Privacy Policy

Effective and last updated: 5 September 2026

This Privacy Policy explains how Synergy Marketing Technology Limited (“Synergy”, “we”, “us” or “our”) collects, uses, stores and discloses personal data through our company website, enquiries, marketing activities and the digital marketing, advertising, analytics, website, CRM, automation, artificial intelligence and related technology services that we provide (together, the “Services”).

Important role distinction. When we process personal data supplied or controlled by a customer in order to provide the Services, that customer normally decides why and how the data is used and remains the relevant data user. Synergy processes that data on the customer’s instructions. Synergy is the data user for information used to manage our own website, accounts, enquiries, proposals, contracts, support, security, billing and consented communications.

1. Who we are and how to contact us

Synergy Marketing Technology Limited
Suite 2556, Level 25, Two Harbour Square, 180 Wai Yip Street, Kwun Tong, Kowloon, Hong Kong
Privacy contact: Data Protection Officer
Email: info@synergymar.tech

2. Scope

This Policy applies when Synergy collects personal data for its own business or processes personal data while providing the Services. It does not replace the privacy notice that a customer must give to its own clients, contacts, employees or other data subjects. Third-party platforms and service providers apply their own privacy terms to data they handle independently.

3. Personal data we may process

Website, enquiry and business contact information

Name, company, role, telephone or WhatsApp number, email address and other contact details.
Enquiries, form submissions, meeting requests, proposals, support messages, feedback and service communications.
Consent choices, direct-marketing preferences, opt-out records and suppression records.

Customer, project and service information

Account and authorised-user details, project requirements, campaign settings, creative materials, website content, audience information and customer instructions.
Advertising, analytics, website, CRM and automation data that a customer asks us to access, import, organise, analyse or manage.
Communications, contact records, attachments and other content supplied by a customer or made available through an authorised integration.
Contracts, subscriptions, invoices, billing and transaction records. Payment-card details are handled by the relevant payment provider and should not be sent to us by email or support chat.

Platform and integration information

When a customer authorises a connection to a third-party platform, we may process the business account, advertising account, page, profile, website, CRM, messaging account or other identifiers needed to provide the requested service. Depending on the integration, this may include configuration details, authorisation status, access tokens, campaign or content data, templates, delivery status, webhook events, contacts and communications. The customer remains the owner or authorised user of its own platform assets.

Technical, cookie and usage information

Our website, hosting, analytics and security providers may automatically process IP address, browser or device type, cookie or similar identifiers, requested URL, referring page, approximate region, request time, interaction events, conversion events, error logs and security events.

4. How we obtain personal data

We obtain personal data directly from individuals and their organisations, from forms and communications, from files or content that users choose to provide, from customers that engage us, from authorised third-party platform connections, from public business sources where lawful and appropriate, and automatically through the operation, analytics and security of our website and Services.

A customer or user must not supply, upload or connect personal data unless it and its organisation have authority to do so and have provided any notice or obtained any consent required by law.

5. Why we use personal data

To respond to enquiries, prepare proposals, register and support customers, and manage our business relationship.
To provide, configure, operate and improve the Services requested by a customer.
To create, manage, measure and report on websites, advertising, content, analytics, CRM, messaging, automation and related workflows.
To authenticate users, maintain authorised integrations and perform customer-requested actions.
To keep consent and opt-out evidence, honour suppression requests and support customers’ compliance obligations.
To administer contracts, subscriptions, billing, accounting and payments.
To monitor performance, troubleshoot, prevent fraud or abuse, protect systems and respond to security incidents.
To comply with law, enforce our agreements and protect Synergy, our customers, service providers and the public.
To send information about Synergy’s services where the recipient has given any consent required by law.

6. Cookies, analytics and advertising technologies

We may use cookies, tags, pixels and similar technologies to operate the website, remember preferences, understand usage, measure campaigns and improve our Services. These may include Google analytics or tag-management tools and Meta advertising tools. Where required, we will request consent before using non-essential technologies. Browser settings and any consent controls made available on the website can be used to manage these technologies, although disabling them may affect some functions.

