Privacy Policy

1. Who We Are

Crane Counsel is an educational provider offering financial transition courses for adults aged 40 and above, based at 14/F, China Building, 29 Queen's Road Central, Central, Hong Kong. For data protection matters, you may contact us at [email protected].

2. Data We Collect

We collect personal data only when it is necessary for enrolment, course administration, or responding to enquiries. This includes:

• Name and contact details (email address, phone number)
• Enquiry or message content submitted through our website contact form
• Enrolment information (name, email, chosen programme)
• Payment confirmation details (we do not store card numbers; payments are processed by third-party providers)
• Website usage data collected via cookies (see our Cookie Policy)

We do not collect personal financial data from participants during courses. Exercises and worksheets involve each participant's own numbers, which remain entirely private.

3. How We Use Your Data

Personal data is used for the following purposes:

• Responding to enquiries submitted through the website
• Processing and confirming course enrolment
• Administering course schedules, materials, and communications
• Sending post-programme feedback surveys
• Improving our website and course content based on aggregated usage data
• Meeting any legal or regulatory obligations applicable in Hong Kong

We do not use personal data for marketing purposes beyond communications directly related to the programmes you have enquired about or enrolled in, unless you have explicitly consented to broader communications.

4. Legal Basis for Processing

We process personal data on the following bases under the PDPO and applicable standards:

• Consent — for contact form submissions and cookie preferences
• Contract performance — to administer course enrolment and delivery
• Legitimate interests — to improve our educational offering based on aggregated feedback
• Legal obligation — where required by Hong Kong law

5. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected:

• Enquiry records: up to 12 months after the last communication
• Enrolment records: up to 7 years after course completion (for accounting and compliance purposes)
• Website analytics data: aggregated, retained for up to 26 months

6. Data Sharing

We do not sell personal data to third parties. We may share data with:

• Payment processors (for secure transaction processing; these providers do not receive unnecessary personal data)
• Email delivery services used to send course communications
• Analytics providers (Google Analytics — aggregated, anonymised data)
• Legal or regulatory authorities where required by Hong Kong law

Third-party service providers are selected for their data protection standards and are only provided with data necessary for their specific function.

7. Data Security

We take reasonable and appropriate measures to protect personal data against unauthorised access, loss, or misuse. These include:

• Encrypted data transmission (HTTPS) on our website
• Access to personal data restricted to staff with a clear need
• Use of third-party services with their own security certifications for payment and communication
• Regular review of data handling practices

In the event of a data breach affecting your personal data, we will notify affected individuals and relevant authorities in accordance with applicable obligations.

8. Cookies

Our website uses cookies to support basic functionality and to understand how the site is used. For full details, please see our Cookie Policy. You may manage your cookie preferences at any time via the cookie settings on this website.

9. Your Rights

Under the PDPO and applicable data protection principles, you have the right to:

• Access personal data we hold about you
• Request correction of inaccurate data
• Request erasure of data we hold about you (subject to legal retention requirements)
• Object to processing for marketing purposes
• Withdraw consent where processing is based on consent

To exercise any of these rights, please contact us at [email protected]. We will respond within 40 days as required by the PDPO.

10. Third-Party Links

Our website may contain links to external websites. We are not responsible for the privacy practices of those sites. We recommend reviewing the privacy policies of any third-party sites you visit.

11. Children's Privacy

Our courses and website are designed for adults aged 18 and above. We do not knowingly collect personal data from individuals under 18. If you believe we have inadvertently done so, please contact us so we can remove the data.

12. Changes to This Policy

We may update this Privacy Policy from time to time. The updated version will be posted on this page with a revised "Last updated" date. Material changes will be communicated to enrolled participants by email where possible.

13. Contact

For questions about this Privacy Policy or how we handle your personal data, please contact: