Dated at July 13, 2026
1. INtroduction and scope
Nomad Capitalist Limited (Nomad Capitalist, we, us, our) is a company incorporated in Hong Kong with its registered office at 2301, 23F Bayfield Building, 99 Hennessy Road, Wanchai, Hong Kong.
We serve clients globally. This policy explains how we collect, use, disclose, transfer, retain and protect personal data when you visit our website, complete forms, subscribe to communications, create an account, make a purchase, or otherwise interact with our online services.
Because we serve clients located in the European Union and the wider European Economic Area (EEA), our processing of their personal data is governed by the EU General Data Protection Regulation (GDPR). Because we are incorporated in Hong Kong, our processing is also governed by the Personal Data (Privacy) Ordinance (PDPO) and its six Data Protection Principles. Where the two regimes differ, we apply the standard that gives you the greater protection.
For all matters described in this policy, the data controller is Nomad Capitalist Limited at the address above. Contact for privacy enquiries is [email protected].
2. Definitions
In this policy:
- Personal data: any information relating to an identified or identifiable individual.
- Processing: any operation performed on personal data, including collection, storage, use, disclosure, transfer and deletion.
- Controller: the party that determines the purposes and means of processing personal data. Nomad Capitalist is the controller of the personal data described here.
- Processor: a third party that processes personal data on our behalf and on our instructions.
- Cookies and tracking technologies: small files and similar technologies (such as pixels, tags and software development kits) placed on your device or embedded in our pages to store or read information.
- Direct marketing: the offering or advertising of goods, services or other subjects by sending information addressed to specific individuals, including by email, telephone or targeted online advertising.
- Consent: a freely given, specific, informed and unambiguous indication of your agreement, given by a clear affirmative action.
- Supervisory authority: the data protection regulator with jurisdiction over a given individual or processing activity, such as an EEA supervisory authority or the Office of the Privacy Commissioner for Personal Data, Hong Kong (PCPD).
3. Data We Collect and How We Use It
3.1 Categories of personal data
- Identity and contact data: name, telephone number and email address.
- Technical and log data: IP address, device and browser technographics, connection speed and similar log file information.
- Marketing and engagement data: your interactions with our website, content, emails and advertisements, your preferences, and your recorded consent choices.
3.2 How we collect personal data
- Directly from you, when you complete forms, subscribe, make a purchase or correspond with us.
- Automatically, through cookies and tracking technologies when you use our website (see Section 4).
- From third parties, such as our analytics and advertising partners and our customer relationship management (CRM) tools.
3.3 Purposes and legal bases
For individuals protected by the GDPR, we rely on the legal bases set out below. The same purposes apply to all users. Where we rely on consent, you may withdraw it at any time.
|
Purpose |
Personal data used |
GDPR legal basis |
|---|---|---|
|
Operate and provide our website and services |
Identity, contact, technical, transaction |
Legitimate interests |
|
Respond to enquiries and provide support |
Identity, contact, marketing |
Legitimate interests |
|
Direct marketing (email and targeted advertising) |
Identity, contact, marketing |
Consent |
|
Website analytics and performance measurement |
Technical, marketing |
Consent (for non-essential cookies) |
|
Online advertising and remarketing |
Technical, marketing |
Consent |
|
Security, fraud prevention and network integrity |
Technical, transaction |
Legitimate interests; legal obligation |
|
Compliance with legal and regulatory obligations |
As required |
Legal obligation |
Our legitimate interests are limited to operating a secure and effective website and business. We do not rely on legitimate interests as a basis for direct marketing. All direct marketing is conditioned on a standalone affirmative opt-in.
4. Active Tracking Technologies and Cookies
4.1 How we use cookies and tracking technologies
We use cookies and similar technologies to operate the website, remember your preferences, measure performance, and (where you have consented) deliver and measure advertising. Some technologies are strictly necessary for the website to function. All others are non-essential and load only after you give consent.
4.2 Consent management
We manage cookie consent through Usercentrics, operating under a dedicated GDPR consent configuration. We also use Google Consent Mode, which dynamically enforces your privacy choices across Google services and adjusts how those services behave based on the consent you give or withhold.
You can review and change your choices at any time through the consent banner and preference centre on our website. Withdrawing consent does not affect processing carried out before withdrawal.
4.3 Tag management and external agencies
All website scripts and tracking tags are centralised and deployed through Google Tag Manager. External marketing agencies may deploy additional tags through this platform. They do so under our control and instruction, and any non-essential tags remain subject to the consent controls described in Section 4.2.
4.4 Technologies and platforms in use
As of our June 2026 technical audit, the following technologies are active on our website:
|
Category |
Purpose |
Platforms |
|---|---|---|
|
Strictly necessary |
Core website functionality and security |
First-party session and security cookies |
|
Consent management |
Capturing and enforcing your choices |
Usercentrics; Google Consent Mode |
|
Tag management |
Centralised deployment of scripts and tags |
Google Tag Manager |
|
Analytics |
Measuring website usage and performance |
Google Analytics |
|
Advertising and remarketing |
Serving and measuring targeted advertising to past and prospective visitors |
Meta / Facebook (Facebook Pixel); LinkedIn; Microsoft Advertising remarketing; Google Ads and Trustpilot |
|
CRM and marketing automation |
Lead tracking, contact management and marketing automation |
HubSpot |
|
Reviews |
Displaying customer reviews and ratings |
Trustpilot |
Analytics, advertising, remarketing and marketing automation technologies that involve non-essential tracking load only after you give consent through Usercentrics and Google Consent Mode.
5. Third-Party Data Disclosures
We do not sell your personal data. We disclose personal data only in the circumstances described below.
- Service providers and processors: we share personal data with providers that host our infrastructure, operate our CRM, deliver analytics, and process payments. They act on our instructions under written contracts and may not use the data for their own purposes. We have strict Data Protection Agreements with all third parties and monitor how they protect data. All third parties we work with are in line with GDPR.
- Advertising and marketing partners: we might share personal data with advertising and marketing partners, and allow it to be used to build custom audiences and serve targeted advertising on platforms such as Facebook, only where you have given a specific, standalone, affirmative opt-in. If you have not opted in, we do not provide your personal data to third parties for their direct marketing.
- Legal and regulatory disclosures: we may disclose personal data where required by law, regulation, legal process or enforceable governmental request, or to establish, exercise or defend legal claims.
- Corporate transactions: we may disclose personal data in connection with a merger, acquisition, financing or sale of assets, subject to appropriate confidentiality protections.
This section replaces any earlier statement that we may share collected information with third parties such as advertisers, contest sponsors, or promotional and marketing partners on an unqualified basis. Any such sharing for direct marketing is now conditioned on your prior affirmative opt-in.
6. International Data Transfers
We operate globally and use international hosting. Personal data collected through the website may be transferred across borders to our personnel, offices, and third-party processors located outside your country of residence.
We rely on appropriate safeguards such as the European Commission Standard Contractual Clauses, together with any supplementary measures needed to protect the data. You may request information about the safeguards we use by contacting us (see Section 12).
7. Security
We maintain technical and organisational measures designed to protect personal data against unauthorised access, disclosure, alteration and loss. These include encryption in transit using SSL/TLS, access controls, and electronic safeguards over financial data.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
8. Data Retention
We retain personal data for up to seven years, unless a longer period is required by law or a shorter period applies. If you delete your account, we begin active disposal of the associated personal data within 60 days, subject to any data we are required to retain for legal, accounting or regulatory purposes.
9. Your Privacy Rights
9.1 GDPR rights (EU and EEA residents)
If you are located in the EU or EEA, you have the following rights in relation to your personal data:
- Access to your personal data and information about how we process it.
- Rectification of inaccurate or incomplete personal data.
- Erasure of your personal data in certain circumstances.
- Restriction of processing in certain circumstances.
- Data portability, where processing is based on consent or contract and is carried out by automated means.
- Objection to processing based on our legitimate interests, and to processing for direct marketing at any time.
- Withdrawal of consent at any time, without affecting processing carried out before withdrawal.
- Lodging a complaint with your local supervisory authority.
If you are in the EEA and wish to contact our representative under Article 27 of the GDPR, the details are: [email protected].
9.2 Hong Kong PDPO rights and direct marketing opt-in
If your personal data is handled under the PDPO, you have the right to ascertain whether we hold your personal data, to request access to it, and to request correction of it. We handle personal data in accordance with the six Data Protection Principles.
Direct marketing under PDPO Part VIA. We will not use your personal data for our own direct marketing, and we will not provide your personal data to any third party for that third party to use in direct marketing, unless you have first been clearly informed and have given a specific, standalone, affirmative opt-in. We will not treat silence, inactivity or a pre-ticked box as consent.
Where we intend to provide your personal data to a third party for the third party’s direct marketing, we will additionally tell you whether the data is provided for gain and identify the classes of recipients and of marketing subjects.
You may withdraw your consent and ask us to stop using or providing your personal data for direct marketing at any time, at no cost, and we will act on that request without charge. Every marketing message will include a simple opt-out channel.
9.3 How to exercise your rights
To exercise any of these rights, contact us using the details in Section 12. We may need to verify your identity before acting on a request.
10. Children’s Privacy
Our website and services are directed to adults and are not intended for children. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will take appropriate steps to delete it.
11. Changes to This Policy
We may update this policy from time to time to reflect changes in our practices, technology or legal obligations. We will post the updated policy on our website and revise the effective date above. Where required, we will obtain fresh consent for any new processing.
12. How to Contact Us
If you have questions about this policy or wish to exercise your rights, contact us:
Privacy contact: [email protected].