Privacy Policy

1. Introduction

Syntax Code Lab ("we," "our," or "us") is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website syntaxcodelab.com (the "Site").

We are a business registered in Hong Kong and comply with the Personal Data (Privacy) Ordinance (Cap. 486) ("PDPO") and related privacy regulations applicable in the Hong Kong Special Administrative Region.

By using our Site, you consent to the collection and use of your information as described in this Privacy Policy. If you do not agree with our policies and practices, please do not use our Site.

2. Information We Collect

2.1 Personal Data

We may collect the following types of personal data when you use our Site:

• Contact Information: Name, email address, phone number, and any other information you provide when contacting us through our contact forms.
• Account Information: If you create an account (e.g., for admin access), we collect your email address, password (encrypted), and any profile information you provide.
• Communications: Messages, inquiries, and feedback you send to us through our contact forms or email.
• Professional Information: Any information you provide related to business inquiries, project requirements, or collaboration opportunities.

2.2 Automatically Collected Information

When you visit our Site, we may automatically collect certain information about your device and usage, including:

• Log Data: IP address, browser type, operating system, referring URLs, pages viewed, and access times.
• Cookies and Similar Technologies: We use cookies, web beacons, and similar tracking technologies to enhance your experience. See our Cookie Policy section below for more details.
• Analytics Data: We may use third-party analytics services to understand how visitors use our Site.

2.3 Information from Third Parties

We may receive information about you from third-party services such as authentication providers (e.g., Firebase Authentication) or analytics platforms.

3. How We Use Your Information

We use the information we collect for the following purposes:

• To Provide and Maintain Our Services: Process your inquiries, respond to contact form submissions, and deliver requested information or services.
• To Communicate with You: Send you responses to your inquiries, updates about our services, and administrative messages.
• To Improve Our Site: Analyze usage patterns, troubleshoot technical issues, and enhance user experience.
• To Ensure Security: Detect, prevent, and address fraud, security breaches, and other potentially harmful activities.
• To Comply with Legal Obligations: Fulfill our legal and regulatory obligations under Hong Kong law and international regulations.
• With Your Consent: For any other purpose with your explicit consent.

4. Legal Basis for Processing (PDPO Compliance)

Under the PDPO, we process your personal data based on the following lawful grounds:

• Consent: Where you have given explicit consent for us to process your personal data for specific purposes.
• Contractual Necessity: To fulfill our contractual obligations to you or to take steps at your request before entering into a contract.
• Legal Obligation: To comply with applicable laws and regulations in Hong Kong.
• Legitimate Interests: For our legitimate business interests, such as improving our services, provided such interests are not overridden by your data protection rights.

5. General Data Protection Regulation (GDPR) & EU Users

5.1 Data Controller

Syntax Code Lab ( privacy@syntaxcodelab.com ) is the data controller for EU users.

5.2 Legal Basis

We process contact form submissions on the basis of your consent in order to respond to your inquiry.

5.3 Rights

EU data subjects have the right to access, rectify, erase, restrict processing, object to processing, and request portability of their personal data. To exercise these rights, contact privacy@syntaxcodelab.com .

5.4 Retention

Contact messages are retained for up to 3 years unless you request deletion earlier (see Section 8 for details).

5.5 Data Transfers

Your personal data may be transferred outside the EEA; where required, we rely on standard contractual clauses or other appropriate safeguards.

5.6 Breach Notification

Where required by law, we will notify affected individuals and supervisory authorities of any personal data breach within 72 hours.

6. How We Share Your Information

We do not sell, rent, or trade your personal data to third parties. We may share your information in the following circumstances:

6.1 Service Providers

We may share your personal data with carefully selected third-party service providers who support the operation of our Site and the delivery of our services. These providers perform functions on our behalf and are contractually required to protect your information, use it only for the purposes we specify, and comply with applicable data protection laws.

Our service providers include, but are not limited to:

• Cloud Hosting: Vercel and Supabase, for secure hosting and storage of application data.
• Authentication Services: Supabase Authentication, to provide secure user login and identity management.
• OAuth Providers: Google and GitHub, to enable third-party sign-in options.
• Analytics Providers: To help us monitor Site performance, understand usage patterns, and improve our services.
• Email Services: For sending transactional, administrative, and service-related communications.

These service providers are contractually obligated to protect your data and may only use it for the purposes we specify.

6.2 Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., court orders, government agencies) in Hong Kong or other jurisdictions.

6.3 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your personal data may be transferred to the acquiring entity. We will notify you of any such change via email or a prominent notice on our Site.

