Privacy Policy

Version: PP-2026-09-15
Last Updated: 15 September 2026
Effective Date: 15 September 2026

Massive Dynamic Limited ("we", "our", "us") respects your privacy and is committed to protecting your personal data. This Privacy Policy applies to our websites including mdhk.ltd, track.mdhk.ltd, and app.mdhk.ltd, and explains how we collect, use, store, and protect your information.

1. What This Website Does NOT Collect

No Passport Data via Website

We do not request, collect, or store passport numbers, passport scans, or similar identity documents through our websites. When your service requires passport documents, they are exchanged outside the website via secure encrypted channels (WhatsApp, Telegram, Facebook Messenger).

No Payment Card Data Storage

We do not collect or store payment card numbers, CVV codes, or PAN (Primary Account Number) on our servers. All payment card details are handled exclusively by our payment processors.

No Special-Category Data

We do not use the website to collect sensitive personal data such as biometric data, health information, racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, or data concerning sex life or sexual orientation.

2. Minimal Data for Browsing

We collect and use only the minimum information necessary to operate and secure our websites:

IP Address: For security, fraud prevention, and geographic service delivery
Device Information: Browser type, operating system, device type (for compatibility and security)
Usage Data: Pages visited, time spent, referral source (for service improvement)
Essential Cookies: Session management, security, authentication (see Section 8)

If you create an account or log in, your identity data (email, phone number) is handled by our authentication provider (see Section 3).

3. Third-Party Processors and Providers

We use trusted third-party service providers who process data on our behalf:

Payment Processing

Stripe & Airwallex

Purpose: Secure payment processing for all card transactions
Data Processed: Payment card details, transaction information, billing address
Storage: Card details are entered and stored on their secure infrastructure, NOT on our servers
Security: PCI DSS Level 1 compliant
Privacy Policies:
- Stripe: https://stripe.com/privacy
- Airwallex: https://www.airwallex.com/privacy-policy

Authentication & Account Management

Clerk

Purpose: User sign-up, sign-in, session management, account security
Data Processed: Email address, phone number (optional), name, authentication tokens
Storage: Identity data is processed and stored by Clerk under their infrastructure
Security: SOC 2 Type II compliant, encryption at rest and in transit
Privacy Policy: https://clerk.com/privacy

Third-Party Service Providers (Case Implementers)

Substantive Service Delivery Partners

Purpose: Delivery of substantive services (immigration processing, company formation, licensed activities)
Data Processed: Identity documents, application forms, supporting documentation, case-specific information necessary for service delivery
Legal Basis: Contract performance (Article 6(1)(b) GDPR) and legitimate interests (Article 6(1)(f) GDPR)
Relationship: Each Third-Party Provider acts as an independent data controller within the meaning of Article 4(7) GDPR for the substantive services it provides
Disclosure: The identity of the Third-Party Provider assigned to your case is disclosed in your service agreement (MSA Schedule A) or upon engagement
Geographic Locations: Third-Party Providers operate in EU member states, Hong Kong, and other jurisdictions relevant to the requested service; international transfers comply with GDPR Article 46 safeguards

Communication Channels

WhatsApp Business (Meta Platforms, Inc.)

Purpose: Real-time messaging and document exchange (optional)
Data Processed: Messages, documents, attachments transmitted via the platform
Storage: Data is processed by Meta Platforms, Inc. (USA) under its own privacy policy
Cross-Border Transfers: Use of WhatsApp involves data transfers to the United States. EU/EEA-based clients who do not consent to such transfers should use the secure portal at app.mdhk.ltd as the exclusive channel for sensitive documents
Privacy Policy: https://www.whatsapp.com/legal/business-privacy-policy

Important: We never receive full payment card numbers and we do not store them on our servers. Authentication cookies are set and managed by Clerk.

4. Secure File Handling (app.mdhk.ltd)

Our secure client portal at app.mdhk.ltd provides strong security for document management:

Security Measures

Hosting Location: Our application servers and the client portal are hosted in Germany, within the European Union
Encryption at Rest: All files encrypted using AES-256 encryption
Transmission Security: TLS 1.3 encryption for all data transfers
Cloudflare Protection: DDoS protection, WAF (Web Application Firewall), and CDN security across all IT channels
Access Control: Zero-trust architecture with strict authentication

Access Restrictions

Only two parties can access uploaded files:

The person who uploaded the file (authenticated user)
The assigned case manager (the individual handling your case)

No other personnel, third parties, or systems have access to your files.

