This Privacy Policy explains how NeoX Business Intelligence Limited handles personal data across its website at www.neoxbi.lol and across the reporting engagements it delivers to clients. The policy is published by NeoX Business Intelligence Limited, the developer of the site and the studio behind the reporting services described on it. The practice is led by the developer known as NeoX BI, whose team works from the office at Rm 704 7/F NEW MANDARIN PLZ TWR A, 14 SCIENCE MUSEUM RD, Hong Kong (HK). We have written this policy in plain English so that a reader can understand, without a legal dictionary, what we collect, why we collect it, how long we keep it and how a person can ask us to change or remove it.
1. Who We Are
NeoX Business Intelligence Limited is a company registered in Hong Kong that designs dashboard walls, KPI libraries, data pipelines and board reporting for organisations in professional, scientific and technical fields. The registered office and the working studio are both at Rm 704 7/F NEW MANDARIN PLZ TWR A, 14 SCIENCE MUSEUM RD, Hong Kong (HK). For the purposes of data protection law, the company is the controller of the personal data described in this policy, except where a client agreement states otherwise for work performed on a client system.
The company is the developer of this website and is responsible for its content, its forms and the technical arrangements that support them. A single point of contact handles all privacy questions, and that contact can be reached at hello@neoxbi.lol or by telephone at +14057833811 during the business hours stated on the contact page.
2. Scope of This Policy
This policy applies to personal data collected through the website, through email and telephone enquiries, through proposals and contracts, and through the reporting engagements the studio delivers. It does not apply to third party websites that may be reached from a link on this site, and it does not override the terms of a signed client agreement where that agreement sets different rules for the handling of client data.
Where the company processes personal data on behalf of a client as part of a reporting project, the client remains the controller of that data. In those cases the company acts as a processor, follows the written instructions in the engagement agreement, and refers any request from a data subject back to the client unless the agreement states otherwise.
3. Data We Collect
We collect only the data that is needed to answer an enquiry, deliver a service, meet a legal duty or keep the website working. The categories we may hold are set out below.
- Identity data such as name, job title and organisation name.
- Contact data such as email address, telephone number and postal address.
- Enquiry data such as the subject line and the content of a message sent through the contact form.
- Contract data such as proposals, signed agreements, invoices and payment references.
- Technical data such as browser type, device type, screen size, language setting and the pages visited.
- Usage data such as the time of a visit, the referring page and the links followed.
- Project data such as notes, definitions, diagrams and meeting records created during an engagement.
We do not ask for special category data, and we do not ask for payment card numbers through this website. If a person chooses to send sensitive information in a free text field, we will treat it as part of the enquiry and handle it with the same care as the rest of the message.
4. How We Collect Data
Most of the personal data we hold comes directly from the person concerned. A visitor may complete the contact form, send an email, place a telephone call or hand over a business card at a meeting. A client may provide contact details for staff who will take part in a reporting project. In each case the data arrives as part of a normal business conversation.
A smaller amount of data is collected automatically when a person visits the website. The server records a limited set of technical details for security and troubleshooting, and the analytics described later in this policy may record aggregated usage information. We do not buy personal data from data brokers, and we do not build profiles of visitors from data sourced outside the website.
5. Purposes and Legal Basis
We use personal data to answer enquiries, prepare proposals, deliver reporting services, issue invoices, keep accounting records, protect the website and meet legal obligations. Each use rests on one of the following grounds.
- Performance of a contract, where the data is needed to deliver a service or manage an engagement.
- Legitimate interests, where the data is needed to answer an enquiry, secure the website or run the business in a reasonable way.
- Legal obligation, where a record must be kept for tax, accounting or regulatory purposes.
- Consent, where a person has clearly agreed to receive marketing messages or has asked for a specific optional contact.
Where we rely on legitimate interests, we balance the interest of the business against the rights of the person concerned. If the balance does not favour the business, we do not proceed with that use. Where we rely on consent, the person may withdraw it at any time by writing to the contact address given at the end of this policy.
7. Analytics and Server Logs
The web server keeps technical logs that record the time of a request, the page requested, the response code, the approximate originating region and the browser identifier sent by the visitor. These logs are used to detect abuse, diagnose faults and understand which pages are read most often. They are not used to identify an individual visitor and are not combined with any other record to build a personal profile.
If an analytics tool is used, it is configured to avoid collecting full internet protocol addresses and to avoid cross site tracking. The information is reviewed in aggregate, and the retention period for analytics records is kept as short as is practical for the purpose of understanding website usage.
8. Client Reporting Data
Reporting projects often involve access to operational data that belongs to a client. That data may contain personal information such as staff identifiers, customer records or transaction details. We treat all such data as confidential, access it only for the purpose described in the engagement, and keep it inside the environments agreed with the client.
Where possible, we prefer to work with aggregated or pseudonymised extracts rather than raw personal records. When a client asks us to process personal data directly, we follow the written instructions in the agreement, apply the security measures described in this policy, and return or delete the data at the end of the engagement according to the terms of the contract.
Project notes and working files are stored in access controlled folders. Sharing with a client is done through a named channel agreed at the start of the project, and access is removed when the engagement closes. We do not reuse client data for any other purpose, and we do not sell it.
10. Service Providers
The company uses a small set of service providers to run the website and the business. These include a hosting provider for the website files, an email provider for the hello@neoxbi.lol mailbox, and an accounting service for invoices and records. Each provider processes data only as instructed and only for the function it supplies.
Before a new provider is engaged, we check its security posture, its data location and its approach to sub-processors. A provider that cannot meet the standard set out in this policy is not used. The list of providers is reviewed at least once a year, and any material change is reflected in this policy.
11. International Transfers
The studio is based in Hong Kong, and the website may be hosted in a region outside Hong Kong. Where personal data is transferred across a border, we take steps to ensure that the protection travels with it. These steps may include a written contract with standard data protection terms, a check on the legal framework of the destination country, or the use of a provider that keeps the data within a region with comparable safeguards.
A person who wishes to know more about the safeguards used for a particular transfer may write to the contact address at the end of this policy, and we will explain the arrangement in plain terms.
12. Retention Periods
We keep personal data only for as long as it is needed for the purpose for which it was collected, or for as long as the law requires. The general periods are set out below, and a specific period in a client agreement takes precedence where it applies.
- Enquiry messages are kept for up to twenty four months after the last reply, so that we can follow up on a conversation.
- Contract and invoice records are kept for seven years to meet accounting and tax duties.
- Project working files are kept for the duration of the engagement and for a short handover period afterwards.
- Server logs are kept for a short technical window and then deleted or overwritten.
- Marketing consent records are kept until consent is withdrawn, plus a short period to prove the withdrawal.
When a retention period ends, the data is deleted or anonymised so that it can no longer be linked to a person. Where deletion is not immediately possible because of a backup cycle, the data is isolated and left untouched until the backup is overwritten.
13. Security Measures
We protect personal data with a combination of technical and organisational measures. Access to the mailbox and to project folders is limited to the people who need it, protected by strong passwords and two factor authentication. Devices are encrypted, software is kept up to date, and access is removed promptly when a person leaves the team or a project ends.
The website is served over an encrypted connection, and the contact form does not store messages on the server; it prepares an email in the visitor own mail application. Physical documents are kept in a locked cabinet at the studio and are shredded when they are no longer needed.
No system is perfectly secure. If a breach occurs that is likely to affect the rights of a person, we will notify the affected parties and the relevant authority within the time required by law, and we will describe what happened, what was affected and what steps are being taken to reduce the risk.
14. Your Rights
A person whose data we hold has a set of rights over that data. These rights are not absolute, and some are subject to conditions, but we take every request seriously and answer it within the period required by law.
- The right to be told what data we hold and why we hold it.
- The right to receive a copy of the data in a readable format.
- The right to have inaccurate data corrected.
- The right to have data erased where there is no continuing reason to keep it.
- The right to restrict how the data is used while a question is being resolved.
- The right to object to a use based on legitimate interests.
- The right to withdraw consent where consent is the basis for a use.
- The right to complain to a supervisory authority.
To exercise a right, write to hello@neoxbi.lol with enough detail for us to find the record, such as the email address used in the original contact. We may ask for proof of identity before acting, to avoid releasing data to the wrong person. There is normally no charge, and we aim to reply within one month.
15. Privacy for Children
The services of NeoX Business Intelligence Limited are intended for organisations and their staff. The website is not directed at children, and we do not knowingly collect personal data from a child. If a message reaches us that appears to come from a child, we will not use the data for marketing and will delete it once the enquiry is answered unless a legal duty requires us to keep it.
A parent or guardian who believes that a child has sent personal data to the studio may write to the contact address at the end of this policy, and we will help to locate and remove the record promptly.
16. Marketing Messages
We send marketing messages only where a person has asked to receive them or where the law allows a message to be sent to an existing business contact on a closely related subject. Every message includes a way to stop receiving further messages, and a request to stop is honoured without any need to explain why.
Withdrawing consent for marketing does not affect the messages needed to deliver a service, such as a project update or an invoice. Those messages are part of the engagement and are sent under the contract rather than under consent.
17. Changes to This Policy
We review this policy from time to time and update it when the way we work changes, when a new provider is engaged or when the law requires a different wording. The current version is always the one published on this page. Where a change is material, we will add a clear notice on the page and, where we hold a contact address, send a short message to the people most likely to be affected.
Continuing to use the website after an update means that the new version applies to the data collected from that point onward. Data already held continues to be handled under the policy that was in force when it was collected, unless the new policy offers stronger protection.
18. How to Contact Us
Privacy questions, requests and complaints should be sent to NeoX Business Intelligence Limited at Rm 704 7/F NEW MANDARIN PLZ TWR A, 14 SCIENCE MUSEUM RD, Hong Kong (HK). The email address for all privacy matters is hello@neoxbi.lol, and the telephone number is +14057833811. The studio answers calls during business hours from Monday to Friday.
If a person is not satisfied with the answer received, that person may raise the matter with the supervisory authority responsible for data protection in the relevant jurisdiction. We will cooperate fully with any such review and will provide the records needed to resolve the question.
This policy is published by NeoX Business Intelligence Limited and applies to the website at www.neoxbi.lol and to the reporting services offered by the company.
Back to the homepage