私隱政策

Enolent Technology Limited ("we") develops and operates Cortile, a resident-management app and property-management console (the "Service"). This Policy explains how we collect, use, disclose and protect your personal data. The Service is adopted by your building's property-management party (the "PM") to serve residents. Using the Service means you have read and understood this Policy.

For data generated using community-management features (read-status, maintenance tickets and photos, visitor invites, facility bookings, polls, notices — "Resident Operational Data"), we process on the PM's instructions; the PM is controller/data user and we are its processor. For account and technical data needed to run the App (login ID, device push token, version/language, security and debug logs) we determine purposes and means and are the controller/data user. We have a DPA with each PM.

We collect only the minimum needed: (a) Identity/contact: name, email, mobile, login user ID; (b) Residence: building, block, floor, unit, parking (if any); (c) Resident activity: maintenance descriptions and photos, visitor data (name, window, plate), bookings, polls, lost-and-found/notices, read-status; (d) Financial: management-fee and other bills, payment status and records; (e) Technical: device push token, app version, language, limited technical logs. We do not track across apps/sites and do not use data for third-party advertising.

We process only with a legal basis. Hong Kong: under PDPO (Cap.486), for a lawful purpose directly related to our functions, fairly collected with a collection statement; change of purpose requires express consent. Taiwan: under Arts. 19–20 PDPA, based on our contractual/quasi-contractual relationship and a specific purpose, with your consent. Macau: under Art. 6 of Law 8/2005, as necessary to provide the service and/or with your explicit consent. Cross-border consent: see §7.

All uses are limited to providing and maintaining the Service: creating/managing accounts and unit binding; providing announcements, billing, maintenance, visitors, packages, bookings, polls, documents, emergency help; sending related push notifications (adjustable in settings); verifying residents and access credentials; security, abuse-prevention, debugging and improvement; complying with legal obligations. We do not sell your personal data.

We disclose only as necessary: (i) your PM — staff/admins access data to handle service requests; (ii) service providers — cloud hosting, push notifications, [future] payment processing, processing only on our instructions; (iii) legal requirements — where required by law, court order or competent authority. All providers must apply appropriate security and process only for specified purposes.

Our servers and database are hosted in Taiwan (region asia-east1). Taiwan residents: your data is stored and processed within Taiwan; no cross-border transfer. Hong Kong or Macau residents: your data is transferred to and stored/processed in Taiwan, safeguarded by (i) a DPA with protective clauses, (ii) encryption in transit and at rest and access controls, and (iii) transferring only what is necessary. Macau residents: under Art. 20 of Law 8/2005 we transfer only after your explicit consent and appropriate contractual safeguards [counsel to confirm whether GPDP authorisation/notification is also required]. You may withdraw consent anytime; we may then be unable to provide some or all of the Service.

We retain your personal data only as long as necessary for the purposes in this Policy or as required by law. After account termination or unit unbinding, we delete or anonymise within a reasonable period, except where retention is legally required. Specific retention periods to be set by counsel per the three jurisdictions.

You can request deletion of your account at any time within the App at [My > Delete Account], or by emailing [privacy@…]. We will delete or anonymise your personal data within a reasonable period, except for (i) data we must retain by law, and (ii) financial/billing records the PM must keep for fee disputes or statutory obligations, deleted after the applicable period. Some data may persist briefly in backups and is purged on our backup overwrite cycle.

The Service serves many buildings on one system. We apply database-level Row-Level Security and other measures so each building's data is isolated and not accessible from another building.

We apply technical and organisational measures proportionate to risk: TLS (HTTPS), encryption at rest, passwords hashed with argon2, access controls, row-level isolation, audit logging, periodic security testing. No system can guarantee absolute security.

Subject to applicable law you may have rights to: access and obtain a copy, request correction, request deletion (where permitted), withdraw consent, and lodge complaints. Exercise via §13; requests involving data held by the PM may be referred to the PM. Exact scope and procedure per jurisdiction to be completed by counsel (HK PDPO access/correction; Taiwan PDPA Art. 3; Macau law).

The Service is for residents and not designed for children. A primary household account may create sub-accounts for family members; whoever creates an account for a minor is responsible for it and must ensure necessary consents are obtained.

For queries, requests or complaints, contact Enolent Technology Limited at [privacy email, consistent with the App's support email or a dedicated privacy@]. [Add offices and DPO contact if legally required.] You may also complain to your local authority: Hong Kong PCPD, Taiwan's competent authority, or Macau GPDP.

We may update this Policy; material changes will be notified in-app or by other appropriate means. The latest version is published at [Privacy URL, matching the App's BrandConfig.privacyURL]. Effective date: [to be set after counsel finalises].