Legal
Privacy Policy
Last updated: 11 November 2026
Key points
- We collect only the personal data needed to communicate with you, deliver our services and process payments.
- We do not sell personal data, and we do not use advertising or tracking cookies.
- Card details are processed by our payment provider, Airwallex. We never see or store them.
- Where you are a customer of one of our clients, that business is responsible for your personal data, and we process it on its behalf.
- You may request access to, correction of or deletion of your personal data at any time by contacting team@amdsites.com.
1. Introduction and Who We Are
This Privacy Policy explains how AMD global Limited, a company incorporated in Hong Kong (company number 80784470) with its registered office at 50 Stanley Street, Central, Hong Kong, and trading as AMD Global ("AMD Global", "we", "us" or "our"), collects, uses, discloses and protects personal data.
We design, build, host and maintain websites for trades and local businesses worldwide on a monthly or annual subscription. This policy applies to visitors to amdsites.com, individuals who book a consultation with us, our clients and their representatives, and the customers of our clients ("you").
For any matter relating to your personal data, please contact us at team@amdsites.com.
2. Our Role and Applicable Law
We are based in Hong Kong and comply with the Personal Data (Privacy) Ordinance (Cap. 486). As we serve businesses in the United Kingdom, the European Union and other jurisdictions, we also comply with the UK General Data Protection Regulation (UK GDPR) and the EU General Data Protection Regulation (EU GDPR) where they apply, together with any other local law that applies to you. We extend the same standard of protection, and the same rights, to everyone, regardless of where they are located.
Depending on whose personal data is concerned, we act in one of two capacities:
- Controller. For visitors to our website, individuals who book a consultation, and our clients, we determine the purposes and means of processing and are responsible for that processing as described in this policy.
- Processor. The websites we build for clients may collect personal data from their customers, such as enquiries, quote requests or bookings. That data belongs to our client, who acts as controller (or "data user"). We process it solely on the client's behalf and in accordance with its instructions, under a written data processing agreement (see section 9).
3. Personal Data We Collect
3.1 Consultation bookings
When you book a consultation through our website, we collect:
- your trade, current business position, intended timeframe and approximate monthly revenue band (you may select "Prefer not to say");
- your preferred call method (WhatsApp or Zoom);
- for WhatsApp calls, your mobile telephone number and country code; and
- for Zoom calls, your name and email address, and your mobile telephone number if you choose to provide it.
We also record the currency displayed to you, the country from which you accessed our website (derived from your internet connection, not your precise location) and the page from which you booked.
If you choose a Zoom call, you select a time through our scheduling service, Calendly, which collects your name, email address and chosen time and issues the meeting invitation.
3.2 Direct sign-up
If you sign up without a consultation, we collect your name, business name, email address and chosen plan. To prevent automated abuse, we also retain a one-way cryptographic fingerprint of your internet connection, which cannot be used to recover your IP address. It is used solely to limit the number of sign-up links that can be created from one connection each day.
3.3 Onboarding information
Before building your website, we ask you to complete an onboarding form, which saves your answers as you progress. It collects:
- your name, email address and mobile telephone number;
- your business name, trade, location, service area, years of trading, services, prices, opening hours, accreditations and service commitments;
- your existing web address and Google Business Profile, your preferred method of receiving enquiries, and the email address or software to which enquiries should be sent;
- details of previous projects you choose to share, including any customer reviews you provide;
- logos, photographs, videos and documents you upload;
- your invoicing name and address, and a VAT or tax number if provided; and
- your acceptance of our Terms and Conditions.
Please provide reviews, images or information about other individuals, such as your customers or staff, only where you have their permission, and avoid providing information we do not need, such as images showing a customer's address or vehicle registration.
3.4 Payments
Payments are processed by Airwallex on its own secure payment page. We do not see or store your full card details. Airwallex informs us whether a payment has succeeded, and we retain the reference numbers for your plan and payments, your plan status, payment dates and any failed payment. We provide Airwallex with your invoicing name, email address, address and, where provided, your tax number, so that your invoices are accurate.
3.5 Communications
We retain the messages and emails you send us and notes of our calls, in order to deliver what has been agreed. We do not record calls without first obtaining your consent. WhatsApp and Zoom calls are conducted on those providers' services and are subject to their own privacy policies.
3.6 Use of our website
Our website is hosted by Cloudflare. As with any website, its servers process your IP address and basic technical information, such as your browser type, in order to deliver pages and protect against attacks. We do not use analytics, advertising or social media tracking technologies.
Our website's typefaces are delivered by Google Fonts. Your browser therefore connects to Google's servers, which receive your IP address, in order to retrieve the font files.
3.7 Sensitive personal data
We do not request sensitive personal data, such as information about health, religious beliefs or ethnic origin, and we ask that you do not provide it.
4. Purposes and Lawful Bases
We use personal data only for the purposes described below and only to the extent necessary. Where the UK GDPR or EU GDPR applies, each purpose relies on the lawful basis shown.
| Purpose | Lawful basis |
|---|---|
| Arranging and conducting consultations, and responding to enquiries | Steps taken at your request before entering into a contract; our legitimate interest in responding to enquiries |
| Designing, building, hosting, updating and supporting your website | Performance of our contract with you |
| Processing payments, issuing invoices and administering your plan | Performance of our contract with you |
| Maintaining financial and tax records | Compliance with a legal obligation |
| Notifying our team when you book, sign up, request a call or make a payment | Our legitimate interest in operating our business effectively |
| Following up before unpaid onboarding information is deleted | Our legitimate interest in helping you complete your sign-up |
| Preventing spam, fraud and attacks on our website | Our legitimate interest in keeping our services secure |
| Displaying websites we have built in our portfolio, unless you object | Our legitimate interest in showcasing our work |
| Processing our clients' Customer Data | Processing on behalf of, and on the instructions of, the client as controller (see section 9) |
| Handling complaints, disputes and legal claims | Our legitimate interest and, where applicable, compliance with a legal obligation |
Where we rely on legitimate interests, we have balanced those interests against your rights and limited our processing to what you would reasonably expect. You may object to such processing at any time (see section 10).
We do not send marketing communications. Should this change, we will do so only where permitted by law, and every communication will include a simple means of unsubscribing.
6. International Data Transfers
We are based in Hong Kong, and the providers listed in section 5 are located in, or operate servers in, the United States, the European Economic Area, the United Kingdom and other countries. Cloudflare serves content from data centres worldwide. Your personal data may therefore be processed in countries other than your own, whose data protection laws may differ.
Wherever your personal data is processed, we ensure that it is protected to the standard described in this policy. For personal data originating in the United Kingdom or the European Union, we rely on one of the following safeguards:
- a finding that the destination provides an adequate level of protection, including for US organisations certified under the EU-US Data Privacy Framework and its UK Extension; or
- contractual protections approved for this purpose, namely the EU Standard Contractual Clauses, the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
Further details of the safeguard applicable to any provider are available on request.
8. Data Retention
We retain personal data only for as long as necessary for the purposes for which it was collected, after which it is deleted:
| Category | Retention period |
|---|---|
| Consultation bookings that do not lead to a client relationship | 12 months from the date of booking, after which they are deleted automatically |
| Onboarding information and uploaded files where no payment is made | The private onboarding link remains valid for 30 days. All information is deleted automatically on the day after it expires, and the onboarding form displays this date |
| Onboarding information and files of clients | For the duration of the client relationship and for up to 30 days after the plan ends |
| Payment and invoice records | 7 years, as required by Hong Kong business and tax law |
| Emails, messages and call notes | For the duration of the client relationship and for up to 2 years thereafter |
| Customer Data held on behalf of clients | For the duration of the client's plan. On termination, the client may request a copy within 30 days, after which the data is deleted |
| Website security logs (Cloudflare) | A short period determined by Cloudflare, typically a matter of days |
Deleted data may persist in encrypted backups for a limited period until those backups are overwritten.
9. Customers of Our Clients
If you have contacted a business through a website we built for it, for example by submitting an enquiry or making a booking, that business is the controller of your personal data. We process it solely to operate the business's website and only in accordance with its instructions. We do not use it for our own purposes, sell it, or contact you about our own services.
To access, correct or delete your personal data, or for any question about its use, please contact the business directly. If you contact us, we will promptly refer your request to the business and assist it in responding.
Each client agrees to the data processing terms set out in clause 15 of our Terms and Conditions, which govern how we protect its customers' personal data.
10. Your Rights
Wherever you are located, you have the right to:
- Access: obtain a copy of the personal data we hold about you;
- Rectification: have inaccurate or incomplete personal data corrected;
- Erasure: request deletion of your personal data where we are not required to retain it by law;
- Restriction: request that we suspend processing while a concern is investigated;
- Objection: object to processing based on our legitimate interests;
- Portability: receive personal data you have provided in a commonly used format, or have it transmitted to another organisation; and
- Withdrawal of consent: withdraw your consent at any time where we rely on it.
To exercise any of these rights, please contact team@amdsites.com. There is no charge. We will respond within one month and may need to verify your identity. Where a request is complex, we may extend this period by up to two further months, in which case we will inform you.
11. Data Security
We protect personal data through appropriate technical and organisational measures, including:
- encrypted connections (HTTPS) across our website and forms;
- private, access-controlled storage for uploaded files;
- unique, non-guessable links for each client's onboarding form;
- access restricted to personnel who require it, with secure authentication on all accounts; and
- secure storage of credentials, which are never held in our source code.
Although no system can be guaranteed to be completely secure, we take all reasonable precautions. In the event of a personal data breach that places your data at risk, we will notify you, and any regulator that must be informed, within the timeframes required by law.
12. Automated Decision-Making
We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. Our website automatically limits the creation of sign-up links and filters obvious spam, but these measures do not have such effects.
13. Changes to This Policy
We may update this policy to reflect changes to our services or to the law, and will revise the date shown at the top of this page accordingly. Where a change materially affects how we process personal data, we will notify our clients by email before it takes effect.
14. Contact and Complaints
For questions, requests or concerns, please contact us at team@amdsites.com.
If you are dissatisfied with how we have handled your personal data, we ask that you contact us first so that we may address your concern. You also have the right to lodge a complaint with a data protection authority:
- Hong Kong: the Office of the Privacy Commissioner for Personal Data, at pcpd.org.hk;
- United Kingdom: the Information Commissioner's Office, at ico.org.uk/make-a-complaint or on 0303 123 1113;
- European Union: the data protection authority in the member state in which you live or work; or
- Elsewhere: your local data protection regulator.