Due to international regulatory requirements, Cirius Justice does not accept clients who are citizens or permanent residents of the United States, Germany, Italy, or France.

Official privacy notice, 2 November 2026

Privacy Policy

This English text is the official privacy notice of Justice Alliance Party Limited, which uses the brand Cirius Justice. Translations are provided for readers. If a translation differs from this page, this English page governs.

Due to international regulatory requirements, Cirius Justice does not accept clients who are citizens or permanent residents of the United States, Germany, Italy, or France.

1. Who is responsible

Justice Alliance Party Limited (正義聯盟黨有限公司) is a Hong Kong private company, Company Registry number 2394360, Business Registration number 66336348. Its registered office is Room 1802B, 18/F, Fortress Tower, 250 King's Road, North Point, Hong Kong. For personal data collected through this website and through inquiries sent to the company, Justice Alliance Party Limited is the data user under the Personal Data (Privacy) Ordinance (Cap. 486) and, where the GDPR or UK GDPR applies, the controller.

Justice Alliance Party Limited has no establishment in the European Union. It has not appointed a representative under Article 27 of the GDPR.

Article 27 can require a representative where a controller outside the Union offers goods or services to people in the Union, or monitors their behaviour, and no exemption applies. An exemption can apply where the processing is occasional, does not include, on a large scale, special-category data or data about criminal convictions, and is unlikely to result in a risk to the rights and freedoms of people in the Union. Whether those conditions are met depends on the activities the company actually carries on, not on the fact that this notice mentions the GDPR.

This notice does not publish a concluded legal opinion on that question. The company should take advice on its actual activities before treating the exemption, or the duty to appoint a representative, as settled. People in the EEA and the United Kingdom can still write to claims@ciriusjustice.com or use the inquiry form. Where the GDPR or UK GDPR applies, the rights below are the rights this notice describes. The notice is not a statement that every inquiry from the EEA is subject to the GDPR in the same way.

The company has not appointed a statutory Data Protection Officer. Privacy correspondence goes to the same contact.

2. What the company is, and what it is not

Cirius Justice traces cryptocurrency transactions and coordinates recovery work. It may do the tracing itself or ask an independent forensic partner to do it. It does not give legal advice and it does not act as your lawyer. Legal advice, court applications, and legal representation, where they happen, are provided by an independent law firm under a separate engagement with you.

The company is not a bank, an exchange, an investment firm, or a custodian. It does not take ownership of client funds, it does not administer client funds, and it does not ask you to transfer cryptocurrency or liquidity to it.

3. What an inquiry may include

The inquiry form asks for your name, email address, telephone number, and a description of what happened. You may mention a country, a type of fraud, or an approximate loss in that description if you choose. You may later send public transaction references, such as a transaction hash or a public wallet address.

Do not send a seed phrase, a private key, a password, or a request for remote-access software such as AnyDesk or TeamViewer. The company does not ask for those, and they should not be sent on any channel.

If a matter proceeds, the company or a partner may ask for identity information, proof of residence, or records you already hold, so that the person and the source of funds can be checked. Send those only after they are asked for, and not through the public form.

The company does not send newsletters and does not use inquiry details for marketing or for sale to other companies. Partners receive contact details only when that is required for the professional work you have asked for. They are not given your details so they can sell you unrelated services.

4. Why the information is used

Where the GDPR or UK GDPR applies, the company relies on steps taken at your request before a contract (Article 6(1)(b)) for the inquiry and for work you ask it to start; on a legal obligation (Article 6(1)(c)) where a check or a disclosure is required by law; and on legitimate interests (Article 6(1)(f)) in securing the correspondence and keeping a record of a matter that is actually underway. Consent is not used as a cover for all of that processing. The checkbox on the form records that you were given this notice. It is not a consent to sell your data.

Under the Hong Kong Personal Data (Privacy) Ordinance, data is collected for a purpose directly related to the inquiry or the engagement, and is not used for a new purpose unless the law allows it or you agree. The company does not use the data for direct marketing.

People in Switzerland may have rights under the Federal Act on Data Protection. They can write to the company and, separately, to the Federal Data Protection and Information Commissioner.

5. Who else may receive it

Information is shared only for the professional work, for a legal duty, or to protect a claim. It is not sold.

The partner directory gives, for each published name, the country or region, the service, and a statement that professional registration and current referrals are confirmed with that organisation. A name on this list is not proof that the organisation is accepting a referral, and it is not proof that the organisation is a law firm unless the directory says it is an independent legal practice.

A partner is an independent organisation. A law firm that advises you is normally its own controller for the work it does. A forensic firm may act on instructions for a defined task, or as its own controller for its own professional duties. The role follows the arrangement for that matter. It is not the same for every partner on every file.

Courts, law-enforcement bodies, regulators, banks, and exchanges may receive information when that is legally justified for the matter. The company does not promise that information is never shared without consent. A privacy notice that said that would be false, because partners and authorities can have a proper reason to receive it.

People who handle correspondence for the company may see an inquiry so it can be read and answered. They are not partners who give legal advice, and this notice does not publish a technology inventory.

Countries that may be involved include Hong Kong and the countries of the partners listed above, and any country where a court, authority, bank, or exchange in the matter is located. Where the GDPR requires a transfer tool, the company uses an approved mechanism such as standard contractual clauses, together with any extra step the transfer needs. You may ask for a summary of the safeguard that applies to your matter.

6. How long it is kept

If you submit the form and you do not continue, the inquiry is kept for up to six months so the company can still reply if you return. It is deleted sooner if you ask for deletion.

You may stop before you sign papers, before you make any commitment, and before you receive a work result such as a forensic report from the company or from a partner. If you stop at that stage, the company deletes the inquiry information and ends the service.

If a cryptocurrency recovery matter is already underway with the company, the information is kept for as long as it is needed for the investigation, for possible legal proceedings, and for their outcome. That period is not fixed in advance, because the length of an investigation or a case is not known at the start. It is not kept for marketing.

7. Security

The company limits access to people who need the information for the inquiry or the matter, and it uses encryption for the transmission of the website form. No method of transmission or storage is perfectly secure. The company does not claim a certification it has not been awarded.

See the information security statement.

8. Your rights

Where the GDPR or UK GDPR applies, you may ask for access, correction, erasure, restriction, and a portable copy where that right applies. You may object to processing based on legitimate interests. You may complain to a supervisory authority. The company aims to answer a valid request within one month, with the extensions the law allows. It may ask for enough information to be satisfied that the requester is the person concerned. That check is not a request for a seed phrase or a password.

Under the Hong Kong ordinance, you may make a data access request and a data correction request. Section 19 requires compliance with a data access request within 40 days, or a written explanation within those 40 days if that is not possible, followed by compliance as soon as practicable. You may also contact the Office of the Privacy Commissioner for Personal Data.

Erasure is available in the situations in section 6. A matter that is already underway may have to be kept for the investigation or for legal proceedings. A deletion request does not remove a record that the law requires the company to keep.

More detail is on the data rights page.

9. Cookies

The site does not set analytics or advertising cookies. See the Cookie Policy.

10. Office

You may visit the registered office by appointment: Room 1802B, 18/F, Fortress Tower, 250 King's Road, North Point, Hong Kong.

11. Complaints and contact

Privacy questions, access requests, correction requests, and complaints can be sent through the inquiry form or by email to claims@ciriusjustice.com. Postal address: Justice Alliance Party Limited, Room 1802B, 18/F, Fortress Tower, 250 King's Road, North Point, Hong Kong.

This notice was published on 2 November 2026.