Privacy Policy

RTG Global Sourcing Limited Last updated: 22 Oct 2026

1. Who we are

This Privacy Policy explains how RTG Global Sourcing Limited ("RTG Global", "RTG", "we", "us" or "our") collects, uses, shares and protects personal information. It covers our website, rtgglobal.com (the "Website"), our communications with you, payments you make to us, and our advisory and consulting engagements. RTG Global Sourcing Limited, a company incorporated in Hong Kong with limited liability (BR No. 50808305), is the controller (also called the "data user" or "personal information controller") of the personal information described here.

Contact: info@rtgglobal.com · Philippines · Hong Kong · Texas

2. Information we collect

Information you give us

• Contact form and email: your name, email address, company (optional) and your message, plus anything else you choose to send us. When you submit the contact form we also record the date and time of submission and the version of this Privacy Policy shown to you. Please do not include sensitive personal information in the form, such as health or medical details, financial account, tax or payment card details, government ID numbers, passwords, or information about children. If a message contains information like this, we may delete that part of it.
• Resource downloads: when you request a download from the Website, such as a checklist or template, we collect your name, email address, the resource you requested, whether you ticked the box to receive occasional resources and updates, the date and time of your request, and the version of this Privacy Policy shown to you.
• Client engagements: business contact details for you and your colleagues, and the information you share with us so we can deliver services. This may include documents about your vendors, operations, entities and controls. We ask clients not to send us sensitive personal information unless an engagement requires it.
• Billing: billing contact name, company, email address, billing address, invoice details and payment history.

Payment information processed by Airwallex

Card and other online payments to RTG are processed by our payment provider, Airwallex, through its secure payment links and hosted checkout pages. Airwallex collects your card or payment details directly. RTG does not receive or store your full card number or security code. We receive limited information from Airwallex, such as your name, email address, the amount, currency and date, payment status, a transaction reference and, in some cases, the card brand and last four digits. Airwallex's own privacy policy explains how Airwallex uses your information: https://www.airwallex.com/en-hk/terms/privacy-policy

Information collected automatically

When you visit the Website, our hosting provider records standard technical information, such as your IP address, browser type, device information, pages requested and timestamps, in server logs for security and to keep the site running. The Website loads fonts from Google Fonts, so your browser sends your IP address to Google when the page loads.

Site usage: when you visit, our hosting provider (Lovable) records basic page-view information, such as the page visited, load timings, your IP address and browser details, so we can see overall traffic. We don't use it to identify you.

3. How we use your information

We use personal information to:

• reply to inquiries and discuss possible engagements;
• deliver services, manage engagements and communicate with clients;
• send invoices, payment links and receipts, process payments and refunds, and keep accounting records;
• operate, secure and improve the Website, and prevent spam, fraud and abuse;
• meet legal, regulatory, tax and accounting obligations, and establish, exercise or defend legal claims; and
• send occasional relevant business updates to clients and contacts, where the law allows. You can opt out at any time.

Contact form enquiries. We use the details you submit through the contact form to reply to you, to discuss whether and how we can help, and to keep a record of our business enquiries so we can follow up and avoid duplicate contact. Our legal basis is taking steps at your request before entering into a contract and our legitimate interest in responding to and managing business enquiries. We do not add you to marketing emails because you sent an enquiry. We send business updates only to clients and contacts where the law allows, and you can opt out at any time.

Resource downloads. We use the details you give us when you request a download to deliver the resource, keep a record of your request and may send you one follow-up email about it. You can tell us at any time not to contact you. Our legal basis is our legitimate interest in sharing our resources and following up on requests for them. If you tick the box to receive occasional resources and updates, we will also send you those emails. Our legal basis for that is your consent, which you can withdraw at any time by unsubscribing. We do not add you to our mailing list unless you tick the box.

Legal bases. Where the law requires a legal basis, we rely on: performing a contract with you or taking steps at your request before one; our legitimate interests in running and growing an advisory business, where those interests are not overridden by your rights; compliance with legal obligations; and your consent, where we ask for it.

We do not sell personal information. We do not share it for cross-context behavioral advertising, and we do not use it for automated decision-making that has legal or similarly significant effects.

4. How we share information

We share personal information only as needed, with:

• Payment processors: Airwallex, to process payments, refunds and chargebacks, and for fraud prevention and its own regulatory compliance.
• Business software providers: these providers act on our instructions under data processing terms and do not use your information for their own purposes:
  • Lovable (website hosting) and Supabase (website database, hosted in the United States), which receive and store contact form submissions and download requests;
  • Resend (email delivery), which sends us an email alert containing your submission and, for contact form enquiries, sends you an automatic confirmation that we received it;
  • Notion (workspace software, hosted in the United States), where we keep our record of business enquiries, download requests and client follow-up; and
  • Google Workspace (email, documents and storage), which receives the email alert and holds a periodic backup copy of our enquiry records.
• Professional advisers and partners: lawyers, accountants, auditors and insurers. Where an engagement requires it, we also share information with third parties you ask us to deal with on your behalf, such as vendors, banks or corporate service providers.
• Authorities: where the law, a regulation, legal process or a government request requires it, or to protect our rights, our clients or others.
• Business transfers: in connection with a merger, acquisition or sale of all or part of our business, subject to appropriate confidentiality protections.

5. International transfers

We work across borders. Contact form submissions and our enquiry records are hosted in the United States. Our team may access them from the Philippines, the United States and other countries where we operate, and our service providers may process them in the countries where they operate. Data protection laws in those countries may differ from those where you live. Where the law requires it, including the EU and UK GDPR, we use appropriate safeguards for these transfers, such as the European Commission's Standard Contractual Clauses (and the UK Addendum) included in our service providers' data processing terms, and we stay responsible for personal information we transfer to them for processing. You can ask us for more information about these safeguards at info@rtgglobal.com.

