Privacy Policy

1. Who We Are

The data controller is Orchid Vault, operating from 19/F, Central Plaza, 18 Harbour Road, Wan Chai, Hong Kong. We offer educational courses on personal insurance for adults resident in Hong Kong. We do not sell insurance products and have no financial relationship with any insurer.

2. Information We Collect

We collect personal information only where it is necessary to operate our courses and respond to enquiries. This includes:

• Contact details: Name, email address, and phone number provided when you submit an enquiry or register for a course.
• Course registration data: Programme chosen, payment records, attendance, and the written outputs produced during the course.
• Communications: Records of correspondence between you and Orchid Vault, including enquiry messages.
• Website data: Technical information collected via cookies and analytics tools when you visit our website (see Section 6).

We do not collect, record, or retain copies of personal insurance policy documents. These remain the property of the participant at all times.

3. How We Use Your Information

• Course delivery: Processing registration, communicating session details, and providing course materials.
• Responding to enquiries: Addressing questions before, during, and after the course period.
• Administration: Maintaining records for accounting, refund processing, and regulatory compliance.
• Service improvement: Reviewing anonymised feedback to refine course content.
• Communications: Sending information about future cohorts or related programmes, where you have given consent. You may withdraw this at any time.

4. Legal Basis for Processing

Under the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong, we process personal data on the following bases: performance of a contract (course delivery), compliance with legal obligations (financial records), and, for marketing communications, your explicit consent.

5. Data Retention

• Enquiry records: Retained for 12 months from the date of last contact if no enrolment follows.
• Course and payment records: Retained for 7 years for accounting and legal compliance purposes.
• Marketing consent records: Retained until consent is withdrawn.
• Website analytics: Aggregated and anonymised data retained for up to 26 months.

6. Cookies and Website Analytics

Our website uses cookies to support basic functionality and to understand how visitors use the site. We use Google Analytics, which may set cookies on your device. You can manage cookie preferences through our Cookie Policy page.

We do not use cookies for advertising or third-party tracking beyond anonymised analytics.

7. Sharing of Personal Data

We do not sell, rent, or trade personal data. We may share data in limited circumstances:

• Service providers: Payment processors and email delivery services operating under data processing agreements.
• Legal requirements: Where disclosure is required by law or regulatory authority in Hong Kong.

No data is shared with insurers, financial product distributors, or any commercial partner.

8. Data Security

We implement appropriate technical and organisational measures to protect personal data, including encrypted data transmission, access controls limiting which staff can view personal records, and secure document storage. In the event of a data breach that poses risk to individuals, we will notify affected parties and the Office of the Privacy Commissioner for Personal Data (PCPD) as required.

9. Your Rights

Under the Personal Data (Privacy) Ordinance, you have the right to:

• Access: Request a copy of personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Withdrawal of consent: Withdraw consent for marketing communications at any time.
• Deletion: Request deletion of data that is no longer necessary, subject to our legal retention obligations.
• Complaint: Lodge a complaint with the Office of the Privacy Commissioner for Personal Data (PCPD) at www.pcpd.org.hk.

To exercise any of these rights, contact us at [email protected]. We will respond within 40 days as required by the Ordinance.

10. Third-Party Links

Our website may contain links to external sites. We are not responsible for the privacy practices of those sites and recommend that you review their policies independently.

11. Children's Privacy

Our courses are designed for adults aged 40 and over. We do not knowingly collect personal data from individuals under the age of 18. If we become aware that we have done so inadvertently, we will delete that data promptly.

12. Changes to This Policy

We may update this policy periodically. Material changes will be communicated by email to registered participants. Continued use of our services after an update constitutes acceptance of the revised policy. The current version is always available on this page.

13. Contact

For any privacy-related questions, requests, or concerns: