This Privacy Policy explains how personal data is collected, used, stored, shared and protected when you visit the website of Proversatile Project Company Limited, send an enquiry, request a programme review or work with us on a project. The developer name for this website is Proversatile, and the operating company is Proversatile Project Company Limited, with its registered place of business at Rm 6 11/F Prosperity Place, 6 Shing Yip St, Kwun Tong, Hong Kong - 999077, Hong Kong (HK). We are a project delivery company working in computer integrated systems design, and we handle a limited amount of personal data in the ordinary course of that work. This policy is written to be read without legal training, and it explains both what we do and why we do it. If you have a question that the policy does not answer, you can write to info@proversatile.lol or call +15674400454 during Hong Kong business hours. We treat privacy as part of professional service quality, because a client who shares a project schedule or a contact list should be able to predict exactly where that information will travel.
By using this website or contacting us, you acknowledge that you have read this policy. If you do not agree with it, please do not submit personal data through the site and contact us by telephone instead. We may update the policy from time to time, and the current version is always the one published on this page.
1. Who we are
Proversatile Project Company Limited is a Hong Kong company providing project delivery and milestone assurance services for fit-out programmes and integrated systems work. Our place of business is Rm 6 11/F Prosperity Place, 6 Shing Yip St, Kwun Tong, Hong Kong - 999077, Hong Kong (HK). For the purposes of applicable data protection law, the company is the controller of the personal data described in this policy, which means that the company decides why the data is collected and how it is used.
The developer name used for this website is Proversatile. The company name and the developer name are used in different contexts. The company is the contracting entity, the employer of the delivery team and the party responsible for privacy. References to we, us and the Company in this policy mean Proversatile Project Company Limited.
Our work is concentrated on the coordination of physical works and technical systems. That means the personal data we hold is usually limited to contact details, correspondence, project roles and site records. We do not sell personal data, we do not operate an advertising network, and we do not build behavioural profiles of website visitors.
2. Scope of this policy
This policy applies to personal data collected through www.proversatile.lol, through email and telephone contact with our team, and through the delivery of our services to clients, suppliers and their representatives. It does not apply to third party websites that may be linked from this site, and it does not govern the internal systems of a client or a supplier, which are covered by their own privacy notices.
Where a client provides us with a separate written data processing agreement for a particular engagement, that agreement takes priority over this policy for the data covered by it. In all other respects, this policy sets out the standard that the Company applies to personal data across its operations.
This policy is written for a general audience. It covers website visitors who never become clients, prospective clients who request a review, appointed clients, supplier representatives, site visitors and the professional contacts who appear in project documentation.
3. Personal data we collect
We collect only the personal data that we need to respond to enquiries, deliver services and maintain proper business records. The categories are as follows.
Contact and identity data
Name, job title, employer or organisation, business email address, business telephone number and, where relevant, the site or office address associated with a project. If you write to us from a personal email address, we will hold that address in the same way as a business address.
Enquiry and correspondence data
The content of messages sent through the contact form or by email, including the project description, the handover date, the names of other parties mentioned in the enquiry, and our replies. We keep correspondence as part of the project record because it often contains commitments that matter later.
Project and role data
Names, roles and contact details of client staff, contractor staff, consultant staff and supplier staff who are listed in a programme, a responsibility matrix, an audit note, a risk register or a closeout pack. This data is supplied by the client or by the parties themselves in the course of the engagement.
Site and photographic data
Photographs taken during progress photo rounds and site visits, which may incidentally include people on site, vehicles, personal belongings or names on door plates. We minimise the incidental capture of people, but complete avoidance is not always practical on a working site.
Technical and usage data
Standard server information such as the internet protocol address, browser type, referring page and the time of a visit, collected by the hosting provider for security and availability purposes. We do not use this information to identify individuals.
Billing and administrative data
Where an engagement is invoiced, we hold the contact and billing details of the client organisation and, where relevant, the name and contact details of the person handling accounts payable. Payment card details are not stored by the Company.
We do not knowingly collect special category data such as health information, religious belief, biometric data or precise location data, and we ask that you do not include such information in an enquiry message.
4. How we collect personal data
Personal data reaches us in four principal ways. First, you may provide it directly through the contact form, by email to info@proversatile.lol, by telephone on +15674400454 or in a meeting. Second, it may be provided by your employer or by another party to a project, for example when a client supplies a responsibility matrix that names the members of a delivery team. Third, it may be created during our work, for example when a progress photo round captures a site, when an audit note records a conversation with a supplier representative, or when a handover drill report lists the people who attended.
Fourth, a limited amount of technical data is generated automatically when a browser connects to the website. This technical data is handled by the hosting infrastructure and is used only for security, diagnostic and availability purposes.
We do not buy personal data from data brokers, and we do not enrich the contact details of website visitors from third party databases. If a colleague forwards your details to us with a recommendation, we will treat those details as having been provided by the referring party and will use them only for the purpose for which they were shared.
5. Why we use personal data
We use personal data for the following purposes, each of which is connected to our professional work.
- To respond to enquiries, answer questions and arrange a programme review.
- To prepare proposals, confirm scope and administer engagements.
- To build and maintain milestone baselines, audit notes, risk registers and closeout packs.
- To communicate with clients, consultants, contractors and suppliers during a programme.
- To arrange site access, security clearance and health and safety induction where required.
- To maintain proper business, tax and accounting records.
- To protect the website and our systems against misuse, fraud and unauthorised access.
- To comply with legal obligations and to establish, exercise or defend legal claims.
- To send occasional service updates to contacts who have asked to receive them.
We do not use personal data for automated decision making that produces legal or similarly significant effects. We do not use personal data to train external artificial intelligence models, and we do not permit a third party service provider to do so with data we have shared for operational purposes.
Where we wish to use personal data for a purpose that is not listed above, we will identify that purpose before the use begins and will provide supplementary information at that point.
6. Our lawful bases
Depending on the context, we rely on one or more of the following lawful bases. Where you have given consent, for example by asking to receive service updates, you may withdraw that consent at any time by writing to info@proversatile.lol. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
Performance of a contract
When you are a client, a client representative or a supplier representative on an active engagement, we process personal data because it is necessary to perform the contract with the client organisation or to take steps at your request before entering into that contract.
Legitimate interests
We rely on legitimate interests for responding to business enquiries, maintaining project records, securing our systems and improving our services. We assess those interests against the rights of the individuals concerned, and we limit the processing to what is proportionate to the stated purpose.
Legal obligation
We process personal data where required by law, including tax, accounting, company record keeping and, where applicable, health and safety obligations connected to site work.
Consent
We rely on consent for optional communications such as service updates and for any specific use that we identify as requiring consent at the point of collection.
7. Project records and evidence
A distinctive feature of our service is the creation of a structured project record. Milestone baselines, supplier audit notes, handover drill reports, risk registers, photographic indexes and closeout packs all contain names, roles and correspondence. These records exist so that the programme can be governed on evidence rather than recollection, and so that the operator receives a usable archive at handover.
Because these records serve a professional and contractual purpose, they are retained for the duration of the engagement and for a defined period afterwards. The retention period is described in section 13. The records are shared with the parties who need them for the programme, such as the client, the principal contractor and the relevant supplier, and they are not published or used for marketing.
Where a record contains personal data that is not necessary for the purpose, such as a personal mobile number that was shared informally, we will remove or redact it when the record is finalised. If you are named in a project record and believe that the inclusion is no longer necessary, you may contact us and we will review the request against the contractual and legal need to retain the record.
8. Photographs and site records
Progress photo rounds are taken from fixed stations and are intended to record the state of the works rather than the identity of individuals. In practice, a photograph of a working site may capture a person, a uniform, a badge or a name on a door. We instruct the team to frame the works, to avoid deliberate portraits and to avoid capturing personal belongings where the shot can be taken without them.
Where a photograph incidentally captures a person, the image is used only for programme purposes: audit, handover evidence and the closeout pack. It is not published on this website, used in marketing material or shared on social media without specific permission. If you appear in a site photograph and wish the image to be removed or cropped, contact info@proversatile.lol and we will act on the request as quickly as the contractual record allows.
Clients and suppliers who intend to bring visitors on site should inform those visitors that the programme includes photographic progress records. We can supply a short notice that can be displayed at the site entrance.
11. Suppliers and service providers
Our technical suppliers include a website hosting provider, an email service and a document storage service. These providers are selected for reliability and for a reasonable security posture. Where a provider is located outside Hong Kong, the transfer is described in section 12.
We review the arrangements with our principal providers periodically and ask them to confirm that they maintain access controls, encryption in transit, logging and a process for responding to security incidents. We do not permit a provider to contact our clients directly for marketing purposes using data that we have supplied.
A supplier representative who works with us on a programme is also a data subject in relation to their own contact details. The same rights described in section 15 apply to that representative, and the same retention rules apply to the audit notes in which they appear.
12. International transfers
The Company operates from Hong Kong and most of the personal data we hold is processed in Hong Kong. Some technical providers may store data in other jurisdictions, including jurisdictions whose data protection laws differ from those of Hong Kong. Where a transfer takes place, we take reasonable steps to ensure that the data remains protected, for example by relying on contractual terms that require the recipient to apply appropriate safeguards.
Where a client requires data to remain in a specific jurisdiction, the requirement should be raised before the engagement begins so that the working arrangements can be designed around it. We will confirm in writing whether the requirement can be met.
If you would like more information about the location of a particular set of records, contact info@proversatile.lol and we will explain where the data is held.
13. How long we keep data
We keep personal data only for as long as it is needed for the purpose for which it was collected, plus any period required for legal, accounting or contractual reasons. The following periods are our standard approach.
- Enquiries that do not lead to an engagement are kept for up to twenty four months and then deleted.
- Engagement records, including milestone baselines, audit notes and closeout packs, are kept for seven years after the end of the engagement, in line with ordinary business record keeping.
- Billing and tax records are kept for the period required by applicable law, which is currently seven years from the end of the relevant financial year.
- Technical logs held by the hosting provider are kept for a short operational period and then rotated.
- Marketing consent records are kept until consent is withdrawn, plus a short period to evidence the withdrawal.
When a retention period ends, the data is deleted or irreversibly anonymised. Where deletion is not immediately possible because data is held in a backup, the backup is isolated and deleted at the next rotation. Projects that are subject to a legal hold are retained until the hold is lifted.
14. How we protect data
We apply a set of practical security measures that are proportionate to the nature of the data we hold. Access to project records is limited to team members who need it for the engagement. Accounts are protected by strong credentials, and access is removed when a person leaves a project. Documents are stored in a controlled repository rather than circulated as uncontrolled attachments where the project allows it.
Data in transit between the website and the browser is protected by transport encryption provided by the hosting infrastructure. Devices used by the team are kept patched and protected by screen locks. Printed project material is stored in locked cabinets and disposed of securely when no longer needed.
No system can be guaranteed to be entirely secure. If a security incident affecting personal data occurs, we will investigate promptly, take steps to contain the incident and notify the affected parties and any relevant authority where the law requires it. We will also explain what happened and what has been changed to reduce the likelihood of a repeat.
15. Your privacy rights
Subject to applicable law, you have the following rights in relation to the personal data that the Company holds about you.
Right of access
You may ask for a copy of the personal data that we hold about you, together with information about how it is used and with whom it has been shared.
Right to correction
You may ask us to correct personal data that is inaccurate or incomplete. If the data appears in a project record, we will correct it and note the change where the record requires an audit trail.
Right to erasure
You may ask us to delete personal data where there is no continuing reason for us to hold it. We will assess the request against contractual, legal and record keeping requirements and will explain the outcome in writing.
Right to restriction
You may ask us to restrict the processing of your data while a question about its accuracy or use is being resolved. During that period we will hold the data but will not use it for the ordinary purpose.
Right to object
You may object to processing that we carry out on the basis of legitimate interests. We will stop the processing unless we can show compelling grounds that override your objection.
Right to data portability
Where processing is based on consent or contract and is carried out by automated means, you may ask for the data in a structured and commonly used format.
Right to withdraw consent
Where processing is based on consent, you may withdraw that consent at any time. Withdrawal is simple and does not require a reason.
To exercise any of these rights, write to info@proversatile.lol with enough detail for us to identify the data concerned. We will respond within the period required by applicable law, and in most cases within thirty days. We may ask for proof of identity before releasing personal data. There is normally no charge for a request, but a reasonable fee may apply where a request is manifestly unfounded or excessive.
16. Privacy for Children
This website and our services are intended for businesses and professional users. They are not directed at children, and we do not knowingly collect personal data from anyone under the age of sixteen. If a child has provided personal data through the site, a parent or guardian may contact info@proversatile.lol and we will delete the data promptly.
Site visits occasionally involve young people, for example during an educational visit arranged by a client. In that case the client organisation is responsible for obtaining any necessary consent and for supervising the visit. We will follow the instructions of the client and will avoid including visitors in progress photographs wherever the shot allows.
17. Marketing and communications
We send occasional service updates to professional contacts who have asked to receive them. Every update includes a simple way to stop receiving further messages, and a request to stop is actioned promptly. We do not send marketing messages to addresses that were collected for a one-off enquiry without a clear indication that updates are welcome.
We do not use tracking pixels in marketing email, and we do not sell contact lists. If you receive a message that appears to come from us but does not match this policy, please forward it to info@proversatile.lol so that we can investigate.
18. Changes to this policy
We review this policy at least once a year and whenever a material change occurs in our services or in the systems we use. The updated version is published on this page with a new date at the top. Where a change materially affects how we use personal data that we already hold, we will take reasonable steps to inform the affected contacts before the change takes effect.
Previous versions are retained internally so that we can explain how the policy has developed. A copy of a previous version can be requested by writing to info@proversatile.lol.
19. Complaints and disputes
If you are unhappy with how we have handled your personal data, please contact us first. We will investigate the concern, explain what we have found and describe what we intend to do. Most concerns can be resolved through a direct conversation.
If you remain dissatisfied, you may raise the matter with the relevant data protection authority in your jurisdiction. In Hong Kong, the relevant authority is the Office of the Privacy Commissioner for Personal Data. We will cooperate fully with any inquiry.
Nothing in this policy limits any right that you have under applicable law, and nothing in this policy creates a right that is not available under applicable law.
20. How to contact us
Questions about this policy, requests to exercise a right and reports of a possible security incident should be sent to the Company using the details below.
Rm 6 11/F Prosperity Place, 6 Shing Yip St, Kwun Tong, Hong Kong - 999077, Hong Kong (HK)
Email: info@proversatile.lol
Telephone: +15674400454
Website: https://www.proversatile.lol
We aim to acknowledge written privacy enquiries within two working days and to provide a substantive response within thirty days. If a request requires more time, we will explain why and give an expected date.
This policy is published by Proversatile Project Company Limited and applies to the website operated under the developer name Proversatile.