Privacy Notice
International Metallurgical Resource Industry Association Limited 國際冶金資源工業協會有限公司
Operating through its registered branch: International Critical Minerals & Metals Association 國際關鍵礦產和金屬協會
Room 18, 2/F, TusPark, 118 Wai Yip Street, Kwun Tong, Kowloon, Hong Kong SAR Email: info@icmsm.org | Website: https://icmsm.org
Notice to readers: This Privacy Notice describes our actual data practices as of its effective date. One item remains unconfirmed: the execution status of a Data Processing Agreement with HubSpot, Inc. (§5.1). This notice should not be treated as a complete statement of legal compliance until that item is resolved. We recommend obtaining independent legal advice on compliance with the PDPO (Cap. 486).
1. Who We Are
International Metallurgical Resource Industry Association Limited (Company Registration No. 39850729-002-10-26-A), operating through its registered branch International Critical Minerals & Metals Association ("ICMSM Hub", "we", "us", "our"), is the data user responsible for personal data collected through this website and its associated services (collectively, the "Services").
We are subject to the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong SAR ("PDPO") in respect of personal data we collect, hold, process, and use.
2. Scope
This Privacy Notice applies to personal data collected through:
- The ICMSM Hub website at https://icmsm.org
- Membership application forms
- Conference and event registration forms
- The business matching and contact enquiry form
- Newsletter subscription forms
- The AI Intelligence Assistant feature
- Any correspondence you send to us by email or other means
3. Personal Data We Collect
3.1 Data You Provide Directly
| Context | Data collected | Required / Optional |
|---|---|---|
| Membership application | Full name, email address, country of residence, membership tier, commodity interests | Name, email, country, tier: required. Phone: optional |
| Conference registration | Full name, email address, organisation, job title, phone number, dietary/accessibility requirements | Name, email, organisation: required. Others: optional |
| Contact / business matching enquiry | First name, last name, email address, message | Name, email, message: required. Organisation, phone: optional |
| Newsletter subscription | Email address, first name | Email: required. First name: optional |
| AI Intelligence Assistant | Content of queries you submit | Provided voluntarily |
| General correspondence | Name, email address, and any information you include in your message | As provided |
3.2 Data Collected Automatically
When you use our Services, we and our service providers may collect:
- Device and network data: IP address, browser type and version, operating system, device identifiers
- Usage data: pages visited, session duration, referring URLs, search queries on the site
- Cookies and similar technologies: session cookies required for site functionality; analytics cookies where consent has been obtained
This website does not currently deploy third-party analytics or advertising cookies. Only session cookies required for site functionality (authentication, security) are set. No consent banner is required at this time. If analytics services are added in future, this notice will be updated and a consent mechanism implemented before any such cookies are set.
4. Purposes of Collection and Use
We collect and use personal data for the following purposes:
| Purpose | Data used |
|---|---|
| Processing membership applications and administering memberships | Name, email, country, tier, commodity interests |
| Registering and administering conference delegates | Name, email, organisation, job title, phone, dietary/accessibility data |
| Responding to business matching and general enquiries | Name, email, organisation, message |
| Sending newsletters and industry updates (where consent given) | Email address, first name |
| Operating the AI Intelligence Assistant | Query content; live commodity price and news data injected by the system |
| Maintaining CRM records of contacts and interactions | Name, email, organisation, application and registration history |
| Improving and securing the Services | Usage data, device data |
| Complying with legal obligations | As required by applicable law |
We collect and use personal data only for the purposes stated above or purposes directly related to them, in accordance with Data Protection Principle 3 of the PDPO.
5. Subprocessors and Third-Party Recipients
We share personal data with the following categories of recipients:
5.1 HubSpot, Inc. (CRM Platform)
Personal data submitted through our membership application, conference registration, contact, and newsletter forms is transmitted to and stored by HubSpot, Inc., which acts as a data processor on our behalf. HubSpot processes this data solely to provide CRM services to us.
HubSpot stores data on servers located in the United States (NA2 data centre). HubSpot, Inc. offers a standard Data Processing Agreement (DPA) at https://legal.hubspot.com/dpa. The execution status of a formal DPA between the Association and HubSpot has not yet been verified. Until execution is confirmed, data transfers to HubSpot are conducted on the basis of HubSpot's standard contractual commitments as published at that URL. This notice will be updated once DPA execution status is confirmed.
HubSpot's privacy information: https://legal.hubspot.com/privacy-policy
5.2 OpenAI, LLC (AI Processing)
Queries submitted to the AI Intelligence Assistant are processed by OpenAI, LLC via the OpenAI API. Query content is transmitted to OpenAI's servers for processing. We do not send personal data from your membership or registration records to OpenAI. You should not include sensitive personal data in queries to the AI Assistant.
OpenAI's privacy information: https://openai.com/policies/privacy-policy
5.3 Hosting Provider
This website is hosted on infrastructure provided by GoDaddy Inc.
