Privacy Policy

1. Controller

This privacy policy is written for an international website operated by a Hong Kong company. It explains how personal data is processed when people visit the website or contact the agency. Where the GDPR applies, the controller is:

2. Scope and legal bases

We process personal data only as needed to provide this website, respond to enquiries, prepare or perform client and talent-related services, comply with legal duties, and protect legitimate business and security interests. Where the GDPR applies, legal bases include Art. 6(1)(b), Art. 6(1)(f) and, where consent is requested, Art. 6(1)(a) GDPR.

3. EU representative

No EU representative is currently appointed. The website is internationally available and does not use EU-specific tracking or analytics. If the agency later targets EU users, clients, creators or talent in a way that triggers Art. 27 GDPR, this section will be updated.

4. Hosting and server log files

This website is hosted by Hetzner Online GmbH. The stated hosting location is Germany.

When the website is accessed, the server processes technically necessary access data. This may include IP address, date and time of access, requested file, referrer URL, browser type, operating system, transferred data volume and HTTP status code.

Where the GDPR applies, processing is based on Art. 6(1)(f) GDPR. Our legitimate interest is the secure, stable and error-free operation of the website. Log data is deleted after as long as necessary for security and troubleshooting, usually no longer than 14 days unless an incident requires longer retention, unless longer retention is needed to investigate security incidents.

Where a hosting provider processes personal data on our behalf and GDPR applies, a data processing agreement under Art. 28 GDPR will be used where required.

5. Contact, briefs and talent enquiries

If you contact us by email or through the brief flow, we process the information you provide to handle the enquiry. This may include contact details, company details, project information, budget ranges, social handles, portfolio links, talent information and any message content you choose to send. The website contact form sends the submitted brief to the agency by email through the configured email delivery provider.

Where the GDPR applies, the legal basis is Art. 6(1)(b) GDPR if the enquiry relates to pre-contractual or contractual steps. In other cases, processing is based on Art. 6(1)(f) GDPR. Our legitimate interest is structured handling of incoming enquiries and business communications.

Enquiry data is deleted when the enquiry has been fully handled and no statutory retention duties or legitimate interests require further storage.

6. Cookies, tracking and consent

The current website does not use analytics tools, advertising trackers or non-essential cookies. It also does not store or access information on the visitor's device for marketing or analytics purposes. For that reason, no cookie consent banner is currently shown.

If analytics, marketing pixels, embedded third-party content or non-essential cookies are added later, consent requirements must be checked before activation and this policy must be updated.

7. Local fonts, images and video

Fonts, images and video assets are currently loaded locally from this website. Loading these assets does not create a connection to external font, video or asset providers.

8. External links

This website may contain links to external services such as Instagram. Merely visiting this website does not transmit data to those external providers through such links. If an external link is clicked, the privacy information of the respective provider applies.

9. Recipients and international transfers

Recipients of personal data are the website operator and, where necessary, hosting providers, email providers and technical service providers involved in operating the website and handling enquiries.

Because the controller is established in Hong Kong, personal data sent by visitors, prospects, clients or talent may be processed in Hong Kong. If the GDPR applies, transfers from the EU/EEA to Hong Kong require a valid transfer mechanism unless a specific exception applies.

10. Your rights

Where the GDPR applies, data subjects have in particular the following rights:

• access to personal data being processed,
• rectification of inaccurate or incomplete data,
• erasure of personal data,
• restriction of processing,
• data portability,
• objection to processing based on Art. 6(1)(f) GDPR,
• withdrawal of consent with effect for the future.

Depending on the visitor's jurisdiction, additional or different privacy rights may apply. Privacy requests can be sent to privacy@chinapunkagency.com.

11. Complaint rights

If the GDPR applies, you have the right to lodge a complaint with a data protection supervisory authority, including in the EU member state of your habitual residence, place of work or place of the alleged infringement, if you believe that the processing of your personal data violates data protection law.

Hong Kong privacy authority: Office of the Privacy Commissioner for Personal Data, Hong Kong
https://www.pcpd.org.hk/

12. Data protection officer

No data protection officer is currently listed. If a legal obligation to appoint one applies, the contact details will be added here.

13. Automated decision-making

Automated decision-making, including profiling within the meaning of Art. 22 GDPR, does not take place on this website.

14. Updates to this policy

This privacy policy will be updated if the website, services, providers, data processing or legal requirements change.