Privacy policy

1. Controller and scope

WE OPERA STUDIO HOLDING LIMITED (Hong Kong registration number 69478541) is the data user/controller for www.weoperastudio.com.

Room 305, 3/F Wing Tuck Comm Ctr, No. 177 Wing Lok Street, Sheung Wan, Hong Kong
Privacy inquiries and data requests: info@weoperastudio.com

This policy addresses applicable requirements of Hong Kong’s Personal Data (Privacy) Ordinance (Cap. 486). GDPR requirements also apply to processing within its material and territorial scope. Cookies and device access are separately subject to applicable ePrivacy rules, including Article 122 of the Italian Personal Data Protection Code.

2. Data we collect

• Inquiries: name, email, message, selected inquiry type, optional subject, submission time and handling status; also contact details and contents of direct emails.
• Operation and security: hosting may process IP addresses, browser data, requested pages, times and error logs to deliver and protect the site. The contact form itself does not add IP addresses or browser fingerprints to message records. A security session validates the form and limits repeated submissions.
• Optional video: after permission, YouTube can receive IP, device/browser data, site origin and playback interactions, and may use cookies or device storage. This site saves only your video choice, time, expiry and policy version in your browser, without creating a visitor identifier.

We do not run standalone visitor analytics, advertising pixels, remarketing, visitor fingerprinting or automated decisions with legal or similarly significant effects. Messages are not sold, used for advertising or automatically sent to collaborators.

3. Collection notice: contact form

Using the form is voluntary. Name, valid email and message are required; without them the form cannot be submitted and we may be unable to respond. Subject and inquiry type are optional; the default type is general inquiry. Send only relevant data, without passwords, identity documents, payment or health data, other unnecessary sensitive information, or another person’s data without authority.

Data is used only to answer and follow up that inquiry. Necessary recipients are company staff handling the response, providers instructed to support the site or correspondence, and bodies lawfully entitled to the data. Request access or correction at the privacy email above. Submission is not a marketing subscription or consent to all cookies or overseas transfers.

4. Grounds and purpose limits

Where GDPR applies: steps before a contract requested by you, such as quotations or production engagements, use Article 6(1)(b); general or organisation-representative inquiries and website security use legitimate interests under Article 6(1)(f), subject to balancing your rights; mandatory legal duties use Article 6(1)(c); optional YouTube loading uses consent under Article 6(1)(a) and applicable ePrivacy rules. Necessary technical storage does not depend on video consent.

An inquiry does not trigger unsolicited promotions. Future marketing, tracking or incompatible purposes require separate information and, where required, separate consent. Updating this policy cannot replace consent.

5. Providers and external links

Hosting is supplied by the Italian provider Aruba. Authorised maintenance and correspondence providers may process data as needed for their tasks. Law, lawful orders or necessary legal proceedings may require disclosure to authorities, courts or legal advisers. Listed partner institutions, artists and theatres do not receive messages merely because they are listed.

YouTube is an external Google service; relevant EEA and Swiss services are generally provided by Google Ireland Limited, with other regional entities identified in Google’s policy. Privacy-enhanced mode does not mean anonymous or data-free playback. YouTube, ticketing and other external sites apply their own policies when you visit them.

Aruba · GDPR · Google · Privacy · Cookie & video policy

6. Retention

Inquiry data is kept for the response and necessary follow-up. Our management rule is periodic review and deletion or anonymisation of unnecessary general inquiries within 12 months after closure; this requires a company process, not an automatic form-deletion feature. For ongoing engagements, legal retention duties or actual disputes, only necessary data may remain until that purpose or period ends, then be deleted or anonymised.

The contact cookie lasts for a session; video choices last up to 182 days. Hosting security logs and backups follow actual provider settings and applicable duties, potentially with different cycles; specific periods remain to be verified. Contact us about retention relevant to your data.

7. International processing

Our company is in Hong Kong and the host is in Italy. Responding may involve company staff accessing website or correspondence data from Hong Kong; after video permission, Google may process data elsewhere under its policy. Laws and government-access regimes may differ in other jurisdictions.

Transfers subject to GDPR Chapter V require an applicable lawful mechanism and safeguards, such as a valid adequacy decision or applicable standard contractual clauses and assessment. Specific company-provider processing and transfer agreements remain to be verified; this policy does not claim they are signed or all transfers certified. Ask our privacy contact for relevant arrangements or copies of applicable safeguards. Browsing, messaging or allowing video is not blanket consent to all overseas transfers.

8. Your rights and requests

Hong Kong law provides access and correction rights; you may also ask us to review deletion of unnecessary data. Where GDPR applies, its conditions also provide erasure, restriction, portability and objection to legitimate-interest processing. Portability covers data you provided, processed automatically on consent or contract grounds.

Withdraw video consent at any time through “Cookie & video settings” in every footer, as directly as granting it; withdraw other consent by email. Withdrawal does not affect earlier lawful processing. Refusing video does not affect reading or inquiries.

Email info@weoperastudio.com with “Privacy request”, the right and enough information to locate the correspondence. We seek proportionate identity verification only if needed; do not send full identity documents unsolicited. Hong Kong access/correction requests follow statutory limits, normally 40 days. GDPR requests normally receive a response within one month; complex or numerous requests may be extended by two further months where permitted, with reasons within the first month. Requests are generally free; reasonable Hong Kong access fees or GDPR exceptions will be explained first. Any inability to comply fully will be explained with available remedies.

9. Complaints

You may complain directly to the Hong Kong Privacy Commissioner for Personal Data without first complaining to us. Where GDPR applies, you may also complain to an EU supervisory authority in your habitual residence, workplace or place of alleged infringement, including Italy’s Garante.

PCPD · Hong Kong
Garante per la protezione dei dati personali

10. Security, minors and updates

HTTPS, protected data directories, form validation and anti-abuse measures reduce unauthorised access risks; no networked system is risk-free. Incidents require assessment, remediation and legally required notifications. This site is not specifically directed at children; a parent, guardian or authorised institutional representative should handle minors’ education or performance inquiries, avoiding sensitive child data.

We update the policy for feature or legal changes, giving appropriate notice of material changes and seeking separate consent where needed. Statutory rights are not limited. All three language versions describe the same arrangements; contact us about questions or translation differences.