Privacy Policy

Last Updated: February 25, 2026

This Privacy Policy explains how DimTax Consulting (the “Company“), being the operator of the website, application, and services at dimtax.com, collects, processes, and protects personal data in accordance with the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong.This Privacy Policy applies to all individuals who access, use, or interact with the Company’s website, application, or services, and whose personal data may be collected, processed, stored, or otherwise handled by the Company (referred to as “Users” or “Data Subjects“).

Background

The Company is committed to protecting the privacy and personal data of its Users in accordance with the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong and internationally recognized data protection principles.

The Company collects, processes, uses, and stores personal data of Users in connection with the provision of its services, website operations, customer support, and business activities.

This Privacy Policy sets out the Company’s practices regarding the collection, use, disclosure, retention, and protection of personal data, and explains the rights of Data Subjects under Hong Kong privacy law.

The Company recognizes the importance of transparency in data processing activities and seeks to provide clear information about how personal data is handled to enable informed decision-making by Users.

The Company implements appropriate technical and organizational measures to ensure the security and confidentiality of personal data and compliance with applicable privacy laws and regulations.

This Privacy Policy applies to all personal data collected by the Company through its website, mobile applications, services, and any other digital platforms or direct interactions with Users.

1. Definitions

1.1 Anonymized Data means personal data that has been processed in such a way that it can no longer identify a specific individual, either directly or indirectly, and cannot reasonably be re-identified.

1.2 Application means any mobile application, software application, or digital platform operated by the Company through which personal data may be collected.

1.3 Consent means any freely given, specific, informed and unambiguous indication of a Data Subject’s agreement to the processing of personal data relating to him or her.

1.4 Cookies means small text files or data stored on a User’s device by a web browser while browsing the Website, including session cookies, persistent cookies, and third-party cookies.

1.5 Data Processor means any person or entity (other than an employee of the Company) who processes personal data on behalf of the Company.

1.6 Data Protection Officer means the individual designated by the Company to oversee data protection compliance and serve as the point of contact for privacy-related inquiries and complaints.

1.7 Device Information means technical information about a User’s device, including IP address, browser type, operating system, device identifiers, and similar technical data.

1.8 Direct Marketing means the communication (by any means) of any advertising or marketing material which is directed to particular individuals, as defined under the Personal Data (Privacy) Ordinance.

1.9 Hong Kong means the Hong Kong Special Administrative Region of the People’s Republic of China.

1.10 Personal Data means any data relating to a living individual who can be identified from that data, or from that data and other information which is in the possession of, or is likely to come into the possession of, the data user, as defined under the Personal Data (Privacy) Ordinance.

1.11 PDPO means the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong, as amended from time to time.

1.12 Privacy Commissioner means the Privacy Commissioner for Personal Data established under the PDPO.

1.13 Processing means any operation performed on personal data, including collection, recording, organization, storage, adaptation, alteration, retrieval, consultation, use, disclosure, dissemination, erasure, or destruction.

1.14 Profiling means any form of automated processing of personal data to evaluate personal aspects relating to an individual, including analysis or prediction of performance, behavior, or preferences.

1.15 Pseudonymized Data means personal data that has been processed so that it can no longer be attributed to a specific Data Subject without the use of additional information, which is kept separately.

1.16 Sensitive Personal Data means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data, or data concerning sex life or sexual orientation.

1.17 Third Party means any person or entity other than the Company and the Data Subject, including service providers, business partners, and other organizations.

1.18 Tracking Technologies means cookies, web beacons, pixels, tags, scripts, and other similar technologies used to collect information about Users’ online activities.

1.19 Usage Data means information about how Users access and use the Website or Application, including pages visited, time spent, click-through rates, and interaction patterns.

1.20 Website means the Company’s website located at dimtax.com and any associated subdomains or related web properties operated by the Company.

