Privacy Policy

Last updated: 26 July 2026

1. Who we are

Hainan Corporate Services Group (“HCSG”, “we”, “us”, or “our”) is the data controller for the personal data described in this policy. We provide company registration, visa, Canton Fair, and China business-expansion services through our website at hainancorporateservices.com.

2. What personal data we collect

We collect and process the personal data listed below, depending on how you interact with us.

3. How we use your data

We use personal data for the following purposes and on the following legal bases under the GDPR:

• To respond to enquiries and provide services - performance of a contract or pre-contractual steps (Article 6(1)(b)).
• To manage our relationship with you - legitimate interest in client communication and service delivery (Article 6(1)(f)), and compliance with legal obligations (Article 6(1)(c)).
• To qualify leads and route them to the right team member - legitimate interest in operating an efficient sales process (Article 6(1)(f)).
• To communicate via WhatsApp, email, SMS, or phone - consent, where required by platform terms or local law, or legitimate interest in replying to your request (Article 6(1)(a) or (f)).
• To measure advertising effectiveness and improve campaigns - legitimate interest in understanding marketing performance (Article 6(1)(f)). You can opt out via the rights below.
• To comply with legal, tax, and regulatory obligations - legal obligation (Article 6(1)(c)).

4. Lead forms on Meta, TikTok, and LinkedIn

We collect leads through native lead-generation forms on Meta (Facebook/Instagram), TikTok, and LinkedIn. When you submit a form on these platforms, the platform sends us the information you provided, which typically includes name, email, phone number, country, and service interest.

• We do not request sensitive personal data (such as ethnicity, religion, political opinion, or health data) through lead forms.
• We do not use nationality or origin data to target or exclude any protected group in violation of platform policies or applicable law. Where nationality is collected, it is only for assessing visa eligibility for the service you requested.
• Each lead form includes a link to this privacy policy and, where required, a consent checkbox.

5. WhatsApp Business messaging

We use WhatsApp Business through our Business Service Provider (BSP) and GoHighLevel integration to communicate with prospects and clients.

• Messages are stored in our GoHighLevel CRM and may be used to qualify your request, schedule consultations, and provide updates.
• WhatsApp Business is provided by Meta. Meta’s own privacy practices apply to the WhatsApp platform and are described in WhatsApp’s Privacy Policy.
• We honor WhatsApp customer-service windows and opt-out requests. If you send “STOP” or ask us not to contact you, we will suppress further marketing messages.
• We do not send payment links or make binding offers through automated WhatsApp messages without human review.

6. CRM storage in GoHighLevel

We store lead, contact, and opportunity data in GoHighLevel (GHL), our customer-relationship management platform. GHL acts as a data processor on our behalf.

• Data stored in GHL includes contact details, conversation history, pipeline stage, lead score, appointment records, and deal amounts.
• We configure access controls so that only authorised HCSG staff can view or edit your data.
• We do not store raw payment card numbers or government ID documents in GHL.
• We use GHL’s built-in security features and rely on GHL’s data-processing terms. You can read GHL’s privacy practices at GoHighLevel Privacy Policy.

7. Conversions API and event data

We send conversion events to Meta (and similar platforms) using server-side Conversions API (CAPI) and browser pixels. This helps us understand which ads and content lead to enquiries, bookings, and completed engagements.

• Before sending data to Meta CAPI, we hash personal identifiers such as email addresses and phone numbers using SHA-256.
• We send standard events including Lead, QualifiedLead, Schedule, Contract, and Purchase. The Purchase event is sent only when payment is confirmed, not when a deal is merely marked closed.
• Event data may include a campaign ID, timestamp, and the page or action that triggered the event.
• You can object to this processing by exercising your rights under Section 10 or by using platform-specific ad controls (e.g., Meta Ad Preferences, TikTok Ad Settings, LinkedIn Account Settings).

8. Analytics and cookies

We use analytics tools and cookies to understand how visitors use our website and to improve our marketing.

• We may use third-party analytics services that collect IP addresses, device information, and browsing behaviour.
• Where required by law, we will request your consent before placing non-essential cookies or tracking technologies.
• You can manage cookies through your browser settings. Blocking cookies may affect website functionality.

9. Data sharing and processors

We do not sell personal data. We share personal data only with the following categories of service providers (processors) who help us operate our business:

• Meta Platforms, Inc. - lead forms, messaging, WhatsApp Business, and CAPI event data.
• TikTok Pte. Ltd. - lead forms and advertising measurement.
• LinkedIn Corporation / Microsoft - lead forms and advertising measurement.
• GoHighLevel - CRM, conversations, appointment scheduling, and workflow automation.
• WhatsApp Business Platform providers (BSP) - messaging delivery.
• Hosting / VPS providers - secure storage of our self-hosted systems and databases.
• Analytics and email service providers - website analytics and communication delivery.

We require all processors to handle personal data only on our instructions and to maintain appropriate security measures.

10. International data transfers

Our operations are based in China, and some of our processors (such as Meta, TikTok, LinkedIn, and GoHighLevel) are located in the United States, Singapore, Ireland, and other countries. When personal data is transferred outside your country of residence, we rely on appropriate safeguards such as:

• Standard Contractual Clauses (SCCs) approved by the European Commission or equivalent UK/Swiss mechanisms, where applicable;
• Processor contracts and data-processing agreements that include security and confidentiality obligations;
• Platform-specific transfer mechanisms offered by Meta, TikTok, LinkedIn, and GoHighLevel.

11. Data retention

We keep personal data only as long as necessary for the purposes described above, or as required by law.

• Lead and contact data: retained for the duration of our business relationship plus 5 years for legal, tax, and compliance purposes.
• WhatsApp chat transcripts: retained for 5 years unless you request deletion earlier.
• Advertising event data: retained according to the retention policies of the relevant platform (e.g., Meta, TikTok), typically up to 5 years.
• Analytics and log data: retained for 5 years.

When data is no longer needed, we delete or anonymise it in accordance with our retention schedule.

12. Your data protection rights

Depending on your location, you may have the following rights under the GDPR and similar laws:

• Access - request a copy of the personal data we hold about you.
• Rectification - ask us to correct inaccurate or incomplete data.
• Erasure - request deletion of your personal data in certain circumstances.
• Restriction - ask us to restrict processing in certain circumstances.
• Data portability - receive your data in a structured, commonly used format.
• Objection - object to processing based on legitimate interests, including direct marketing and profiling for advertising.
• Withdraw consent - where processing is based on consent, you can withdraw it at any time.
• Complaint - lodge a complaint with your local data protection authority.

To exercise any of these rights, contact us using the details in Section 1. We will respond within the timeframe required by applicable law.

13. Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or misuse, including:

• Encryption in transit (TLS/HTTPS) and at rest where appropriate.
• Access controls, role-based permissions, and audit logging.
• Regular backups and security reviews.
• Hashing of identifiers before sending to advertising platforms.

No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

14. Changes to this policy

We may update this privacy policy from time to time to reflect changes in our practices, legal requirements, or platform policies. The latest version will always be posted on hainancorporateservices.com/privacy-policy with the updated “Last updated” date.

15. Contact us

If you have questions about this privacy policy or how we handle your personal data, please contact us:

16. Platform-specific notices

Meta / Facebook / Instagram

Lead forms and ads on Meta are subject to Meta’s Privacy Policy and Self-Serve Ad Terms. We comply with Meta’s lead-advertising and restricted-vertical policies, including the prohibition on discriminatory targeting and guaranteed-outcome claims for immigration services.

TikTok

TikTok lead forms and advertising are subject to TikTok’s Privacy Policy and Business Terms. We do not target users based on protected characteristics, and we comply with TikTok’s ad policies for financial, legal, and immigration services.

LinkedIn

LinkedIn lead forms and advertising are subject to LinkedIn’s Privacy Policy and Ad Terms. We use LinkedIn only for professional, business-related outreach and do not send automated connection requests or messages.

WhatsApp

WhatsApp Business is provided by Meta and governed by the WhatsApp Business Terms of Service and Privacy Policy. We use only approved message templates where required, honour opt-outs, and do not send spam or unsolicited promotional messages.