Nearoute Limited Privacy Policy

Effective date: 2021.9.28
Last updated: 2026.10.3

This Privacy Policy explains how Nearoute Limited (Nearoute, we, us, or our) handles personal data across its data-centre, IDC, ISP, hosting, equipment and network business. It covers nearoute.com, vps.nearoute.com, other Nearoute-operated portals, accepted written Orders, site visits and relevant offline dealings.

The Services include cloud and VPS computing, dedicated and rented servers, customer-owned server colocation, cabinets and rack space, power, cross-connects, remote hands and agreed managed services, IP Transit, bandwidth and private connectivity, IP address leasing, permanent transfers of IP registration rights, and related services identified in an Order. This Policy does not imply that all categories, processing tools or locations are used for every customer.

Nearoute Limited is incorporated in Hong Kong. Our registered office is RM 22, 2/F, FU TAO BUILDING, NO. 98 ARGYLE STREET, MONGKOK, HONG KONG. Personal data enquiries and requests may be addressed to the Privacy Contact, Nearoute Limited, using the public contact form or by post to that address. Security incidents and abuse reports may be sent to [email protected].

We handle personal data in accordance with Hong Kong's Personal Data (Privacy) Ordinance (Cap. 486) (PDPO) and other data protection requirements that apply to the relevant processing. This Policy is a statement of our practices and commitments; it is not blanket consent to every use or disclosure of your data. A request for separate consent, where required, will be presented separately.

1 Who this Policy covers

1.1 This Policy covers website visitors, prospective and current customers, corporate representatives and authorised users, facility visitors and contractors, equipment and shipment contacts, technical and abuse contacts, IP transferors and recipients and their representatives, and people who submit enquiries or reports. It addresses personal data used in our own service administration, site security, transaction and legal activities as well as our relevant role in hosted or transmitted data.

1.2 Personal data means information relating to a living individual whose identity can practicably be ascertained from that information, directly or indirectly, in a form that permits access or processing. An IP address, identifier, or usage record may be personal data when it can be linked to an identifiable individual.

1.3 Our role depends on the activity. We normally determine the purposes of Account, billing, business-contact and security processing that we undertake. We may process hosted information on a customer's behalf where we provide computing or an agreed managed service. Providing power, rack space, or network carriage alone does not mean that we determine the purposes of every dataset on a customer-owned server or may inspect its contents. The parties' roles depend on the actual processing and applicable law, not a label or the mere presence of equipment in a facility.

1.4 An independent data-centre operator, carrier, payment provider or Internet registry may process information for its own legal or operational purposes and issue its own notice. Where such a party instead processes data on our instructions, our own duties concerning that arrangement remain. A person using a customer's hosted application should normally contact that operator about its application data; we will assist or respond within our actual role as required.

2 Information we handle

The categories below describe information relevant to our Services. The information actually handled depends on the features you use, what you provide, the applicable transaction, and any legitimate security or legal requirement. We do not collect every category from every person.

