Introduction
Propaxio (“Propaxio,” “we,” “us,” or “our”) operates the website propaxio.com and provides performance marketing services to clients in the regulated finance sector. This Privacy Policy describes how we collect, use, and share personal information when you visit our website, contact us, or engage with our services.
Who controls your information
Propaxio (CR No. 74644985), of Office 26, 10/F, Beverley Commercial Centre, 87–105 Chatham Road South, Tsim Sha Tsui, Kowloon, Hong Kong, is the data controller / data user responsible for personal information collected through this website, unless another entity is identified at the point of collection.
As a business established in Hong Kong, we handle personal data in line with the Hong Kong Personal Data (Privacy) Ordinance (PDPO) and, where our processing is subject to them, the EU/UK GDPR and other applicable data-protection laws.
We are committed to protecting your personal information and being transparent about how we use it. This policy applies to all visitors, users, and clients of our website and services.
Information We Collect
We collect personal information in the following ways:
Information You Provide
- Contact details — name, email address, company name, role, and phone number when you book a strategy call, contact us, or subscribe to communications.
- Business context — information about your business, ad spend, marketing objectives, and current marketing setup that you share during strategy calls or onboarding.
- Communication content — emails, messages, and call notes from interactions with our team.
Information Collected Automatically
- Usage data — pages visited, time spent on pages, referring URLs, browser type, operating system, and approximate location (derived from IP address).
- Device identifiers — IP address, device IDs, and similar technical identifiers collected via cookies, pixels, and analytics services.
Information from Third Parties
We may receive information from third-party sources such as ad platforms (Meta, Google, Microsoft), CRM integrations (GoHighLevel), analytics providers, and publicly available business data sources.
How We Use Information
We use the personal information we collect to:
- Provide, maintain, and improve our services and website
- Respond to inquiries, schedule strategy calls, and deliver requested services
- Send service-related communications, including onboarding, performance updates, and administrative messages
- Send marketing communications about our services, where you have opted in or where we have a legitimate interest under applicable law
- Analyze website performance, understand visitor behavior, and improve the user experience
- Detect, prevent, and address technical issues, fraud, and security incidents
- Comply with legal obligations, enforce agreements, and protect our rights
Legal Basis for Processing (GDPR)
If you are located in the European Economic Area, United Kingdom, or another jurisdiction with similar data protection laws, we rely on the following legal bases for processing your personal information:
- Consent — for marketing communications and certain analytics cookies, where you have given explicit permission
- Contract performance — to deliver services you have requested or to take steps prior to entering a contract with you
- Legitimate interests — for service improvement, security, and limited marketing to existing clients, balanced against your privacy rights
- Legal obligation — where required by applicable law or regulation
Sharing and Disclosure
We do not sell your personal information. We share personal information only in the following circumstances:
Service Providers
We use third-party service providers to operate our business — for example, CRM platforms, email delivery services, analytics providers, and hosting infrastructure. These providers process personal information on our behalf under contractual obligations consistent with this policy.
Legal Requirements
We may disclose personal information when required by law, court order, or government request, or where necessary to protect our rights, property, safety, or that of our clients or others.
Business Transfers
If Propaxio is involved in a merger, acquisition, asset sale, or bankruptcy, personal information may be transferred as part of that transaction. We will notify affected individuals where required by law.
Service Providers We Use
We rely on a limited set of third-party providers to operate our website and services. We disclose personal information to them only as needed to provide our services, and they are required to protect it. The main categories and representative providers we currently use are:
- Analytics — Google Analytics.
- Advertising & measurement — Google Ads, Meta, Microsoft Advertising.
- CRM & lead management — GoHighLevel.
- Scheduling, hosting, and email — the providers used to run our booking, website hosting, and email infrastructure.
We review this list periodically and update it as our tooling changes. We do not sell personal information.
Client Data We Process as a Service Provider
When we deliver services such as tracking, attribution, CRM, and lifecycle marketing, Propaxio may process personal information on behalf of our clients — for example advertising audiences, lead records, analytics events, and conversion data. In these situations the client is generally the data controller (data user) who determines the purpose and lawful basis for the processing, and Propaxio acts as a service provider (data processor) handling the data according to the client's instructions and the terms of the applicable agreement or Data Processing Addendum (DPA).
If you are an end customer of one of our clients and have questions about how your data is used, please contact that business directly, as they control that processing.
Data Retention
We retain personal information for as long as necessary to fulfill the purposes outlined in this policy, comply with our legal obligations, resolve disputes, and enforce agreements. Specifically:
- Inquiry data — typically retained for 24 months after last contact
- Client engagement records — retained for the duration of the engagement and up to 7 years after for accounting, tax, and contractual purposes
- Marketing preferences — retained until you opt out or for 36 months of inactivity
Your Rights
Depending on your location, you may have the following rights regarding your personal information:
- Access — request a copy of the personal information we hold about you
- Correction — request that we correct inaccurate or incomplete information
- Deletion — request that we delete your personal information, subject to legal exceptions
- Restriction — request that we limit how we process your information
- Portability — request your information in a structured, machine-readable format
- Objection — object to processing based on legitimate interests, including direct marketing
- Withdraw consent — withdraw consent at any time where processing is based on consent
To exercise these rights, contact us using the details in the “Contact Us” section below. We will respond within the timeframes required by applicable law (typically 30 days under GDPR).
Cookies and Tracking Technologies
Our website uses cookies and similar tracking technologies to understand how visitors interact with our content and to deliver relevant marketing. We use:
- Essential cookies — required for the site to function (e.g., session management)
- Analytics cookies — to understand site usage (e.g., Google Analytics)
- Marketing cookies — to deliver and measure advertising (e.g., Meta Pixel, Google Ads conversion tracking)
You can control non-essential cookies through your browser settings or our cookie consent banner where applicable. For a full list of the cookies and similar technologies we use, their purposes, and their durations, see our Cookie Policy.
Data Security
We implement industry-standard technical and organizational measures to protect personal information against unauthorized access, disclosure, alteration, or destruction. These measures include encryption in transit, access controls, vendor security reviews, and incident response procedures. However, no system is perfectly secure, and we cannot guarantee absolute security of information transmitted over the internet.
International Data Transfers
Personal information may be transferred to and processed in countries other than the one in which you reside. Where we transfer personal information outside the European Economic Area, United Kingdom, or other jurisdictions with restrictions on international transfers, we rely on appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms approved by relevant authorities.
Children's Privacy
Our services are intended for businesses and professionals, not individuals under 18. We do not knowingly collect personal information from children. If we learn that we have collected information from a child without parental consent, we will delete it.
Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date at the top of this page and, where appropriate, notify you by email or a notice on our website.
Contact Us
If you have questions about this Privacy Policy, want to exercise your rights, or have a complaint, contact us at:
Email: privacy@propaxio.com
We aim to respond to all inquiries within 14 business days.