J & H Development Company Limited respects the personal information of every person who visits our website, contacts our office, uses the products we build, or otherwise engages with our work. This policy sets out in plain language how we collect, use, disclose, retain, and protect personal data.
The services described on this website are developed and operated by the developer JH Devy on behalf of J & H Development Company Limited, a firm of computer systems designers and integrators. We are a company incorporated and carrying on business from Room 1905, Nan Fung Centre, 264-298 Castle Peak Road, Tsuen Wan, Hong Kong (HK). This policy applies to all services we provide from that office and to any digital property we control.
We provide this document so that you can make an informed choice before you share anything with us. Please read it together with our Terms of Service, which govern the wider relationship between you and the firm.
1. Who we are and the purpose of this policy
J & H Development Company Limited is a professional, scientific, and technical services business specialising in computer systems design, software development, platform integration, data engineering, and the ongoing operation of the systems we build. Our creative and technical direction is carried by the developer JH Devy, and the corporate body behind the services is registered at our office in Tsuen Wan, Hong Kong.
The purpose of this policy is to tell you exactly what happens to the information you give us. We do not want you to wonder whether your details sit safely with us. We wrote this document so that the handling of your personal data is as clear as a drawn survey line: measurable, honest, and easy to read from start to finish.
We encourage everyone who reads this page to approach us whenever anything in it is unclear. You can reach a member of our office at any time through the channels listed at the end of this document, and we will explain our practice in terms that make sense for your situation.
2. The scope of this privacy policy
This privacy policy applies to personal data that we process in connection with this website, our marketing communications, our sales enquiries, our consulting and engineering engagements, and any hosted or managed platform that we operate on behalf of a client under a separate written agreement.
Where we build software or operate a platform for another business, that business remains the controller of the data its users share with it. In such cases we act as a processor under their instructions and the applicable contract between us and that client governs our handling of the underlying records. This policy should be read accordingly: it describes our own data practices rather than the practices of every client whose systems we touch.
Nothing in this policy reduces any right you hold under stronger privacy legislation that may apply to you in your country of residence. If a stricter local standard exists and applies to our processing of your information, we will honour that stricter standard wherever a conflict would otherwise arise.
This document uses no terms of art that cannot be looked up, but where a specific legal word appears we intend its ordinary meaning as applied in Hong Kong and, where relevant, in global data protection frameworks.
3. The information we collect
The categories of personal data we handle are kept deliberately narrow. We believe that collecting less is almost always the more responsible choice, so we restrict ourselves to the following:
- Identity data, such as your name, the company you represent, your professional title, and the business name you operate under.
- Contact data, including your email address, telephone number, office address, and country of operation so that we can reach you about our shared work.
- Proposal and engagement data, covering the details you raise in enquiries, scoping calls, written briefs, and requests for our services.
- Transaction and account data, including billing records, invoicing references, and records of the communications we exchange during an active project.
- Technical data we obtain automatically when you use our website, such as your internet protocol address, browser type, device identifiers, and the pages you visit.
- Communications data such as the content of messages you write to us and the records of calls, meetings, and correspondence we hold with your consent or on a lawful basis.
We make a firm point of not asking for, and not wanting, data we do not genuinely need. You will never be asked to share religious or political opinions, trade union membership, health details, or any of the sensitive categories of information described as special category data in privacy law, and we ask that you do not volunteer such material in ordinary correspondence.
Should exceptionally narrow circumstances ever require the handling of sensitive information, we would only proceed after a specific, written, and freely given consent from you together with a lawful basis clearly explained in a dedicated notice.
4. How personal data reaches us
Your personal data can arrive through several doors, each treated with equal care:
- You provide it directly when you fill in the contact form on this website, telephone our office, or write to our email address.
- You provide it during active engagements, when you share documents, attend calls, or give us the technical detail needed to design a system.
- It is generated automatically when technology you employ interacts with ours, for example when your browser requests a page from our server or when a platform we operate logs routine activity.
- It may be shared by a colleague or business partner who introduces you to us, in which case we will record the context of that introduction and treat the shared details under this same policy.
In every case we record only what is necessary to pursue a legitimate and lawful objective. We do not buy personal data from brokers and we do not scrape address lists from public or private sources to build marketing files.
Where someone else, such as a business partner, provides us with your details, we rely on that person having a proper basis to do so and we keep the introduction sufficiently documented to satisfy a fair and reasonable audit.
