This Privacy Policy (the “Policy”) informs you of the practices regarding the collection, use, and retention of personal data (“Data”) by [Company Name], a [Entity Type, e.g., limited liability company] with its registered office at [Company Address] (“Company”, “We”, or “Us”).

​

This Policy applies to Data collected through our website [Your Website URL] (the “Site”) and our mobile application (the “Mobile App”), collectively referred to as the “Solution”.

​

We regularly update this Policy to ensure compliance with applicable data protection laws, including the General Data Protection Regulation (GDPR). Any changes will be communicated via appropriate in-app or website notifications.

​

Our Data Protection Officer / Privacy Lead can be reached at [Insert Email, e.g., privacy@yourdomain.com].

 

1. Data Collected

Depending on how you interact with our Solution, we may collect the following categories of Data:

• Identification Data: Name, date/year of birth, gender, email address, phone number, profile photo, and demographic preferences.

• Economic & Financial Data: Transaction details, payment histories, and subscription status for services purchased.

• Browsing & Technical Data: IP address, browser type, device information, operating system, log files, and usage statistics.

​

2. How Data Is Collected

We collect Data through direct interactions and automated technologies:

• Direct Interactions: Creating an account, filling out intake/preference forms, subscribing to updates, or contacting support.

• Automated Technologies: Cookies, tracking pixels, and performance analytics tools during your interaction with the Solution.

​

3. Why and How Long Do We Retain Your Data?

We process and store your personal data only for as long as necessary to fulfill the specific purposes outlined below:

​

Core Service & Account Management

• Purposes: User registration, user matching, and managing reservations with partner venues.

• Legal Basis: Execution of contract.

• Retention Periods:

  • Account Data: Retained for as long as your account remains active. If your account is inactive for 2 years, your data will be deleted after sending a reactivation email.

  • Login Logs: Kept for 6 to 12 months.

  • Legal Proof Archiving: Certain contract data may be archived for 5 years after account deletion for evidentiary purposes.

  • Making reservations with partner restaurants: In the case of an inactive account for 2 years, your personal data will be deleted if no response is received to our reactivation email.

 

 Business Management & Accounting

• Purposes: Managing partner/supplier relationships, contract generation, and legal accounting.

• Legal Basis: Legitimate interest & Legal obligations.

• Retention Periods:

  • Business Data: Kept for the duration of the contractual relationship.

  • Invoices & Accounting Documents: Archived for 10 years to comply with regulatory standards.

 

App Security & Analytics

• Purposes: Security monitoring, solution availability tracking, solution improvement and website/app usage statistics.

• Legal Basis: Legitimate interest.

• Retention Period: 2 years from the date of collection.

​

Marketing & Communications

• Purposes: Direct prospecting, sending newsletters, and managing incoming customer inquiries.

• Legal Basis: Legitimate interest.

• Retention Periods:

  • Existing Customers: Duration of the business relationship + 3 years after termination.

  • Prospects: 3 years from the last recorded contact.

​

Privacy Rights & Compliance

• Purposes: Verification and processing of user privacy rights requests.

• Legal Basis: Legal obligation.

• Retention Period: Identity verification proofs are retained only for the exact time required to confirm identity. For invoices: invoices are archived for a period of 10 years.

 

Cookies & Tracking Technologies

• Purposes: Visitor measurement, user experience optimization, browsing behavior estimation, and search acceleration.

• Retention Periods:

  • Audience Measurement Cookies: Up to 6 months.

  • Other Cookies & Trackers: Up to 13 months.

  • (You can view our complete Cookie Policy at app.timeleft.com)

​​​​​

4. Data Processors & Third-Party Sharing

Your Data is processed internally by authorized personnel and shared with trusted service providers to run our operations, including infrastructure providers, analytics tools, communication platforms, and customer support engines.

 

5. Data Security

We employ administrative, technical, and physical safeguards—including firewalls, encryption, and strict access controls—to protect Data from unauthorized access, loss, or alteration. You are responsible for keeping your login credentials confidential.

 

6. Your Rights

Under the Hong Kong Personal Data (Privacy) Ordinance (PDPO), you hold the following rights regarding your personal data:

• Data Access: Request confirmation of whether we hold your personal data and receive a copy of such data.

• Data Correction: Request that we correct any inaccurate or incomplete personal data we hold about you.

• Opt-Out of Direct Marketing: You have an absolute right to object to or withdraw your consent for direct marketing communications at any time, free of charge.

How to Exercise Your Rights

To exercise any of your rights, please submit a written request to us at [Insert Support/Privacy Email].

Processing & Operational Guidelines

• Identity Verification: To protect your privacy and security, we may request proof of identity before processing your access or correction request.

• Response Timeline: In accordance with the PDPO, we will respond to your request within 40 calendar days of receiving your written request and identity verification.

• Administrative Fees: As permitted under Section 28 of the PDPO, we reserve the right to charge a reasonable fee (not excessive) to cover administrative costs directly incurred in processing a Data Access Request. Direct marketing opt-outs are always free of charge.

• Legal Exemptions: In certain circumstances permitted by law (e.g., if fulfilling the request would disclose another individual's personal data), we may refuse a Data Access or Correction Request. If a request is refused, we will notify you in writing with the reasons within 40 days.

 

7. Child Safety & Exploitation Prevention

We maintain a zero-tolerance policy regarding Child Sexual Abuse and Exploitation (CSAE) or Child Sexual Abuse Material (CSAM). Any activity or content violating minor safety standards will result in immediate termination of the account, preservation of evidence, and reporting to relevant enforcement authorities, such as the National Center for Missing and Exploited Children (NCMEC) or local law enforcement. Reports can be submitted to [Insert Safety Email, e.g., safety@yourdomain.com].