Privacy Policy

Effective Date: 13 April 2026

1. Introduction and Company Information

This Privacy Policy explains how HarbourFold Origami Studio (“we”, “us”, or “our”) collects, uses, stores, discloses, and otherwise processes personal data in connection with our origami studio services, workshops, classes, events, retail activities, website, customer communications, and related business operations.

We are committed to protecting personal data in accordance with the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong (“PDPO”) and, where applicable, the six Data Protection Principles and related guidance issued by the Privacy Commissioner for Personal Data, Hong Kong.

Company Name: HarbourFold Origami Studio
Address: HarbourFold Origami Studio, 18 Hoi Kwong Street, Quarry Bay, Hong Kong 999077
Email: [email protected]
Phone: +852 2814 7396

2. Data Collection and Processing

We may collect and process the following categories of personal data, depending on your interactions with us:

• Identification and contact details: name, email address, phone number, billing address, delivery address, and emergency contact details where relevant for workshops or events.
• Booking and transaction details: class registrations, purchase records, payment status, invoices, receipts, and refund-related information.
• Communication data: messages, enquiries, feedback, complaint details, and correspondence with our team.
• Workshop and participation data: attendance records, skill level, preferences, accessibility requirements, and dietary or health-related information only where voluntarily provided and necessary for event arrangements.
• Technical and usage data: IP address, browser type, device identifiers, cookie data, pages visited, and website interaction data.
• Marketing preferences: subscription status, consent choices, and communication preferences.
• Image, audio, and video data: photographs or recordings taken during events, classes, or studio activities, where notice is provided or consent is obtained as appropriate.

We generally collect personal data directly from you, such as when you make a booking, purchase products, subscribe to updates, contact us, attend a workshop, or interact with our website. We may also receive data from third-party service providers, payment processors, booking platforms, delivery providers, or publicly available sources where lawful and appropriate.

If you provide personal data relating to another person, you should ensure that you have the authority to do so and that the individual is aware of this Privacy Policy.

3. Purpose of Data Processing

We process personal data for the following purposes:

• to provide, manage, and administer our origami studio services, workshops, classes, events, and retail sales;
• to process bookings, payments, refunds, cancellations, and customer support requests;
• to communicate with you regarding enquiries, confirmations, updates, service notices, and administrative matters;
• to personalise your experience and tailor class recommendations, materials, or event arrangements;
• to manage attendance, safety, accessibility, and operational logistics for workshops and events;
• to send marketing communications, newsletters, promotions, and event announcements where permitted by law and, where required, with your consent;
• to maintain records, perform accounting, audit, and internal administration;
• to monitor and improve our website, services, customer experience, and business operations;
• to detect, prevent, and investigate fraud, misuse, security incidents, or unlawful activity;
• to comply with legal obligations, regulatory requirements, and lawful requests from authorities; and
• to establish, exercise, or defend legal claims.

4. Legal Basis for Processing

Under Hong Kong law, personal data must be collected for a lawful purpose directly related to our functions or activities, and the data collected must be necessary and not excessive. We process personal data on the following grounds, as applicable:

• Performance of a contract: where processing is necessary to provide services, process bookings, or fulfil purchases.
• Legitimate interests: where processing is necessary for our legitimate business interests, provided those interests are not overridden by your rights and interests. This may include service improvement, fraud prevention, security, and business administration.
• Consent: where you have given clear consent, such as for certain marketing communications, photography, or the handling of optional sensitive information.
• Legal obligation: where processing is required to comply with applicable laws, tax rules, accounting requirements, or lawful requests from public authorities.

Where we rely on consent, you may withdraw it at any time, subject to legal or contractual restrictions and reasonable notice.

5. Data Sharing and Third Parties

We may share personal data with trusted third parties only where necessary and appropriate for the purposes described in this Privacy Policy. These may include:

• Payment service providers for processing card or online payments;
• Booking and scheduling platforms used to manage class registrations and event attendance;
• Delivery and logistics providers for shipping products or workshop materials;
• IT, cloud hosting, and website service providers who support our systems and communications;
• Professional advisers such as accountants, auditors, lawyers, and insurers;
• Marketing and analytics providers where permitted by law and subject to appropriate controls;
• Government, regulatory, or law enforcement authorities where required by law or to protect our rights;
• Event partners or venue operators where necessary to organise joint workshops or activities.

We require third parties to handle personal data in a manner consistent with applicable privacy laws and, where appropriate, under contractual confidentiality and security obligations. We do not sell personal data.

6. Data Transfer to Third Countries

Some of our service providers may be located outside Hong Kong, or personal data may be stored or processed in jurisdictions outside Hong Kong. Where such transfers occur, we will take reasonable steps to ensure that the recipient provides a standard of protection comparable to that required under the PDPO and that appropriate safeguards are in place.

These safeguards may include contractual protections, access controls, security measures, and due diligence on service providers. By using our services, you acknowledge that your personal data may be transferred to and processed in jurisdictions outside Hong Kong for the purposes described in this Privacy Policy.

7. Storage Duration

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law, accounting standards, dispute resolution needs, or legitimate business interests.

• Customer and booking records: generally retained for the duration of the customer relationship and for a reasonable period thereafter.
• Financial and tax records: retained for the period required by applicable laws and accounting obligations.
• Marketing records: retained until you unsubscribe, withdraw consent, or object where applicable.
• Enquiry and correspondence records: retained for as long as necessary to manage the communication and any follow-up.
• CCTV or security-related records: retained for a limited period unless needed for investigation, legal, or security purposes.

When personal data is no longer required, we will delete, anonymise, or securely destroy it in accordance with our retention practices.

8. User Rights

Subject to applicable law, you may have the following rights in relation to your personal data:

• Access: to request confirmation of whether we hold your personal data and to obtain a copy of it.
• Rectification: to request correction of inaccurate, incomplete, or outdated personal data.
• Erasure: to request deletion of personal data in certain circumstances, subject to legal and operational limitations.
• Restriction: to request limitation of processing in certain circumstances, such as while a correction request is being reviewed.
• Data portability: to request a copy of certain personal data in a structured, commonly used format where applicable and technically feasible.
• Objection: to object to processing based on our legitimate interests or to direct marketing where applicable.

To exercise any of these rights, please contact us using the details provided below. We may need to verify your identity before responding. We will respond within a reasonable time and in accordance with applicable legal requirements.

9. Withdrawal of Consent

Where we rely on your consent to process personal data, you may withdraw that consent at any time by contacting us or using any unsubscribe mechanism provided in our communications.

Withdrawal of consent will not affect the lawfulness of processing carried out before the withdrawal. In some cases, if you withdraw consent, we may no longer be able to provide certain services, such as optional marketing updates or participation in activities that require specific information.

10. Right to Complain

If you have concerns about how we handle your personal data, please contact us first so that we may try to resolve the issue promptly and fairly.

You also have the right to lodge a complaint with the Office of the Privacy Commissioner for Personal Data, Hong Kong if you believe that your personal data has been handled in a manner contrary to the PDPO.

11. Data Security

We implement reasonable and appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction, alteration, disclosure, or misuse. These measures may include:

• access controls and role-based permissions;
• password protection and authentication measures;
• secure storage and encryption where appropriate;
• staff confidentiality obligations and privacy training;
• regular review of systems, processes, and security practices;
• backup and recovery procedures; and
• incident response measures for suspected data breaches.

While we take reasonable steps to protect personal data, no method of transmission over the internet or method of electronic storage is completely secure. We cannot guarantee absolute security.

12. Contact Information

If you have any questions, requests, or complaints regarding this Privacy Policy or our handling of personal data, please contact us at:

HarbourFold Origami Studio
HarbourFold Origami Studio, 18 Hoi Kwong Street, Quarry Bay, Hong Kong 999077
Email: [email protected]
Phone: +852 2814 7396

13. Changes to Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, operational needs, legal requirements, or regulatory guidance. Any revised version will be posted on our website or otherwise made available to you, and the “Effective Date” will be updated accordingly.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal data. Your continued use of our services after any changes take effect constitutes your acknowledgment of the updated Privacy Policy, to the extent permitted by law.