Privacy Policy

Effective Date: July 2026

The Institute of Financial Planners of Hong Kong Limited ("IFPHK") is committed to respecting and protecting your privacy. IFPHK is a non-profit professional body established under the laws of Hong Kong, dedicated to promoting the financial planning profession through certification programmes.

This Privacy Policy (the "Policy") describes how IFPHK collects, holds, processes, uses and discloses personal data in connection with all of IFPHK's services and activities.

This Policy applies to personal data collected through:

· The IFPHK website at https://www.ifphk.org (the "Website") and its associated online portals and services;

· Membership, certification, and student registration applications (online and paper-based);

· Certification examinations and assessments;

· Continuing Professional Development ("CPD") programmes and activities;

· Training courses, seminars, conferences, and events (whether held online or in person); and

· Correspondence by post, email, telephone, fax, and in person with IFPHK staff.

This Policy does not extend to third-party websites that may be linked from the Website. Those sites may have their own privacy policies that differ from this Policy.

This Policy is prepared in compliance with the Personal Data (Privacy) Ordinance (Cap. 486) ("PDPO") and the latest guidance issued by the Office of the Privacy Commissioner for Personal Data ("PCPD").

By using the Website or otherwise providing personal data to IFPHK, you acknowledge and agree to the terms of this Policy.

In the event of any inconsistency or discrepancy between the English and Chinese versions of this Policy, the English version shall prevail.

2. Definitions

For the purposes of this Policy:

· "Personal Data" means any data relating directly or indirectly to a living individual from which it is practicable to ascertain that individual's identity, as defined under the PDPO.

· "Data Subject" means the individual to whom the personal data relates.

· "Data User" means IFPHK, as the entity that controls the collection, holding, processing and use of personal data.

· "PCPD" means the Office of the Privacy Commissioner for Personal Data.

· "Data Breach" means any suspected or confirmed unauthorised or accidental access, processing, erasure, loss or use of personal data held by IFPHK.

3. Types of Personal Data Collected

IFPHK may collect the following categories of personal data from you, depending on your relationship with IFPHK:

· Identity data: name, HKID number or passport number, date of birth, photograph.

· Contact data: postal address, email address, telephone and fax number.

· Professional data: employer, job title, professional certifications and qualifications, membership status.

· Account data: Login ID, password, member account records, annual renewal information.

· Membership and certification data: certification category and status, certification history, any conditions, suspensions, or revocations, and records of disciplinary proceedings and their outcomes (where applicable).

· Examination and assessment data: examination enrolment, attendance and results records, academic integrity declarations.

· CPD and training data: CPD activity enrolment and attendance, CPD points earned and compliance status, e-learning usage logs and assessment results.

· Transaction data: records of examinations, programmes, courses, seminars, events, conferences and membership fees registered and paid.

· Technical data: IP address, browser type and version, device information, cookies and usage data collected automatically when you access the Website.

· Communications data: correspondence, complaints, enquiries, and feedback submitted to IFPHK.

The submission of personal data is voluntary. However, failure to provide sufficient personal data may prevent IFPHK from processing your application or registration, providing a required service, or responding to your enquiry.

4. Lawful Basis and Purposes of Collection

IFPHK collects personal data only by lawful and fair means, and only for the specific purposes stated in this Policy or notified to you at the time of collection. IFPHK collects and uses your personal data for the following purposes:

a. Processing your applications for certification and related programmes, examinations, seminars, courses, events and conferences;

b. Administering your IFPHK membership, including processing certification renewals, updating membership records, and issuing certificates or letters;

c. Processing online payments and verifying transaction records;

d. Verifying your identity for access to the Members' Login Area and restricted sections of the Website;

e. Sending you notifications, reminders, updates and information about IFPHK's programmes, services, events and publications (see also Section 8 on Direct Marketing);

f. Receiving, investigating, and processing complaints against IFPHK members or certificants; conducting disciplinary investigations, hearings, and reviews in accordance with IFPHK's Rules, Code of Ethics, and Practice Standards; and maintaining records of disciplinary outcomes as required by IFPHK's governance requirements;

g. Conducting research, data analysis, and statistical reporting to improve IFPHK's services and the Website (aggregate, non-identifying data only may be shared with third parties);

h. Complying with applicable laws, regulations, professional standards, court orders, and requirements of regulatory bodies; and

i. Any other purpose directly related to the above, or for which your explicit consent has been obtained.

5. Cookies

IFPHK uses cookies (small text files stored on your device) to:

- recognise your device and help you log in to the Members’ Login Area; and

- collect aggregated usage statistics so we can improve the Website.

These cookies are not used to identify you personally beyond what is necessary for these purposes. You can set your browser to refuse cookies or to alert you before accepting them. However, if you disable cookies, some parts of the Website, including the Members’ Login Area, may not function properly.

6. Use of Third-Party Services and AI Systems

IFPHK may engage third-party service providers (including for payment processing, IT, and website maintenance) who require access to your personal data. All such providers are contractually required to process your data only on IFPHK's instructions, keep it confidential, and comply with the PDPO.

Where IFPHK uses any AI system that processes personal data, IFPHK will ensure such use complies with the PDPO, including conducting appropriate risk assessments and maintaining human oversight.

7. Disclosure and Sharing of Personal Data

Personal data held by IFPHK is kept strictly confidential. IFPHK may disclose your personal data to the following categories of persons only to the extent necessary for the purposes described in Section 4:

a. Agents, advisors, auditors, contractors, and service providers engaged in connection with IFPHK's operations and the provision of services to members;

b. The Financial Planning Standards Board Ltd. (FPSB) and FPSB-affiliated bodies, for CFP^® certification and AFP^® certification administration and mark licensing purposes;

c. Professional bodies, examination boards, or regulatory authorities (including but not limited to the Mandatory Provident Fund Schemes Authority, the Securities and Futures Commission, and the Insurance Authority) for the purpose of certification, professional standing or disciplinary matters;

d. Persons under a duty of confidentiality to IFPHK; and

e. Any person or authority to whom IFPHK is required by law to make disclosure, including law enforcement agencies, courts, and regulatory bodies in or outside Hong Kong.

IFPHK does not sell personal data to third parties.

8. Direct Marketing

8.1 Use of Personal Data for Direct Marketing

IFPHK may use your name and contact information (including your email address and correspondence address) to send you information about:

· CPD activities, conferences, seminars, and events organised or co-organised by IFPHK;

· IFPHK publications, professional development resources, and members' benefits; and

· Goods, services, and facilities provided by IFPHK or its professional partners.

8.2 Consent Requirement

IFPHK will only use your personal data for direct marketing if you have consented, or have been given the opportunity to indicate no objection, in accordance with the PDPO.

8.3 Right to Opt Out

You have the right to opt out of receiving direct marketing communications from IFPHK at any time and at no charge.

9. Cross-Border Transfer of Personal Data

IFPHK's systems and data may be hosted or processed by third-party cloud service providers, which may be located outside Hong Kong. IFPHK remains accountable for your personal data regardless of where it is stored or processed.

Where personal data is transferred outside Hong Kong, IFPHK ensures appropriate safeguards are in place through contractual protections with our service providers. IFPHK will update this Policy if its data hosting arrangements change.

10. Retention of Personal Data

IFPHK retains personal data only for as long as is necessary to fulfil the purpose(s) for which it was collected, or as otherwise required or permitted by law. Retention periods vary depending on the nature of the data and the purpose of collection — for example, membership and financial records are retained for longer periods to meet regulatory and accounting requirements, while operational records such as event registrations and website logs are retained for shorter periods.

IFPHK maintains a separate Data Retention Schedule setting out the applicable retention periods for each category of personal data. Upon expiry of the applicable retention period, personal data will be securely destroyed, deleted, or anonymized.

11. Security of Personal Data

IFPHK takes all practicable steps to protect personal data from unauthorised or accidental access, processing, erasure, loss or use. Security measures include encryption of data in transit and at rest, access controls limiting data access to authorised staff, regular security assessments, and staff training on data protection obligations.

Due to the inherent nature of the internet, IFPHK cannot guarantee the absolute security of data transmitted electronically.

12. Your Rights: Access, Correction and Deletion

You may request access to, correction of, or deletion of your personal data held by IFPHK. IFPHK will handle such requests in accordance with the PDPO and IFPHK’s applicable legal, regulatory, and operational retention requirements.

If you have any questions about this Policy, wish to exercise your rights, or wish to report a privacy concern, please contact IFPHK at:

The Institute of Financial Planners of Hong Kong Limited
13/F, Causeway Bay Plaza Phase II
463–483 Lockhart Road, Causeway Bay, Hong Kong
Telephone: (852) 2982 7888
Fax: (852) 2982 7777
Email: info@ifphk.org
Website: https://www.ifphk.org

13. Changes to This Policy

IFPHK may update this Policy from time to time. Changes take effect when the updated Policy is published on the Website, and you are encouraged to review it periodically. Where required by law, IFPHK will seek your consent for any materially new uses of your personal data.

This Policy is effective from July 2026 and supersedes all previous versions.