SPOTMIND Privacy Policy
This Privacy Policy explains how SPOTMIND Limited ("SPOTMIND", "we", "us", "our") collects, uses, discloses, and protects personal data when you visit our website (spotmind.co) or use the RevMind advertising management system (revmind.spotmind.co) ("RevMind"), including when you log in to RevMind.
SPOTMIND Limited is a marketing agency incorporated in Hong Kong. We are committed to handling personal data in accordance with the Personal Data (Privacy) Ordinance, Cap. 486 ("PDPO").
This document is a general, plain-language disclosure of our actual data practices. It is not a substitute for formal legal advice.
Scope
This Policy applies to:
- Visitors to spotmind.co, including anyone who submits an enquiry/application form;
- Users who log in to or use the RevMind System at revmind.spotmind.co (publishers, advertisers, agency partners, and their staff); and
- Any related SPOTMIND subdomains that link to this Policy.
What personal data we collect
2.1 Enquiry / application form
| Field | Description |
|---|---|
| Name / Contact name | Your name, or the name of your contact person |
| Your business email address | |
| Company | The name of your company or organisation |
| Website / Domain | The domain of your company or website |
| Role | Your job title or function |
| Region | The region your business operates in |
| Source | How you heard about us, or the referral source |
When you fill in an enquiry or application form on our website, we collect the fields listed in the table above and store them in our customer enquiry records.
2.2 Website analytics (Google Tag Manager)
Our website uses Google Tag Manager to manage the following analytics/advertising tags, which may run only if you consent (see Section 4, Cookies & Consent): Google Analytics 4 and Facebook Pixel.
2.3 RevMind ad event tracking
The RevMind System uses a separate ad-tracking script that reports ad delivery events to our own servers, for publishers/advertisers using the RevMind ad-serving/management system to measure ad delivery and performance. This is not general visitor analytics and operates independently of the GTM tags described in Section 2.2. This tracking records only the site/placement identifier (site key), ad placement code, event type, and creative size — it does not collect or store the browser user-agent string, IP address (precise or otherwise), or any geolocation data. This Policy describes our current practices; if we change what the RevMind ad tracking collects, we will update this Policy and explain the change before it takes effect.
2.4 What we do not collect
We do not currently operate a consumer e-commerce checkout or process card payments through this website. This website does not directly process payments. If this changes, this Policy will be updated accordingly.
Purpose of collection and use (PDPO Data Protection Principle 1 & 3)
We collect and use personal data for the following purposes:
- to respond to and follow up on your enquiry or application;
- to assess and manage a potential or existing business relationship;
- to understand and improve how our website is used, through analytics (GA4);
- to measure the performance of our own advertising (Facebook Pixel);
- to operate and support the RevMind advertising management system, including tracking ad delivery and serving events for publishers and advertisers;
- to comply with applicable legal, accounting, or regulatory requirements.
We use personal data only for the purposes stated above, or for a directly related purpose, unless we obtain your consent for another use.
Cookies and Consent (Google Consent Mode v2)
Since 21 August 2026, our website applies a deny-by-default approach to non-essential cookies, using Google Consent Mode v2. This means analytics and advertising storage (e.g. GA4, Facebook Pixel) is not activated unless you actively opt in. When you visit our site, a cookie consent banner gives you three choices: Accept all, Reject all, or Manage, which lets you choose Analytics and Advertising separately rather than as a single on/off setting. Your choice is remembered (the banner will not reappear on its own), but you may change it at any time via the "Cookie Settings" link in the website footer, which reopens the banner with your existing choice pre-filled for review and adjustment. Your choice also does not carry across spotmind.co and revmind.spotmind.co — each domain requires a separate choice.
Disclosure to third parties / data processors (PDPO Data Protection Principle 3)
| Third party | Purpose | Data involved |
|---|---|---|
| Google (Google Analytics 4, Google Tag Manager) | Website analytics | Usage / device data, collected only after you consent via the cookie banner |
| Meta / Facebook (Facebook Pixel) | Advertising performance measurement | Usage / device data, collected only after you consent via the cookie banner |
We share limited personal data with the following third-party service providers, who act as our data processors: Google (GA4, GTM) for website analytics, and Meta/Facebook (Facebook Pixel) for advertising performance measurement — both only if you have consented via the cookie banner. These providers are large multinational technology companies whose infrastructure is located outside Hong Kong; data collected via GA4 and Facebook Pixel may therefore be transferred to, stored, and processed in jurisdictions outside Hong Kong, and are governed by each provider’s own privacy and security practices. We recommend reviewing the Google Privacy Policy and the Meta Privacy Policy to understand how they handle data. Beyond what is described in this Policy, we have no practice of disclosing personal data to any other third party. If further disclosure is required by legal obligation or court order, we will disclose only to the extent required or permitted by law.
Data retention (PDPO Data Protection Principle 2)
| Data category | Retention period |
|---|---|
| Enquiry / application form data | Up to 24 months from your last contact or submission, after which it is deleted or anonymised. Where a business relationship has been established, our general customer/supplier record-keeping periods apply instead. |
| Website analytics data (GA4) | Retained according to Google Analytics' own default retention setting (14 months), in line with the GA4 platform default. |
| RevMind ad delivery event records | Up to 13 months, which is enough to compare advertising performance month on month. After that, event-level records are deleted or aggregated into statistics that do not identify anyone. |
We retain personal data only for as long as reasonably necessary to fulfil the purposes for which it was collected, or as required to meet legal, accounting, or regulatory obligations. Retention periods: enquiry/application data up to 24 months from last contact; GA4 analytics per Google's default 14-month setting; RevMind ad-serving event logs up to 13 months. We set these periods to balance our business needs against data minimisation. They are not fixed by any specific statutory period, and we review them from time to time.
Data security (PDPO Data Protection Principle 4)
We take reasonable steps to protect personal data we hold from unauthorised or accidental access, processing, erasure, loss, or use. However, no method of electronic storage or transmission is 100% secure, and we cannot guarantee absolute security.
Your rights (PDPO Data Protection Principle 6 — Access & Correction)
Under the PDPO, you have the right to request access to and correction of personal data we hold about you, and to request information about our data policies and practices. We may charge a reasonable fee to cover the administrative cost of processing a data access request. To exercise these rights, please contact us using the details in Section 10.
Who this website serves
Our website and RevMind System are intended primarily for business-to-business ("B2B") use. This website is not directed at, and we do not knowingly target, individual consumers for online retail purposes.
Contact us
If you have any questions about this Privacy Policy, or wish to exercise your data access or correction rights, please contact SPOTMIND Limited at privacy@spotmind.co.
Changes to this Policy
We may update this Privacy Policy from time to time to reflect changes in our data practices or for legal/regulatory reasons. The "Effective date" at the top of this Policy indicates when it was last revised. Material changes will be reflected by updating this page.
資料刪除 Data Deletion
如需刪除我們持有的你的個人資料，請電郵 privacy@spotmind.co，主旨註明「刪除資料請求」。我們會喺收到後 30 日內處理並回覆確認。
To request deletion of the personal data we hold about you, email privacy@spotmind.co with the subject "Data Deletion Request". We will process your request and confirm within 30 days of receipt.