Privacy Policy — Hong Kong
How Cerrax handles personal data under the Personal Data (Privacy) Ordinance, in plain terms.
1. Who we are
Cerrax Ltd ("Cerrax", "we") provides software for removals businesses: a pricing engine, and the enquiries, customer records, quotes and jobs around it. We are a company registered in England and Wales, and we have no office or place of business in Hong Kong. This policy explains what personal data we handle for removal firms in Hong Kong and the people they quote, why, and your rights under the Personal Data (Privacy) Ordinance (Cap. 486). Because we are established in the United Kingdom, the UK GDPR also applies to everything we process, wherever the person it is about lives. Questions: hello@cerrax.io.
2. Two different roles
Our role under the Ordinance depends on whose data it is:
- Your data (the removal firm using Cerrax). For account holders' own details, we decide how the data is used, so we are the data user.
- Your customers' data. When a firm uses Cerrax to price a job, any personal data about that firm's customers (names, addresses, districts, phone numbers) is handled by us as a data processor: only on the firm's instructions and never for a purpose of our own. The firm is the data user; our processing is governed by the data processing agreement between us.
- Website visitors. We are the data user for the limited data you give us directly (e.g. a waitlist or contact form).
- A customer's video kept to train software. If a customer agrees to Cerrax keeping their video or photographs for that purpose, we are a data user in our own right for that use alone (see §3).
3. What we collect
Personal Information Collection Statement. Why we collect it: to open and run your account, to price and explain your jobs, to bill you, to tell you about the service, and to build the anonymised learning corpus in §7; we use it for direct marketing only as §11 describes. Whether you must give it: your firm's name, your email address and a password are obligatory — without them we cannot open an account. Your phone number and Business Registration Number are voluntary, and leaving them out does not stop you using Cerrax. The job details you enter are needed to price that job; if you leave one out, Cerrax cannot take it into account. Who it may go to: the service providers named in §8, who process it for us; services you choose to connect (such as your accounting software); a successor to our business; and a regulator, court or law-enforcement body where the law requires it. This paragraph, with §§5, 8 and 12, is our Personal Information Collection Statement under Data Protection Principle 1(3) of the Ordinance. Access and correction: you may ask for access to and correction of your personal data (§12) by writing to the director of Cerrax Ltd responsible for data protection, at hello@cerrax.io or the postal address in §17.
From firms using Cerrax: account and contact details (name, company, email, phone and, if you give it to us, your Business Registration Number), and the job inputs you enter to produce a price. Within job data: addresses and job details, which may be personal data of your customers — processed only to produce and explain a price and record the outcome you tell us. From the job itself: where your crew use Cerrax on the day, photographs they take of the property, its access and any damage found; if you ask your customer to sign the inventory, the name they give and the signature they draw; and, if you invite it and your customer chooses to, a video of their home that they send you to be quoted from. These are held as the record of the job, on your instructions, and are used for nothing else: they never affect a price and are never shared with another firm, unless the firm chooses to send a link to its crew or its insurer (see below). From website visitors: what you submit in a waitlist, demo or contact form. We do not record your browsing sessions or track behaviour for advertising.
The account details we ask for at signup are needed to open and run your account; without them we cannot provide the service. Everything else is supplied by choice. We do not ask for Hong Kong Identity Card numbers and you should not enter them into Cerrax.
Contacts and enquiries (for firms that switch them on). A firm can keep a contact record for each of its customers and enquirers — their name, email addresses, phone numbers, company, preferred language, the addresses they have moved from or to, where the enquiry came from, the firm's notes, and any choice the person made about the firm's messages. The firm decides what is kept; we hold it on its behalf, only within that firm's account, and never share it with another firm. To recognise the same person arriving twice, we keep a scrambled key made from their email address or phone number that cannot be read back without a secret held only by us.
Enquiry emails and AI. A firm can give lead websites a Cerrax address to send enquiries to. We receive those emails (through Amazon Web Services) and read them to fill in the enquiry. If an email isn't laid out in labelled lines, we send its text — without the forwarding headers or earlier quoted messages — to Anthropic, an AI provider in the United States, which suggests the name, contact details, addresses, date and size of the move. A suggestion is only used if the words appear in the email, and a person at the firm checks it before anything is priced or sent. Anthropic does not use it to train its models and deletes it within 30 days (longer only if it is flagged for misuse). We do not keep the email's text for any purpose of our own. When a firm describes a job's items and rooms to Cerrax, we keep that description — with any email address, phone number or address removed — for 30 days to improve how Cerrax recognises items, and then delete the text.
