Privacy Policy

Effective date: 11 July 2025

Finch Academy Limited (“Finch Academy”, “we”, “our”, “us”)

This Privacy Policy explains how Finch Academy collects, uses, protects and discloses personal data when you (“Student”, “you”, “your”) access, enrol in or otherwise use our online school and courses (the “School”) hosted on the Teachable platform (the “Platform”). By using the School you agree to the terms below. If you do not agree, please do not use the School.

DATA WE COLLECT

(a) Personal Data you give us or that arises from your use of the School, for example:

• Identity / contact data – name, email, phone, billing address.

• Account credentials – username, password, authentication tokens.

• Payment / transaction data – partial card digits, order history (payment handled by Teachable or Stripe).

• Course interaction data – progress, quiz scores, certificates, messages.

• Marketing preferences – newsletter opt-in / opt-out.

(b) Technical data automatically logged by the Platform (IP address, device identifiers, usage statistics). We use this only in aggregated or security-related form.

Legal bases for processing: consent (where required), performance of contract, legitimate interests (student management, security, service improvement) and legal compliance.

HOW WE USE PERSONAL DATA

We use personal data only for the purposes below and never sell or rent it to third parties:

• Provide and administer courses, create accounts, track progress, issue certificates, troubleshoot problems.

• Customer service and technical support.

• Essential communications (transaction confirmations, policy updates) and, where you consent, marketing messages.

• Analytics and service improvement.

• Compliance with laws, regulations, court orders and protection of Finch Academy’s rights and property.

DISCLOSURE OF PERSONAL DATA

We disclose personal data only:

• To service providers / data processors (e.g. Teachable, Stripe, cloud hosts, email vendors) bound by written contracts to keep data confidential and secure.

• When required by law, regulation or court order, or to protect Finch Academy’s legitimate interests (fraud, security, enforcement of terms).

• In connection with a business transfer (merger, acquisition, asset sale) under confidentiality obligations.

We do not sell, trade or rent personal data to anyone.

INTERNATIONAL TRANSFERS

The Platform’s servers are located in the United States. By using the School you agree that your data may be transferred and stored outside Hong Kong. We rely on appropriate safeguards (such as standard contractual clauses) to protect such transfers.

DATA SECURITY

We employ administrative, technical and physical measures designed to protect personal data, including TLS encryption, password hashing, access controls and regular security reviews. No system is 100 % secure; you are responsible for keeping your password confidential.

DATA RETENTION

We keep personal data only as long as needed for the purposes stated in this Policy and to satisfy legal, accounting or tax requirements. Course records and certificates may be kept indefinitely unless deletion is requested and permitted by law.

YOUR RIGHTS

Subject to applicable law (including the Hong Kong Personal Data (Privacy) Ordinance and, where relevant, the EU/UK GDPR) you may have the right to:

• Access the personal data we hold about you.

• Correct inaccurate or incomplete data.

• Request deletion or restriction of processing.

• Object to certain processing, including direct marketing.

• Receive a copy of data you provided in a structured, machine-readable format.

• Withdraw consent at any time where processing is based on consent.

To exercise these rights, email our Data Protection Officer (Section 10). We may need proof of identity before acting on your request.

THIRD-PARTY LINKS

The School may contain links to external websites. Finch Academy is not responsible for the privacy practices or content of those sites. Your use of external sites is at your own risk and subject to their policies.

CHANGES TO THIS POLICY

We may modify this Policy from time to time. The latest version will always be posted in the School with an updated “Effective date”. Continued use of the School after changes are posted constitutes acceptance of the revised Policy.

CONTACT US

Data Protection Officer

Finch Academy Limited

Email: cs@hkfinch.com