1. Introduction
Meta Brand Strategy welcomes you to this website and thanks you for taking the time to read this Privacy Policy. This document describes, in plain and complete language, what happens to personal information when you visit our pages, send us a message, request a proposal or work with our studio on a consulting engagement. We have written it to be read from beginning to end rather than skimmed, because privacy notices are only useful when they are actually understood.
The website is operated by Meta Brand Strategy Consulting Limited, a company that provides brand strategy consulting, positioning research, naming work, identity audits and related professional services. Meta Brand Strategy is the name under which the studio presents its work, and references to the studio, we, us or our in this policy mean the company described in the next section.
We believe that personal data belongs to the person it describes. Our role is to hold it carefully for a defined purpose, to keep it only as long as necessary and to return control to you whenever you ask. This policy is the written expression of that belief. It is not a formality and it is not copied from a template.
In short: we collect only what we need to answer you and to deliver consulting work, we never sell personal data, and you can ask us to explain, correct or delete your information at any time by writing to mailbox@metabrandstrategy.buzz.
2. Who We Are
The data controller responsible for the personal information described in this policy is Meta Brand Strategy Consulting Limited. The registered and operating address of the company is Rm A 7/F Max Share Ctr, 373 Kings Rd, North Point, Hong Kong - 999077, Hong Kong (HK). The studio can be reached by email at mailbox@metabrandstrategy.buzz and by telephone at +17312014340.
The company operates as an independent consulting practice. It is not part of a group of advertising networks, it does not run a data brokerage and it derives its revenue solely from professional services and related advisory work. That commercial model matters for privacy, because it means our interests are aligned with the clients and visitors we serve rather than with advertisers.
A single point of contact handles privacy questions. When you write to the studio email address and mark your message for the attention of the privacy contact, your request is logged, acknowledged and routed to a senior member of the practice who has authority to act on it. We do not outsource the handling of privacy requests to an unrelated call centre.
3. Scope of This Policy
This policy applies to personal data processed through the public website, through email correspondence, through telephone calls, through proposals and statements of work, and through the delivery of consulting engagements. It also applies to information shared during events, workshops and meetings organised by the studio.
This policy does not apply to the practices of other organisations. If you follow a link from our pages to a third party website, that website applies its own privacy notice, and we encourage you to read it before sharing personal information. Equally, this policy does not cover information that our clients process in their own systems, even when that information relates to a project we are advising on.
Where we act as a processor on behalf of a client, meaning that we handle personal data under the instruction of that client rather than for our own purposes, the terms of the relevant services agreement and the client privacy notice govern that processing. Section nine of this policy explains this distinction in more detail.
4. Data We Collect
The categories of personal data we collect are limited and predictable. They fall into four broad groups: information you give us directly, information generated when you use the website, information created through professional correspondence, and information supplied in the course of a consulting engagement.
Information you give us
When you complete the contact form or send an email, you may provide your name, your email address, your telephone number, your organisation, your role and the content of your message. If you request a proposal, you may also share project context, timelines and commercial constraints. You decide how much of this detail to include, and we only require the minimum needed to reply to you.
Information generated by the website
When you visit the site, our hosting provider records standard technical information such as the Internet Protocol address used for the connection, the browser and device type, the referring page, the pages requested and the time of the request. This information is used to keep the site available and secure. It is not used to build advertising profiles.
Information from professional correspondence
Emails, meeting notes and call summaries may contain personal data about you and about colleagues you mention. We keep these records so that advice remains consistent over time and so that commitments made in one conversation are not lost in the next.
Information supplied during engagements
Consulting work sometimes requires access to research materials, customer interview notes or internal documents. Where those materials contain personal data, we ask clients to share only what is necessary, to remove sensitive identifiers where possible and to confirm that they have a lawful basis to share the material with us.
We do not intentionally collect special category data such as health information, biometric data, political opinions or religious beliefs. If such information reaches us by accident, we will delete it promptly unless a legal obligation requires us to retain it.
5. How We Collect Data
Most of the personal data we hold arrives directly from you. You type it into the contact form, you include it in an email, you say it during a call or you hand over a document at a meeting. Direct collection matters because it means the information is accurate at the moment it is shared and because you remain aware that it has been provided.
A smaller amount arrives automatically. Server logs are generated whenever a browser requests a page, and these logs are produced by the hosting infrastructure rather than by any action you take. We treat them as operational records rather than as a source of insight about individuals.
In some situations a colleague or a client may provide information about you, for example when a project lead introduces team members by email or when a client shares a research transcript. When this happens we rely on the sender to have the right to share the information, and we limit our use of it to the purpose for which it was supplied.
We do not purchase contact lists from data brokers, and we do not enrich the contact details you give us with information gathered from unrelated sources. What you share is what we hold.
6. Why We Use Data
Personal data is used to answer enquiries, prepare proposals, deliver consulting services, maintain accurate business records, protect the website and meet legal obligations. Each of these purposes is concrete and each is connected to a service you have requested or a relationship you have entered into.
We use contact details to reply to your message, to arrange calls and meetings and to keep you informed about the progress of a project. We use project materials to conduct research, to write recommendations and to support the advice we provide. We use billing information to issue invoices and to satisfy accounting requirements.
We use technical logs to monitor availability, to diagnose faults and to detect abusive traffic. We use correspondence records to maintain continuity, to resolve disputes and to demonstrate that professional advice was given and understood.
We do not use personal data to train general purpose artificial intelligence models, and we do not sell, rent or trade personal data to any third party for marketing purposes. We do not use your information to make automated decisions that produce legal or similarly significant effects.
7. Legal Bases for Processing
Where data protection law requires us to identify a legal basis, we rely on one of four grounds. The first is the performance of a contract or the steps needed before entering a contract, which covers proposals, engagements and the administration of client relationships.
The second is our legitimate interests in running a professional practice. This covers responding to enquiries, maintaining business records, protecting the security of our systems and improving the quality of our services. We balance these interests against your rights and we do not rely on this ground where the impact on you would be disproportionate.
The third is legal obligation, which covers tax, accounting and record keeping duties, as well as responding to lawful requests from authorities with jurisdiction over the company. The fourth is consent, which we rely on for optional communications such as occasional studio updates, and which you may withdraw at any time.
Where we process personal data as a processor for a client, the legal basis is established by that client and is described in the client privacy notice. We follow documented instructions and do not determine the purposes of that processing ourselves.
10. Service Providers
A small number of service providers support the operation of the studio. These typically include a hosting provider that serves the website, an email provider that delivers and stores correspondence, an accounting provider that handles invoicing and a document storage provider that holds project files. Each provider is selected with care and is reviewed periodically.
We require providers to process personal data only on documented instructions, to apply appropriate technical and organisational security measures, to assist us in responding to rights requests and to delete or return data at the end of the relationship. Where a provider subcontracts part of its service, we expect equivalent obligations to flow down to the subcontractor.
We keep a record of the providers used for personal data, the categories of data they handle and the location of their processing. That record is reviewed when a new provider is introduced and when an existing arrangement changes.
If you would like to know the categories of providers involved in handling your information, write to mailbox@metabrandstrategy.buzz and we will explain them in plain terms.
11. International Transfers
The studio operates from Hong Kong and works with clients in other regions. As a result, personal data may be transferred to and processed in jurisdictions other than the one in which it was collected. Whenever this happens we take steps to ensure that the data continues to receive a comparable level of protection.
Where a transfer leaves a jurisdiction with comprehensive data protection law, we rely on appropriate safeguards such as standard contractual clauses, adequacy findings or a documented assessment of the risks and the mitigations in place. We do not transfer personal data to a jurisdiction solely on the basis of convenience.
Technical records such as server logs may be stored in the region selected for hosting. Where a hosting provider offers regional storage, we choose the region that best matches the location of our clients and the legal requirements that apply to them.
You may ask for more information about the safeguards used for a specific transfer by writing to the studio email address.
12. How Long We Keep Data
We keep personal data only for as long as it is needed for the purpose for which it was collected, or for as long as a legal obligation requires. The retention period depends on the category of data and on the nature of the relationship.
Enquiries that do not lead to an engagement are generally removed within twenty four months of the last contact. Correspondence connected to an active or recent engagement is kept for the duration of the work and for a reasonable period afterwards so that advice can be explained if questions arise.
Accounting and tax records are kept for the period required by the applicable law, which is typically several years. Website server logs are retained for a short operational window and are then deleted or aggregated.
When a retention period ends, data is deleted or irreversibly anonymised. If deletion is not immediately possible because data is held in a backup, access is restricted until the backup cycle completes and the data is removed.
13. How We Protect Data
We apply technical and organisational measures that are proportionate to the sensitivity of the data we hold. Access to personal data is limited to the people who need it for their work, and access rights are reviewed when roles change or when a relationship ends.
Data in transit is protected by encryption, and stored data is protected by access controls and, where supported, encryption at rest. Devices used for studio work are protected by passwords, automatic locking and timely security updates. Files are stored in controlled repositories rather than on personal drives.
We train the people who work with us to recognise phishing, to handle personal data carefully and to report incidents without delay. We maintain a simple incident response procedure that covers containment, assessment, notification and review.
No system can guarantee absolute security. If a breach occurs that is likely to result in a risk to your rights, we will notify the relevant authority and the affected individuals without undue delay, in line with the obligations that apply to us.
14. Your Rights
You have rights over the personal data we hold about you. These rights are not absolute and are subject to exceptions in law, but we take them seriously and we apply them generously wherever we can.
- Access: you may ask for a copy of the personal data we hold about you, together with an explanation of how it is used.
- Correction: you may ask us to correct information that is inaccurate or incomplete.
- Deletion: you may ask us to delete information that is no longer needed, where no legal obligation requires us to keep it.
- Restriction: you may ask us to limit how we use your information while a question about accuracy or lawfulness is resolved.
- Objection: you may object to processing that we carry out on the basis of legitimate interests.
- Portability: you may ask for data you provided to us in a structured, commonly used and machine readable format.
- Withdrawal of consent: where we rely on consent, you may withdraw it at any time without affecting lawful processing that took place before the withdrawal.
To exercise a right, write to mailbox@metabrandstrategy.buzz with enough detail for us to identify you and understand the request. We may ask for proof of identity to protect your information from being disclosed to someone else. We aim to respond within thirty days, and we will tell you if a request is complex enough to require more time.
You also have the right to complain to a data protection authority in your jurisdiction. We would appreciate the chance to resolve the matter with you first.
15. Privacy for Children
This website is intended for business audiences and is not directed at children. We do not knowingly collect personal data from anyone under the age of sixteen. If you believe that a child has provided personal information to the studio, please contact us and we will delete the information promptly.
If a consulting engagement ever involves research with younger participants, the work is arranged through the commissioning client, which is responsible for obtaining appropriate consent from a parent or guardian and for applying its own safeguards.
16. Marketing Communications
We send marketing messages rarely and only to people who have asked for them or with whom we have an existing professional relationship. Typical messages announce a new proof sheet, a change to the services or an invitation to a studio event. We do not run bulk campaigns and we do not rent mailing lists.
Every marketing message includes a simple way to opt out, and you can also write to us at any time to ask that your address be removed from future communications. Opting out of marketing does not affect messages that are necessary for the delivery of a service you have requested.
17. Third Party Links
Some pages may link to websites operated by other organisations, for example a research source, a partner studio or a publication. Those websites are outside our control. They may set their own cookies, collect their own data and apply their own policies.
A link does not imply that we endorse the privacy practices of the destination. We encourage you to review the privacy notice of any site before providing personal information, and we take no responsibility for the content or practices of external sites.
18. Changes to This Policy
We review this policy regularly and update it when our practices, our providers or the law change. The date at the top of the page shows when the current version came into effect. When a change is material, we will announce it on this page and, where appropriate, notify clients directly.
Previous versions are retained internally so that we can explain how a particular decision was made at a particular time. If you need to know which version applied on a specific date, write to the studio and we will help.
Continued use of the website after an update means that you accept the revised policy. If you do not accept a change, you may stop using the site and ask us to delete information you have provided.
19. How to Contact Us
Questions, requests and complaints about privacy are welcome. Please write to mailbox@metabrandstrategy.buzz, call +17312014340 or send a letter to Meta Brand Strategy Consulting Limited, Rm A 7/F Max Share Ctr, 373 Kings Rd, North Point, Hong Kong - 999077, Hong Kong (HK).
If you are not satisfied with our response, you may escalate the matter to a data protection authority in your jurisdiction. We will cooperate fully with any investigation and will provide the records needed to assess the matter.
This Privacy Policy is part of the wider terms that govern the use of this website. Please read the Terms of Service as well, because together they describe the full relationship between you and Meta Brand Strategy Consulting Limited.