CorpSec - Your company, anywhere it matters

1. Who we are

This Privacy Policy explains how CorpSec ('CorpSec', 'we', 'us') handles personal data when you visit corpsec.io, talk to Gabriella, contact us, or use our platform to form and manage a company.

CorpSec is the controller of your personal data. Our registered address is Unit 2A, 17/F, Glenealy Tower, No. 1 Glenealy, Central, Hong Kong. You can reach us about anything in this policy at hello@corpsec.io.

We process personal data in line with the Hong Kong Personal Data (Privacy) Ordinance and, where it applies to you, the EU and UK General Data Protection Regulation (GDPR).

2. Information we collect

Information you give us:

Contact and enquiry details: your name, email address, phone number, company and the message you send us through the contact form or when you book a call.
Quiz and report details: your answers to the jurisdiction quiz and the email address you give us to receive your report.
Conversations with Gabriella: the questions you ask our AI advisor and the answers it gives.
Account details: your name, email address and the credentials you use to sign in.
Company formation details: information about founders, directors and shareholders (such as full legal name, email, phone, nationality and country of residence), the proposed company name, business activity, share capital and other details needed to register and run the company.
Identity and verification documents: copies of passports, proof of address and other documents required by corporate service providers and anti-money-laundering rules.
Payment details: payments are processed by Stripe. We receive confirmation of the payment and limited details such as the amount and the last digits of the card, but we do not see or store your full card number.

Information we collect automatically:

Usage data: pages visited, clicks, time on page, device and browser type, approximate location derived from your IP address, and similar technical data, collected through our analytics provider (PostHog).
Session recordings: we may record how visitors interact with the site to find and fix usability problems. Text you type into form fields is masked in these recordings.
Attribution data: the page you first landed on, the website that referred you, and any campaign (UTM) parameters in the link you followed.
Preferences: your chosen language and currency, and the progress you have made in the company formation flow.

3. How we use your information

To provide our services: recommending jurisdictions, preparing and filing company formations, and delivering registered-agent, accounting and compliance services through our partners.
To verify identity and meet legal obligations, including anti-money-laundering, know-your-customer and beneficial-ownership requirements.
To reply to your enquiries, arrange calls and provide customer support.
To process payments and keep financial records.
To send you the reports or briefings you asked for. You can unsubscribe at any time.
To understand how the site is used, measure our marketing, and improve our services and Gabriella's answers.
To keep the platform secure and prevent fraud and misuse.

4. Legal bases (GDPR)

Where the GDPR applies, we rely on the following legal bases:

Contract: to provide the services you ask for, and to take steps at your request before entering into a contract.
Legal obligation: to carry out identity checks and keep records required by law.
Legitimate interests: to run, secure and improve our website and services, and to understand which channels bring visitors to us, where these interests are not overridden by your rights.
Consent: where we ask for it, for example for optional marketing emails. You can withdraw consent at any time.

5. Who we share it with

We do not sell your personal data. We share it only where needed to provide our services or when the law requires it:

Licensed corporate service providers and regulated professionals in the jurisdiction where your company is formed, who carry out the incorporation, registered-agent, accounting and compliance work.
Company registries, tax authorities, banks and other public or regulatory bodies, where filing or disclosure is part of the service or required by law.
Service providers who act on our behalf, including hosting and file storage, payment processing (Stripe), analytics (PostHog), meeting scheduling (Cal.com), email delivery and the AI model providers that power Gabriella. They may use your data only to provide their services to us.
Professional advisers, auditors and insurers, where needed.
A buyer or successor, if CorpSec is involved in a merger, acquisition or sale of assets.
Law enforcement or courts, where we are legally required to do so.

6. International transfers

Because we form companies in many jurisdictions and use service providers based in different countries, your data may be transferred to and processed in countries other than your own, including Hong Kong, the United States, the European Union and the jurisdiction where your company is formed.

Where the GDPR applies, we protect these transfers with appropriate safeguards, such as the European Commission's standard contractual clauses or an adequacy decision.

7. Cookies and similar technologies

We use cookies and browser storage to make the site work and to understand how it is used:

Essential: remembering your language and currency, keeping you signed in, and saving your progress in the company formation flow.
Analytics: PostHog cookies that help us measure visits and usage.
Attribution: remembering how you first found us, so we can tell which campaigns are working.

You can block or delete cookies in your browser settings. Some parts of the site, such as the formation flow, may not work properly without them.

8. How long we keep it

We keep personal data only for as long as we need it for the purposes described in this policy.

Enquiries and quiz leads: for as long as needed to respond and follow up, unless you ask us to delete them sooner.
Customer, company and identity records: for the duration of our relationship and afterwards for the period required by anti-money-laundering, tax and company laws.
Analytics data: for a limited period, after which it is deleted or aggregated.

9. How we protect it

We use technical and organisational measures to protect your data, including encryption in transit, restricted access to identity documents, and contracts with our service providers that require them to keep your data secure.

No method of transmission or storage is completely secure. If a data breach affects you, we will notify you and the relevant authorities where the law requires it.

10. Your rights

Depending on where you live, you may have the right to:

Access the personal data we hold about you and receive a copy of it.
Correct data that is inaccurate or incomplete.
Ask us to delete your data, unless we must keep it by law.
Object to or ask us to restrict certain processing, including direct marketing.
Receive your data in a portable format.
Withdraw consent you have given us.

To exercise any of these rights, email hello@corpsec.io. We may need to verify your identity before acting on your request. If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner for Personal Data in Hong Kong or to the data protection authority in your country.

11. Children

Our services are intended for adults forming and running companies. We do not knowingly collect personal data from anyone under 18.

12. Changes to this policy

We may update this policy from time to time. The date at the top of this page shows when it was last changed. If we make significant changes, we will let you know by email or through a notice on the site.

13. Contact us

If you have any questions about this policy or how we handle your data, email hello@corpsec.io or write to CorpSec, Unit 2A, 17/F, Glenealy Tower, No. 1 Glenealy, Central, Hong Kong.