Caimao Culture Media Limited · Back to the homepage
This Privacy Policy explains how Caimao Culture Media Limited collects, uses, stores and protects personal data when people visit this website, contact the studio, or engage the studio for brand storytelling work in computer systems design and related professional, scientific and technical services. The website and the studio materials are developed and maintained by Caimao Media on behalf of the company, and this policy describes the practices that apply to that work.
The company is registered and operates from Rm 9042 9/F Chung Mei Centre Blk B, 15-17 Hing Yip St, Kwun Tong, Hong Kong - 999077, Hong Kong (HK). The studio can be reached by email at enquiries@ycidesign.buzz or by telephone at +14842766322. This policy is written in plain English and applies to all visitors and clients regardless of where they are located, subject to the mandatory rights described in the sections below.
We have tried to make this policy complete rather than short. It covers what we collect, why we collect it, how long we keep it, who we share it with, how we protect it, and what you can ask us to do with it. If any part of this policy is unclear, please write to the studio email address and we will explain the relevant section in writing.
Caimao Culture Media Limited is a company that runs an ink stone studio for brand storytelling in computer systems design and related professional, scientific and technical services. The studio produces campaign decks, press sheets, client reels, brand voice programs, collateral review sittings and launch calendars for client organisations. The company is the controller of the personal data described in this policy, which means that the company decides why and how that data is processed.
The website is developed and maintained by Caimao Media, a developer that works with the company on digital production and studio content. Where Caimao Media handles personal data in the course of that work, it does so on the instructions of the company and under the same principles set out in this policy. The developer name appears here so that visitors can identify the party behind the technical build of this site alongside the company that operates the studio.
The company address is Rm 9042 9/F Chung Mei Centre Blk B, 15-17 Hing Yip St, Kwun Tong, Hong Kong - 999077, Hong Kong (HK). The studio line is +14842766322. The studio email address is enquiries@ycidesign.buzz. Correspondence may be sent to any of these channels, and we will route privacy questions to the person responsible for data protection within the studio.
This policy applies to personal data that the company collects through this website, through email and telephone correspondence with the studio, through enquiry forms, and through the delivery of studio services to client organisations. It also applies to personal data shared with the company at events, in meetings at the Chung Mei Centre studio, and in tender or procurement processes where the company is asked to provide company information.
This policy does not apply to websites operated by other organisations, even where this website links to them. It also does not apply to personal data that a client organisation handles inside its own systems, including systems described in the decks, sheets and reels that the studio produces. Where the studio receives personal data about the customers of a client so that the studio can produce a client reel or a case story, the client remains responsible for the lawful basis of that sharing and for the consent of the people shown.
Some parts of the website are purely informational and require no personal data. You can read the homepage, the services page and the legal pages without providing any information. Personal data is only collected when you choose to contact the studio or when a client relationship requires it.
The categories of personal data that the company may collect are listed below. We try to collect only what is needed for the purpose at hand, and we do not collect special category data such as health information, political opinions or religious beliefs in the ordinary course of business.
This includes a name, job title, employer name, business email address, business telephone number and business postal address. Where a client is an individual rather than a company, it may also include a personal email address and a personal telephone number that the individual chooses to provide.
This includes the subject and content of messages sent through the contact form or by email, the date and time of the message, and any attachments or links included in it. If you call the studio line, it may include notes taken during the call and a record of the call time.
This includes information about a client engagement such as meeting notes, design briefs, source documents, feedback comments, approvals and delivery records. Where an engagement involves people appearing in a client reel, it may include the name and role of those people and their written permission to appear.
This includes invoice details, purchase order numbers, billing contact details and records of payments received. The company does not store full payment card numbers on its own systems, and card payments are handled through the banking or payment provider used for the engagement.
This includes the internet protocol address used to reach the website, the browser type and version, the device type, the operating system, the referring page and the pages visited. Technical data is used to keep the website working and, where measurement is enabled, to understand which pages are useful to visitors.
