Privacy Policy

1. Who we are

Nuvoca Limited is the company responsible for the Site and for the personal data described in this policy.

This policy covers personal data collected through the Site, including enquiry forms, website logs, email replies, analytics and advertising measurement. It does not replace a separate client contract, project agreement or employment privacy notice.

2. Enquiry form collection notice

Fields marked as required are necessary for us to review your request and reply. If you do not provide the required information, we may not be able to respond or prepare a quotation. Other information is voluntary and should only be included if relevant to your enquiry.

We use the submitted information for enquiry handling, quotation preparation, service-fit assessment, business records and lawful dispute management. We may disclose or transfer it to service providers that help us host the Site, process the form and send business email. We do not use the enquiry form to automatically subscribe you to newsletters or for direct marketing without a separate lawful basis and notice.

3. Personal data we handle

• Contact and identity details: name, company name and email address.
• Project enquiry details: language pair, content type, estimated character count, preferred deadline, LQA request, message content and any follow-up materials you choose to share.
• Technical and security data: IP address, approximate country or region inferred for tag-gating, browser and device information, referrer, access time, server logs and anti-spam signals such as the hidden _gotcha field.
• Analytics and advertising measurement data: when the Google tag is permitted to load, page views, scrolls, outbound clicks, video engagement, file downloads, advertising click identifiers such as GCLID, and the generate_lead event after a successful enquiry submission.

Please do not submit unnecessary personal data, special-category or highly sensitive data, or third-party confidential materials unless they are genuinely required for the enquiry.

4. How we use personal data

• to receive, review and respond to enquiries;
• to prepare quotations, evaluate scope, confirm feasibility and communicate by email through Google Workspace;
• to operate, secure, debug and improve the Site and form flow;
• to measure Site performance, lead-generation paths, user engagement and advertising campaign performance;
• to maintain appropriate business, legal, accounting and dispute-management records.

We do not sell personal data. We also do not upload enquiry form contents or contact details into Google Ads as customer data, enhanced conversions or audience lists.

5. Google tag, GA4 and Google Ads

The Site uses the Google tag for Google Analytics 4 and Google Ads on pages where the regional tag gate permits loading. GA4 is connected with Google Ads and Google Search Console. Google Ads is connected with Google Business Profile and Google Search Console. Google Ads auto-tagging is enabled, so Google may append a GCLID parameter to ad-click landing URLs.

GA4 enhanced measurement and automatic event detection are configured for page views, scrolls, outbound clicks, video engagement and file downloads. Site search measurement and form-interaction measurement are turned off. Browser-history page-view change tracking is also turned off.

The form-success conversion is measured manually in the page code. When Formcarry returns a successful response, the Site resets the form, shows the success card and, where the Google tag is available, sends a generate_lead event. Crucially, this event is triggered without including any personally identifiable information or specific enquiry details, such as names, email addresses, project descriptions, or any other field values from the form.

To ensure privacy by design, we have enabled GA4 data redaction. This feature automatically strips email addresses and excludes all custom URL query parameters associated with our enquiry form fields. User-provided data features in the Google tag are disabled, and we do not override the Google tag's default cookie settings. We accepted Google's data processing terms for GA4 on 29 April 2026. We do not mark Google tag or container data as consented by default, and Google services such as Ads, Maps, Play, Search, Shopping and YouTube cannot receive consented data from this setup.

GA4 business objectives are set to lead generation and user engagement/retention. Engagement modelling and business insights are enabled on an aggregated and anonymised basis. Google signals, granular location and device data, and advanced ads personalisation are enabled only outside the CMP-required regions described below. GA4 event and user data retention are set to 14 months, with reset on new user activity enabled. The GA4 reporting identity is set to blended.

Google Ads is used for campaign delivery, conversion counting and performance measurement. Current primary targeting locations are: Argentina, Chile, Japan, Macao, Mongolia, Canada, Israel, Mexico, Panama, Taiwan, Malaysia, Türkiye, Australia, Hong Kong, Singapore, Kazakhstan, Kuwait, New Zealand, South Korea, Saudi Arabia, Uruguay, the United States, the United Arab Emirates and Qatar. We do not use third-party measurement, call conversion actions, call reporting, enhanced conversions, enhanced conversions for leads, lead form ads, Customer Match lists, conversion-based customer lists, automatic bid application, recommendation auto-apply or Google Ads customer-data terms for enquiry details.

6. Regional tag controls

We do not intentionally advertise or sell through the Site to users in regions where we currently treat a consent-management platform as required for Google tag loading. Because the Site does not currently implement a CMP, Hostinger GeoIP is used to infer the visitor's country or region before the local Google-tag loader runs.

If the visitor appears to be in one of the following regions, the Site remains viewable and the enquiry form remains available, but Google tags are not loaded for that visit: Guadeloupe, Greece, the Netherlands, Norway, Denmark, Germany, Latvia, Réunion, Romania, Luxembourg, Lithuania, Liechtenstein, Martinique, Mayotte, Malta, Belgium, Bulgaria, Saint Martin, Ceuta and Melilla, Sweden, Switzerland, Spain, Slovakia, Slovenia, Iceland, Ireland, Estonia, the United Kingdom, Austria, the Åland Islands, Italy, Czechia, the Canary Islands, Croatia, Cyprus, Portugal, Poland, France, French Guiana, Finland and Hungary.

GeoIP checks can be imperfect, for example when VPNs, proxies, corporate networks or routing errors are involved. If we later decide to target those regions or if applicable law requires consent for a particular use, we may need to implement a full CMP or change the Site configuration.

7. Service providers and international handling

We may process personal data in Hong Kong and in other jurisdictions where our service providers or their infrastructure operate. Our current providers include:

• Hostinger: website hosting, infrastructure and GeoIP-based regional tag gating. Hostinger web and cloud hosting locations include data centres in Asia such as Malaysia and Singapore.
• Formcarry: enquiry form delivery, storage, spam filtering and notification. Formcarry states that form personal data is stored in Frankfurt, Germany/EU, with limited remote access from the United States for support, maintenance, troubleshooting and service delivery.
• Google Workspace: business email for receiving and replying to enquiries.
• Google Analytics 4 and Google Ads: website measurement, advertising measurement and conversion counting, subject to the regional controls described above.

We expect providers to process data only for appropriate service purposes and under reasonable contractual, technical and organisational safeguards.

8. Retention and deletion

Enquiry and quotation correspondence is normally kept for up to three years from the last meaningful contact, unless a longer period is reasonably needed for legal, accounting, tax, security or dispute-management purposes. Server logs and security records are kept only as long as reasonably needed for operation and security. GA4 event and user data retention are set to 14 months. Formcarry data may remain in the account until we delete it or the account retention settings require deletion.

When personal data is no longer needed, we delete it, anonymise it or otherwise stop using it in a manner appropriate to the circumstances.

9. Security

We use reasonable technical and organisational safeguards designed to protect personal data against unauthorised or accidental access, processing, erasure, loss, misuse, modification or disclosure. No internet transmission or storage system is completely secure.

10. Your rights

Subject to applicable law, you may request access to personal data we hold about you and request correction of inaccurate data. Under the Hong Kong Personal Data (Privacy) Ordinance, we reserve the right to charge a reasonable fee for the processing of any data access request. Depending on the law that applies to you, you may also have rights to request deletion, restriction, objection, withdrawal of consent or portability. We will assess and respond to requests in accordance with applicable law.

To exercise a privacy right, contact us using the details below. We may need to verify your identity before acting on a request.

11. Changes, language and contact

We may update this policy to reflect legal, operational, analytics, advertising or service changes. The updated version will show its effective date and last updated date.

This policy may be provided in multiple languages. For the English and Hong Kong Chinese pages, if there is any inconsistency, the English version prevails to the extent permitted by applicable law. Mandatory local law may still apply regardless of language.