前言

1 Soul Art Academy 重視你及你孩子的私隱。本政策說明我們如何按照香港《個人資料（私隱）條例》（第486章）（下稱「《私隱條例》」）收集、使用、分享及保護你的個人資料。本政策亦作為我們的《收集個人資料聲明》。

2 使用我們的網站 soul-artacademy.com、填寫問卷、購買或使用任何服務，即表示你已閱讀並明白本政策。

1. 我們收集哪些個人資料及收集目的

1.1 身份及聯絡資料： 姓名、電話號碼、電郵地址。目的：建立你的客戶紀錄、發送購買確認及課程登入資料、安排諮詢、提供客戶服務。

1.2 孩子的基本資料： 孩子的年齡及性別。目的：令評估結果、繪畫分析報告及建議切合孩子的成長階段。我們不要求提供孩子的全名、學校或身份證明文件。

1.3 繪畫作品照片： 你及孩子按指示完成的繪畫（例如屋樹人測試）的照片。目的：撰寫繪畫分析報告（PDF）及準備 1 對 1 諮詢。

1.4 問卷回答： 免費兒童情緒及行為評估、親子關係測試及其他問卷的回答。目的：產生評估結果、了解你的需要、為你推薦合適的服務。

1.5 付款資料： 交易金額、日期、購買項目及付款狀態。信用卡號碼等完整付款資料由第三方支付平台（例如 Stripe）直接處理，我們不會看到或儲存你的完整卡號。

1.6 技術資料： IP 位址、瀏覽器類型、瀏覽紀錄及 Cookie 資料（見第 7 條）。目的：維持網站運作、分析網站使用情況及改善服務。

1.7 提供個人資料屬自願性質。但如你不提供第 1.1 至 1.3 條所列資料，我們可能無法向你提供相關服務（例如無法撰寫繪畫分析報告）。

2. 我們如何使用你的資料

2.1 提供服務： 處理訂單、開通課程、安排 1 對 1 視像諮詢、管理 WhatsApp 社群及提供客戶支援。

2.2 撰寫分析報告： 由 Karies 老師親自閱讀繪畫照片及問卷回答，撰寫繪畫分析報告。報告只會發送給下單的家長本人。

2.3 課程推薦及直接促銷： 在取得你的同意後，我們可能使用你的姓名、電話及電郵，透過電郵、WhatsApp 或短訊向你發送課程推薦、優惠及活動資訊。你可隨時回覆「取消訂閱」或聯絡我們，免費停止接收。

2.4 改善服務： 在移除可識別身份的資料後，我們可能以統計或匿名方式分析問卷結果，以改善課程內容。

2.5 教學及宣傳用途： 我們不會在未取得你另行書面同意前，於任何課程、社交媒體或宣傳材料中使用你或孩子的繪畫作品、個案內容或評價。即使取得同意，我們亦會移除可識別身份的資料。

2.6 法律責任： 遵守適用法律、回應執法或監管機構的合法要求。

3. 資料分享對象

3.1 我們不會出售、出租或交換你的個人資料。

3.2 為提供服務，我們會把所需的最少資料交予以下服務供應商（「資料處理者」）：（a）GoHighLevel 及其白標平台 Infinite Sales — 客戶關係管理、表格、電郵及預約系統；（b）Stripe 或其他支付平台 — 處理付款；（c）WhatsApp（Meta）— 客戶溝通及家長社群；（d）視像會議平台 — 1 對 1 諮詢；（e）雲端儲存及網站寄存服務。

3.3 我們會採取合理措施（包括合約條款），要求資料處理者只按我們的指示處理資料，並防止資料被未獲准許地查閱、使用或保留超過所需時間。

3.4 跨境轉移： 上述部分平台的伺服器位於香港以外地區（例如美國）。使用我們的服務，即表示你明白你的資料可能被轉移至香港以外地區處理，而當地的資料保障水平可能與香港不同。

3.5 社交媒體： 如你經 Instagram、Facebook 或 YouTube 與我們互動，該等平台會按其本身的私隱政策處理你的資料。

3.6 在法律要求或法院命令下，我們可能需要向有關當局披露資料。

4. 資料保存期限

4.1 我們只會在達成收集目的所需的期間內保存資料，具體如下（第 4.2 至 4.5 條）。

4.2 繪畫作品照片：分析報告交付後 12 個月內刪除，或在你要求時提早刪除。

4.3 分析報告及諮詢筆記：最後一次服務後保存 2 年，以便你日後跟進或升級課程。

4.4 交易及付款紀錄：保存 7 年，以符合香港稅務及會計法規要求。

4.5 只填寫免費問卷而未購買服務的資料：最後一次互動後 2 年內刪除。

4.6 保存期屆滿後，資料會被刪除或作不可識別身份的處理。

5. 資料安全措施

5.1 我們採取合理的技術及管理措施保護你的資料，包括：網站使用 SSL 加密傳輸；系統帳戶設有密碼及雙重認證；只有 Karies 老師及經授權的團隊成員可查閱繪畫照片及報告；報告只以私人方式發送給家長本人。

5.2 互聯網傳輸無法保證百分百安全。如發生可能影響你的資料外洩事故，我們會在合理可行的情況下盡快通知你及香港個人資料私隱專員公署。

5.3 WhatsApp 社群屬多人群組，群組內其他成員可看到你發出的訊息。請勿在群組內分享孩子的全名、學校、照片或其他敏感資料。

6. 你的權利

6.1 查閱權： 你有權要求查閱我們持有關於你（及你孩子）的個人資料。我們會在收到要求後 40 日內回覆，並可能收取不超乎適度的費用。

6.2 更正權： 如資料不準確，你有權要求更正。

6.3 刪除要求： 你可要求我們刪除你的資料（包括繪畫照片）。除法律要求我們保留的紀錄（例如交易紀錄）外，我們會在合理時間內處理。

6.4 撤回同意： 你可隨時撤回直接促銷同意或第 2.5 條的宣傳用途同意。撤回不影響撤回前已進行的處理。

6.5 如欲行使以上權利，請以第 10 條的聯絡方式提出。為保障你的私隱，我們可能需要核實你的身份。

7. Cookie 及追蹤技術

7.1 我們的網站使用 Cookie 及類似技術，包括：（a）必要 Cookie — 維持網站及付款流程運作；（b）分析 Cookie — 了解訪客如何使用網站；（c）廣告追蹤像素（例如 Meta Pixel）— 衡量廣告成效及向曾瀏覽網站的人士展示相關廣告。

7.2 你可透過瀏覽器設定拒絕或刪除 Cookie。停用必要 Cookie 可能令部分網站功能無法正常運作。

7.3 我們不會把繪畫照片、問卷回答或孩子的資料傳送給廣告追蹤工具。

8. 未成年人資料的特別處理

8.1 我們的服務只供 18 歲或以上的家長或法定監護人購買及使用。兒童不得自行註冊或提交資料。

8.2 提交孩子的繪畫作品照片、年齡、性別或相關問卷回答，即表示你確認你是該孩子的父母或法定監護人，並同意我們按本政策處理該等資料。

8.3 我們鼓勵你在拍攝繪畫作品前，先向孩子說明用途，並尊重孩子的意願。

8.4 孩子的資料只用於為該家庭撰寫報告及提供服務，絕不用於直接促銷、廣告追蹤或對外宣傳。

8.5 請只拍攝畫作本身，避免照片中出現孩子的樣貌、校服、全名或其他可識別身份的資料。如照片中出現該等資料，我們會在處理前予以遮蓋或刪除。

9. 私隱政策的修改

9.1 我們可能不時修訂本政策。修訂版本會在網站公佈，並更新頁首的生效日期。

9.2 如修訂涉及重大改變（例如新的資料用途或分享對象），我們會在生效前最少 14 日以電郵或 WhatsApp 通知你。涉及新的直接促銷用途時，我們會再次徵求你的同意。

本政策如中英文版本有任何歧異，以中文版本為準。

English Version

Introduction

1 Soul Art Academy respects the privacy of you and your child. This Policy explains how we collect, use, share and protect your personal data in accordance with the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong (the "PDPO"). This Policy also serves as our Personal Information Collection Statement.

2 By using our website soul-artacademy.com, completing a questionnaire, or purchasing or using any service, you confirm that you have read and understood this Policy.

1. What Personal Data We Collect and Why

1.1 Identity and contact data: name, phone number, email address. Purpose: to create your customer record, send purchase confirmations and course access details, arrange consultations and provide customer service.

1.2 Basic data about your child: your child's age and gender. Purpose: to make assessment results, drawing analysis reports and suggestions appropriate to your child's developmental stage. We do not ask for your child's full name, school or identity documents.

1.3 Photos of drawings: photos of drawings completed by you and your child as instructed (e.g. the House-Tree-Person test). Purpose: to prepare drawing analysis reports (PDF) and 1-on-1 consultations.

1.4 Questionnaire answers: answers to our free child emotion and behaviour assessment, parent-child relationship assessment and other questionnaires. Purpose: to generate results, understand your needs and recommend suitable services.

1.5 Payment data: transaction amount, date, items purchased and payment status. Full payment details such as card numbers are processed directly by third-party payment platforms (e.g. Stripe); we do not see or store your full card number.

1.6 Technical data: IP address, browser type, browsing activity and cookie data (see Section 7). Purpose: to operate the website, analyse usage and improve our services.

1.7 Providing personal data is voluntary. However, if you do not provide the data listed in Sections 1.1 to 1.3, we may be unable to provide the relevant services (for example, we cannot prepare a drawing analysis report).

2. How We Use Your Data

2.1 Providing services: processing orders, granting course access, arranging 1-on-1 video consultations, managing the WhatsApp community and providing customer support.

2.2 Preparing analysis reports: Karies personally reviews the drawing photos and questionnaire answers to prepare drawing analysis reports. Reports are sent only to the parent who placed the order.

2.3 Course recommendations and direct marketing: with your consent, we may use your name, phone number and email to send you course recommendations, offers and event information by email, WhatsApp or SMS. You may opt out at any time, free of charge, by replying "unsubscribe" or contacting us.

2.4 Improving services: after removing identifying information, we may analyse questionnaire results in statistical or anonymised form to improve our course content.

2.5 Teaching and promotional use: we will not use your or your child's drawings, case details or testimonials in any course, social media or promotional material without your separate written consent. Even with consent, identifying information will be removed.

2.6 Legal obligations: to comply with applicable laws and respond to lawful requests from law enforcement or regulatory authorities.

3. Who We Share Your Data With

3.1 We do not sell, rent or trade your personal data.

3.2 To provide our services, we share the minimum necessary data with the following service providers ("data processors"): (a) GoHighLevel and its white-label platform Infinite Sales — CRM, forms, email and booking; (b) Stripe or other payment platforms — payment processing; (c) WhatsApp (Meta) — customer communication and the parent community; (d) video conferencing platforms — 1-on-1 consultations; (e) cloud storage and website hosting services.

3.3 We take reasonable steps, including contractual terms, to require data processors to process data only on our instructions and to prevent unauthorised access, use or retention beyond what is necessary.

3.4 Cross-border transfer: some of the platforms above have servers outside Hong Kong (e.g. in the United States). By using our services, you understand that your data may be transferred to and processed outside Hong Kong, where data protection standards may differ.

3.5 Social media: if you interact with us through Instagram, Facebook or YouTube, those platforms handle your data under their own privacy policies.

3.6 We may disclose data to authorities where required by law or court order.

4. How Long We Keep Your Data

4.1 We keep data only for as long as necessary to fulfil the purposes for which it was collected, as follows (Sections 4.2 to 4.5).

4.2 Drawing photos: deleted within 12 months after the analysis report is delivered, or earlier on request.

4.3 Analysis reports and consultation notes: kept for 2 years after the last service, to support follow-up or course upgrades.

4.4 Transaction and payment records: kept for 7 years to comply with Hong Kong tax and accounting requirements.

4.5 Data of users who completed only a free questionnaire without purchasing: deleted within 2 years after the last interaction.

4.6 After the retention period, data will be deleted or anonymised.

5. Data Security

5.1 We take reasonable technical and organisational measures to protect your data, including: SSL encryption on our website; password and two-factor authentication on system accounts; access to drawing photos and reports limited to Karies and authorised team members; reports sent privately to the parent only.

5.2 No internet transmission is 100% secure. If a data breach that may affect you occurs, we will notify you and the Office of the Privacy Commissioner for Personal Data, Hong Kong as soon as reasonably practicable.

5.3 The WhatsApp community is a group chat; other members can see your messages. Please do not share your child's full name, school, photos or other sensitive information in the group.

6. Your Rights

6.1 Access: you have the right to request access to the personal data we hold about you (and your child). We will respond within 40 days of receiving your request and may charge a fee that is not excessive.

6.2 Correction: you have the right to request correction of inaccurate data.

6.3 Deletion: you may request that we delete your data, including drawing photos. We will do so within a reasonable time, except for records we must keep by law (such as transaction records).

6.4 Withdrawal of consent: you may withdraw your direct marketing consent or your Section 2.5 promotional consent at any time. Withdrawal does not affect processing carried out before it.

6.5 To exercise these rights, contact us using the details in Section 10. We may need to verify your identity to protect your privacy.

7. Cookies and Tracking Technologies

7.1 Our website uses cookies and similar technologies, including: (a) essential cookies — to operate the website and checkout; (b) analytics cookies — to understand how visitors use the website; (c) advertising pixels (e.g. Meta Pixel) — to measure ad performance and show relevant ads to previous visitors.

7.2 You can refuse or delete cookies through your browser settings. Disabling essential cookies may affect some website functions.

7.3 We do not send drawing photos, questionnaire answers or children's data to advertising tracking tools.

8. Special Protection for Children's Data

8.1 Our services may be purchased and used only by parents or legal guardians aged 18 or above. Children may not register or submit data themselves.

8.2 By submitting your child's drawing photos, age, gender or related questionnaire answers, you confirm that you are the child's parent or legal guardian and consent to our processing of that data under this Policy.

8.3 We encourage you to explain the purpose to your child before photographing their drawing, and to respect their wishes.

8.4 Children's data is used only to prepare reports and provide services for that family, and is never used for direct marketing, advertising tracking or public promotion.

8.5 Please photograph only the drawing itself, avoiding your child's face, school uniform, full name or other identifying details. If such details appear, we will mask or delete them before processing.

9. Changes to This Policy

9.1 We may revise this Policy from time to time. Revised versions will be posted on our website with an updated effective date.

9.2 For material changes (such as new purposes or recipients), we will notify you by email or WhatsApp at least 14 days before they take effect. Where a new direct marketing use is involved, we will seek your consent again.

If there is any inconsistency between the Chinese and English versions of this Policy, the Chinese version shall prevail.

Contact Us

If you have any questions about this Privacy Policy, You can contact us:

By email: support@soul-artacademy.com