私隱 · Privacy
私隱政策 Privacy Policy
私隱政策（中文版本）
生效日期：2026年10月20日
1. 關於本政策
Kalendars 網上預約系統由 Kalendar Limited（「我們」）營運。本政策說明我們如何按照香港《個人資料（私隱）條例》（第 486 章）（「條例」）收集、使用、保存、轉移及保護個人資料，以及你可如何查閱及改正你的資料。
2. 我們與商戶的角色
使用 Kalendars 接受預約的店舖（「商戶」）與我們各自負責不同的資料：
- 由商戶負責的資料。你向商戶預約或成為其會員時提供的資料（預約聯絡資料、會員資料、套票及餘額、付款證明）由該商戶決定用途，商戶是這些資料的資料使用者。我們只按商戶的指示、為提供服務而處理這些資料。如要查閱、改正或刪除這些資料，請先聯絡該商戶；我們會協助商戶回應。
- 由我們負責的資料。我們是以下資料的資料使用者：商戶及員工帳戶資料、平台保安及支援紀錄、網站分析資料，以及你經開通查詢表提交的資料。
3. 我們收集的資料
- 商戶及員工：店舖名稱、店舖網址名稱、負責人姓名、電郵、電話（選填）、業務類型、推薦碼（選填）；員工姓名、電郵及角色，以及使用商戶後台的分析紀錄（見第 6 節）。密碼只由登入服務以雜湊形式保存，我們看不到你的密碼。商戶如設定轉數快（FPS）收款，其轉數快識別碼、香港手機號碼或電郵，以及收款人名稱會顯示給該店舖的顧客，方便顧客以銀行轉帳付款。
- 預約顧客（代商戶處理）：姓名、電話、電郵、所選服務、時間及服務人員、付款方 式及你上載的付款證明圖片。
- 會員（代商戶處理）：姓名、電話、電郵、會員級別、餘額、積分、套票及交易紀錄。
- 會員登入（代商戶處理）：手機號碼及密碼。首個密碼由商戶員工產生，會員可自行更改；我們只保存經單向雜湊處理的密碼，任何人（包括我們及商戶員工）都無法讀取。我們亦記錄哪位員工產生或重設密碼，以及登入工作階段（最長 90 日）。
- 網站訪客：你在開通查詢表填寫的內容；網站分析資料（見第 6 節）；以及寄存服務為保安及運作而記錄的技術資料，例如 IP 地址、瀏覽器類型及瀏覽的網址。
- 平台管理及支援：管理員帳戶、登入紀錄，以及支援人員在商戶帳戶內進行操作的紀錄。
4. 使用目的
我們使用個人資料以：
- 提供及運作預約服務，包括建立及管理預約、會員、套票及付款核對；
- 開設及管理帳戶、處理登入，並保障系統安全（包括防止自動程式濫用）；
- 回應查詢及提供客戶支援；
- 了解網站及服務的使用情況，以改善服務（見第 6 節）；
- 遵守法律、稅務及監管要求，以及處理爭議。
標示為必填的資料是提供服務所必需的。如不提供，我們或商戶可能無法完成預約、開設帳戶或回應查詢。選填資料由你決定是否提供。
直接促銷：未經你同意，我們不會將你的個人資料用於直接促銷。商戶向其顧客發出推廣訊息，由該商戶負責，並須遵守條例第 VIA 部。
5. 資料轉移
我們不會出售你的個人資料。我們可能把個人資料轉移給：
- 為我們提供服務的機構：Vercel（應用程式寄存）、Supabase（資料庫、登入、重設密碼電郵及檔案 儲存）、Resend（經 Supabase 發送重設密碼等帳戶電郵）、Cloudflare（官網寄存、內容傳遞及保安服務、Turnstile 防機械人驗證及 Web Analytics）、Notion（開通查詢表）及 Amplitude（網站分析，啟用狀態見第 6 節）。我們要求它們只按我們的指示處理資料，並採取適當的保安措施。
- 你預約的商戶：該商戶的預約及會員資料。
- WhatsApp（Meta）：商戶員工以 WhatsApp 聯絡你時，會在自己的裝置開啟 WhatsApp，你的電話號碼及預填訊息會傳送至 WhatsApp。這項聯絡由商戶負責。
- 其他：法律要求時的執法或監管機構及法院；業務轉讓時的承讓人，並須提供同等保障。
香港以外的處理地點：我們的應用程式及資料庫寄存於香港以外。如啟用，Amplitude 會把分析資料存放於美國。Resend、Notion 及 Cloudflare 或會在美國或其他地方處理資料；我們的服務供應商亦可能在其營運的其他地方存取資料，以提供支援及保安。
尚未啟用的功能：自動電郵、短訊或 WhatsApp 通知、Google 日曆同步及信用卡付款目前並未啟用。啟用前，我們會更新本政策。
6. Cookies 及網站分析
必要 cookies 及瀏覽器儲存：
- 登入工作階段 cookies（商戶、員工、會員及平台管理員）；
- 語言設定
kl_locale，保存一年； - 預約過程的暫存資料，存放於瀏覽器的 sessionStorage，關閉分頁後清除。
Cloudflare Web Analytics：Cloudflare Web Analytics 已設定涵蓋本網域及其子網域，用於了解頁面瀏覽及載入效能。 網頁設定載入分析程式，將瀏覽及效能量度資料傳送至 Cloudflare；瀏覽器設定、內容封鎖工具或本網站的內容保安政策可能阻止程式載入或資料傳送，因此設定啟用不代表每次瀏覽均有傳送資料。 這與 Cloudflare 為寄存及保安服務而處理網站請求的技術資料屬不同用途；封鎖分析不會阻止後者。
網站分析（Amplitude）：本官網已啟用 Amplitude 分析，用於了解官網（包括經營分享）的使用情況。這不表示商戶後台分析已啟用。官網分析使用 Amplitude 的美國數據中心。 啟用時，Amplitude 以首方 cookie（名稱以 AMP_ 開頭，設定有效期為 365 日，只限你正在瀏覽的網站）保存隨機裝置編號，並收到：
- 官網：你瀏覽的頁面（只包括網址路徑及廣告活動 utm 參數），以及你是否點擊開通查詢連結；
- 瀏覽器及裝置類型。我們將 Amplitude SDK 設定為不記錄 IP 地址；這不表示服務不會收到網絡連線的 IP 地址。
Cookie 有效期與事件保存期限不同。本官網使用的 Amplitude 專案已設定事件保存期限為 Amplitude 收到事件起計 12 個月；供應商透過定期清理執行此設定，並非每筆事件到期即時刪除。這不代表商戶後台專案的保存設定已核實。 我們沒有啟用自動擷取互動或工作階段重播。
如另行啟用商戶後台分析，會記錄你開啟的後台版面名稱（例如「預約」、「設定」）；商戶員工登入後台時，我們會以系統內部編號（而非姓名或電郵）識別其帳戶及店舖。我們的伺服器亦會向 Amplitude 記錄店舖層面的活動：開設店舖、新增服務或服務人員、開啟收款方式，以及建立預約（只註明由顧客網上預約或由員工建立）。這些紀錄只連結店舖的內部編號，不連結任何個人。
啟用後，我們不會把顧客姓名、電話、電郵、預約時間或內容、付款資料傳送給 Amplitude，亦不會在商戶的顧客預約頁面使用瀏覽器分析。
啟用後，你可在瀏覽器封鎖或刪除 cookies，或使用內容封鎖工具阻止連線至 Amplitude，這不會影響你使用本網站。封鎖必要 cookies 則可能令登入等功能無法運作。
7. 保存期限
以下期間為我們的保存政策目標，明確標示的供應商設定除外；這不代表每項刪除程序均已實施。
目前限制：預約聯絡資料匿名化、帳戶及登入身份刪除、付款證明圖片刪除及備份到期，尚未全部實施或核實。部分資料可能超過政策目標仍然保存；我們目前不能保證到期自動刪除或匿名化。現有刪除操作只處理指定紀錄，並不代表已刪除某人的全部資料。如需了解你的資料處理情況，請按第 9 節聯絡我們或負責的商戶。
| 資料 | 政策目標或供應商設定 |
|---|---|
| 預約聯絡資料 | 政策目標：預約完成、取消或到期後保存 24 個月，再作不可逆轉匿名化；自動執行尚未核實 |
| 付款及交易紀錄 | 政策目標：交易後 7 年（稅務用途），並盡量減少當中的個人資料；實際執行尚未核實 |
| 付款證明圖片 | 政策目標：付款最終核實後保存 90 日；自動刪除尚未核實 |
| WhatsApp 預填訊息紀錄 | 政策目標：確認時起計（未確認則由建立時起計），內容保存 90 日、紀錄保存 24 個月；程式有清理功能，但部署及完成清理的情況尚未核實 |
| 保安、登入及支援操作紀錄 | 政策目標：24 個月；各類紀錄的實際清理尚未核實 |
| Vercel 執行時間日誌 | 按目前寄存計劃最多可供查閱 1 小時 |
| Vercel 持有的保安紀錄 | Vercel 會按保安、法律及合約需要保存，可能長於執行時間日誌可供查閱的期間 |
| Cloudflare 寄存及保安紀錄 | 供應商的適用保存期限尚未核實；不沿用 Vercel 日誌的可供查閱期間 |
| 商戶及員工帳戶資料 | 政策目標：帳戶有效期間，以及帳戶終止後 12 個月；帳戶及登入身份的刪除尚未全部實施或核實 |