7. International Data Transfers

Your personal data may be transferred to, stored, and processed in countries outside of Hong Kong, including but not limited to the United States and European Union member states, where our service providers are located.

When we transfer your data internationally, we ensure appropriate safeguards are in place to protect your information in accordance with the PDPO and international data protection standards. These safeguards may include:

• Standard contractual clauses approved by relevant authorities
• Ensuring the recipient country has adequate data protection laws
• Implementing technical and organizational security measures

8. Data Security

We implement appropriate technical and organizational security measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption: Data in transit is encrypted using SSL/TLS protocols. Passwords are hashed and encrypted.
• Access Controls: Restricted access to personal data on a need-to-know basis.
• Regular Security Audits: Periodic reviews of our security practices and infrastructure.
• Secure Infrastructure: Use of reputable cloud service providers with robust security standards.

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your personal data, we cannot guarantee its absolute security.

9. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

Specific retention periods include:

• Contact Form Submissions: Retained for up to 3 years or until the inquiry is resolved and any follow-up is complete.
• User Accounts: Retained for the duration of your account's active status and up to 1 year after account deletion for backup and legal purposes.
• Log Data and Analytics: Typically retained for up to 2 years for security and analytical purposes.

After the retention period expires, we will securely delete or anonymize your personal data.

10. Your Rights Under Hong Kong Law (PDPO)

Under the Personal Data (Privacy) Ordinance, you have the following rights regarding your personal data:

10.1 Right to Access

You have the right to request access to the personal data we hold about you and obtain a copy of such data.

10.2 Right to Correction

You have the right to request correction of any inaccurate or incomplete personal data we hold about you.

10.3 Right to Data Portability

You may request to receive your personal data in a structured, commonly used, and machine-readable format.

10.4 Right to Object or Withdraw Consent

You have the right to object to the processing of your personal data or withdraw your consent at any time where we are relying on consent as the legal basis for processing.

10.5 Right to Erasure

You may request the deletion of your personal data in certain circumstances, such as when the data is no longer necessary for the purposes for which it was collected.

10.6 How to Exercise Your Rights

To exercise any of these rights, please contact us using the contact information provided in Section 13 below. We will respond to your request within 40 days as required by the PDPO. We may require verification of your identity before processing your request.

Please note that a data access request fee may be charged in accordance with the PDPO.

11. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience on our Site. Cookies are small text files stored on your device that help us remember your preferences and understand how you use our Site.

11.1 Types of Cookies We Use

• Essential Cookies: Necessary for the Site to function properly (e.g., authentication, security).
• Preference Cookies: Remember your settings and preferences (e.g., theme selection, language).
• Analytics Cookies: Help us understand how visitors interact with our Site by collecting anonymous usage data.
• Marketing Cookies: Currently not used, but may be used in the future to deliver relevant advertisements.

11.2 Managing Cookies

You can control and manage cookies through your browser settings. Most browsers allow you to refuse or accept cookies, delete existing cookies, or set preferences for certain websites. Please note that disabling cookies may affect the functionality of our Site.

For more information about cookies and how to manage them, visit www.allaboutcookies.org .

12. Third-Party Links

Our Site may contain links to third-party websites, services, or resources that are not operated by us. We are not responsible for the privacy practices or content of these third-party sites. We encourage you to review the privacy policies of any third-party sites you visit.

13. Children's Privacy

Our Site is not intended for children under the age of 18. We do not knowingly collect personal data from children under 18. If you are a parent or guardian and believe that your child has provided us with personal data, please contact us immediately. If we become aware that we have collected personal data from a child under 18 without parental consent, we will take steps to delete that information.

14. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

We will respond to your inquiry within a reasonable timeframe, and no later than 40 days as required by the PDPO.

15. Complaints to the Privacy Commissioner

If you are not satisfied with how we have handled your personal data or your privacy concerns, you have the right to lodge a complaint with the Office of the Privacy Commissioner for Personal Data (PCPD) in Hong Kong:

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of any material changes by:

• Posting the updated Privacy Policy on this page
• Updating the "Last Updated" date at the top of this page
• Sending you an email notification if you have provided us with your email address

Your continued use of our Site after any changes to this Privacy Policy constitutes your acceptance of the updated policy. We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information.

17. Governing Law and Jurisdiction

This Privacy Policy is governed by and construed in accordance with the laws of the Hong Kong Special Administrative Region. Any disputes arising from or relating to this Privacy Policy shall be subject to the exclusive jurisdiction of the courts of Hong Kong.

18. Language

This Privacy Policy is provided in English. In the event of any inconsistency or conflict between the English version and any translation, the English version shall prevail.