Privacy Policy

Scope and Our Role

This Privacy Policy explains how WLX Limited (“WLX”, “we”, “us”, or “our”) collects, uses, stores, shares, and protects personal data when you visit wlx.hk, create or use a customer account, order or use a service, communicate with us, or interact with our network and infrastructure operations.

WLX Limited is the data user or controller for personal data processed for our own account administration, billing, compliance, support, security, and business operations. For customer content processed only on a customer’s instructions through infrastructure services, the customer normally determines the purpose and means of processing and WLX acts as a processor or service provider, subject to the service and applicable law.

This Policy is designed around Hong Kong’s Personal Data (Privacy) Ordinance (“PDPO”). Additional rights or duties may apply depending on your location and the service. This Policy does not replace a separately signed data-processing agreement.

Personal Data We Collect

We collect only data reasonably related to providing, securing, supporting, and administering our services. Depending on your interaction with WLX, this may include:

1. account and contact data, such as name, company, role, username, email, telephone number, billing and service address, language, and account identifiers;
2. verification and compliance data, such as identity and business documents, beneficial ownership, tax information, source-of-funds information, network use case, sanctions or fraud-screening results, and responses to KYC or KYB checks;
3. order, billing, and payment data, such as services, invoices, transaction references, payment status, tax records, and correspondence; payment processors normally handle full card or payment-account credentials and WLX does not ordinarily store full card numbers;
4. network-resource and service data, such as IP addresses and prefixes, ASN, routing policy, LOA, ROA, IRR, RPKI, WHOIS or RDAP data, reverse DNS, ports, VLANs, traffic usage, power usage, equipment identifiers, facility access, and support history;
5. technical and security data, such as source IP, browser and device information, timestamps, account and API activity, authentication events, monitoring alerts, flow or traffic metadata, routing events, abuse reports, and diagnostic logs;
6. communications and submitted content, such as tickets, email, forms, call notes, screenshots, configuration files, logs, legal notices, and other material you choose to provide.

How We Obtain Data

We obtain personal data directly from you or your organization; automatically from the website, customer portal, authentication, monitoring, billing, and network systems; and from parties involved in delivering or protecting the service.

Those parties may include payment processors, banks, identity or fraud-verification providers, datacenters, carriers, upstream networks, RIRs, NIRs, LIR partners, registries, hardware and software providers, and security or DDoS-mitigation providers.

We may also obtain data from public or industry sources including WHOIS/RDAP, IRR, RPKI, BGP and routing databases, sanctions lists, corporate registries, abuse databases, and people who submit abuse, security, legal, or intellectual-property reports.

Purposes and Legal Grounds

We process personal data to:

1. create and secure accounts, verify customers, assess orders, and prevent fraud;
2. provision, operate, monitor, support, renew, modify, suspend, and terminate services;
3. coordinate IP addresses, ASN, LIR, BGP, routing, RPKI, IRR, reverse DNS, LOA, WHOIS, RDAP, colocation, and facility access;
4. issue invoices, process payments, administer taxes and refunds, and collect amounts due;
5. maintain network stability, capacity, security, routing integrity, abuse response, and service records;
6. communicate about service, maintenance, security, billing, policy, support, and permitted marketing;
7. comply with law, sanctions, court or authority requests, registry policy, supplier requirements, audit, and recordkeeping obligations;
8. improve our services, website, automation, support, and customer experience, and establish, exercise, or defend legal claims.

Depending on the law that applies, our grounds may include performing or preparing a contract, complying with legal duties, protecting network and business interests, preventing fraud or abuse, protecting vital interests, and consent where consent is required. Where we request information, we will indicate if it is mandatory and the practical consequence of not providing it, such as being unable to open an account or provide an IP or ASN service.

Website, Cookies, and Logs

Our website and customer portal use session cookies, tokens, local storage, and similar technologies needed for login, security, language preferences, shopping-cart and order functions, fraud prevention, and service operation. We may also use limited analytics or performance technologies to understand and improve the website.

You can control cookies through your browser. Blocking necessary cookies may prevent account, checkout, language, or security functions from working. Where applicable law requires consent for an optional technology, we will request it before use.

Web and security logs may record IP address, user agent, referrer, request, timestamp, session or account identifier, login event, and security result. We use them for authentication, troubleshooting, capacity, fraud and abuse prevention, system integrity, and legal compliance.

Service Data and Network Operations

Infrastructure operation necessarily generates service metadata such as assigned resources, traffic volume, flow information, routing events, availability, hardware health, power use, and security alerts. WLX uses this data to deliver service, measure usage, bill, troubleshoot, secure the network, and respond to incidents.

WLX does not routinely inspect the content of customer communications or files. We may access, capture, preserve, or disclose limited customer content or packet data where reasonably necessary to respond to your support request, investigate a security or abuse event, protect a network or person, or comply with law or a binding supplier or registry requirement.

You should not submit passwords, private keys, identity documents, or other sensitive information in a support ticket unless necessary and requested. Remove or mask unrelated data where possible.