File Retention & Deletion

Client Control:

You can delete your files at any time through the client portal
Deletion is immediate and permanent from active systems
Backup copies are overwritten within 7 days

Automatic Deletion:

Files are automatically deleted 180 days after case completion or account closure
You will receive notification 30 days before automatic deletion
You can request early deletion or extended retention

Document Exchange Outside Website

When services require passport documents, identity cards, or other sensitive materials:

Documents are exchanged via encrypted messaging channels (WhatsApp, Telegram, Facebook Messenger)
Documents are NOT stored on our web servers
Documents uploaded to app.mdhk.ltd follow the security measures above

5. Legal Basis & Purposes

Your personal data is processed under the following legal bases:

Legitimate Interests

Website Operation: Ensuring website functionality, performance, and user experience
Security: Protecting against fraud, unauthorized access, and cyber threats
Service Improvement: Analyzing usage patterns to enhance our services
Sanctions Screening: Prevention of financial crime and compliance with applicable sanctions regimes (see Section 14)

Contract Performance

Service Delivery: Processing your orders and delivering contracted services
Payment Processing: Collecting payment and issuing invoices
Communication: Providing support, status updates, and service-related information
Third-Party Provider Coordination: Forwarding required documentation to assigned Third-Party Providers for substantive service delivery

Legal Compliance

Customer Due Diligence: Identity verification and screening applied as a matter of internal policy, aligned with the standards of Hong Kong's AMLO Cap. 615 and with the requirements of our banking and payment partners (see Section 14)
Sanctions Compliance: Screening against UN, HK, OFAC, and EU sanctions lists
Accounting & Tax: Maintaining financial records as required by Hong Kong law
Regulatory Requirements: Compliance with applicable immigration, corporate, and industry regulations

6. Data Retention

We retain personal data only as long as necessary for the purposes outlined in this policy:

Active Service Period:

Account information: Duration of service + 180 days
Transaction records: 7 years (accounting and tax requirements)
Communication logs: 3 years (dispute resolution and quality assurance)
Uploaded files: 180 days after case completion (automatic deletion)
Sanctions screening records: 6 years (aligned with AMLO Cap. 615 record-keeping standards)

After Service Completion:

Minimal data retained for legal, accounting, and security purposes
Full anonymization or deletion after statutory retention periods
Payment card data: Retained by Stripe/Airwallex under their policies (not on our servers)

7. Your Privacy Rights

Depending on your jurisdiction (Hong Kong PDPO, EU GDPR, etc.), you may have the following rights:

Right to Access

Request confirmation of what personal data we hold about you
Receive a copy of your personal data in a structured, commonly used format

Right to Rectification

Request correction of inaccurate or incomplete personal data
Update your account information directly through app.mdhk.ltd

Right to Deletion ("Right to be Forgotten")

Request deletion of your personal data where:
- No longer necessary for original purpose
- You withdraw consent (where consent was the legal basis)
- You object to processing and no overriding legitimate grounds exist
- Data was unlawfully processed

Exceptions: We may retain data where legally required (accounting, dispute resolution, regulatory compliance, screening record-keeping)

Right to Restriction

Request temporary restriction of processing while we:
- Verify accuracy of disputed data
- Assess whether legitimate grounds override your objection

Right to Object

Object to processing based on legitimate interests
Object to direct marketing (we do not engage in unsolicited marketing)
Note: Sanctions screening cannot be opted out of. It is a mandatory condition of engagement under our internal compliance policy and under the requirements of our banking and payment partners.

Right to Data Portability

Receive your personal data in machine-readable format
Request direct transfer to another controller where technically feasible

Right to Withdraw Consent

Where processing is based on consent, you may withdraw at any time
Withdrawal does not affect lawfulness of processing before withdrawal

How to Exercise Your Rights: Email: support@mdhk.ltd with subject "Privacy Rights Request"
Response time: 30 days (may be extended by 60 days for complex requests)

8. Cookies

We use only essential cookies required for website functionality:

Essential Cookies (Cannot be Disabled)

Session Cookies: Maintain your logged-in state and shopping cart
Security Cookies: Protect against CSRF attacks and unauthorized access
Authentication Cookies: Set by Clerk for account management (httpOnly, secure, SameSite)

We do NOT use:

Analytics cookies (beyond essential server logs)
Advertising cookies
Social media tracking cookies
Third-party marketing cookies

Cookie Duration:

Session cookies: Deleted when you close your browser
Authentication cookies: 30 days (configurable in your account settings)

Full details are set out in our Cookie Policy.

