Privacy notice
This notice explains how Zypa Limited collects, uses and protects personal data when we help businesses open accounts. It is our Personal Information Collection Statement under Hong Kong's Personal Data (Privacy) Ordinance (Cap. 486). Last updated: 14 October 2026.
1. Who we are
Zypa Limited ("Zypa", "we") is a Hong Kong company. For privacy questions, email us at contact@zypa.finance.
2. Whose data we collect
Our clients are businesses, but we collect personal data about the people connected to them: directors, shareholders and beneficial owners, authorised signatories, employees who will use the account, and the person who contacts us.
3. What we collect
| Type | Examples |
|---|---|
| Identity | full name, date of birth, nationality, ID or passport details and copies |
| Contact | email, phone, residential address, proof of address |
| Role in the business | position, shareholding, source of wealth and source of funds where a Provider asks |
| Business information that may identify a person | company documents, contracts, invoices, bank statements |
| Communications | emails, messages and call notes with us |
| Website and technical | IP address, browser and pages visited, in our hosting provider’s standard logs. We use no analytics or advertising cookies; the assessment form keeps your answers in your browser until you send them |
We do not ask for online banking passwords or security codes. Some Providers require information about criminal records or politically exposed status; we collect it only when the Provider requires it.
4. Why we use it
We use personal data to:
- assess which Providers may accept your business and recommend them;
- prepare and check Applications and the documents Providers require;
- send Applications and answers to the Providers you choose;
- communicate with you about the Services and send invoices;
- carry out our own checks against fraud, sanctions and money laundering; and
- meet legal, accounting and regulatory obligations.
We will not use your data for direct marketing without your consent, and you can withdraw consent at any time.
5. Is providing data required?
Providing the data is voluntary, but Providers require most of it by law. If you do not give it, we may be unable to recommend a Provider or prepare your Application.
6. Who we share it with
| Recipient | Why |
|---|---|
| Providers you choose to apply to | to assess and open your account; each Provider then handles the data under its own privacy notice |
| Our technology providers | email and documents (Google Workspace), website, forms and hosting (Netlify, Vercel), all bound by contract to protect the data |
| AI drafting tools | OpenAI, to draft letters and answers; we replace names, ID numbers and addresses with labels before anything is sent, and documents are read only by an AI system running on our own computer |
| Professional advisers | our lawyers, accountants and auditors, under confidentiality |
| Authorities | a court, regulator or law-enforcement body, when the law requires it |
We do not sell personal data.
7. Transfers outside Hong Kong
Some recipients store data outside Hong Kong, for example in Singapore, the United States or the European Union, and Providers may be located in the country where you open the account. We take reasonable steps, including contract terms, so that the data receives protection similar to the PDPO.
8. Security
We limit access to staff who need it, use multi-factor sign-in on our accounts, encrypt data in transit, and keep client documents on systems we control. No system is perfectly secure; we will tell you without undue delay if a breach affects your data.
9. How long we keep it
We keep personal data for as long as the engagement lasts and then for 7 years, to meet record-keeping, tax and anti-money-laundering requirements and to deal with any dispute. Documents for an Application that never went ahead are deleted after 12 months. We then delete or anonymise the data.
10. Your rights
Under the PDPO you may ask:
- whether we hold your personal data, and for a copy of it (a data access request);
- us to correct data that is inaccurate; and
- us to stop using your data for direct marketing.
Send requests to contact@zypa.finance. We reply within 40 days, as the PDPO requires, and may charge a reasonable fee for copying data. If you are not satisfied, you may complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong.
11. Changes to this notice
We will post any update on our website with a new date and, for material changes, tell current clients by email.