Last updated: 4 September 2026

 

This Privacy Policy and Direct Marketing Statement (this “Policy”) is issued by the Institute for City Transformation (“ICT”, “we”, “us”, “our”). It explains how we collect, use, retain, disclose and protect personal data when you visit our website, submit an enquiry or registration form, participate in our courses or activities, or communicate with us. We handle personal data in accordance with the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong (the “PDPO”) and its six Data Protection Principles. This Policy should be read together with our Courses and Activities Terms & Conditions and the Personal Information Collection Statement provided at the point of collection. If those documents are inconsistent concerning our handling of personal data, the provision offering greater protection to the participant will prevail, without affecting any right that cannot lawfully be excluded.

​

We mainly collect your name and preferred name, email address, telephone or messaging contact, postal address (if provided), church or organisation, occupation or ministry role, registration and attendance records, assignments, feedback, and other information you provide in enquiries or forms. Fellows Program applicants may also be asked for information relating to their church life, sending relationships and referees. For payments, we collect the payment method, payer’s name, transaction record or receipt copy, but we do not collect or store credit card numbers. If you voluntarily tell us about a health condition, mobility limitation, food allergy or other accessibility need for an in-person class or site visit, we use that information only to make reasonable arrangements. When you visit our website, we may use cookies or similar technologies to collect your IP address, browser and device information and pages viewed.

 

At the point of application or registration, we identify which data is obligatory or voluntary and the consequences of not providing obligatory data. Identity and contact details, application information directly relevant to selection, and registration and payment details are generally necessary to process an application or registration. Health and accessibility information and direct-marketing consent are voluntary; withholding them does not affect eligibility, although we may be unable to make the relevant special arrangements.

​

We use personal data only for purposes directly related to our functions and activities, including handling enquiries, applications, selection, registration and payment; verifying identity and attendance; arranging classes, groups, in-person sessions and site visits; issuing notices, materials, receipts and certificates; collecting feedback; handling complaints; conducting internal statistics, reporting, audit, administration, website security and fraud prevention; and meeting legal and regulatory obligations. Unless permitted by law, we do not use personal data for a new purpose unrelated to the original purpose without notice and any consent required.

​

To fulfil those purposes, we may provide relevant personal data, on a need-to-know and data-minimisation basis, to speakers, mentors, teaching assistants, ICT staff, host organisations for in-person classes or City Lab visits, payment service providers, auditors, and IT and communications service providers including Wix, Google, Mailchimp and Zoom. We may also disclose data where required by law, court order or a regulator. We do not rely on a general authorisation to disclose data indiscriminately and identify the relevant classes of transferees in the Personal Information Collection Statement provided at collection.

​

For Part VIA of the PDPO, we intend to use your name, email address and telephone or messaging contact to market our courses, lectures, workshops, site visits and public events; publications and research reports; ministry news and newsletters; and fundraising and donation appeals by email (including Mailchimp), WhatsApp, SMS, telephone or post. We do so only after providing the prescribed information and obtaining your separate, explicit consent. Consent is collected through a separate, optional and un-pre-ticked choice. Refusal does not affect your right to apply, register or participate. You may opt out at any time and free of charge through an unsubscribe link or by emailing info@icitytransformation.org with the subject “Opt-out of Direct Marketing”; we act on the request as soon as practicable. We do not provide, transfer or sell your personal data to any third party for that third party’s own direct-marketing purposes.

​

As a general rule, we do not collect HKID numbers or copies, including for short courses, events, conferences and other activities. For the Fellows Program, we may collect an admitted person’s HKID copy solely to confirm their legal Chinese and English names, establish enrolment records and issue certificates. The person may mask the photograph, HKID number and other unnecessary information, provided that both legal names remain clearly visible. Copies are handled only by authorised staff, stored separately, and will not be provided to third parties. We provide a separate Personal Information Collection Statement before collection.

​

We retain personal data only for as long as necessary. Registration, payment and accounting records are generally retained for seven years. Attendance and certificate records are retained as needed to answer enquiries, verify study records or handle disputes, generally for no longer than seven years. Unsuccessful enquiries and general correspondence are generally retained for two years. Unsuccessful Fellows Program application and selection data is generally deleted or anonymised within six months after selection is completed, unless a complaint, dispute or legal obligation requires longer retention. Contact details used for news and marketing are retained until consent is withdrawn. We periodically review retention and securely delete or anonymise data when it is no longer needed.

​

We take all reasonably practicable security measures to protect personal data against unauthorised or accidental access, processing, erasure, loss or use. Measures include need-to-know access, account authentication and permissions, locked paper records and reasonable service-provider review. Some providers may process or store data outside Hong Kong, including in the United States. We notify data subjects of such processing and take reasonably practicable steps, including contractual safeguards and provider security review where appropriate, to maintain a level of protection comparable to Hong Kong. If a personal-data breach occurs, we assess the risk, take remedial action and, where appropriate, notify affected individuals and the Office of the Privacy Commissioner for Personal Data.

 

If we intend to take identifiable photographs, screenshots or recordings for promotional use, we give separate advance notice and obtain consent. Refusal does not affect participation. For course administration, security or internal records, we notify participants in advance, restrict use and access, and provide practicable camera-avoidance arrangements. During site visits, neither participants nor ICT may photograph a host organisation’s service users unless all necessary explicit consents and host approval have been obtained.

​

Our website may use cookies and analytics tools to understand usage and improve performance. You may block or delete cookies through your browser settings, although some functions may be affected. Our courses and activities are mainly intended for adults. If a participant is under 18, we obtain parental or guardian consent where appropriate and apply suitable safeguards.

​

Under the PDPO, you may request access to and correction of your personal data or require us to cease using it in direct marketing. We may first verify your identity. For enquiries or requests, contact the Institute for City Transformation: info@icitytransformation.org; WhatsApp 9178 2889; 1205, Block A, Sea View Estate, 2 Watson Road, North Point, Hong Kong; Attn: ICT Admin.

 

We may revise this Policy and publish the revised version and last updated date on our website. If the Chinese and English versions differ, the Chinese version prevails.