1. Data User

For the purposes of the Personal Data (Privacy) Ordinance (Cap. 486) ("PDPO"), Hong Kong Hikers Club is the Data User responsible for the collection, holding, processing and use of personal data described in this Privacy Policy.

Privacy enquiries may be directed to:

Hong Kong Hikers Club

Email: legal@hkhikersclub.com

2. Personal Data Collected

We may collect and process the following categories of personal data:

1. Identity information, including name, date of birth and gender (required to confirm eligibility, support safety planning and verify identity where necessary).
2. Contact information, including mailing address, email address and telephone number.
3. Billing and payment information.
4. Emergency contact information.
5. Event registration, booking and participation information.
6. Account and authentication information, including usernames, encrypted passwords, login history and account preferences.
7. Safety-related information voluntarily provided by participants, including emergency contact details, participation history, incident reports, medical information voluntarily disclosed by participants and information relevant to event safety.
8. Device information, including IP address, browser type, operating system and technical system data.
9. Cookies and analytics information.
10. Communication preferences.
11. Uploaded photographs, videos, documents or other submissions.
12. User-generated content, including reviews, comments, forum posts and images.
13. Survey responses and feedback.
14. Records of policy acceptance, bookings, purchases and participation.
15. Any other information voluntarily provided to us.

Providing certain information is mandatory for event registrations, membership administration, merchandise purchases, safety management or legal compliance.

Failure to provide required information may result in our inability to provide services or permit participation in Club activities.

We collect information necessary to create and manage membership accounts, administer bookings, verify eligibility, manage safety-related matters and operate Club activities.

3. Purpose of Use

We may use personal data for the following purposes:

1. Processing event registrations, bookings and purchases.
2. Administering membership accounts.
3. Event administration and participant management.
4. Safety planning, incident management and emergency response.
5. Communication regarding events, bookings, operational matters and Club activities.
6. Payment processing and fraud prevention.
7. Website administration, security monitoring and analytics.
8. Maintaining records relating to policy acceptance, bookings and participation.
9. Compliance with legal, regulatory and contractual obligations.
10. Handling complaints, disputes and enquiries.
11. Marketing communications where consent has been provided.
12. Any purpose directly related to the above.

3A. Safety and Emergency Information

Where participants voluntarily provide emergency contact information or safety-related information, such information may be used for:

1. Participant welfare;
2. Safety management;
3. Incident investigation;
4. Emergency response;
5. Contacting nominated emergency contacts; and
6. Other legitimate safety-related purposes connected with Club activities.

4. Direct Marketing

We may send newsletters, promotional messages, event announcements, partner offers and other marketing communications only where you have provided consent as required by applicable law.

You may withdraw your consent at any time by:

1. Clicking the unsubscribe link contained in marketing emails;
2. Updating your account preferences; or
3. Contacting us at legal@hkhikersclub.com.

Withdrawal of consent will not affect service-related communications, including:

1. Booking confirmations;
2. Event updates;
3. Safety notices;
4. Operational announcements; or
5. Legal notifications.

5. Data Retention

Personal data is retained only for as long as reasonably necessary to fulfil the purposes described in this Privacy Policy or as required by law.

Typical retention periods include:

1. Financial and accounting records: 7 years.
2. Event registration, participation and safety records: up to 7 years where reasonably required for operational, legal, insurance, safety or dispute-resolution purposes.
3. Membership account information: Until account closure and for a reasonable period thereafter where necessary for legal, operational, safety or dispute-resolution purposes.
4. Terms & Conditions acceptance records: For as long as reasonably necessary to demonstrate contractual acceptance and compliance.
5. Cookies and analytics information: In accordance with the applicable technology provider's retention policies.
6. Marketing consent records: For as long as reasonably required to demonstrate consent history and compliance.

Personal data will be securely deleted, anonymized or destroyed when no longer required.

6. Data Security

We employ reasonable technical and organizational safeguards to protect personal data, including:

1. Secure encrypted communications (SSL/TLS).
2. Access controls and authentication measures.
3. Secure hosting environments.
4. Data minimization practices.
5. Monitoring and security controls designed to prevent unauthorized access.
6. Confidentiality obligations imposed on volunteers, contractors and service providers where appropriate.

While we take reasonable precautions, no method of internet transmission or electronic storage can be guaranteed to be completely secure.

7. Data Sharing

We do not sell personal data.

We may disclose personal data to:

1. Payment processors and payment service providers.
2. Volunteers, coordinators and organizers involved in the administration and operation of Club activities where necessary for legitimate operational or safety purposes.
3. Logistics, shipping and delivery providers.
4. IT service providers, hosting providers and technology vendors.
5. Emergency services, medical providers or emergency contacts where reasonably necessary.
6. Professional advisers, auditors or insurers where required.
7. Government authorities, regulators or law enforcement agencies where legally required.

We may also disclose personal data where required or permitted by applicable law, regulation, court order, law enforcement request or governmental authority.

Where practicable, third-party recipients are subject to confidentiality obligations and appropriate security measures.

8. Cross-Border Transfers

Our servers, service providers and technology providers may be located in Hong Kong, Singapore or other jurisdictions.

Where personal data is transferred outside Hong Kong, we take reasonable steps to ensure that appropriate levels of protection are maintained and that such transfers are conducted in accordance with applicable legal requirements.

By using our services, you acknowledge that certain transfers of personal data may occur across international borders for operational purposes.

9. Cookies and Tracking Technologies

We use cookies and similar technologies to improve website functionality, security and performance.

These may include:

1. Essential cookies used for authentication and account management.
2. Functional cookies used to remember preferences and settings.
3. Analytics tools used to understand website usage and improve services.
4. Website performance monitoring tools.
5. Security logging and fraud-prevention tools.

You may disable cookies through your browser settings; however, certain website features may not function correctly.

10. Access and Correction Rights

Under the PDPO, you may have the right to:

1. Request access to personal data held about you.
2. Request correction of inaccurate personal data.
3. Update information maintained in your account.
4. Withdraw consent for direct marketing communications.

Requests should be submitted to: legal@hkhikersclub.com

We will respond within the period prescribed under applicable law. A reasonable administrative fee may be charged for data access requests where permitted.

10A. Account Closure and Data Removal

You may request closure of your membership account by contacting us.

Account closure does not necessarily require immediate deletion of all associated information.

Certain records may be retained where reasonably necessary for:

1. Legal compliance;
2. Regulatory obligations;
3. Financial recordkeeping;
4. Safety management;
5. Fraud prevention;
6. Dispute resolution;
7. Enforcement of contractual rights; or
8. Legitimate operational requirements.

11. Updates to This Privacy Policy

We may update this Privacy Policy from time to time to reflect operational, legal, regulatory or technological changes.

Updated versions will be published on our website and may also be communicated through email, account notifications or other communication channels where appropriate.

The version published on our website is the current and authoritative version of this Privacy Policy.

12. Contact

For privacy-related enquiries, requests or complaints, please contact:

Hong Kong Hikers Club

Email: legal@hkhikersclub.com