Privacy & Data Policy

1. Who we are

Holdfast Ltd. (“Holdfast,” “we,” “us,” “our”) is a company incorporated in Hong Kong. We run small, curated cohort programmes that bring people together through shared in-person experiences, and we provide related services to corporate and organisational clients. For the personal data described in this policy, Holdfast is the data user under the Personal Data (Privacy) Ordinance (the “PDPO”), except where we act as a data processor for a corporate client (see section 13).

If you have any question about this policy or about your personal data, contact our Privacy Officer:

2. Scope of this policy

This policy applies to personal data we collect when you visit weholdfast.co, apply to or take part in a Holdfast cohort or event, contact us, or otherwise interact with our services. It also serves as our Personal Information Collection Statement (“PICS”) under Data Protection Principle 1 of the PDPO.

Our website and application form may link to or embed third-party services (for example our application-form provider and payment provider). Those services have their own privacy policies, and we encourage you to read them. We are not responsible for the privacy practices of websites we do not control.

3. The personal data we collect

We collect only the data we need to run our programmes well and to meet our legal and operational obligations. Depending on how you interact with us, this may include:

a. When you apply to a cohort

Through our online application form we collect: your first and last name, email address, how long you have been based in Hong Kong, your employment situation and (optionally) your company or organisation, your stated commitment to the cohort schedule, and free-text answers about why you want to join and what you hope to get from the programme.

b. To match you into a suitable group

We collect your self-described fitness level and the activities you are comfortable with, and any physical limitations, accessibility needs or dietary requirements you choose to tell us so we can include you safely. Some of this information may relate to your health; we treat it with particular care, use it only for matching and your safe participation, and do not use it for any other purpose without your consent.

c. Activity / participation records

For some outdoor sessions we may invite you — entirely optionally — to share a simple record of an activity, such as a screenshot from Strava, Apple Health, Garmin or a similar app, to confirm participation. In future we may, again only with your separate opt-in, let you connect a fitness account (for example via Strava’s secure authorisation flow) so that activity and route data can be confirmed automatically. These records can include location/GPS and activity data. Sharing them is always voluntary, and your individual location tracks are never published or sold.

d. Payment information

If you are offered and accept a place, payment is taken through our third-party payment provider (Stripe). Your card details are entered with the provider and processed under their security standards; Holdfast does not see or store your full card number. We retain a record that payment was made, the amount, and the date.

e. When you contact us or join a waitlist

If you email us, join a waitlist, or sign up for updates, we collect your name, email address and the contents of your message.

f. Technical data when you visit the site

When you browse weholdfast.co, our hosting and security provider automatically processes limited technical data such as your IP address, browser type, device information and pages visited. This is used to deliver the site securely and to understand aggregate usage. See section 9.

4. How and why we use your data

We use personal data only for the purposes for which it was collected, or a directly related purpose. Specifically, we use your data to:

Purpose	Examples
Assess applications & place you in a cohort	Reviewing your answers, matching you into a compatible group of around eight people, accommodating limitations and dietary needs
Run and coordinate the programme	Sending you joining details, meeting points and schedule updates; managing attendance; communicating within your cohort (other participants see your first name only)
Process payments	Issuing payment links, confirming and recording payment, handling refunds
Verify participation	Confirming attendance at outdoor sessions from optional, voluntarily-shared activity records
Improve our programmes	Understanding, in aggregate, what works; measuring outcomes such as whether groups keep meeting after a cohort ends
Communicate with you	Responding to enquiries; sending you operational messages about a programme you have joined
Marketing (with your consent)	Sending you news about future cohorts or events — see section 6
Meet legal & safety obligations	Keeping accounting records, managing insurance, responding to lawful requests, and protecting the safety of participants

5. Your consent

By submitting our application or contact forms, and by sharing optional activity records, you consent to Holdfast collecting and using your personal data as described in this policy. Where we rely on your consent for a specific use — such as direct marketing, or connecting a fitness account — that consent is requested separately and you may withdraw it at any time by contacting us. Withdrawing consent will not affect anything we did lawfully before you withdrew it.

6. Direct marketing

We will only use your name and email to send you marketing about future Holdfast cohorts, events and offers if you have given us consent to do so, consistent with Part 6A of the PDPO. We do not sell, rent or trade your personal data to any third party for their own marketing.

You can opt out of marketing at any time, at no cost, by clicking “unsubscribe” in any marketing email or by writing to privacy@weholdfast.co. We will stop using your data for marketing as soon as practicable after we receive your request.