Category	Examples and circumstances
Account and contact information	Name, email address, telephone number, billing or contact address, country or region, Account identifier, and organisation information where relevant.
Authentication and preferences	Login and security settings, authentication records or tokens needed for a feature, recovery information, language preferences, and records of notices or choices. Do not send passwords or private keys in a support message.
Orders and payments	Accepted quotations, contracts, signatory authority, service selections, commitments, renewal instructions, invoices, Account balance, security deposits, transaction references, refunds, and payment-method identifiers or tokens relevant to the payment process.
Service and network records	Server and circuit identifiers, assigned prefixes and ASNs, handover details, BGP or route-change records, relevant flow or security metadata, traffic and capacity measurements, power readings, provisioning actions, timestamps, errors and diagnostics. Such records are personal data where linked to an identifiable person.
Website and security information	Source IP address, browser or device information supplied by your connection, pages or actions requested, session identifiers, security events, and relevant login or abuse-prevention records.
Communications and reports	Support tickets, enquiries, complaint or abuse details, correspondence, and attachments you provide. These may contain information about another person.
Verification information	Identity, payment-authorisation, business-authorisation, or eligibility information reasonably needed in a particular case to address a genuine verification, fraud, or legal issue.
Customer-hosted content	Files, databases, messages, software, configurations, or other personal data stored or transmitted through customer resources. This is distinct from the Account information we use to administer the relationship.
Facility and visitor records	Where needed for an actual site visit or security function: visitor name and organisation, host, contact details, identity verification result, appointment, access authorisation, card or access log, and incident report. Site surveillance information is addressed in Section 9.5.
Equipment and logistics records	Equipment serial numbers or inventories linked to customer contacts, delivery and collection authorisations, shipment details, handling instructions, work tickets, and custody or handover records.
IP resource transaction and registry records	Prefixes, ASNs, registry accounts, source and recipient organisations, signatories and authority documents, LOAs, business or technical contacts, transfer correspondence, and payment or completion evidence. Some required contact and technical records may be public as described in Section 7.6.

2.1 We receive information from you, your representatives and authorised contacts, your interactions with the Websites and Services, relevant service or site records, and people arranging an authorised visit or transaction. We may also obtain relevant information from facility operators, carriers, equipment couriers, payment providers, registries, disclosed transfer counterparties or brokers, public registry records, complainants, or competent authorities. The source does not remove our duty to assess relevance, lawful use and appropriate notice.

2.2 A selected payment provider may collect payment credentials through its own payment interface and process them under its applicable terms and privacy notice. The information returned to Nearoute depends on that method. Do not send full payment-card details, card security codes, passwords, or private keys through our contact form or support tickets.

2.3 Verification requirements depend on the transaction or visit; this Policy does not impose a universal identity-document upload on every customer. A site-access check, corporate signatory check or registry transfer may require different evidence. We will explain the actual purpose, seek no more than necessary, and use an appropriate submission process. Recording that a document was checked may suffice instead of keeping a copy. Collection of a Hong Kong identity card number, copy or other identifier must satisfy applicable requirements; a general security justification is not an exemption from them.

2.4 Provide another person's data only where you are authorised or otherwise lawfully entitled to do so. Limit support attachments and reports to what is necessary. We may redact or remove unnecessary information and request a safer or more limited submission.

3 Required and optional information

3.1 Information identified as required in the relevant registration, Order, payment, support, or verification process is needed to perform that activity. Depending on the request, this may include an identifiable customer, a working email address, authentication information, necessary billing details, and information sufficient to identify an affected Service or investigate a complaint.

3.2 If necessary information is missing or materially inaccurate, we may be unable to register an Account, fulfil or renew an Order, complete a payment or registry transfer, authorise site entry or equipment collection, arrange a circuit, verify an instruction, or resolve the request. The consequence must relate to the missing information and purpose; we will not use a required-field label to justify unrelated collection.

3.3 Optional information may be omitted. Marketing choices are voluntary and do not determine eligibility for the core Services. Withdrawing consent to an optional use does not retrospectively invalidate processing that was lawful when performed.

4 Purposes of processing

We use personal data for the following purposes, to the extent relevant and lawful:

• creating and administering Accounts, authenticating users, managing permissions, and communicating about the customer relationship;

• accepting and fulfilling Orders, provisioning resources, recording authorised instructions, measuring agreed power, capacity or traffic usage, and providing support;

• arranging authorised site access, protecting facilities and equipment, managing delivery or collection, recording custody, and carrying out agreed remote-hands tasks;

• configuring and troubleshooting circuits and routing, maintaining operational or abuse contacts, investigating route incidents, and validating rights to announce IP Resources;

• checking authority and performing an agreed IP lease or permanent transfer, coordinating the relevant parties, and maintaining required registry or public technical records;

• processing payments, applying Account balance to authorised renewals, issuing invoices, reconciling transactions, and handling refunds or disputes;

• maintaining service reliability and security, diagnosing faults, managing capacity, and investigating fraud, compromise, or misuse;

• assessing complaints and rights reports, enforcing the Terms of Service and Acceptable Use Policy, and correcting mistaken restrictions;

• maintaining records required by law, responding to lawful requests, establishing or defending legal claims, and meeting obligations to regulators or competent authorities;

• administering your privacy requests, preferences, consent records, and communications choices;

• sending optional direct marketing only in accordance with Section 6.

4.1 We may use aggregated information for service planning and reliability analysis where individuals are not identifiable. Removing a name alone does not necessarily make information anonymous, and identifiable or re-identifiable information remains subject to applicable safeguards.

4.2 We will not use personal data for an unrelated new purpose without the consent or other legal basis required by applicable law. A contractual prohibition on unlawful activity is not a general permission to use customer information for unrelated purposes.

4.3 We do not treat hosting permission as permission to sell Customer Data, monetise private server content through advertising, or train general-purpose AI models on that content. Any use of administrative data by an automated tool remains subject to the stated purposes, appropriate safeguards, and applicable law.

5 Cookies and similar technologies

5.1 Where a Nearoute website or portal provides a login, shopping or customer session, it uses session technology for those functions and processing associated requests. Cookies or similar local storage may also support preferences you select and security measures such as protecting forms from automated misuse. Necessary technical information can include a session identifier, your network address, request details, and browser information.

5.2 You can manage cookies through your browser settings. Blocking or deleting a cookie needed for login, a transaction, or security may prevent that function from working. A cookie's duration depends on its function and configuration: session cookies normally end with the relevant session, while a persistent cookie remains until its stated expiry or earlier deletion. This Policy does not claim that every cookie is a session cookie.

5.3 If we introduce optional analytics, advertising, or other non-essential tracking, we will identify the relevant purposes, providers or recipients, and applicable choices before the collection takes place, and obtain prior consent where required by law. Such tracking must not be treated as essential merely because it is commercially useful. We will provide a way to change a consent-based choice.

5.4 A payment, verification, or security provider may process information through a component used for its particular function. We will provide the applicable information and choices at that interaction. Acceptance of this Policy does not itself authorise undisclosed advertising tracking, and simply continuing to browse is not a substitute for express consent where it is required.

6 Service messages and direct marketing

6.1 We send communications reasonably necessary to administer the Services, including invoices, renewal reminders, payment or deletion warnings, security messages, responses to requests, and material contractual notices. Unsubscribing from marketing does not stop these essential communications. A message promoting additional products is not automatically an essential service message merely because it accompanies an invoice or notice.

6.2 If we offer direct marketing, we will first specify the personal data, marketing subjects and free response channel. Proposed Nearoute promotions may concern your name and business or personal contact details and offers for data-centre space, colocation, server rental, cloud or VPS services, power and on-site support, IP Transit, bandwidth and connectivity, or IP resource leasing and transfer services. We will market only within the scope of the valid consent or express indication of no objection actually obtained. Adding business categories to this Policy does not expand a person's existing marketing consent. Silence is not consent, and an earlier cloud-only choice does not automatically cover all company services.

6.3 You may opt out at any time, free of charge, through a supplied unsubscribe method or the contact channels in Section 16. We will cease the relevant direct marketing as required by law and may retain a minimal suppression record to ensure that your preference is honoured.

6.4 This Policy does not authorise selling a customer contact list or providing personal data to a third party for its own direct marketing. Any proposed arrangement of that kind would require separate advance information, including the required recipient and marketing details, and the legally required consent. Consent to Nearoute's own marketing would not automatically cover it.

7 Recipients and service providers

7.1 We may disclose relevant personal data to the following defined classes of recipients where necessary for the stated purpose, within the relevant authority, and subject to applicable safeguards:

Recipient class	Purpose and typical information involved
Personnel authorised to administer or support the Services	Account administration, troubleshooting, security, and responding to requests; access is limited to their duties.
Hosting, data-centre, network, infrastructure and security service providers	Supplying, connecting or protecting the relevant resources; necessary technical identifiers, operational contacts, site-access details, traffic or security records, and hosted information only within the agreed role and purpose.
Billing, customer-support, communications and account-management providers	Managing invoices, service messages and support; relevant contact, Account, transaction, and correspondence information.
Banks, payment processors and payment-dispute participants	Completing or reversing authorised payments, detecting payment fraud, and resolving disputes; transaction and billing details and relevant evidence.
Verification or fraud-prevention providers, if engaged for a particular check	Assessing the specific verification or fraud issue; only information proportionate to that check.
Authorised facility personnel, installation contractors, equipment maintainers and logistics providers	Site appointments, deliveries, remote hands, equipment return and safe custody; relevant visitor, contact, authorisation, inventory and shipment information.
Relevant RIRs, NIRs, registration or routing-service operators, and identified IP transaction counterparties or brokers	Verifying rights, processing a lease or transfer and maintaining necessary records; relevant organisational, signatory, technical and contact information. Public disclosures are limited by Section 7.6.
Legal, accounting, audit and other relevant professional advisers, and insurers where a claim requires it	Obtaining professional advice, meeting accounting obligations, or administering a genuine claim; information relevant to that task under appropriate duties of confidentiality.
Courts, law enforcement agencies, regulators and other competent authorities	Only where the legal and evidential requirements in Section 10 are satisfied.
A proposed or actual successor to the relevant Nearoute business, and its professional advisers	Necessary due diligence or transfer of the customer relationship under Section 7.4.

7.2 A recipient's presence in this list is not permission to receive all customer data. We consider what it actually needs, restrict processing performed on our behalf to authorised purposes, and use contractual or other appropriate measures to address security, confidentiality, retention, and deletion. Outsourcing does not remove Nearoute's own responsibilities.

7.3 Some recipients, such as a bank or competent authority, determine their own purposes or have independent legal duties. Their processing is governed by the applicable law and their own relevant notices. Where you select an external payment or service provider, its identity and applicable information should be presented as part of that interaction.

7.4 A genuine business reorganisation, merger, or transfer may require limited disclosure under confidentiality safeguards and transfer to a successor that assumes the relevant obligations. We will provide appropriate notice and obtain any consent required by law before a materially different use. A business transfer does not authorise unrestricted reuse or unrelated marketing.

7.5 A complainant does not receive customer identity details or private server contents merely because they submit a report. We may pass relevant allegations and limited evidence to an affected customer so that the issue can be addressed, protecting unnecessary personal information. Other disclosure must have an adequate legal basis.

7.6 Public Internet registration and routing records. A resource transaction or network Service may require technical and contact information in WHOIS, RDAP, abuse-contact, IRR, reverse-DNS or RPKI-related records. We will explain a required public submission at the relevant process, use role-based business contacts and minimise personal details where permitted, and provide a way to request correction of records we control. Information made public may be accessed globally, copied and retained by others; we cannot promise removal from independent lawful registry history or caches. A public contact requirement does not justify publishing identity-document copies, payment records or private contracts without a separate lawful basis.

8 Processing locations and international transfers

8.1 Nearoute is a Hong Kong company. A facility, server or circuit endpoint is located as specified in the accepted Order. This does not locate every support, administration, payment, carrier, registry or security operation there, or promise that Internet traffic remains within a country. An agreed controlled-route or data-residency service requires an express scope and commitments.

8.2 Processing may occur in Hong Kong and other places where the selected Services or relevant recipients operate. Actual locations depend on the facility, carrier path, administrative provider or registry transaction. We will make relevant information available through service or site information, the transaction process, recipient notices or an enquiry, and give specific advance disclosure where required by law. A customer needing a geographic restriction should have it expressly agreed before contracting. We do not infer data-residency permission simply from acceptance of this Policy.