Where a person applies to work with the studio, this includes a curriculum vitae, portfolio links, references and correspondence about the application. Recruitment data is handled separately from client data and is kept only for the period described in the retention section.
We collect personal data directly from you in most cases. You provide it when you fill in the contact form, send an email to the studio address, call the studio line, meet the team at the Chung Mei Centre studio, or respond to a proposal. We also receive personal data from client organisations that introduce their staff to the studio for a project, and from partners that recommend the studio to a client.
A limited amount of technical data is collected automatically when your browser requests a page from this website. The web server records the request so that the site can be delivered reliably and so that errors can be diagnosed. This technical data is not used to identify individual visitors and is not combined with contact data unless there is a specific reason to investigate a security incident.
The contact form on this website does not send data to a server owned by the company. Instead, it prepares a message inside your own email program and you choose whether to send it. This design is deliberate. It means that no enquiry content is stored on the website itself, and it gives you a clear moment at which to decide whether the message should be sent.
The company uses personal data for a small number of connected purposes. Each purpose is described below with the kind of data involved. We do not use personal data for a new purpose without updating this policy first, and we do not sell personal data to anyone.
Where the studio produces a client reel that shows identifiable people, the company relies on the written permission obtained for that reel and on the client organisation confirming that its own notices cover the filming. The studio keeps the permission record with the project file so that it can be checked if the reel is reused.
Where the law requires a legal basis for processing, the company relies on the following bases. For enquiries and client work, the basis is usually the performance of a contract or the steps taken before a contract. For accounting, tax and security records, the basis is compliance with a legal obligation or the legitimate interests of the company in running a lawful and secure business.
For optional studio mailings and for certain kinds of measurement, the basis is consent. Where the company relies on legitimate interests, it has balanced those interests against the rights and expectations of the people concerned, and it offers an easy way to object. Where the company relies on consent, that consent can be withdrawn at any time by writing to the studio email address.
Some visitors are located in jurisdictions that grant additional rights or restrictions. The company applies the same core practices to all visitors and then adds the local requirements where they apply, so that no visitor is left with a weaker standard than the one described here.
The web server that delivers this website records a log line for each request. A typical line contains the internet protocol address, the requested page, the response code, the browser identification string and the time of the request. These logs are kept for a short period so that the company can diagnose errors, detect abuse and confirm that the site is available.
Where aggregate measurement is used, it is configured to avoid identifying individuals. The company prefers measurement that reports counts of page views and referral sources without building a profile of any single visitor. Aggregate reports may be shared with the client only in the context of a studio engagement, and never with advertising brokers.
If you would prefer that your visit not appear in any measurement at all, you can enable the do not track setting in your browser or use a browser extension that blocks measurement scripts. The company respects those signals where its tooling supports them.
The company uses a small number of service providers to run the studio and the website. These providers act as processors, which means they handle personal data on the instructions of the company and not for their own purposes. Each provider is chosen for reliability and is bound by a written agreement that covers confidentiality, security and the return or deletion of data at the end of the relationship.
Typical providers include a website hosting service, an email service, an accounting platform and, where a project requires it, a file transfer or review tool. The company reviews the list of providers at least once a year and removes any provider that no longer meets the required standard. A summary of provider categories can be requested by writing to the studio email address.
The company does not allow a provider to use client data to train a general purpose product or to build advertising audiences. Where a provider offers such features by default, the company turns them off or chooses a different provider.
The studio is based in Hong Kong, and most personal data is processed there. Some service providers operate data centres in other regions, which means that personal data may be transferred outside Hong Kong or outside the region where a visitor is located. Where that happens, the company uses appropriate safeguards such as standard contractual clauses or an equivalent mechanism recognised by the relevant authority.
