How CoachLinking collects, uses, shares, transfers, retains and protects personal data. 1. Data user and privacy contact Coach Linking Limited is the data user responsible for CoachLinking. Its registered office, business correspondence address and formal service address are House B3, 10 Mount Davis Road, Hong Kong. Privacy complaints and personal-data access, correction or deletion requests may be sent to support@coachlinking.com for the attention of the Hong Kong Privacy Contact. 2. Data we collect Depending on the service, we collect names, email addresses, phone numbers, account and user identifiers, preferred language, profile and participant details; coach identity, qualification, verification and payout information; approximate lesson/resort location; booking, payment, points, refund, dispute, purchase and settlement records; messages, media, reviews, support and safety records; device and push identifiers; authentication, IP, security, performance and diagnostic data; and consent/version evidence. Payment card details are entered with the payment provider and are not stored in full by CoachLinking. 3. Sources Data comes from you, a parent or booking organiser, coaches, counterparties to an order, authentication and payment providers, device and platform providers, support communications, resorts or verification sources you direct us to, and technical use of the service. We may derive fraud, risk, order-state and service-quality signals from these records. 4. Purposes, required data and consequences Required data is used to create and secure accounts; verify coaches; search, message, book and deliver lessons; process payment, points, refunds and coach settlement; provide notifications and support; prevent fraud and abuse; resolve disputes; maintain audit and financial records; comply with law; and maintain service reliability. Required fields are identified in the relevant flow. If required data is not provided, the related account, booking, payment, payout, support or safety function cannot be provided. Optional profile fields and marketing choices may be declined. 5. Recipients and processors We disclose data only as reasonably necessary to the relevant student, guardian or coach; authorised CoachLinking staff, professional advisers and insurers; payment, authentication, database/storage, hosting/deployment, email and mobile-notification providers; verification and support providers; and regulators, courts or law-enforcement bodies where lawfully required. Current service providers include Supabase, Vercel, Stripe, Brevo, Expo, Firebase Cloud Messaging and Apple Push Notification service. We do not sell personal data and do not use it for third-party targeted advertising. 6. Cross-border processing CoachLinking, users and service providers may process data outside Hong Kong, including in locations used by the listed providers and in Japan where lessons are delivered. We use data minimisation, access controls, provider contracts and other safeguards appropriate to the processing. A provider may use approved subprocessors. Data is not represented as remaining solely in Hong Kong. 7. Service messages and direct marketing Order, security, dispute, refund and account messages are service communications. Promotional email, push or similar direct marketing is sent only after a separate opt-in where required, identifies CoachLinking and provides a free and simple withdrawal method. Withdrawal applies prospectively and does not erase transaction records or stop essential service messages. 8. Cookies, SDKs and device storage CoachLinking uses authentication, security, session, preference and operational storage and the SDKs needed for payment, push delivery, diagnostics and reliable operation. We do not use advertising trackers. Where a non-essential analytics technology requires consent under applicable law, it will not be activated before that consent is obtained. Browser or device settings may control some storage, but disabling necessary storage may prevent sign-in or other functions. 9. Retention and deletion We keep personal data no longer than reasonably necessary for the stated purpose, legal obligations and establishment or defence of claims. Transaction, accounting, tax, settlement, refund, dispute and consent evidence may be retained for up to seven years after the relevant transaction or account closure where reasonably required. Active account and profile data is kept while the account operates; after a valid deletion request it is deleted or de-identified unless needed for unresolved orders, safety, fraud, legal hold or another lawful purpose. Restricted backups age out under the backup cycle. 10. Access, correction and deletion requests Subject to the Personal Data (Privacy) Ordinance, a person may request access to and correction of personal data and may be asked to verify identity. A fee permitted by law may apply to an access request. Deletion requests are assessed against outstanding transactions, safety, fraud, accounting, legal-hold and other lawful retention needs. Requests should identify the account and the right being exercised and be sent to the privacy contact in section 1. 11. Children People under 18 may not create or control an account. A parent or lawful guardian may provide only the minor information reasonably needed for a booking and safety, remains responsible for the booking and should supervise communications. We do not knowingly use a minor’s personal data for direct marketing. A guardian may contact us about access, correction or deletion, subject to identity, authority and lawful-retention checks. 12. Security and incidents We use role-based access, restricted storage, authentication, encryption in transit, logging and transaction controls appropriate to the service. No system is completely secure. Suspected incidents are assessed, contained and documented, and affected persons or authorities are notified where the facts and applicable law require. 13. Policy changes and language The displayed version, content hash and effective date identify this statement. Material changes receive notice and, where appropriate, fresh consent; previous consent evidence remains immutable. The English version prevails if translations conflict, to the extent permitted by mandatory law.