GUAVAN LIMITED | Public Website & Client Privacy Notice
Privacy Notice
Last updated: 7 September 2026
1. Introduction
GUAVAN LIMITED (“GUAVAN”, “we”, “us” or “our”) respects the privacy of the individuals whose personal data we handle.
This Privacy Notice explains how we collect, use, store, disclose, transfer and protect personal data in connection with our website, enquiries, prospective and existing client relationships, professional relationships and the operation of our business.
GUAVAN LIMITED is a company incorporated in Hong Kong with limited liability (Company No. 80730829) with its registered office at 14 Science Museum Road, Tsim Sha Tsui, Hong Kong.
For the purposes of the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486) (the “PDPO”), GUAVAN may act as a data user in relation to personal data for which it determines the purposes and means of use. Depending on your location and the circumstances of our relationship, other privacy and data protection laws may also apply.
2. Scope of this Notice
This Notice may apply to personal data relating to:
Separate privacy wording or a Personal Information Collection Statement (“PICS”) may be provided for particular services, forms or engagements. Where more specific wording is provided, it should be read together with this Notice.
3. What is personal data?
For the purposes of this Notice, “personal data” means information relating to an identified or identifiable individual, or information treated as personal data under applicable privacy law.
The nature of the information we handle depends on our relationship with you and the matter concerned.
4. Personal data we may collect
4.1 Identity and contact information
4.2 Identification, verification and compliance information
Where reasonably necessary for a proposed or existing engagement, this may include:
We do not ask website visitors to provide such documentation through a general enquiry form unless specifically required.
4.3 Family and relationship information
Because GUAVAN operates as a private office, relevant information may include family relationships, marital status, dependants, guardianship arrangements, succession considerations, family decision-making arrangements and information concerning other family members where necessary for the matter concerned.
4.4 Business and professional information
This may include occupation, employer, professional background, directorships, shareholdings, business interests, corporate structures, professional advisers, transaction information and information relating to companies or organisations with which you are connected.
4.5 Financial and asset-related information
Where relevant to a matter, we may receive information concerning banking relationships, investments, property, companies, trusts or other structures, assets and liabilities, financial objectives, transaction information and source of funds or wealth.
GUAVAN does not collect financial information merely because you browse our website.
4.6 Mobility and immigration information
Where relevant to a mobility or relocation matter, information may include nationality and citizenship, immigration status, residence history, travel history, intended destination, family circumstances, employment or business activities and information contained in immigration-related documentation.
4.7 Education information
Where relevant to education or next-generation matters, information may include academic history, school or university records, qualifications, examination information, language ability, extracurricular interests, educational objectives and information concerning a child or young person.
4.8 Private-office and lifestyle information
Where required to carry out a request, we may process information relating to property, travel, accommodation, household administration, insurance, bookings, memberships, personal preferences, local service arrangements and other private administrative matters.
4.9 Communications and matter information
We may retain emails, correspondence, meeting notes, instructions, documents supplied to us, records of decisions, service requests, complaints and records relating to the administration of an engagement.
4.10 Website and technical information
When you use our website, we may automatically receive certain technical information, including IP address, browser type, device type, operating system, pages viewed, referring page, approximate geographic region derived from technical data, date and time of access, interactions with the website, and cookie or similar technology identifiers.
Please see our Cookie Notice for further information.
4.11 Personal data requiring particular care
Certain matters may involve personal data that is particularly sensitive in context, including health information, information relating to minors, immigration history, financial circumstances, criminal or regulatory matters and other highly private information.
We seek to collect such information only where reasonably necessary and appropriate for the relevant purpose, and to apply additional care to its access, disclosure and security.
You should not send particularly sensitive information through a general website enquiry form unless we have specifically requested it.
5. How we collect personal data
5.1 Directly from you
For example, when you submit an enquiry, communicate with us, become a client, attend a meeting, provide documents, request a service, subscribe to a publication or otherwise interact with GUAVAN.
5.2 From persons authorised by you
This may include family members, personal assistants, employees, representatives, lawyers, accountants, investment professionals, immigration professionals or other advisers.
5.3 From third parties
Where appropriate and lawful, we may receive information from professional advisers, service providers, referral partners, counterparties, educational institutions, public authorities, verification providers, corporate registries or other persons involved in a matter.
5.4 From publicly available sources
We may use legitimate publicly available sources, including official registries, professional directories, company websites, reputable news sources and public professional profiles.
5.5 Automatically
Certain technical information may be collected when you use our website through cookies, server logs and similar technologies.
6. Why we use personal data
6.1 Responding to enquiries
To respond to your request, understand the nature of the matter, determine whether GUAVAN may be able to assist and communicate with you about next steps.
6.2 Client acceptance and engagement
To assess whether we can accept a matter, identify potential conflicts or professional limitations, verify identity where appropriate, conduct reasonable compliance or due-diligence procedures, establish scope, responsibilities and terms, and open and administer a client relationship.
6.3 Providing and coordinating services
To understand your objectives, organise information, coordinate matters, manage projects and timelines, prepare or maintain records, communicate with relevant parties, introduce or instruct specialists, monitor implementation and provide services agreed with you.
6.4 Working with professional advisers and service providers
Where a matter requires external expertise or local implementation, we may use relevant information to coordinate with lawyers, accountants, tax advisers, investment professionals, immigration professionals, corporate service providers, education specialists, property professionals and other providers. We aim to share only information reasonably required for the relevant purpose.
6.5 Administration and relationship management
To maintain client records, manage communications, issue invoices, process payments, administer suppliers, maintain appropriate documentation, manage client preferences and support an ongoing private-office relationship.
6.6 Legal, regulatory and risk purposes
To comply with applicable law, respond to lawful requests from authorities, establish, exercise or defend legal rights, prevent or investigate fraud, misuse or security incidents, protect GUAVAN, our clients and third parties, and meet legitimate compliance, governance and record-keeping requirements.
6.7 Website operation and security
To operate the website, maintain security, diagnose technical issues, prevent misuse, understand website performance and improve content and user experience.
6.8 Publications, events and direct marketing
Where permitted by applicable law and subject to any consent required, we may use relevant contact information to send GUAVAN Perspectives, invitations, business updates, service information and other communications that may reasonably be relevant to you.
GUAVAN does not sell personal data.
7. Use for new purposes
We will not use personal data for a new purpose that is unrelated to the purpose for which it was originally collected without the prescribed consent of the individual, unless such use is otherwise permitted or required by applicable law.
8. Supplying personal data
Unless we tell you otherwise, supplying personal data through the website is generally voluntary.
However, certain information may be required before we can respond meaningfully to an enquiry, establish a client relationship, comply with legal or professional requirements or carry out a requested service.
If required information is not provided, we may be unable to proceed with the relevant request or engagement.
9. Who we may share personal data with
Depending on the matter and subject to appropriate confidentiality and privacy considerations, personal data may be disclosed to the following categories of recipient.
9.1 GUAVAN personnel and service teams
Employees, contractors or other persons working with GUAVAN who require access for legitimate business purposes.
9.2 Professional advisers
For example, lawyers, tax advisers, accountants, auditors, investment professionals, immigration professionals, fiduciaries, notaries and other specialists.
9.3 Operational service providers
For example, providers of cloud hosting, email, document management, cybersecurity, customer relationship management, identity verification, payment processing, analytics, information technology and administrative support.
9.4 Private-office service providers
Where relevant, this may include corporate service providers, education specialists, guardians, property agents, relocation providers, insurers or brokers, travel providers, healthcare administrators and other providers requested or approved in connection with a matter.
9.5 Financial institutions and transaction parties
Where relevant to a legitimate matter, this may include banks, payment providers, professional counterparties or institutions involved in an agreed transaction.
9.6 Public bodies
We may disclose personal data to regulators, courts, law-enforcement authorities, tax authorities, immigration authorities or other public bodies where required or permitted by law.
9.7 Corporate transactions
If GUAVAN undergoes a reorganisation, financing, merger, acquisition, sale or similar transaction, information may be disclosed to professional advisers and relevant parties subject to appropriate safeguards.
10. Data processors and service providers
Where we engage a service provider to process personal data on our behalf, we take contractual or other appropriate measures to require the provider to protect the personal data against unauthorised or accidental access, processing, erasure, loss or use, and to avoid retaining the personal data for longer than reasonably necessary for the relevant processing purpose.
We may also carry out proportionate due diligence on providers and limit access to personal data according to the services being performed.
11. International transfers
GUAVAN works with international clients and professional networks. Accordingly, personal data may in some circumstances be accessed from, stored in or transferred to jurisdictions outside Hong Kong.
The locations in which personal data may be processed will depend on the service providers, professionals and jurisdictions relevant to the particular matter. The privacy laws of another jurisdiction may differ from those of Hong Kong.
Where personal data is transferred internationally, we seek to use reasonable and appropriate measures having regard to the circumstances, which may include:
Where additional transfer requirements apply under another applicable privacy or data protection law, we will seek to comply with those requirements.
12. Data security
GUAVAN takes reasonable and practicable steps to protect personal data against unauthorised or accidental access, processing, erasure, loss or use.
Measures may include, as appropriate:
No method of internet transmission or electronic storage is completely secure. For particularly sensitive matters, we may agree alternative communication arrangements.
13. Data incidents
If a personal data incident occurs, we will assess the nature and potential impact of the incident and take appropriate containment, investigation and remedial measures.
Where appropriate or required by applicable law, we may notify affected individuals, the Privacy Commissioner for Personal Data or other relevant authorities as soon as reasonably practicable.
14. Data minimisation
We seek to collect personal data that is reasonably necessary and relevant to the purpose for which it is used.
A private-office relationship can involve extensive personal context, but this does not mean that every item of information should be collected or shared. Where possible, access and disclosure are limited on a need-to-know basis.
15. Accuracy of personal data
We take reasonably practicable steps to ensure that personal data used by us is accurate having regard to the purpose for which it is used.
We encourage individuals to inform us if their personal data changes or if they believe information held by us is inaccurate or incomplete.
16. Retention
We retain personal data only for as long as reasonably necessary for the purpose for which it was collected or another permitted purpose.
The relevant period may depend on the nature of the relationship, whether an engagement proceeds, the duration of a client relationship, professional or regulatory requirements, legal limitation periods, accounting and tax requirements, compliance obligations, dispute or complaint considerations and legitimate record-keeping needs.
When personal data is no longer reasonably required, we will seek to delete, anonymise or securely dispose of it in accordance with our applicable retention practices.
17. Information relating to children and young people
Some GUAVAN services, particularly education and family matters, may involve children or young people.
The website is not intended to invite children to establish an independent private-office relationship with GUAVAN.
Where appropriate, we may seek confirmation that a parent, guardian or other authorised person has authority to provide personal data concerning a minor or to instruct us in relation to the relevant matter, subject to applicable law and the circumstances of the engagement.
We seek to limit collection of children’s personal data to what is reasonably necessary and to apply heightened care to its access, disclosure and security.
18. Cookies and similar technologies
Our website may use cookies and similar technologies. Some are required for technical operation. Others may be used, subject to applicable requirements and your choices, for functionality, analytics or marketing.
Please see our Cookie Notice for further details and information about managing your choices.
19. Direct marketing
Subject to applicable law, GUAVAN may wish to use your name, email address, telephone number, communication preferences and information concerning your relationship with GUAVAN for direct marketing.
The marketing subjects may include GUAVAN publications and Perspectives, events, private-office services, international mobility, education, structuring and other services that may reasonably be relevant to our relationship with you.
Where the direct-marketing provisions of the PDPO apply, we will take the steps required by Part 6A of the PDPO and obtain your consent or indication of no objection before using your personal data for direct marketing.
We will not provide your personal data to another person for that person’s own direct marketing unless the disclosure has been clearly identified and any consent required by law has been obtained.
You may ask us at any time, without charge, to stop using your personal data for direct marketing by contacting privacy@guavan.com or by using the unsubscribe mechanism in the relevant communication.
20. Your rights in Hong Kong
Subject to the PDPO and applicable exemptions, you may request access to personal data held by GUAVAN and request correction of personal data that is inaccurate.
A formal data access request should be made in the form prescribed by the Privacy Commissioner where applicable. We will respond within the period required by the PDPO, ordinarily no later than 40 calendar days after receipt of a valid request, subject to the provisions and exemptions of the PDPO.
We may take reasonable steps to verify your identity before processing a request.
Where permitted by law, a fee that is not excessive may be charged for complying with a data access request. No fee will be charged merely for requesting correction of inaccurate personal data.
Requests should be sent to:
Privacy Lead GUAVAN LIMITED 14 Science Museum Road Tsim Sha Tsui, Hong Kong privacy@guavan.com
21. Additional rights where other privacy laws apply
Depending on where you are located and the circumstances in which GUAVAN processes your personal data, additional privacy or data protection laws - including the UK General Data Protection Regulation (“UK GDPR”) or the EU General Data Protection Regulation (“EU GDPR”) - may apply to particular processing activities.
Where such laws apply, you may have additional rights, which may include rights to:
Such rights are subject to the conditions, limitations and exemptions contained in the applicable law.
Where UK GDPR, EU GDPR or another law requiring a legal basis for processing applies to particular processing, the relevant basis may include performance of a contract or steps requested before entering into a contract, compliance with a legal obligation, GUAVAN’s or a third party’s legitimate interests where not overridden by applicable individual rights, consent, or another basis permitted by applicable law.
You may contact privacy@guavan.com if you believe additional privacy rights apply to you.
22. Third-party websites and providers
Our website may contain links to third-party websites or services. Their handling of personal data is governed by their own privacy practices.
GUAVAN is not responsible for the privacy practices of independent third-party websites merely because they are linked from our website.
23. Changes to this Notice
We may update this Privacy Notice from time to time to reflect changes in our operations, technology, services, regulatory requirements or privacy practices.
The current version will be published on our website and identified by its “Last updated” date. Where a change is material and appropriate notice is required, we will take reasonable steps to provide that notice.
24. Questions and complaints
If you have a question, concern or complaint about GUAVAN’s handling of personal data, please contact:
Privacy Lead GUAVAN LIMITED 14 Science Museum Road Tsim Sha Tsui, Hong Kong privacy@guavan.com
We will seek to review legitimate privacy concerns appropriately. You may also have the right to contact the Office of the Privacy Commissioner for Personal Data, Hong Kong, or another competent privacy or data protection regulator where applicable.