Privacy Policy
Effective date: 3 July 2026
This Privacy Policy explains how we ("we", "us", "our", or the "Operator") collect, use, disclose, and protect personal data in connection with the Cert Career website and web application (the "Service"). We handle personal data in accordance with the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486) ("PDPO") and its six Data Protection Principles. Where the EU/UK GDPR applies to visitors in the EEA or UK, the GDPR-specific provisions below apply to them.
1. Who We Are (Data Controller)
The Operator is the data user (PDPO) and data controller (GDPR) responsible for your personal data. Contact details are in Section 14.
2. What Data We Collect
| Category | Examples | Source |
|---|---|---|
| Account data | Email address; authentication identifiers | You, when you create an account |
| Practice / progress data | Questions attempted, answers, scores, mock results, streaks, preferences | Generated as you use the Service |
| Payment data | Transaction records, purchase tier, partial card details — processed by Stripe; we do not store full card numbers | Stripe, when you pay |
| Device / usage data | IP address, browser/device type, pages visited, approximate location, timestamps | Automatically |
| Cookies / local storage | Local progress, session and preference identifiers | Your browser |
| Communications | Emails you send us, including refund/Pass Guarantee claims and documents | You |
For free-tier users without an account, progress data may be stored only locally in your browser (localStorage). We do not intentionally collect special-category data; please do not submit it.
3. How and Why We Use Your Data
To: (a) provide and maintain the Service and save your progress; (b) create/manage your account and authenticate you; (c) process payments and provide purchased access (via Stripe); (d) assess and administer Pass Guarantee and refund claims, including reviewing score reports you submit; (e) communicate with you about your account, purchases, support, and changes; (f) understand and improve the Service, using privacy-friendly, cookieless analytics (Vercel Analytics) that measure aggregate page views and product events (e.g. that a checkout was started) without cross-site tracking, advertising identifiers, or selling data; (g) maintain security and prevent fraud; and (h) comply with legal obligations and enforce our Terms.
4. Legal Bases (GDPR)
Where the GDPR applies: performance of a contract (provide the Service, process purchases, handle claims); legitimate interests (security, improvement, fraud prevention); consent (non-essential cookies and optional communications — withdrawable any time); and legal obligation (accounting/tax). Under the PDPO we collect and use data lawfully and fairly for purposes directly related to our activities, and obtain consent before any new and unrelated purpose.
5. Third-Party Processors and Disclosure
| Processor | Purpose |
|---|---|
| Stripe | Payment processing (handles card data under its own policy) |
| Vercel | Hosting / infrastructure and cookieless analytics (may process IPs and request logs) |
| Clerk | Account authentication |
| Neon | Database hosting (account, purchase-access and progress records) |
| Meta (Facebook) Pixel | Advertising measurement for our own ad campaigns only (whether an ad led to a visit or purchase). Our advertising does not target the EEA/UK; if you browse from there, no consent-requiring advertising cookies are intended to apply to you — contact us with any concerns. |
We may also disclose data to comply with law, to enforce our Terms or protect rights, or in connection with a merger/sale. We do not sell your personal data.
6. Cookies and Local Storage
We use cookies and browser localStorage to keep you logged in, remember preferences, and store progress. Strictly necessary storage operates the Service. Where required, we request consent for non-essential cookies; you can manage cookies in your browser. Disabling some storage may affect functionality (e.g. saved progress).
7. Data Retention
- Account and practice data — while your account is active and a reasonable period after; then deleted or anonymised.
- Payment/transaction records — retained for accounting, tax, and audit (typically up to 7 years).
- Refund/Pass Guarantee claim records — retained to administer the claim and any related dispute.
- Locally stored (browser) data — remains on your device until you clear it.
8. Your Rights
Under the PDPO (all users): request access to, and correction of, the personal data we hold about you. We respond within the statutory 40 days; a reasonable fee may apply to a Data Access Request as permitted by the PDPO. Under the GDPR (EEA/UK visitors): access, rectification, erasure, restriction, portability, objection, and withdrawal of consent; and the right to lodge a complaint with your supervisory authority. We respond within one month.
9. International Transfers
We are based in Hong Kong, and our processors may be located in or transfer data to other jurisdictions (including the US). For EEA/UK personal data transferred to a country without an adequacy decision, we use appropriate safeguards such as the EU Standard Contractual Clauses (and the UK IDTA/Addendum where applicable). You may request a copy of the relevant safeguards.
10. Security
We use reasonable technical and organisational measures (encryption in transit, access controls, reputable processors). No system is completely secure, and we cannot guarantee absolute security.
11. Children
The Service is not directed at children. We do not knowingly collect personal data from children under 16 (or the applicable age) without verified parental consent. Contact us if you believe a child has provided us data.
12. Third-Party Sites
We are not responsible for the privacy practices of third-party sites the Service links to (including Microsoft's). Please review their policies.
13. Changes to This Policy
We may update this Policy; we will update the "Effective date" and, for material changes, provide notice where reasonable. Continued use indicates acceptance.
14. Contact and Data Protection Officer
For any privacy questions, requests, or formal notices, contact us at support@certcareer.com. Hong Kong residents may also contact the Office of the Privacy Commissioner for Personal Data (PCPD); EEA/UK visitors may contact their local authority.