Legal

Privacy & Data Collection Policy

How KoiZai collects, uses, shares and safeguards personal data across our website, platform and services — including how AI-assisted features handle it.

Last updated: August 17, 2026

On this page

About this Policy

1.1

Purpose and scope. KoiZai Limited respects your privacy. This Policy describes KoiZai’s general personal data practices in connection with our websites, applications, software platform, products, services, events, communications and business activities (together, the Services). The personal data collected and the way it is handled depend on the Services used, the relationship concerned and the information supplied to us.

1.2

Applicable law. This Policy is intended to support KoiZai’s obligations under the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong (PDPO). Other privacy laws may apply to particular activities, individuals or KoiZai entities. Where applicable law provides additional rights or requirements, KoiZai will handle the relevant personal data in accordance with that law.

1.3

Meaning of personal data. “Personal data” means information that identifies, or can reasonably be used — alone or together with other information — to identify, a living individual. It includes information that can be accessed or processed in a usable form. References to “personal information” in our Services have the same meaning, unless applicable law defines the term differently.

1.4

Reading this Policy. This Policy should be read together with any Personal Information Collection Statement presented when data is collected, the applicable customer or subscription agreement, data processing terms, cookie notice and any service-specific privacy information. This general Policy does not replace a collection statement or other notice required for a particular collection activity.

1.5

Supporting notices. We provide additional privacy information where appropriate or required for a particular form, Service, feature, customer arrangement or jurisdiction. Those notices explain relevant collection purposes, whether information is mandatory or voluntary, consequences of not providing it, classes of recipients, cookies, AI processing, service providers, overseas processing and available choices or rights.

Who we are

2.1

KoiZai. In this Policy, KoiZai, we, us and our mean KoiZai Limited and any subsidiary or affiliate that is identified as responsible for a particular Service or collection activity.

2.2

Contact details. KoiZai Limited is established in Hong Kong SAR. Privacy enquiries may be sent to our CEO, who also serves as KoiZai’s Data Protection Officer where that designation is required, at info@koizai.com. Current corporate and postal contact details are available on our website.

Who this Policy covers

3.1

Individuals covered. This Policy applies to website visitors; people who contact us, request information or attend our events; users and administrators of customer accounts; directors, officers, employees, representatives and contractors of adviser firms and other business customers; advisers’ clients whose personal data is processed through the Services; suppliers, partners and other individuals who interact with KoiZai.

3.2

Separate notices. We may issue a more specific privacy or collection notice for a particular Service, form, event, recruitment activity or jurisdiction. If that notice conflicts with this general Policy, the more specific notice applies to that activity to the extent of the conflict.

KoiZai's role

4.1

KoiZai-controlled data. KoiZai determines how personal data is handled for its website, enquiries, account administration, billing, security, support and its own business operations. For these activities, KoiZai acts as the data user or controller, as applicable.

4.2

Customer-controlled data. Where an adviser firm or another business customer enters, uploads or connects client data to the KoiZai platform and determines why and how that data is used, KoiZai generally processes the data on that customer’s behalf and in accordance with the applicable customer agreement, data processing terms and documented instructions. Those terms address the authorised purposes, confidentiality, security, subprocessors, assistance with individual requests, incident notification, retention and deletion, as applicable.

4.3

Customer responsibility. Business customers are responsible for ensuring that they have authority to provide personal data to KoiZai, that their instructions comply with applicable law and professional obligations, and that they give individuals the required notices and choices.

4.4

Role depends on the activity. KoiZai’s role is assessed by reference to the particular processing activity. In some circumstances, KoiZai and a customer may have separate or overlapping responsibilities. The applicable agreement and collection notice may provide further information about those responsibilities.

Personal data we collect

KoiZai collects or processes only the categories reasonably relevant to the Services used, the relationship concerned and the information supplied. These may include account, contact, professional, financial-planning, client, technical, usage, support and communication information.

5.1

Identity and contact data. This may include name, title, date of birth where relevant, business or residential address, email address, telephone number, country or location and identity-verification information.

5.2

Account and authentication data. This may include organisation, role, username, account permissions, authentication records, password-related information, multi-factor authentication status and account preferences.

5.3

Professional and business data. This may include employer, job title, professional qualifications, licences, adviser profile, business structure, workflow configuration, authorised users, customer relationship information and communications.

