Privacy Policy

1. Introduction

Banyan Scroll ("we", "us", "our") is committed to handling personal data responsibly and in accordance with the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong ("PDPO"). This policy explains what personal data we collect, how we use it, how long we keep it, and what rights you have in relation to it.

If you have questions about this policy or about how your data is handled, please contact us at [email protected].

2. Data We Collect

We collect personal data only when it is provided to us directly — through our enquiry form, course enrolment, or email correspondence. The categories of data we may collect include:

• Full name and preferred name
• Email address
• Phone number (if provided voluntarily)
• Information included in correspondence or form messages
• Technical data from website visits (see Cookie section below)

We do not ask for or collect financial information, estate details, asset values, or sensitive family information through this website or our enrolment process.

3. How We Use Your Data

Personal data collected through this site is used for the following purposes:

• Responding to enquiries: We use the contact details you provide to respond to your message.
• Course administration: When you enrol in a programme, we use your name and email to provide access, send materials, and communicate about the course.
• Site improvement: Aggregated, non-identifiable data from analytics cookies may be used to understand how visitors use the site.
• Legal compliance: We may retain records where required by applicable law.

We do not sell, rent, or trade personal data to third parties. We do not use personal data for automated decision-making.

4. Legal Basis for Processing

Our legal basis for processing personal data under the PDPO is your consent, provided when you submit a form or enrol in a course, and the performance of our agreement with you as a course participant. Where we retain data for compliance purposes, the legal basis is a statutory obligation.

5. Data Retention

We retain personal data only for as long as it is needed for the purpose for which it was collected. Enquiry records are retained for twelve months. Course participant records are retained for three years from the date of completion. After these periods, data is securely deleted unless retention is required by law.

6. Data Protection Measures

We take reasonable technical and organisational measures to protect personal data against unauthorised access, loss, or disclosure. These include encrypted data storage, restricted internal access on a need-to-know basis, and regular review of our data handling practices. In the event of a data breach that poses a risk to individuals, we will notify affected parties as required by applicable law.

7. Cookies

Our website uses cookies to support basic site functionality and, where consent is given, to understand how visitors use the site. Full details of the cookies we use and how to manage them are set out in our Cookie Policy.

8. Third-Party Services

We use a small number of third-party services in operating our website, including analytics tools. These services may process technical data about your visit in accordance with their own privacy policies. We do not share identifiable personal data with third parties except where required to deliver a service you have requested or where required by law.

9. External Links

This site may contain links to external websites. We are not responsible for the privacy practices or content of those sites. We encourage you to read the privacy policies of any site you visit via a link from our pages.

10. Your Rights

Under the PDPO, you have the right to:

• Request confirmation of whether we hold personal data about you
• Request access to that data
• Request correction of inaccurate data
• Request deletion of your data, where retention is no longer required
• Withdraw consent for processing, where processing is based on consent
• Lodge a complaint with the Office of the Privacy Commissioner for Personal Data (PCPD) in Hong Kong

To exercise any of these rights, please contact us at [email protected]. We will respond within 40 days, as required by the PDPO.

11. Children's Privacy

Our courses are designed for adults aged 40 and above. We do not knowingly collect data from individuals under the age of 18. If we become aware that we have received data from a minor, we will delete it promptly.

12. Changes to This Policy

We may update this policy from time to time to reflect changes in our practices or in applicable law. The date at the top of this page will indicate when the policy was last revised. We encourage you to review this page periodically.

13. Contact

For privacy-related enquiries, please write to: