Privacy Policy

Effective Date: 13 April 2026

1. Introduction and Company Information

This Privacy Policy explains how Harbour Peak Hiking Co. (“we”, “us”, “our”) collects, uses, stores, discloses, and otherwise processes personal data in connection with our hiking, outdoor activity, tour, booking, customer support, and related services.

We are committed to protecting your privacy and handling your personal data in accordance with the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong (“PDPO”) and, where applicable, the data protection principles and related guidance issued by the Privacy Commissioner for Personal Data, Hong Kong.

Company name: Harbour Peak Hiking Co.
Address: Unit 1208, 12/F, Harbour Centre, 25 Harbour Road, Wan Chai, Hong Kong
Email: [email protected]
Phone: +852 2867 4593

2. Data Collection and Processing

We may collect and process the following categories of personal data, depending on how you interact with us:

• Identity and contact information: name, email address, phone number, postal address, emergency contact details.
• Booking and service information: booking details, preferred hiking routes, group size, participation dates, special requests, dietary preferences, and service history.
• Payment information: billing details, transaction records, and limited payment-related information. We generally do not store full card details where payment is processed by a third-party payment provider.
• Health and safety information: relevant medical conditions, allergies, fitness level, mobility limitations, emergency information, and other information necessary to assess suitability for hiking activities and ensure safety.
• Identification information: passport or identity document details where required for booking, insurance, permits, or legal compliance.
• Technical and usage data: IP address, device information, browser type, cookies, log data, and website interaction data.
• Communications: emails, messages, feedback, complaints, survey responses, and customer support correspondence.
• Photographs and video: images or recordings taken during hikes or events, where consent is obtained or where otherwise permitted by law.

We may collect personal data directly from you, from your authorised representatives, from booking platforms, from payment processors, from insurance providers, or from other third parties where lawful and appropriate.

If you provide personal data relating to another person, you should ensure that you have the authority to do so and that they are aware of this Privacy Policy.

3. Purpose of Data Processing

We process personal data for the following purposes:

• to provide, manage, and administer our hiking and related services;
• to process bookings, payments, cancellations, refunds, and customer requests;
• to assess participant suitability, safety, and emergency preparedness for hiking activities;
• to communicate with you about your bookings, service updates, and customer support;
• to comply with legal, regulatory, insurance, and record-keeping obligations;
• to manage risk, prevent fraud, and protect the safety and security of participants, staff, and property;
• to improve our services, website, operations, and customer experience;
• to conduct marketing and promotional activities, where permitted by law and subject to your preferences;
• to handle complaints, disputes, and legal claims;
• to maintain internal administration, accounting, and business records.

4. Legal Basis for Processing

Under Hong Kong law, personal data should be collected for a lawful purpose directly related to our functions or activities and should be adequate but not excessive in relation to that purpose. We process personal data on the following bases, as applicable:

• Performance of a contract: where processing is necessary to provide our services, manage bookings, or take steps at your request before entering into a contract.
• Consent: where you have given clear consent, for example for certain marketing communications, optional health disclosures, or use of photographs and video in promotional materials where required.
• Legal obligation: where processing is necessary to comply with applicable laws, regulations, court orders, or lawful requests from authorities.
• Legitimate interests: where processing is necessary for our legitimate business interests, such as service improvement, fraud prevention, safety management, and internal administration, provided that such interests are not overridden by your rights and interests.
• Vital interests: where processing is necessary to protect the vital interests of you or another person, particularly in emergency or safety situations during hiking activities.

5. Data Sharing and Third Parties

We do not sell your personal data. We may share personal data with third parties only where necessary and lawful, including:

• Service providers: booking systems, payment processors, email service providers, cloud hosting providers, IT support, customer relationship management providers, and analytics providers.
• Guides, instructors, and operational partners: where needed to deliver hiking services safely and effectively.
• Insurance providers: for coverage, claims handling, and risk management.
• Professional advisers: lawyers, accountants, auditors, and consultants.
• Authorities and regulators: where required by law or where disclosure is necessary to protect rights, safety, or property.
• Emergency services and medical personnel: in the event of an emergency or safety incident.

We require third parties who process personal data on our behalf to protect it and to use it only for the purposes we specify, subject to applicable law and contractual safeguards.

6. Data Transfer to Third Countries

Some of our service providers or business partners may be located outside Hong Kong. As a result, your personal data may be transferred to, stored in, or accessed from jurisdictions outside Hong Kong, including countries that may have different data protection laws.

Where we transfer personal data outside Hong Kong, we will take reasonable steps to ensure that the recipient provides a standard of protection comparable to that required under the PDPO, including through contractual protections, security measures, and due diligence where appropriate.

7. Storage Duration

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required or permitted by law.

• Booking and service records: retained for the duration of the customer relationship and for a reasonable period thereafter.
• Accounting and tax records: retained for the period required by applicable law and business practice.
• Health and safety records: retained for as long as necessary to manage safety, incidents, claims, and legal obligations.
• Marketing data: retained until you opt out or withdraw consent, subject to periodic review.
• Website and technical logs: retained for a limited period necessary for security, troubleshooting, and analytics.

When personal data is no longer required, we will take reasonable steps to securely delete, anonymise, or destroy it.

8. User Rights

Subject to applicable law, you may have the following rights in relation to your personal data:

• Access: request confirmation of whether we hold your personal data and obtain a copy of that data.
• Rectification: request correction of inaccurate or incomplete personal data.
• Erasure: request deletion of your personal data in certain circumstances, subject to legal and operational retention requirements.
• Restriction: request that we restrict the processing of your personal data in certain circumstances.
• Data portability: request a copy of certain data in a structured, commonly used, machine-readable format where applicable and technically feasible.
• Objection: object to processing based on our legitimate interests or to direct marketing.

To exercise any of these rights, please contact us using the details below. We may need to verify your identity before responding. We will respond within a reasonable time and in accordance with applicable legal requirements.

9. Withdrawal of Consent

Where we rely on your consent to process personal data, you may withdraw that consent at any time by contacting us. Withdrawal of consent will not affect the lawfulness of processing carried out before the withdrawal.

If you withdraw consent for certain information, we may be unable to provide some services or features, particularly where the information is necessary for safety, booking administration, or legal compliance.

10. Right to Complain

If you have concerns about our handling of your personal data, please contact us first so that we can try to resolve the matter.

You also have the right to lodge a complaint with the Office of the Privacy Commissioner for Personal Data, Hong Kong if you believe your personal data has been handled in a way that breaches applicable privacy laws.

11. Data Security

We implement reasonable technical and organisational measures designed to protect personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures may include access controls, encryption, secure storage, staff confidentiality obligations, and regular review of security practices.

However, no method of transmission over the internet or electronic storage is completely secure. While we strive to protect your personal data, we cannot guarantee absolute security.

12. Contact Information

If you have any questions, requests, or complaints regarding this Privacy Policy or our handling of personal data, please contact us:

Harbour Peak Hiking Co.
Unit 1208, 12/F, Harbour Centre, 25 Harbour Road, Wan Chai, Hong Kong
Email: [email protected]
Phone: +852 2867 4593

13. Changes to Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, legal requirements, or operational needs. Any revised version will be posted on our website with an updated effective date.

We encourage you to review this Privacy Policy periodically. Your continued use of our services after any changes become effective constitutes your acknowledgment of the updated policy, to the extent permitted by law.