| Amplitude 分析事件 | 本官網 Amplitude 專案設定：Amplitude 收到事件起計 12 個月，由供應商定期清理；商戶後台專案尚未核實，不等同 cookie 有效期 |
| Cloudflare Web Analytics | Cloudflare Web Analytics 的保存期限尚未核實；不適用 Amplitude 的 12 個月設定 |
| 開通查詢 | 政策目標：最後聯絡後 12 個月；實際刪除尚未核實 |
| 系統備份 | 政策目標：35 日內到期；各類備份的設定及到期情況尚未核實 |
有關 Vercel 如何處理及保存資料，請參閱 Vercel 私隱聲明。
如法律要求或需處理稅務、欺詐調查或法律申索，我們可能在所需期間內保留有關資料。
8. 保安
- 所有連線均以 HTTPS 加密。
- 資料庫設有存取控制，每間商戶只能存取自己的資料；員工按角色獲得權限。
- 付款證明存放於非公開儲存空間；每次查看都使用短時效連結，並留有紀錄。
- 系統紀錄會移除電話、電郵等個人資料。
如發生資料外洩，我們會盡快採取行動，並在適當情況下通知受影響人士及個人資料私隱專員公署。
9. 查閱及改正資料
你有權要求查閱及改正我們持有的你的個人資料。請以電郵聯絡：
我們會在收到要求後 40 日內回覆。處理查閱資料要求時，我們可能收取不超逾所需的費用，並會事先通知你。我們不會就改正資料要求收費。有關商戶持有的預約或會員資料，請先聯絡該商戶，我們會協助商戶處理。
你亦可向個人資料私隱專員公署查詢或投訴：https://www.pcpd.org.hk。
10. 政策更新
我們會在此頁公佈本政策的更新，並註明生效日期。如有重大變更，我們會在網站或商戶後台通知。
11. 語言
本政策備有中文及英文版本。如兩者有歧義，以英文版本為準。
Privacy Policy (English version)
Effective date: 20 October 2026
1. About this policy
The Kalendars online booking system is operated by Kalendar Limited (“we”, “us”). This policy explains how we collect, use, keep, transfer and protect personal data under Hong Kong’s Personal Data (Privacy) Ordinance (Cap. 486) (the “Ordinance”), and how you can access and correct your data.
2. Our role and the shop’s role
Businesses that take bookings through Kalendars (“shops”) and we are responsible for different data:
- Data the shop is responsible for. Details you give a shop when you book or join as a member (booking contact details, member profile, packages and balances, payment proof) are used as the shop decides; the shop is the data user. We process them only on the shop’s instructions and to provide the service. To access, correct or delete them, contact the shop first; we will help the shop respond.
- Data we are responsible for. We are the data user for merchant and staff accounts, platform security and support records, website analytics, and what you submit through our enquiry form.
3. What we collect
- Merchants and staff: shop name, shop web address name, owner’s name, e-mail, phone (optional), business type, referral code (optional); staff names, e-mail addresses and roles, and records of how the workspace is used (section 6). Passwords are kept only as a hash by our sign-in service; we cannot see your password. If a shop sets up FPS payments, its FPS ID, Hong Kong mobile number or e-mail address and the payee name are shown to that shop’s customers so they can pay by bank transfer.
- Customers who book (processed for the shop): name, phone, e-mail, the service, time and staff member chosen, the payment method and any payment-proof image you upload.
- Members (processed for the shop): name, phone, e-mail, member tier, balance, points, packages and transactions.
- Member sign-in (processed for the shop): your mobile number and a password. Shop staff create the first password and you can change it. We keep only a one-way hash of the password, which no one, including us and the shop’s staff, can read. We also record which staff member created or reset it, and your sign-in sessions (at most 90 days).
- Website visitors: what you enter in our enquiry form; website analytics (section 6); and technical data our hosting records for security and operation, such as IP address, browser type and the web address visited.
- Platform administration and support: administrator accounts, sign-in records and a record of actions support staff take inside a shop’s account.
4. Why we use it
We use personal data to:
- provide and run the booking service, including bookings, members, packages and payment checks;
- open and manage accounts, handle sign-in and keep the system secure, including stopping automated abuse;
- answer enquiries and provide support;
- understand how the website and service are used so we can improve them (section 6);
- meet legal, tax and regulatory requirements and handle disputes.
Fields marked as required are needed to provide the service. Without them we or the shop may be unable to complete a booking, open an account or answer an enquiry. Optional fields are your choice.
Direct marketing: we will not use your personal data for direct marketing without your consent. A shop that sends promotions to its customers is responsible for them and must comply with Part VIA of the Ordinance.
5. Who we transfer it to
We do not sell personal data. We may transfer it to:
- Our service providers: Vercel (application hosting), Supabase (database, sign-in, password-reset e-mail and file storage), Resend (account e-mail such as password resets, sent through Supabase), Cloudflare (hosting, content delivery and security for our public website, Turnstile bot checks and Web Analytics), Notion (enquiry form) and Amplitude (website analytics; see section 6 for activation status). We require them to process data only on our instructions and to keep it secure.
- The shop you book with: that shop’s booking and member data.
- WhatsApp (Meta): when shop staff contact you on WhatsApp, they open WhatsApp on their own device, and your phone number and a pre-filled message go to WhatsApp. The shop is responsible for that contact.
- Others: law-enforcement or regulatory bodies and courts when the law requires; a buyer of the business, who must give the same protection.
Processing outside Hong Kong: Our application and database are hosted outside Hong Kong. If enabled, Amplitude stores analytics data in the United States. Resend, Notion and Cloudflare may process data in the United States or elsewhere, and our providers may access data from other places where they operate, for support and security.
Features not yet active: automated e-mail, SMS or WhatsApp notifications, Google Calendar sync and card payments are not active. We will update this policy before turning any of them on.
6. Cookies and analytics
Essential cookies and browser storage:
- sign-in session cookies (merchants, staff, members and platform administrators);
- the language setting
kl_locale, kept for one year; - temporary booking details in your browser’s sessionStorage, cleared when you close the tab.
Cloudflare Web Analytics: Cloudflare Web Analytics is configured across our domain and its subdomains to measure page visits and loading performance. Pages are configured to load an analytics script and send usage and performance measurements to Cloudflare; browser settings, content blockers or our Content Security Policy may block the script or transmission, so configuration does not prove that every visit sends data. This is separate from Cloudflare processing technical request data for hosting and security; blocking analytics does not stop that processing.
Public website analytics (Amplitude): Amplitude analytics is enabled on this public website to understand its use, including the blog. This does not mean workspace analytics is enabled. Public website analytics uses Amplitude’s United States data centre. When enabled, Amplitude keeps a random device ID in a first-party cookie (named AMP_…, with a configured expiry of 365 days and limited to the site you are on), and receives:
- on our website: the pages you view (the path and utm campaign parameters only) and whether you click an enquiry link;
- your browser and device type. We configure the Amplitude SDK not to record IP addresses; this does not mean the service never receives the IP address of a network connection.
Cookie expiry is separate from event retention. The Amplitude project used by this website is configured to retain events for 12 months from receipt by Amplitude; the provider enforces this through periodic cleanup, not immediate deletion at each event’s expiry. This does not verify retention for workspace projects. We have not enabled interaction autocapture or session replay.
If workspace analytics is enabled separately, it records the section you open (for example Bookings or Settings). When merchant staff sign in to that workspace, we identify the account and the shop by internal IDs, not by name or e-mail. Our servers also record shop-level activity in Amplitude: a shop being opened, a service or staff member added, a payment method turned on, and a booking created (noting only whether it was booked online or by staff). These records are linked to the shop’s internal ID, not to any person.
If enabled, we never send customers’ names, phone numbers, e-mail addresses, booking times or details, or payment data to Amplitude, and we do not run browser analytics on shops’ booking pages.
If enabled, you can block or delete cookies in your browser, or use a content blocker to stop connections to Amplitude; this does not affect your use of the website. Blocking essential cookies may stop sign-in and other features from working.
7. How long we keep it
The periods below are our retention policy targets, except where a provider setting is explicitly stated; they do not mean every deletion process is implemented.
Current limitations: The processes for booking contact anonymisation, account and sign-in identity deletion, payment-proof image deletion and backup expiry are not all implemented or verified. Some data may remain beyond the policy targets; we cannot currently guarantee automatic deletion or anonymisation at expiry. Existing erasure operations affect specified records and do not mean all data about a person has been erased. Contact us or the responsible shop using section 9 to ask about your data.
| Data | Policy target or provider setting |
|---|---|
| Booking contact details | Policy target: retention for 24 months after completion, cancellation or expiry, followed by irreversible anonymisation; automatic enforcement is not verified |
| Payment and transaction records | Policy target: 7 years after the transaction for tax purposes, with personal data minimised; enforcement is not verified |
| Payment-proof images | Policy target: retention for 90 days after final payment review; automatic deletion is not verified |
| WhatsApp pre-filled message records | Policy target: content retained for 90 days and records for 24 months from confirmation, or creation if unconfirmed; cleanup exists in source but deployment and completion are not verified |
| Security, sign-in and support-action records | Policy target: 24 months; cleanup of each record class is not verified |
| Vercel runtime logs | Available for up to 1 hour under the current hosting plan |
| Provider-held security records | Retained by Vercel as necessary for security, legal and contractual purposes; may outlast runtime-log availability |
| Merchant and staff account data | Policy target: while the account is active and 12 months after it closes; account and sign-in identity deletion is not fully implemented or verified |
| Cloudflare hosting and security records | Applicable provider retention is not verified; Vercel log availability does not apply |
| Amplitude events | This website’s project setting: 12 months from receipt by Amplitude, enforced through periodic cleanup; workspace projects are not verified and cookie expiry is separate |
| Cloudflare Web Analytics | Cloudflare Web Analytics retention has not been verified; Amplitude’s 12-month setting does not apply |
| Enquiries | Policy target: 12 months after our last contact; deletion is not verified |
| System backups | Policy target: expiry within 35 days; settings and expiry for each backup type are not verified |
Read the Vercel Privacy Notice for how Vercel handles and retains data.
We may keep data longer where the law requires it, or for tax, fraud investigations or legal claims, for as long as needed.
8. Security
- All connections use HTTPS.
- Database access controls limit each shop to its own data; staff get access by role.
- Payment-proof images are kept in private storage; each view uses a short-lived link and is logged.
- System logs remove personal data such as phone numbers and e-mail addresses.
If a data breach occurs, we will act promptly and, where appropriate, notify the people affected and the Office of the Privacy Commissioner for Personal Data.
9. Access and correction
You have the right to request access to and correction of personal data we hold about you. Write by e-mail to:
- Founder
- E-mail: support@bookingkalendar.com
We will reply within 40 days of receiving your request. We may charge a fee for a data access request that is not excessive, and will tell you before we do. We do not charge for correction requests. For booking or member data a shop holds, contact the shop first; we will help the shop respond.
You can also contact or complain to the Office of the Privacy Commissioner for Personal Data: https://www.pcpd.org.hk.
10. Changes
We will post updates to this policy on this page with the effective date, and announce material changes on the website or in the merchant workspace.
11. Language
This policy is available in Chinese and English. If they differ, the English version prevails.