This Privacy Policy explains how HKGpipi (“we”, “us” or “our”) collects, uses, stores and protects personal data.

We provide cloud cost optimisation, AWS infrastructure analysis, implementation and savings verification services, including our AWS Savings Sprint, implementation engagements and post-implementation verification.

We take the protection of personal data seriously and process personal data in accordance with applicable UK data protection law, including the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 and applicable Privacy and Electronic Communications Regulations (“PECR”), in each case as amended from time to time.

1. Who we are

HKGpipi Registered office: 14 Whitworth Rd, Woolwich, LONDON . SE18 3QB Website: hkgpipi.com

For questions about this Privacy Policy or our use of personal data, contact:

privacy@hkgpipi.com

2. When this Privacy Policy applies

This Privacy Policy applies when we process personal data in connection with:

visits to our website;
enquiries about our services;
prospective and existing client relationships;
meetings, calls and correspondence;
contracts, invoicing and account management;
delivery of our cloud optimisation and engineering services;
implementation and verification engagements;
marketing and business development; and
the operation, security and improvement of our business.

It does not replace any data processing agreement, services agreement or other contractual privacy terms agreed with a client.

When we process data on behalf of a client

During an engagement, we may be given access to a client's AWS environment, infrastructure, repositories, engineering tools or other systems.

Where we process personal data solely on a client's documented instructions, the client generally acts as the controller, and we act as its processor.

That processing is governed by the relevant services agreement, data processing agreement or other contractual terms between us and the client. Where those terms conflict with this Privacy Policy in relation to processor activities, the contractual data processing terms will apply.

We may separately act as a controller for personal data we need for our own business purposes, such as client contact information, contracts, invoices, security records and business communications.

3. Personal data we may collect

Depending on how you interact with us, we may collect the following categories of personal data.

Identity and contact information

This may include:

name;
job title;
employer or organisation;
business email address;
telephone number;
business address; and
professional contact details.

Business and professional information

This may include:

your role and responsibilities;
company or team information;
information about your organisation's cloud environment;
information relevant to a potential or existing engagement; and
professional correspondence with us.

Contract and account information

This may include:

contracts and statements of work;
authorised contacts;
billing information;
payment and invoice records;
procurement information; and
records relating to the administration of our client relationship.

We do not normally require payment card details to be provided directly to us where payment is handled through a third-party payment provider.

Communications

We may retain communications exchanged with us through:

email;
video or telephone calls;
website forms;
project management systems;
support channels;
messaging platforms; and
other business communication tools.

Website and technical information

When you use our website, we may collect information such as:

IP address;
browser and device information;
approximate location derived from an IP address;
pages visited;
referral information;
dates and times of visits;
cookie or similar technology identifiers; and
website security and diagnostic information.

Where required, non-essential storage, tracking or similar technologies are used only in accordance with applicable consent requirements.

4. Information processed during cloud engagements

Our services require us to understand how a client's cloud infrastructure operates and where costs arise.

Depending on the agreed scope, we may therefore process or be given access to information such as:

AWS account and organisation identifiers;
billing, usage and cost-management information;
Cost Explorer or equivalent cost data;
commitments, reservations and Savings Plan information;
resource names, identifiers and tags;
infrastructure configuration and metadata;
architecture information;
infrastructure-as-code;
repository and commit metadata;
pull requests;
tickets and project records;
deployment and configuration information;
IAM usernames or other authorised-user identifiers;
engineering contact information;
operational logs provided for troubleshooting; and
other technical information necessary to identify, implement or verify cloud savings.

Much of this information will not itself be personal data. However, technical records may become personal data where they identify or can reasonably be linked to an individual, for example through a username, email address, account identity, commit record or support ticket.

Data minimisation

We do not require access to personal data merely because it exists in a client's AWS environment.

Clients should provide access appropriate to the engagement and, where practicable, use least-privilege permissions.

We do not intentionally access application-level customer content or unrelated production data unless this is necessary for the agreed engagement and we have been authorised to do so.

If personal data is present in systems that we access on a client's behalf, we process that information in accordance with the client's documented instructions and the applicable contractual data processing terms.

5. Why we use personal data

We may process personal data for the following purposes.

Responding to enquiries

We use contact and business information to:

respond to enquiries;
understand potential requirements;
arrange meetings;
prepare proposals; and
discuss possible engagements.

Our lawful basis will generally be our legitimate interests in operating and developing our business. Where an individual is entering into a contract with us personally, processing may also be necessary to take steps at their request before entering into that contract.

