Privacy Policy

1. Introduction & Statutory Scope

FIHRI EDUCATION LIMITED (斐瑞教育有限公司, “Fihri”, “we”, “us”, or “our”) is committed to safeguarding the personal data of our students, parents, school partners, and website visitors. This policy is intended to describe Fihri Education's handling of personal data under applicable Hong Kong requirements and should be reviewed by a qualified privacy or legal professional. It outlines our operational principles regarding the collection, retention, processing, and transfer of personal data.

2. Categories of Personal Data Collected

In accordance with the principle of data minimisation, Fihri collects only the personal information strictly necessary to provide academic mentorship, admissions guidance, school workshops, and respond to legitimate enquiries through our online forms:

• Private Tutoring Consultations: Parent/guardian name, email address, telephone number, student year group, curriculum, target subjects, learning objectives, and preferred learning location/format.
• University Admissions Guidance: Applicant name, contact email, telephone number, grade level, target university systems (e.g. UK/Oxbridge, US), intended academic subjects, application year, and academic concerns.
• School STEM Proposals: School name, teacher or coordinator contact name, professional title, institutional email, telephone number, requested workshop programme, target cohort size, and scheduling preferences.
• General Advisory & Booking Forms: Contact name, email address, telephone number, and enquiry message or consultation notes.
• Technical Information: Non-personally identifiable server telemetry, browser user-agent, language preference, and anonymous analytics event timestamps.

3. Purposes of Data Processing

Personal data is processed strictly for the following stated purposes:

• Evaluating academic standing to formulate Individualised Learning Plans (ILPs).
• Matching students with appropriately screened and qualified independent academic mentors.
• Communicating lesson progress, diagnostic summaries, and scheduling confirmations.
• Administering school workshop proposals, logistics, and official procurement quotations.
• Complying with statutory, regulatory, and child safeguarding obligations under Hong Kong law.

Direct Marketing Notice: Submitting an academic consultation request or enquiry through our Website does not constitute consent for marketing or promotional communications. Promotional consent is collected separately where applicable, and you may opt out or withdraw promotional consent at any time.

4. Protection of Minors & Parental Consent

A substantial proportion of our learners are minors under the age of 18. Fihri enforces the following safeguarding protocols regarding minors' data:

• Parental Consent: All tutoring and admissions engagements for minors require explicit written consent from a parent or legal guardian. Direct service contracts are never concluded with minors independently.
• No Direct Unmonitored Messaging: Mentors and trainers are prohibited from private, unrecorded digital messaging with minor students outside verified educational groups involving parents or school coordinators.
• No Public Identification: Children's full legal names, identifiable photographs, examination result certificates, or residential details are never published on our website or marketing collateral without prior, documented parental release.

5. Artificial Intelligence & Data Handling Policy

Our technology and pedagogical staff operate under the following binding commitments:

• Strict Data Minimisation: Student full names, dates of birth, residential addresses, contact information, and government identity numbers are strictly prohibited from being entered into external AI models, APIs, or chat interfaces (e.g. ChatGPT, Gemini, Claude).
• Pseudonymisation: Where curriculum generation, exercise drafting, or diagnostic rubric structuring utilizes AI tools, all underlying student materials are thoroughly scrubbed and pseudonymised (e.g. “Year 10 Student A”).
• Jurisdictional Awareness: Third-party AI cloud providers may process data outside the Hong Kong SAR. To maintain data sovereignty and confidentiality, confidential client essays, school internal documents, and medical/special-need disclosures must never be submitted to external AI systems.

6. Disclosure & Third-Party Processors

Fihri does not sell, rent, or trade personal data to marketing aggregators. Data may be shared only with:

• Assigned academic mentors and workshop trainers strictly to the extent required to deliver instruction.
• Cloud hosting and communication infrastructure providers (e.g. Vercel Inc. for secure application hosting; transactional email delivery services such as Resend, Inc. strictly for relaying website consultation requests). Such infrastructure providers process transmissions under strict data processing addenda in overseas cloud regions (including the United States and European Union) and retain transmission logs for limited operational windows (typically 7–30 days) prior to automatic deletion.
• Twilio / WhatsApp Business strictly for direct client-initiated messaging under end-to-end transport encryption.
• Hong Kong law enforcement, judicial, or statutory regulatory bodies where mandatory under written statutory order.

*Notice: This Privacy Policy represents Fihri Education's current operational data minimisation and technical controls. It is a compliance draft subject to ongoing professional legal review under the Laws of Hong Kong.

7. Data Security & Storage Limitations

All digital communication is encrypted in transit using industry-standard TLS protocols. Access to administrative systems is restricted via multi-factor authentication and role-based permissions. Personal data is retained only for the duration of the educational relationship and archived in accordance with standard statutory tax and accounting retention requirements (typically 7 years in Hong Kong), after which it is securely destroyed.

8. Access, Correction & Opt-Out Rights

Under the PDPO, individuals (or their legal guardians) possess the statutory right to:

• Request confirmation as to whether Fihri holds their personal data.
• Request a copy of their personal data file (subject to a reasonable administrative fee as permitted by law).
• Request the correction of inaccurate personal data.
• Withdraw consent for direct marketing or promotional communications at any time.

9. Privacy Enquiries & Contact Details

All formal requests for data access, correction, or questions regarding data privacy practices should be addressed in writing to: