STORIES THAT STAY PROGRAM
YouPath Foundation Limited · Registered Charity under Section 88, IRO (Cap. 112)
Issued in compliance with the Personal Data (Privacy) Ordinance (Cap. 615), Hong Kong
1. Data Controller
YouPath Foundation Limited ("the Foundation", "we", "us", "our") is the data controller responsible for the personal data collected in connection with the Stories That Stay program ("the Program"). Queries relating to this Notice may be directed to our Data Protection Contact at [email protected].
2. Scope of This Notice
This Privacy Notice governs the collection, use, storage, and disclosure of personal data provided by participants and their parent or guardian ("you") in connection with the Program. By proceeding, you confirm that you have read, understood, and agreed to the terms set out herein.
3. Categories of Personal Data Collected
Names and contact details
Program administration and storybook delivery
Interview audio recordings
Transcription, story drafting, and storybook production
Voice messages
Embedded in storybook as QR-linked audio
Family photographs
Incorporated into storybook layout
Written story content
Core narrative of the printed storybook
Personal data is collected for the specific purposes set out above and will not be used for any other purpose without your prior consent.
4. Use of AI-Assisted Technology
The Foundation utilises AI-assisted tools for the purposes of audio transcription and narrative story drafting. These tools are engaged solely to support storybook production. Participant data is not used to train, test, or improve any AI system. All AI processing is subject to the applicable terms of service and data protection commitments of the respective technology providers.
5. Data Storage and Security
Personal data is stored on industry-certified, cloud-based platforms that comply with recognised international security standards. Access to participant data is restricted to the assigned program facilitator and authorised Foundation staff. The Foundation implements appropriate technical and organisational measures to safeguard personal data against unauthorised access, loss, alteration, or disclosure.
6. Retention of Personal Data
Personal data is retained for as long as necessary to fulfil the purposes described in this Notice. There is no fixed retention period — data will be held until a withdrawal request is received and processed in accordance with Section 8 below. Participants retain the right to request deletion of their data at any time.
7. Optional Extended Use Permission
Where participants have expressly consented to extended use, the Foundation may utilise anonymised excerpts of the participant's story content — with all names and personally identifiable information removed — for the following purposes:
- Academic research, program evaluation, and grant applications
- Public exhibitions or community showcases organised or supported by the Foundation
- Media features, press coverage, or editorial content relating to the Program
- Program photography and video footage taken during the workshop, used for documentation, social media, and promotional materials
The Foundation will not publicly identify any participant family without obtaining separate prior written consent. Extended use permission is entirely voluntary and has no bearing on participation in the Program.
8. Right of Withdrawal
Participants may withdraw their consent at any time without providing reasons by submitting a written request to [email protected] with the subject line: Withdrawal of Consent — [Child's Full Name].
Upon receipt, the Foundation will delete the relevant personal data, recordings, and photographs within fourteen (14) calendar days. Participants acknowledge that:
(a) Printed storybooks already delivered to the participant family cannot be recalled or destroyed by the Foundation;
(b) Anonymised excerpts already incorporated into published research, exhibition materials, or media cannot be retracted; and
(c) No further use will be made of the participant's data following completion of the deletion process.
9. Data Subject Rights under the PDPO
In accordance with the PDPO, participants have the right to access personal data held by the Foundation, request correction of any inaccurate data, and request deletion of personal data. Requests should be directed to [email protected]. Participants who believe their rights have been infringed may lodge a complaint with the Office of the Privacy Commissioner for Personal Data at pcpd.org.hk.
10. Disclosure to Third Parties
The Foundation discloses personal data only to service providers engaged for program delivery, including secure cloud storage and AI-assisted processing services. The Foundation does not sell, license, or otherwise disclose personal data to any third party for commercial purposes. All service providers are subject to appropriate confidentiality and data protection obligations.
11. Amendments
The Foundation reserves the right to amend this Privacy Notice from time to time. Participants will be notified of any material changes prior to their taking effect.
12. Governing Law
This Notice and any dispute arising in connection with it shall be governed by and construed in accordance with the laws of Hong Kong.