Sharing and Public Registry Data

We disclose personal data only where reasonably necessary for the purposes in this Policy. Recipients may include WLX personnel and contractors; payment, banking, accounting, tax, verification, fraud, security, monitoring, and support providers; datacenters, carriers, upstreams, registries, RIRs, NIRs, LIR partners, hardware and software providers; professional advisers and insurers; and courts, regulators, law enforcement, or other parties where required or permitted by law.

IP and ASN services may require organization, contact, abuse, route, and resource data to be submitted to WHOIS/RDAP, IRR, RPKI, RIR, NIR, LIR, or other network registries. Some of this data is intentionally public or available to network operators. Before submission, you must ensure that you are authorized to provide the data and that designated contacts understand its publication.

We may disclose data in a merger, financing, reorganization, sale, or transfer of all or part of the relevant business, subject to appropriate confidentiality and lawful processing. WLX does not sell personal data for money or permit third parties to use it for their own direct marketing without the notice and consent required by law.

International Transfers

WLX is based in Hong Kong and serves customers internationally. Personal data may be processed in Hong Kong and in locations where customers, datacenters, carriers, registries, payment processors, security providers, and other suppliers operate.

Privacy laws and protections differ between locations. Where required by applicable law, WLX uses reasonable contractual, organizational, or technical safeguards for a cross-border transfer and limits the transfer to what is necessary for the stated purpose.

Retention and Deletion

We keep personal data only for as long as reasonably necessary for the purpose for which it was collected and for legitimate service, billing, tax, audit, security, abuse-prevention, dispute, and legal needs. Retention depends on the type of record, service lifecycle, risk, and legal or registry requirement.

1. account, contract, invoice, payment, tax, and corporate-verification records may be retained for the applicable statutory, accounting, audit, and dispute periods;
2. tickets and service records may be retained to maintain service history, prove instructions, resolve disputes, and protect security;
3. authentication, network, routing, and security logs are retained for periods appropriate to operations, troubleshooting, abuse response, and legal compliance;
4. registry, IP, ASN, routing, and public-record data may remain subject to the retention practices of the relevant registry or network database;
5. customer content may be deleted after cancellation, expiry, or termination in accordance with the service terms and should not be relied on as a backup.

We may retain limited records longer where required for an unpaid balance, legal hold, fraud or abuse history, security incident, regulatory duty, or legal claim. When data is no longer required, we take practicable steps to delete or anonymize it.

Security and Incidents

WLX uses reasonable technical and organizational measures designed to protect personal data, including access control, authentication, least-privilege administration, monitoring, network security, backup or redundancy appropriate to the relevant business system, and procedures for incident response.

No Internet service or storage method is completely secure. You are responsible for protecting account credentials, restricting users and API keys, securing your systems, applying patches, configuring services correctly, and maintaining independent backups.

If a personal-data incident occurs, WLX will investigate, contain, and document it and will notify affected customers, authorities, or other parties where required by applicable law or reasonably necessary to reduce harm.

Your Rights and Requests

Under the Hong Kong PDPO, an eligible data subject may request access to personal data held by WLX and correction of inaccurate data, subject to statutory procedures and exceptions. Depending on applicable law, you may also have rights to deletion, restriction, objection, portability, withdrawal of consent, or complaint to a privacy authority.

To make a request, email [email protected] with enough information to identify you, the relevant account or interaction, and the requested action. WLX may verify your identity and authority before responding. We may refuse or limit a request where permitted by law, including to protect another person, security, confidential information, legal privilege, billing, fraud prevention, or a legal obligation.

You may also contact the Office of the Privacy Commissioner for Personal Data, Hong Kong, regarding rights or concerns under the PDPO.

Marketing, Children, and External Sites

WLX may send service, security, billing, and legal messages necessary to administer your account. We will use personal data for direct marketing only after providing the notice and obtaining the consent or indication of no objection required by applicable law. You may opt out at any time without charge; opting out does not stop operational messages.

Services are intended for adults, businesses, and technical users and are not directed to children. We do not knowingly collect personal data from a child who cannot lawfully provide it. Contact us if you believe a child has provided data.

Our website or communications may link to registries, payment processors, social platforms, or other external services. Their privacy and security practices are governed by their own policies, not this Policy.

Customer Responsibilities

If you use WLX infrastructure to collect, store, route, or otherwise process personal data for your own users, employees, or customers, you are responsible for your compliance as data user or controller. This includes a lawful basis, appropriate notices, required consent, data-subject responses, retention rules, security, and cross-border transfer requirements.

You must not instruct WLX to process data unlawfully and must not use infrastructure services to store or transmit personal data that the applicable service, law, or security controls cannot appropriately support. Contact WLX before ordering if you require a data-processing agreement or have regulated-data requirements.

Changes and Contact

We may update this Policy to reflect legal, technical, security, registry, supplier, or service changes. The current version and effective date will be published on the website. Where practicable, we will notify account holders of a material change.

For a privacy question, request, or complaint, contact:

WLX Limited
Room 39, 3/F, 143 Wai Yip Street
Kwun Tong, Hong Kong
Email: [email protected]
Website: https://wlx.hk