1. Who we are
This website is run by EPOCH TECHNOLOGIES (UK) LTD (Companies House number 17535469), trading as Epoch Technologies (“we”, “us”). We are the controller of the personal data described in this policy. This policy is written to meet the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Hong Kong Personal Data (Privacy) Ordinance (PDPO).
Questions or requests about your data: hansonchan@epochtech.ai.
2. What we collect
Enquiry and demo forms
When you send a form (for example “Book a demo” or “Tell Us What You Need”), we collect what you enter: your name, business name, type of business, email address, phone number, your message and the services you ticked. We also record the page you sent it from and, if you arrived from an ad or campaign link, the campaign tags in that link (such as utm_source, utm_campaign and the Google Ads click ID, gclid).
Website chat (receptionist)
When you use the chat, we keep the messages you type and the replies, the page you were on, your language, your browser type and a scrambled (one-way hashed) version of your IP address, which we use to stop spam and abuse. If you share your name, email address or phone number in the chat, we save them as an enquiry so our team can reply. A random conversation ID is kept in your browser’s session storage so the chat continues as you move between pages; it is deleted when you close the browser tab.
Emails, WhatsApp and phone calls
If you email us, message us on WhatsApp or call us, we receive your contact details and whatever you tell us, and we keep our correspondence with you. WhatsApp is run by WhatsApp (part of Meta) under its own terms and privacy policy.
Visit statistics
Our own simple visit counter records the page you visited, the website that referred you and any campaign tags. It uses no cookies; unique visitors are counted with a code that changes every day, so it cannot follow you from one day to the next.
Cookies for analytics and advertising (only with your consent)
With your consent, we use Google Tag Manager, Google Analytics 4 and Google Ads to understand how the site is used and to measure and improve our ads. These set cookies and collect information such as pages viewed, approximate location, device and browser details, and whether you sent an enquiry after clicking an ad. See Cookies below.
3. How we use it, and our lawful basis
| What we do | Lawful basis (UK GDPR) |
|---|---|
| Reply to your enquiry, arrange a demo or call, and prepare a proposal | Taking steps at your request before a contract, and our legitimate interest in answering enquiries |
| Answer your questions in the website chat | Our legitimate interest in answering visitors quickly |
| Provide our services to clients and manage the relationship | Performance of a contract |
| Keep business and accounting records | Legal obligation |
| Keep the site secure and stop spam and abuse | Our legitimate interest in protecting the site and our team |
| Count visits with our own cookie-free counter | Our legitimate interest in knowing which pages are useful |
| Analytics cookies (Google Analytics 4) | Your consent |
| Advertising cookies and ad measurement (Google Ads) | Your consent |
Under the PDPO, we collect personal data only for the purposes above, which we explain at or before the time we collect it, and we use it only for those purposes or directly related ones unless you agree otherwise. We do not sell your personal data, and we do not use or pass it on for direct marketing without your consent.
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
4. Who we share it with
We use trusted service providers who process personal data for us, on our instructions and under written agreements:
- Vercel: hosts this website and runs its server code.
- Supabase: stores enquiries, chat conversations and our business records in a database.
- Resend: delivers our emails, including the notice of your enquiry to our team and our replies.
- xAI: processes the messages you type in the website chat to write the replies.
- Google: Google Tag Manager, Google Analytics 4 and Google Ads, only if you allow analytics or advertising cookies.
We may also share information with professional advisers (such as accountants and lawyers), or when the law requires it.
5. International transfers
Some of these providers store or process data outside the UK and Hong Kong, including in the United States and the European Economic Area. When we transfer personal data from the UK, we rely on UK adequacy regulations or appropriate safeguards such as the UK International Data Transfer Agreement or Addendum, or the UK Extension to the EU-US Data Privacy Framework where the provider is certified. For data collected in Hong Kong, we take reasonable steps, including contract terms, so that it is protected to a standard comparable to the PDPO.
6. How long we keep it
We keep personal data only as long as we need it for your enquiry or our relationship with you, and to meet legal and accounting requirements. After that, we delete it or make it anonymous.
- Enquiries that do not lead to work together: period to be confirmed.
- Website chat conversations and chat enquiries: period to be confirmed.
- Client records and correspondence: for the length of the relationship, then period to be confirmed (or longer where the law requires business records to be kept).
- Analytics and advertising cookies: period to be confirmed (set in our Google settings); you can clear them at any time in your browser.
7. Your rights
Under UK GDPR you have the right to:
- ask for a copy of the personal data we hold about you (access);
- ask us to correct data that is wrong or incomplete;
- ask us to delete your data;
- ask us to limit how we use your data;
- object to our use of your data based on legitimate interests, and to direct marketing at any time;
- receive data you gave us in a commonly used format, or ask us to send it to someone else (portability);
- withdraw your consent at any time, for example in . This does not affect anything we did before you withdrew it.
Under the PDPO you have the right to ask whether we hold your personal data, to get a copy of it (a data access request), and to ask us to correct it (a data correction request). The PDPO allows a fee for a data access request that is not excessive; we will tell you before charging one. You can also ask us to stop using your data for direct marketing at any time.
To use any of these rights, email hansonchan@epochtech.ai. We may need to confirm who you are first. We reply within one month under UK GDPR and within 40 days under the PDPO.
8. Complaints
Please contact us first so we can try to put things right. You also have the right to complain to a data protection regulator:
- UK: the Information Commissioner’s Office (ICO), ico.org.uk
- Hong Kong: the Office of the Privacy Commissioner for Personal Data (PCPD), pcpd.org.hk
9. Cookies
Cookies are small files stored by your browser. We only use analytics and advertising cookies if you allow them. You can change your choice at any time in (also linked at the bottom of every page).
| Type | What it does | Examples |
|---|---|---|
| Strictly necessary (always on) | Remembers your cookie choice, keeps the chat going between pages, and keeps campaign tags for your enquiry during your visit | epoch_consent_v1 (local storage), epoch_rxw_v1 and epoch_airx_utm (session storage) |
| Analytics (with consent) | Google Analytics 4: shows which pages are useful and how visitors use the site | _ga, _ga_* |
| Advertising (with consent) | Google Ads: measures enquiries that come from our ads and helps show relevant ads | _gcl_au and other Google advertising cookies |
We use Google Consent Mode. Until you choose, analytics and advertising storage is switched off. If you decline, Google tags may still send basic signals without cookies or identifiers (for example, that a page was viewed), which Google uses to estimate results in aggregate.
10. Children
Our website and services are for businesses and are not aimed at children. We do not knowingly collect personal data from children. If you think a child has given us personal data, please contact us and we will delete it.
11. Keeping your data safe
We use access controls, encrypted connections (HTTPS) and reputable providers to protect your data. No system is completely secure, so please do not share sensitive information, such as health or financial details, through the forms or chat.
12. Changes to this policy
We may update this policy from time to time. The latest version is always on this page, with the date it was last updated at the top.