This website is hosted on GoDaddy's Airo platform, which operates on infrastructure located in the United States.
5.4 Analytics and Advertising
This website does not currently use third-party analytics, advertising, or tracking services. No analytics cookies are set and no data is shared with advertising networks. If analytics services are introduced in future, this section will be updated prior to deployment.
5.5 Other Disclosures
We may also disclose personal data:
- To professional advisers (lawyers, accountants) under duties of confidentiality
- To regulatory authorities or law enforcement where required by applicable law or court order
- In connection with a merger, acquisition, or sale of assets, subject to confidentiality obligations
- With your consent, for any other purpose notified to you at the time of collection
We do not sell personal data to third parties.
6. Cross-Border Data Transfers
ICMSM Hub is operated from Hong Kong SAR. Our Services are accessible globally. When personal data is transferred to service providers located outside Hong Kong SAR, we take reasonable steps to ensure that such data is protected to a standard comparable to that required under the PDPO.
Personal data is transferred to the following jurisdictions outside Hong Kong SAR:
- United States — HubSpot, Inc. (CRM); OpenAI, LLC (AI processing); GoDaddy Inc. (hosting). These transfers are conducted on the basis of each provider's standard contractual commitments and data processing terms. We take reasonable steps to ensure that personal data transferred outside Hong Kong SAR is protected to a standard comparable to that required under the PDPO. [PENDING — confirm HubSpot DPA execution and update transfer mechanism description once signed.]
7. Data Retention
We retain personal data for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law.
| Data category | Retention period |
|---|---|
| Membership records | Duration of membership plus 3 years after membership ends |
| Conference delegate records | 2 years from the date of the event |
| General enquiry records | 2 years from the date of last substantive interaction |
| Newsletter subscriber records | Removed from active marketing use within 30 days of unsubscribe; suppression record retained indefinitely to prevent further mailings |
| Server logs | 90 days, subject to hosting provider capabilities |
Exceptions and longer retention: Financial records (invoices, payment records) are retained for 7 years in accordance with Hong Kong tax and accounting requirements under the Inland Revenue Ordinance (Cap. 112). Records subject to an active dispute, legal claim, or regulatory inquiry are retained until the matter is fully resolved. Where a longer statutory period applies, that period governs.
Deletion: When personal data is no longer required under the above periods, we will delete or anonymise it. Deletion of data held by third-party processors (including HubSpot) is subject to those processors' deletion capabilities and timescales.
When personal data is no longer required, we will delete or anonymise it in accordance with our data retention policy.
8. Security
We implement reasonable technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. These include encrypted transmission (HTTPS), access controls, and authentication requirements for administrative functions.
No information system can be guaranteed to be completely secure. If you believe that your interaction with us is no longer secure, please contact us immediately at info@icmsm.org.
9. Children
Our Services are directed at professionals and are not intended for use by individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected data from a minor, please contact us at info@icmsm.org and we will delete it promptly.
10. Your Rights Under the PDPO
Under the PDPO, you have the right to:
- Access personal data we hold about you (Data Access Request under section 18 of the PDPO)
- Correct any inaccurate personal data (Data Correction Request under section 22 of the PDPO)
- Be informed of the purposes for which your personal data is used
To exercise these rights, submit a written request to:
Privacy Officer International Critical Minerals & Metals Association Room 18, 2/F, TusPark, 118 Wai Yip Street Kwun Tong, Kowloon, Hong Kong SAR Email: info@icmsm.org
We will respond within 40 days as required by the PDPO. We may charge a reasonable fee for data access requests as permitted under the PDPO.
If you are not satisfied with our handling of your request, you may lodge a complaint with the Office of the Privacy Commissioner for Personal Data (PCPD): Website: https://www.pcpd.org.hk | Tel: +852 2827 2827
11. Governing Law
This Privacy Notice is governed by the laws of the Hong Kong Special Administrative Region of the People's Republic of China. Any dispute arising out of or in connection with this Privacy Notice shall be subject to the exclusive jurisdiction of the courts of Hong Kong SAR, subject to any mandatory jurisdiction provisions that cannot be excluded by agreement under applicable law.
12. Changes to This Privacy Notice
We will post any updates to this Privacy Notice on this page. The revised version will be effective when posted. If we make material changes, we will notify you by a prominent notice on our website or by email where we hold your contact details. We encourage you to review this Privacy Notice periodically.
13. Contact Us
International Critical Minerals & Metals Association (a registered branch of International Metallurgical Resource Industry Association Limited 國際冶金資源工業協會有限公司) Room 18, 2/F, TusPark, 118 Wai Yip Street Kwun Tong, Kowloon, Hong Kong SAR Email: info@icmsm.org Website: https://icmsm.org
This Privacy Notice was last reviewed on 31 October 2026. It is provided for information purposes and does not constitute legal advice. One item remains unconfirmed: HubSpot DPA execution status (§5.1). We recommend obtaining independent legal advice on compliance with the Personal Data (Privacy) Ordinance (Cap. 486).