Privacy Policy

Brainexis Tech Limited (CR 80815493), 8/F, China Hong Kong Tower, 8 Hennessy Road, Wan Chai, Hong Kong, is the data user and controller responsible for the personal data described in this policy. Contact us at info@brainexistech.com for any privacy matter.

This policy explains what personal data we collect through brainexistech.com and in the course of providing our Services, why we collect it, how we use and protect it, and the rights available to you.

We never see or store your full card number, expiry date or security code. Card details are entered directly with our PCI-DSS compliant payment provider and are not transmitted to or held on our systems.

• To respond to enquiries and prepare proposals — steps taken at your request before entering a contract.
• To deliver the Services and manage your project — performance of our contract with you.
• To take payment, issue invoices and handle refunds or disputes — performance of contract and compliance with legal obligations.
• To prevent fraud and secure our systems — our legitimate interest in protecting the business and our clients.
• To improve the Site and our Services — our legitimate interest, using aggregated or de-identified analytics wherever possible.
• To send marketing emails — your consent, which you may withdraw at any time.
• To meet accounting, tax and regulatory obligations — compliance with legal obligations.

We do not sell personal data and we do not share it for third-party advertising. We share it only with service providers who help us operate, each bound by confidentiality and data protection obligations:

• Payment providers, for processing card payments and handling refunds and disputes.
• Hosting, cloud storage and email providers.
• Analytics and website performance tools.
• Project management and communication tools used to run your engagement.
• Professional advisers, including accountants, auditors and lawyers.
• Regulators, law enforcement or courts, where we are legally required to disclose.

We are based in Hong Kong and use service providers located in other jurisdictions. Where personal data is transferred outside your jurisdiction, we take reasonable steps to ensure it is protected to a comparable standard, including through contractual safeguards with our providers.

• Enquiries that do not become projects: up to 24 months.
• Client contracts, invoices and payment records: 7 years, to meet accounting and tax requirements.
• Project files and deliverables: 12 months after final handover, unless you ask us to delete them sooner or the Proposal says otherwise.
• Marketing subscriptions: until you unsubscribe.
• Website analytics: up to 26 months.

We apply reasonable technical and organisational measures to protect personal data, including encryption in transit, access control on a need-to-know basis, secured credential storage, and staff confidentiality obligations. No system can be guaranteed completely secure; if a breach affects your personal data and poses a real risk to you, we will notify you and the relevant authority as required.

Subject to applicable law, you may:

• Request access to the personal data we hold about you.
• Ask us to correct data that is inaccurate or incomplete.
• Ask us to delete data we no longer need to hold.
• Object to or ask us to restrict certain processing.
• Withdraw consent to marketing at any time, using the unsubscribe link or by emailing us.
• Request a copy of data you provided in a portable format, where applicable.

Send any request to info@brainexistech.com. We respond within 30 days. We may ask you to verify your identity first. If you are in Hong Kong and are not satisfied with our response, you may complain to the Office of the Privacy Commissioner for Personal Data. If you are in the European Economic Area or the United Kingdom, you may complain to your local supervisory authority.

Our Site and Services are intended for business users and are not directed at children under 16. We do not knowingly collect personal data from children. If you believe we have, contact us and we will delete it.

When we build or maintain a platform for you, we may access personal data belonging to your own customers. In that context you are the controller and we act as a processor: we use that data only to perform the Services, on your instructions, and we do not use it for our own purposes. A separate data processing agreement is available on request.

We may update this policy from time to time. The date at the top shows when it was last revised, and material changes will be notified to active clients by email. See also our Cookie Policy.