8.3 Before a cross-border arrangement is used, we must assess the applicable requirements and put in place the necessary safeguards. These may include contractual restrictions on use and further transfer, appropriate security and confidentiality obligations, or a transfer mechanism or consent where the relevant law requires it. Overseas processing does not remove applicable Hong Kong data protection obligations.

8.4 We will not materially change an agreed data-residency commitment without the notice and any consent required by the agreement or law. A statement that information may be processed overseas is not blanket consent to a transfer that would otherwise be unlawful.

9 Customer-hosted information and operational access

9.1 Customers retain their rights in the information they host. We process hosted information to provide the purchased infrastructure, perform lawful customer instructions, protect the Services, and meet applicable legal obligations. Customers are responsible for their own collection notices, lawful permissions, application security, and obligations to the individuals whose information they host.

9.2 We may use relevant service measurements, interface counters, route changes, security records and proportionate network metadata for stated operational, billing and security purposes. A transit or bandwidth Service is not a representation that we routinely record full packet contents or every customer communication. Any exceptional diagnostic capture or inspection must have a justified lawful purpose, limited scope, appropriate authority and retention, and the required notice or consent. We do not promise anonymous or log-free Services.

9.3 Access by our personnel to hosted information must be limited to what is reasonably necessary for an authorised service, security, support, or legal purpose. A support request does not permit unrestricted browsing of unrelated content. Where a problem can reasonably be investigated using limited diagnostic information, we should use that information rather than request unnecessary content or credentials.

9.4 If a separate data processing agreement is legally required, it must be in place before the relevant processing begins. This Policy is not a substitute for all terms required by such an agreement. Requests from a customer's users will be handled according to the parties' actual roles, including referring the request to the customer or providing reasonable assistance where appropriate.

9.5 Site access and surveillance. At a facility where access records or CCTV are used for security, the relevant operator must provide the appropriate notice, identify who controls the records and explain their purposes and contact channel. Where Nearoute controls or receives such records, we limit their use to justified access, safety, security, incident or legal purposes, restrict access and retain them only as justified. We do not represent that every partner facility is operated by Nearoute or uses the same surveillance arrangements. Facial recognition, biometric identification and audio recording are not automatically authorised by this Policy; any such processing requires a separately assessed lawful basis, adequate notice and any necessary consent before use.

9.6 Equipment and remote work. Holding a customer's server in a cabinet, replacing a cable, or recording its serial number does not grant unrestricted access to data on its disks. A remote-hands instruction must identify the authorised task. If the task genuinely requires data access, minimise it to the agreed purpose and protect any diagnostic material. Customer-owned equipment collection, rented-drive sanitisation and any lawful evidential preservation follow their distinct contractual and legal processes.

10 Lawful investigations and disclosure

10.1 Binding requests. We will cooperate with a competent law enforcement agency, court, regulator, or other authority acting within its legal powers, including by preserving or producing relevant information in response to a valid and binding warrant, court order, statutory production requirement, or other enforceable legal process. We will take reasonable steps to verify identity, authority, authenticity, scope, and applicability. A binding legal requirement does not depend on the customer already having been convicted.

10.2 Disclosure supported by sufficient evidence. Where disclosure is legally permitted but not compulsory, we will cooperate and disclose relevant information if, after reasonable assessment, we are satisfied that the requester is a competent authority and credible documents or other evidence provide sufficient objective grounds for a lawful, necessary, and proportionate disclosure. If relying on the crime-related exemption in section 58 of the PDPO, the relevant statutory conditions must be met, including that non-disclosure would be likely to prejudice the qualifying purpose.

10.3 An unsupported allegation or assertion of official status is insufficient. We may ask for clarification, narrow an excessive request, or decline a request without an adequate legal basis. We remain responsible for documenting and assessing the basis of a voluntary disclosure.

