PRIVACY POLICY & PERSONAL INFORMATION COLLECTION STATEMENT

PART A: PRIVACY POLICY STATEMENT (PPS)

Our Pledge

We pledge to fully meet the requirements of the Personal Data (Privacy) Ordinance (Cap. 486 of the Laws of Hong Kong). In doing so, we understand that you care about the security of your privacy, and it is our prime concern to protect it. We ensure compliance by our staff with the strictest standards of security and confidentiality.

Commitment to Information Security (ISMS)

We maintain a formal Information Security Management System (ISMS) aligned with ISO/IEC 27001 standards to ensure the confidentiality, integrity, and availability of all personal data we process. Our management is fully committed to the continual improvement of our security controls and regularly reviews our ISMS against evolving physical and cyber threats. We implement rigorous technical and organizational measures—including robust network security and secure data storage—to protect against unauthorized or accidental access, processing, erasure, loss, or use of your data.

Employee Awareness and Access Control

Access to personal data within our organization is granted strictly on a “need-to-know” and “least privilege” basis. All staff and contractors undergo mandatory, regular information security and data privacy awareness training to ensure strict, ongoing compliance with our ISMS and privacy policies.

Information Security Incident Management

We have established a comprehensive Information Security Incident Response Plan to address and mitigate any potential security events. In the unlikely event of a suspected or actual personal data breach, we will take immediate, systematic action to contain the incident and secure our systems. We commit to notifying affected individuals and the relevant regulatory authorities in a timely manner, as required by our ISMS framework and applicable laws.

Marketing

We may use your personal data for marketing and promotional purposes, including keeping you informed about our products, services, and future activities when you register for or join our events. We may offer marketing and promotions to you by post, telephone, or online (including through email, your mobile device, or via online banner advertisement). As appropriate and where required, we will ask you for your consent or otherwise provide you with the opportunity to choose not to receive marketing, at the time we collect your data (such as on an event registration form). We will always provide an option to unsubscribe or opt out of further communication on any direct marketing communication sent to you, free of charge. You may also opt out at any time by contacting us via mail.

Data Collection During Website Browsing

When you browse our Website, we do not collect personal data from you unless you explicitly provide it (for example, by filling out a form or sending us an email). No registration is required to access general information on our Website. Like many other websites, we record your visit automatically through cookies. Cookies are small data structures sent to your computer to record your visit and to identify you during future visits. These cookies may be saved permanently on your computer but are harmless. The data types collected include your browser type and version, operating system, IP address, and domain name. This information is only used to compile general statistics regarding the number of visitors and usage patterns on our Website. You may disable cookies in your browser settings, but this may affect your browsing experience on our Website.

Data Retention

Personal data you provide to us will be retained only for as long as is necessary to fulfill the purposes for which it was collected, after which it will be securely deleted or anonymized, subject to any legal or regulatory requirements.

Updates to this Policy

We reserve the right to revise, change, or modify this Statement from time to time at our sole discretion by updating this page or by inserting notices on particular pages of this Website.

Applicable Law and Language

This Statement shall be governed by and construed in accordance with the laws of the Hong Kong Special Administrative Region of the People’s Republic of China. This Statement is written in English.

PART B: PERSONAL INFORMATION COLLECTION STATEMENT (PICS)

This Personal Information Collection Statement applies whenever we ask you to provide personal data to us (e.g., when submitting enquiries, registering for services, or opting into marketing).

1. Purpose of Collection

The personal data provided by you may be used for the following purposes:

• Processing your specific enquiries, feedback, or complaints and conducting proper follow-ups. 
• Processing enrolment applications or providing requested services.
• Compiling statistical data for internal analysis.
• Direct marketing (subject to your consent, as detailed in Section 4 below).

2. Obligatory vs. Voluntary Data

It is voluntary for you to provide your personal data. However, if you fail to provide the requested data, we may not be able to process your application, answer your enquiries, or provide our services to you.

3. Disclosure, Transfer, and Third-Party Security

Our general policy is to keep all personal data confidential. However, we may provide your personal data to:

• Personnel authorized by us to process the information for the specified purposes.
• Our clients, where the sharing of such information is necessary for the delivery of our services or in connection with events and activities you participate in.
• Third-party service providers (such as IT vendors or delivery services) engaged by us to assist with the specified purposes.
• Law enforcement, regulatory, or government bodies where required or permitted by law.

Supplier Security: In alignment with our ISO 27001 commitments, any third-party vendors or service providers processing personal data on our behalf are subjected to rigorous information security risk assessments. We legally bind our authorized suppliers to maintain security standards and controls that are equivalent to our own ISMS policies. Please note that outside of our authorized vendors and clients involved in our service delivery, we assume no responsibility for the privacy practices of third parties to whom data has been disclosed incidental to legal obligations. We will not share your personal data with other companies or organizations for their own marketing purposes without your explicit consent.

4. Direct Marketing

We intend to use your personal data (such as your name, email address, phone number, and mailing address) for direct marketing and promotional purposes, including sending you updates regarding our products, services, and promotions. We cannot use your personal data for direct marketing without your consent (which includes an indication of no objection). When we collect your data, we will provide you with the opportunity to opt-in or opt-out. If you consent but later change your mind, you may opt out of receiving direct marketing communications at any time, free of charge, by using the “unsubscribe” link in our emails or by contacting us using the details below.

5. Personal Data Access and Correction

Under the Personal Data (Privacy) Ordinance, you have the right to ascertain whether we hold your personal data, to obtain a copy of such data, and to correct any inaccuracies.