We may update this Policy due to legal, regulatory, technical, service or operational changes. The revised version will state its last-updated date and be published through the Platform or another appropriate method.
If a change introduces a new purpose, direct marketing or a material effect on data-subject rights, we will provide appropriate notice and obtain express consent where legally required. Continued use alone will not replace consent required for a new purpose or direct marketing.
Policy Updates
Where the Platform provides an account-deletion function, a member may submit a request according to the procedure then displayed.
Account deletion does not necessarily mean immediate deletion of every record. We may restrict and retain data necessary for legal obligations, dispute handling, fraud prevention, security or legal rights for the period permitted by law.
You may withdraw consent for a non-essential purpose. Withdrawal does not affect processing lawfully carried out before withdrawal. If data is necessary for a particular service, withdrawal may prevent us from continuing that service.
Account deletion or withdrawal does not require deletion of information that has already been genuinely anonymised and can no longer reasonably identify you.
Account Deletion and Withdrawal of Consent
Access and Correction
Subject to the Ordinance, you may ask whether we hold your personal data, request a copy, and request correction of inaccurate personal data.
Requests must be made in writing to the Privacy Contact below and contain sufficient information for identity verification and identification of the relevant records.
We may charge a fee that is not excessive where permitted by law and will notify the requester before processing. If we lawfully refuse all or part of a request, we will provide reasons where required and keep the required refusal record.
Security and CMS Export Controls
We take all reasonably practicable administrative, technical and physical measures to protect personal data against unauthorised or accidental access, processing, erasure, loss or use.
Measures may include authentication, role-based and least-privilege access, administrator and system operation logs, controls over data export and download, maintenance, backup and monitoring, staff confidentiality requirements, and appropriate processor contracts.
Exported personal data files generated through the Platform or CMS may only be retained, used and shared for authorised business purposes, stored in approved locations with access restrictions, and securely deleted when no longer required.
Electronic systems cannot be guaranteed absolutely secure. If a personal data incident occurs, we will investigate, contain and remediate it and consider notification having regard to the nature of the incident, possible harm and applicable requirements.
Where exported files include copyright works, content, trademarks, images, reports or other protected materials, their use remains subject to the Copyright Policy, Terms of Use and any applicable Merchant Terms.
We retain personal data only for as long as reasonably necessary to fulfil the relevant purpose of collection or for a period required or permitted by law.
Retention periods are determined by the purpose, whether the account, booking, merchant or support relationship remains active, complaint or legal-claim needs, fraud and security risks, regulatory or audit requirements, and reasonable backup or disaster-recovery needs.
We maintain an internal retention schedule covering accounts, bookings, Platform usage, merchant onboarding, operation logs, exported files, direct marketing consent and other principal records.
At the end of the applicable period, we take practicable steps to securely delete the personal data or convert it into a form that cannot reasonably identify an individual. Genuinely anonymised information may be retained for the purposes described in Sections 7, 7A and 7B.
Retention and Deletion
We take all reasonably practicable steps to ensure that personal data is accurate for the purposes for which it is used. You should provide accurate information and update account and contact data when it changes.
Where personal data is used for a decision that may materially affect an individual, we take appropriate verification measures where practicable.
Accuracy
Third-Party Services and Cross-Border Processing
The Platform may open or connect to mapping, communications, telephone, email, calendar or other third-party services. Those services are independently operated and their privacy policies apply.
Personal data may be processed outside Hong Kong where our service architecture or suppliers require this. Where cross-border processing occurs, we take practicable steps to provide protection comparable to that required under this Policy and applicable law, including appropriate contractual, access-control and security measures having regard to the circumstances.
We disclose or transfer personal data only where reasonably necessary for a notified purpose, with valid consent, or where permitted or required by law.
Recipient classes may include your selected merchant; hosting, communications, customer support, security, technical or data-processing service providers acting for us; legal, accounting, insurance and other professional advisers; parties involved in a bona fide restructuring, merger, acquisition or business transfer subject to appropriate obligations; and courts, regulators or law-enforcement bodies.
We do not sell personally identifiable personal data. This does not restrict the provision or licensing of genuinely anonymised, de-identified or aggregated reports or data products under Sections 7A and 7B.
Where a data processor handles personal data for us, we use contractual or other practicable means to require appropriate retention and security controls.
Disclosure and Transfer
We use personal data for direct marketing only after providing the information required by the Ordinance and obtaining the required consent. Before obtaining consent, we inform you of the intended use, the kinds of personal data to be used, the classes of marketing subjects and your right to require us, free of charge, to stop such use.
Marketing subjects may include Open Beauty Platform features, membership services and campaigns; beauty, skincare and personal-care services; promotional offers from participating merchants; and wellness, lifestyle and related consumer services specifically described in the consent interface.
Direct marketing consent is separate from acceptance of service terms, is not pre-selected, and is not inferred from silence. If we propose to provide personal data to another person for direct marketing, we will separately provide the statutory written notice and obtain the consent required by law.
You may opt out at any time and free of charge through the unsubscribe method in a marketing communication, applicable account or notification settings, or by contacting our Privacy Contact. Opting out does not stop essential account, booking, security or service communications.
Direct Marketing
Personalised Content and Automated Analysis
Where the Platform offers personalisation, we may use preference and interaction data provided or generated within notified purposes to adjust merchants, campaigns or content shown within the Platform. Personalised recommendations are for reference only and are not a guarantee that a merchant, service or treatment is suitable for you.
Nothing in this Policy prevents Open Beauty from using genuinely anonymised, de-identified, aggregated or statistical information for machine learning, artificial intelligence development, recommendation systems, analytics, Platform optimisation or product and service development.
