Effective date: 27 August 2026
This privacy policy explains how EKCO COOPERATION LIMITED, a company registered in Hong Kong with its registered address at 1/F 5G TSENG TAU TSUEN, SAI SHA RD, Sai Kung, Hong Kong, collects, uses, shares, and protects personal information when you visit our website at https://www.ekco.autos, when you contact us, or when you use the computer systems design and integration services we provide.
The website and the systems, tools, and support services described on it are developed and operated by the developer Ekcocpt on behalf of EKCO COOPERATION LIMITED. This policy covers personal information handled across our website, our project work, and our managed operations services. We are committed to handling your information fairly, lawfully, and transparently, and we review our practices regularly to keep them aligned with the requirements that apply in Hong Kong and in the countries where our clients operate.
Please read this policy carefully before providing us with any personal information. If you do not agree with any part of it, you should stop using the website and contact us before sharing information with us. By continuing to use the website and our services, you acknowledge that you have read and understood this policy. Capitalised terms that are not defined here have the meaning given to them in our terms of service.
We collect information in two main ways. First, we collect information that you provide to us directly. Second, we collect information automatically when you interact with our website or use our services.
Information you provide directly includes your name, email address, telephone number, company name, job title, and the contents of any enquiry, message, or document you send to us through our contact form, by email, by telephone, or during a project. When you engage us for a project, we may also collect billing information, payment details, and technical information about the systems you ask us to design, integrate, or operate. We always collect this information with your knowledge and for a purpose that is clear to you.
Information collected automatically includes your device type, browser type, operating system, internet protocol address, the pages you visit, the date and time of your visit, the referral source that brought you to the site, and approximate location data. We collect this information using standard web technologies, including cookies and server logs, which are described in more detail later in this policy.
We do not intentionally collect sensitive categories of personal information. Where a project requires us to handle such information, we do so only on your explicit instruction, under a separate agreement, and with safeguards appropriate to the sensitivity of the data.
We use your information for clear and limited purposes that are related to the services we provide and the relationship we have with you. We use contact information to respond to your enquiries, to prepare proposals, to deliver projects, to provide support, and to maintain our ongoing relationship with you.
We use your information to send service messages, security notices, and operational updates that are part of the systems we manage for you. These messages are necessary for the delivery of our services and are not marketing communications. Where we send promotional or marketing material, we do so only with your consent or where permitted by law, and you can opt out at any time using the instructions in each message.
We also use information to improve our website, to monitor performance and security, to diagnose faults, to analyse how our services are used, and to comply with our legal obligations. Where we rely on your consent for a particular use, we make that clear at the point of collection, and you may withdraw your consent at any time without affecting the delivery of the services you already receive.
We do not use your personal information for purposes that are incompatible with the purposes described in this policy. If we need to use your information for a new and unrelated purpose, we will update this policy and, where required by law, seek your consent before doing so.
Where data protection law applies to our processing of personal information, we rely on several lawful bases. We process information in order to perform a contract with you or to take steps at your request before entering into a contract. This includes processing information to deliver design, integration, and operations services that we have agreed to provide.
We process information to comply with legal obligations that apply to our business, including obligations relating to taxation, accounting, record keeping, and responses to lawful requests from authorities. Where such obligations require us to retain information, we keep it for the period the law requires.
We also process information for our legitimate business interests, which include operating our website, securing our systems, preventing fraud and abuse, responding to enquiries, and delivering support and service improvements. When we rely on legitimate interests, we balance those interests against your rights and freedoms and apply safeguards where your interests require them.
Where the law requires consent as the basis for processing, we obtain it in advance and in a clear and specific way. You may withdraw consent at any time by contacting us, and we will stop the processing that relies on that consent without affecting the lawfulness of processing carried out before withdrawal.
Our services operate across cloud platforms, and our team supports clients in multiple countries and regions. As a result, personal information that we collect may be stored and processed in countries outside the place where you are located, including in the Hong Kong Special Administrative Region and in other jurisdictions where our service providers operate.
When we transfer personal information across borders, we apply appropriate safeguards designed to protect the information. These safeguards include contractual commitments such as standard contractual clauses, reliance on recognised adequacy decisions where they apply, and equivalent protections required under applicable law.
Before engaging a provider in another jurisdiction, we assess the security and data protection standards of the destination and of the provider. We choose providers that maintain strong controls over data security and that agree to handle information only for our purposes. You may request details of the safeguards we apply to your information by contacting us.
Where the law of a particular jurisdiction gives you stronger rights than those described in this policy, we will honour those rights to the extent they apply to you. Nothing in this policy is intended to limit any right that you hold under the law of your place of residence.
We keep personal information only for as long as it is needed for the purposes described in this policy, or for as long as the law requires us to keep it. The retention period for each category of information is determined by the purpose it serves and by any legal, accounting, or contractual requirements.
Enquiry correspondence is retained for a reasonable period so that we can manage our relationship with you and answer follow-up questions accurately. Project records, including technical documentation and billing information, are retained for the duration of the engagement and for as long as needed to honour warranties, invoices, and legal obligations. Monitoring and analytics data is kept in an aggregated form that does not identify individuals.
When personal information is no longer needed, we delete it or make it anonymous in a secure manner. Deletion is performed using methods that prevent recovery, and anonymisation is performed so that the data can no longer be linked to you. We review our retention schedules periodically and adjust them to reflect changes in our services and in the law.
Some information may be retained for a longer period where required by law, such as accounting records or records needed to respond to legal proceedings. In those cases, the information is retained only for the period the law requires and is not used for any other purpose.
Depending on where you live, you may have rights over your personal information. These rights may include the right to access the information we hold about you, the right to correct inaccurate information, the right to delete your information, the right to restrict or object to certain processing, and the right to receive your information in a portable format.
To exercise any of these rights, contact us at contact@ekco.autos with a clear description of the right you wish to exercise and the information to which it relates. We respond to all requests within the timeframes required by applicable law, and we keep you informed of the progress of your request.
Before acting on a request, we verify your identity to protect your information and to prevent unauthorised access. We may ask for proof of identity or for details that confirm you are the person to whom the information relates. Where we cannot verify your identity, we will explain what we need from you before we can proceed.
We do not charge a fee for exercising your rights in ordinary circumstances. Where a request is manifestly unfounded, excessive, or repetitive, we may charge a reasonable administrative fee or decline to act, and we will explain our reasoning in that case.
Our website and our services are intended for business and professional audiences and are not directed to children. We do not knowingly collect personal information from children, and we design our services with that expectation in mind.
If we become aware that we have collected personal information from a child without appropriate consent, we take prompt steps to delete that information. Where we cannot verify the age of a user, we treat the information with the care required for sensitive handling.
If you believe that a child has provided personal information to us, please contact us so that we can investigate and take the appropriate action. We take these reports seriously and we respond to them quickly.
We protect your personal information with administrative, technical, and physical safeguards that are appropriate to its sensitivity and to the risks it faces. These safeguards include encryption of data in transit, access controls that limit who can see personal information, secure development practices, and regular reviews of our systems and procedures.
We train our team on the importance of confidentiality and on the practical steps each person must take to protect the information they handle. Access to personal information is granted only to people who need it to perform their duties, and that access is reviewed regularly.
No method of transmission over the internet and no method of storage is completely secure. While we work hard to protect your information, we cannot guarantee absolute security against every possible threat. We encourage you to protect any passwords and to be careful about the information you share online.
In the event of a data incident that affects your personal information, we respond according to our incident response procedures. We assess the scope of the incident, take steps to contain and reduce harm, inform affected parties and regulators where the law requires, and review our controls to prevent recurrence.
Our website may contain links to external websites and may use third party tools, including analytics services, mapping services, communication platforms, and hosting providers. These third parties operate under their own privacy policies and process information under their own control, and we encourage you to review their policies before sharing information with them.
Where a third party processes personal information on our behalf, we require an appropriate contract that sets out the scope of processing, the safeguards that apply, and the obligations of the provider. We review our provider relationships periodically to confirm that our standards continue to be met.
We are not responsible for the content or the privacy practices of external websites, even where they are linked from our site. When you leave our website, you should check the policy of the site you are visiting before providing any information. The protection of your information on other sites is governed by their own policies, not by this one.
We do not use your personal information for automated decision making that produces legal or similarly significant effects about you. We believe that decisions that materially affect a person should involve human judgment and review.
Where analytics or monitoring tools classify activity for security or performance purposes, the results are reviewed by people and are not used to make automated decisions that affect your rights. Any automated sorting that we use is limited to operational organisation of information, such as routing an enquiry to the correct engineer.
If we ever introduce processing that has a significant automated component, we will update this policy and inform you before relying on such processing. We will also provide a way for you to request human review of any decision that materially affects you.
We may update this privacy policy from time to time to reflect changes in our services, in our use of technology, or in legal requirements. When we make changes, we update the effective date shown at the top of this page, and the updated version applies to information collected after that date and, to the extent permitted by law, to information collected before it.
If changes are significant, we take reasonable steps to bring them to your attention, including placing a notice on our website or sending an email to the address you have given us. We encourage you to review this page periodically so that you are aware of how your information is being handled.
Continued use of our website or services after changes take effect means that you accept the updated policy. If you do not agree with the updated policy, you should stop using the website and services and contact us to close any active engagement, and we will handle any outstanding matters in accordance with your instructions.
If you have questions about this policy or about how we handle your personal information, you can reach us in several ways. You may email us at contact@ekco.autos, telephone us at +12245840571, or write to us at 1/F 5G TSENG TAU TSUEN, SAI SHA RD, Sai Kung, Hong Kong.
We welcome questions about privacy and we respond to enquiries promptly. When you contact us, please provide enough detail for us to understand your question and to locate the relevant information. This helps us to give you an accurate and useful answer.
Our data protection contact is the person responsible for privacy within our team. All privacy enquiries are routed to that contact, who coordinates our response and ensures that your request is handled consistently with this policy.
We hope that we can resolve any concern about privacy directly with you. If you are not satisfied with our response, you may have the right to raise a complaint with a data protection authority in your country or region. In Hong Kong, enquiries and complaints about personal data privacy may be directed to the Office of the Privacy Commissioner for Personal Data.
We ask that you give us the opportunity to resolve your concern before escalating it. You may contact us through the details in the previous section, and we will work with you to address the matter fairly and promptly. We take feedback about privacy seriously, and we use it to improve our practices.
Nothing in this policy limits any rights you hold under applicable law, including the right to seek a remedy through a court or supervisory authority where the law provides one. We will not penalise you for raising a concern or for exercising your rights.
This policy is governed by the laws of Hong Kong, and any dispute arising under it is subject to the exclusive jurisdiction of the courts of Hong Kong, subject to any rights you hold under the law of your place of residence.