Privacy Policy · Signet Shield

1. Who we are

Signet Shield is operated by Signet Technologies Limited (“Signet Shield,” “we,” “us” or “our”), a company incorporated in Hong Kong with its registered office at [Unit / Floor, Building, Street], [District], Hong Kong SAR.

This Privacy Policy explains how we collect, use, disclose, transfer and protect personal data when you visit signetshield.com (the “Website”), create or use a Signet Shield account, or otherwise interact with us. It is our Personal Information Collection Statement and privacy policy statement for the purposes of the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong (the “PDPO”).

For the personal data described in this policy, we act as a “data user” under the PDPO and, where the EU or UK General Data Protection Regulation (“GDPR”) applies, as a “controller.”

2. Scope and our customers' end users

Our customers are businesses that install the Signet Shield client agent on their own websites and apps to identify devices and prevent fraud (the “Services”). When we process data about visitors to our customers’ properties (“Customer Data”), we do so on behalf of, and on the instructions of, that customer. In that role we act as a data processor (and, under the GDPR, a processor) and our processing is governed by our agreement with the customer, including our Data Processing Addendum.

If you are a visitor to one of our customers’ websites or apps, please read that customer’s privacy policy and direct any requests to them. If you contact us directly, we will refer your request to the relevant customer where we are able to identify them.

3. Personal data we collect

Information you give us

Account information — your name, work email address, company name, job title and password (stored only as a salted hash).
Billing information — billing contact and address, tax identifiers and payment details. Card details are collected and stored by our payment processor; we receive only a token and limited card metadata (such as brand and last four digits).
Communications — the content of messages you send us, including through our contact form (with your company name and size if you choose to provide them), support requests, survey responses and call recordings where you have been told a call is recorded.

Information collected automatically

Device and usage data — IP address, browser type and version, operating system, device characteristics, language and time-zone settings, referring URL, pages viewed and the date and time of each request.
Dashboard activity — actions you take in your account, such as API keys created, settings changed and sign-in events, kept as an audit log for security.
Cookies and similar technologies — see Cookies and similar technologies.

Information from third parties

Single sign-on providers — if you sign in with Google or GitHub, we receive your name, email address and profile image from that provider.
Payment and fraud-prevention providers — payment status and risk-screening results relating to your transactions.

4. Our live demo

Our home page and live demo page show you how Signet Shield works by running our identification technology on your own browser. When you load those pages, your browser computes a visitor identifier from device and browser characteristics (such as screen properties, graphics hardware, installed fonts, time zone and language). That identifier is sent to our servers together with your IP address and user agent.

We use this data only to:

display your result back to you, including how many times you have visited;
detect automated traffic and abuse of the demo; and
keep the demo secure and working properly.

We do not combine demo data with your account, use it for advertising or profiling, or share it with third parties other than our hosting providers. Demo records are deleted automatically no more than 30 days after your last visit. The raw signals used to compute your identifier remain in your browser and are not stored by us.

Our legal basis under the GDPR is our legitimate interest in demonstrating our product to visitors who choose to view it and in protecting the Website. If you prefer not to take part, you can leave the page, or contact us at privacy@signet.example.com to have demo data relating to you deleted.

5. How we use personal data

We use personal data for the following purposes:

to create and administer your account and provide the Services;
to process payments, issue invoices and keep financial records;
to secure our Website and Services, including detecting and preventing fraud, abuse, and unauthorised access;
to respond to your enquiries and provide customer support;
to send service communications, such as security alerts, usage notifications and changes to our terms;
to analyse usage, troubleshoot problems and improve and develop our products;
to send you direct marketing, only where you have consented (see Direct marketing); and
to comply with legal obligations, enforce our agreements, and establish, exercise or defend legal claims.

We will not use your personal data for a new purpose that is not directly related to the purposes above without first obtaining your voluntary and express consent, as required by Data Protection Principle 3 of the PDPO.

Providing your account and billing information is necessary for us to provide the Services. If you do not provide it, we will not be able to open or maintain your account.

6. Legal bases (EEA and UK)

If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases:

Contract — to provide the Services and manage your account and billing;
Legitimate interests — to secure the Website and Services, prevent fraud, run our live demo, understand how our products are used and improve them, and communicate with business contacts. We balance these interests against your rights and you may object at any time;
Consent — for direct marketing and any non-essential cookies, which you may withdraw at any time; and
Legal obligation — to keep accounting records and respond to lawful requests from authorities.

7. Direct marketing

In accordance with Part 6A of the PDPO, we will not use your personal data in direct marketing, or provide it to others for use in direct marketing, unless you have given us your consent. We intend to use your name and email address to send you information about Signet Shield products, features, events and offers relating to fraud prevention and device intelligence. We do not provide your personal data to third parties for their own direct marketing.

You can withdraw your consent at any time, free of charge, by clicking the unsubscribe link in any marketing email or by writing to privacy@signet.example.com. We will continue to send essential service communications while you have an account.

