Privacy Policy

Effective Date: October 23, 2026

1. Who We Are

HKSM (HK School of Management) operates the website hksmnow.com. We provide online education for working professionals. For GDPR purposes, HKSM is the data controller.

2. Information We Collect

Information you provide:

  • Name (first and last) — for account identification and responding to contact requests
  • Email address — for login, communications, and replying to contact requests
  • Password — stored as an irreversible hash, never in plain text
  • Marketing preferences — whether you want to receive emails from us
  • Contact-form message — the information you choose to provide when contacting HKSM. Please do not include passwords, payment information, or other sensitive personal details.
  • Course purchases — when you buy a course on hksmnow.com: the email address and name you give at checkout, the course purchased, the order and transaction reference, the amount and currency paid, and the status of your account set-up, course enrolment and purchase email. We never receive or store your full card number or other payment-card details.

Information collected automatically:

  • IP address — recorded at registration, login, and consent changes for security purposes
  • Browser and device information — for security and audit logging
  • Login attempts — for rate limiting and fraud prevention (retained 90 days)
  • Session data — to keep you logged in (retained 30 days after last activity)
  • LMS course data — for tracking your progress and interactions with our learning management system
  • Other information — as necessary for the operation of our services, including processing payments by 3rd party payment service provider.

Consent audit log: We maintain a permanent record of your marketing consent choices and any changes. This includes timestamp, IP address, browser, and the choice made. This log exists to demonstrate legal compliance and is never deleted.

3. How We Use Your Information

  • Provide your account (legal basis: contract) — name, email, password
  • Send verification and password reset emails (legal basis: contract) — email
  • Deliver courses you buy (legal basis: contract) — name, email and order details. After a purchase we use the checkout email to find your HKSMNow account, or create one and email you a link to set your password, then create your course account at courses.hksmnow.com if needed, enrol you in the course, and email you access instructions
  • Purchase records, refunds and accounting (legal basis: legal obligation and legitimate interest) — order details and the checkout email
  • Respond to contact requests (legal basis: legitimate interest or steps requested by you) — name, email address, and message
  • Security and fraud prevention (legal basis: legitimate interest) — IP, login attempts, session data
  • Prevent contact-form abuse (legal basis: legitimate interest) — session data and reCAPTCHA verification information
  • Compliance and audit (legal basis: legal obligation) — consent log
  • Educational marketing emails (legal basis: consent) — email, name
  • Promotional marketing emails (legal basis: consent) — email, name
  • Website analytics (legal basis: legitimate interest) — anonymized browsing data, no cookies
  • Website analytics (legal basis: consent) — browsing data, using cookies if you provide consent

4. Cookies

Essential cookies (always active):

  • hksm_session — keeps you logged in (duration: 2 hours)

We do not use analytics cookies. Our analytics system (Matomo) operates without cookies and with anonymized IP addresses, so no consent is required.

Marketing cookies (require your consent):

  • mautic_device_id, mtc_id — our marketing system, links your browsing to your account if you register (duration: persistent)

You can manage marketing cookie preferences using our cookie banner or your browser settings.

5. Third-Party Services

Matomo Analytics (self-hosted): We use Matomo for website analytics, hosted on our own servers at hksmnow.com. This system operates without cookies and anonymizes IP addresses. All data remains within our infrastructure with no third-party sharing.

Google reCAPTCHA: Our registration, contact, and other abuse-sensitive public forms may use Google reCAPTCHA v3 to prevent automated abuse. When you interact with a protected form, Google may process device and interaction information to evaluate whether the request appears legitimate. See Google's Privacy Policy and Terms of Service.

Google Gmail: Contact-form submissions are delivered to an HKSM-operated Gmail inbox. Google therefore processes the name, email address, and message included in the submission as our email service provider. See Google's Privacy Policy and Terms of Service.

Mautic and Amazon SES: We use self-hosted Mautic to manage marketing-email preferences and campaigns. We use Amazon Simple Email Service (Amazon SES) to deliver educational and promotional emails. These services may process your name, email address, marketing preferences, email content, and delivery information such as delivery failures, bounces, or unsubscribe status, solely to send and manage our marketing communications.

GoDaddy: Our website and database are hosted by GoDaddy in the United States.

Others: Our website may rely on other service providers that are not explicitly listed here. Should you have any questions about these services, please contact us.

Payment Processing: If you purchase any products or services, we share your payment information with a third-party payment processor to facilitate the transaction. Refer to their privacy policy for more details.

Paddle (direct purchases): Courses, digital books and other digital products bought on hksmnow.com are sold through Paddle (Paddle.com and its affiliates), which acts as reseller and Merchant of Record. Paddle runs the checkout, collects your payment details, billing country and postal code and the email you enter, calculates and collects sales tax, and issues your receipt and invoice. Paddle shares with us your email, your name where provided, the order details and the payment status, and any email-preference choices you make before checkout; it does not share your full card details with us. Paddle processes your information under its own Privacy Policy.

HKSM Courses (courses.hksmnow.com): When you buy a course, we send your name, email address and HKSMNow account reference to our course platform to create your course account (if you do not already have one) and enrol you in the course you bought.

6. Marketing Emails

We send two types of marketing emails — only if you opt in:

  • Educational content: Free tips, course updates, industry insights
  • Promotional offers: Discounts, new course announcements, special offers

You can change your educational and promotional marketing-email preferences at any time using the preference link in a marketing email or from your HKSMNow account page. You may unsubscribe from either category or both.

When you buy a course while not signed in, you can choose these preferences before checkout and confirm or change them on the purchase confirmation page. Both are optional and unticked unless you choose them.

We also send transactional emails (verification, password reset, and course purchase and access emails) which are required for your account and purchases to function and don't require consent.

7. Data Retention

  • Account data — until you request deletion
  • Consent audit log — permanent (legal requirement)
  • Failed login attempts — 90 days
  • Successful login attempts — 30 days
  • Sessions — 30 days after last activity
  • Expired verification/reset tokens — 7 days after expiry
  • Contact-form submissions — not stored in the HKSM website database; email copies are retained only as long as reasonably necessary to respond, maintain appropriate business records, resolve disputes, or meet legal obligations
  • Payment information — as required for transaction processing and compliance
  • Course purchase records (order details and the email used at checkout) — kept after account deletion for as long as needed for refunds, disputes, tax and accounting, and to meet legal obligations

8. Your Rights

Depending on your location, you may have the right to:

  • Access your personal data
  • Correct inaccurate data
  • Delete your account and data
  • Export your data
  • Object to processing based on legitimate interest
  • Withdraw consent for marketing
  • Payment information is managed by our payment processor (not us)

To delete your courses (Learning management platfrom) or export your data: Visit your courses account profile page.

To delete your account or export your data: Visit your account settings page.

To update marketing preferences: Visit your account settings page or click unsubscribe in any email.

To manage marketing cookies: Use the cookie banner or your browser settings.

Account deletion notice: Deleting your account is permanent and cannot be reversed. We cannot restore a deleted account. Account deletion does not itself request a refund or cancel a purchase. For purchase or refund questions, contact us with your order details; your applicable refund and consumer rights remain in effect. Certain data may be retained where required by law, including consent records (for legal compliance) and transaction records (for tax and accounting purposes). Course purchase records, including the email used at checkout, are not deleted with your account; Paddle also keeps its own records of your purchase as the seller.

Separate course app: Learning records and materials are delivered through courses.hksmnow.com, which has its own app and data. Deleting your HKSMNow account does not itself delete that app's account or data. Delete the account and data you want removed there before deleting your HKSMNow account.

For other privacy requests, please contact us. We will respond within 30 days.

9. Data Security

We protect your data using:

  • Password hashing (bcrypt)
  • HTTPS encryption
  • Secure, HTTP-only session cookies
  • CSRF protection on all forms
  • Rate limiting on login attempts
  • Invisible reCAPTCHA, honeypot, timing checks, and session-based throttling on the contact form
  • Payment information is managed by our payment processor (not us)

10. International Transfers

Your data is stored in the United States (GoDaddy hosting). Marketing-email delivery information may also be processed by Amazon Web Services in the Amazon SES region we select to provide the service. Purchase and payment information is processed by Paddle, which may process it outside your country. If you are in the EU/UK, transfers are protected by Standard Contractual Clauses with our service providers.

11. Children

Our services are for adults and working professionals. We do not knowingly collect data from anyone under 16.

12. Changes to This Policy

We will update this policy as our practices change. Material changes will be announced via email or website notice.

13. Contact

For privacy questions or to exercise your rights, please contact us.

For more information about our privacy practices, if you have questions, or if you would like to make a complaint, please contact us.

Contact Us