Privacy Policy

1. Introduction

Foundry Lex ("we", "us", "our") is committed to protecting the personal data of individuals who interact with our mentorship programme and website. This policy explains what data we collect, why we collect it, how it is used, and what rights you have over it.

This policy applies to data collected through our website at foundryl.pro, our application process, and the administration of our mentorship engagements.

Questions about this policy may be directed to [email protected].

2. Data We Collect

We collect personal data in the following ways:

• Contact form submissions: name, email address, phone number (optional), and message content.
• Programme applications: professional background, company information, and the question a founder brings to the application.
• Working session administration: session notes, written correspondence between sessions, and the closing reflection memo produced at the end of a one-to-one engagement.
• Website analytics: anonymised usage data through cookies, subject to your consent preferences.

Legal basis for processing: We process personal data on the basis of (a) your consent where given, (b) the performance of a contract for programme participants, and (c) our legitimate interests in administering the programme and maintaining the quality of our services.

Retention: Contact enquiry data is held for 12 months. Programme participant data is held for 36 months following the close of an engagement. Anonymous feedback and programme statistics are held indefinitely.

3. How We Use Your Data

• Responding to enquiries submitted through our contact form.
• Administering engagements — scheduling sessions, producing written notes, and coordinating mentor pairings.
• Improving the programme based on aggregated and anonymised feedback.
• Communicating about future programme cycles where you have consented to receive such communications.

We do not sell personal data to third parties. We do not share founder information with mentors beyond what is required to administer the specific engagement.

Where third-party service providers process data on our behalf (for example, email delivery services), they are required to handle data in accordance with our instructions and applicable data protection law.

4. Data Protection Measures

• Encryption: Data transmitted through our website is encrypted using TLS/SSL.
• Access controls: Access to personal data is restricted to programme staff with a direct operational need.
• Storage: Data is held on servers located within jurisdictions with adequate data protection frameworks.
• Breach response: In the event of a data breach affecting your personal data, we will notify you within 72 hours where required by applicable law.

5. Cookies

Our website uses cookies for essential functionality, analytics (where consented), and preference retention. You can manage your cookie preferences at any time. For a full explanation of the cookies we use, see our Cookie Policy.

6. Your Rights

Under the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong, you have the following rights in respect of your personal data:

• Right of access: You may request a copy of the personal data we hold about you.
• Right of correction: You may request that inaccurate data be corrected.
• Right to object: You may object to the processing of your data for direct marketing purposes.
• Right to erasure: In certain circumstances you may request deletion of your personal data.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at [email protected]. We will respond within 40 days as required under the Ordinance. If you are dissatisfied with our response, you may lodge a complaint with the Office of the Privacy Commissioner for Personal Data (PCPD) at www.pcpd.org.hk.

7. Third-Party Links

Our website may contain links to external sites. We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies independently.

8. Children's Privacy

Our programme is directed at founding team members of business-stage companies. We do not knowingly collect personal data from individuals under the age of 18. If you believe a minor has provided personal data through our website, please contact us at [email protected].

9. Policy Updates

We may update this policy from time to time. When material changes are made, we will notify programme participants by email and update the "Last updated" date at the top of this page. Continued use of the website following a policy update constitutes acceptance of the revised terms.