PRIVACY POLICY & DATA PROTECTION STATEMENT

Last Updated: October 23, 2026

This Privacy Policy and Personal Data Protection Statement explains how Korean Cultural Center in Hong Kong ("the Organization", "we", "us", or "our") collects, uses, protects, and manages your personal data when you interact with our portal, register for events, reserve venue facilities, subscribe to publications, or participate in community programs.

We are committed to respecting your privacy in strict compliance with the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong ("PDPO").

1. DATA CONTROLLER & DATA PROCESSOR ROLES

1.1 Data Controller Identity: Korean Cultural Center in Hong Kong acts as the primary Data Controller determining the purposes and means of processing personal data collected in connection with all events, venue reservations, member records, surveys, volunteer shifts, and organizational communications conducted on this portal.

1.2 Data Processor Role: The independent technological software platform and cloud infrastructure provider acts strictly as a neutral Data Processor (or Data Intermediary) processing attendee registrations, account credentials, and ticket states solely on behalf of, under the documented instructions of, and to fulfill services commissioned by Korean Cultural Center in Hong Kong.

2. CATEGORIES OF PERSONAL DATA COLLECTED

We collect only the personal information strictly necessary to deliver community experiences and manage attendance:

2.1 Identity & Contact Details: Name, email address, telephone numbers, and language preferences required for registration, ticket issuance, and emergency communications.

2.2 Attendance & Check-in Telemetry: Ticket verification records, timeslot bookings, dynamic QR validation timestamps, session check-ins, and volunteer hours.

2.3 Age Verification Records: Where an event is subject to statutory or venue-enforced age restrictions (e.g., 18+ adult admission), birth date verification is processed strictly to confirm entry qualification.

2.4 Voluntary Preferences & Surveys: Voluntary responses to community questionnaires and feedback submissions provided at your discretion to help improve future programming.

3. LEGAL BASES & PURPOSES OF PROCESSING

We process personal data only when supported by valid legal grounds:

3.1 Contractual Performance: Processing registrations, issuing ticket barcodes, managing timeslot capacities, and delivering critical operational updates (such as venue instructions or inclement weather notifications).

3.2 Legitimate Organizational Interests: Preventing duplicate bookings, verifying fair ballot allocations, protecting venue safety, and compiling aggregated attendance statistics.

3.3 Consent-Based Direct Communications: Delivering community newsletters or upcoming program previews only where you have provided explicit opt-in consent. You may withdraw marketing consent at any time via a single-click unsubscribe link.

3.4 Legal Compliance: Fulfilling statutory accounting, audit, tax, or emergency public health directives.

4. SUBPROCESSORS, CLOUD INFRASTRUCTURE & COMMUNICATIONS

4.1 Certified Cloud Hosting: To deliver reliable and secure digital reservations, Korean Cultural Center in Hong Kong utilizes certified cloud software and database infrastructure operating under strict technical and organizational safeguards (including data encryption at rest and role-based access isolation).

4.2 Transactional Delivery Infrastructure: Personal contact details (such as email addresses and phone numbers) are processed through dedicated transactional delivery providers strictly to dispatch registration confirmations, digital QR passes, calendar notifications, security verification codes, and critical event updates.

4.3 Tokenized Payment Processing: If an event or booking requires payment, payment processing is handled exclusively through PCI-DSS Level 1 compliant tokenized payment gateways (such as Stripe). Neither Korean Cultural Center in Hong Kong nor the platform software infrastructure ever receives, processes, or stores raw payment card numbers.

4.4 No Secondary Commercial Use: All authorized subprocessors are bound by data processing agreements and strict statutory confidentiality covenants prohibiting any secondary commercial monetization, profiling, or unauthorized disclosure of attendee data.

5. COOKIES, LOCAL TOKENS & SESSION TELEMETRY

5.1 Essential Operation Cookies: We use only essential session cookies and temporary queue tokens (such as ticket state tokens) necessary to maintain secure logins, authenticate ticket requests, and prevent denial-of-service traffic.

5.2 Zero Third-Party Advertising Trackers: We do not deploy third-party advertising pixels, behavioral tracking networks, or commercial analytics trackers on this portal.

6. ZERO COMMERCIAL SALE & DISCLOSURE POLICY

6.1 Zero Commercial Sale: We never sell, rent, lease, or monetize your personal data to third parties, advertisers, or data brokers.

6.2 Restricted Disclosure: Personal data is disclosed only to authorized service personnel on a need-to-know basis, or when required by enforceable judicial order, subpoena, or statutory regulation.

7. DATA RETENTION & ARCHIVAL CYCLES

7.1 Retention Schedule: Personal data is retained only for as long as necessary to administer active event registrations, maintain active membership standing, or satisfy statutory accounting and audit retention mandates.

7.2 Automated Archival: Expired event records and obsolete registration logs are systematically purged or permanently anonymized in accordance with institutional data retention schedules.

8. STATUTORY PRIVACY RIGHTS & SELF-SERVE DATA EXPORT

8.1 Your Legal Rights: Under applicable data protection law, you have the right to request access to, correction of, or erasure of your personal data, as well as the right to restrict or object to processing, free of charge.

8.2 Self-Serve Personal Data Export: Registered users can initiate and download a complete, machine-readable export of their personal account data directly through the self-service privacy export interface at the bottom of this page.

8.3 Revocation of Consent: You may withdraw consent for promotional communications at any time without affecting the lawfulness of processing carried out prior to withdrawal.

9. TECHNICAL & ORGANIZATIONAL SECURITY MEASURES

9.1 Encryption Standards: All web traffic and data transmissions are secured with modern Transport Layer Security (TLS 1.3). Sensitive stored data is protected with industry-standard AES-256 encryption at rest.

9.2 Access Isolation: Internal access to attendee registries is protected by role-based access control, strict session authentication, and automated rate limiting against automated attacks.

10. MINORS' PRIVACY, INQUIRIES & SUPERVISORY AUTHORITIES

10.1 Protection of Minors: We do not knowingly collect personal data from children under sixteen (16) without verifiable parental or guardian consent.

10.2 Inquiries and Response Windows: To exercise any of your data protection rights, or if you have questions regarding this policy, please contact our privacy representative at [info@kcchk.kr](mailto:info@kcchk.kr). We respond to verified statutory requests within thirty (30) calendar days.

10.3 Supervisory Authority: You retain the statutory right to lodge a complaint or inquiry with the Office of the Privacy Commissioner for Personal Data, Hong Kong (PCPD).