Privacy Policy

1. Commitment and Scope

LuDuan ("we", "us" or "our") is committed to complying with the provisions of the Personal Data (Privacy) Ordinance (Cap. 486 of the Laws of Hong Kong) (the "Ordinance"). This Privacy Policy Statement (this "Statement") explains how we collect, use, retain, transfer and protect your personal data.

This Statement applies to:

- Visitors browsing our website (the "Platform");
- Clients who register for and use our services ("Clients");
- Individuals who submit service enquiries or applications to us;
- Professionals who apply to become consultants on our platform ("Consultants").

By using the Platform or providing personal data to us, you acknowledge that you have read, understood and agree to the terms of this Statement.

2. Categories of Personal Data We Collect

We may collect the following categories of personal data:

2.1 Client Data

- Name, company name, job title;
- Contact details (email address, phone number);
- Account login credentials (username, password);
- Payment information (e.g., credit card details, processed by third-party payment service providers);
- Service requirements, project details and any documents or information submitted through the Platform in connection with your engagement;
- Correspondence between you, us and Consultants.

2.2 Consultant Data

- Name, contact details, professional qualifications and certifications;
- Work experience, areas of expertise and service history;
- Identity documents (for background checks and compliance purposes);
- Bank account details (for payment of service fees);
- Correspondence with us and performance reviews.

2.3 Website Usage Data

- IP address, browser type, operating system;
- Browsing history, click behavior and session duration;
- Data collected via cookies and similar tracking technologies (see Section 10 below).

3. Purposes of Collection

We collect your personal data for the following legitimate purposes:

3.1 Client-Related Purposes

- Processing your service orders and delivering service deliverables;
- Assigning your service requests to appropriate Consultants for review and handling;
- Communicating with you regarding your orders and providing client support;
- Processing payments and issuing invoices;
- Improving our service quality and developing new services;
- Complying with legal and regulatory requirements.

3.2 Consultant-Related Purposes

- Assessing your application and verifying your professional credentials;
- Matching you with suitable client projects;
- Managing your service assignments, payments and performance evaluations;
- Maintaining the quality and reputation of the consultant community on the Platform.

3.3 General Purposes

- Maintaining the security and proper operation of the Platform;
- Conducting data analysis and research to improve user experience;
- Conducting direct marketing to the extent permitted by law (see Section 6 below);
- Fulfilling our legal and regulatory obligations.

4. Artificial Intelligence and Automated Processing

Our core service model involves the use of artificial intelligence (AI) technology. We explain this as follows:

4.1 Role of AI in Processing Client Data

When we receive a service request and related materials from a Client, certain parts of the workflow will be processed automatically by our AI systems, including but not limited to:

- Preliminary analysis and categorization of submitted materials;
- Generation of draft service reports, assessment results or recommendations;
- Identification of potential risks or compliance issues;
- Provision of data-driven insights and suggestions.

4.2 Legal Basis for AI Processing

Under Data Protection Principle 3 of the Ordinance, personal data must not be used for a new purpose that is incompatible with the purpose for which it was collected. We commit that: 

- All purposes for which AI processing is used have been clearly stated in Section 3 of this Statement; 
- We will not use client data to train or customize AI models unless we have obtained your explicit and voluntary consent in advance;
- If we intend to use data for new purposes such as model training in the future, we will seek your separate consent beforehand.- Provision of data-driven insights and suggestions.

4.3 Collaboration Between AI and Human Review (HITL)

Our service model is "AI-driven + Human-in-the-Loop (HITL)" :

- AI systems handle approximately 80% of the automated processing work;
- Every final deliverable is reviewed and validated by qualified Consultants;
- This means your data will be processed by AI systems and may also be accessed by Consultants.

5. Transfer and Disclosure of Personal Data

5.1 Disclosure to Consultants

To facilitate service delivery, we may transfer a Client's service requirements and related materials to the Consultant assigned to the project. All Consultants have signed confidentiality agreements and are bound by the Platform's data protection policies.

We take the following measures to protect the confidentiality of client data:

- Tiered Access Rights: Consultants can only access data strictly necessary for their assigned tasks;
- Data Minimisation: Only the minimum data required to complete the task is transferred;
- Technical Isolation: Client data does not leave the Platform environment; Consultants work within the Platform;
- Audit Trails: All data access is logged.

5.2 Disclosure to Third-Party Service Providers

We may transfer personal data to the following categories of third parties:

- Payment processing service providers (e.g., credit card gateways);
- Cloud service and data storage providers;
- Technical maintenance and support providers;
- Legal and compliance advisors (when necessary).

All third-party service providers are required to comply with data protection standards equivalent to those set out in this Statement and may only process personal data in accordance with our instructions.

5.3 Disclosure Required by Law

We may disclose your personal data if required by law, court order or lawful request from government authorities.

5.4 Cross-Border Data Transfers

If personal data is transferred outside the Hong Kong Special Administrative Region, we will ensure that such transfer complies with the Ordinance and that appropriate safeguards are in place.

6. Direct Marketing

We may use your personal data (including your name, contact details and service preferences) to promote our services and products.

6.1 Your Rights

Under Section 35C of the Ordinance, before using your personal data for direct marketing, we must:

- Inform you that we intend to use your personal data for direct marketing;
- Inform you of the categories of data to be used and the types of services to be marketed;
- Obtain your explicit and voluntary consent.

6.2 Right to Opt-Out

You have the right to request, at any time and free of charge, that we cease using your personal data for direct marketing. To exercise this right, please notify us using the contact details in Section 12 below.

7. Data Security

We take appropriate technical and organizational measures to protect your personal data against unauthorized or accidental access, processing, deletion, loss or use. These measures include:

- Data encryption in transit (SSL/TLS);
- Data encryption at rest;
- Access controls and authentication mechanisms;
- Regular security audits and vulnerability assessments;
- Data protection training for staff and Consultants.

8. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes set out in Section 3. When data is no longer needed, it will be securely deleted or anonymized. Retention periods for different types of data are as follows:

- Client account data: for the duration of account activity and up to 7 years after closure (to meet legal and audit requirements);
- Service records and deliverables: up to 7 years after delivery;
- Consultant data: for the duration of the consultant relationship and up to 7 years after termination;
- Website usage data: up to 12 months.

9. Your Rights

Under the Ordinance, you have the following rights:

9.1 Right of Access and Correction

You have the right to:

- Request access to your personal data held by us;
- Request correction of inaccurate or incomplete personal data.

Under the Ordinance, access means obtaining a copy of the relevant data. We may charge a reasonable fee for processing access requests.

9.2 How to Exercise Your Rights

To access or correct your personal data, please submit a written request to us using the contact details in Section 12 below.

10. Cookies and Tracking Technologies

We use cookies and similar technologies to:

- Maintain your login status and session;
- Record your preferences;
- Analyze website traffic and usage patterns;
- Improve user experience.

You may refuse or delete cookies through your browser settings, but this may affect certain functionality of the Platform.

11. Updates to This Privacy Policy

We may update this Statement from time to time. Any material changes will be posted on the Platform with an updated effective date. We encourage you to review this Statement periodically.

12. Contact Us

If you have any questions about this Statement or wish to exercise your rights of access, correction or opt-out of direct marketing, please contact us at:

Data Protection Officer
LuDuan
Email: ai@luduan.io

13. Governing Language

This Privacy Policy Statement is available in both English and Chinese. In the event of any inconsistency between the English and Chinese versions, the English version shall prevail.