10.4 Information disclosed may include relevant Account and verification details, corporate or operational contacts, billing and payment records, assigned IP prefixes and ASNs, routing and access records, proportionate operational or network logs, site-entry or incident records, relevant surveillance held by us, equipment custody records, IP transaction documents, support communications, and hosted data. Disclosure is limited to information we hold or lawfully control and to what is required or justified by the legal basis. This Policy does not authorise an independent search, interception, seizure or decryption power beyond applicable law, and does not promise that every category exists.

10.5 An overseas authority's request is not automatically binding on Nearoute. We will assess Hong Kong law, any other law binding on the data or operation, and any required recognition, mutual legal assistance, or other lawful process. We will not make a cross-border disclosure that would itself breach applicable law.

10.6 Where lawful and appropriate, we will notify an affected customer. Notice may be delayed or withheld if prohibited by law, if it would prejudice a legitimate investigation, or if it would create a material risk of harm or destruction of evidence. Relevant information may be preserved for a justified lawful purpose even after Services end. Neither preservation nor a pending investigation guarantees continued server access or recoverability.

10.7 This section follows the corresponding provisions in the TOS. Neither this Policy nor acceptance of the TOS gives unrestricted consent for disclosure. Applicable personal data and confidentiality requirements continue to apply.

11 Retention and deletion

11.1 We retain personal data only for as long as reasonably necessary for a specified purpose or required by applicable law. The relevant factors include the active service relationship, the nature and sensitivity of the information, legal accounting or record-keeping requirements, a genuine unresolved complaint or claim, a lawful preservation obligation, and whether a less identifying record is sufficient. We will review continued retention and delete or appropriately anonymise information when it is no longer justified.

11.2 Retention is assessed by category:

• Account and contact records are needed to administer an active relationship and, after closure, only to the extent justified by outstanding transactions, legal duties, or genuine claims.

• Payment, invoice, and tax-related records may need to remain for the applicable statutory period even after a server is deleted.

• Operational and security logs are retained according to their service or security purpose, with relevant extracts preserved longer only where a particular incident, dispute, or legal requirement justifies it.

• Support and abuse records are retained for handling the matter and any justified follow-up, with unnecessary attachments removed when no longer needed.

• Visitor, access and surveillance records are retained for the defined site-security purpose, with relevant extracts isolated where a substantiated incident or legal preservation requirement needs longer retention;

• Equipment handover, site-work and circuit records are retained for the service, custody, accounting or genuine claim purpose to which they relate;

• IP transfer and authority records are retained for completion, continuing obligations, relevant registry requirements and justified claims; separate public registry records may remain under the responsible registry's own lawful rules;

• Verification documents should be kept no longer than needed for the particular verification or legal purpose; a limited record of the result may be sufficient afterwards.

• Marketing preferences and limited suppression records may be retained to prove and honour your choices without retaining an unnecessary marketing profile.

11.3 Retail Cloud virtual servers suspended for non-payment are scheduled for permanent deletion 72 continuous hours after suspension under the TOS. This includes weekends and public holidays. The rule concerns the affected virtual resources, not automatic deletion of every invoice, contact record or item of evidence. It does not apply automatically to physical server rental, Customer Equipment, cabinets, circuits, IP Transit, IP leases or completed permanent IP transfers.

11.4 Backups are not included by default. Customers maintain independent backups unless a purchased Service includes them. Cloud deletion, separately ordered backup retention, sanitisation of rented server storage, and return of customer-owned disks are distinct processes under the TOS and relevant Order. Customer-requested cloud deletion or reinstallation may cause earlier loss; customer-owned hardware cannot be erased merely by applying a cloud retention period. Returning a leased IP resource does not erase independent public registry records, and ending a network Service does not reverse a completed permanent transfer.

11.5 Where residual information remains temporarily in infrastructure recovery systems, it will be protected and removed through the relevant retention cycle, except where lawful preservation is required. Such residual information is not a promised customer backup or recovery facility. A lawful obligation to preserve evidence does not require us to keep an operational server available to the customer.

