NextPath HR Services Privacy Policy

NextPath Solutions Limited ("NextPath", "we", "us") is committed to protecting the privacy of all individuals whose personal data we handle in the course of providing HR consultancy and administration services. This policy explains how we collect, use, and safeguard personal data in accordance with the Personal Data (Privacy) Ordinance (Cap. 486) ("PDPO") of Hong Kong.

Our Role

We provide HR consultancy, payroll administration, and HRIS advisory services to business clients. We do not provide recruitment, placement, or staffing services, and we do not collect personal data for the purpose of finding employment for any person or supplying workers to employers.

We handle personal data in two capacities:

• As a data user — for our own business contacts, such as client representatives and prospective clients who contact us, and for the website security records described under "Website Visitors" below.
• As a service provider (data processor) on behalf of our clients — where a client engages us for payroll processing or HR administration, we process personal data of the client's employees on the client's instructions. In these cases, the client remains the data user responsible for that data, and we process it only as needed to deliver the agreed services.

Data We Collect

• Business contacts: name, company, job title, contact details, and correspondence records, including the details you provide if you email us or book a consultation through our website (see "Appointment Bookings" below).
• Client employee data (processed on our clients' behalf): name, contact details, employment particulars, salary and benefits information, and identification documents where required for statutory payroll, MPF/ORSO, and Inland Revenue (IR56 series) filings.
• Website visitors: limited technical records of requests made to our website, described under "Website Visitors" below. These records do not include your full IP address, your name, or any other information that identifies you.

We collect only the personal data necessary for these purposes.

Website Visitors

This section applies to anyone who visits our website at nextpath.hk. It is separate from the client and client-employee information described above: these records are held by NextPath as data user in its own right, and are never combined with data we process on behalf of our clients.

What our servers record. To protect this website from attack and misuse, our servers keep a security record of incoming requests. Each entry contains:

• the page or file requested (for example, /cookie-policy);
• the country the request came from, as reported by our content delivery network (a two-letter country code);
• a partial IP address — the first two segments only (for example, 110.249). This identifies a block of approximately 65,000 addresses operated by an internet provider. The full IP address is never stored, and we have no means of recovering it;
• the browser identification string (the "User-Agent") that your browser sends with every request; and
• the date and time of the request.

What we do not record. We do not store your full IP address. We do not record your name, email address, or any other information that identifies you. We do not read from or write to your device: no cookies, no local storage, and no device or browser fingerprinting. We do not combine these records with any other information we hold, and we do not attempt to identify individual visitors from them.

Why we do this. We use these records for one purpose only: keeping this website secure. Specifically, to detect and record automated scanning, vulnerability probing and content scraping; to investigate suspected attacks on the site; and to maintain a record of such activity. These records may also inform any decision to restrict or block access under our Terms of Service. We do not use them for analytics, advertising, marketing, visitor research, or profiling of any kind. We do not sell them, and we do not share them for any commercial purpose. Information about how we measure website usage is set out separately in our Cookie Policy.

Who else has access. Our website is hosted and delivered by Vercel Inc. Each record is created at Vercel's edge network as a request arrives, and is then sent to and stored in a database that we operate on Supabase, a database hosting service. Supabase holds that database on our behalf and, under its data processing terms, may process its contents only on our instructions — it is not permitted to use them for its own purposes, or to combine them with data from any other source. Vercel's own handling of information passing through its platform is governed by its terms of service and privacy notice, published at vercel.com. Because both providers operate internationally, records may be held on servers outside Hong Kong. Apart from these two service providers, we would disclose these records only where we are required to do so by law, or where it is necessary to report or investigate an attack — for example, to a law enforcement agency or to the abuse team of another internet provider.

How long we keep them. Individual entries are automatically and permanently deleted 30 days after they are created. Separately, we keep daily aggregate counts — for example, the total number of requests received from each country and the total number blocked for each reason. These aggregates are numbers only: they contain no IP address, no browser identification string, and nothing that relates to or identifies any individual. We keep these counts indefinitely as a long-term record of the security of our website.

Your rights. The rights of access and correction described under "Your Rights" below apply to any personal data we hold about you. Because these website security records contain no full IP address and no information identifying any individual, we are generally unable to locate entries relating to a particular person, and we will not collect additional information from you in order to try. If you believe a record relating to you is held and you wish to make a request, please contact us at privacy@nextpath.hk and we will assist you so far as it is practicable to do so.

Appointment Bookings

If you book a consultation through the scheduler on our Contact page, we collect the details you enter: your name, email address, telephone number, the appointment time you select, and any notes you choose to provide.

Purpose. We use this information to schedule, confirm, remind you of, conduct and follow up on your appointment, and to communicate with you about it. We do not use your booking details for direct marketing.

Voluntary. Providing this information is voluntary, but we cannot schedule an appointment without your name, email address and a chosen appointment time.

How it is collected and stored. The scheduler is Microsoft Bookings, part of the Microsoft 365 service we already use for our email and calendar. The details you enter are transmitted directly to Microsoft and stored in our Microsoft 365 account (our booking mailbox and calendar). They do not pass through, and are not stored on, our own web servers or database. Microsoft processes this information on our behalf under the Microsoft 365 terms of service and the Microsoft Products and Services Data Protection Addendum, and may store it on servers located outside Hong Kong. Confirmation, reminder and calendar-invitation emails for your appointment are sent by Microsoft Bookings on our behalf.

Consultations. Consultations are conducted by video call using Microsoft Teams. We do not record consultations unless we tell you first and you agree.

Retention. We keep booking records for 12 months after the appointment date (or the date of cancellation, if earlier), after which they are deleted. If you become a client, information relevant to our engagement is kept in accordance with the "Data Retention" section of this policy. We may keep records longer where necessary to deal with a dispute or to comply with a legal obligation.

Your choices. You may request access to or correction of your booking information, or ask us to cancel your appointment and delete your details, by emailing info@nextpath.hk.

Enquiries, Meetings and Quotations

When you or your organisation enquire about our services, meet us or ask for a quotation, we record your name, job title, organisation, contact details, the information you give us about your organisation's HR needs (for example headcount, industry, current HR practices and timing) and the marketing channel through which you reached us. We use it to respond to you, prepare and follow up a quotation, and manage our relationship with you. Where an enquiry does not lead to an engagement, we keep these records for 24 months from the date the outcome is recorded (or from the meeting date if no outcome is recorded), and then remove all identifying details; where it does, we keep them for seven years after our relationship with your organisation ends. After identifying details are removed, we keep only non-identifying information about the engagement (such as industry, headcount and hours quoted) to help us price similar work in future. Records relating to sole proprietors, partnerships and individuals are deleted in full instead. We do not record personal data about your employees in these notes.

How We Use Personal Data

We use personal data that we collect in connection with our HR consultancy and administration services solely to: deliver the HR consultancy and administration services agreed with our clients (including payroll processing, MPF administration, and statutory tax filings); respond to enquiries; administer our client relationships; and comply with legal obligations under Hong Kong law.

The only other information we handle is the website security records described under "Website Visitors" above. Those records are used solely to protect this website, and are never used for any of the purposes described in this section, nor combined with any personal data we hold in connection with our services.

We do not sell personal data. We do not share personal data with third parties except with service providers engaged to help us deliver our services (who are bound by confidentiality and data protection obligations), or where required by law.

Direct Marketing

We may use your name, job title, organisation and business contact details (email address and telephone number) to tell you about NextPath's own products and services for employers and HR teams, namely the Rivomni HR and payroll platform, NextPath's HR outsourcing and consulting services, and related events, guides and updates. We do not provide your personal data to anyone else for their marketing.

How we do this depends on how we obtained your details:

• Details you gave us in your business capacity. If you gave us your business contact details in the course of your work, for example by booking a demo, enquiring about our services, giving us your business card, or as a client contact, we may send you the information described above without asking for separate consent, because the products and services concern your organisation rather than you personally. This follows the Privacy Commissioner's guidance on business-to-business marketing. Every message tells you how to opt out.
• Details we obtained in any other way. If we obtained your contact details from a public source such as a professional networking site or a directory, or if the details may be personal rather than business details, we will first send you a notice explaining what we would send and what data we would use, and we will send you marketing only if you agree. Silence is not treated as agreement.

Opting out. You may opt out at any time, free of charge, by using the unsubscribe link in any message or by writing to privacy@nextpath.hk. We act on an opt-out within ten working days and keep a record of it so that it continues to be honoured. Opting out does not affect messages we need to send to respond to your enquiry or to provide a service you have asked for. If you are a contact person for one of our clients, opting out stops marketing messages only; we keep your business contact details for as long as we need them to provide services to your organisation, as described under Data Retention.

Details collected before 30 September 2026. Contact details we collected before that version of the Policy took effect were collected on the basis that we would not use them for direct marketing. We will not send marketing to those contacts unless we have first sent the notice described above and you have agreed.

Data Retention

We retain personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable law in Hong Kong (for example, statutory record-keeping requirements for payroll and tax filings). Data that is no longer required is securely deleted or anonymised. Specific retention periods for our website security records and appointment bookings are set out under "Website Visitors" and "Appointment Bookings" above.

Business contact records (prospects and enquiries that do not become clients). Deleted 24 months after our last substantive contact with you (a reply from you, a meeting, a quotation, or a form you submitted; messages we send that receive no response do not count), and in any case no later than 36 months after the record was created. Client contact records are kept for seven years after our relationship with the client ends. If you opt out of marketing, we delete your contact details and keep only a one-way hashed record of your opt-out so that we continue to honour it. Records of enquiries and quotation meetings are handled as described under "Enquiries, meetings and quotations" above.

Data Security

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or misuse, and we require the same of any service provider that handles personal data on our behalf.

Your Rights

Under the PDPO, you have the right to request access to and correction of your personal data held by us. You may also request erasure of data that is no longer necessary for the purpose for which it was collected. Where we process data on behalf of a client as their service provider, we may refer your request to that client as the responsible data user, and will assist them in responding.

Contact

To exercise your rights or raise any privacy concern, contact our Data Protection Officer at privacy@nextpath.hk. We will respond within the timeframes required by the PDPO.