The company limits transfers to what is necessary for the service being provided. For example, an email provider may store messages in a data centre in another region so that the studio can receive enquiries reliably. The company does not move data to a region simply to reduce cost if that would weaken the protection available to the people concerned.
Visitors and clients who need to know whether their data has been transferred to a particular region can write to the studio email address. The company will describe the relevant provider and the safeguard in place, unless the disclosure would compromise the security of the system.
The company keeps personal data only for as long as it is needed for the purpose for which it was collected, or for as long as the law requires. The periods below are the standard periods used by the studio. Where a specific contract or legal requirement sets a different period, that period applies and is recorded in the project file.
When a retention period ends, the company deletes the data or, where deletion is not immediately possible because of backups, isolates it so that it cannot be used for any purpose other than restoring the system. Backups are rotated on a fixed schedule and are not used to extend a retention period beyond what is described here.
The company treats security as part of the craft of the studio, not as an afterthought. All connections to this website are served over encrypted transport. Access to studio systems is limited to the people who need it for a specific task, protected by strong authentication, and reviewed when a person leaves the team.
Files that contain client data are stored in a controlled location with version history, so that an accidental change can be reversed and so that the original approval can be checked. Printed material that contains personal data is kept in a locked drawer at the studio and shredded when it is no longer needed. Devices that hold studio data are encrypted and require a passcode to unlock.
No system is perfectly secure. The company therefore plans for the possibility of an incident and rehearses the steps that follow one. If a breach occurs that is likely to result in a risk to the rights of the people concerned, the company will notify the relevant authority and the affected people without undue delay, in line with the law that applies to the incident.
The company sends studio mailings only to people who have asked to receive them, and only about work that is relevant to the recipient. A mailing might describe a new studio service, a change to the way a service is delivered, or a short note about a piece of work that the studio has published. Mailings are sent at most once a month and are written by a person, not generated as a bulk feed.
Every mailing contains a working way to unsubscribe, and the request is actioned promptly without asking for a reason. You can also write to the studio email address and ask to be removed from the mailing list. Removing a person from the mailing list does not remove the records needed to deliver a service that the person has already engaged, or the records needed for accounting.
The company does not buy mailing lists and does not add people to its list simply because they gave a business card at an event. Where a business card is received, the company asks before adding the person to any list, and the answer is recorded.
Depending on where you live, you may have some or all of the rights described below. The company applies these rights to all visitors and clients as a matter of practice, even where a local law does not require it. To exercise a right, write to the studio email address and describe what you would like the company to do. The company will confirm your identity before acting so that data is not released to the wrong person.
The company responds to a rights request within one month. If a request is complex or involves a large amount of data, the company may extend the period and will tell you why. There is normally no charge for a request, but a reasonable fee may be charged where a request is clearly unfounded or repetitive.
This website and the studio services are intended for businesses and for adults acting in a professional capacity. They are not directed at children, and the company does not knowingly collect personal data from anyone under sixteen years of age. Where a client reel might include a person under sixteen, the client is asked to arrange written permission from a parent or guardian before filming, and the studio keeps that permission with the project file.
If you believe that a child has provided personal data to the company without the agreement of a parent or guardian, please write to the studio email address. The company will investigate the report and delete the data promptly if it was collected in error. Where deletion would affect a client deliverable, the company will discuss the change with the client and remove the child from the material.
The company does not run advertising on this website and does not build audience segments that could be used to reach minors. Any mailing list maintained by the studio is limited to people who have confirmed that they are adults acting in a professional capacity.
The website may link to other sites, for example to a client organisation or to a publication that has covered the studio. The company does not control those sites and is not responsible for their privacy practices. When you follow a link, the privacy policy of the site you reach applies. The company recommends reading that policy before providing personal data.
Where the website embeds content from another provider, such as a video or a document viewer, the provider may set its own cookies or receive technical data about your visit. The company prefers embedding that loads only when a visitor chooses to play or open the content, so that no third party is contacted before you act. If a provider does not support that behaviour, the company uses a plain link instead.
