Privacy Policy

01 Introduction & scope

This Privacy Policy describes how HK BALENTRAE CO., LIMITED ("HK BALENTRAE", "we", "us", the "Company") collects, uses, discloses and protects personal information in connection with:

• this public website at hengyuance.com (the "Site"); and
• the mobile applications published by HK BALENTRAE on Google Play and the Apple App Store (the "Apps"), which relate to our eight business lines: corporate strategic planning; business planning & management consulting; brand marketing planning & market research; project investment consulting; business information consulting; exhibition planning services; supply chain consulting; and import/export of goods and technology.

This Policy is written in English. The English version is the authoritative version in any conflict.

02 Data controller information

The data controller for both the Site and the Apps is:

HK BALENTRAE CO., LIMITED
Registered office: Room 1011, 10/F, The Cloud, 111 Tung Chau Street, Tai Kok Tsui, Hong Kong
General & support: support@hengyuance.com
Key-account & partnerships: subo@hengyuance.com

03 Information we collect

3.1 From the Site (hengyuance.com)

• Server access logs (IP address, user-agent, referrer, timestamp) — for security and capacity planning.
• Contact-form submissions (name, company, work email, phone, selected service lines, free-text message).
• First-party session cookies only — strictly necessary for site operation. No advertising or analytics cookies are set on the Site.

3.2 From the Apps

• Device identifier (Google Advertising ID on Android; IDFA on iOS), Android ID, IP address, coarse location (city / country), app-set ID, SDK session ID.
• In-app events (taps, screens viewed, completion of guided workflows) — used for product improvement and crash-free measurement.
• Crash logs (stack traces, device model, OS version) — used to diagnose stability issues.
• In-app messaging transcripts when the user engages with the support channel inside the Apps.

04 How we use information

• To respond to enquiries submitted through the Site contact form.
• To operate, secure and improve the Site and the Apps.
• To serve advertising through the integrated ad-mediation stack in the Apps (see §8) — only for adult users in jurisdictions that allow personalised advertising.
• To measure app performance and ad-mediation performance in aggregate.
• To comply with applicable law and respond to lawful requests from public authorities.

05 Legal bases for processing

We rely on the following legal bases depending on the activity and the user's jurisdiction:

• Consent — for personalisation of advertising in the Apps and for non-essential cookies (none are set on the Site).
• Contract — to respond to enquiries and to provide the services the user has requested.
• Legitimate interest — for security, fraud prevention, capacity planning, and aggregate measurement.
• Legal obligation — to comply with applicable law and to respond to lawful requests.

06 Cookies, SDKs and similar technologies

6.1 On the Site

The Site uses first-party session cookies only — strictly necessary for site operation. No advertising or analytics cookies are set. No third-party trackers load on the public Site.

6.2 In the Apps

The Apps integrate the SDKs of the 20 ad platforms listed in §8. The Apps also integrate platform SDKs (Google Play Services on Android; Apple's advertising and analytics frameworks on iOS) and a crash-reporting SDK. SDKs are loaded on demand and never before the user has been presented with the in-app privacy notice.

07 Advertising — Mobile app ad platforms (full matrix)

The HK BALENTRAE mobile apps integrate advertising mediation. The 20 platforms below are documented individually for each of the four ad formats we serve. Each format sub-block states: identifier collected, purpose, legal basis, retention, children handling, opt-out / revocation path, and cross-border transfer mechanisms.

08 Children's data — framework matrix

The Apps are intended for a professional audience. Where a user is detected (via OS signals, declared age or in-app age screen) as below the threshold for any of the following frameworks, the Apps apply the highest-protection regime: no behavioural advertising, no personalised measurement, and only child-safe certified networks are eligible to serve an ad — or no ad call at all if no such network is wired in.

09 Regional law compliance — ad platform matrix

The following 9 region blocks cover the jurisdictions in which the Apps are published and the data subjects reside. Each block lists all 20 ad platforms integrated in the Apps and the per-region posture.

10 International data transfers

The following transfer mechanisms are used for personal data moving between Hong Kong and other jurisdictions:

• HK ↔ EU/EEA: EU Standard Contractual Clauses (SCCs) Module 1/2 (2021/914), as referenced by the European Commission.
• HK ↔ UK: UK International Data Transfer Addendum to the EU SCCs (IDTA), issued by the ICO.
• HK ↔ Mainland China: CAC Standard Contract for Cross-Border Transfer of Personal Information (PIPL Art. 38), or a security assessment where volume thresholds are met.
• HK ↔ USA: EU-US Data Privacy Framework (where the recipient is a participating organisation); SCCs elsewhere.
• HK ↔ Brazil: ANPD Standard Contractual Clauses (Resolução CD/ANPD nº 4/2023) and the LGPD Art. 33 transfer limitation assessment.
• HK ↔ Singapore & APAC: ASEAN MCCs (where applicable) or a transfer limitation assessment under the destination's PDPA / equivalent.

11 Data retention

We retain personal data only for as long as needed for the purpose for which it was collected, or as required by law. The table below covers the principal data categories in the Site and the Apps.

12 Security measures

• Encryption in transit (TLS 1.2+) and at rest (AES-256) for personal data in our systems.
• Access control based on least privilege, with multi-factor authentication for staff accessing personal data.
• Regular vulnerability scanning and annual third-party security review.
• Vendor due diligence for all sub-processors, including the ad-mediation platforms in §7.
• Documented incident-response procedure with notification to users and regulators as required by applicable law.

13 Your rights & how to exercise them

Depending on the user's jurisdiction, the following rights are available. We honour requests submitted to support@hengyuance.com within 30 days, free of charge, unless the request is manifestly unfounded or excessive.

13.1 Common rights

• Access — obtain a copy of personal data we hold about you.
• Rectification — correct inaccurate or incomplete personal data.
• Erasure / deletion — request deletion of your personal data, subject to legal retention obligations.
• Restriction of processing — limit how we process your personal data.
• Data portability — receive a machine-readable copy of personal data you provided to us.
• Object to processing — object to processing based on legitimate interest or for direct marketing.
• Withdraw consent — at any time, where processing is based on consent.
• Lodge with DPA — file a complaint with the relevant data-protection authority.

13.2 California-specific (CCPA / CPRA)

• Opt-out of sale or sharing — exercise via the in-app "Do Not Sell or Share My Personal Information" toggle or the Site's email contact. We do not knowingly sell or share personal information of users under 16.
• Limit use of sensitive personal information — exercise via the same in-app toggle.

13.3 Brazil-specific (LGPD)

• Confirmation of existence and access to personal data.
• Anonymisation, blocking or elimination of unnecessary or excessive data.

13.4 China-specific (PIPL)

• Right to explanation of automated decisions affecting your rights.
• Right to refuse processing by automated decision-making that produces legal effects.

14 Third-party links

The Site and the Apps may contain links to third-party websites. This Policy does not apply to those websites. We encourage you to read the privacy notice of every third-party site you visit.

15 Changes to this policy

We may update this Policy from time to time. Material changes will be notified in-app or by email where we have a working address. The "Last updated" date at the top of this Policy reflects the most recent change.

16 Contact

For any privacy-related request or question, contact us at:

HK BALENTRAE CO., LIMITED
Room 1011, 10/F, The Cloud, 111 Tung Chau Street, Tai Kok Tsui, Hong Kong
support@hengyuance.com · subo@hengyuance.com