Privacy Policy | Brown Rice Livelihood Foundation Limited

1. Who we are and the scope of this policy

Brown Rice Livelihood Foundation Limited (Chinese name: 活米慈善基金有限公司) (“Brown Rice”, “we”, “us” or “our”) is a charitable institution exempt from tax under section 88 of the Inland Revenue Ordinance (Cap. 112) of Hong Kong (IRD reference number 91/13427). Brown Rice is the data user responsible for the personal data described in this Privacy Policy.

Petal – Girls Club (“Petal”) is a girls’ club and brand operated by Brown Rice. It brings together neurodivergent girls and young women through membership, club activities, services and community engagement. Petal is not a separate legal entity or data user; personal data collected through Petal is controlled by Brown Rice.

We handle personal data in accordance with the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong (the “PDPO”) and the applicable data protection principles. This policy applies to people whose personal data we control, including prospective and current Petal members; parents, guardians, caregivers and emergency contacts; people seeking assessment, counselling or support; participants in our activities; donors and supporters; employees, applicants, mentors, facilitators, speakers and volunteers; education, professional, corporate and community partners; website visitors; and anyone who communicates with us.

This policy explains our general practices. Where required, we will also provide a Personal Information Collection Statement (“PICS”) on or before collecting personal data directly from an individual. The PICS gives details specific to that collection, including whether providing the data is obligatory or voluntary and the consequences of not providing it. If a specific PICS is inconsistent with this policy, the PICS applies to that collection to the extent of the inconsistency.

This policy is not a request for consent to direct marketing, publicity or any other use that requires separate consent under the PDPO.

2. Personal data we collect

What we collect depends on how a person interacts with us and may include:

Identity and contact information: name, age or date of birth, email address, telephone number, address, school, organisation, occupation or role, and identity or eligibility information where reasonably necessary. We will not collect a Hong Kong identity card number or copy of an identity document unless permitted and reasonably necessary.
Petal membership and participation information: enquiries, applications, membership records, interests, preferences, attendance, feedback, communication or accessibility needs, support arrangements, parent or guardian details, emergency contacts, and safeguarding, welfare, accident or incident information.
Assessment, counselling and support information: referral and appointment details; information about neurodivergence, health, learning, communication, accessibility, wellbeing, goals and support needs; and authorised assessment, counselling or follow-up records.
Donations, payments and administration: payment amount, status, method, date and transaction reference; receipt or reimbursement details; donor instructions; and information needed for accounting, audit, fraud prevention and legal compliance.
Communications and content: correspondence, enquiries, meeting or telephone notes, survey responses, complaints, feedback, testimonials, photographs, video or audio recordings, personal stories, quotations, and consent or withdrawal records.
Employment, volunteering and professional engagement: applications, experience, qualifications, availability, references, screening, training, allocation, performance and safeguarding or conflict declarations.
Website and technical information: IP address, browser, device and operating-system details, pages and links used, date and time of visits, cookie or security identifiers, and information submitted through online forms.

Information about health, neurodivergence, counselling, assessment, wellbeing and safeguarding can be particularly sensitive. We seek to collect only data that is necessary, adequate and not excessive for the relevant purpose and apply safeguards appropriate to the nature of the information and the harm that could result from unauthorised access or use.

3. How and why we collect and use personal data

We may collect personal data directly from an individual through forms, applications, activities, interviews, correspondence, telephone calls or meetings; from an authorised parent, guardian, caregiver, school, referrer, professional or partner; automatically through our website; or from public sources where collection is lawful, fair and appropriate.

If someone gives us personal data about another person, they should be authorised to do so and should direct that person to the relevant policy and PICS. We may take reasonable steps to verify the source, authority and accuracy of the information.

We may use personal data to:

respond to enquiries, applications, requests, feedback and complaints;
operate Petal, assess and administer membership, verify eligibility, and arrange reasonable support or accessibility measures;
organise club gatherings, activities, retreats, mentorships, talks, workshops, training, events and community initiatives;
provide or arrange assessments, counselling, follow-up support and referrals, and coordinate authorised support with families, schools or professionals;
communicate necessary membership, booking, payment, safety and service information;
recruit, screen, train, coordinate and support employees, mentors, facilitators, speakers and volunteers;
process donations, fees, payments, reimbursements and receipts, and manage relationships with supporters, funders, sponsors and partners;
plan, safeguard, evaluate and improve our activities, services, website and participant experience;
meet funding, governance, accounting, audit, insurance, reporting and legal obligations;
prevent or respond to fraud, security threats, accidents, safeguarding concerns, disputes and emergencies;
produce and use content for specifically notified purposes where the required consent has been obtained;
administer communication preferences and send direct-marketing communications only after the applicable PDPO requirements have been met;
protect the safety, wellbeing, rights and property of individuals and Brown Rice; and
establish, exercise or defend legal rights.

Providing data may be obligatory for a particular service or voluntary, as stated in the relevant PICS or form. If information reasonably required for membership, safeguarding, an activity, support service, payment, application or enquiry is not provided, we may be unable to process the request or provide the relevant service. Refusing optional marketing or publicity consent will not, by itself, prevent someone from joining Petal or receiving a service.

We will not use personal data for a new purpose that is not the original purpose or a directly related purpose unless we obtain the prescribed consent required by the PDPO or the use is otherwise permitted or required by law.

4. Members under 18

Petal accepts members aged 15 to 25. A member under 18 must have the consent and involvement of a parent or guardian required by Brown Rice for membership and participation.

We will present privacy and consent information in language appropriate to the member’s age and maturity. We will take reasonable steps to respect her views, privacy and best interests while involving a parent or guardian where required or appropriate for membership, activities, assessment, counselling, safeguarding, emergency arrangements or legal requirements.

We may ask a parent, guardian or other person acting for a minor to provide sufficient evidence of identity, parental responsibility or authority. Any prescribed consent given on behalf of a minor must meet the applicable PDPO requirements. A parent or guardian who believes that a minor supplied personal data without the required permission should contact our Data Protection Officer using the details in section 12.

5. Assessments, counselling and support

Assessment, counselling and related professional support may be provided by:

a Brown Rice employee or authorised representative acting under Brown Rice’s control; or
an external professional or organisation acting as an independent data user.

Before personal data is transferred to or collected by an external professional, we will explain the arrangement in a PICS or other notice and obtain consent where required. An independent professional may issue a separate privacy notice for the personal data under that professional’s control.

With appropriate consent, Brown Rice may retain assessment, counselling or follow-up information for continuity of support. Access will be limited by role and need. Consent to receive a service is not consent for publicity, direct marketing or unrelated disclosure.

Professional confidentiality may be subject to limited exceptions, including where disclosure is required by law or reasonably necessary to address a serious safeguarding, safety or emergency concern. Any disclosure will be considered in light of the circumstances and applicable legal and professional obligations.

6. Direct marketing

Direct marketing may include communications addressed to a specific person that promote services, facilities or activities, or solicit donations or contributions. We may wish to use a person’s name and contact details, including email, telephone, messaging-app or postal details, to send information about:

Petal membership, club activities and services;
Brown Rice support services, talks, workshops, training, events and publications;
volunteering, mentoring and community opportunities;
sponsorship, corporate, ESG or CSR partnerships; and
fundraising campaigns, donation appeals and charitable support opportunities.

Before using personal data for direct marketing, we will explain in an easily understandable and readable form the kinds of personal data to be used, the classes of marketing subjects, our intention to use the data, that we may not do so without the individual’s consent, and a free response channel for communicating consent.

We will not use personal data for direct marketing unless we have received the consent or indication of no objection required by the PDPO. Consent is not inferred from silence, failure to respond, website use, membership or receipt of a service. If consent is given orally, we will provide the written confirmation required by the PDPO.

On first use, we will inform the individual of the right to require us to cease using the data for direct marketing. Anyone may opt out at any time without charge using the unsubscribe or preference facility in the communication or by contacting us. We may retain limited suppression information so that we can honour the request.

