How we handle personal data.

Who we are

Normatum is operated by Sayantan Jha and Ilia Voroshilov, trading as Normatum (“Normatum”, “we”, “us”) in Hong Kong. We are the data users responsible for the personal data described in this policy. Our postal address is [postal address].

Normatum is in the course of being incorporated in Hong Kong. When the company is registered, it becomes the data user and we will update this policy with its registered name and office.

What we collect

When you visit this website

This website does not use analytics, advertising trackers or cookies of its own, and it has no forms. Two things still happen when you load a page:

• Server logs. Our hosting provider, Hostinger, records standard technical information for every request: your IP address, browser type, the page requested, and the date and time. These logs are used to operate and secure the website.
• Web fonts. The site's typefaces are served by Google Fonts. Loading them sends your IP address and browser details to Google.

When you email us

If you write to info@normatum.org, we receive your name, email address and whatever you choose to tell us. Providing it is voluntary; we simply cannot reply without an email address.

Services that are not live yet

We plan to add an online booking calendar and a readiness self-assessment. Both will collect personal data. We will update this policy and our Personal Information Collection Statement before either goes live, and each will show its own notice at the point you give us your details.

How we use it

We use personal data only to reply to your enquiry, arrange and hold a conversation you have asked for, prepare a proposal if you request one, and keep this website running and secure. We do not use it for any other purpose without your express consent, in line with Data Protection Principle 3.

Direct marketing

We will not use your personal data to send you marketing, and will not pass it to anyone else for marketing, unless you have given us your consent to do so, as Part 6A of the Ordinance requires. You can withdraw that consent at any time by telling us, at no cost.

Who we share it with

We do not sell personal data. We share it only with:

• our website hosting provider (Hostinger);
• our email provider, Hostinger;
• Google, for web fonts, as described above;
• professional advisers, such as our accountants or lawyers, under a duty of confidentiality, where needed; and
• regulators, courts or law enforcement where we are legally required to.

Where it is stored

These providers may store and process data outside Hong Kong. Where they do, we rely on their contractual commitments to protect it to a standard comparable to the Ordinance.

How long we keep it

We keep enquiry emails that do not lead to an engagement for 24 months after our last contact, then delete them. Where you become a client, we keep correspondence for as long as the engagement and any legal or professional record-keeping obligations require. Server logs are kept by our hosting provider for a limited period under its own policies.

How we use AI with your data

We apply our own principles here. No sensitive client information is uploaded to or stored with third-party large-language-model vendors. Every output we produce has a named person accountable for it, and every AI-assisted decision passes through a human before it takes effect.

Security

We protect personal data with multi-factor authentication on every account that holds it, encryption on the devices we work from, and access limited to the people who need it. We review these arrangements at least once a year.

Your rights

You have the right to ask whether we hold personal data about you, to request a copy, and to ask us to correct anything inaccurate. We will respond within 40 days, as the Ordinance requires. We may charge a fee for a copy, which will not be excessive. Send requests to the contact below.

Contact

Requests and questions about personal data should be addressed to Sayantan Jha or Ilia Voroshilov at info@normatum.org, or by post to [postal address]. Either of us can handle a request; both of us see that mailbox.

Changes

We will update this policy when what we collect or how we use it changes, and show the date of the latest version below.

Last updated 23 September 2026.