Privacy Policy

1. Who We Are

This Privacy Policy applies to hf8.ch and all services operated under the HF8 brand, including AI Marketing, AI Agents, AI Research and Development, and the HF4 LLM. The data controller responsible for processing your personal data is:

HF8 (operated by Avvi Management LTD)
Suite C, Level 7, World Trust Tower
50 Stanley Street, Central, Hong Kong
Email: info@hf8.ch

HF8 serves clients across Europe, the Gulf Cooperation Council, and Asia-Pacific. This policy is written to satisfy the transparency requirements of the EU General Data Protection Regulation (GDPR), the Saudi Arabia Personal Data Protection Law (PDPL), the UAE Personal Data Protection Law (PDPA), and the Hong Kong Personal Data (Privacy) Ordinance (PDPO), as applicable to our processing activities.

2. What Data We Collect and Why

2.1 Contact forms and email enquiries

When you submit a contact form or email us, we collect your name, email address, company name, job title, and the content of your message. We process this data to respond to your enquiry and, where applicable, to fulfil pre-contractual or contractual obligations.

Legal basis (GDPR): Art. 6(1)(b) — performance of a contract or pre-contractual steps; Art. 6(1)(f) — our legitimate interest in responding to business enquiries. Retention: 24 months from last interaction, or longer if required by applicable law or an ongoing contractual relationship.

2.2 Server log files

Our hosting infrastructure automatically records standard server log data when you access hf8.ch. This includes your IP address, browser type and version, operating system, referrer URL, pages accessed, and the date and time of access. This data is used solely to ensure the technical operation and security of the website. It is not merged with any other data source and is not used to identify individual users.

Legal basis (GDPR): Art. 6(1)(f) — our legitimate interest in maintaining a technically secure and functional website. Retention: 30 days, after which logs are automatically deleted.

2.3 Website analytics (Google Analytics 4)

We use Google Analytics 4, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics places cookies on your device and collects information about your browsing behaviour on our website, including pages visited, session duration, device type, and approximate geographic location. This data is transmitted to Google servers, which may be located in the United States.

We have activated IP anonymisation. Your full IP address is truncated before transmission to Google servers outside the EEA. We have executed a Data Processing Agreement with Google. Data transfers to the US are covered by Google's certification under the EU-US Data Privacy Framework (DPF) and, as a supplementary safeguard, by Standard Contractual Clauses (SCCs). Further information: policies.google.com/privacy.

Legal basis (GDPR): Art. 6(1)(a) — your consent, obtained via our cookie consent mechanism. You may withdraw consent at any time by adjusting your cookie preferences or by installing the Google Analytics opt-out browser add-on at tools.google.com/dlpage/gaoptout. Retention: 14 months within Google Analytics, after which data is anonymised or deleted.

2.4 Advertising and remarketing (Google Ads, Google Remarketing, Google Conversion Tracking)

We use Google Ads and related Google advertising services (Remarketing, Conversion Tracking) to promote our services in search results and across the Google Display Network. These services use cookies and similar technologies to recognise visitors who have previously accessed hf8.ch and to measure the effectiveness of our advertising campaigns.

Google Conversion Tracking allows us to determine whether a user who clicked on one of our ads subsequently took a specific action on our website (for example, submitting a contact form). We receive aggregated, anonymised statistics only — we cannot identify individual users from this data.

Data transfers to the US are covered by Google's DPF certification and SCCs. Further information: policies.google.com/technologies/ads.

Legal basis (GDPR): Art. 6(1)(a) — your consent, obtained via our cookie consent mechanism. You may opt out of personalised advertising at google.com/settings/ads.

2.5 Bot protection (Google reCAPTCHA v3)

We use Google reCAPTCHA v3 on our website to distinguish automated bot traffic from human users and to protect our forms against spam and abuse. reCAPTCHA v3 operates invisibly in the background — it analyses behavioural signals including mouse movements, keyboard patterns, browser settings, and interaction history without presenting a challenge to the user. A risk score is generated and transmitted to our servers. No individual is identified by this process.

Legal basis (GDPR): Art. 6(1)(f) — our legitimate interest in protecting the integrity and security of our website against automated abuse. Further information: policies.google.com/privacy.

3. AI Processing and Automated Systems

3.1 HF4 LLM and AI Agents

Where you interact with our AI-powered services — including the HF4 large language model or any HF8 AI Agent — the content you submit (prompts, queries, documents, and related metadata) is processed to generate responses and deliver the requested service. This constitutes automated processing of personal data to the extent that your inputs contain or relate to personal information.

We do not use your inputs to retrain, fine-tune, or otherwise improve our AI models without your explicit prior written consent. Inputs are processed in accordance with the retention periods set out in your service agreement, and are not used for any purpose beyond delivering the contracted service.

Legal basis (GDPR): Art. 6(1)(b) — performance of the contract between you and HF8; Art. 6(1)(f) — our legitimate interest in maintaining service quality.

3.2 Automated decision-making

HF8 does not make decisions that produce legal or similarly significant effects on individuals solely through automated processing, without human review, unless this is expressly agreed in a separate service agreement and disclosed at the point of collection. Where automated analysis is used to inform (but not solely determine) recommendations, this is disclosed in the relevant service documentation.

4. Third-Party Data Processors

We engage trusted third-party service providers who process personal data on our behalf as data processors. All processors are bound by data processing agreements requiring them to process data only on our instructions and to maintain appropriate security measures. Key processors include:

• Google Ireland Limited — analytics, advertising, and bot protection (see Sections 2.3 to 2.5)
• Zoom Video Communications Inc — video conferencing for client communications (processor agreement in place; US transfers covered by DPF and SCCs)
• IONOS SE — website hosting infrastructure (processor agreement in place)

We do not sell personal data to third parties. We do not share personal data with third parties for their own independent marketing purposes.

5. International Data Transfers

HF8 is incorporated in Hong Kong and serves clients globally. Personal data may be transferred to and processed in countries outside your country of residence, including Hong Kong, the United States, and other jurisdictions where our processors operate.

For transfers of personal data from the European Economic Area (EEA) to third countries, we rely on the following transfer mechanisms as applicable: (a) adequacy decisions of the European Commission where available; (b) the EU-US Data Privacy Framework for transfers to certified US entities; and (c) Standard Contractual Clauses (SCCs) as supplementary safeguards.

Hong Kong is not currently subject to an EU adequacy decision. Transfers from the EEA to Hong Kong are therefore conducted on the basis of SCCs, supplemented by our assessment that the level of data protection in Hong Kong under the PDPO is broadly comparable to EU standards for the categories of data we process.

6. Cookies

hf8.ch uses cookies — small text files stored on your device. We use the following categories:

• Essential cookies — strictly necessary for the website to function. These cannot be disabled. Legal basis: Art. 6(1)(f) — legitimate interest in operating a functional website.
• Analytics cookies — used by Google Analytics to understand how visitors use our website. Activated only with your consent.
• Advertising cookies — used by Google Ads and remarketing services to measure campaign performance and deliver relevant ads. Activated only with your consent.

You can manage or withdraw your cookie preferences at any time through our cookie consent tool or through your browser settings. Withdrawing consent does not affect the lawfulness of processing that occurred before withdrawal.

7. Your Rights

Depending on your location, you have the following rights in relation to your personal data. To exercise any of these rights, contact us at info@hf8.ch. We will respond within 30 calendar days.

7.1 Rights under GDPR (EU/EEA residents)

• Access — you may request a copy of the personal data we hold about you.
• Rectification — you may request correction of inaccurate or incomplete data.
• Erasure — you may request deletion of your data where grounds apply (e.g. data is no longer necessary, consent is withdrawn, or processing is unlawful).
• Restriction — you may request that we limit processing of your data in certain circumstances.
• Portability — where processing is based on consent or contract and carried out by automated means, you may request your data in a structured, machine-readable format.
• Objection — you may object at any time to processing based on legitimate interests (Art. 6(1)(f)), including profiling. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
• Lodge a complaint — you have the right to lodge a complaint with the supervisory authority in your EU member state of residence or where the alleged infringement occurred.

7.2 Rights under Gulf data protection laws

If you are located in Saudi Arabia, you have rights under the Personal Data Protection Law (PDPL) including the right to access, correct, and request deletion of your personal data, and the right to withdraw consent. Requests may be submitted to info@hf8.ch and will be handled within the timeframes prescribed by applicable law.

If you are located in the UAE, you have rights under the UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection. These include rights of access, correction, deletion, and objection to processing. Contact us at info@hf8.ch to exercise these rights.

7.3 Rights under Hong Kong PDPO

If you are located in Hong Kong, you have the right under the Personal Data (Privacy) Ordinance (Cap. 486) to request access to and correction of your personal data held by us. Requests should be directed to info@hf8.ch.

8. Data Security

We implement appropriate technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include TLS/SSL encryption for all data transmitted to and from hf8.ch, access controls limiting data access to authorised personnel, and contractual security obligations imposed on all data processors.

No method of transmission over the internet or method of electronic storage is completely secure. We cannot guarantee absolute security, but we are committed to applying industry-standard safeguards and to notifying affected individuals and relevant authorities in the event of a data breach where required by applicable law.

9. Retention Periods

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, to comply with legal obligations, to resolve disputes, and to enforce our agreements. The following retention periods apply as a general guide:

• Contact form and email enquiries: 24 months from last interaction
• Client contractual data: duration of the contract plus 7 years (to satisfy applicable commercial and tax record-keeping obligations)
• Server log files: 30 days
• Analytics data (Google Analytics): 14 months
• AI tool inputs (HF4, AI Agents): as specified in your service agreement, or 90 days from submission if no agreement specifies otherwise

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our processing activities, applicable law, or regulatory guidance. Material changes will be notified by updating the "Last updated" date at the top of this page. We encourage you to review this policy periodically. Your continued use of hf8.ch after any update constitutes acceptance of the revised policy.

11. Contact and Complaints

For any questions about this Privacy Policy, to exercise your data subject rights, or to raise a concern about our data processing practices, please contact us at:

Email: info@hf8.ch
Postal: Avvi Management LTD, Suite C, Level 7, World Trust Tower, 50 Stanley Street, Central, Hong Kong

EU residents who are not satisfied with our response have the right to lodge a complaint with the supervisory authority in their member state of residence. A list of EU supervisory authorities is available at edpb.europa.eu.

HF8  ·  hf8.ch  ·  Last updated: 30 May 2026