DRAFT - not legal advice - review before publishing

Privacy Notice & Personal Information Collection Statement (PICS)

Data user: the individual operator of Harbour & Wall, based in Hong Kong. This is a free project with no company behind it.
Contact for all privacy matters: Privacy Officer, casperwong167@gmail.com. See section 6.
Last updated: 1 October 2026 | Consent wording version: v1

This notice explains how your data is handled when you use our sign-up form. It is written to meet the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486, "PDPO"), including Data Protection Principle 1 and Part 6A on direct marketing.

1. What we collect

Email address (required only so we can send you the free template).
Tips consent (optional): whether you ticked the box to receive career-prep tips and marketing emails.
Waitlist interest (optional): whether you ticked the box saying you would consider paying for a buy-side (hedge fund) recruiting kit and may receive information about it.
Basic email activity recorded automatically by our email provider: sign-up date and form, whether emails are opened and links clicked, and approximate location based on your IP address.
How you found us (recorded automatically from the link you used): campaign/source tags in the page link (UTM parameters, such as which site or post referred you). We don't use them to identify you.
Region (optional, waitlist only): the region you select, such as Hong Kong, US, or UK, so we can judge where interest in a paid kit comes from.

We collect no payment or purchase data. Everything we offer is free.

2. Why we collect it (purposes)

Everyone: to send you the free investment banking resume template you asked for, which is a one-off delivery email.
Only if you tick the tips box: to send occasional career-preparation emails, such as recruiting tips, checklists, and new free resources.
Only if you tick the waitlist box: to gauge interest in a possible future paid buy-side kit (no product exists yet and nothing is for sale), and to send you information about paid career-prep products (e.g. a buy-side kit) if we make one.
To understand which channels bring sign-ups (source tags) and where waitlist interest comes from (region), in aggregate.
To keep the list working and respect your choices, for example by removing bounced addresses, keeping records of consent and opt-outs, and seeing which content is useful.

We will not use your data for any other purpose without your consent.

3. Is providing data voluntary?

Yes. All information you give us is voluntary. We need your email address to send the template, so if you don't give one we can't send it. Both checkboxes are optional and unticked by default. You get the template whether or not you tick them.

4. Who we transfer data to (classes of transferees)

Kit (kit.com, operated by ConvertKit LLC), our email service provider. Kit acts as our data processor: it stores the list and sends emails on our behalf, and may use its own sub-processors such as cloud hosting. Kit is based and hosts data outside Hong Kong (mainly in the United States), so your data will be transferred and stored outside Hong Kong. We rely on Kit's contractual data-protection commitments (including its Data Processing Addendum) to protect it.
Authorities, where the law requires it.
A successor entity: if a company or other entity later takes over this project, your data may be transferred to it, to be used only for the same purposes described in this notice and subject to the choices you have made. We will tell you before the transfer, and you can unsubscribe or ask for deletion first.

We do not sell, rent, or trade your personal data, and we do not give it to third parties for their own marketing.

5. Direct marketing (PDPO Part 6A)

We intend to use personal data for direct marketing, but only if you give consent by ticking the relevant box.

Kinds of personal data used: your email address, and your tips and waitlist choices.
Classes of marketing subjects:
- (a) tips box: free finance-recruiting and career-preparation resources, such as resume templates, interview and screener checklists, and guides;
- (b) waitlist box: information about paid career-prep products (e.g. a buy-side kit) if we make one. No such product exists yet and nothing is for sale.
How you give consent: each box is separate, optional, and unticked by default. Ticking a box and submitting the form (then confirming your email) is your consent for that class only. We never pre-tick boxes or treat silence as consent.
Refusing or withdrawing consent has no consequence. If you don't tick either box, or later withdraw, you still receive the free template, and it makes no other difference. You will simply not get marketing emails.
Opting out: you can withdraw consent at any time, free of charge, by clicking the unsubscribe link in any marketing email or by emailing the Privacy Officer at casperwong167@gmail.com. Opt-outs are processed promptly, and your address goes on a suppression list so you won't receive marketing again. A confirmation of the opt-out is the only possible exception.
If you gave neither consent, the only email you will get is the template delivery email, plus a sign-up confirmation email if one is needed.

6. Access, correction, and who to contact

Under the PDPO you have the right to ask whether we hold data about you, to get a copy, and to have it corrected. You can also ask us to delete it or withdraw consent. Send requests to:

Privacy Officer, Harbour & Wall
Email: casperwong167@gmail.com (subject: "Data access/correction request")

We will reply within 40 days, as the PDPO requires. We may charge a reasonable, non-excessive fee for data access requests, though we normally won't. Correcting or deleting your data, or opting out, is free.

If you're in the EU or UK, we send the template because you asked for it, and we send marketing emails (tips or waitlist) only based on your consent, which you can withdraw at any time. Your data is transferred to Kit in the US under Kit's safeguards (Standard Contractual Clauses or equivalent). You have the rights to access, rectify, erase, restrict, object, and data portability, and you can complain to your local data protection authority. If you're in California, we do not sell or share personal information, and you can ask us to access or delete your data.

8. How long we keep data

Template-only sign-ups (no consent): deleted from Kit within 90 days of the template being delivered.
Subscribers who consented: kept until you unsubscribe or ask us to delete your data. We may remove subscribers who have not opened any email in 12 months.
Consent and opt-out records: kept as long as needed to prove consent and honour opt-outs. A minimal suppression record (email or subscriber ID) is kept so you are never emailed marketing again. Ask us if you want it fully deleted.
Waitlist interest: deleted if no paid kit launches within 24 months.
If the project closes: we will delete the list.

9. Security

The list is held only in Kit, in an account protected by a strong password and two-factor authentication, and only the operator (and tools acting on the operator's instructions) can access it. Internal consent and suppression logs use subscriber IDs or hashed emails where possible. We don't keep separate spreadsheet copies except for temporary exports that are deleted after use. No system is perfectly secure. If a breach happens that is likely to affect you, we will tell you.

10. Other points

The form is intended for students and professionals aged 16 and over.
Our website may use basic analytics or Kit's own tracking of opens and clicks, as described in section 1.
If this notice changes, we will update the date above. We will tell subscribers by email before any change to how we use data for direct marketing.