Effective date: 4 September 2026
Version: 2.0
The short version
We’re a WordPress maintenance company. We hold two very different kinds of personal data, and they’re governed by different rules:
- Data about you — because you visited our website, emailed us, or bought a care plan. We decide what to do with that, so the law calls us the controller. This policy covers it.
- Data on your website — your customers’ names, orders, form submissions. That’s yours. We only touch it to do the job you’re paying us for, and the law calls us the processor. Our Data Processing Addendum covers it, not this policy — email privacy@upthinkisgood.com for a copy.
We don’t sell personal data. We never have.
1. Who we are
WP Geeks is a service of UpThink Limited, a limited company incorporated in Hong Kong (company number 2226128), registered office Flat/Rm A-C, 25/F, Seabright Plaza, 9-23 Shell Street, North Point, Hong Kong.
We’re the controller of the personal data described in this policy.
Privacy questions, or a request about your data: privacy@upthinkisgood.com, or write to us at Flat/Rm A-C, 25/F, Seabright Plaza, 9-23 Shell Street, North Point, Hong Kong.
We haven’t appointed a Data Protection Officer, because we’re not required to. privacy@upthinkisgood.com reaches the person responsible.
2. What we collect, why, and on what legal basis
| What we collect | Where it comes from | Why | Legal basis (EU/UK GDPR) |
|---|---|---|---|
| Name, email, phone, company, message | You, via our contact form, email, or a booking link | To answer you and quote for work | Legitimate interests — responding to an enquiry |
| Billing name, address, email, payment method | You, at checkout, via Stripe | To take payment, invoice you, and keep tax records | Performance of a contract; legal obligation |
| Account details, plan, website addresses, credentials to your systems | You, when you subscribe | To deliver your plan | Performance of a contract |
| Support tickets and correspondence | You | To handle your requests and keep a record of what we did | Performance of a contract; legitimate interests |
| Consent records for automatic renewal — the terms shown, the box you ticked, the date, time and IP address | Our checkout | Because US subscription law requires us to prove you consented | Legal obligation; legitimate interests |
| Website analytics, IP address, pages viewed, device and browser | Cookies and similar technology on wpgeeks.co | To understand how the site is used | Consent, where required; otherwise legitimate interests |
| Marketing email — your address, whether you opened and clicked | You, when you subscribe | To send you things you asked for | Consent |
| Business contact details of prospects | Public sources and data providers, for our outreach | To introduce our services to businesses that may want them | Legitimate interests |
We don’t collect special category data — health, race, religion, politics, sexual orientation, biometrics, trade union membership — and we ask you not to send it.
Children. Our services are for businesses. We don’t knowingly collect data about anyone under 16.
3. Who we share it with
We share personal data with the suppliers we need to run the business. Email privacy@upthinkisgood.com and we’ll send you the current list, with what each supplier does and where it processes data.
We also share data:
- With professional advisers — accountants, lawyers, insurers — under a duty of confidence.
- Where the law requires it, or to establish or defend a legal claim.
- With a buyer, if we ever sell the business, under confidentiality.
We do not sell personal data, share it for cross-context behavioural advertising, or rent our list.
4. Where your data goes
We’re in Hong Kong, our people work from Thailand, and our suppliers are mostly in the United States and Europe. So your data crosses borders.
If you’re in the EU, EEA, UK or Switzerland: Hong Kong has no adequacy decision. Where we transfer your personal data out of your region, we rely on the European Commission’s Standard Contractual Clauses, and the UK’s International Data Transfer Addendum for UK data, with a transfer impact assessment. Ask us at privacy@upthinkisgood.com for a copy.
5. How long we keep it
| Data | Kept for |
|---|---|
| Enquiries that don’t become clients | 24 months from last contact |
| Client account and support records | The life of the account, then 24 months |
| Credentials to your systems | Deleted within 30 days of your plan ending |
| Backups of your website | 30 days after your plan ends |
| Invoices, payments and tax records | 7 years, because we have to |
| Auto-renewal consent records | 3 years, or 1 year after the subscription ends, whichever is longer — because California law requires it |
| Marketing subscribers | Until you unsubscribe, then a suppression record so we don’t email you again |
| Website analytics | 14 months |
6. Your rights
Depending on where you live, you can ask us to:
- Tell you what we hold about you and why.
- Give you a copy, in a portable format.
- Correct anything wrong.
- Delete it, where we don’t need it.
- Restrict or object to how we use it, including for direct marketing — an objection to marketing is always honoured.
- Withdraw consent you gave, without affecting what we did before.
- Not be discriminated against for exercising any of these rights. Under the California Consumer Privacy Act we won’t deny you service, charge you a different price, or give you a lower quality of service.
How to ask: email privacy@upthinkisgood.com. We’ll reply within 30 days — 45 days in California, extendable once where the law allows. We may need to verify who you are before we act.
If you’re unhappy with our answer, tell us first. You can also complain to a regulator: the Hong Kong Privacy Commissioner for Personal Data, the UK Information Commissioner, your EU or EEA supervisory authority, or your US state Attorney General.
Authorised agents. In California you can use an authorised agent. We’ll ask for written proof of their authority.
Requests about data on a client’s website — an order, an account, a form submission — should go to the website’s owner, not to us. If you send one to us we’ll pass it on and tell you we’ve done so.
7. Cookies
wpgeeks.co uses cookies and similar technology for three things: keeping the site working, remembering your preferences, and understanding how the site is used.
- Strictly necessary cookies — login, security, form submission. These don’t need consent.
- Preference cookies — remember choices you made.
- Analytics cookies — tell us which pages people read.
If you’re in the EU, EEA or UK, we ask for your consent before setting anything other than strictly necessary cookies, and rejecting is as easy as accepting. You can change your choice at any time from the cookie settings link in our footer.
You can also block or delete cookies in your browser, though parts of the site may stop working.
8. How we protect it
We use named individual accounts, two-factor authentication, a password manager, encrypted connections, encrypted device storage, and access limited to what each person’s job needs. Full detail is in our Access and Credential Security Policy, available on request.
No system is perfectly secure, and we don’t claim ours is. If a breach affects your personal data and the law requires it, we’ll tell you and the relevant regulator without undue delay.
9. Marketing and outreach
If you subscribed to our list, we’ll email you until you unsubscribe. Every email has an unsubscribe link and our postal address.
If we contacted you cold, we found your business contact details from a public source or a business data provider, because we thought our WordPress services might be useful to you. Every message tells you who we are, gives our postal address, and offers a one-click way to stop. Reply “stop” and we’ll add you to our suppression list and never contact you again.
You can ask us where we got your details, and we’ll tell you.
10. Changes to this policy
We’ll update this page when things change, and change the effective date at the top. If a change materially affects how we use your data, we’ll email clients and subscribers at least 30 days beforehand.
11. Contact
Email: privacy@upthinkisgood.com
Post: UpThink Limited, Flat/Rm A-C, 25/F, Seabright Plaza, 9-23 Shell Street, North Point, Hong Kong
WP Geeks is a service of UpThink Limited, a limited company incorporated in Hong Kong. Company number 2226128.
Appendix — Hong Kong Personal Information Collection Statement
Required by Data Protection Principle 1 of the Personal Data (Privacy) Ordinance (Cap. 486).
Purpose of collection. We collect your personal data to respond to your enquiry, provide and administer our services, take payment, meet our legal and tax obligations, and — with your consent — send you marketing.
Consequences of not supplying it. You don’t have to give us your data, but without it we can’t answer your enquiry or provide the service.
Classes of transferees. Our service providers, listed on request; our professional advisers; and regulators or courts where the law requires.
Use in direct marketing. We will not use your personal data in direct marketing without your consent. You may withdraw that consent at any time, free of charge, by emailing privacy@upthinkisgood.com.
Access and correction. You may request access to, or correction of, your personal data by writing to privacy@upthinkisgood.com or to our registered office. We may charge a reasonable fee for complying with a data access request, as the Ordinance permits.