Canvas Academy Privacy Policy

1. Introduction

Canvas Hair and Beauty Academy ("Canvas Academy", "we", "our", or "us") is committed to protecting the privacy and personal data of our students, prospective students, website visitors, and all other individuals who interact with us. This Canvas Academy privacy policy explains how we collect, use, store, and ensure personal data protection for your information in accordance with the Personal Data (Privacy) Ordinance (Cap. 486) of the Laws of Hong Kong Special Administrative Region ("PDPO"), maintaining the highest standards of beauty school privacy Hong Kong.

By accessing our website at canvashair.org, contacting us via WhatsApp, email, or phone, or enrolling in any of our courses, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and use of your personal data as described herein.

2. Information We Collect

We may collect the following types of personal data:

2.1 Information You Provide Directly

• Contact Information: Name, email address, phone number, WhatsApp number, and mailing address.
• Enrolment Information: Date of birth, educational background, employment status, course preferences, and payment details.
• Communication Records: Messages, enquiries, and feedback you send to us via WhatsApp, email, phone, or our website contact form.
• Student Records: Attendance records, assessment results, certificates issued, and course completion status.
• Portfolio Content: Photographs and videos of student work created during courses (with your consent).

2.2 Information Collected Automatically

• Website Usage Data: IP address, browser type, device information, pages visited, time spent on pages, and referring URLs.
• Cookies and Similar Technologies: We use cookies and similar tracking technologies to enhance your browsing experience and analyse website traffic. See Section 7 for more details.
• Analytics Data: Aggregated and anonymised data about website usage patterns to help us improve our services.

3. How We Use Your Information

We use the personal data we collect for the following purposes:

• Course Administration: Processing enrolments, managing class schedules, tracking attendance, issuing certificates, and communicating course-related information.
• Customer Service: Responding to your enquiries, providing course consultations, and addressing any concerns or complaints.
• Marketing and Promotions: Sending you information about new courses, workshops, promotions, and events that may be of interest to you (with your consent, where required).
• Website Improvement: Analysing website usage to improve our online content, user experience, and service offerings.
• Legal Compliance: Complying with applicable laws, regulations, and legal processes.
• Business Operations: Managing our internal operations, including financial reporting, quality assurance, and staff training.

4. How We Share Your Information

We do not sell, rent, or trade your personal data to third parties. We may share your information in the following limited circumstances:

• Service Providers: We may share data with trusted third-party service providers who assist us in operating our website, processing payments, sending communications, or performing other business functions. These providers are contractually obligated to protect your data and use it only for the purposes we specify.
• Legal Requirements: We may disclose your information if required by law, regulation, legal process, or governmental request.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your personal data may be transferred as part of the transaction, subject to the same privacy protections.
• With Your Consent: We may share your information for purposes not described in this policy with your explicit consent.

5. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable laws and regulations. Student records, including course completion and certificate information, may be retained for a longer period to support alumni services and verify qualifications. When personal data is no longer needed, we will securely delete or anonymise it.

6. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include encryption of data in transit, secure storage systems, access controls, and regular security reviews. However, no method of transmission over the Internet or electronic storage is completely secure, and we cannot guarantee absolute security.

7. Cookies and Tracking Technologies

Our website uses cookies and similar technologies to:

• Remember your preferences and settings
• Analyse website traffic and usage patterns
• Improve website performance and user experience
• Provide relevant content and recommendations

You can manage your cookie preferences through your browser settings. Please note that disabling certain cookies may affect the functionality of our website.

8. Your Rights

Under the PDPO, you have the following rights regarding your personal data:

• Right of Access: You may request access to the personal data we hold about you.
• Right of Correction: You may request correction of any inaccurate or incomplete personal data.
• Right to Opt-Out: You may opt out of receiving marketing communications from us at any time by contacting us or using the unsubscribe mechanism in our communications.

To exercise any of these rights, please contact us using the details provided in Section 10 below. We will respond to your request within a reasonable timeframe, typically within 40 days as required by the PDPO.