7. AI-assisted and automated processing

Some Services may use automated or artificial intelligence tools to classify, summarise, extract, draft, forecast or analyse information supplied by us or a customer. Only information reasonably necessary for the requested task should be provided to those tools. Outputs can be incomplete, outdated or wrong and must be reviewed before they are used for a business, legal, financial, property, marketing or other material decision. We do not use customer confidential content to train Synergy’s own general-purpose model unless the customer expressly agrees in writing.

8. Disclosure and service providers

We disclose personal data only where reasonably necessary for the purposes described in this Policy, including to:

Hosting, security, website, analytics, advertising, communication, CRM, automation, artificial intelligence, payment and cloud-service providers.
Third-party platforms such as Google, Meta and WhatsApp where a customer requests or authorises the relevant integration or campaign.
Professional advisers, auditors, insurers, support contractors and other suppliers subject to appropriate confidentiality and data-protection duties.
A purchaser, investor or successor in connection with a genuine business reorganisation or transaction, subject to appropriate protections.
Courts, regulators, law-enforcement bodies or other recipients where required or permitted by law.

Some providers may process data outside Hong Kong. We take reasonably practicable steps to select providers that protect personal data, use appropriate contractual or organisational safeguards where applicable, and limit the data shared to what is necessary. We do not sell personal data.

9. Retention

Enquiry, account, customer and consent records are retained while needed for the relationship, support, consent evidence, suppression records or legal obligations and are reviewed periodically.
Customer project and connected-service data are retained according to the applicable agreement, customer instructions and service configuration. After a verified deletion request or termination, active copies under our control are deleted or anonymised within a reasonable period unless a longer period is required by law or contract.
Security and operational logs are normally retained only as long as needed to operate and protect the Services or investigate an incident.
Billing, contractual and dispute records are retained for the periods required by accounting, tax, limitation and other legal requirements.
Residual copies in protected backups expire through the normal backup cycle and are not used for ordinary business processing.

10. Direct marketing

Where Synergy proposes to use a person’s name, telephone number, WhatsApp number, email address or other personal data for direct marketing, the relevant collection notice will identify the purpose and the classes of services to be promoted. We will not use personal data for that purpose without the consent required by the Personal Data (Privacy) Ordinance. Consent is optional and is not pre-ticked.

A recipient may withdraw consent or opt out at any time, without charge, by using the unsubscribe method in the message, replying “STOP” where applicable, or contacting info@synergymar.tech.

11. Security

We use reasonably practicable administrative, technical and physical safeguards appropriate to the nature of the data and the risk. These may include access controls, least-privilege handling, encrypted network transport, secret-management practices, supplier review, logging, backups and incident response. No system is completely secure. Users must protect their accounts and must never send us passwords, one-time codes, access tokens or payment-card details by email, support chat or an unapproved file.

12. Your rights and choices

Subject to the Personal Data (Privacy) Ordinance and other applicable law, a person may ask whether Synergy holds personal data about them, request access to or correction of that data, request deletion where it is no longer required, withdraw consent, opt out of direct marketing or ask questions about our practices. We may verify identity and authority before acting and may charge only a fee permitted by law for a data-access request.

Send requests to the Data Protection Officer at info@synergymar.tech or follow our Data Deletion Instructions. If the requested data is controlled by one of our customers, that customer may need to decide the request and instruct us; we will provide reasonable assistance.

13. Children

Our business Services are intended for organisations and authorised business users aged 18 or over. Our website is not directed to children, and users must not intentionally provide children’s personal data unless doing so is lawful, necessary and appropriate for the requested service.

14. Changes to this Policy

We may update this Policy to reflect changes in our Services, technology, providers or legal obligations. We will publish the revised version and its effective date. Where a change materially affects how existing personal data is used, we will provide an appropriate notice and obtain consent where required.

15. Questions and complaints

Please contact our Data Protection Officer first so that we can investigate. Individuals may also contact the Office of the Privacy Commissioner for Personal Data, Hong Kong.

English