Privacy Statement

1. Our commitment

Huge Prospect Inc Limited owns and operates this website and the related services under the Wealth Insight brand (“Wealth Insight”, “we”, “us” or “our”). We respect personal data privacy and are committed to complying with the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486) (the “PDPO”) and its Data Protection Principles.

This Statement explains how we collect, use, disclose, retain and protect personal data when you browse the website, create or use an account, purchase a subscription, access or view a course, receive email or contact us.

2. Personal data we may collect

2.1 Account and identity data

• name or display name, email address, member ID, role, membership level and account status;
• email verification and password reset status; and
• a cryptographic hash of your password. We do not store your self-selected password in readable form in our database.

Where a course organiser or administrator creates an account from a student list, we may receive your name, email and course information from that organiser or administrator and notify you by email.

2.2 Subscription, payment and promotion data

• selected plan, billing interval, subscription status, renewal and cancellation details;
• Stripe customer and subscription identifiers;
• transaction status, payment time, currency, amount and promotion-code usage; and
• limited payment or billing information supplied by Stripe.

Stripe processes complete payment card numbers and security codes directly. We do not store them in our website database.

2.3 Course and account-sharing prevention data

• authorised courses, course expiry and administration records;
• recent lesson, first and last playback times and whether playback ended;
• server-issued device identifier, IP address and browser/device user-agent;
• blocked concurrent playback attempts and related security records; and
• your registered email and Hong Kong time displayed as a video watermark.

2.4 Website use, technical and communication data

• session and course-device cookies and associated identifiers;
• features, pages or transaction events used, times, errors and service-operation records;
• hashed rate-limiting data used to prevent abuse, and ordinary request, security and diagnostic logs;
• delivery records for service, security, course and membership communications; and
• enquiries, complaints, data requests and correspondence you provide to us.

We do not intend to collect Hong Kong identity card numbers, full payment card data or sensitive information unrelated to the Services. Do not include unnecessary sensitive information in free-text messages.

3. How and where we collect data

We may obtain personal data:

• directly from registration, sign-in, payment, password reset, enquiry or other forms you submit;
• automatically when you use the website, account or courses;
• from service providers such as Stripe in relation to transactions or subscription status;
• from a course organiser or authorised administrator through a student list; or
• from another source permitted by law.

A person who provides your data to us should ensure that they are lawfully authorised to do so and have given you any required notice.

4. Personal Information Collection Statement

4.1 Whether data is required

Unless stated otherwise at collection, providing a name is generally voluntary. An email address and password are required for a self-registered account, payment details are required for a subscription, and technical and security data are required for restricted Services. Without required data, we may be unable to create or verify an account, process payment, provide membership or course access, protect the account or respond to a request.

4.2 Purposes of use

We may use personal data to:

1. create, verify, administer and protect accounts;
2. process sign-in, password reset and sessions;
3. process subscriptions, payments, promotions, renewals, cancellations, refunds and customer service;
4. provide and record access to paid articles and courses;
5. prevent account sharing, recording, fraud or abuse through device limits, email watermarks and playback records;
6. send transactional and service messages, including verification, security, payment, renewal, course and important service notices;
7. send newsletters, member offers or other direct marketing after obtaining any required valid consent;
8. analyse and improve service performance, content, products, user experience and security;
9. investigate errors, complaints, disputes, Terms violations or suspicious activity;
10. perform backups, audits, record keeping and business continuity; and
11. comply with law, court orders, regulatory or enforcement requirements and establish, exercise or defend legal claims.

We will not use personal data for a new, unrelated purpose without your prescribed consent unless permitted or required by law.

4.3 Classes of possible transferees

We disclose or transfer data only as needed for the purposes above or as permitted by law, including to:

• Stripe for payment and subscription processing;
• Resend or another email service provider for email delivery;
• cloud hosting, database, storage, content delivery, security, technical support, backup and analytics providers;
• video providers such as YouTube when you use embedded content;
• auditors, accountants, lawyers, consultants or insurers subject to confidentiality obligations;
• an actual or proposed transferee in a merger, financing, reorganisation or sale of business or assets; and
• courts, regulators, law-enforcement, tax or other authorities lawfully entitled to receive the data.

5. Direct marketing and your choices

We will use your name, email, membership category, subscription or content interests to promote Wealth Insight news, research, memberships, courses, events or related services only after giving the notice and choices required by the PDPO and obtaining any required consent or indication of no objection.

You may opt out free of charge at any time by following the opt-out instructions in the relevant message or writing to the Data Protection Officer. We may continue sending non-promotional messages needed to perform a contract, protect an account or process a transaction.

6. Cookies and similar technologies

These cookies are necessary for sign-in and course features. You may delete or block cookies in your browser, but parts of the Services may then not work. If we later introduce non-essential advertising, cross-site tracking or personalised analytics cookies, we will update this Statement and provide choices or obtain consent where applicable.

We may embed video using YouTube’s privacy-enhanced mode. When you play or interact with embedded content, YouTube or Google may still receive device, network and interaction data under their own policies.

7. Data retention

We retain personal data only for as long as necessary for the collection purpose, contract performance, dispute handling, security and legal compliance. Our general approach is:

• session cookie: up to 7 days for members and 12 hours for administrators, or until sign-out, expiry or revocation;
• course-device cookie: up to 1 year;
• course playback and device-security records: generally deleted 30 days after last activity unless needed for an investigation, dispute or legal requirement;
• email-verification and password-reset credentials: deleted or invalidated after use, expiry or replacement;
• accounting, payment, refund and transaction records: retained as legally required, generally for no more than 7 years after the transaction;
• account, membership, course-entitlement and service records: for the active service and afterwards as needed for enquiries, disputes, fraud and legal obligations; and
• general analytics, security and email records: periodically reviewed, deleted or anonymised and not retained longer than needed.

Data in backups may take longer to disappear under established rotation cycles but will no longer be used in ordinary operations and remains protected. Legal holds, disputes or investigations may extend these periods.

8. Data security

We take reasonably practicable administrative, technical and physical measures against unauthorised or accidental access, processing, erasure, loss or use. Depending on the context, measures include password hashing, encrypted transport, HttpOnly/Secure/SameSite cookies, access controls, shorter administrator sessions, Stripe-hosted payment, origin checks, content security policy, rate limiting, restricted video streaming and watermarks.

No network transmission or storage is absolutely secure. If an incident may significantly affect data subjects, we will assess the risk, take remedial action and make appropriate notifications in accordance with applicable law and regulatory guidance.

9. Cross-border processing

Service providers, servers or support personnel may be outside Hong Kong, so personal data may be stored or processed outside Hong Kong in places with different data-protection laws.

Where reasonably practicable, we limit disclosure to data the provider needs and use contracts, provider review, access controls, encryption or other appropriate measures to require consistent confidentiality and security standards.

10. Access, correction and erasure requests

Under the PDPO, you may ask whether we hold your personal data, request access to it and request correction of inaccurate data. You may also request account closure or erasure of data we no longer need, although we may retain transaction, legal, security or dispute records.

We aim to confirm the outcome of a clear and verifiable erasure request, or explain any additional time required, within 15 working days. Complex requests, identity verification or legal retention duties may take longer.

A data access request may be made using the Hong Kong Privacy Commissioner’s Data Access Request Form (OPS003) or in writing. We will verify identity and authority to prevent unauthorised disclosure and handle a valid request within the statutory period. Where permitted by law, we may charge a fee that is not excessive and will tell you in advance.

11. Children and minors

The Services are primarily intended for adults. We do not knowingly sell a membership subscription directly to a person under 18. A person under 18 should use the Services with the consent and supervision of a parent or legal guardian. If a school, organisation, parent or guardian arranges a course for a minor, we process only data needed to provide the course and protect the account, and the provider should have the required authority or consent.

12. External links and third-party services

The website may link to third-party websites or services. Those parties independently determine how they process data, and this Statement does not apply to them. Review the relevant third-party privacy policy before leaving our website or using embedded content.

13. Changes to this Statement

We may update this Statement when our Services, providers, law or data practices change. We will publish the updated version and revision date on the website. If a change materially affects your rights or how we use data, we will where reasonably practicable give additional notice through the website, account or email and obtain consent where required.

14. Enquiries and complaints

For a question or complaint about this Statement, our handling of personal data or your rights, write to the Data Protection Officer. We will acknowledge and handle the matter fairly. You may also contact or complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong.