Personal Data (Privacy) Policy
Last updated: Jun 1, 2026Introduction and scope
This Personal Data (Privacy) Policy explains how Property Wealth International Limited, incorporated in Hong Kong ("we", "us", "the Company"), collects, holds, uses and discloses personal data. It applies to customers, prospective customers, and visitors to our website and app. This Policy is prepared to comply with the Personal Data (Privacy) Ordinance, Cap. 486 ("PDPO").
In this Policy, "you" and "your" refer to the Client — the customer or prospective customer to whom this Policy applies.
Property Wealth International Limited (the "Company") is the data controller for personal data under the PDPO. The Company's registered office is at Unit B, 11/7, Yam Tze Commercial Building, 23 Thomson Road, Wan Chai, Hong Kong (Business Registration No. 77357844).
What personal data we collect
Identity and contact details: full name, date of birth, nationality, residential address, email address, phone number
Identification documents: passport/HKID number and copies, proof of address
Financial information: bank account details, income and source of wealth, investment experience and risk profile
Account and transaction data: account numbers, holdings, transaction history, communications with us
Technical data: IP address, device identifiers, browser type, and usage data collected through our website and app
How we collect personal data
Directly from you, when you open an account, complete a Know-Your-Customer (KYC) or onboarding form, or contact customer support
Automatically, through your use of our website and app (see "Cookies and similar technologies" below)
From third parties, such as identity-verification providers, payment processors, and, where permitted, publicly available sources or credit reference agencies
Purposes for which we use your data
In line with Data Protection Principle 1 of the PDPO, we collect and use personal data only for purposes directly related to our functions, including to:
Open and administer your account, and carry out identity verification and anti-money laundering (KYC/AML) checks
Provide, operate and improve our services
Comply with legal and regulatory obligations, including reporting to regulators
Respond to enquiries and provide customer support
Send service-related communications, and marketing communications where you have consented (you may opt out at any time)
Detect, investigate and prevent fraud and other financial crime
Disclosure and sharing of personal data
We do not sell your personal data. We may disclose personal data to:
Where necessary to provide our products or services to you
With appointed property developers, conveyancing solicitors, and mortgage brokers as necessary to execute property reservations and transactions, or with the specific referring partner that introduced you to us.
Where required by law, court order, or to comply with other legal, statutory or regulatory obligations, including accounting and taxation requirements
To prevent, detect or investigate crime, fraud or other financial misconduct
Where you have given consent, whether express or implied
With our group companies and professional advisers, such as auditors and legal counsel, under confidentiality obligations
With service providers who process data on our behalf, such as custodians, payment processors, identity-verification providers and cloud/IT providers
With regulators
Retention of personal data
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, accounting or regulatory requirements. Financial and KYC records are generally retained for a minimum period after the end of the business relationship, as required under applicable anti-money laundering and securities regulations.
Data security
We apply technical and organisational measures across the following areas:
Logical controls — authentication and access controls, encryption of data in transit and at rest, firewalls, malware detection, and regular back-up procedures.
Frameworks and audit — our information security approach is subject to periodic internal audit.
Breach notification — if we become aware of a data breach likely to result in a real risk of harm, we will notify affected individuals and the relevant authorities without undue delay.
While we take appropriate precautions, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.
Monitoring of communications
Telephone calls, emails and other electronic communications between you and us may be monitored and/or recorded, for the purposes of maintaining service quality, training, detecting and preventing fraud, and complying with our legal and regulatory obligations.
Use of Artificial Intelligence (AI)
We may use, or engage service providers who use, artificial intelligence (AI) tools to support our business — for example, to improve efficiency, analyse data, and generate insights or recommendations that help us deliver better outcomes for you. Where an AI tool informs a decision that affects you, a human remains able to review and, where appropriate, intervene in that decision.
Third-party AI tools — where a service provider uses AI technologies on our behalf, such as for data analysis, customer support or operational tasks, this is permitted only where and to the extent we have approved it in writing. We ensure a human can oversee, and where necessary check, any such use when it involves processing your personal data.
The use of automated or AI-based processing does not affect your rights under the PDPO, including your right to request access to, or correction of, your personal data.
Cross-border transfer of personal data
Our operations may involve service providers or group entities located outside Hong Kong, so personal data may be transferred to, and processed in, other jurisdictions. We take reasonable steps to ensure any such transfer is subject to safeguards comparable to those required under the PDPO. Section 33 of the PDPO, which would further restrict cross-border transfers, has not yet been brought into force in Hong Kong; this section should be revisited if that changes.
Use of Google Analytics and remarketing
Our website uses Google Analytics, a web analytics service provided by Google, to help us understand how visitors use our site. Google Analytics uses cookies that collect information such as your IP address and browsing activity, which is transmitted to and processed by Google, including on servers located outside Hong Kong (see "Cross-border transfer of personal data" above). Google uses this information to compile reports on website activity and to provide related analytics services to us, and may share it with third parties where required by law or where those third parties process it on Google's behalf.
You can find out more about how Google collects and processes this data in Google's own privacy policy.
Your rights under the PDPO
Under the PDPO, you have the right to:
Request access to the personal data we hold about you (a Data Access Request)
Request correction of any inaccurate personal data (a Data Correction Request)
To exercise these rights, contact us using the details below. To protect your privacy, we will require proof of identity, such as your HKID, before disclosing any personal data. We may charge a reasonable fee to cover the cost of complying with a data access request, and we will comply with, or explain our reasons for refusing, any request within 40 days, as required under section 19 of the PDPO.
Cookies and similar technologies
Our website and app use cookies and similar technologies to operate core features, remember your preferences, and understand how our services are used (analytics). You can manage or disable cookies through your browser settings; some features may not function properly if cookies are disabled.
Hyperlinks
Our website and app may contain links to websites operated by other organisations. This Policy applies only to our own website and app; we are not responsible for the privacy practices or content of any linked third-party website.
Changes to this policy
We may update this Policy from time to time to reflect changes in our practices or legal requirements. Material changes will be notified through our website, app, or direct communication. The as-of date at the top of this Policy shows when it was last revised.
How to contact us
If you have questions about this Policy, or wish to exercise your data access or correction rights, please contact, Property Wealth International Limited (trading as "On Invest") at enquiry@on-invest.asia.