Impact Bridge – Privacy Policy

1. About this Policy

Impact Bridge (the "Platform") is a cross-sector collaboration platform operated by Fullness Social Enterprises Society Limited ("FSES", "we", "us" or "our") at https://impactbridge.fses.hk/. The Platform connects corporates and other organisations ("Corporate Users") with social enterprises ("SE Users") for product and service sourcing, enquiries and requests for quotation, collaboration records under the M.O.V.E.R. model, the Impact Dashboard and nominations for the Social Enterprise Supporter Award Scheme.

This Privacy Policy explains how we collect, use, disclose, keep and protect personal data through the Platform, in accordance with the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong (the "PDPO") and its six Data Protection Principles. Sections 2, 3, 4, 10 and 14 together form our Personal Information Collection Statement.

Most information on the Platform is about organisations. This Policy applies to personal data, meaning information that relates to an identifiable individual, such as contact persons, account holders, award nominees and people who appear in photos.

2. Personal data we collect

2.1 Account registration.

(a) Corporate Users: company name, contact person's name, email address, phone number, primary sourcing purpose, billing address and password. We do not ask for a Business Registration number at corporate registration.

(b) SE Users: organisation name (Chinese and English), contact person's name and job title, email address, phone number, website or social media page, social enterprise certification(s) held, and password.

Fields marked * are mandatory. If you do not provide them, we cannot process your registration. Other fields are voluntary.

2.2 Profiles and listings. After approval, SE Users may add a fuller profile, such as an organisation description, social mission and impact story, beneficiary groups, social and environmental objectives, Sustainable Development Goals (SDGs), products and services, indicative prices, photos, a logo and supporting documents (for example, certification records or a Business Registration certificate where applicable). Corporate Users may add a company description, CSR and sustainability focus areas and a logo.

2.3 Enquiries, requests for quotation (RFQs) and orders. Contact details, procurement scenario, budget range, target date, quantity, customisation requirements, preferred social enterprise, delivery details (such as address, contact person and site access requirements), quotations, order status, and documents such as quotations, invoices, receipts and proof of payment. Orders placed through the Platform are contracted with FSES: FSES issues quotations and invoices in its own name, and payments are made to FSES outside the Platform. We do not collect payment card details on the Platform.

2.4 Collaboration and impact data. M.O.V.E.R. collaboration records reported by Corporate Users and SE Users, for example procurement amounts, volunteer headcount and hours, and in-kind contributions, together with SE-side figures such as the number of beneficiaries, training hours and related wages. SE Users should report beneficiary information as aggregate figures and should not submit beneficiaries' personal data.

2.5 Award nomination data. Information submitted through the Nomination Center, including procurement amounts, M.O.V.E.R. descriptions, organisation logos and supporting documents (such as contracts, invoices and receipts). For the Social Leadership Award, this includes the nominee's name, job title and a short narrative. If you nominate another person, please make sure that he or she is aware of the nomination and of this Policy.

2.6 Photos and other uploaded content. Photos of products, services, stories and activities, which may show identifiable individuals.

2.7 Communications and feedback. Messages, feedback, suggestions and screenshots you send to us through the Platform, by email or by phone.

2.8 Technical data. Login session data, IP address, browser and device information, and a record of key account actions (an audit log) kept for security purposes. See Section 8 on cookies.

3. How we use personal data

We use personal data for the following purposes:

(a) to review registration applications, confirm that SE Users are social enterprises, and create and manage accounts;

(b) to operate the Platform, including displaying approved social enterprise profiles and listings, filter-based matching, and handling enquiries and RFQs;

(c) to process orders placed with FSES, including issuing quotations and invoices, collecting payment, arranging fulfilment and delivery by the relevant social enterprise, and handling complaints, refunds and other after-sales matters;

(d) to record collaboration data, carry out FSES verification, and prepare the Impact Dashboard and impact summaries for the users concerned, as well as aggregated and anonymised Platform-level reports. FSES verification is an internal platform process; it is not independent assurance or an audit;

(e) to administer the Social Enterprise Supporter Award Scheme, including assessing nominations, notifying results, and publishing the names (and, where applicable, logos) of awardees;

(f) to communicate with you about your account, enquiries, orders, nominations and service notices;

(g) to keep the Platform secure, prevent fraud and misuse, fix problems and improve the Platform;

(h) to comply with legal and regulatory requirements and to handle disputes; and

(i) for direct marketing, only with your consent (see Section 7).

We will not use personal data for a new purpose that is not directly related to these purposes unless we have obtained your express and voluntary consent.

4. Who we share personal data with

We do not sell personal data. We may share personal data with the following classes of transferees, only as needed for the purposes in Section 3:

(a) Social enterprises fulfilling orders. Orders placed through the Platform are placed with FSES, and social enterprise contact details are not shown publicly. When a Corporate User submits an enquiry or RFQ, FSES shares the request details (such as requirements, quantity, customisation and target date) with the relevant social enterprise(s) to check availability and pricing. For a confirmed order, FSES shares the order details, delivery address and the name and phone number of the on-site contact person with the social enterprise fulfilling the order, only to the extent needed to fulfil it. Collaboration records and nominations relating to a partnership may be seen by both parties to that partnership.

