Privacy Policy

This Privacy Policy explains how Confa Limited ("Confa," "we," "us," or "our") collects, uses, discloses, stores, and protects your personal data. Please read this Policy carefully before using our services; your use of the services constitutes your agreement to all terms herein.

Preamble

  • Confa operates its services from Hong Kong. Our registered office is at Rm A, 19/F, Max Share Centre, 367–373 King’s Road, North Point, Hong Kong.
  • This Policy is drafted in accordance with the Hong Kong Personal Data (Privacy) Ordinance ("PDPO"), the European Union General Data Protection Regulation ("GDPR"), and other applicable laws and regulations.

Scope of Data Collection

2.1 General Personal Data

  • Registration information: full name, email address, phone number, password
  • Transaction details: order number, payment amount, date and time of transaction, payment method (stored by third-party payment provider)
  • Travel preferences: itinerary preferences, preferred transportation modes, budget range, accommodation habits
  • Technical data: IP address, cookies, device identifiers, browsing behavior
  • Live location information: GPS and positioning services, used to provide itinerary suggestions, nearby services, and real‑time notifications.

2.2 Special-Category Data (collected only with your explicit consent)

  • Health-related information (e.g., insurance claims, medical requirements)
  • Children’s data (collected only where consent is obtained from a parent or legal guardian for users under 18)

Methods of Data Collection

  • Data you provide directly when registering, placing orders, completing forms, or using features
  • Automatic collection via cookies and similar tracking technologies
  • Data collected automatically by third-party services (e.g., Google Analytics, Firebase)
  • When you authorize the platform to access location services, we will collect and use your live location information.

Purposes of Data Use

  • Deliver and maintain core platform features: itinerary listing, booking, payment, AI guidance, collaborative planning, budget management
  • Process orders, payments, and customer support requests
  • System maintenance, fraud prevention, and risk management
  • Provide live location–related features, such as nearby transportation, accommodation, activity recommendations, and safety notifications
  • Personalized itinerary suggestions and marketing communications (only with your consent)
  • Aggregated, de-identified data for trend analysis and statistical research
  • Legal retention and disclosure as required by law

Data Sharing and Disclosure

  • Third-party payment processors (e.g., Stripe, PayPal): essential order information
  • Operational partners (transportation, accommodation, event providers): affiliate order details with your consent
  • Government, regulatory, or law-enforcement authorities: when legally required
  • Marketing service providers: promotional materials and offers with your consent (you may unsubscribe at any time)

Cross-Border Data Transfer

  • Our primary servers are located in Hong Kong, and your personal data is generally stored there.
  • If business needs require us to transfer your data outside of Hong Kong, we will do so in compliance with the PDPO and Standard Contractual Clauses ("SCCs") recommended by the Hong Kong Privacy Commissioner, and will implement technical and organizational measures equivalent to those described in this Policy to ensure your information remains protected.
  • You understand that courts, regulators, or law-enforcement agencies in those other jurisdictions may gain lawful access to your data under local procedures.

Data Security and Breach Notification

  • We employ industry-standard safeguards including SSL/TLS encryption, access controls, firewalls, and regular security audits.
  • In the event of a data breach likely to affect your rights, we will notify you and the Hong Kong Privacy Commissioner within 72 hours as required by law.

Cookies and Tracking Technologies

We use three categories of cookies:

  • Necessary cookies (essential for platform operation)
  • Functional cookies (enable enhanced features)
  • Analytical/Marketing cookies (support analytics and promotional activities)

You may disable cookies via your browser or platform settings, but some features may become unavailable.

Data Retention Periods

  • Account and profile data: retained for two years after account deletion
  • Transaction and financial records: retained for at least seven years in accordance with Hong Kong law
  • Anonymized data: retained indefinitely for statistical analysis

Your Rights

Under the PDPO and the GDPR, you have the right to:

  • Access, review, and obtain a copy of your personal data
  • Rectify or erase incomplete or inaccurate data
  • Request restriction of processing or cessation of data use (including marketing)
  • Withdraw consent at any time (particularly for special-category data and marketing)
  • Portability of your data to another service provider
  • Lodge a complaint with a supervisory authority

Children and Minors

Registration is limited to individuals aged 18 or older. If under 18, you must obtain prior consent from a parent or guardian and provide a written consent form.

Policy Updates

We may update this Policy from time to time. We will post changes and update the "Last Updated" date on this page and may notify you by email or in-platform messaging. Your continued use of our services after any amendment constitutes your acceptance of the revised Policy.

Contact Information

  • Confa Limited
  • Rm A, 19/F, Max Share Centre
  • 367–373 King’s Road, North Point
  • Hong Kong
  • Email: [email protected]

Last Updated: January 16, 2026