Privacy Policy

1. Who this policy covers

• Website visitors — people browsing bluepointads.com or submitting a contact / partnership form.
• Business partners — advertisers, publishers, agencies, affiliates, and developers working with our desk.
• Operator users — authenticated users of any BluePoint console or workspace we provide.

End users who see or click ads on publisher inventory are generally processed under the publisher’s and/or advertiser’s privacy notices, together with any measurement partner (for example an MMP) named in the campaign brief. BluePoint Ads processes campaign technical signals only as needed to deliver, measure, and quality-review the scoped engagement.

2. Data controller

3. What we collect

We do not intentionally collect special-category data, and we do not sell personal data for unrelated third-party advertising.

4. Why we process it

• Operate and secure the website and any authenticated console.
• Respond to sales, partnership, and support enquiries.
• Scope, launch, measure, and quality-review performance campaigns under written briefs.
• Detect bots, invalid traffic, duplicate events, and other abuse patterns.
• Meet accounting, tax, dispute, and regulatory record-keeping duties.

As a Hong Kong company we operate under the Personal Data (Privacy) Ordinance and applicable contractual duties. Where partners process EU/UK personal data in their own campaigns, they remain responsible for their lawful basis and notices; BluePoint Ads processes only what the brief and integration require.

5. Sharing & processors

• Measurement partners named by the advertiser (for example MMPs) receive attribution signals the brief defines.
• Infrastructure vendors that host email, DNS, or application servers under confidentiality and security controls.
• Professional advisers (legal, accounting) when required for a dispute or compliance matter.
• Authorities when we are legally compelled to disclose.

Data may be processed in Hong Kong and in other regions where our infrastructure or a named measurement partner operates. International transfers are limited to what is necessary for the service you requested.

6. Retention

• Website contact enquiries — up to 24 months after last meaningful correspondence.
• Security and access logs — typically 90–180 days, longer if investigating an incident.
• Campaign operational records — for the life of the engagement plus up to 24 months, or longer if required by contract, tax, or dispute.
• Console account data — until the account is closed and deletion is completed under the Data deletion workflow.

7. Security

We apply role-based access, encrypted transport (HTTPS), least-privilege operator accounts, and monitoring for abusive traffic. No method of transmission or storage is perfectly secure; report suspected incidents to [email protected].

8. Your rights

Subject to applicable law and contractual retention, you may request access, correction, deletion, or restriction of personal data we hold about you.

• Email [email protected] with enough detail for us to locate your records.
• Use the Data deletion page for workspace-scoped deletion requests.
• We may need to verify identity before acting on a request.
• Eligible requests are typically completed within 30 calendar days.

9. Children

Our website and partner services are directed to businesses, not to children. We do not knowingly collect personal data from anyone under 16. If you believe a child has submitted data to us, contact the DPO mailbox and we will delete it where required.

10. Changes

We may update this policy when our products, vendors, or legal duties change. The “Last updated” date at the top will change when we publish a revision. Material changes affecting partners will also be communicated through the desk contact on file where practical.