(b) The public. Social enterprise profiles and listings approved for publication (such as organisation name, mission, beneficiary groups, products and services, photos, logo and website) can be viewed by anyone. The names, and where applicable the logos, of awardees may be published on the Platform, FSES websites, award ceremony materials and publicity.

(c) Service providers. Our website developer and maintenance contractor, hosting and cloud storage providers, email delivery and IT support providers, and our web analytics provider (Google, see Section 8), who act on our behalf and are bound by contract to use the data only for our purposes and to keep it secure (see Section 5).

(d) Award assessment. Assessment panel members and any co-organisers or supporting organisations of the Social Enterprise Supporter Award Scheme, for assessment purposes only.

(e) Others where required. Our professional advisers and auditors, and courts, law enforcement agencies or regulators where required or permitted by law.

5. Data storage and transfer outside Hong Kong

Platform data is stored on servers operated by our hosting provider. Some service providers, such as Google Analytics (see Section 8), may store or process data outside Hong Kong. Where personal data is stored or processed outside Hong Kong, we take reasonable steps, including contractual safeguards, to ensure that it receives protection comparable to that required under the PDPO.

6. How long we keep personal data

We keep personal data only for as long as necessary to fulfil the purposes for which it was collected, including any legal, accounting or reporting requirements, and then delete or anonymise it. Account data, order records and nomination records are kept while the account is active and for one (1) year after the account is closed, and are then deleted or anonymised, unless a longer retention period is required or permitted by law (for example, accounting and tax record-keeping requirements). Aggregated and anonymised impact data that no longer identifies any individual may be kept for longer for reporting purposes.

7. Direct marketing

With your consent, FSES intends to use your personal data for direct marketing, in accordance with Part 6A of the PDPO.

(a) Kinds of personal data used: your name, email address and phone number.

(b) Classes of marketing subjects: FSES events and activities; the Social Enterprise Supporter Award Scheme; Impact Bridge platform updates; and products and services of social enterprises.

(c) Consent: we will only send direct marketing if you tick the separate direct marketing consent box at registration. The box is not ticked by default, and you may register without ticking it.

(d) Opting out: you may withdraw your consent at any time, free of charge, by emailing tecm@fses.hk or using the unsubscribe link in our messages. We will then stop using your personal data for direct marketing.

(e) No transfer for others' marketing: we will not provide your personal data to any third party for its own direct marketing.

Service messages about your account, enquiries, orders and nominations are not direct marketing and will continue to be sent while your account is active.

8. Cookies and similar technologies

8.1 Strictly necessary. The Platform uses strictly necessary cookies to keep you signed in and protect your session, and your browser's local storage to remember your language preference. These cannot be switched off without affecting how the Platform works.

8.2 Analytics. We use Google Analytics, a web analytics service provided by Google, which places analytics cookies on your device. These cookies collect information such as the pages you visit, time spent on the Platform, referring website, device and browser type, and approximate location derived from your IP address. We use this information in aggregated form to understand how the Platform is used and to improve it. Google processes this information on our behalf as our service provider and may do so outside Hong Kong. More information is available at https://policies.google.com/technologies/partner-sites.

8.3 Fonts. Web fonts are loaded from Google Fonts, so your browser connects to Google's servers, which receive your IP address.

8.4 Your choices. You can block or delete cookies through your browser settings; if you block strictly necessary cookies, you may be unable to log in. You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on (https://tools.google.com/dlpage/gaoptout).

9. Security

We take reasonable practical steps to protect personal data against unauthorised or accidental access, processing, erasure, loss or use. These include encrypted (HTTPS) connections, password-protected accounts, role-based access for Corporate Users, SE Users and FSES administrators, restricting administrative access to authorised FSES staff, audit logs, and contractual obligations on our service providers.

Please keep your password confidential and tell us immediately if you suspect unauthorised use of your account. No method of transmission over the internet is completely secure. If a data breach occurs, we will act promptly to contain it and, where appropriate, notify the affected individuals and the Office of the Privacy Commissioner for Personal Data.

10. Your rights to access and correct your personal data

Under the PDPO, you have the right to ask whether we hold your personal data, to request a copy of it, and to request correction of any inaccurate data. You may also ask about our data policies and practices and the kinds of personal data we hold. You can update most account information in your profile on the Platform.

To make a data access or correction request, please write to contact us (see Section 13). You may use the Data Access Request Form published by the Privacy Commissioner for Personal Data. We will respond within 40 days of receiving the request. We may charge a reasonable fee for complying with a data access request, which will not be excessive. We do not charge for correcting personal data.

11. Links to other websites

The Platform may link to other websites, such as social enterprise websites, social media pages and other FSES websites. Their privacy practices are not covered by this Policy, and we encourage you to read their own privacy policies.

12. Changes to this Policy

We may update this Policy from time to time. The updated version will be posted on this page with a new "Last updated" date. We will notify registered users of significant changes through the Platform or by email.

13. Contact us

If you have any questions about this Policy, or wish to make a data access or correction request or withdraw your consent to direct marketing, please contact: