Privacy Policy
HKBU InfoDay 2026 Privacy Policy
This policy explains how Hong Kong Baptist University (“HKBU”, “we”, “us”) handles personal data in the HKBU InfoDay 2026 mobile app and web app (the “App”). It supplements HKBU’s Privacy Policy Statement and Personal Information Collection Statement (“PPS/PICS”). If there is any inconsistency, the PPS/PICS prevails.
1. Scope and controller
The App is operated by HKBU for HKBU Information Day 2026. HKBU is the controller of the personal data described in this policy. The App is intended for Information Day visitors, prospective students and other members of the HKBU community.
This policy applies to the App and to the services that support it. It does not apply to third-party websites or services that you open from the App, such as an external social media page or an email client. Those services have their own privacy policies.
2. Data we collect
We collect only the data needed to run the App. The table below explains what we collect and how it reaches us.
| Data | What it includes | How it is collected |
|---|---|---|
| Account details | Your name, email address and an account identifier generated by our service. The account identifier is not your email address. | You enter your name and email address when you create an account. The account identifier is generated when the account is created. |
| Sign-in and security data | A keyed hash of your email address, a hashed one-time code, the time the code was requested, its expiry time, the number of attempts and the number of requests in the current rate-limit window. | Generated when you request a login code. We do not store the six-digit code in readable form. |
| Saved events | The identifiers of events you mark as favourites. | Collected when you tap the save or favourite button while signed in. |
| Data stored on your device | Your name, email address, optional visitor role, saved favourites and sign-in token. | Stored locally by the App so that you can stay signed in and see your profile and favourites. It is removed when you log out or delete your account. |
| Location (on-device only) | Your device’s precise or approximate location. | Read only after you grant location permission. The App uses it to show your position on the campus map. It is not sent to HKBU and is not stored on our servers. |
| Map tile requests | Your IP address, the map tiles requested, and standard request metadata. | Sent to our map tile providers (OpenStreetMap or CARTO) when the map loads. The App does not send your GPS coordinates to them. |
| Technical logs | IP address, request time, requested URL and error details. | Generated by our hosting, database and security infrastructure when you use the App, for operation and security purposes. |
We do not collect your contacts, photos, health data, financial information or advertising identifiers. We do not use advertising, analytics or cross-app tracking SDKs. We do not sell your personal data.
3. How we use your data
- To create and manage your account, and to identify you when you sign in.
- To send you a one-time login code by email. We use Microsoft Azure Communication Services Email to deliver the code; Microsoft processes your email address for that purpose.
- To keep you signed in and to display your profile.
- To save, sync and display your favourite events and itinerary.
- To show your position on the campus map, using location on your device only.
- To operate, secure and troubleshoot the App, prevent abuse, enforce rate limits and investigate errors.
- To comply with HKBU policies, applicable law and lawful requests from authorities.
- To communicate with you about your account or the service.
We do not use your data for advertising, marketing, profiling or tracking across other apps or websites. The only emails we send for the App are transactional messages such as login codes and account or security notices.
4. Consent and your choices
We handle personal data in accordance with the Personal Data (Privacy) Ordinance (PDPO) of Hong Kong and HKBU’s PPS/PICS. By creating an account, you consent to the collection and use described in this policy.
You can browse public event information without an account. An account is required for features such as saving favourites. You can withdraw your consent at any time by deleting your account. If you withdraw consent, you may no longer be able to use account-based features.
You can also control location and camera access in your device settings. Denying location permission does not prevent you from using the rest of the App; the map will simply not show your position.
5. Sharing and service providers
We share personal data only as needed to run the App:
- Microsoft Azure. We use Azure Container Apps for hosting, Azure DocumentDB for the database, Azure Blob Storage for media, and Azure Communication Services for email delivery. Microsoft processes data on our behalf under its agreements with HKBU. See the Microsoft Privacy Statement.
