1. Introduction and Scope
This Privacy Policy describes how Commons Properties Limited collects, uses, stores, shares and protects personal information. It applies to our public website, to enquiries and correspondence, and to the estate systems that we plan, integrate and steward for commercial buildings and industrial grounds. The policy was written by the developer Commons Estates on behalf of Commons Properties Limited, and it is maintained as a living document that reflects the way the practice actually works.
A computer integrated systems design practice touches many kinds of information. Some of it is ordinary business contact information. Some of it is operational data gathered from plant, meters and access systems inside a client estate. This policy explains which categories we handle, on whose behalf, and for how long. Where we act as a service provider to a building owner, that owner remains the controller of the estate data and we act on documented instructions. Where we run our own website and office functions, we are the controller.
By using this website or engaging our services, you acknowledge that you have read this policy. If you do not agree with it, please do not submit personal information to us, and contact us so that we can discuss an alternative arrangement where one is possible.
2. Who We Are
Commons Properties Limited is a company registered in Hong Kong and operating from a survey office at Room 5, 30/F, W50, 50 Wong Chuk Hang Road, Wong Chuk Hang, Hong Kong (HK). The company provides computer integrated systems design and related professional, scientific and technical services for the built estate. Our practice covers estate systems architecture, building telemetry integration, access and gate control systems, metering and utility data, grounds and plant networks, and managed estate stewardship.
For the purposes of applicable data protection law, Commons Properties Limited is the data controller in respect of information gathered through this website, through direct enquiries, and through the administration of our own business. When we operate systems inside a client estate, we generally act as a data processor for that client, and the client decides the purposes and scope of the processing.
You may reach our privacy contact at any time by writing to contact@avyfertilizer.mom or by calling +15313216284 during our published business hours.
3. Information We Collect
We collect only the information that is needed to answer an enquiry, deliver a survey, integrate an estate system, keep records and meet our legal duties. The categories are described below.
- Identity and contact details, including name, company, job title, email address, phone number and postal address.
- Correspondence content, including the subject and body of messages sent through our contact form, by email or by telephone, and our replies.
- Estate operational data that a client asks us to integrate, such as plant readings, alarm events, meter values, access events and device status.
- Visitor and credential data held in access control systems that we integrate or steward on a client estate, always under that client instructions.
- Technical data from this website, such as the pages requested, the time of the request and general device or browser information needed to serve the site securely.
- Contract and billing data for clients, suppliers and professional partners.
We do not seek special category information such as health data, political opinions or religious beliefs, and we ask that you do not send such information to us through this website. If an estate system must handle sensitive data for a specific safety purpose, the handling is defined in the client contract with appropriate safeguards.
4. How We Collect Information
Most information reaches us directly from you. You may complete the contact form on this website, send an email, place a telephone call, or hand a business card to a surveyor during a site visit. We also receive information from client systems when we are engaged to integrate or steward them, and from suppliers and professional partners in the ordinary course of a project.
Our website collects a limited amount of technical data needed to operate safely, such as the address requested and the time of the request. We do not use tracking scripts for advertising, and we do not build behavioural profiles of visitors. Where a client estate transmits operational data to systems we manage, that data is collected by field devices and gateways inside the estate and forwarded to our integration platform under the client instructions.
We may also receive information indirectly where a client provides it about their staff, tenants, contractors or visitors so that credentials, notifications or reports can be configured. In that situation the client is responsible for giving the required notices and for having a lawful basis to share the information with us.
5. Why We Use Information
We use personal information for clear and limited purposes. The main purposes are to respond to enquiries, to prepare and deliver surveys and integration work, to operate and support the estate systems we steward, to keep our records accurate, to issue invoices and manage accounts, to protect the security of our own systems and client estates, and to comply with legal and regulatory obligations.
We also use information to improve our services, for example by reviewing how a fault was detected, how long a repair took, or how a report was received by an operator. Where we wish to use information for a new purpose that is not compatible with the purpose for which it was collected, we will explain the new purpose and, where the law requires it, ask for your consent before proceeding.
We do not sell personal information. We do not rent contact lists. We do not trade estate operational data for advertising. The practice exists to make buildings legible and reliable, not to turn the people inside them into a product.
6. Lawful Bases for Processing
Where the law requires us to identify a lawful basis, we rely on one or more of the following. We process information to perform a contract with you or to take steps at your request before entering a contract, for example when you engage us for a survey or a managed stewardship service. We process information for our legitimate interests in running a professional practice, provided those interests are not overridden by your rights.
