to be refused while the file is within its retention period, because the integrity of the review record depends on the document set being intact. In that case we will explain the limit, tell you when the retention period ends and offer any alternative that is available, such as restricting access to the file.
You also have the right to be told the source of data we hold about you where you did not provide it yourself. In most cases the source is a client who sent us a document, and we can tell you the category of source without revealing the client identity where confidentiality requires it.
Send your request to connect@haersinvest.lat with the subject line Privacy Request, or write to the controller at Rm 15 5/F Hung Hom Commercial Centre Tower B, 37 Ma Tau Wai Rd, Hung Hom, Hong Kong - 999077, Hong Kong (HK). Please tell us what you want and how we can verify that you are the person concerned, which is usually enough if you write from the address we already hold.
We acknowledge a request within five working days and answer within thirty days. If a request is complex or covers a large file, we may extend the period and will tell you why. We do not charge a fee for an ordinary request. Where a request is manifestly unfounded or repetitive, we may explain why we are declining, and we will not simply ignore it.
If you are asking on behalf of someone else, we will need written authority from that person before we respond. This rule exists to stop anyone walking into a vault file through a polite email.
Our practice serves professional clients and is not directed at children. We do not knowingly collect personal data from anyone under the age of eighteen. If you believe that a child has sent us personal data, write to connect@haersinvest.lat and we will delete it promptly.
Occasionally a document we review may contain the name of a young person, for example where a tenement correspondence file includes a family trust reference. In such a case we treat the reference as confidential client material and apply the same protections as for any other personal data.
This website contains no content designed to attract children and no interactive features aimed at young people. Our contact form asks for a name, an email, a subject and a message, and it does not invite visitors to state their age.
We do not send marketing email. If you give us your contact details in the course of an enquiry, we use them to answer the enquiry and to manage any engagement that follows. We do not add you to a list and we do not share your details with a marketing partner.
If you would like to receive occasional practice notes on lithium record keeping, you can ask to join a small list and you can leave it at any time with a single reply. The list is held by us, is not rented out and is used only for material we write ourselves.
Business contacts met at conferences and industry events are held in an ordinary contact register with a note of where we met and what was discussed. Any such contact can ask to be removed at any time, and the removal is made within five working days.
We do not make automated decisions that carry legal or similarly significant effects for individuals. The review of a claims file is a human judgement made by a named reviewer and checked by a second person before the file closes. Software helps us to index documents and to search them, but it does not decide the outcome of a review.
Our website uses a small piece of script to reveal sections as you scroll and to open and close the questions in the contact page list. That script runs in your browser, does not send data to us and does not make any decision about you.
If we introduce a tool that profiles individuals in any way, we will describe it here and give you a way to object before the tool is used on your file. We do not intend to introduce such a tool, but the commitment to tell you first is unconditional.
Lithium review work involves commercially sensitive information about claims, grades and shipment plans. Confidentiality is therefore a core part of our privacy practice, and the two are handled together. A person named in a document is often identifiable through their role in a company, and the confidentiality of that role matters to the company as much as the personal privacy matters to the person.
We do not publish case studies that identify a client without written consent. We do not name a client in a conversation with another client. We do not use a client file as a teaching example in a public setting. Where we need to describe our work, we describe the method rather than the material, and we strip any detail that could identify a party.
Staff and contractors sign a confidentiality undertaking at the start of work and confirm it again at the close of each engagement. That undertaking survives the end of employment and covers personal data as well as commercial data. The combination of a privacy policy, a confidentiality undertaking and a vault file that records access is how we keep both promises at once.
We review this policy at least once a year and whenever our practice changes in a way that affects the handling of personal data. The date at the top of the page shows when the current version took effect. If a change is material, we will tell clients who hold an active file by email before the change takes effect.
Earlier versions of this policy are kept with the legal records of the company so that a question about past practice can be answered accurately. If you would like to see the version that applied at the time of a particular engagement, write to us and we will send a copy.
Continuing to use this website after a change takes effect means that the new version applies to visits made after that date. It does not change the terms of an engagement already in progress, which are governed by the engagement note and the policy in force when the work began.
If you are unhappy with how we have handled your personal data, tell us first. Write to connect@haersinvest.lat with the subject line Privacy Complaint, or call +18509772246 during business hours from Monday to Friday. Please describe what happened and what outcome you are seeking, and include any reference number we have given you.
We acknowledge a complaint within five working days and aim to answer within twenty working days. If the matter is complex we will tell you why it is taking longer and give you a date for our answer. Our answer will set out what we found, what we are doing about it and what you can do next if you remain dissatisfied.
You also have the right to complain to the Privacy Commissioner for Personal Data in Hong Kong. We would rather hear from you first, because most problems can be resolved in a single conversation, but we will never discourage you from using the statutory route.
For all other matters, including review enquiries and engagement questions, the fastest route is the contact page on this website. Written enquiries may be sent to connect@haersinvest.lat or posted to Huayou International Lithium (Hong Kong) Limited at Rm 15 5/F Hung Hom Commercial Centre Tower B, 37 Ma Tau Wai Rd, Hung Hom, Hong Kong - 999077, Hong Kong (HK).