- Map tile providers. The map uses tiles from OpenStreetMap or CARTO. When the map loads, your device sends those providers your IP address and the requested tile coordinates, but not your GPS coordinates. See the OpenStreetMap Foundation privacy policy and the CARTO privacy policy.
- HKBU units and authorised staff. Staff who need the data for Information Day administration, support, security or compliance may access it on a need-to-know basis.
- Authorities and legal recipients. We may disclose data if required by law, a court order, a regulator or a lawful request, or to protect the rights, safety and security of HKBU, users or others.
Service providers are required to protect personal data and to use it only for the services they provide to HKBU. We do not sell, rent or trade personal data, and we do not share it with advertising or tracking partners.
6. Location and camera
Location
Location access is optional. If you grant permission, the App reads your device’s location to show your position on the campus map and to help you find nearby buildings. The location is processed inside the App on your device. It is not sent to HKBU, stored in your account or linked to your identity.
When the map is displayed, your device requests map tiles for the area on screen from OpenStreetMap or CARTO. Those requests include your IP address and the requested tile coordinates. The App does not include your GPS coordinates in those requests. You can revoke location permission at any time in your device settings.
Camera
The App includes a camera permission for QR code scanning. If you use QR scanning, the camera image is processed on your device and is not uploaded or stored by us. The current version does not use the camera to collect personal data. You can revoke camera permission at any time in your device settings.
7. Retention and account deletion
We keep your account details and saved events for as long as your account is active. You can delete your account at any time from within the App:
Profile → Settings → Delete Account → Delete. The account is deleted immediately. You do not need to contact staff or send an email.
Deleting your account removes:
- your account record, including your name, email address and account identifier;
- your saved favourites; and
- the profile data, favourites and sign-in token stored by the App on your device.
One-time login codes are valid for 10 minutes and are stored only as hashes. We retain limited request metadata (such as request times, attempt counts and rate-limit information) for security and abuse prevention. Technical logs and backups may be retained for a limited period in accordance with HKBU’s retention policies, and may be disclosed only where required by law or for security investigations.
If you delete your account, you can create a new account later with the same email address. Data that has been deleted cannot be recovered.
8. Security
We use technical and organisational measures to protect personal data, including HTTPS/TLS for data in transit, encryption of email addresses in our database, hashed one-time codes, access controls and monitoring. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
If you believe your account or data has been compromised, contact us immediately at 334jupas@hkbu.edu.hk.
9. Your rights
Under the PDPO, you have the right to:
- request access to the personal data we hold about you;
- request correction of inaccurate personal data;
- request deletion of your account and associated personal data;
- withdraw your consent, subject to legal or contractual restrictions; and
- complain to the Privacy Commissioner for Personal Data, Hong Kong.
The quickest way to delete your account is the in-app path above. For access, correction or other requests, contact 334jupas@hkbu.edu.hk or use HKBU’s Personal Data Access Request process. We may need to verify your identity before acting on a request.
You can also contact the Privacy Commissioner for Personal Data, Hong Kong.
10. International transfers
HKBU is based in Hong Kong. Microsoft Azure and Azure Communication Services may process data in data centres outside Hong Kong. Where data is transferred outside Hong Kong, we require service providers to apply protections consistent with the PDPO and HKBU’s PPS/PICS. You can contact us for more information about the safeguards used.
11. Children
The App is intended for Information Day visitors and prospective students. It is not directed at children under 13, and we do not knowingly collect personal data from children under 13. If you believe a child has provided personal data to us, contact us and we will take appropriate steps.
12. Changes to this policy
We may update this policy from time to time. The “Last updated” date at the top of this page will change. Material changes will be notified in the App or on this page. Continued use of the App after an update means you accept the updated policy.
13. Contact us
For questions about this policy or your personal data, contact the HKBU Information Day 2026 team:
- Email: 334jupas@hkbu.edu.hk
- HKBU Privacy Policy Statement and Personal Information Collection Statement: bupdpo.hkbu.edu.hk