Messages a firm sends through Cerrax. A firm can switch on emails in its own name: a thank-you after a move, and — only if the customer ticked a box agreeing to it — one email after the move asking whether they know anyone else who is moving. Reminder emails about a quote are not available here. Every one identifies the firm, carries its postal address and a one-tap way to unsubscribe; stopping takes effect at once and covers all of these emails from that firm to that person. We keep a record of each choice and when it was made so the firm can show it later, and a scrambled note of a stop so it is honoured even after other records are deleted. The firm is responsible for these messages; we send them on its instructions.
If your customer lets us keep their video to train software. When a customer sends a video or photographs, they may tick a separate box allowing Cerrax to keep them to train software that recognises furniture and rooms. It is never ticked for them and it is not a condition of being quoted. For that use, and only that use, Cerrax is a data user in its own right, not a data processor, and uses the data for this purpose only because the customer has expressly agreed to it (Data Protection Principle 3). Before any footage is used to train software, faces, documents and anything else that identifies a person or the home are blurred. Where Cerrax blurs faces as soon as a video arrives, the firm sees it with faces already blurred. Nothing uses it today: it is kept, not yet used. The customer can withdraw their consent at any time, by asking the removal firm or by writing to us at hello@cerrax.io; the video and photographs are then deleted under the 90-day rule in §10.
Links a firm chooses to share. A firm can send its crew a link to a job sheet, and can give its insurer, broker or claims handler a link to a job's evidence — the customer's name, the photographs, video and signatures, never their email address or phone number. Evidence links expire after a period the firm chooses, at most 90 days; they can be revoked at any time and record each time they are opened. Who receives a link is the firm's decision.
Calendar feeds. If a firm subscribes its own calendar (for example Google, Apple or Microsoft) to its Cerrax calendar link, that calendar provider fetches the firm's booked jobs — including the customer's name, addresses and phone number unless the firm chooses the private version — and holds that copy under the firm's own agreement with it.
Messages about a job. As part of a job, a firm can send its customer booking confirmations, move-day reminders, requests for a video or a payment, a note before a quote expires and, after the move, a request for a review — by WhatsApp where the firm has connected it and the customer uses it, otherwise by email. The customer can instead answer the review request privately, with a rating from 1 to 5 and a comment that only the firm sees. A firm can also keep follow-up tasks about a customer, with notes.
When a customer accepts a quote, we record the time, the version of the firm's terms and the cancellation statement shown, and any box the customer ticked. We do not record their IP address or device. We also count how many times the page for a quote is opened, and note when it was last opened, so the firm can see whether its quote has been read.
A firm's team. The logins of the people a firm invites — their name, email address and sign-in details, including two-step sign-in if they turn it on (the secret that links their authenticator app, and one-time recovery codes kept in scrambled form) — are account data that we are responsible for. What a firm records about its crew for its jobs — the mobile numbers used to send them job sheets, who is assigned to which job, and the times they mark arrival or completion — is the firm's data, which we hold on its behalf. No location is ever captured.
Faces in photographs and video. Nothing in Cerrax recognises a face or keeps any measurement of one. Where faces are blurred, software finds them only to blur them, and the unblurred original is then deleted.
Feedback and problem reports. If someone at a firm reports a problem or sends us feedback from inside Cerrax, we keep it with their name and account so we can look into it and tell them when it is fixed. We may use Anthropic to sort feedback into categories.
Dictation. If you dictate into Cerrax, your browser's own speech-recognition service (Google in Chrome, Apple in Safari) turns your speech into text before it reaches us, under your browser's terms. We receive only the text; you can type instead.
Email delivery records and the audit trail. For each email sent through Cerrax we keep the recipient's address, the subject and whether it was delivered, to investigate delivery problems. We also keep a record of consequential actions in an account and who took them, to keep the service secure and accountable.
4. Cookies
We use only the cookies needed to make the site and service work (for example, keeping you signed in). We don't use advertising or cross-site tracking cookies. If we ever add analytics or other non-essential cookies, we'll tell you first and let you refuse them.
We measure how many people visit these pages using Vercel Web Analytics, which is privacy-preserving by design: it sets no cookie, stores no identifier, and cannot follow you between sites or sessions. It tells us page counts, referring sites and countries and territories — never who you are.
We also keep a few things in your browser so the service works — for example a draft you have not saved yet, or your language. These are strictly necessary and are never used for tracking.