11.6 A closure or erasure request will be assessed against applicable law and justified retention requirements. We will explain relevant limitations where lawful. Closing an Account does not permit us to retain personal data indefinitely without a valid purpose, and a need to retain limited records does not justify keeping all server content.

12 Security and incidents

12.1 We are responsible for taking appropriate and reasonably practicable technical and organisational measures against unauthorised or accidental access, processing, loss, erasure, or use of personal data. The measures must reflect the nature of the data, foreseeable harm, the infrastructure, and the relevant processing. Appropriate measures include restricting access by role, protecting credentials and communications, maintaining systems, and controlling access by service providers.

12.2 No internet or physical facility service guarantees absolute security. That does not release Nearoute from reasonable precautions and its own duties. Customers are responsible for systems, applications, access lists, credentials and backups within their agreed role; colocation, remote hands, managed computing and transit have different service boundaries. We must protect data and equipment-related records within our own responsibility even where the underlying server belongs to a customer.

12.3 If we become aware of an incident materially affecting Customer Data within our responsibility, we will investigate, take reasonable containment and remedial measures, notify affected customers without undue delay, and meet applicable regulatory or individual notification duties. We will provide information reasonably available to help affected customers respond. We do not state that every jurisdiction has the same notification deadline.

12.4 Report a suspected security incident promptly to [email protected] or through support. Do not include unnecessary sensitive data, credentials, or live malware in the initial report.

13 Access correction and other choices

13.1 You may ask whether we hold your personal data, request access to that data, and request correction of inaccurate data in accordance with the PDPO. Some Account details can be updated through the customer area. For a formal request, contact the Privacy Contact in Section 16 and identify the information or correction sought.

13.2 We may request information reasonably necessary to verify your identity and authority and clarify the request. The verification must be proportionate; we should not collect excessive new personal data merely because you exercise a privacy right. We will protect information about other people when responding.

13.3 We will handle a data access or correction request within the applicable statutory period, generally no later than 40 days after receiving the request under the PDPO, subject to its provisions. Where the law permits or requires a different handling step, we will provide the required response or explanation rather than assume that the deadline disappears. If we cannot fully comply within the applicable period, we will give the notice required by law and complete the remaining response as required.

13.4 We may charge a non-excessive fee for complying with a data access request where the law permits it, and will explain the fee in advance. We will not charge for a data correction request or opting out of direct marketing where the law prohibits such a charge. A request may be refused only on an applicable lawful ground, with the explanation or notice required by law.

13.5 You may also ask about Account closure, unnecessary data, marketing choices, or consent withdrawal. Additional rights, such as erasure, restriction, objection, portability, or safeguards concerning automated decisions, apply where the law governing the relevant processing provides them. This Policy does not represent that every right is unconditional or applies identically in every country.

13.6 Security or fraud-prevention tools may generate alerts, risk assessments, or operational restrictions. You may request a review of a disputed Account or Service restriction and provide relevant evidence. We will provide any human review or other safeguard required by applicable law. No automated tool removes Nearoute's responsibility to assess a justified privacy or service complaint.

13.7 You may raise a complaint with us or contact the Office of the Privacy Commissioner for Personal Data, Hong Kong. You do not have to contact us first if you wish to use a regulatory or legal remedy available to you. Other competent data protection authorities may also be available where their laws apply.

14 Children and external services

14.1 Customers contracting in their own name must meet the TOS age and legal-capacity requirements. Services are not directed at children as retail Account holders. If we learn of an underage Account, we will assess appropriate restriction and deletion subject to lawful retention. A visitor or representative is also subject to applicable facility and authorisation requirements; this Policy does not create a general invitation for children to access a data centre.

14.2 Customers may hold information about children in their own applications only where lawful and appropriately protected. The Account age requirement is not permission to disregard obligations concerning children's information hosted by a customer.

14.3 A link to an external service does not place all of that provider's processing under this Policy. Review its relevant notice before providing information. Nearoute remains responsible for its own selection, instructions, and disclosures where it engages a provider to process information on its behalf.

15 Changes and relationship with the TOS

15.1 We publish changes with an updated date and provide appropriate notice of a material change. Expanded service categories do not authorise new uses of previously collected data without the necessary basis, notice or consent. A change affecting a contractual commitment also follows the TOS. New site-surveillance, public registry publication, tracking, recipient or marketing arrangements must receive their own required advance information; this revision alone is not consent to them.

15.2 We will not rely solely on continued use, a revised webpage, or acceptance of the TOS to obtain consent where a separate valid consent is required. No change retrospectively authorises an unlawful collection or disclosure.

15.3 This Policy supplements the TOS and the Personal Information Collection Statement below. It does not reduce contractual or statutory data protection obligations. Mandatory laws and rights prevail over conflicting wording, including any translation or choice-of-law clause.

16 Privacy contact

For personal data enquiries, access or correction requests, and privacy complaints, address your request to:

Privacy Contact, Nearoute Limited
RM 22, 2/F, FU TAO BUILDING, NO. 98 ARGYLE STREET, MONGKOK, HONG KONG
Online contact: Contact Nearoute
Existing customers may also use their agreed service contact or a support ticket clearly marked Privacy Request. The request will be directed to the Privacy Contact.
Security and abuse reports: [email protected]

Please identify the request and provide a safe reply method. Do not send identity documents, payment-card security codes, passwords, private keys, or unnecessary third-party information in the initial message. We will explain any verification that is reasonably needed.

17 Personal Information Collection Statement

Nearoute Limited collects personal data to handle enquiries and accepted Orders; administer Accounts and authorised contacts; process payments, deposits and renewals; supply data-centre, colocation, cabinet, server-rental, cloud, VPS and network Services; arrange site access, equipment delivery or return and remote hands; operate IP Transit and bandwidth; verify and complete IP leasing or permanent transfer transactions; maintain security; handle complaints; and meet applicable legal obligations. We use only the purposes relevant to the actual interaction.

Information identified as required in the relevant form or process is necessary for that activity. Without it, we may be unable to accept the Order, authorise a visit or equipment collection, verify an instruction, provide connectivity, complete a payment or registry transaction, or answer the request. Other information and marketing choices are voluntary. Provide only relevant, accurate information and tell us when designated contacts change.

Relevant information may be provided to authorised personnel; hosting, facility, network and security providers; installation, maintenance and logistics contractors; billing, support and communications providers; banks and payment processors; verification providers where needed; professional advisers or insurers for a relevant matter; registries, routing operators and identified IP transaction counterparties or brokers; competent authorities where disclosure is legally required or justified; and a genuine business successor under appropriate safeguards. Sections 7 and 10 explain the purposes and limits. Processing may occur in Hong Kong and overseas; an endpoint or cabinet location does not locate every related processing activity.

Where a transaction requires a public registry or routing contact record, we will identify that requirement at the relevant process and minimise personal details where permitted. Site access records and any surveillance are subject to the applicable site notice. A general service enquiry does not authorise publishing identity documents or private transaction records. Websites use necessary session and security information; optional tracking requires the notices and choices described in Section 5.

Direct marketing requires the appropriate separate notice and valid consent or express indication of no objection. Refusing marketing does not prevent use of the core Services. Expanding Nearoute's service range does not expand the marketing subjects you previously agreed to.

You may request access to and correction of your personal data under the PDPO. Contact Privacy Contact, Nearoute Limited, RM 22, 2/F, FU TAO BUILDING, NO. 98 ARGYLE STREET, MONGKOK, HONG KONG, or use the public contact form. A non-excessive access fee may apply where legally permitted. Retention, security, rights and complaint handling are explained in this Policy. Accepting an Order or providing information is not blanket consent to unrelated processing or unrestricted disclosure.