5.4

Financial-planning and client data. Only where relevant to an authorised customer workflow, this may include income, expenditure, assets, liabilities, savings, investments, insurance, retirement arrangements, tax-related information, financial goals, dependants, beneficiaries, risk preferences, financial plans, scenarios, recommendations, adviser notes and supporting documents. Customers and users should not enter information that is unnecessary for the relevant purpose.

5.5

Payment and subscription data. This may include plan, billing contact, invoices, payment status and transaction references. Where payments are handled by an external payment provider, KoiZai may receive confirmation and limited transaction information rather than complete payment-card details.

5.6

Technical and usage data. This may include IP address, browser and device type, operating system, language, time zone, pages or functions used, referring website, session information, error records, system logs, audit trails and security events.

5.7

Support and communications data. This may include enquiries, feedback, survey responses, event registrations, support tickets, troubleshooting information and records of communications with KoiZai.

5.8

AI interaction data. This may include prompts, instructions, source data supplied for analysis, generated summaries or outputs, user edits, feedback, quality signals and associated audit records when an AI-assisted feature is used.

5.9

Data about other people. If you provide personal data about another person, you must have the authority to do so and, where required, inform that person about this Policy and the relevant collection notice.

How we collect personal data

6.1

Directly from you. We may collect personal data when you use the Services, create or administer an account, complete a form, communicate with us, request support, attend an event, participate in a survey, make a payment or otherwise interact with KoiZai.

6.2

From customers and authorised users. We may receive personal data from adviser firms, their authorised users, administrators and connected business partners when they configure or use the platform, upload documents, enter client information or connect another system.

6.3

From third parties. We may receive personal data from service providers, integration partners, payment providers, event organisers, professional or public sources and other parties where permitted by law. We take reasonable steps to handle such data consistently with this Policy and any applicable customer instructions.

6.4

Automatically. We may collect technical and usage data through logs, cookies and similar technologies when you access our websites or applications.

6.5

Mandatory and voluntary information. The relevant collection notice or form will identify, where required, whether information is mandatory or voluntary and the principal consequences of not providing mandatory information. We may be unable to create an account, provide a requested function, process a transaction, respond to an enquiry or meet a legal or security requirement if the necessary information is not provided.

How we use personal data

7.1

Providing the Services. KoiZai may use personal data where reasonably necessary to provide and administer the Services, create and manage accounts, authenticate users, configure customer environments, process subscriptions, support financial-planning workflows, maintain records and deliver requested products, services and support.

7.2

Communication. We use personal data to respond to enquiries, provide service messages, security alerts, product notices, training information and administrative communications.

7.3

Security and integrity. We use personal data to authenticate users, manage permissions, prevent and investigate misuse or fraud, protect systems and information, maintain audit trails and enforce applicable terms.

7.4

Analysis and improvement. We may analyse usage, performance, feedback and support information to maintain, troubleshoot, test, develop and improve the Services. Where reasonably practicable, we use aggregated or de-identified information for these purposes.

7.5

Business and legal purposes. We may use personal data for billing, accounting, audit, insurance, corporate transactions, dispute resolution, record keeping, compliance with law, regulation, court orders and lawful requests, and the establishment, exercise or defence of legal rights.

7.6

Compatible and new purposes. We will not use personal data for a new purpose that is unrelated to the purpose for which it was collected unless we obtain the individual’s express and voluntary consent or the use is otherwise permitted or required by law.

7.7

Data minimisation. We seek to collect and use personal data that is adequate but not excessive for the relevant purpose. Customers and users should avoid entering personal data that is not required for the intended workflow.

AI, algorithms and automated processing

8.1

AI-assisted functionality. Where enabled or selected by the Customer, KoiZai may use financial calculation engines, algorithms, analytics, workflow automation and AI-assisted tools, including Ask Koi, to organise information, calculate or compare scenarios, identify relevant considerations, generate summaries, support workflows and assist an adviser’s next conversation.

8.2

Adviser-led use and human review. Outputs generated by KoiZai’s calculation engines, algorithms and AI-assisted tools are intended to support, and not replace, professional judgement. Advisers and other authorised users remain responsible for reviewing the relevant client information, assumptions, calculations, limitations and outputs before relying on them or using them in advice, recommendations or other material decisions. KoiZai does not intend AI-generated outputs to be the sole basis of a material decision affecting an individual without appropriate human review.