We process information to comply with legal obligations, including tax, accounting and record keeping duties. We process information with your consent where consent is the appropriate basis, for example when you subscribe to a mailing list or agree to receive occasional practice updates. Where you have given consent you may withdraw it at any time, and withdrawal will not affect processing that already took place.
Where we act as a processor for a client estate, the client is responsible for establishing the lawful basis for the underlying processing, and we process the data only on the client documented instructions.
7. Estate Telemetry and Building Data
Estate telemetry is the operational heartbeat of a building. It includes readings such as temperature, pressure, flow, energy, vibration and equipment status, together with alarm events and maintenance acknowledgements. Telemetry usually describes plant and spaces rather than people, but it can become personal data where it is linked to an identifiable individual, for example a single engineer credential that acknowledges an alarm at a recorded time.
When we integrate telemetry, we follow data minimisation. We collect the points that the client needs to operate the estate and we avoid collecting unrelated signals. We apply clear naming and time synchronisation so that readings can be trusted, and we record a quality flag so that a calibrated value can be distinguished from an inferred one. Retention periods are set with the client, balancing the value of trend history against the principle of keeping data no longer than necessary.
Access to telemetry is role based. Operators see the estate they run, engineers see the points they maintain, and analysts see aggregated views where individual identifiers are not needed. Every access to an operational platform is logged so that the estate can be audited and so that misuse can be traced.
8. Access Control and Visitor Records
Access control systems record who enters a building, when and through which door. This information is inherently personal, because a credential belongs to a named person. When we integrate or steward access control for a client estate, we design the system so that the client retains control of the data, and we act only under the client instructions.
We recommend that clients set retention periods that match their security and legal needs, and that they give clear notices to staff, tenants, contractors and visitors about what is recorded. Where a visitor register is kept, we advise that it records only the fields that are genuinely necessary, and that it is protected against unauthorised reading. We do not use access records for marketing and we do not combine them with website data.
Audit trails produced by access systems are written so that they survive power loss and the replacement of a controller. We treat the integrity of these records as part of the security service, because an access log that can be altered without trace offers no protection to anyone.
9. Metering and Utility Data
Metering data shows how much electricity, water, gas, chilled water or waste a space consumes. At a building level this is not personal, but at the level of a single tenant or a small unit it can reveal occupancy patterns and working habits. For that reason we treat tenant level metering data with care, and we design dashboards so that a tenant sees its own consumption while an operator sees aggregated and plant level views.
We reconcile metered data against supplier invoices so that the estate accounts balance. This reconciliation may involve sharing consumption figures with the building owner, the managing agent and, where a tenant is billed directly, the tenant itself. We do not share one tenant data with another tenant, and we do not disclose metering data to third parties for purposes unrelated to the operation and billing of the estate.
Where a client asks us to retain a long history of metering data for energy reporting, we agree a retention period and a level of aggregation in advance, and we document the arrangement in the client contract.
10. Cookies and Similar Technologies
This website is built as a set of static pages and uses no advertising cookies and no third party tracking scripts. The site may rely on strictly necessary technical mechanisms that a web server needs in order to deliver a page securely and to remember a basic preference such as whether the mobile navigation panel is open during a single visit.
If we later introduce a feature that requires a cookie or a similar technology, we will describe the purpose, the duration and the choices available to you before the feature is used. You can also manage cookies through your browser settings, including blocking and deleting them, although blocking strictly necessary mechanisms may affect how the site behaves.
We do not use invisible tracking pixels, cross site identifiers or fingerprinting to follow visitors from this website to other services.
11. Sharing and Disclosure
We share personal information only where it is necessary and only with parties who are bound to protect it. Typical recipients include our own staff and surveyors, professional advisers such as accountants and lawyers, suppliers who provide hosting or integration components under contract, and the client on whose estate we are working. Each recipient receives only the information needed for its task.
We may disclose information where the law requires it, for example in response to a valid legal request, a court order or a regulatory requirement. We may also disclose information to protect the safety of people, the security of an estate or the rights of Commons Properties Limited, where there is a genuine and pressing need. Where a disclosure is not compelled by law and the situation allows, we will consider whether we can notify the affected client or individual.
If our business is restructured, merged or sold, information may be transferred as part of that transaction. We would require the receiving party to honour this policy, and we would give affected parties notice of any material change in how their information is handled.