Any use of personal data for material artificial intelligence training or automated analysis remains subject to the Ordinance and requires an assessment of purpose, necessity, transparency, retention, security and any applicable notice or consent requirements.
Open Beauty may generate market research reports, merchant insight reports, consumer trend reports, location-demand analysis, industry intelligence reports, Platform statistics, benchmarking reports and other data products based solely on anonymised, de-identified or aggregated information.
Such reports or data products may be provided, licensed or made available to merchants, business partners, investors, advertising partners, advisers, research organisations and other lawful recipients.
No personal data identifying, or reasonably capable of identifying, an individual will be disclosed through such reports or data products. Recipients may be subject to contractual restrictions against attempted re-identification, unauthorised combination with other datasets, onward disclosure and use outside the agreed purpose.
Nothing in this Policy transfers ownership of any copyright or intellectual property rights in reports, data products or analytics outputs except as expressly stated in the Terms of Use or Copyright Policy.
Market Insight Reports and Data Products
Platform Intelligence and Analytics
Open Beauty may create, analyse, use, retain and commercialise aggregated, statistical, anonymised or de-identified information derived from Platform activities, provided that such information does not identify and is not reasonably capable of identifying any individual.
Such information may be used for Platform optimisation, merchant analytics, market and location-demand analysis, recommendation systems, benchmarking, advertising-effectiveness measurement using non-identifiable information, product and service development, machine learning and artificial intelligence development, and other lawful business, research and operational purposes.
Before releasing or licensing such information, we will take reasonably practicable steps to assess and reduce re-identification risk, taking account of the data, recipients, intended use and available safeguards.
The ownership, licensing and intellectual-property treatment of reports, analytics outputs, market insights, statistical summaries and other Platform Content may also be governed by the Terms of Use and the Copyright Policy.
We may analyse Platform usage and operational data to improve services, understand overall trends, evaluate Platform or campaign performance, improve search and recommendation functions, and prepare business and market insights.
Where reasonably practicable, we use aggregated or anonymised data. Anonymised data means information that, after reasonable processing, cannot reasonably be used to identify an individual. Coded, hashed or pseudonymised information that can still be re-identified remains personal data.
We may use genuinely anonymised or non-re-identifiable aggregated information for Platform statistics, market trends, merchant or campaign-level insights, industry research, benchmarking and product or service improvement.
We may own lawful intellectual property and commercial rights in database design, analytical methods, models, statistical reports and genuinely anonymised derivative outputs. This does not affect statutory rights in data that remains personal data.
Analytics, Aggregation and Anonymisation
Purposes of Use
We may use personal data to create, verify and administer accounts; provide search, merchant display, favourite, booking and campaign functions; transfer booking information reasonably required by the selected merchant; send account, booking, security and operational communications; provide support; provide enabled location or district functions and personalisation; maintain, test, improve and secure the Platform; detect fraud, abuse and unauthorised access; conduct audit and access-control management; perform statistics and trend analysis without directly identifying individuals where practicable; comply with law; and establish, exercise or defend legal rights.
If we wish to use personal data for a new purpose not directly related to the original purpose of collection, we will give notice and obtain prescribed consent where required by the Ordinance.
We indicate at the collection point whether provision of data is mandatory or voluntary. If required information is not provided, we may be unable to create or verify an account, process a booking, provide a requested function or respond to an enquiry.
Non-essential data collected for recommendation, interest analysis or direct marketing is voluntary. Refusal to provide such data will not affect core services unrelated to that data.
Mandatory and Voluntary Data
Personal data may be obtained directly from you, generated when you use the Platform, provided by your device with permission, supplied by a merchant involved in your booking or service interaction, provided by service providers acting for us, or obtained from another source permitted by law.
A merchant or other person submitting another individual’s personal data must ensure that it has appropriate authority and has provided the required notice to that individual.
Sources of Personal Data
Personal Data We Collect
Depending on your role and the functions you use, we may collect identity and contact data; account and verification data; booking and interaction data; location or district data; Platform usage data; device, network and security data; preference data; customer-support communications; and merchant or merchant-representative information, including business registration documents.
Examples include name, telephone number, email address, membership identifier, login and account status, appointment details, attendance records, favourites, campaign participation, searches, browsing, clicks, IP address, login records, device or application information and operation logs.
We will not collect excessive personal data merely by relying on broad future business needs. If a new function requires a material new category of data, we will provide an appropriate notice at or before collection and seek consent where required by law.
Scope
This Policy applies when we process personal data in connection with account registration and login, merchant searches and interactions, bookings, campaigns, location and personalisation features, customer support, merchant onboarding, CMS administration, security, audit and Platform analytics.
This Policy does not govern third-party services independently controlled by other organisations. Their own privacy policies apply when you use those services.
About this Policy
OPENBEAUTY LIMITED (“Open Beauty”, “we”, “us” or “our”) operates the Open Beauty mobile application, related websites, content management system and associated services, collectively referred to as the “Platform”. We are the data user in respect of personal data collected through the Platform.
This Privacy Policy explains how we collect, hold, process, use, disclose, protect and delete personal data, and how data subjects may exercise their rights.
We handle personal data in accordance with the Personal Data (Privacy) Ordinance (Cap. 486 of the Laws of Hong Kong) (the “Ordinance”), the Data Protection Principles and other applicable requirements.
This Policy should be read together with our Terms of Use, Merchant Terms, Copyright Policy and any Personal Information Collection Statement provided at a specific collection point.