We do not sell personal data, and we do not share it for cross-context behavioural advertising. We disclose personal data only to:

Service providers who process it on our behalf under contract — including cloud hosting and content delivery, payment processing, email delivery, customer support tooling and error monitoring. A current list of sub-processors is available on request from privacy@signet.example.com;
Our affiliates, for the purposes described in this policy;
Professional advisers such as lawyers, auditors and insurers, under duties of confidentiality;
Law enforcement, regulators and courts, where we are required to by law or where disclosure is necessary to protect the rights, property or safety of Signet Shield, our customers or others; and
A buyer or successor, in connection with a merger, acquisition, financing or sale of assets, subject to this policy.

9. International transfers

We are based in Hong Kong, and our service providers operate data centres in other jurisdictions, including the United States and the European Union. Your personal data may therefore be transferred to, stored in and processed outside Hong Kong and outside the country where you live.

Wherever your data is processed, we require recipients to protect it to a standard comparable to the PDPO and this policy. For transfers of personal data from the EEA or the UK to countries without an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum, together with supplementary measures where appropriate.

10. How long we keep data

In line with Data Protection Principle 2 of the PDPO, we keep personal data only for as long as necessary to fulfil the purposes for which it was collected:

Account data — for as long as your account is open, and then for up to 24 months so that you can reactivate it and so that we can resolve disputes;
Billing and transaction records — for at least 7 years, as required by Hong Kong law, including the Inland Revenue Ordinance (Cap. 112) and the Companies Ordinance (Cap. 622);
Security and server logs — up to 12 months;
Live demo data — up to 30 days after your last visit; and
Customer Data — according to our customer’s retention settings, and deleted within 30 days after the customer’s agreement ends unless the law requires otherwise.

When data is no longer needed we delete or irreversibly anonymise it.

11. How we protect data

We take all practicable steps, as required by Data Protection Principle 4 of the PDPO, to protect personal data against unauthorised or accidental access, processing, erasure, loss or use. Our measures include encryption in transit and at rest, network isolation, role-based access controls with multi-factor authentication, logging and monitoring, regular vulnerability testing, and confidentiality obligations for staff and contractors.

No method of transmission or storage is completely secure. If you believe your account has been compromised, or you have found a vulnerability, please contact security@signet.example.com immediately.

12. Your rights

Under the PDPO (Hong Kong)

You have the right to:

ask whether we hold personal data about you and request a copy of it (a “data access request” under section 18);
ask us to correct personal data that is inaccurate (a “data correction request” under section 22); and
ask about our policies and practices on personal data and the kinds of personal data we hold.

We will respond to data access and correction requests within 40 days of receipt, as required by the PDPO. We may charge a fee for processing a data access request, which will not be excessive.

Under the GDPR (EEA and UK)

In addition, you may have the right to access, rectify or erase your personal data, restrict or object to its processing, receive it in a portable format, and withdraw consent at any time without affecting processing that took place before you withdrew it.

Under US state privacy laws

Depending on where you live, including California, you may have the right to know what personal information we collect and how we use and disclose it, to access, correct and delete it, and to opt out of its sale or sharing (we do not sell or share personal information). We will not discriminate against you for exercising these rights. You may use an authorised agent to submit a request on your behalf.

How to make a request

Email privacy@signet.example.com or write to our Personal Data Privacy Officer at the address in Contact us. We may need to verify your identity before acting on your request, and we may decline requests where the law permits us to do so, in which case we will tell you why.

13. Cookies and similar technologies

Cookies are small files stored on your device. We use a limited set of cookies and similar technologies:

Strictly necessary — to keep you signed in to the dashboard, protect against cross-site request forgery and remember security preferences. The Services cannot function without them.
Device identification — our live demo (see Our live demo). We may also use our own technology on our sign-in and sign-up pages to protect accounts against fraud and automated attacks.

We do not use advertising cookies or allow third parties to place advertising trackers on the Website. If we introduce analytics or other non-essential cookies, we will update this policy and ask for your consent where the law requires. You can block or delete cookies in your browser settings, but parts of the dashboard may stop working.

14. Children

The Website and Services are intended for businesses and are not directed at anyone under the age of 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, please contact privacy@signet.example.com and we will delete it.

15. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will change the effective date at the top of this page and, if the changes are material, notify account holders by email or through the dashboard before they take effect.

16. Contact us

If you have questions about this policy or wish to exercise your rights, please contact our Personal Data Privacy Officer:

Personal Data Privacy Officer
Signet Technologies Limited
[Unit / Floor, Building, Street], [District], Hong Kong SAR
Email: privacy@signet.example.com

If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong (www.pcpd.org.hk). If you are in the EEA or UK, you may also complain to your local data protection supervisory authority.

This policy is written in English. If we provide a translation, the English version prevails to the extent of any inconsistency.

The short version