8.3

Personal data processed by AI-assisted functions. Where an authorised AI-assisted function is used, personal data contained in prompts, client records, documents, notes or scenarios may be processed only to provide, secure, support and monitor that function, in accordance with the Customer’s documented instructions and applicable law.

Customers and users must provide only personal data that they are authorised to provide, that is relevant to the intended purpose and that they reasonably believe to be accurate and complete. KoiZai will apply appropriate data-minimisation, access-control, security, retention and deletion measures to personal data processed through AI-assisted functions.

8.4

AI model training and service improvement. KoiZai will not use identifiable Customer Data, prompts or outputs to pre-train, train, fine-tune, evaluate or otherwise improve a general-purpose or shared AI model for the benefit of KoiZai, an AI provider, other customers or third parties.

KoiZai may use aggregated or anonymised information for platform analytics, security, evaluation and service improvement where individuals cannot reasonably be identified, directly or indirectly. KoiZai will prohibit attempted re-identification.

Any other use of identifiable or re-identifiable personal data for model training or improvement requires:

1.the Customer’s specific written authorisation;
2.confirmation that the Customer is authorised to provide those instructions;
3.any notice to and consent from affected individuals required by applicable law; and
4.appropriate contractual, technical and governance safeguards.

Customer authorisation does not replace any consent or other legal requirement applicable to the individuals whose personal data is involved.

8.5

External AI providers. KoiZai may engage external AI providers to support specified platform functions. KoiZai will require each provider to process Customer Data only:

1.for the specified service purpose;
2.on KoiZai’s documented instructions;
3.for no longer than necessary; and
4.subject to appropriate confidentiality, security, access-control, retention, deletion, incident-notification and subprocessor requirements.

KoiZai will contractually prohibit external AI providers from using identifiable Customer Data, prompts or outputs to pre-train, train, fine-tune, evaluate or improve a general-purpose or shared model for the provider’s benefit or for the benefit of other customers or third parties.

Where appropriate, KoiZai will provide information about the relevant provider or provider category, the purpose of processing, the types of data involved, processing locations, retention arrangements and whether any customer-specific model configuration or evaluation is involved.

8.6

Reporting and review of AI outputs. Users may report inaccurate, inappropriate, biased, unsafe or unexpected outputs through their Customer administrator or KoiZai support.

KoiZai may review the relevant inputs, outputs, system logs and user feedback only to investigate the reported issue, provide support, maintain security, meet legal obligations and improve the reliability of the relevant function. Access will be limited to authorised personnel and service providers with a need to know.

Users should not include unnecessary personal data in feedback or support reports. Where a reported issue may involve a personal-data breach, unauthorised processing or material risk to an individual, it will be escalated under KoiZai’s applicable incident-response procedures.

Cookies and website technologies

9.1

Cookies. Our websites may use cookies and similar technologies to operate the site, remember preferences, support security, understand website use and improve visitor experience. Some cookies are necessary for the website to function; others may be optional.

9.2

Analytics and advertising. Our websites may use analytics or advertising technologies. Where they are used, a cookie notice or consent interface will identify the relevant categories, purposes, providers where appropriate, duration and available choices.

9.3

Choices. You can manage cookies through available website controls and your browser settings. Rejecting or disabling certain cookies may affect site functions. Where applicable law requires consent for optional cookies, those cookies will not be placed or accessed until the required consent has been obtained. A user may later change or withdraw the relevant choice through the available controls.

Direct marketing

10.1

Marketing use. With the consent or indication of no objection required by applicable law, KoiZai may use your name, business contact details, organisation, role, interests and interaction history to send information about KoiZai software, platform features, subscriptions, training, events, research, insights and related professional services.

10.2

Consent. We will not use personal data for direct marketing unless we have provided the information required by law and received the necessary consent or indication of no objection. Silence or failure to respond will not be treated as consent where an affirmative indication is required.

10.3

Provision for another person's marketing. If KoiZai intends to provide personal data to another person for that person’s direct marketing, we will provide the specific information and obtain the written consent required by applicable law before doing so.

10.4

Opting out. You may ask us to stop using your personal data for direct marketing at any time and without charge by using an unsubscribe link in a marketing message or contacting info@koizai.com. Opting out of marketing will not prevent necessary service, security or account communications.

Disclosure of personal data

11.1

Within KoiZai. Personal data may be accessed by authorised KoiZai directors, officers, employees and contractors who need it for the purposes described in this Policy and who are subject to appropriate confidentiality and security obligations.

