Privacy Policy

Cholliman Inc. ("SPACO", "we") respects user privacy. This policy explains how we collect, use and protect your personal data, in line with the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486).

By using spacohk.com or any of our services, you accept this Privacy Policy.

When you register, book, or contact us, we collect:

• Identifiers: name, email, HK WhatsApp number. • Payment records: transaction logs for credit card / bank / FPS. Note: full card numbers are handled by Stripe; SPACO does not store them. • Booking details: venue, date, time, head count, add-ons, special requests, event nature. • Refund info: FPS ID or bank account for security-deposit refunds. • Marketing channel: how you first heard about us. • Usage logs: pages viewed, cookies, device, IP (for site analytics).

We use your data to:

• Confirm and complete bookings (door passcodes, confirmation emails, reminders). • Process payments and deposit refunds. • Customer support, enquiry responses, dispute resolution. • Improve service quality and site experience (analytics). • Marketing decisions (channel attribution, budget allocation). • Legal and tax compliance.

We do not use your data for purposes outside those disclosed without obtaining your additional consent.

We send transactional emails (confirmation, reminders, payment) that are not considered direct marketing.

If you are a member, we may also send marketing emails:

• New offers and seasonal promos • Birthday promo codes • Post-event thank-you + points notifications

You may opt out anytime via the unsubscribe link in any email, or by contacting spacohk@gmail.com.

We share your data only with the following third parties as needed:

• Payment processor (Stripe) — credit-card processing. • Email service (Resend) — booking emails. • Cloud infrastructure (Google Firebase, Vercel) — data storage and site hosting. • Google Calendar — schedule sync for branch staff. • Food and shisha vendors — order placement; only date, head count and preferences shared. • TTLock — one-time door passcode generation. • HK tax / law enforcement authorities — as legally required.

We do not sell your personal data to any third party for marketing.

Booking + payment records: 7 years from the last event (for tax / audit).

Member account data: until you request deletion. Inactive accounts (>24 months) may be deleted after email notice.

Site analytics (cookies): up to 14 months.

Refund info (FPS / bank): deleted within 1 year of refund completion unless retention is needed for audit.

We apply reasonable technical and administrative measures, including:

• HTTPS / TLS encryption in transit • Firebase Authentication for sign-in • Role-based access control (admin / CS / cleaner / marketing) • Payment data handled fully by Stripe (PCI-DSS compliant) • Regular backups • Staff confidentiality policy

However, no online transmission is 100% secure; we cannot guarantee absolute protection against hackers or other incidents.

Under the PDPO you have the right to:

• Access your data (self-service via "My Account") • Correct inaccurate data • Request deletion of your account and associated data (subject to Section 6 retention) • Opt out of direct marketing • File a complaint or enquiry

Email spacohk@gmail.com to exercise these rights; we respond within 40 working days.

We use cookies and similar technologies for:

• Keeping you signed in (essential) • Remembering your language preference (essential) • Site analytics (Google Tag Manager / GA) — visitor counts and behaviour. All data is anonymised.

You may disable cookies in your browser, but some features (sign-in, booking) may stop working.

We may update this policy from time to time. Material changes will be announced on the site or via email to members. The "Last updated" date reflects the latest version. Please review periodically.

For questions, rights requests or complaints regarding this Privacy Policy:

Email: spacohk@gmail.com Phone / WhatsApp: +852 9282 3060 Data Protection Officer: Cholliman Inc.