Necessary administrative and service messages concerning an existing membership, booking, payment, safeguarding matter or requested service are not optional marketing merely because they are sent by email, telephone or messaging service.

We do not provide personal data to another person for that person’s direct marketing without first giving the prescribed information and obtaining the written consent required by the PDPO. We will not direct optional marketing to a member under 18 unless Brown Rice’s age-appropriate notice, member choice and parent or guardian process has been completed.

7. Donations, fees and payments

We may use payment-related personal data to process and confirm a transaction; issue receipts; maintain donor or payer records; follow instructions; answer enquiries; conduct accounting, audit, reconciliation, fraud-prevention and financial controls; and meet legal, tax, regulatory and governance requirements. We will communicate about future fundraising only where the applicable direct-marketing requirements have been met.

Banks, payment gateways or other payment service providers may collect payment-card, bank-account or other credentials directly under their own privacy terms. Brown Rice may retain transaction, receipt and accounting information that it receives or reasonably requires, but will not request or retain more payment information than is necessary. The applicable PICS will identify relevant classes of transferees.

8. Photographs, recordings and personal stories

We may wish to use identifiable photographs, video or audio recordings, testimonials or personal stories to document our work, communicate with members, report impact, promote public understanding or support publicity, social-media, publication, fundraising or media activities.

We will explain the intended uses and obtain express and voluntary consent where required before using identifiable material for a notified publicity or media purpose. This consent will be separate from membership, participation, assessment, counselling or another service. For a member under 18, Brown Rice’s required parent or guardian process will also apply.

Where reasonably practicable, consent choices will distinguish different channels or uses. Refusing optional publicity consent will not, by itself, affect membership or access to a service. Consent may be withdrawn for future use by contacting us, without affecting uses lawfully made before we received the request. We will take reasonably practicable steps for material under our control, but may be unable to recall printed material already distributed or copies independently published, downloaded or shared by third parties.

9. Disclosure, service providers and overseas processing

We do not sell or rent personal data.

Subject to the notified purpose and the PDPO, we may disclose or transfer personal data where reasonably necessary to:

Brown Rice employees, authorised personnel, board or committee members and volunteers who need it for their duties and are subject to appropriate confidentiality requirements;
authorised parents, guardians, caregivers and emergency contacts;
assessors, counsellors, trainers, facilitators, mentors, speakers, medical or allied professionals and referral partners;
schools, colleges, universities and education professionals involved in authorised support or activities;
hosting, cloud-storage, database, email, messaging, form, survey, event-management, payment, accounting, security and other service providers;
auditors, insurers, bankers, lawyers and other professional advisers;
funders, sponsors, donors and partners, normally using aggregated or anonymised information; and
government departments, regulators, courts, law-enforcement bodies, emergency services or other persons where disclosure is required or authorised by law or reasonably necessary for legal, safety, safeguarding or emergency purposes.

If identifiable data is proposed to be disclosed beyond the original or directly related purpose, we will explain the recipient, information and purpose and obtain prescribed consent unless the disclosure is otherwise permitted or required by law. We will only describe information as anonymised where an individual is no longer reasonably identifiable.

Some service providers may access, store or process personal data outside Hong Kong, where privacy laws may differ. For providers processing data on our behalf, we will take reasonably practicable contractual or other steps, where appropriate, to require authorised-purpose processing, security and confidentiality safeguards, incident notification, restricted retention, and return, erasure or anonymisation when the data is no longer required. Brown Rice remains responsible for personal data under its control.

10. Website, cookies and third-party services

Our website may use cookies or similar technologies needed for operation, security and user preferences. Our contact form uses Google reCAPTCHA for abuse prevention and Google Apps Script to transmit submitted information to Brown Rice. These Google services may receive technical information such as IP address, device, cookie and interaction data and may process information outside Hong Kong under Google’s applicable terms and privacy practices.

Brown Rice does not currently configure advertising or audience-measurement analytics on this website. If we introduce non-essential analytics or tracking, we will update the relevant notice and, where appropriate, offer users a choice before that technology is used. Browser settings may also allow cookies to be blocked or deleted, although this can affect functionality.

The website and our communications may link to third-party websites, maps, social-media platforms, online forms, payment facilities, podcast platforms or embedded content. Those third parties control their own data practices. Individuals should review the relevant third party’s privacy information before providing data or using the service.

11. Accuracy, security and retention

We take reasonably practicable steps to keep personal data accurate for the purposes for which it is used. Individuals should give accurate and complete information and tell us when it changes. If we learn that data is inaccurate, we will correct or erase it, or stop using it until corrected, as appropriate.

We take reasonably practicable measures to protect personal data against unauthorised or accidental access, processing, erasure, loss or use. Depending on the data and risk, measures may include need-to-know access, authentication, secure transmission and storage, confidentiality duties, staff and volunteer training, provider controls, system maintenance, monitoring, secure disposal and incident-response procedures.

No internet transmission or storage method is entirely risk-free. If a personal data breach occurs, we will assess and contain it, investigate the circumstances, and consider notifying affected individuals, the Privacy Commissioner for Personal Data and other relevant parties in accordance with applicable requirements and guidance.

We retain personal data only as long as necessary for the purpose for which it is used or a directly related purpose, and for relevant legal, regulatory, accounting, audit, insurance, safeguarding, reporting, dispute-resolution and governance requirements. Retention varies according to the record, sensitivity, legal or professional requirements, limitation periods and potential need to establish or defend legal rights. In particular:

membership and participation records are reviewed when membership or the activity ends;
assessment, counselling and follow-up records are retained only while needed for authorised continuity of support, professional, safeguarding or legal purposes;
donation, payment, receipt and accounting records are retained for the applicable financial, audit and legal period;
direct-marketing consent and suppression records may be retained as needed to demonstrate consent and honour opt-outs; and
publicity-consent and withdrawal records may be retained while the material remains in authorised use and for an appropriate period afterwards.

When data is no longer required for a continuing lawful purpose, we will take reasonably practicable steps to securely erase or irreversibly anonymise it. Access to records that must be retained will be restricted according to their purpose and sensitivity.

12. Access, correction, complaints and contact

Subject to the PDPO, an individual may ask whether Brown Rice holds their personal data, request access to a copy, and request correction of inaccurate data.

A data access request should be made in writing using the current Data Access Request Form (Form OPS003) issued by the Privacy Commissioner for Personal Data. Send the completed form to Brown Rice, not to the Privacy Commissioner. Form OPS003 is available at the Privacy Commissioner’s forms page. A correction request should be made in writing with enough detail and supporting information.

We may request information reasonably necessary to verify a requester’s identity and authority. Someone acting for another person may need to provide evidence of identity and authority.

We will respond within the period prescribed by the PDPO, normally no later than 40 calendar days after receiving a valid request. If we cannot comply within that period, we will give the required notification and comply as soon as practicable afterwards. We may charge a fee for a data access request, but it will not be excessive and will be limited to costs directly related to and necessary for compliance. We may refuse a request only on a ground permitted by the PDPO and will give reasons where required.

Questions, complaints, data access requests and correction requests should be sent to:

Data Protection Officer
Brown Rice Livelihood Foundation Limited
活米慈善基金有限公司
17/F, Hing Lung Commercial Building
68 Bonham Strand
Sheung Wan, Hong Kong
Email: enquiry@brownrice.org
Telephone: +852 6263 0663

This does not affect an individual’s right to contact or complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong.

13. Changes to this policy

We may update this policy to reflect changes in our activities, services, technologies, legal requirements or personal-data practices. The current version will show its last-updated date, and where reasonably practicable we will draw attention to a material change.

Changing this policy does not by itself authorise us to use personal data for a new purpose that is not the original purpose or a directly related purpose. Where prescribed consent is required, we will obtain it before the new use.