9. International Data Transfers

Massive Dynamic Limited is registered in Hong Kong and its team works remotely. Your data may be transferred to and processed in:

Germany: Our application servers and the client portal at app.mdhk.ltd are hosted in Germany, within the European Union. This is where client data is stored at rest.
Hong Kong: Place of registration and administration of the business
European Union: For EU client service delivery and compliance, including transfers to EU-based Third-Party Providers
United States: Third-party processors (Stripe, Clerk, Meta/WhatsApp) with EU-US Data Privacy Framework certification where applicable
Other Jurisdictions: Where required for Third-Party Provider service delivery, including the jurisdictions of the immigration or corporate programmes requested by the client, and the countries from which members of our remote team access our systems

All international transfers comply with GDPR Article 46 safeguards:

Standard Contractual Clauses (SCCs) with processors
Adequacy decisions (where applicable)
Processor security certifications (SOC 2, ISO 27001)
Explicit consent for transfers to non-adequate jurisdictions where required

10. Children's Privacy

Our services are not directed to individuals under 18 years of age. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, contact us immediately for deletion.

11. Changes to This Policy

We may update this Privacy Policy to reflect:

Changes in our services or business practices
New legal or regulatory requirements
Improvements to security or privacy protections

Notification of Changes:

Updated version and date displayed at top of this page
Material changes communicated via email to account holders
Continued use after changes constitutes acceptance

Version History: Current: PP-2026-09-15 (15 September 2026)
Previous: PP-2026-05-11 (11 May 2026), PP-2026-02-21 (21 February 2026)

12. Contact & Data Protection Officer

Massive Dynamic Limited
Unit 1603, 16/F, The L. Plaza
367-375 Queen's Road Central
Sheung Wan, Hong Kong

Hong Kong Company Registration: #78076051

Privacy Inquiries:
Email: support@mdhk.ltd
Phone: +852 9290 0201
Subject Line: "Privacy Policy Inquiry"

Supervisory Authority (EU Residents): If you are located in the EU and have concerns about our data processing practices, you may lodge a complaint with your national data protection authority.

Hong Kong Privacy Commissioner (HK Residents):
Office of the Privacy Commissioner for Personal Data
Website: https://www.pcpd.org.hk

13. Security Incident Response

In the unlikely event of a data breach affecting your personal data:

Notification: We will notify affected individuals within 72 hours of discovery
Disclosure: Notification will include nature of breach, data affected, and remedial actions
Regulatory Reporting: Serious breaches reported to relevant authorities as required
Remediation: Immediate steps taken to contain breach and prevent recurrence

14. Sanctions Screening

Our Regulatory Position

Massive Dynamic Limited is not a licensed financial institution, money service operator, trust or company service provider, or other designated non-financial business or profession under Hong Kong's Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO, Cap. 615), and is therefore not subject to the statutory customer due diligence obligations imposed by that Ordinance. Our full regulatory status is set out in our Terms of Service, Section 7.

As a matter of internal policy, and to meet the requirements of our banking and payment partners, we voluntarily apply customer due diligence and sanctions screening standards aligned with AMLO Cap. 615 to all clients. We screen against:

United Nations Security Council Sanctions List
Hong Kong Sanctions List (Financial Services and the Treasury Bureau)
OFAC Specially Designated Nationals (SDN) List (where applicable to USD transactions)
EU Consolidated Sanctions List (where applicable to EUR transactions)
UK HM Treasury Consolidated Sanctions List (where applicable to GBP transactions)

Screening Process

At Engagement: All new clients screened before service commencement
Periodic Re-Screening: Active clients re-screened periodically and upon material updates to sanctions lists
KYC Timeline: Identity verification must be completed within 30 working days of engagement. Failure to complete verification results in mandatory suspension of the business relationship.
Data Processed: Full legal name, date of birth, nationality, address, beneficial ownership information (for corporate clients)
Data Source: Customer due diligence (KYC) documentation provided by the client
Retention: Screening records retained for 6 years, aligned with AMLO Cap. 615 record-keeping standards

Outcome

Engagement may be declined or terminated if a client appears on a sanctions list, if a true match is identified, or if KYC verification cannot be completed within the stated timeline. Where a positive screening result is identified, the matter may be reported to relevant competent authorities (including the Joint Financial Intelligence Unit) where we are required or entitled to do so by law.

Your Rights

Notification: You will be notified if your engagement is declined or terminated due to sanctions screening, to the extent permitted by law
Disclosure to Third Parties: No personal data resulting from screening is shared with third parties except as required by competent regulatory authorities
Right to Object: Sanctions screening is a mandatory condition of engagement and cannot be opted out of

Your privacy is fundamental to our business.

We are committed to transparency, security, and your control over personal data. If you have questions or concerns about this Privacy Policy or our data practices, please contact us at support@mdhk.ltd.

This Privacy Policy is governed by the laws of Hong Kong SAR and complies with the Personal Data (Privacy) Ordinance (PDPO, Cap. 486) and, where applicable, the EU General Data Protection Regulation (GDPR).