The company does not accept payment for placing a link on this website. Where a page mentions a partner or supplier, it is because the studio works with them, not because of a commercial placement.
The studio may use software tools that assist with drafting, transcription or image preparation. Where such a tool is used, the company limits it to work that does not require the tool to learn from client data, and it reviews the output before anything is shared. A tool is never given personal data that is not needed for the specific task, and it is never allowed to decide the final content of a client deliverable.
If a client prefers that no assisting tool be used on its project, the client can say so at the first sitting and the preference is recorded in the project file. The studio will then complete the work using ordinary editorial and design methods. This choice does not change the fee or the calendar in most cases, because the tools are aids rather than a substitute for studio work.
The company does not use client material to train a general model and does not allow a provider to do so under its terms. Where a provider changes its terms in a way that would permit such use, the company stops using that provider for client work.
The company does not make decisions about people using automated processing that produces legal or similarly significant effects. Decisions about whether to take on an engagement, who to hire and how to price a project are made by people, with the reasoning recorded where the decision concerns a client or an applicant.
The website uses no profiling to alter prices, to hide content or to rank visitors. Measurement, if enabled, is aggregate and does not feed a decision about an individual. If the company later introduces an automated feature that affects people, this policy will describe it before it goes live and will offer a way to ask for a human review.
You can ask the company whether a decision that affected you was made with automated assistance. The company will explain the role of any tool in plain language and, where a human decision was involved, will describe the factors that were considered.
The company keeps a short incident plan so that a problem is handled calmly rather than in a rush. The plan covers how to contain a breach, how to assess the risk to the people concerned, who to inform and how to record what happened. The studio lead is responsible for activating the plan and for keeping a written record of each step.
If a breach is likely to result in a high risk to the rights of the people concerned, the company will contact those people directly and explain what happened, what data was involved and what they can do to reduce the risk. The company will not wait for a perfect account before warning people where an early warning would help them protect themselves.
After an incident, the company reviews what went wrong and changes its practice so that the same problem is less likely to happen again. A summary of the lesson, without personal details, may be shared with clients where it is relevant to work in progress.
If you are unhappy with the way the company has handled personal data, please write to the studio email address first. The company takes complaints seriously and will investigate the concern, explain what it found and set out what it will change. Most concerns can be resolved in that exchange without involving anyone else.
If the concern is not resolved, you may complain to the data protection authority in the place where you live or work, or to the authority in Hong Kong where the company is established. The company will cooperate with an authority that investigates a complaint and will provide the records needed for the review.
Complaining to an authority does not affect any other right you may have, including the right to bring a claim in a court. The company prefers to resolve concerns directly, but it does not ask anyone to give up a legal right as a condition of handling a complaint.
The company reviews this policy at least once a year and whenever a change to the studio or the website requires it. When the policy changes, the date at the top of the page is updated and, for a significant change, a short note is placed at the top of the page so that returning visitors can see what is different.
A significant change might include a new category of personal data, a new provider that processes data in another region, or a new purpose for processing. Where the change relies on consent, the company will ask for that consent rather than assume it from an earlier visit.
The current version of the policy is always the one published on this page. Earlier versions can be requested by writing to the studio email address, and the company keeps a record of each version so that the history can be checked.
For any question about this policy, or to exercise a right described above, please contact the studio using the details below. Please include enough information for the company to identify the matter, such as the email address used in earlier correspondence and the nature of the request.
Caimao Culture Media Limited
Rm 9042 9/F Chung Mei Centre Blk B, 15-17 Hing Yip St, Kwun Tong, Hong Kong - 999077, Hong Kong (HK)
Email: enquiries@ycidesign.buzz
Telephone: +14842766322
The studio answers privacy correspondence within five working days and completes a formal request within the period described in the rights section. If you do not receive a reply, please send the message again and mention that it is a follow up, so that it is routed to the right person.