Managing client relationships

We use personal data to:

establish and administer client relationships;
communicate with client personnel;
manage contracts and statements of work;
coordinate projects;
provide reports;
handle billing and payments; and
respond to client requests.

Depending on the circumstances, we rely on legitimate interests, performance of a contract or compliance with legal obligations.

Delivering our services

We process information where necessary to perform agreed services, which may include:

identifying cloud savings opportunities;
assessing engineering and implementation risk;
analysing cloud commitments and utilisation;
identifying idle or inefficient resources;
reviewing architecture and infrastructure configuration;
locating relevant infrastructure-as-code;
producing implementation recommendations;
preparing or contributing to pull requests;
creating or updating engineering tickets;
making authorised configuration changes;
supporting deployment;
establishing savings baselines; and
verifying realised savings.

When we process personal data within client-controlled systems solely to provide these services, we generally do so as a processor acting on the client's instructions.

Savings verification and outcome-based engagements

Where our engagement includes post-implementation verification or an outcome-based fee, we may process relevant cost, usage, baseline and account information for the period required to:

measure the effect of implemented changes;
compare actual expenditure with the agreed baseline;
verify realised savings;
investigate material differences; and
calculate fees where they depend on verified savings.

Our standard verification engagement may continue for approximately 30 days after implementation, although the exact period is governed by the applicable statement of work or contract.

Billing, tax and legal obligations

We use relevant personal data to:

issue and administer invoices;
maintain financial records;
comply with tax, accounting and regulatory obligations;
establish and enforce contractual rights; and
manage legal claims or disputes.

We rely on our legal obligations and, where applicable, our legitimate interests in protecting and administering our business.

Security

We may process personal data where necessary to:

authenticate users;
control access to systems;
investigate suspicious activity;
protect our systems and client information;
prevent fraud or misuse;
maintain audit and security records; and
respond to security incidents.

We generally rely on our legitimate interests in maintaining appropriate information and cyber security and, where relevant, compliance with legal obligations.

Marketing

We may use business contact information to communicate about services, insights or developments that we believe may be relevant to a recipient.

Where required by law, we obtain consent before sending electronic marketing.

Where consent is not legally required, we may rely on our legitimate interests in promoting our services, provided those interests are not overridden by the individual's rights and interests.

You have the right to object to the use of your personal data for direct marketing at any time.

Every marketing communication we send electronically will provide an appropriate method of opting out, or you may contact us at privacy@hkgpipi.com.

6. Where we obtain personal data

We may obtain personal data:

directly from you;
from your employer or organisation;
from another member of your organisation;
through our website;
during sales or procurement processes;
through meetings and correspondence;
through client-authorised systems to which we are given access;
through professional networking platforms;
from publicly available business sources; or
from service providers acting on our behalf.

Where a client provides us with personal data relating to its personnel, customers, suppliers or other individuals, the client is responsible for ensuring it is permitted to provide that data to us for the agreed purpose.

7. Sharing personal data

We do not disclose personal data indiscriminately.

We may share personal data with trusted third parties where reasonably necessary for the purposes described in this Privacy Policy, including:

cloud and hosting providers;
business email and productivity providers;
collaboration and project-management platforms;
source-control and software-development platforms;
accounting and payment providers;
CRM and business administration providers;
website hosting and analytics providers;
professional advisers such as lawyers and accountants;
contractors working under appropriate confidentiality obligations; and
regulators, courts, law enforcement agencies or public authorities where disclosure is legally required.

Service providers that process personal data on our behalf are required to handle the information appropriately and subject to applicable contractual and data protection requirements.

Where we appoint a sub-processor to process client personal data, we do so in accordance with the applicable client agreement or data processing terms.

A current list of material sub-processors used for client processing is available on request.

We may also disclose information in connection with a merger, acquisition, financing, reorganisation or sale of all or part of our business, subject to appropriate confidentiality and data protection safeguards.

8. International transfers

Some of the systems and service providers used by us may process information outside the United Kingdom.

Where this results in a restricted transfer of personal data, we use an appropriate transfer mechanism as required by applicable UK data protection law.

Depending on the destination and recipient, this may include:

UK adequacy regulations;
an approved UK international data transfer agreement;
an approved UK addendum to recognised standard contractual clauses; or
another legally permitted transfer mechanism.

Where required, we also assess the circumstances of the transfer and implement supplementary safeguards.

9. Data security

We use technical and organisational measures designed to protect personal data against unauthorised access, disclosure, alteration, loss or destruction.

Depending on the relevant system and risk, these measures may include:

access controls;
least-privilege permissions;
multi-factor authentication;
encryption;
secure device management;
access logging;
confidentiality obligations;
secure credential management;
controlled access to client environments;
security monitoring; and
incident-management procedures.

Access to client environments is limited to personnel who require it for the relevant engagement.

No internet-based service or method of electronic storage can be guaranteed to be completely secure. We therefore continually assess our controls according to the nature of the information and the risks involved.

10. How long we keep personal data

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, including satisfying contractual, legal, accounting, security and reporting requirements.

Retention periods vary according to the information involved.

As a general approach:

enquiry and prospective-client information is retained for a reasonable period following the last meaningful interaction;
client relationship and contractual records may be retained for the duration of the relationship and afterwards where necessary for legal, tax, accounting or contractual purposes;
accounting and transaction records are retained for applicable statutory record-keeping periods;
marketing information is retained while it remains relevant or until the individual opts out;
a minimal suppression record may be retained after an opt-out so that we can honour that preference;
security and technical logs are retained according to the relevant security and operational requirements; and
copies or exports of information created specifically for a client engagement are deleted or returned in accordance with the applicable contract, data processing terms and our internal retention procedures.

Where our services include a defined verification period, relevant engagement information may be retained throughout that period so that we can validate savings and produce the agreed results.

We may retain information for longer where reasonably required in connection with a legal dispute, regulatory requirement, investigation or other legal obligation.

11. Cookies and similar technologies

Our website may use cookies and other storage or access technologies that are necessary for the website to operate securely and correctly.

We do not currently use non-essential analytics, advertising or tracking cookies.

If we introduce non-essential cookies or similar technologies in future, we will provide appropriate information and, where required by law, obtain consent before using them.

12. Your rights

Depending on the circumstances and the applicable lawful basis, you may have rights in relation to your personal data, including the right to:

request access to your personal data;
request correction of inaccurate or incomplete data;
request deletion of your personal data;
request restriction of processing;
object to certain processing;
request portability of certain personal data;
withdraw consent where processing is based on consent; and
complain to a supervisory authority.

These rights are subject to conditions and exceptions under applicable law and do not apply in every circumstance.

To exercise a right, contact privacy@hkgpipi.com.

We may need to verify your identity before responding to a request.

Direct marketing

You may object to our use of your personal data for direct marketing at any time.

You can do so using the unsubscribe facility in an electronic marketing communication or by contacting privacy@hkgpipi.com.

Client-controlled data

If your request relates to personal data that we process solely on behalf of one of our clients, the client is generally responsible for responding to your request as controller.

If you contact us directly about such information, we may refer your request to the relevant client or otherwise assist them in accordance with our contractual and legal obligations.

13. Complaints

We encourage you to contact us first if you have concerns about how we use your personal data.

You can contact us at:

privacy@hkgpipi.com

You also have the right to complain to the UK Information Commissioner's Office (“ICO”).

Information about raising a concern with the ICO is available at ico.org.uk.

If you are located outside the United Kingdom, you may also have the right to contact the data protection regulator responsible for your jurisdiction.

14. Special category data

Our services are not designed to require health information, biometric information, information concerning racial or ethnic origin, religious beliefs, sexual orientation, political opinions or other categories of sensitive personal data.

We ask clients and prospective clients not to provide this type of information unless it is genuinely necessary and appropriate safeguards have been agreed in advance.

If special category personal data is incidentally present in a client-controlled environment to which we have authorised access, we will process it only in accordance with the client's instructions and the applicable contractual and legal requirements.

15. Children

Our website and services are intended for businesses and professional users.

They are not directed towards children, and we do not knowingly seek to collect personal data from children through our services.

16. Automated decision-making

We do not use personal data to make solely automated decisions about individuals that produce legal effects or similarly significant effects.

Our cloud cost and engineering analysis may use automated tools to identify technical or financial opportunities. Recommendations affecting a client's environment remain subject to human and client review as appropriate to the engagement.

17. Third-party websites and services

Our website or communications may contain links to third-party websites or services.

We are not responsible for the privacy practices of independent third parties. You should review their privacy information before providing them with personal data.

18. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect:

changes to our services;
changes to our use of technology or service providers;
changes to applicable law or regulatory guidance; or
changes to our internal practices.

When we make material changes, we will update the “Last updated” date at the top of this policy and take any additional steps required by law.

19. Contact us

For privacy questions, requests or complaints, contact:

HKGpipi
Email: privacy@hkgpipi.com