Privacy Notice
VELKERN is a trading name of BRIGHTLOOP TECHNOLOGIES LIMITED, Hong Kong.
This notice explains what personal data VELKERN collects, why we use it and what rights you have in relation to that data. It applies to visitors to this website, to those who contact us with a question or an enquiry, and to those who offer to work with us as contractors.
It does not apply to personal data that we process on the instructions of our clients when delivering development services. For such data the purposes of the processing are determined by the client — see section 3.
1 Who we are
VELKERN is a trading name of BRIGHTLOOP TECHNOLOGIES LIMITED, a private limited company incorporated in Hong Kong (Special Administrative Region of the People’s Republic of China).
Company Registration Number (CR No.): to be providedBusiness Registration Number (BR No.): to be providedRegistered office: RM 4B, 10/F, East Ocean Centre, 98 Granville Road, Tsim Sha Tsui, Kowloon, Hong Kong
In this notice, “VELKERN”, “we” and “us” mean BRIGHTLOOP TECHNOLOGIES LIMITED. In relation to the personal data described here, we are the party that determines the purposes and means of the processing — the controller, and under Hong Kong law the data user.
For any matter arising from this notice, including any request concerning your personal data, write to [email protected].
2 What personal data we process, why and on what legal basis
We collect only what is needed for the purposes set out below. We do not ask for special categories of personal data — concerning health, racial or ethnic origin, religious or political beliefs, sex life or sexual orientation, or data concerning criminal offences — and we ask you not to send us such data.
2.1 Enquiries and business contacts
What we process: your name and email address; your company and role, if you have provided them; the content of your message and anything you have chosen to include in it.
Why: to respond to your enquiry and to correspond with you about our services, including about a possible contract.
Legal basis: our legitimate interest in responding to enquiries and in running our business; and, where your enquiry relates to a possible contract, steps taken at your request prior to entering into it.
Retention period: up to 12 months after the last message in the correspondence — unless the enquiry has developed into a contractual relationship, in which case we keep the data for the duration of that relationship, and unless longer retention is required by law or for the establishment or defence of legal claims.
Providing this data is voluntary. Without it we will not be able to reply to you.
2.2 Offers of cooperation from contractors
What we process: your name and contact details; your CV, portfolio or work samples; information about your experience and skills; anything else you have included in your message, together with our correspondence with you.
Why: to consider your offer and to correspond with you while we do so; to enter into a contract with you if we decide to work together; and — if you agree to this — to keep your data for future projects.
Legal basis: our legitimate interest in assessing those who offer to work with us; from the moment we begin agreeing terms with you, steps taken at your request prior to entering into a contract; your consent — solely as regards keeping your data for future projects.
Retention period: if the cooperation has not begun — up to 6 months after our decision, or up to 12 months if you have agreed to your data being kept for future projects. If the cooperation has begun — as set out in clause 2.3.
Providing this data is voluntary. Without it we will not be able to consider your offer. Consent to your data being kept for future projects may be withdrawn at any time by writing to [email protected]; the withdrawal does not affect processing carried out before it.
2.3 Contractors we work with under a contract
What we process: identity data and contact details; contract and payment details; records of the work performed.
Why: to enter into and perform our contract with you and to administer the working relationship.
Legal basis: performance of a contract to which you are party; compliance with our legal obligations, including tax and accounting obligations; our legitimate interest in running our business.
Retention period: for the duration of the cooperation and thereafter for as long as is required to comply with our legal obligations and for the establishment or defence of legal claims.
3 Personal data we process on the instructions of our clients
When delivering development services, we may process personal data held in our clients’ systems and environments. For such data the purposes and means of the processing are determined by the client, and we act on the client’s documented instructions; that data is governed by the client’s own privacy notice, not by this one. Where such processing falls within European Union or United Kingdom law, we enter into a written data processing agreement with the client before the processing begins. Where the work does not require real personal data, we use synthetic or test data, in which case no client personal data is passed to our contractors.
4 How we obtain your personal data
We obtain it directly from you: from the message you have sent us and from the subsequent correspondence. Our website has no forms and no other means of collecting information — email is the only channel. We do not buy personal data and we do not obtain it from data brokers.
6 Who we disclose personal data to
We disclose personal data only to the extent necessary for the purposes set out above:
- to our personnel and to the independent contractors we engage to deliver our services;
- to service providers who process personal data on our instructions under written terms, in the following categories: website hosting and email services;
- to our professional advisers — lawyers and accountants — where necessary;
- to public authorities and regulators where required by law or where necessary for the establishment or defence of legal claims.
We do not sell personal data and we do not disclose it for third-party advertising.
7 International transfers of personal data
We are established in Hong Kong. The contractors and service providers we engage may be located in the countries outside Hong Kong and outside the European Economic Area and the United Kingdom. Personal data covered by this notice is therefore processed outside the European Economic Area and the United Kingdom — in countries not covered by a European Commission or United Kingdom adequacy decision.
Where a disclosure of personal data by us falls within the data transfer rules laid down by European Union or United Kingdom law, we do not make that disclosure until an appropriate transfer mechanism is in place for it. In any event, we limit the data disclosed to what the recipient needs for the relevant purpose, and our contractors and service providers are bound by written confidentiality obligations and may use personal data only for the purpose for which we provided it.
Hong Kong law does not currently restrict transfers of personal data outside Hong Kong: section 33 of the Personal Data (Privacy) Ordinance has not been brought into force.
If you wish to find out how a disclosure of data concerning you is safeguarded, or to request a copy of the applicable transfer mechanism, write to [email protected].
8 How we protect personal data
We apply technical and organisational measures appropriate to the risk. Access to personal data is limited to those who need it for the purposes described above. Contractors accept written confidentiality obligations before any project materials are passed to them; access to a client’s systems is granted to them by role and only for the duration of the work; they receive and store credentials solely in encrypted form. If a significant incident affecting personal data occurs, we record what happened, inform the affected party and notify the supervisory authority or the affected individuals where required by law. No method of transmitting or storing information is completely secure, and we do not claim otherwise.
9 Which data protection law applies
We are a Hong Kong company, and the way we handle personal data is subject to the Personal Data (Privacy) Ordinance (Cap. 486).
Where we offer services to individuals located in the European Economic Area or in the United Kingdom, the processing described in this notice may also be subject to the European Union General Data Protection Regulation or the United Kingdom General Data Protection Regulation. Where either of them applies, we comply with it in respect of the relevant processing.
We have not appointed a representative in the European Union or in the United Kingdom. Our processing of the personal data of individuals located in those territories is occasional, does not involve special categories of personal data or data concerning criminal offences, and is not processing likely to result in a risk to the rights and freedoms of individuals; accordingly, the exemption provided for in Article 27(2)(a) of the European Union General Data Protection Regulation and of the United Kingdom General Data Protection Regulation applies to us. You can contact us directly at [email protected]; we handle requests concerning personal data in English. If our processing changes so that a representative becomes mandatory, we will appoint one and state its details here.
10 Your rights
Under the Personal Data (Privacy) Ordinance you may ask whether we hold personal data about you, request a copy of it and require correction if the data is inaccurate.
Where the processing is subject to the European Union or the United Kingdom General Data Protection Regulation, you are also entitled — to the extent that the right is granted by the applicable law — to:
- obtain access to your personal data and a copy of it;
- require the correction of inaccurate personal data and the completion of incomplete personal data;
- require the erasure of your personal data in the cases provided for by law;
- require the restriction of processing or object to it, including processing based on our legitimate interests;
- receive your personal data in a portable format and require its transmission to another recipient, where that right applies;
- withdraw your consent where the processing is based on consent, which does not affect processing carried out before the withdrawal.
To exercise any of these rights, write to [email protected]. We may ask you for information to verify your identity before acting on your request, and we respond within the time limit laid down by the applicable law.
You also have the right to lodge a complaint with a data protection authority: in Hong Kong, the Office of the Privacy Commissioner for Personal Data (pcpd.org.hk); in the United Kingdom, the Information Commissioner’s Office (ico.org.uk); in the European Economic Area, the supervisory authority of the country where you live, where you work or where the matter you are complaining about took place.
11 Changes to this notice
We may update this notice from time to time. When we make a material change, we update the effective date below and, where appropriate, take reasonable steps to bring the change to your attention.
Effective date: 03.11.2026 · Version 1.0 · Controller: BRIGHTLOOP TECHNOLOGIES LIMITED (VELKERN)