7. Who we share your data with

We do not sell your personal data. We share it only where necessary to run our services, and we require our service providers to protect it and to use it only for the purposes we specify. The main recipients are:

Recipient	Why
Application-form provider (e.g. Tally)	Collecting and storing your application responses
Website hosting & security provider (e.g. Cloudflare)	Serving the website securely and processing technical/log data
Email & productivity provider (e.g. Google Workspace)	Receiving your messages and corresponding with you
Payment provider (e.g. Stripe)	Processing your payment securely
Fitness/activity platforms (e.g. Strava) — only if you opt in	Confirming activity and participation
Cloud infrastructure providers	Hosting our systems and data, with a preference for Hong Kong / regional data centres
Professional advisers, insurers & authorities	Where reasonably necessary, or required by law or to protect safety
Corporate clients	For corporate cohorts only, and only in aggregated or anonymised form unless you have separately agreed otherwise — see section 13

The named examples reflect the providers we currently use; specific providers may change over time, but the categories and safeguards above will continue to apply.

8. Transfers of data outside Hong Kong

Some of our service providers store or process data on servers located outside Hong Kong. Where personal data is transferred outside Hong Kong, we take reasonable steps to ensure it receives a level of protection comparable to that under the PDPO — for example through contractual protections with our providers and, where appropriate, the kinds of safeguards recommended in the Privacy Commissioner’s Guidance on Personal Data Protection in Cross-border Data Transfer. By using our services you acknowledge that your data may be transferred and processed in this way.

9. Cookies & analytics

Our website uses a small number of cookies and similar technologies that are necessary for the site to function securely and to understand aggregate, non-identifying usage. We do not use cookies to build advertising profiles of you. Embedded third-party content (such as the application form) may set its own cookies under the provider’s policy. You can control or block cookies through your browser settings, though some parts of the site may not work properly if you do.

10. How long we keep your data

We keep personal data only for as long as is necessary for the purpose it was collected, and then delete or anonymise it. As a general guide:

• Unsuccessful applicants: we keep application data for up to 12 months (so we can consider you for a future cohort), then delete it, unless you have asked to stay on our waitlist.
• Participants: we keep cohort and participation records for the duration of the programme and for a reasonable period afterwards to measure outcomes and handle follow-up, typically up to 24 months.
• Activity records: optional activity screenshots are kept only as long as needed to confirm participation, then deleted.
• Payment & accounting records: kept for at least 7 years as required by Hong Kong tax and company law.
• Marketing contacts: kept until you unsubscribe or ask us to delete your details.

11. How we protect your data

We take practicable steps to protect personal data against unauthorised or accidental access, processing, loss or use. These include encryption of data in transit and, for sensitive systems, at rest; access controls so that staff and contractors only see the data they need; using reputable providers that maintain recognised security standards; and limiting how long we hold data. No system is completely secure, but we work to keep these safeguards appropriate to the sensitivity of the data we hold.

12. Your rights — access and correction

Under the PDPO you have the right to:

• Ask whether we hold personal data about you, and to request a copy of it (a Data Access Request);
• Request that we correct any of your personal data that is inaccurate (a Data Correction Request);
• Ask us to stop using your data for direct marketing at any time; and
• Ask us to delete data we no longer have a lawful or operational reason to keep.

To exercise any of these rights, email privacy@weholdfast.co. We will respond within 40 days, as required by the PDPO. We may need to verify your identity first, and for a data access request we may charge a small fee that is not excessive, as permitted by the Ordinance.

13. Corporate & employer programmes

Where Holdfast runs a cohort for a company or organisation, we generally act as a data processor on that client’s behalf, under a written agreement that limits how the data may be used. If you take part through your employer:

• We use your data to run the programme and to produce aggregated or anonymised reporting (for example, overall participation and engagement metrics, including for the employer’s wellbeing or ESG reporting).
• We do not share your individual responses, individual activity data, or individual location/GPS tracks with your employer, unless you have separately and clearly agreed to that.
• Your employer’s own privacy notice also applies to how they handle your participation.

14. Children

Our programmes and website are intended for adults (18 and over). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

15. Data breaches

We maintain procedures to detect and respond to personal-data breaches. In the event of a breach that poses a real risk of significant harm, we will take prompt remedial action and will notify affected individuals and, where appropriate, the Office of the Privacy Commissioner for Personal Data, in line with current PDPO guidance and any applicable legal requirements.

16. Changes to this policy

We may update this policy from time to time. When we do, we will revise the “Effective” date and version number at the top, and post the updated version here. If the changes are significant, we will take reasonable steps to bring them to your attention.

17. Questions & complaints

If you have any concern about how we handle your personal data, please contact our Privacy Officer first at privacy@weholdfast.co — we want to put things right. You also have the right to make a complaint to the Hong Kong regulator:

This Privacy & Data Policy is provided for transparency and does not, by itself, constitute legal advice. Holdfast Ltd. is the data user responsible for the personal data described above.