11.2

Customers and authorised users. Where personal data forms part of a customer-controlled account or client record, it may be available to that customer and its authorised users in accordance with configured roles and permissions.

11.3

Service providers. KoiZai may engage service providers to support hosting, cloud infrastructure, data storage, security, authentication, communications, payments, support, analytics, professional services or AI-assisted functions. Personal data is disclosed only where reasonably necessary for the relevant service or another purpose described in this Policy.

11.4

Professional advisers and insurers. We may disclose personal data to auditors, accountants, lawyers, consultants, insurers and other professional advisers where reasonably necessary for legitimate business, compliance, insurance or legal purposes.

11.5

Legal and protective disclosure. We may disclose personal data where required or authorised by law, regulation, court order or lawful request, or where reasonably necessary to protect the rights, property, systems, users or safety of KoiZai, our customers or another person.

11.6

Corporate transactions. Personal data may be disclosed under appropriate confidentiality arrangements in connection with an actual or proposed financing, merger, acquisition, restructuring, change of control, sale of assets or similar transaction. Any resulting transfer will be made only to the extent permitted by law.

11.7

Processor controls. Where KoiZai appoints a service provider to process personal data, we use contractual or other appropriate means to require the provider to process the data only for authorised purposes and to apply suitable confidentiality, security, retention and deletion measures.

Overseas processing and transfers

12.1

International operations. KoiZai and its service providers may process personal data outside Hong Kong where this is necessary to provide the Services or carry out a purpose described in this Policy.

12.2

Safeguards. Where personal data is handled outside the jurisdiction in which it was collected, KoiZai takes steps appropriate to the circumstances and applicable law. These may include considering the nature of the information and processing, selecting suitable providers and using contractual, organisational or technical measures.

12.3

Locations and customer arrangements. KoiZai makes available, through the applicable customer agreement, data processing terms, collection notice, service documentation or another accessible notice, information about relevant categories of providers and principal processing locations. Where required by applicable law and reasonably practicable, the information will identify the likely countries in which overseas recipients process personal data. KoiZai will update that information when a material change affects the relevant processing arrangement.

Data retention and deletion

13.1

Retention principle. KoiZai retains personal data only for as long as reasonably necessary for the relevant purpose and to meet applicable contractual, legal, regulatory, accounting, security and dispute-resolution requirements.

13.2

Retention criteria and schedule. KoiZai determines and documents retention periods or criteria for relevant categories of personal data. They take account of the type and sensitivity of the information, the customer’s instructions, the relationship concerned, account and support needs, applicable limitation periods, record-keeping requirements, security considerations and whether the data is held in an active system, archive or backup. Retention arrangements are reviewed periodically and when a material processing activity changes.

13.3

Deletion or de-identification. When personal data is no longer required, KoiZai takes practicable steps to delete, securely dispose of, de-identify or make it inaccessible, subject to applicable law, documented legal holds and backup cycles. Backup copies may remain until they are overwritten or deleted under the applicable cycle, with use and access restricted in the meantime except for restoration, security, legal or compliance purposes.

13.4

Customer-controlled data. Deletion and return of customer-controlled data are governed by the relevant customer agreement, instructions and technical capabilities. KoiZai may retain limited records after account closure where required for security, audit, billing, legal compliance or the establishment, exercise or defence of legal rights.

Data security

14.1

Safeguards. KoiZai maintains administrative, technical and organisational safeguards designed to protect personal data against unauthorised or accidental access, processing, erasure, loss or use. The measures applied depend on the nature and sensitivity of the information, the relevant system and the risks involved, and may include access controls, authentication, encryption, logging, backup, personnel measures, provider oversight and periodic review or testing, as appropriate.

14.2

No absolute guarantee. No transmission, software platform or storage system can be guaranteed to be completely secure. This does not reduce KoiZai’s responsibility to take practicable steps to protect the personal data it holds.

14.3

User responsibilities. Users must protect their account credentials, use multi-factor authentication where available, maintain the confidentiality of login information, follow their organisation’s security requirements and promptly report suspected unauthorised access. Users must not share an account or password with another person.

Data incidents

15.1

Response. KoiZai maintains an incident-response and escalation process. If KoiZai becomes aware of a suspected personal data incident, it will take steps appropriate to the circumstances to assess, contain, investigate, document and address the incident. KoiZai may preserve and review relevant records to understand the incident, support notification decisions and reduce the risk of recurrence.

15.2

Notification. Where notification is appropriate or required, KoiZai will notify affected customers, individuals, regulators or other relevant parties without undue delay and within any period required by applicable law or contract. The content and timing of a notice will take account of the nature of the incident, the risks presented, available facts and steps being taken. KoiZai records the basis for material notification decisions.

Access, correction and other rights

16.1

Access and correction. Subject to applicable law, you may request access to personal data that KoiZai holds about you and request correction of data that is inaccurate. A request should be sent to our privacy contact using the details in section 20 and should contain enough information for us to identify you and the relevant data.

16.2

Verification. We may request information reasonably necessary to verify the requester’s identity and authority. If a person acts for another individual, we may request evidence of that person’s authority.

16.3

Response period. We will handle a valid access or correction request within the period required by applicable law. Under the Hong Kong PDPO, this will normally be within 40 days, subject to the Ordinance’s requirements, permitted extensions and exemptions.

16.4

Fees. Where permitted by law, we may charge a fee that is not excessive and is directly related to and necessary for complying with a data access request. We will inform the requester of any applicable fee before completing the request.

16.5

Refusal. We may refuse or limit a request where permitted or required by law. Where required, we will explain the reason for refusal within the applicable response period.

16.6

Other applicable rights. Depending on the jurisdiction, an individual may have additional rights relating to deletion, restriction, objection, withdrawal of consent, data portability or a complaint to a regulator. We will consider a request in accordance with the law applicable to the relevant processing.

Adviser firms and their clients

17.1

Primary contact. If your personal data was entered into KoiZai by an adviser firm or another business customer, that organisation is generally the appropriate first point of contact for questions about why the data was collected, how it is used and the advice or service provided to you.

17.2

Requests. A request concerning customer-controlled data may need to be directed to the relevant customer. Where appropriate, KoiZai will refer the request to the customer or assist the customer in responding, subject to the applicable agreement, law and identity-verification requirements.

17.3

No alteration of professional responsibility. KoiZai’s processing of information and provision of technology do not transfer an adviser’s professional, legal, regulatory or record-keeping responsibilities to KoiZai.

Children

18.1

General audience. The Services are intended for businesses and adult users and are not directed to children. KoiZai does not knowingly invite a child to create a user account.

18.2

Client and dependant data. An authorised adviser or customer may record information about a client’s child, dependant or beneficiary only where it is relevant to a legitimate financial-planning or service purpose and the customer has the required authority. Such data must be limited to what is necessary and is subject to appropriate access, security, retention and deletion controls.

Third-party websites

19.1

External links. Our websites or Services may contain links to websites, applications or services that KoiZai does not own or control. A link does not by itself constitute endorsement of the third party’s privacy practices.

19.2

Separate practices. KoiZai is not responsible for a third party’s independent handling of personal data. You should review the third party’s privacy notice before providing personal data or using its service.

Complaints and contact details

20.1

Contacting KoiZai. Questions, access or correction requests, marketing opt-outs and privacy complaints may be addressed to KoiZai Limited’s Privacy Officer, who also serves as KoiZai’s Data Protection Officer where that designation is required, by email at info@koizai.com or by telephone at +852 8193 2294. Current postal and corporate contact details are available on our website.

20.2

Complaints. Please describe the concern, the relevant Service or account, the personal data involved and any steps already taken. We will acknowledge and assess the complaint, may request further information and will respond within a reasonable period having regard to its complexity and applicable law.

20.3

Regulatory complaint. If you remain dissatisfied, you may contact the Office of the Privacy Commissioner for Personal Data, Hong Kong, or another competent data protection authority where applicable. Information about the Hong Kong Privacy Commissioner is available at www.pcpd.org.hk.

Changes to this Policy

21.1

Updates. We may update this Policy to reflect changes in our Services, technology, operations, legal requirements or privacy practices. The current version will be published on our website with an effective or last-updated date.

21.2

Material changes. Where a change materially affects how we use personal data, we will take reasonable steps to provide additional notice through the website, the platform, email or another appropriate channel before or when the change takes effect. We will seek consent where required by law.

21.3

Previous versions. A previous version may be made available on request where reasonably practicable.

Questions about this document?

Our team is happy to help with anything unclear.

Email the team