5. Why we use it
- To provide the service — pricing jobs, holding job records, billing and support, under our contract with you.
- To improve the pricing engine — using de-identified data only (see §7); and, to improve how Cerrax recognises items, keeping a firm's descriptions of a job's items and rooms for 30 days with email addresses, phone numbers and addresses removed (see §3).
- To keep the service secure and meet legal obligations — e.g. detecting misuse, rate limits, blocking attacks, checking that a visitor to the public price check is a person, accounting, and responding to lawful requests.
- To keep a customer's video or photographs to train software — only with the customer's express and voluntary consent, which they can withdraw at any time (see §3).
We use personal data only for these purposes, or a purpose directly related to them. We will not use it for a new purpose without your express and voluntary consent, as the Ordinance requires.
6. Automated pricing
Cerrax produces a price automatically from the inputs and settings provided. This is a tool for the firm: the firm decides what to charge its customer (see our Terms). Cerrax does not profile anyone, and the automated price is not a decision Cerrax makes about a customer.
Cerrax can price an enquiry as soon as it arrives, but that price is a proposal to the firm: the firm reviews it and chooses to send it, change it, or not to quote, and a customer is always free to decline a quote. AI in Cerrax only suggests details for a person to confirm; it never sets a price.
7. The learning corpus (important)
Cerrax gets more accurate as it sees real outcomes. When a job is completed, we make a separate de-identified record of it, on the firm's instruction: the volume, a distance band, access features, crew, vans, hours, the price and cost, the month of the move, and an area no finer than the first two letters of a district's name — never the district, street or building. It never holds a name, contact detail, full address, map position, free text, photograph, video, signature, the firm's identity, or any reference that links it back to the job. While we still hold the original job it is treated as personal data like the job itself; once the original is deleted, no one could reasonably identify a person from it — it is then anonymous, and we keep it indefinitely. We will not try to re-identify anyone, and we require anyone we share it with to make the same commitment. Aggregated insight may inform regional benchmarks; we never expose an individual firm's prices or any customer's identity.
8. Who we share it with
We don't sell personal data, and we don't give it to anyone for their own direct marketing. We use a small set of service providers (sub-processors) under contract, currently including: hosting, database and file storage (Google Cloud and Firebase, London region) and account sign-in (Firebase) and geocoding (Google Maps, for distance between addresses). Where a firm uses a feature that reads what it is given — the capture bar and narrative capture, photographs of a written list, spreadsheet import, and enquiry emails with no labelled layout (§3) — those inputs are processed by an AI provider (Anthropic, United States), which does not train on them and deletes them within 30 days. Our website, the Cerrax app and the pages your customers open are run by Vercel, which also provides the cookieless visitor analytics described in §4. Cloudflare Turnstile checks that a visitor to our public price check is a person, not a bot. Email is delivered — to you, and on your behalf to your customers — by Amazon Web Services (SES and SNS, London region), which also receives the enquiry emails sent to your Cerrax lead address. Payments are taken by Stripe — for your Cerrax subscription and, if you connect your own Stripe account to take deposits or balances, your customer's payment on your account; we never see your card details. If you connect your own WhatsApp Business number, the messages you send your customers through it are delivered by Meta (WhatsApp Business). If you connect your own Xero account, the invoice details of the jobs you send to it — your customer's name and address and the amounts — are written into it as draft invoices by Xero. If you connect your own Sage account instead, the same details are written into it as invoices by Sage. We keep this sub-processor list current and reflect only services actually in use, and email account owners at least 30 days before a new provider starts handling their customers' data. We may also disclose data where the law requires it, or to a successor if our business is transferred.
Anthropic is also used to suggest adjustments from the notes on a quote, to write a move-preparation checklist for a customer from the job's districts, date and notes, and to sort feedback sent to us. It does not train on this data and deletes it within 30 days.
9. Where your data is stored
Your data is held in the United Kingdom, in London, so for a firm in Hong Kong it is transferred outside Hong Kong. Section 33 of the Ordinance, which would restrict transfers of personal data out of Hong Kong, has not been brought into force, so no Hong Kong law requires a particular transfer mechanism today. We protect the data as though it did:
- it is used only for the purposes in §5, and protected by the security measures in §15, wherever it is held;
- every service provider that handles it — including those that may process it outside the United Kingdom: the AI provider in the United States, and our mapping, payment and website-hosting providers, which operate internationally — is bound by a written contract to protect it at least as well as our Data Processing Agreement does; and
- in London it is also protected by the UK GDPR, which binds us as a matter of law.
As things stand today: the data behind every Cerrax account is held in London. That is a statement of fact on the date at the top of this page rather than a promise about the future — if you need it in writing for a particular account, or want to know where a specific service processes data, ask us at hello@cerrax.io and we will tell you.
10. How long we keep it
We keep personal data no longer than is necessary for the purpose it was collected for.
Your account data (where we are the data user): for as long as your account is active and for up to six years after it closes, to meet our legal, accounting, and tax obligations — unless the law requires us to keep it longer.
Your customers' data (where we are your data processor): for as long as you keep it with us, and deleted or returned when you ask, as the Data Processing Agreement sets out. Unless you tell us otherwise, job records — a quote, its booking and outcome, the crew's sheets, and any survey or damage photographs attached to them — are kept for six years after the move (or after the quote, if the job did not go ahead), unless a claim or dispute about that job is still open, and then deleted. Photographs have no separate clock: they are kept for as long as the job record they belong to and are deleted with it. A customer's video is deleted 90 days after the job's last date unless the customer has agreed to Cerrax keeping it to train software (§3) and has not withdrawn that consent.
De-identified outcome data: retained for the learning corpus. You can ask us to erase personal data (§12); committed pricing records are never silently altered, but personal identifiers within them can be redacted.
Unless a firm sets different periods: an enquiry that was never priced or sent is deleted 12 months after its last activity; a quote that was sent but never accepted, 24 months after it was sent; a contact record is kept while any job record linked to it is kept, and deleted 12 months after the last one goes (or 12 months after it was made, if it was never linked to a job). A record of a person's consent is kept for as long as their contact record and six years after, so the firm can show it; a scrambled record of a request to stop messages is kept indefinitely, so it keeps being honoured. Our own records: waitlist, demo and contact enquiries, 24 months after our last contact with you (or sooner if you ask); security logs, 90 days.
Also: email delivery records, 90 days; security logs, 90 days (a block on an address is kept while it lasts, then 90 days); the audit trail, up to six years after the account closes, with a customer's details removed when that customer is erased; feedback and problem reports, while the account is open and up to six years after it closes; two-step sign-in details, until they are switched off or the login is removed.
11. Marketing and communications
We'll send you service messages needed to run your account. We will only use your personal data to send you marketing about Cerrax if you have agreed to it, having first been told which of your details we would use (your name and email address) and that the marketing would be about Cerrax's software and services — and you can withdraw that agreement at any time, free of charge, through the unsubscribe link in every marketing email or by emailing us; we will then stop. We never provide your personal data to anyone else for their marketing. Every commercial email we send says who it is from and how to unsubscribe, as the Unsolicited Electronic Messages Ordinance (Cap. 593) requires. We do not send marketing text messages or make marketing calls.
12. Your rights
Under the Ordinance you can ask whether we hold personal data about you and for a copy of it (a data access request), and ask us to correct it if it is inaccurate. We answer both within 40 days, and we do not charge for a data access request. You can also tell us at any time to stop using your data for marketing. Beyond what the Ordinance requires, you can ask us to erase your personal data, and we will unless we must keep it (§10). For your customers' data, where we are the firm's data processor, requests should go to the firm; we help it answer. To exercise a right, contact hello@cerrax.io. Requests are handled by the director of Cerrax Ltd responsible for data protection, at the email address above or the postal address in §17.
You can object to our marketing at any time, and we will stop.
13. Children
Cerrax is a tool for businesses and is not directed at children. We don't knowingly collect data from children.
14. Complaints
If you're unhappy with how we handle your data, tell us at hello@cerrax.io — we will acknowledge your complaint within 30 days and work to resolve it. You can also complain to the Privacy Commissioner for Personal Data, Hong Kong (pcpd.org.hk).
15. Security
We protect data with access controls, encryption in transit and at rest via our cloud provider, and audited administrative actions. No system is perfectly secure, but we take all practicable steps appropriate to the data to protect it against unauthorised or accidental access, processing, erasure, loss or use.
If a personal data breach occurs, we act promptly: where we are the data user and the breach creates a real risk of harm, we notify the Privacy Commissioner and the people affected, as the Commissioner's guidance recommends; where we are a data processor we notify the affected firm without undue delay, and within 48 hours, so it can meet its own obligations.
16. Changes
We may update this policy; we'll post the new version here with a revised effective date.
17. Contact
Cerrax Ltd, 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. hello@cerrax.io.