Last updated: 15 October 2026
Who we are
Finn & Son Creative Studio Ltd. operates finnandson.design and is responsible for the personal information described in this notice. Our address is 7/F, Kowloon Building, 555 Nathan Road, Hong Kong. For privacy questions or requests, email contact (nyan) finnandson.design.
When you contact us
We use your name, email address, message and any information you choose to include to answer your enquiry, discuss your project and provide services you request. You do not have to contact us to browse the website. If you send an enquiry, we need a way to reply. Please only include information relevant to your request.
Where the GDPR applies, we rely on taking steps at your request before entering a contract, or performing a contract, for service and project enquiries where applicable. For other correspondence, we rely on our legitimate interest in answering messages and operating our business. We rely on legal obligations where we must keep records required by law. We do not add people who contact us to a marketing mailing list.
How long we keep information
Ordinary enquiry emails are deleted from our active correspondence records within 14 days after the enquiry is resolved. An enquiry is resolved when we have answered it and no further action is pending. If you become a client, correspondence needed to deliver the project, meet accounting or other legal obligations, or establish, exercise or defend legal claims is kept separately for those purposes. Its retention depends on the project, applicable record-keeping duties and relevant claim periods.
Copies of contact-form submissions stored on this website are scheduled for automatic deletion seven days after submission. This is separate from the email copy used to respond to you. The form is configured not to store your IP address, browser name or device name with the submission.
Technical hosting and security records are separate from enquiry correspondence. They may include IP addresses, request times, requested pages and device or browser information needed to deliver the website, investigate errors and prevent misuse. We use these records for operating and protecting the site, not advertising profiles. Provider-managed logs and backup copies follow the relevant provider’s retention arrangements; the 14-day enquiry rule does not mean that every backup copy disappears at the same time.
Providers and international processing
We use Hostinger for website hosting and service providers for email and technical operation. They may process information needed to store, deliver and protect our website and correspondence. We may also disclose information where required by law or where necessary to establish, exercise or defend legal claims. We do not sell personal information.
Our business is based in Hong Kong, and we handle correspondence there. Depending on the services involved, providers may process information in other countries. If you contact us from the European Economic Area, your information may therefore be processed outside it. You can contact us for information about the providers and transfer arrangements relevant to your enquiry.
Cookies and similar technologies
We do not use visitor analytics or advertising tracking on this version of the site. The site uses Google Fonts configured for local hosting. Links to LinkedIn and other external websites take you to those providers when you choose to follow them; their own privacy notices apply there.
The Portfolio page contains embedded YouTube videos. Their preview images are stored on this website. Before you consent to marketing technologies, the video players are blocked and replaced with a notice. If you choose to enable the players, your browser connects to YouTube, a Google service. YouTube may then receive information such as your IP address, browser or device information, the page you viewed and your interaction with the video, and may use cookies or similar storage according to its own privacy terms.
Essential technologies may be used to deliver and secure the site, manage caching, or remember privacy choices. WordPress also uses authentication and preference cookies for authorised administrators; visitors do not need an account to browse or send an enquiry. Existing privacy-preference cookies may remain in a browser until they expire or are cleared.
You can accept or deny the optional marketing category through the cookie banner and change your choice later through the consent controls. Denying optional marketing technologies prevents embedded YouTube players from loading but does not prevent you from browsing the site or sending an enquiry. You can also inspect, block or delete cookies through your browser settings. Blocking essential cookies can affect functions such as signing in.
Your privacy rights
Where the GDPR applies, you can request access to your information, correction, erasure, restriction of processing, and data portability where applicable. You may object to processing based on legitimate interests. If processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of earlier processing. These rights are subject to the conditions and exceptions in the applicable law.
Please send requests to contact (nyan) finnandson.design. We may ask for proportionate information to verify your identity. Under the GDPR, we normally respond within one month; where a permitted extension is necessary, we will explain it within that period. You may complain to a competent data protection authority, including in the EU Member State where you live, work or believe an infringement occurred.
Changes to this notice
We will update this notice when our services or use of personal information changes. Any future shop, payments, customer accounts or marketing subscriptions will be reviewed before introduction. The date at the top shows the latest revision.