Privacy Policy

1. Identity of the Data Controller

The data controller for personal data collected through this platform is Lexicord, operating from 9/F, 12 Stanley Street, Central, Hong Kong. Enquiries concerning data protection matters may be directed to [email protected] or by post to the address above.

---

2. Personal Data Collected

Lexicord collects personal data only to the extent necessary to provide the reference platform services and to respond to enquiries. The categories of personal data collected include:

• Contact and identity data: name, email address, telephone number, and organisational affiliation, provided when completing an enquiry form or subscription registration.
• Subscription data: subscription tier, commencement and renewal dates, and payment-related data processed by our payment service provider.
• Usage data: access logs, page navigation data, and browser or device type, collected automatically when you access the platform.
• Correspondence data: the content of communications sent to Lexicord by email, post, or through website forms.

Lexicord does not knowingly collect personal data from individuals under the age of 18. The platform is intended for use by legal practitioners, academics, and institutional teams.

---

3. Purposes of Collection and Use

Personal data collected by Lexicord is used for the following purposes:

• Processing subscription applications and managing subscriber accounts;
• Responding to enquiries and requests for information about the platform;
• Delivering the quarterly editorial bulletin and service communications to subscribers;
• Administering editorial customisation engagements and corresponding with clients;
• Maintaining platform security and monitoring for unauthorised access;
• Improving the platform through aggregated, anonymised usage analysis;
• Fulfilling legal and regulatory obligations applicable to Lexicord's operations.

Lexicord does not sell personal data to third parties. Personal data is not used for automated decision-making that produces legal or similarly significant effects.

---

4. Lawful Basis for Processing

Lexicord processes personal data on the following grounds under the Personal Data (Privacy) Ordinance and applicable data protection principles:

• Contractual necessity: processing required to enter into or perform a subscription agreement;
• Legitimate interests: platform security, fraud prevention, and service improvement;
• Consent: where obtained for specific communications or optional data uses;
• Legal obligation: compliance with applicable Hong Kong law.

---

5. Disclosure to Third Parties

Lexicord may disclose personal data to the following categories of third parties, where necessary:

• Payment processors: for the collection of subscription fees, subject to their own privacy terms;
• IT service providers: hosting and platform infrastructure providers who process data on Lexicord's behalf under appropriate data processing arrangements;
• Professional advisers: including legal counsel and accountants, where required;
• Regulatory authorities: where disclosure is required by law or a binding order of a competent authority.

Any third party acting as a data processor is required to handle personal data only as directed by Lexicord and to maintain appropriate technical and organisational safeguards.

---

6. Retention of Personal Data

Personal data is retained only for as long as necessary for the purposes for which it was collected, or as required by applicable law. The following retention periods apply:

• Subscriber data: retained for the duration of the subscription and for a period of seven years following its conclusion, consistent with general commercial record-keeping practice under Hong Kong law;
• Enquiry correspondence: retained for two years from the date of last contact;
• Usage logs: retained in anonymised form for up to 12 months for platform improvement purposes;
• Payment records: retained as required by applicable tax and accounting legislation.

On expiry of the applicable retention period, personal data is deleted or rendered permanently anonymous.

---

7. Data Subject Rights

Under the Personal Data (Privacy) Ordinance, data subjects have the right to:

• Request access to their personal data held by Lexicord;
• Request correction of inaccurate personal data;
• Withdraw consent to the use of personal data for direct marketing purposes;
• Enquire about the policies and practices of Lexicord in relation to personal data.

Requests concerning data access and correction should be submitted in writing to [email protected] or to Lexicord, 9/F, 12 Stanley Street, Central, Hong Kong. Lexicord will respond within 40 days in accordance with the Ordinance. A reasonable administration fee may be charged for access requests, as permitted under the Ordinance.

---

8. Security Measures

Lexicord maintains technical and organisational measures appropriate to the nature of the personal data held and the risks of unauthorised access, disclosure, alteration, or loss. These measures include access controls, encryption of data in transit, and periodic review of information security practices. No method of transmission over the internet is entirely free from risk; subscribers are advised to keep their access credentials confidential.

---

9. Cookies and Tracking Technologies

The Lexicord platform uses cookies and similar technologies to maintain session state and to collect aggregated usage statistics. Details of the cookies used, including their purposes and the options available to manage them, are set out in the Cookie Policy.

---

10. Links to External Resources

The platform may contain references or links to external legal resources, court websites, and official publications. Lexicord is not responsible for the privacy practices of those external sites and recommends that visitors review the relevant policies when accessing them.

---

11. Amendments to This Policy

Lexicord may amend this Privacy Policy from time to time to reflect changes in practice, technology, or applicable law. The current version of the policy, together with its effective date, is published on this page. Subscribers will be informed of material changes by email prior to the change taking effect.

---

12. Contact and Complaints

Questions, requests, or complaints relating to the handling of personal data may be directed to:

If you are not satisfied with the response to a complaint, you may refer the matter to the Office of the Privacy Commissioner for Personal Data of Hong Kong.