5. The purposes for which we use information
We use the personal data we hold for clearly bounded purposes that follow directly from our role as a systems design and development firm:
- To respond to enquiries and to advise you about the services we offer through our website and office.
- To prepare proposals, statements of work, quotations, and other documents needed to begin or continue an engagement.
- To deliver contracted services, including consulting, engineering, integration, and managed operations carried out under our agreements.
- To administer accounts, issue invoices, process payments, and maintain accurate business records.
- To operate and improve this website and any platform we are contracted to run, including securing those systems against misuse.
- To send occasional, relevant, and unobtrusive updates about our work where we hold a lawful basis or a consent to do so.
- To meet our legal, accounting, tax, and professional obligations as a Hong Kong company.
- To prevent fraud, respond to security incidents, and protect the rights of our clients, our staff, and the public.
We will not stretch a purpose beyond its natural boundary. Data collected to answer an enquiry will not silently be repurposed for unrelated marketing, and the records of an active contract will not be used to build profiles of individuals without a clear reason and a lawful basis.
6. The lawful and legitimate grounds for processing
Different legal systems express the reasons for processing personal data in different ways. Where general data protection principles apply, our processing rests on solid foundations in every case:
- Consent, where you freely agree to a particular use such as our sending you a newsletter or processing unusually sensitive details at your request.
- Contract, where the processing is necessary to perform an agreement with you or to take steps at your request before entering one.
- Legal obligation, where a law, regulation, or court order requires us to keep or make available specific records.
- Legitimate interest, where our processing is justified by a genuine business or security need that does not override your rights and freedoms.
When we rely on legitimate interests, we weigh those interests against your privacy carefully before proceeding. The typical examples are keeping our systems secure, answering a postal enquiry, recovering an unpaid account, and improving the reliability of our published services without prying into individual users.
If we ever begin a new processing activity that does not fit comfortably within an existing ground, we will update this policy and, where required, seek fresh consent rather than stretching an old consent to cover the change.
7. Special care for the data of children
Our services are intended for businesses, engineers, and professionals who purchase or commission computer systems and related technical work. We do not design our products or marketing to attract children, and we do not knowingly collect the personal data of anyone under the age at which they can lawfully give independent consent in their own jurisdiction.
Should we ever discover that a child has provided us with personal data without the involvement of a responsible adult, we will delete that information promptly unless the data is part of a lawful obligation. We take this step silently and without perpetuating the record, and we encourage any parent or guardian who believes a child has shared data with us to contact us at once so that we can act.
We ask parents and guardians to remain aware of what children do online and to supervise their use of interactive services in the same careful way they would supervise any other activity.
9. Our third party processors and their role
To run our website and deliver our services we rely on a small set of specialist technology suppliers. These parties are processors: they act only on our instructions and hold our data in trust rather than treating it as their own.
The main categories are domain and hosting providers that keep our site reachable, email and communications services that carry our mail, software support tools that organise our projects, and analytics providers that help us understand how the website is used in aggregate. Each of these suppliers is bound by contract to keep personal data confidential, to use it only for the service we instruct, and to return or destroy it at the end of the relationship.
We review the security posture of critical suppliers when we choose them and we monitor changes that might affect their handling of our clients data. We remain responsible for the processors we appoint, and we do not resile from that responsibility simply because the processing is performed by a third party.
10. International transfers of personal data
J & H Development Company Limited operates from Hong Kong, and the internet does not always respect national borders. Your personal data may be stored on servers located in a country other than your own as part of the normal operation of the hosting and cloud services we use.
Where we transfer personal data across borders we do so under appropriate safeguards. We rely on the adequacy decisions, binding corporate rules, standard contractual clauses, or other recognised transfer mechanisms available under applicable law so that your data is not left unprotected simply because it crosses a boundary.
Hong Kong maintains a strong framework for the protection of personal data, and we hold our operation to that standard wherever our data and that of our clients is stored. We will tell you, upon request, which transfer mechanism protects your particular data if you have a genuine need to know.
11. The security measures we apply
Information is only as safe as the discipline around it, and discipline is the very nature of a systems house. We protect personal data with a layered set of technical and organisational controls:
- Encryption in transit using recognised secure protocols whenever data moves across public networks.
- Encryption at rest for sensitive records stored on our systems and those of our processors.
- Access controls based on least privilege, so that only people with a genuine need can view a given record.
- Strong authentication, including multi factor methods, for administrative access to the systems we control.
- Regular review of our configurations, patching of our software, and monitoring of our logs for suspicious activity.
- Training and confidentiality duties on every person who handles data on our behalf.
No security measure is absolute, and we are honest about that. If a breach were ever to affect the personal data we control, we would assess the risk it poses to the people involved, notify the persons and authorities where the law requires us to do so, and take every reasonable step to contain and correct the situation.
12. Retention of personal data
We keep personal data only for as long as it is needed for the purpose for which it was collected, or for as long as the law requires us to hold it. At the end of that period we delete or anonymise the information so that it can no longer be linked to an identified person.
As a guide, correspondence about an enquiry that does not become a project is ordinarily removed within a reasonable period of no further contact. Records connected to an active contract are kept for the term of the engagement plus the period required by Hong Kong tax and accounting law so that we can answer any lawful enquiry about our books.
Where data is held only in logs and other technical records, we apply an automated expiry so that nothing valuable is discarded too soon and nothing sensitive lingers a day longer than necessary.
14. Usage analytics and aggregate statistics
We study how the website is used so that we can keep it reliable and easy to navigate. For this purpose we process aggregate and statistical information about visits, such as the number of people who view a page, the technology they use, and the general regions they come from.
Aggregate statistics do not identify you, and we take reasonable steps to make sure the summaries we consult cannot be reassembled into profiles of individuals. Where a statistic could reveal a single identifiable user, we suppress it rather than refine it.
The purpose of our analytics is improvement, not surveillance. We want to know whether a page is helpful, not to follow any particular visitor across the wider internet.
15. Your rights as a data subject
Depending on where you live, and subject to the exceptions allowed by law, you may hold a number of rights in respect of the personal data we keep about you. We honour these rights fully and we make it easy for you to exercise them:
- A right to know whether we hold personal data about you and to receive a copy of it in a readable form.
- A right to correct inaccurate or incomplete personal data that we hold about you.
- A right to request the deletion of personal data where there is no longer a lawful basis to keep it.
- A right to restrict or object to certain processing where the legal basis does not allow it to continue.
- A right to ask that personal data you have provided be transferred to you or to another provider where this is technically feasible.
- A right to withdraw any consent you have given, at any time and as easily as you gave it.
- A right to complain to the relevant supervisory authority in your jurisdiction.
To exercise any of these rights, simply contact us using the details at the end of this policy. We may ask a small number of questions to confirm that you are the person you claim to be, and we will respond within the time the law allows once we are satisfied of your identity.
We will never charge a fee for the simple exercise of a right, although we may recover costs where a request is manifestly unfounded, excessive, or repetitive in a way that the law permits us to decline.
16. Direct marketing and how to object
We send direct marketing only where we have a lawful basis and, where local law so requires, your prior consent. The few updates we issue concern our own services and our own practice, and each one carries a simple way for you to stop future messages.
Every marketing message we send names us plainly, identifies our office, and provides a clear opt out link or a reply address through which you can decline. We honour opt out requests promptly and we do not make you search for a way to be left alone.
If you ask us not to contact you for marketing we will stop doing so at once. Where some of the same records are also needed to serve an active contract, we keep only what the continuing project requires and nothing more.
17. Observance of applicable privacy law
As a Hong Kong company we pay close attention to the law that governs the handling of personal data, and we shape our practice to stay within it. We also operate our client work to respect the privacy expectations of the jurisdictions where our clients and their users are located, so that a system we deliver does not expose its owners to avoidable risk.
Where a particular regime grants stronger rights to the individual than our baseline practice, we aim to meet that higher standard wherever it applies. We prefer to over-deliver on privacy rather than to follow only the letter of a minimal rule, and we regard this policy as a living commitment rather than a fixed template.
We review this policy from time to time to keep it accurate and current. When material changes are made we will revise the version date at the foot of this page and, where the change affects you in a meaningful way, we will bring it to your attention through the ordinary channels we use to reach you.
18. Contacting us about this policy
Should you have a question, a concern, or a request relating to this privacy policy or to the personal data we hold, please direct it to our designated contact point in writing.
You may reach us by email at info@jhdev.lol, by telephone at +17797783987, or by post to J & H Development Company Limited at Room 1905, Nan Fung Centre, 264-298 Castle Peak Road, Tsuen Wan, Hong Kong (HK).
We aim to acknowledge every privacy request within a few business days and to resolve genuine concerns quickly and fairly. If you are not satisfied with the way we respond, you are entitled to raise the matter with the appropriate supervisory authority in your own jurisdiction, and we will cooperate with that authority as the law allows.