12. International Transfers
Commons Properties Limited operates from Hong Kong and primarily stores information on infrastructure located in Hong Kong. Some service providers that support our website or integration platform may operate from other jurisdictions. Where information is transferred across a border, we take steps to ensure that it receives an adequate level of protection, using contractual commitments, access controls and encryption appropriate to the sensitivity of the data.
Where a client estate spans several territories, data may flow between the client own locations and our platform. In those projects we agree a transfer map with the client as part of the estate systems architecture, so that everyone knows where data rests and which rules apply to it.
13. Data Retention
We keep personal information only for as long as it is needed for the purpose for which it was collected, or for as long as the law requires. Enquiries that do not lead to an engagement are generally kept for a limited period and then deleted. Contract and billing records are kept for the period required by tax and accounting rules. Estate operational data is retained according to the schedule agreed with each client.
When a retention period ends, we delete the information or, where deletion is not immediately possible, we isolate it and prevent further use until it can be safely removed. Where we hold data as a processor for a client, the client retention schedule governs, and we return or delete the data at the end of the engagement as the contract directs.
14. Data Security
We protect personal information with administrative, technical and physical safeguards appropriate to its sensitivity. These include access controls based on role, encryption of data in transit, protected credentials, network segmentation between management and control traffic, logging of operational access, and regular review of system configurations.
Our field instruments and integration gateways are hardened for the estate environment. Controllers are patched on a schedule, default passwords are removed, unused services are disabled, and remote access is granted only where it is needed and only through a controlled path. We treat the security of an estate system as part of the service, not as an optional extra.
No system can be guaranteed to be free of risk. If we become aware of a security incident that affects personal information, we will investigate, take steps to contain the incident, and notify affected parties and the relevant authorities where the law requires it.
15. Your Rights and Choices
Depending on where you live, you may have rights over your personal information. These may include the right to access a copy of the information we hold about you, to correct information that is inaccurate, to request deletion where there is no continuing lawful reason to keep it, to restrict or object to certain processing, to receive information in a portable format, and to withdraw consent where consent is the basis for processing.
To exercise a right, write to contact@avyfertilizer.mom with enough detail for us to understand the request and to verify your identity. We will respond within the time required by applicable law and we will explain any reason why a request cannot be fully granted. You may also complain to the relevant supervisory authority in your jurisdiction.
Where we process information as a processor for a client estate, requests that concern the estate data of that client should be directed to the client as controller. We will assist the client in responding as our contract requires.
16. Privacy for Children
Our services are provided to businesses and estates, and this website is not directed at children. We do not knowingly collect personal information from children through this website. If you believe that a child has provided personal information to us, please contact us at contact@avyfertilizer.mom and we will take appropriate steps to remove it.
On estates, a childcare facility or a family facility may keep its own records. Those records belong to that operator, and our role, if any, is limited to the integration of building systems under the operator instructions and with safeguards suited to the sensitivity of the data.
17. Third Party Links and Services
This website may link to third party sites, for example a mapping service or a professional body. We do not control those sites and we are not responsible for their privacy practices. When you follow a link away from our site, we encourage you to read the privacy notice of the destination before providing personal information.
Client estates may use third party platforms that we integrate but do not own. Where a third party platform processes estate data, the terms of that provider apply alongside the client instructions and this policy, and we help the client understand the boundary between the systems we steward and those we do not.
18. Changes to This Policy
We review this Privacy Policy from time to time and we may update it to reflect changes in our practice, in technology or in the law. When we make a material change we will revise the effective date at the top of this page and, where the change is significant, we will provide a clearer notice on the website or by direct communication.
The current version of this policy is always the one published on this page. We encourage you to read it again when you begin a new engagement with the practice, so that you understand how your information will be handled at that time.
19. How to Contact Us
If you have a question about this Privacy Policy, or if you wish to exercise a right over your personal information, please contact Commons Properties Limited at the details below. We read every message and we keep a written record of privacy enquiries so that nothing is lost between hands.
- Company: Commons Properties Limited
- Address: Room 5, 30/F, W50, 50 Wong Chuk Hang Road, Wong Chuk Hang, Hong Kong (HK)
- Email: contact@avyfertilizer.mom
- Phone: +15313216284
This policy is published by Commons Properties Limited and was prepared with the assistance of the developer Commons Estates for the website of the practice. Thank you for taking the time to read it.