Personal Data Privacy Policy

1. Categories of Personal Data Collected

In the execution of corporate governance, executive education, and institutional consultancy services, the Company may collect and process the following classes of personal data from data subjects:

• Identity and Contact Data: Legal full name, official corporate email address, contact telephone numbers, employer designation, and professional credentials.
• Account and Access Data: Unique user identifiers, hashed authentication tokens, secure session access logs, and formal course enrollment or CPD accreditation histories processed through our secure enterprise portals.
• Technical and Telemetric Data: Internet Protocol (IP) addresses, user agent identifiers, operating system parameters, and electronic session telemetry recorded during interaction with the Company's digital interfaces.

2. Legal Basis and Specific Purposes of Data Processing

All personal data collected shall be held confidential and processed strictly to the extent necessary for the performance of contractual obligations or compliance with applicable legal and statutory mandates, specifically including:

• Verification of candidate identity for institutional enrollment, regulatory CPD accreditation assessments, and formal certificate issuance.
• Administration, maintenance, and security monitoring of client portal access controls and multi-factor authentication systems.
• Dissemination of statutory compliance notices, regulatory governance advisories, and requested corporate training bulletins.
• Satisfaction of statutory audit obligations, financial record-keeping requirements, and legal directions issued by competent judicial or governmental authorities in Hong Kong SAR.

3. Data Protection Safeguards and Retention Protocols

The Company maintains reasonable technical, administrative, and physical security measures to ensure personal data is safeguarded against unauthorized or accidental access, processing, erasure, loss, or misuse. Personal data shall not be retained longer than is necessary for the fulfillment of the purpose for which the data is or is to be used, subject strictly to statutory retention periods prescribed under relevant Hong Kong laws.

4. Transfer and Disclosure to Third Parties

Personal data collected by the Company will not be sold, rented, traded, or otherwise disclosed to third parties, except under the following circumscribed circumstances:

• Authorized Service Providers: To vetted third-party data processors, enterprise cloud hosting infrastructure providers, and administrative software vendors acting strictly under binding non-disclosure and data processing agreements.
• Regulatory & Accreditation Authorities: To recognized educational governing bodies or statutory accreditation agencies (such as relevant insurance or financial regulators) as required for formal professional certification verification.
• Statutory Mandates: To statutory, regulatory, governmental, or law enforcement entities pursuant to a valid subpoena, court order, or statutory directive under the laws of Hong Kong SAR.

5. Statutory Data Subject Access & Correction Rights

Pursuant to Sections 18 and 22 and Data Protection Principle 6 (DPP6) of the Personal Data (Privacy) Ordinance, data subjects possess the statutory right to ascertain whether the Company holds their personal data, request a copy thereof, and require the correction of any inaccurate data records.

Formal Data Access Requests (DAR) or Data Correction Requests (DCR) should be addressed in writing to our designated Data Protection Officer:

Note: The Company reserves the right to charge a reasonable fee for the administrative processing of any formal compliance Data Access Request as permitted under Section 28 of the PDPO.