6. How long we keep information

We keep personal information only as long as we need it for the purposes described in this policy:

• Contact form enquiries that do not lead to an engagement: up to 24 months after our last contact with you, in our website database, our enquiry records in Notion, the related email alerts and our backup copy. If an enquiry becomes an engagement, the client engagement period below applies.
• Resource download requests: up to 24 months after your request, in our website database, our enquiry records in Notion, the related email alerts and our backup copy. If you ticked the box to receive occasional resources and updates, we keep your name and email address for that purpose until you unsubscribe.
• Client engagement records: for the engagement and up to 5 years after it ends, unless the SOW says otherwise.
• Invoices, payment and accounting records: as long as tax and accounting laws require, usually 7 years.
• Server logs: for a short period set by our hosting provider.
• Backup copies: our periodic backup of enquiry records is replaced on each backup cycle, so deleted records drop out of it at the next backup.
• Deletion requests: when we delete your information at your request, we delete it from the website database, Notion, the email alert and our backup copy, except any record we must keep to show that we honoured your request or to meet a legal obligation.

When we no longer need it, we delete or anonymise personal information securely.

7. Security

We use reasonable organisational, physical and technical safeguards to protect personal information. These include encrypted (HTTPS) connections to the Website, access controls and multi-factor authentication on our business accounts, a limited number of people with access, and reputable service providers. Card payments are handled by Airwallex, which maintains PCI DSS compliance as a payment service provider. No method of transmission or storage is completely secure. If a personal data breach occurs, we will notify affected individuals and regulators where the law requires it.

8. Cookies and similar technologies

We don't use advertising cookies, and we don't track you across other websites. The site uses a few strictly necessary cookies and browser storage set by our hosting and security providers: a Cloudflare security cookie (__cf_bm, 30 minutes) that helps block automated traffic; a hosting cookie (__dpl, up to 24 hours) that keeps your visit on one consistent version of the site; and session storage that remembers your scroll position until you close the tab. Our host's built-in page-view analytics don't set their own cookie and don't collect your name or email. Airwallex checkout and payment-link pages may set their own cookies under Airwallex's policies. You can control cookies through your browser settings.

9. Your rights

Depending on where you live, you may have the right to:

• know what personal information we hold about you and how we use it, and get a copy;
• have inaccurate information corrected;
• have your information deleted, or its processing restricted or blocked;
• object to processing, including direct marketing, and withdraw consent at any time;
• receive your information in a portable format; and
• complain to a data protection authority.

California and other U.S. state residents. Where the California Consumer Privacy Act (as amended by the CPRA) or a similar state law applies, you have the right to know which categories and specific pieces of personal information we collect, use and disclose, and to request deletion and correction. You also have the right to opt out of the "sale" or "sharing" of personal information, but we do not sell or share personal information as those terms are defined. We will not discriminate against you for exercising your rights. You may use an authorised agent, and we may need to verify your identity before we act on a request. In the past 12 months we have collected these categories: identifiers (name, email address, IP address); commercial information (invoices and payment records); professional information (company and role); the content of messages you send us; and internet activity (server logs). We collected them from you, from your devices and from Airwallex, for the purposes in section 3, and disclosed them to the recipients in section 4.

Philippines (Data Privacy Act of 2012). If the Data Privacy Act of 2012 (Republic Act No. 10173) applies to your personal information, you have the following rights as a data subject: to be informed; to access; to object; to erasure or blocking; to rectification; to data portability; to damages; and to file a complaint with the National Privacy Commission (privacy.gov.ph). You can contact our Data Protection Officer at info@rtgglobal.com.

Hong Kong (Personal Data (Privacy) Ordinance). Because RTG Global Sourcing Limited is incorporated in Hong Kong, we handle personal data in line with the Personal Data (Privacy) Ordinance (Cap. 486). You have the right to request access to and correction of your personal data, and to ask us to stop using it for direct marketing. You may complain to the Office of the Privacy Commissioner for Personal Data (pcpd.org.hk). We may charge a reasonable, non-excessive fee for a data access request where the Ordinance allows.

European Economic Area, United Kingdom and Switzerland (GDPR). If the EU General Data Protection Regulation, the UK GDPR or the Swiss Federal Act on Data Protection applies to our processing of your personal information, RTG Global Sourcing Limited is the controller and the legal bases in section 3 apply. You have the rights listed above, including access, rectification, erasure, restriction, portability and objection (including an absolute right to object to direct marketing). Where we rely on consent you may withdraw it at any time without affecting earlier processing. You may also complain to the data protection authority where you live or work, or where you think an infringement occurred. We do not make decisions about you based solely on automated processing.

How to make a request. Email info@rtgglobal.com with the subject "Privacy request" and tell us what you would like us to do: access, correct or delete your information, or stop contacting you. We may need to confirm your identity before we act, usually by replying to the email address we hold for you. We will respond within the time the applicable law requires, normally within one month (30 days under some laws), and we will tell you if we need more time where the law allows. Requests are free unless the law allows a reasonable fee for excessive or repeated requests.

10. Children

The Website and our services are meant for businesses. They are not directed to children, and we do not knowingly collect personal information from anyone under 18.

11. Third-party links

The Website and our payment pages may link to third-party sites, including Airwallex. We are not responsible for their privacy practices, so please read their policies.

12. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date shows when it last changed. If we make material changes, we will take reasonable steps to tell you.

13. Contact us

RTG Global Sourcing Limited (a company incorporated in Hong Kong with limited liability, BR No. 50808305) Email: info@rtgglobal.com Website: https://rtgglobal.com Philippines · Hong Kong · Texas