Background

• The Company is committed to protecting the privacy and personal data of its Users in accordance with the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong and internationally recognized data protection principles.
• The Company collects, processes, uses, and stores personal data of Users in connection with the provision of its services, website operations, customer support, and business activities.
• This Privacy Policy sets out the Company’s practices regarding the collection, use, disclosure, retention, and protection of personal data, and explains the rights of Data Subjects under Hong Kong privacy law.
• The Company recognizes the importance of transparency in data processing activities and seeks to provide clear information about how personal data is handled to enable informed decision-making by Users.
• The Company implements appropriate technical and organizational measures to ensure the security and confidentiality of personal data and compliance with applicable privacy laws and regulations.
• This Privacy Policy applies to all personal data collected by the Company through its website, mobile applications, services, and any other digital platforms or direct interactions with Users.

2. Types of Personal Data Collected

2.1 The Company may collect the following categories of Personal Data from Users in connection with the provision of its services and Website operations:

2.2 Contact Information, including:

• Full name and title;
• Email addresses;
• Telephone and mobile phone numbers;
• Postal addresses and billing addresses;
• Company name and job title (where applicable).

2.3 Account and Profile Information, including:

• Username and password;
• Profile photographs and avatars;
• Biographical information and preferences;
• Account settings and configuration data.

2.4 Financial and Transaction Information, including:

• Payment card details and billing information;
• Bank account information;
• Transaction history and purchase records;
• Invoicing and payment status information.

2.5 Usage Data, including:

• Website and Application interaction data;
• Pages visited, features used, and time spent on platforms;
• Search queries and browsing history;
• Communication records and customer service interactions.

2.6 Device Information and Technical Data, including:

• IP addresses and device identifiers;
• Browser type and version;
• Operating system and device specifications;
• Location data and geolocation information;
• Network connection information.

2.7 Marketing and Communication Data, including:

• Marketing preferences and consent records;
• Survey responses and feedback;
• Event attendance and registration information;
• Communication history and engagement metrics.

2.8 Sensitive Personal Data may be collected only with explicit Consent or where permitted by law, including:

• Health information (where relevant to services);
• Identification documents (for verification purposes);
• Background check information (where legally required).

2.9 The Company does not intentionally collect Personal Data from children under the age of 13 without appropriate parental consent.

3. Methods of Data Collection

3.1 The Company collects Personal Data through various methods and channels as described in this section.

3.2 Website Collection: Personal Data is collected when Users visit, browse, or interact with the Company’s Website, including through contact forms, account registration, newsletter subscriptions, and automated data collection technologies.

3.3 Application Collection: Personal Data is collected through the Company’s mobile or desktop Applications when Users download, install, register, or use such Applications.

3.4 Direct Interactions: Personal Data is collected directly from Users through:

• telephone conversations, emails, and written correspondence;
• face-to-face meetings, consultations, and events;
• customer service interactions and support requests;
• surveys, feedback forms, and market research activities.

3.5 Third Party Sources: Personal Data may be obtained from Third Parties, including:

• business partners, affiliates, and service providers;
• publicly available sources and directories;
• social media platforms and professional networks;
• data brokers and marketing companies, where lawfully permitted.

3.6 Automated Technologies: Personal Data is collected automatically through:

• Cookies, web beacons, and similar Tracking Technologies;
• server logs and analytics tools that record Usage Data;
• device fingerprinting and identification technologies;
• location tracking technologies when location services are enabled.

3.7 Passive Collection: Certain Personal Data is collected passively without direct User input, including IP addresses, browser information, device characteristics, and browsing patterns.

3.8 The Company will inform Users about data collection methods at the point of collection where required by the PDPO and will obtain appropriate Consent where necessary.

4. Purposes of Data Processing

4.1 The Company processes Personal Data for the following primary purposes:

• To provide, maintain, and improve the Company’s services, products, and digital platforms;
• To process transactions, payments, and fulfill contractual obligations;
• To communicate with Users regarding services, account information, and customer support;
• To authenticate Users and maintain account security;
• To personalize User experience and provide relevant content and recommendations.

4.2 The Company may process Personal Data for Direct Marketing purposes, including:

• Promoting the Company’s products, services, and special offers;
• Conducting market research and customer satisfaction surveys;
• Sending newsletters, promotional materials, and marketing communications;
• Analyzing customer preferences and purchasing behavior for targeted marketing.

4.3 Personal Data may be processed for legal and regulatory compliance purposes:

• Complying with applicable laws, regulations, and legal obligations;
• Responding to lawful requests from government authorities, courts, or regulatory bodies;
• Establishing, exercising, or defending legal claims;
• Preventing fraud, money laundering, and other illegal activities.

4.4 The Company processes Personal Data for legitimate business operations:

• Maintaining business records and conducting internal administration;
• Performing data analytics to improve business performance and decision-making;
• Conducting risk assessment and management activities;
• Facilitating business transactions, mergers, or acquisitions;
• Training staff and quality assurance purposes.

4.5 Personal Data may be processed for safety and security purposes:

• Protecting the safety and security of Users, employees, and Company assets;
• Monitoring and preventing unauthorized access to systems and data;
• Investigating security incidents and policy violations;
• Ensuring compliance with internal policies and procedures.

4.6 Where Consent is required under the PDPO for any processing purpose, the Company will obtain such Consent before processing Personal Data for that purpose.

4.7 Users will be notified separately if Personal Data is to be used for any purpose not specified in this Privacy Policy.

5. Legal Basis for Processing

5.1 The Company processes Personal Data only where there is a lawful basis for such Processing under the PDPO and applicable Hong Kong law.

5.2 The primary lawful bases for Processing Personal Data are:

• Consent: Where the Data Subject has given clear and informed Consent for the Processing of their Personal Data for specific purposes.
• Contract Performance: Where Processing is necessary for the performance of a contract to which the Data Subject is a party, or to take steps at the request of the Data Subject prior to entering into a contract.
• Legal Obligation: Where Processing is necessary for compliance with a legal obligation to which the Company is subject under Hong Kong law or other applicable legislation.
• Vital Interests: Where Processing is necessary to protect the vital interests of the Data Subject or another person.
• Legitimate Interests: Where Processing is necessary for the purposes of legitimate interests pursued by the Company, except where such interests are overridden by the fundamental rights and freedoms of the Data Subject.

5.3 For Direct Marketing activities, the Company will obtain explicit Consent from Data Subjects before using their Personal Data for such purposes, in accordance with the PDPO requirements.

5.4 Where Consent is the lawful basis for Processing, Data Subjects have the right to withdraw their Consent at any time, which will not affect the lawfulness of Processing based on Consent before its withdrawal.

5.5 The Company will clearly communicate the specific lawful basis relied upon for each Processing activity when collecting Personal Data from Data Subjects.

6. Data Sharing and Disclosure

6.1 The Company may share Personal Data with Third Parties only in the circumstances set out in this section and in accordance with the PDPO and other applicable laws.

6.2 Service Providers: The Company may disclose Personal Data to Third Party service providers who assist in the operation of the Website, Application, or provision of services, including:

• hosting and cloud storage providers;
• payment processing and financial services providers;
• customer support and communication platforms;
• analytics and performance monitoring services;
• marketing and advertising service providers;
• professional advisors including lawyers, accountants, and consultants.

6.3 Business Partners: Personal Data may be shared with business partners where necessary for joint marketing activities, service integration, or collaborative business operations, provided such sharing is disclosed to Data Subjects and appropriate safeguards are in place.

6.4 Legal and Regulatory Disclosure: The Company may disclose Personal Data where required or permitted by law, including:

• compliance with court orders, subpoenas, or other legal processes;
• cooperation with law enforcement agencies or regulatory authorities;
• protection of the Company’s legal rights or property;
• prevention of fraud, security threats, or illegal activities;
• compliance with applicable laws and regulations in Hong Kong or other jurisdictions.

6.5 Business Transactions: Personal Data may be transferred or disclosed in connection with any merger, acquisition, sale of assets, bankruptcy, or other business transaction involving the Company, subject to appropriate confidentiality obligations.

6.6 Consent-Based Sharing: Personal Data may be shared with Third Parties where the Data Subject has provided specific Consent for such disclosure.

6.7 All Third Parties receiving Personal Data are required to implement appropriate security measures and use the Personal Data only for the specified purposes and in accordance with applicable data protection laws.

6.8 The Company does not sell Personal Data to Third Parties for monetary consideration.

7. International Data Transfers

7.1 The Company may transfer Personal Data outside Hong Kong to countries or territories that may not provide the same level of data protection as Hong Kong.

7.2 International transfers of Personal Data may occur in the following circumstances:

• To service providers, subsidiaries, or affiliates located outside Hong Kong who assist in providing our services;
• To cloud storage providers or data hosting services based in other jurisdictions;
• To comply with legal obligations or regulatory requirements in other jurisdictions;
• In connection with business transactions such as mergers, acquisitions, or asset sales involving entities outside Hong Kong.

7.3 Before transferring Personal Data internationally, the Company will implement appropriate safeguards, which may include:

• Ensuring the recipient country or territory has been recognized as providing adequate data protection;
• Entering into contractual arrangements with data recipients that include standard data protection clauses;
• Requiring recipients to implement technical and organizational measures to protect Personal Data;
• Obtaining explicit Consent from Data Subjects where required by the PDPO.

7.4 The Company will take reasonable steps to ensure that Personal Data transferred internationally will not be held, processed, or used in a manner that is inconsistent with this Privacy Policy or Hong Kong privacy laws.

7.5 Data Subjects may contact the Company to obtain information about the specific safeguards implemented for international transfers of their Personal Data.

8. Data Retention

8.1 The Company retains Personal Data only for as long as necessary to fulfill the purposes for which it was collected or as required by applicable law.

8.2 Personal Data retention periods are determined based on the following criteria:

• the nature and sensitivity of the Personal Data;
• the purposes for which the Personal Data is processed;
• legal, regulatory, or contractual requirements for retention;
• legitimate business needs and operational requirements;
• the potential risks to Data Subjects from continued retention.

8.3 Unless a longer retention period is required by law or legitimate business purposes, Personal Data will generally be retained for the following periods:

• customer account information: for the duration of the customer relationship plus seven (7) years after termination;
• transaction and financial records: seven (7) years from the date of the transaction;
• marketing and communication data: until withdrawal of Consent or three (3) years from last engagement;
• Website and Application Usage Data: twenty-four (24) months from collection;
• support and inquiry records: three (3) years from resolution of the matter;
• employment and recruitment data: seven (7) years from end of employment or unsuccessful application.

8.4 Personal Data that is no longer required will be securely deleted, destroyed, or Anonymized in accordance with the Company’s data destruction procedures.

8.5 The Company may retain Personal Data for longer periods where required by law, regulation, court order, or for the establishment, exercise, or defense of legal claims.

8.6 Data Subjects may request information about the retention period applicable to their Personal Data by contacting the Company using the details provided in Section 15.

9. Data Subject Rights

9.1 Right of Access: Data Subjects have the right to request access to their Personal Data held by the Company and to obtain information about how such Personal Data is being processed.

9.2 Right of Correction: Data Subjects may request correction of inaccurate or incomplete Personal Data concerning them.

9.3 Right to Object to Direct Marketing: Data Subjects have the right to object to the use of their Personal Data for Direct Marketing purposes without charge and without the need to give reasons.

9.4 Right to Request Data Use Limitation: Data Subjects may request the Company to cease or restrict certain Processing activities of their Personal Data where permitted by law.

9.5 Right to Data Portability: Where technically feasible, Data Subjects may request to receive their Personal Data in a structured, commonly used format or request its transfer to another data controller.

9.6 Exercise of Rights: Data Subjects may exercise their rights by contacting the Company using the contact details provided in Section 15 of this Privacy Policy.

9.7 Verification of Identity: The Company may require reasonable proof of identity before responding to requests to exercise Data Subject rights to prevent unauthorized access to Personal Data.

9.8 Response Timeline: The Company will respond to valid requests within forty (40) days of receipt, or such other period as may be prescribed under the PDPO.

9.9 Fees: The Company may charge a reasonable fee for processing requests that are manifestly unfounded, excessive, or repetitive, or as otherwise permitted under Hong Kong law.

9.10 Right to Complain: Data Subjects have the right to lodge a complaint with the Privacy Commissioner if they believe their Personal Data has been processed in violation of the PDPO.

10. Cookies and Tracking Technologies

10.1 The Company uses Cookies and other Tracking Technologies on its Website and Application to enhance user experience, analyze usage patterns, and provide personalized services.

10.2 Types of Cookies Used:

• Essential Cookies – necessary for basic website functionality and cannot be disabled.
• Performance Cookies – collect information about how users interact with the Website to improve performance.
• Functional Cookies – remember user preferences and choices to provide enhanced features.
• Marketing Cookies – track users across websites to deliver targeted advertising and measure campaign effectiveness.

10.3 Other Tracking Technologies:

• Web Beacons – small graphic images used to track user behavior and email engagement.
• Pixel Tags – collect information about user interactions with web pages and advertisements.
• Local Storage – stores data locally on user devices for enhanced functionality.

10.4 The Company may allow Third Parties to place Cookies and Tracking Technologies on its platforms for analytics, advertising, and social media integration purposes.

10.5 Cookie Management and Opt-Out Options:

• Users may manage cookie preferences through their browser settings to block, delete, or receive notifications about cookies.
• Disabling essential Cookies may affect Website functionality and user experience.
• Users may opt out of marketing Cookies through the Company’s cookie preference center or browser settings.
• Third-party opt-out mechanisms are available through relevant advertising networks and analytics providers.
• Cookie information is retained for varying periods depending on the type and purpose, with most cookies expiring within 12 months of placement.
• The Company will obtain Consent for non-essential Cookies where required by applicable law before placing such Cookies on user devices.

11. Data Security

11.1 The Company implements appropriate technical and organizational measures to protect Personal Data against unauthorized access, alteration, disclosure, destruction, loss, or misuse.

11.2 Technical security measures include but are not limited to:

• Encryption of Personal Data both in transit and at rest using industry-standard encryption protocols;
• Secure data transmission protocols including SSL/TLS encryption for data transfers;
• Access controls and authentication mechanisms including multi-factor authentication where appropriate;
• Regular security updates and patches to systems and software;
• Firewalls, intrusion detection systems, and network security monitoring;
• Regular automated backups with secure storage and tested recovery procedures.

11.3 Organizational security measures include but are not limited to:

• Limiting access to Personal Data to authorized personnel on a need-to-know basis;
• Regular training of employees on data protection and security practices;
• Implementation of confidentiality agreements and data protection policies for all personnel;
• Regular security audits and vulnerability assessments;
• Incident response procedures for data breaches and security incidents;
• Secure disposal procedures for Personal Data that is no longer required.

11.4 The Company requires Third Party service providers and Data Processors to implement similar security measures and to comply with contractual data protection obligations.

11.5 Despite these security measures, the Company cannot guarantee absolute security of Personal Data transmitted over the internet or stored electronically, and Users acknowledge the inherent risks of electronic data transmission.

11.6 In the event of a data breach that creates a risk of harm to Data Subjects, the Company will notify the Privacy Commissioner and affected individuals as required under the PDPO and applicable laws.

11.7 The Company regularly reviews and updates its security measures to address evolving threats and maintain compliance with current data protection standards and legal requirements.

12. Third-Party Links and Services

12.1 The Company’s Website and Application may contain links to third-party websites, applications, or services that are not owned or controlled by the Company.

12.2 The Company is not responsible for the privacy practices, content, or data protection policies of any Third Party websites, applications, or services.

13.3 This Privacy Policy does not apply to any Third Party websites, applications, or services, even if accessed through links provided on the Company’s platforms.

12.4 Users are advised to review the privacy policies and terms of service of any Third Party websites, applications, or services before providing Personal Data or using such services.

12.5 The Company may integrate Third Party services, plugins, or widgets into its Website or Application, including but not limited to:

• social media platforms and sharing buttons;
• payment processing services;
• analytics and advertising services;
• customer support tools; and
• content delivery networks.

12.6 When Users interact with integrated Third Party services, such services may collect Personal Data directly from Users in accordance with their own privacy policies.

12.7 The Company makes no representations or warranties regarding the security, privacy practices, or data handling procedures of any Third Party services.

12.8 Users acknowledge that the Company cannot control the data processing activities of Third Party services and use such services at their own risk.

12.9 Any disputes arising from the use of Third Party services or their privacy practices shall be resolved directly between the User and the relevant Third Party.

13. Children’s Privacy

13.1 The Company does not knowingly collect Personal Data from children under the age of 13 years without appropriate parental or guardian consent.

13.2 Where the Company becomes aware that Personal Data has been collected from a child under 13 years of age without verified parental consent, the Company will take reasonable steps to delete such information from its systems as soon as practicable.

13.3 For children between the ages of 13 and 18 years, the Company may collect Personal Data with the child’s consent, provided that:

• the child demonstrates sufficient understanding of the nature and consequences of the Processing; and
• the Company takes additional safeguards to protect such Personal Data, including limiting data sharing with Third Parties.

13.4 Parents and guardians have the right to:

• request access to their child’s Personal Data held by the Company;
• request correction or deletion of their child’s Personal Data;
• withdraw consent for the Processing of their child’s Personal Data; and
• object to Direct Marketing directed at their child.

13.5 The Company will implement age-appropriate privacy notices and obtain verifiable parental consent through reasonable methods, which may include requiring a signed consent form, credit card verification, or other reliable means of age and identity verification.

13.6 Where services are directed primarily at children, the Company will ensure that privacy notices are written in language that children can understand and will not collect more Personal Data than is reasonably necessary for the child to participate in the activity.

14. Changes to Privacy Policy

14.1 The Company reserves the right to update, modify, or revise this Privacy Policy at any time to reflect changes in its data processing practices, legal requirements, or business operations.

14.2 Material changes to this Privacy Policy will be notified to Users through one or more of the following methods:

• Email notification sent to the registered email address of Users;
• Prominent notice displayed on the Website or Application;
• Push notification through the Company’s mobile Application;
• Direct communication through the User’s account dashboard or profile.

14.3 Material changes include modifications that significantly affect the purposes of data processing, categories of personal data collected, data sharing arrangements, retention periods, or User rights under this Privacy Policy.

14.4 Non-material changes, including administrative updates, clarifications, or corrections that do not affect Users’ rights or the Company’s data processing practices, may be implemented without prior notice.

14.5 The updated Privacy Policy will become effective thirty (30) days after notification of material changes, unless Users are required to provide explicit consent for the changes, in which case the updated policy will become effective upon such consent.

14.6 Users who do not agree to material changes may terminate their account or discontinue use of the Company’s services before the updated Privacy Policy becomes effective.

14.7 Continued use of the Company’s services after the effective date of the updated Privacy Policy constitutes acceptance of the revised terms, except where explicit consent is required under applicable law.

14.8 Previous versions of this Privacy Policy will be archived and made available upon request for a period of three (3) years from the date of replacement.

Contact Information

15.1 For any questions, concerns, or complaints regarding this Privacy Policy or the Company’s processing of Personal Data, Data Subjects may contact the Company’s Data Protection Officer using the following details:

Email: support@dimtax.com
Telephone: 852-8433-0577

15.2 Data Subjects may use the above contact information to:

• Make enquiries about the Company’s data processing activities;
• Exercise their rights under the PDPO including data access, correction, or erasure requests;
• Lodge complaints regarding alleged breaches of privacy or data protection;
• Request clarification about this Privacy Policy or the Company’s privacy practices;
• Opt-out of Direct Marketing communications or update communication preferences.

15.3 The Company will acknowledge receipt of all privacy-related communications within five (5) business days and provide a substantive response within forty (40) days of receipt, or such other timeframe as may be required under applicable law.

15.4 Data Subjects may also lodge complaints directly with the Privacy Commissioner for Personal Data, Hong Kong if they are not satisfied with the Company’s response to their privacy concerns.

Governing Law and Jurisdiction

16.1 This Privacy Policy and any disputes or claims arising out of or in connection with it or its subject matter or formation (including non-contractual disputes or claims) shall be governed by and construed in accordance with the laws of Hong Kong.

16.2 Any dispute arising out of or in connection with this Privacy Policy, including any question regarding its existence, validity, interpretation, or termination, shall be subject to the exclusive jurisdiction of the courts of Hong Kong.

16.3 The Company and Users irrevocably agree that the courts of Hong Kong shall have exclusive jurisdiction to settle any dispute which may arise out of or in connection with this Privacy Policy.

16.4 Nothing in this section shall prevent the Company from seeking injunctive or other equitable relief in any jurisdiction where a breach of this Privacy Policy may occur or be threatened.

16.5 This Privacy Policy has been prepared in the English language and such English language version shall be controlling and shall prevail in the event of any inconsistencies with translations into other languages.

This Privacy Policy may be updated from time to time in accordance with Section 14 “Changes to Privacy Policy” section hereof.