Skip to content
Fostier Consulting

Privacy policy

Updated 18 October 2026

Legal framework

This policy is issued under Hong Kong's Personal Data (Privacy) Ordinance (Cap. 486) (the "PDPO") and, for individuals in the European Union or the European Economic Area, the General Data Protection Regulation (EU) 2016/679 (the "GDPR").

Data controller

Fostier Consulting, established in Hong Kong, is responsible for the personal data collected through this website. Privacy contact: lucie@fostierconsulting.com or +852 6537 4439.

Data we collect

This is an introductory website. Apart from job applications, which are covered by a separate candidate privacy notice given when you apply, it has no forms and does not collect personal data by itself. We only process the information you choose to share when you contact us by email, WhatsApp, WeChat, or phone — typically your name, contact details, preferred language, and the content of your messages. No browsing data is collected for advertising or profiling. To measure audience, the site uses Vercel Web Analytics, which sets no cookies and only produces aggregated, anonymous statistics (page views, country, device type, referring site). Our hosting provider, Vercel, also processes technical request data, such as IP addresses in server logs, to deliver the site and keep it secure.

Purposes and legal bases

This data is used exclusively to respond to your enquiries, arrange an initial conversation, and manage the client relationship if you become a client. Processing relies on steps taken at your request before entering into a contract and on our legitimate interest in answering enquiries; where consent is required, we ask for it and you may withdraw it at any time (Article 6 GDPR for individuals in the EU). In Hong Kong, data is collected and used in line with the Data Protection Principles of the Personal Data (Privacy) Ordinance, Cap. 486.

Processors and service providers

Your data is never sold or shared with third parties for commercial purposes. To run this website and receive your messages we use the providers below. Depending on the service, they process data on our behalf or under their own terms, and their own privacy policies also apply:

  • Vercel Inc. (United States): website hosting, server logs, and Vercel Web Analytics, which sets no cookies.
  • WhatsApp (Meta): messages you send us on WhatsApp.
  • WeChat (Tencent): messages you send us on WeChat.
  • Email provider (Microsoft Outlook): emails you send us or that we send you.

Cross-border transfers

Fostier Consulting is based in Hong Kong, so your data may be handled there, and it may be transferred between or accessed from Hong Kong, France and mainland China and, through our providers, the United States. Where the GDPR applies, transfers outside the European Economic Area, including to Hong Kong and mainland China, which are not covered by an EU adequacy decision, rely on appropriate safeguards such as standard contractual clauses, or on the derogations the GDPR allows, for example for steps taken at your request before entering into a contract.

Retention

Contact data is kept only for as long as needed to handle your request, then deleted or anonymised unless the law requires otherwise.

Your rights and how to make a request

Under the PDPO you may ask for access to, and correction of, the personal data we hold about you. Under the GDPR you also have rights of erasure, restriction, portability and objection, and you may withdraw consent at any time. Whichever law applies, you can ask us to delete your data and we will do so unless we are required by law to keep it. You may also complain to the Privacy Commissioner for Personal Data in Hong Kong (pcpd.org.hk) or, in the EU, to your supervisory authority, such as the CNIL in France. To make a request:

  • Email lucie@fostierconsulting.com or call +852 6537 4439.
  • Say what you are asking for (access, correction, or deletion) and give the contact details you used with us, so we can find your records.
  • We may ask you to confirm your identity before acting on the request.
  • We reply within 40 days under the PDPO and within one month where the GDPR applies.

Security

We apply reasonable measures to protect your data (restricted access, encrypted channels). As no Internet transmission is fully secure, absolute security cannot be guaranteed.

Changes

We may update this policy. The date at the top of this page shows when it last changed.