Legal
Privacy Policy
1. Who is responsible
Infinity IT Solutions Limited ("Infinity", "we") is responsible for the personal data described in this policy. We handle personal data in line with the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong and, where it applies to people outside Hong Kong, the data protection law of the country where they live, including the Data Protection Act 2017 of Mauritius for DodoGo customers.
When we collect a payment on behalf of a partner platform such as DodoGo, the partner is separately responsible for the data it holds about you (your account, trips, location). This policy covers only what Infinity does.
2. What we collect
2.1 Website visitors
- Contact form: name, email address, subject and message. The form is delivered to us by Formspree, which stores the submission on our behalf.
- Technical data: our hosting provider (Cloudflare) records IP address, browser type and the pages requested in its standard server logs for security and to keep the site running.
2.2 People who pay for a partner service
When you pay in a partner's app and the payment is collected by Infinity, we receive from the partner and from the payment service provider ("PSP"):
- transaction data: amount, currency, date and time, partner order or trip reference, transaction status, authorisation and settlement references;
- a masked card reference: card brand, last four digits, expiry month, issuing country, and a token that lets the PSP charge a saved card. We never receive or store the full card number, CVV or PIN. Those are entered in the PSP's payment form and handled only by the PSP;
- payer identification provided by the partner: the name and email address or phone number linked to your partner account, so that we can match a refund or dispute to the right person;
- fraud-screening signals produced by the PSP, such as a risk score, the device type and the approximate location of the payment.
2.3 Business clients
For clients of our development services we keep the business contact details of the people we work with (name, role, company, email, phone, messaging handles), contract and invoicing records, and the communication exchanged during the project.
3. Why we use it and on what basis
| Purpose | Data | Basis |
|---|---|---|
| Collecting and settling payments for partner services, issuing refunds, reconciling accounts | Transaction data, masked card reference, payer identification | Performance of the payment transaction you requested; our agreement with the partner |
| Preventing and investigating fraud, handling chargebacks, meeting card network and PSP rules | Transaction data, fraud signals, communication | Our legitimate interest and legal obligations in operating a payment collection business |
| Accounting, tax and audit | Transaction and invoicing records | Legal obligation (Hong Kong Companies Ordinance and Inland Revenue Ordinance) |
| Answering your enquiry or support request | Contact form data, communication | Your request; our legitimate interest in responding |
| Delivering development services and invoicing clients | Client contact and contract data | Performance of the client agreement |
| Keeping the website secure and available | Technical data | Our legitimate interest |
We do not sell personal data and we do not use it for direct marketing without your consent.
4. Who we share it with
- The payment service provider and acquiring bank that process the card payment. They act under their own privacy terms and card network rules.
- The partner platform (for example DodoGo) for which the payment is collected, so that it can confirm the order, handle your support request and approve refunds.
- Card networks and issuing banks, in the context of authorisations, refunds and disputes.
- Service providers we use to run the business: hosting (Cloudflare), form delivery (Formspree), email, accounting and document storage. They process data on our instructions.
- Professional advisers, auditors, regulators, courts and law enforcement where the law requires it or where it is necessary to establish or defend legal claims.
- A buyer or successor if our business is sold or restructured, under the same confidentiality obligations.
5. International transfers
We are based in Hong Kong. Our partners and providers may be located in Mauritius, the European Union, the United Kingdom, the United States and other countries. Where personal data leaves the country in which it was collected, we rely on the recipient's contractual commitments to protect it to a standard comparable to the law of the country of origin, including standard contractual clauses where those are required.
6. How long we keep it
- Transaction, settlement and refund records: 7 years after the transaction, as required by Hong Kong accounting and tax law and by card network dispute rules.
- Chargeback and fraud investigation files: 7 years after the case is closed.
- Contact form submissions and support correspondence: 24 months after the last message, unless they relate to a transaction or contract, in which case they follow the record above.
- Client contract and invoicing records: 7 years after the end of the engagement.
- Server logs: up to 30 days.
7. Security
Card data is handled only by the PSP, which is certified under PCI DSS. On our side, transaction data is stored in access-controlled systems, transmitted over TLS, and available only to the people who need it to reconcile payments, handle refunds or respond to disputes. Our website is served over HTTPS with strict transport security and a content security policy. No system is perfectly secure; if we become aware of a breach affecting your data we will inform you and the relevant authority as the law requires.
8. Your rights
You may ask us to:
- confirm whether we hold personal data about you and give you a copy (data access request);
- correct data that is inaccurate;
- delete data that we no longer need to keep (we cannot delete transaction records within the retention periods above, but we can restrict their use);
- stop using your data for direct marketing;
- explain any automated decision that affected you, for example a fraud screening outcome, and have a person review it.
Send requests to info@infinityitsol.com. We reply within 40 days as the Hong Kong Ordinance requires, and usually much sooner. We may ask you to verify your identity first. If you are not satisfied with our answer, you may complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong (pcpd.org.hk) or, for Mauritius residents, to the Data Protection Office of Mauritius.
9. Cookies
The website sets no analytics or advertising cookies. Cloudflare may set a strictly necessary cookie for security purposes. Fonts are loaded from Google Fonts, which receives your IP address when the font files are requested. The partner's app and the PSP's payment form have their own cookie and tracking practices, described in their policies.
10. Children
Our services are not directed at children under 18. We do not knowingly collect personal data from children. If you believe a child has made a payment that was collected by us, contact us and we will handle it with the partner.
11. Changes
We may update this policy. The current version and its effective date are always published at infinityitsol.com/privacy. Material changes will be announced on the website at least 14 days before they take effect.
12. Contact
Infinity IT Solutions Limited
7/F, MW Tower, 111 Bonham Strand, Sheung Wan, Hong Kong
Email: info@infinityitsol.com