9. Third-Party Links

Our website may contain links to third-party websites, including social media platforms (Instagram, Facebook), messaging services (WhatsApp), and other external resources. We are not responsible for the privacy practices or content of these third-party sites. We encourage you to review the privacy policies of any third-party websites you visit.

10. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. Any changes will be posted on this page with an updated "Last updated" date. We encourage you to review this policy periodically. Your continued use of our website and services after any changes constitutes your acceptance of the updated policy.

12. Governing Law

This Privacy Policy is governed by and construed in accordance with the laws of the Hong Kong Special Administrative Region. Any disputes arising from or in connection with this policy shall be subject to the exclusive jurisdiction of the courts of Hong Kong.

13. Data Protection Principles

At Canvas Academy, we adhere strictly to the core principles of personal data protection. We ensure that all personal data collected is processed lawfully, fairly, and in a transparent manner. We only collect data for specified, explicit, and legitimate purposes related to our educational services and do not further process it in a manner that is incompatible with those purposes. Our commitment to beauty school privacy Hong Kong means we take every reasonable step to ensure that personal data is accurate and, where necessary, kept up to date.

Furthermore, we ensure that personal data is kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed. We process personal data in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.

14. Handling of Sensitive Personal Data

In certain circumstances, we may need to collect sensitive personal data, such as health information or financial details, to provide appropriate accommodations or process payments. We treat this information with the utmost care and apply enhanced security measures to protect it. We will only collect and process sensitive personal data with your explicit consent or where required by law.

Our staff are trained to handle sensitive information confidentially and are subject to strict confidentiality agreements. We regularly review our data handling procedures to ensure they align with the latest best practices in personal data protection and comply with the PDPO.

15. International Data Transfers

While our primary operations are based in Hong Kong, we may occasionally use service providers located outside of Hong Kong to process or store data. When we transfer personal data internationally, we ensure that appropriate safeguards are in place to protect your information in accordance with the PDPO and our Canvas Academy privacy policy.

We carefully select our international partners and require them to implement robust security measures and adhere to strict data protection standards. By using our services, you consent to the transfer of your personal data to these international locations, provided that we maintain the required level of protection.

16. Children's Privacy

Our courses and services are primarily designed for adults. We do not knowingly collect personal data from children under the age of 18 without verifiable parental consent. If we become aware that we have inadvertently collected personal data from a child without appropriate consent, we will take immediate steps to delete such information from our records.

Parents or guardians who believe that their child has provided us with personal data without their consent should contact us immediately. We are committed to protecting the privacy of minors and ensuring compliance with all relevant regulations regarding children's data.

17. Data Breach Notification

In the unlikely event of a data breach that poses a real risk of significant harm to individuals, we have established procedures to respond promptly and effectively. We will notify affected individuals and the relevant regulatory authorities as required by law and our internal policies.

Our incident response plan includes immediate steps to contain the breach, investigate the cause, and implement measures to prevent future occurrences. We believe in transparency and will provide affected individuals with clear information about the nature of the breach, the data involved, and the steps they can take to protect themselves.

18. Employee Training and Awareness

We recognize that technology alone is not sufficient to ensure data security. Therefore, we invest heavily in training our staff on the importance of personal data protection and the specific procedures they must follow to safeguard your information.

All employees undergo regular privacy and security awareness training to stay updated on the latest threats and best practices. This ongoing education helps foster a culture of privacy within our organization, ensuring that your data is handled with the respect and care it deserves.

19. Regular Audits and Reviews

To maintain the highest standards of beauty school privacy Hong Kong, we conduct regular audits and reviews of our data processing activities and security measures. These assessments help us identify potential vulnerabilities and areas for improvement.

We may engage independent third-party experts to evaluate our systems and processes, ensuring that our practices align with industry standards and regulatory requirements. By continuously monitoring and refining our approach to data protection, we strive to provide a secure environment for all our students and stakeholders.