What this covers
Everything the directory receives about an identifiable living person: through browsing, through a submitted listing, through a review, through a report, through a takedown request, or through an ordinary email. If a piece of information can be tied back to somebody — on its own or next to something else that is reasonably available — this page applies to it.
Whoever decides why and how that data is handled is called the operator here. Its particulars and a working privacy address are published before the site opens properly. Where Hong Kong's Personal Data (Privacy) Ordinance applies, that party is the data user under it.
What arrives, and where from
| What | For example | Where it comes from |
|---|---|---|
| Request logs | IP address, timestamp, the page asked for, browser and device string, security events | Your browser and the server itself |
| Browser storage | The age confirmation, saved profiles, interface and session preferences | Cookies and local storage on your own device |
| Listing material | Nickname, photographs, declared facts, contact channels, verification video | The advertiser or whoever submits for them |
| Reviews and reports | Scores, review text, the address complained about, moderation notes | Reviewers, reporters and affected people |
| Correspondence | Your email address, what you wrote, what you attached, what was answered | Whoever writes to the directory |
Nothing on that list includes identity documents, banking credentials or intimate evidence, and none of it should be sent unasked. If a specific request genuinely needs one more thing, that one thing is what gets asked for.
What it is used for
- Serve the pages, remember the state you asked for and keep the site standing up.
- Assess, publish, correct and unpublish listings and reviews.
- Answer support, privacy, rights and legal messages.
- Catch spam, faked reviews, abuse, break-in attempts and people coming back after a ban.
- Keep a proportionate record of decisions, and meet obligations the law imposes.
- Measure how the site performs and how it is used, where that measurement is switched on.
A new purpose that has nothing to do with those needs its own lawful basis and, where the law requires it, a clear yes from the person concerned. Saying nothing is not saying yes, and a pre-ticked box is not consent either.
Who else sees it
The companies that keep the site running: hosting, content delivery, security, email, backups, and professional advisers when one is needed. Each gets what its job requires and no more, under a contract that binds it to the same limits.
Data can also leave under a law, a court order or a valid demand from an authority; to protect somebody from serious harm; or to bring, answer or defend a legal claim. Each of those is weighed for the situation in front of us rather than treated as a standing excuse.
And the obvious one: a published listing and an approved review are public because that is the point of them. Once a field is public, search engines index it and strangers copy it, and neither is something anyone here can undo.
How long it stays, and how it is guarded
It depends on the data. Public material lasts while the listing or review is eligible to be shown. An email thread lasts while the matter it concerns is open. Records of decisions and security events last longer, because they are what stops a banned listing returning and what answers a lawful question later. Anything that has outlived its reason is deleted or stripped of identifying detail where that can be done.
Protection means the unglamorous things: restricted access, encrypted transport, backups, patched software, accounts holding the least privilege that works, and a plan for the day something is accessed, lost or disclosed when it should not have been. No site on the internet can call itself perfectly secure, and this one does not.
What you can ask for
- Ask what personal data is held about you and get a copy of it.
- Ask for something inaccurate to be corrected, and for a reason if it is refused.
- Withdraw a consent you gave, which stops future use without unpicking what was lawful before.
- Ask for data to be restricted or erased where its purpose has run out or it was published without authority.
- Refuse direct marketing, if any is ever introduced.
- Clear your own browser storage at any time, accepting that saved profiles and preferences go with it.
A request needs just enough detail to find the data and to show it concerns you. The removals and corrections page shows how to give that much without handing over a folder of things nobody needs.
Where to write, and who to go to next
Start with the privacy channel on the contact page, which shows whether it is live. Include the address of the page, what the data is, and what you want done with it. An unredacted pile of documents is not required and is not welcome.
The Office of the Privacy Commissioner for Personal Data publishes what the Ordinance requires, how access and correction work and how to complain. Writing here first is a courtesy, not a condition — that route stays open either way.
Working draft · last read through on 29 July 2026