The site that learns least, protects most.

The controller of personal data processed through this website is Goldlink Capital Ltd, trading as BakLok Advisors ("BakLok", "we", "the practice"), formed in Hong Kong and headquartered in Chongqing, China.

Questions, requests, or complaints about privacy may be sent to the founder personally: ptk@bak-lok.com, or by telephone at +852 6847 6261. There is no privacy mailbox queue; the person who runs the practice reads the correspondence.

By browsing this site, no personal data is collected by us. Specifically, this website:

• sets no cookies of its own (see the Cookie statement for the one conditional exception);
• runs no analytics — no Google Analytics, no advertising pixels, no session recording, no heatmaps;
• performs no profiling, fingerprinting, or cross-site tracking of any kind;
• uses no third-party font, script, or embedded-content requests — all typography (Open Sans) is served from this site's own domain;
• stores nothing in your browser — no localStorage, no sessionStorage, no IndexedDB.

Your IP address is processed transiently by our hosting provider's security layer, as set out in section 4. We do not receive, log, or retain it for marketing purposes.

The only personal data BakLok collects is what you choose to send:

• Enquiry correspondence. If you email or telephone the practice, we receive your name (as given), your contact details (email address, phone number) and the content of your message — including anything you volunteer about your role, organisation, or circumstances.
• Engagement records. If an engagement proceeds, we keep the records necessary to deliver it: correspondence, scheduling, session notes, invoices and payment references.

There is no intake form on this website and no newsletter. We cannot add you to a mailing list you never joined, because no such list exists.

This website is served through Cloudflare, Inc.'s global network. Like nearly all web infrastructure, Cloudflare processes technical request data — including IP address, user-agent string and requested URL — for security, availability and abuse prevention. This processing is performed by Cloudflare as our processor under a data processing agreement; Cloudflare is certified under the EU–US and UK Data Privacy Frameworks.

In the rare event a security check is triggered, Cloudflare may set a strictly-necessary security cookie (for example cf_clearance). This is first-party, functional and disclosed in the Cookie statement. It is not used for tracking or advertising.

For visitors from the EU/UK (GDPR and UK GDPR), our lawful bases are:

• Legitimate interests (Article 6(1)(f)): responding to enquiries you send us; keeping the minimal records needed to run the practice; security logging by our hosting provider. You may object to processing based on legitimate interests at any time (section 7).
• Contract (Article 6(1)(b)): where an engagement proceeds, processing the data necessary to deliver it.
• Legal obligation (Article 6(1)(c)): retaining financial records where law requires.

We do not rely on consent for anything on this website, because we do not need to: there are no cookies, analytics, or marketing uses here. Where consent is ever relied upon in the future, it will be requested before use, granular and withdrawable.

Enquiry correspondence that does not lead to an engagement is reviewed periodically and deleted when it no longer serves a purpose. Engagement records are retained for the duration of the engagement and afterwards only as long as needed for professional record-keeping, legal and tax purposes. This website itself retains nothing about you.

Depending on where you are, you hold some or all of the following rights over personal data we hold about you:

• EU/UK (GDPR, UK GDPR): access, rectification, erasure, restriction of processing, data portability, objection (including to legitimate-interests processing) and the right to lodge a complaint with your supervisory authority. We respond within one month.
• Hong Kong (Personal Data (Privacy) Ordinance, Cap. 486): the right to request access to and correction of your personal data held by the practice and to be informed of our Personal Information Collection Statement — which is this document. Data access requests may be directed to ptk@bak-lok.com.
• Mainland China (Personal Information Protection Law): the rights of access, correction, deletion, restriction and explanation of processing rules and the right to withdraw consent where consent is the basis of processing.
• California (CCPA/CPRA): we do not sell or share personal information as those terms are defined, and we have not done so in the preceding twelve months. California residents may request access to, correction of, or deletion of personal information we hold.
• Australia (Privacy Act 1988) and Canada (PIPEDA): equivalent access, correction and complaint rights.

To exercise any right, write to ptk@bak-lok.com. We will verify your identity by the strength of the correspondence itself — not by collecting further data to prove you are you.

BakLok operates across borders because its clients do. Enquiry correspondence sent from anywhere may be read and handled in Hong Kong and mainland China, where the practice operates. Website traffic is served by Cloudflare's global network, which may process request data in multiple jurisdictions under its certifications and transfer safeguards.

Where the GDPR or UK GDPR applies and data is transferred outside the EEA/UK, transfers rely on appropriate safeguards — principally the EU Standard Contractual Clauses (and, where applicable, the UK International Data Transfer Addendum) with our service providers, together with Cloudflare's certifications under the EU–US and UK Data Privacy Frameworks. Hong Kong's Personal Data (Privacy) Ordinance imposes comparable cross-border restraint under DPP3, and our handling of mainland-China-sourced data follows the cross-transfer rules of PIPL.

Beyond legal compliance, the practice holds a professional rule: client identities are held in confidence. Sectors and roles are described publicly only as accurately as discretion allows. No client should be inferred or invented from anything on this site. Testimonials appear only with the author's consent and attribution.

This website is directed at senior professionals, organisations and families. It is not directed at children, and we do not knowingly collect data from children. The youngest people this practice coaches are adult successors — the next generation, not minors.

If this statement changes materially, the change will be dated below. The absence of a long changelog is a feature: a site that collects almost nothing rarely needs to revise its promises.

Effective date: 3 November 2026. Supersedes all prior statements.