開學

Privacy Policy

Version: 1.0.0 Last updated: 26 August 2026

This Privacy Policy is available in English and Traditional Chinese. In the event of any inconsistency, the English version shall prevail.

SchoolTime is committed to protecting your personal data. This policy is prepared in accordance with the Personal Data (Privacy) Ordinance (Cap. 486, Laws of Hong Kong) and the six Data Protection Principles (DPP 1–6).

1. Scope

This policy applies to personal data collected through the SchoolTime platform at schooltime.hk, including our website and any future mobile applications.

2. Personal Data We Collect

We collect personal data through the following means:

  • Google Account sign-in: Name, email address, profile photo, and Google account identifier. Your profile photo may be publicly displayed alongside your reviews. We do not request access to your contacts or any other Google data beyond what is listed here.
  • User-submitted content: School reviews, ratings, display name
  • Automatically collected: IP address, browser type, device information, browsing activity, pages visited, referral URL

3. Purpose of Collection (DPP 3)

We use your personal data for the following purposes:

  • Providing and managing your account
  • Publishing and moderating school reviews
  • Sending transactional emails (verification, moderation notifications)
  • Improving the platform through aggregated, non-identifiable analytics
  • Enforcing our Terms of Service and Content Policy
  • Complying with legal obligations

We will not use your personal data for any purpose other than those stated above, or a directly related purpose, without your prior voluntary consent.

4. Google API Services — Limited Use Disclosure

SchoolTime's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

  • We only request the minimum scopes necessary for authentication (email, name, Google ID).
  • We do not use Google user data for serving advertisements.
  • We do not transfer Google user data to third parties except as necessary to provide or improve the platform, as required by law, or as part of a merger, acquisition, or asset sale with prior notice.
  • We do not use Google user data to establish creditworthiness or for lending purposes.
  • A human can review Google user data only when necessary for security purposes, to comply with applicable law, or when the data has been aggregated and anonymised.

5. Data Storage and Cross-Border Transfer

Your data is stored at the following locations:

Service Location Purpose
Neon PostgreSQL Singapore (ap-southeast-1) Primary database
Vercel United States (edge network) Website hosting and serverless functions
Resend United States Transactional email delivery
Upstash Redis United States Rate limiting and session management

Your personal data may be transferred to and processed in jurisdictions outside Hong Kong as listed above. We take reasonable steps to ensure that any such transfer complies with the requirements of DPP 3 and that the data remains protected to a standard comparable to the PDPO. These steps include selecting service providers with demonstrated privacy commitments and limiting the data transferred to what is necessary for each service's function.

6. Data Sharing

We do not sell your personal data. We share data only in the following circumstances:

  • With the third-party service providers listed above, only as necessary to perform their services
  • When required by law or in response to lawful requests by public authorities
  • To protect the rights, property, or safety of SchoolTime, its users, or the public

7. Cookies and Tracking

This platform uses essential cookies required for authentication and session management, and limited cookies set by our advertising partner (Google AdSense) for frequency capping and reporting purposes.

Advertising: We display non-personalised, contextual advertisements via Google AdSense. These ads are selected based on page content and your general geographic region — not your browsing history, personal interests, or any data from your SchoolTime account. We do not share any personal data with advertising providers. Google may set cookies for ad frequency capping and aggregate reporting; these cookies do not enable behavioural tracking or personalised advertising on this platform. You can manage your ad preferences and opt out of ad personalisation at Google Ad Settings.

We do not use third-party analytics tools or behavioural tracking cookies.

8. Data Retention (DPP 2)

  • Account data: Retained for the duration of account activity. Deleted within 30 days of account deletion request.
  • Published reviews: Retained in anonymised form after account deletion. Author identifiers are removed; review text and ratings are preserved.
  • Moderation audit logs: Retained for 3 years for legal compliance, then deleted.
  • Rate-limiting records: Deleted after 24 hours.
  • Authentication tokens: Deleted on logout or after session expiry.

Personal data is not retained longer than is necessary for the purpose for which it was collected.

9. Data Security (DPP 4)

We take reasonable steps to protect your personal data against unauthorised or accidental access, processing, erasure, loss, or use. These measures include:

  • Encryption in transit: All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher.
  • Encryption at rest: Database connections use SSL. Neon PostgreSQL encrypts data at rest using AES-256.
  • Access controls: Administrative access to production data is restricted to authorised personnel only, using multi-factor authentication.
  • Content moderation: All user-submitted reviews are subject to pre-publication moderation to prevent disclosure of personal data (including under s.64(3A) of the PDPO).
  • Rate limiting: API endpoints are rate-limited to prevent abuse and data scraping.
  • Security headers: HTTP security headers (HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy) are enforced on all responses.

10. Your Rights (DPP 6)

Under the Personal Data (Privacy) Ordinance, you have the right to:

  • Access (DAR): Request access to your personal data held by us. We will respond within 40 days of receiving your request.
  • Correction (DCR): Request correction of inaccurate personal data. We will make corrections within 40 days of receiving your request.
  • Deletion: Request deletion of your account and associated personal data. Personal data will be removed within 30 days. Published reviews will be anonymised, not deleted, as described in Section 8.

We may charge a reasonable fee to cover the cost of complying with a data access request.

To exercise these rights, please contact our Data Protection Officer at the address below.

11. Direct Marketing

We do not use your personal data for direct marketing purposes. If we intend to do so in the future, we will obtain your prior express consent.

12. Children

SchoolTime is not directed at persons under 18 years of age. We do not knowingly collect personal data from persons under 18. If we become aware that a user is under 18, we will terminate their account and delete their personal data.

13. User-Generated Content and Reviews

Reviews submitted to SchoolTime are published on the platform and are publicly accessible. You should not include personal data of third parties in your reviews. Reviews that identify individual teachers or staff members by name may constitute a criminal offence under s.64(3A) of the Personal Data (Privacy) Ordinance (maximum penalty: HKD 1,000,000 fine and 5 years imprisonment) and will be removed.

Published reviews are retained in anonymised form after account deletion, consistent with the licence granted in our Terms of Service.

14. Data Breach Notification

In the event of a personal data breach that is likely to result in a real risk of significant harm to affected individuals, we will notify the Privacy Commissioner for Personal Data and affected individuals without undue delay.

15. Changes to This Policy

We may update this policy from time to time. When we make material changes, we will notify registered users by email and update the "Last updated" date above. Continued use of SchoolTime after the updated policy takes effect constitutes acceptance of the changes.

16. Contact Us

Data Protection Officer Email: privacy@schooltime.hk SchoolTime 開學