Privacy Policy

• Account data: your email address, your name if you give it, and your password, which we store only in hashed form. If you sign in with Google, we receive your name, email address and profile picture from Google.
• Study data: the exam you are studying (SQE or EAQE), your answers, mock exam results, saved questions and progress.
• Purchase data: the pass you bought, the amount, the date, and the customer and payment references from Stripe. Payments are handled by Stripe; we never see or store your card number.
• Messages: what you send us through the feedback form or by email, and, if the AI tutor is offered to you, the questions you type into it.
• Referral and source data: the referral code or link you arrived from, and the campaign or website that sent you, so we can credit referrals and see which channels work.
• Technical data: server logs such as IP address, browser type and pages requested, needed to run and secure the Service.

Obligatory or voluntary. An email address is obligatory to create an account; without it we cannot give you an account, save your progress or sell you a pass. Your name and everything you choose to send us are voluntary.

We use your personal data to:

• create and run your account and let you sign in;
• save your answers and show your progress, results and readiness;
• process payments, grant your pass and keep purchase records;
• send service emails, such as receipts, password resets and notices about your pass;
• answer your questions and feedback;
• credit referrals and measure how people find the Service;
• fix errors, improve questions and features, and keep the Service secure;
• meet our legal, tax and accounting obligations; and
• send you direct marketing about our own exam-preparation services, only if you have agreed (see section 4).

We do not use your personal data for any other purpose without your consent.

We do not sell your personal data. We transfer it only to these classes of persons, and only as needed for the purposes above:

• Service providers that process data for us: Vercel (website hosting, and page-view statistics that do not use cookies); Supabase (database hosting); Resend (sending emails); Stripe (payments); Google (optional "Sign in with Google", and Google Ads conversion measurement where it is switched on); and Anthropic (the AI tutor, where it is offered, receives the questions you type).
• Professional advisers, such as accountants and lawyers, under a duty of confidentiality.
• Law enforcement, regulators and courts, where the law requires or permits it.
• A buyer or successor of our business, who must keep using the data for the same purposes.

Processing outside Hong Kong. Our service providers store and process data on servers outside Hong Kong, including in the United States and elsewhere in Asia. We use providers that commit by contract to keep the data secure and to use it only to provide their service to us.

We intend to use your name and email address to send you direct marketing about our own exam-preparation services: study tips, rule updates that affect the SQE or EAQE, exam reminders and offers on our passes.

We will not do this without your consent. You give consent only by ticking the optional box when you create an account (or, if you sign up with Google, the same box on the welcome page), or on our email preferences page. The box is never ticked for you, and leaving it unticked does not affect your account. We record whether and when you gave consent.

You can withdraw consent at any time, free of charge. Every marketing email has an Unsubscribe link: one click turns marketing off for your account straight away. You can also untick the box on the unsubscribe page or email support@eaaprep.hk.

Chinese edition waitlist. If you join the waitlist for the Traditional Chinese edition, we use your email address only to send you one email announcing that edition, then stop. Joining the waitlist is not consent to any other marketing.

We do not provide your personal data to any third party for its own direct marketing, for gain or otherwise.

Service emails about your account, purchases or pass are not direct marketing and are sent whether or not you opt in.

• Sign-in cookie (essential): keeps you logged in.
• Exam cookie: remembers whether you are studying for the SQE or the EAQE.
• Referral and source cookies: remember a referral code (for up to 60 days) and the campaign or website that sent you, so a later sign-up or purchase can be credited.
• Vercel Analytics: counts page views without cookies.
• Google tag (where switched on): sets cookies that tell us whether a visit from one of our ads led to a sign-up or purchase. Manage ad personalisation at adssettings.google.com.

You can block or delete cookies in your browser settings. If you block the sign-in cookie, you will not be able to log in.

We keep personal data only as long as we need it for the purposes above. We keep your account and study data while your account is open. If you ask us to delete your account, we delete or anonymise your personal data within a reasonable time, except purchase records, which we keep as long as Hong Kong tax and accounting law requires (generally 7 years). Server logs are kept for a short period for security.

We protect personal data with encryption in transit (HTTPS), hashed passwords, access controls limited to the people who need them, and the security measures of our service providers. No system is completely secure; if you think your account has been compromised, tell us at support@eaaprep.hk.

Under the PDPO you have the right to:

• ask whether we hold your personal data and request a copy of it (a data access request, section 18);
• ask us to correct personal data that is inaccurate (section 22);
• withdraw your consent to direct marketing at any time (section 4 above); and
• ask us to delete your account.

Send requests in writing to support@eaaprep.hk, from the email address on your account where possible. For a data access request you may use the Data Access Request Form published by the Office of the Privacy Commissioner for Personal Data (PCPD). We may need to verify your identity first.

We will respond within 40 days of receiving your request. We may charge a reasonable fee for complying with a data access request, and will tell you the amount before we proceed. Correction requests are free. If you are not satisfied, you may complain to the PCPD.

The Service is for adults preparing for a licensing examination. You must be 18 or over to open an account, and we do not knowingly collect personal data from children.

We will update this policy if our practices change and change the "Last updated" date. For a material change we will tell signed-in users on the site or by email. We will not use your data for a new purpose without your consent.

Data access and correction requests, privacy questions and complaints go to our data protection contact at support@eaaprep.hk.