Privacy Policy

1. What we collect

We collect:

Account email address, and the name and role you choose to store on the account.

Transaction records: credit purchases, amounts, dates, plan selections, and payment status. We do not store full payment card numbers.

Information you submit so that we can employ or pay an individual (for example, the employee’s name, contact details, and payroll data), when you use employment services.

Technical data strictly required to operate a secure session: the cookies described below, and standard server logs (IP address, date, requested URL) kept for security and fault diagnosis.

We do not collect marketing profiles, and we do not buy lists of prospects.

2. Why we collect it

We use this data to create and authenticate your account; to take payment for credits and record what you have bought and spent; to deliver employer-of-record, payroll, and onboarding services you have purchased; to meet accounting, tax, and legal duties in Hong Kong and in the markets where we employ people; to secure the Services and prevent fraud or abuse; and to send transactional email (for example, receipts, password resets, and service notices).

We do not use personal data to serve advertising, and we do not sell personal data.

3. Third-party processors

We use processors who handle data on our instructions:

Braintree / PayPal, to process payments.

Resend, to send transactional email.

These processors may handle data outside Hong Kong. We remain responsible under the PDPO for personal data we control, and we require processors to protect it by contract.

We may also disclose data if required by law, a competent authority, or to establish or defend a legal claim.

4. Retention

Account email and workspace records are kept for the life of the account and for up to twenty-four (24) months after the account is closed, unless a longer period is required for a dispute.

Transaction records are kept for at least seven (7) years to meet Hong Kong accounting and tax record-keeping duties.

Employment and payroll records are kept for the period required by the law of the place of employment and by Hong Kong record-keeping rules, whichever is longer.

Server logs are kept for a short operational period unless needed to investigate a security incident.

When retention ends, we delete or irreversibly anonymise the data where feasible.

5. Cookies

We use only a session cookie, so you stay signed in while using the portal, and a CSRF cookie, so form submissions can be checked as genuine.

We do not use advertising cookies, social pixels, or third-party analytics trackers on this site. You can refuse cookies in your browser; the portal’s signed-in features will not work without the session and CSRF cookies.

6. Your rights

Under the PDPO you have the right, subject to statutory exceptions, to request access to personal data we hold about you and to request correction of inaccurate data.

Depending on where you live, you may have further rights (for example to erasure, restriction, objection, or portability). We will consider such requests in line with the law that actually applies.

To exercise a right, email admin@corporatebright.co from the address on the account, or write to Flat/Rm 305, 3/F, Yen Sheng Centre, 64 Hoi Yuen Road, Kwun Tong, KL. We may need to verify your identity. We will answer within the time the applicable law requires.

If you are in Hong Kong you may also complain to the Office of the Privacy Commissioner for Personal Data.

7. Children

The Services are for business clients. We do not knowingly collect personal data from children.

8. Changes

We may update this policy by publishing a new version on this page and revising the “last updated” date. If we make a material change, we will notify the email on your account where we have one.

9. Contact

Corporate Bright Limited Registered office: Flat/Rm 305, 3/F, Yen Sheng Centre, 64 Hoi Yuen Road, Kwun Tong, KL Hong Kong company number: 56396173 Email: admin@corporatebright.co