Privacy Policy & Data Processing Consent

AI Chat Service | Effective Date: January 2025

1. Data Controller

Phronesis Capital Co., Limited (hereinafter "we", "us", or "our") is the data controller responsible for the processing of your personal data collected through our AI chat service on phronesiscapital.ai.

Contact: [email protected]

2. Personal Data We Collect

When you use our AI chat service, we collect the following categories of personal data:

• Identity Data: Your full name
• Contact Data: Your email address
• Professional Data: Your company name and professional role (if provided)
• Conversation Data: All messages exchanged with our AI advisory assistant, including your inquiries, requirements, and business details
• Technical Data: Browser type, device information, and IP address (for security purposes)

3. Legal Basis for Processing

We process your personal data based on the following legal grounds:

• Consent (GDPR Art. 6(1)(a)): Your explicit consent obtained prior to chat initiation
• Contractual Necessity (GDPR Art. 6(1)(b)): Processing necessary to respond to your inquiries
• Legitimate Interest (GDPR Art. 6(1)(f)): Business development and client relationship management
• PDPO Compliance (Hong Kong): Compliance with Personal Data (Privacy) Ordinance requirements

4. Purpose of Data Processing

Your personal data is processed for the following purposes:

• To provide advisory services and respond to your inquiries
• To assess potential business mandates and engagement opportunities
• To communicate with you regarding your request
• To comply with legal and regulatory obligations
• To improve our AI advisory service quality

5. Data Transfers and Storage

International Transfers: Your data may be transferred to and processed in:

• Hong Kong SAR: Our principal place of business
• United States: Cloud infrastructure (Cloudflare Workers, Resend email services)
• China/Mainland: AI service provider (MiniMax API for chat processing)

All transfers are conducted with appropriate safeguards including:

• Standard Contractual Clauses (SCCs) for EU data transfers
• Encryption in transit (TLS 1.3) and at rest
• Data Processing Agreements with sub-processors

6. Your Rights

Depending on your jurisdiction, you have the following rights:

• Right to Access: Request a copy of your personal data
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure ("Right to be Forgotten"): Request deletion of your data
• Right to Restrict Processing: Limit how we use your data
• Right to Data Portability: Receive data in a machine-readable format
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent at any time (without affecting prior processing)

To exercise your rights, contact: [email protected]

7. Data Retention

We retain your personal data for:

• Active Prospects: 2 years from last interaction
• Clients: Duration of engagement plus 7 years (for legal/regulatory compliance)
• Other Inquiries: 1 year, unless longer retention is legally required

8. Data Security

We implement appropriate technical and organizational measures including:

• End-to-end encryption for data transmission
• Secure cloud infrastructure with SOC 2 compliance
• Access controls and authentication protocols
• Regular security assessments

9. Cross-Border Compliance

This privacy policy complies with:

• European Union: General Data Protection Regulation (GDPR) 2016/679
• Hong Kong: Personal Data (Privacy) Ordinance (Cap. 486)
• United States: California Consumer Privacy Act (CCPA) where applicable

10. Contact & Complaints

For privacy-related inquiries or to exercise your rights:

Email: [email protected]
Address: Level 6, CAI Building, 54-58 Electric Road, Tin Hau, Hong Kong

EU Representative: For EU residents, you may also contact the supervisory authority in your Member State.