Privacy

Updated 25 October 2026

Who we are

Morency & Co. is a company incorporated in Hong Kong. Its registered address is 728 King's Rd, Tsat Tsz Mui, Hong Kong Island, Hong Kong.

Morency & Co. is responsible for the personal data described in this notice. Our data protection and information officer is Wilkins Morency. You can contact him at privacy@morencyandco.com.

This notice explains how we collect, use, share, store and protect personal data when you visit our website, request an introduction, use our secure client environment, complete identity verification, communicate with us or otherwise use our services.

Information we collect

When you request an introduction, we collect:

• your full name, telephone number and email address;
• the password used to create your profile;
• your answers to questions about your mandate;
• information needed to arrange and conduct a video call; and
• your communications with us.

When you use the secure client environment, we collect:

• your identity, profile and account details;
• documents and information that you submit;
• your assigned role and access permissions;
• authentication and multi-factor authentication information;
• records of instructions, approvals and other activity; and
• security logs and an attributable audit trail.

For identity verification, we collect:

• a photograph of your identity document;
• a selfie and liveness frames;
• proof of address; and
• the results and records of verification checks.

We use our identity verification service for Morency & Co. customers and to verify customers of MUZA Capital, a service operated by Morency & Co.

For sanctions and politically exposed person screening, we use identity information and public sanctions data. We record relevant screening results and any review undertaken by our staff.

We also collect technical information needed to provide and protect the website and secure client environment. This may include session information, sign-in records, device and browser information, IP address, and security-event data.

How we obtain information

We obtain personal data:

• directly from you;
• from people acting for you;
• through your use of our website and secure client environment;
• from identity documents and evidence you provide;
• from public sanctions and politically exposed person information; and
• from MUZA Capital when we verify one of its customers.

If you give us information about another person, you should have authority to do so and should direct that person to this notice.

Why we use personal data

We use personal data to:

• respond to enquiries and arrange introductions;
• create and administer profiles and client access;
• assess mandates, eligibility and service availability;
• verify identity and address;
• conduct sanctions and politically exposed person screening;
• provide and operate the secure client environment;
• apply role-based access and approval controls;
• carry out instructions and maintain accurate records;
• protect clients, services and systems against misuse, fraud and security threats;
• comply with legal and regulatory obligations;
• establish, exercise or defend legal rights;
• communicate about the relationship and provide service notices;
• send an introductory email series after an enquiry;
• send newsletters after onboarding, where permitted; and
• improve our services, controls and customer communications.

Some requested information is necessary to create a profile, verify identity, assess eligibility, comply with legal obligations or provide a requested service. If you do not provide it, we may be unable to proceed with an introduction, give you access or provide the relevant service. Other information is voluntary, and we will indicate this where appropriate.

European legal bases

Where the EU GDPR or UK GDPR applies, we process personal data because:

• it is necessary to take steps at your request or perform a contract with you;
• it is necessary to comply with a legal obligation;
• it is necessary for our legitimate interests or those of another person, including providing and securing services, maintaining records, preventing fraud and managing our business;
• you have given consent, where consent is required; or
• it is necessary to establish, exercise or defend legal claims.

Where we rely on legitimate interests, we consider the effect on your rights and interests. You may contact us for more information about that assessment.

Artificial intelligence

We use artificial intelligence tools to assist staff with their work. These tools include GLM models accessed through OpenRouter in the United States.

Personal data may be processed through these tools when appropriate for the relevant work. Staff remain responsible for reviewing the output. Artificial intelligence does not make final decisions about clients.

Marketing

We use our own email marketing system for introductory emails and newsletters. We do not sell personal data or send enquiry details to third-party analytics services.

You may unsubscribe from marketing emails at any time by using the unsubscribe method in the message or by contacting privacy@morencyandco.com. Unsubscribing from marketing will not stop service or security communications.

Where applicable law requires consent for direct marketing, we will seek that consent before using your personal data for that purpose.

Cookies

We use only cookies that are strictly necessary to operate and protect the website and secure client environment. These include session, cross-site request forgery protection and sign-in cookies.

We do not use advertising or analytics cookies.

Who receives personal data

We disclose personal data only where relevant to the purpose for which it is held. Recipients may include:

• staff and authorised users whose roles require access;
• MUZA Capital in connection with identity verification for its customers;
• providers that host or support our technology and communications;
• OpenRouter and the providers involved in supplying the GLM models used by our staff;
• licensed partner institutions providing payment, custody or other regulated services under their own terms;
• professional advisers, auditors and insurers;
• courts, regulators, law-enforcement bodies and public authorities where disclosure is required or permitted by law; and
• parties involved in a proposed or completed reorganisation, financing or transfer of a business or service, subject to appropriate confidentiality protections.

Access within the secure client environment is limited according to assigned roles. Sensitive actions are governed by policy and recorded in an attributable audit trail.

International transfers

Morency & Co. is based in Hong Kong. Its servers are rented from Contabo in Germany. Its artificial intelligence tools include GLM models accessed through OpenRouter in the United States.

Your personal data may therefore be processed in Hong Kong, Germany, the United States and other places where an authorised recipient operates. Data-protection laws in those places may differ from those in your location.

Where the EU GDPR or UK GDPR applies, we use a legally recognised transfer mechanism and supplementary protections where required. You may contact privacy@morencyandco.com for information about the safeguards relevant to your data.

Retention

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected and for applicable legal, regulatory, security, accounting and dispute-management requirements.

Retention periods depend on the type of record, the service involved, the sensitivity of the information, legal requirements and the need to establish or defend legal rights. We delete or securely dispose of personal data when it is no longer required.

Security

We use measures designed to protect personal data against unauthorised or accidental access, processing, erasure, loss or use. These measures include multi-factor authentication, role-based access, policy controls for sensitive actions and attributable audit records.

No internet or storage system can be guaranteed to be completely secure. You should protect your credentials and notify us promptly if you believe your profile or account has been compromised.

Your rights

Hong Kong data-protection law may give you rights to request access to and correction of your personal data. We may ask for information needed to verify your identity and may handle the request in accordance with applicable law.

Depending on where you live and which law applies, you may also have rights to:

• receive information about our processing;
• request deletion of personal data;
• restrict or object to processing;
• withdraw consent without affecting earlier lawful processing;
• receive certain data in a portable form;
• object to direct marketing; and
• complain to a data-protection authority.

These rights are subject to legal conditions and exceptions. We may retain information where the law permits or requires us to do so.

To exercise a right, contact privacy@morencyandco.com.

Complaints

Please send privacy questions or complaints to Wilkins Morency at privacy@morencyandco.com.

You may also complain to the Office of the Privacy Commissioner for Personal Data in Hong Kong. If the EU GDPR or UK GDPR applies, you may complain to the data-protection authority in the country where you live or work or where you believe an infringement occurred.

Changes to this notice

We may update this notice when our services, practices or legal obligations change. The date at the top shows when it was last updated.