Privacy Policy
Last Updated: July 2026
1. Introduction
Welcome to StarDeriv. This Privacy Policy explains how we collect, use, disclose, and protect your personal data when you use the StarDeriv software application, website, and all associated services (collectively, the "Services").
We are committed to protecting your privacy and handling your personal data in accordance with the Personal Data (Privacy) Ordinance (Cap. 486) of the Hong Kong Special Administrative Region ("PDPO") and, where applicable, other relevant data protection laws.
By accessing or using StarDeriv, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any part of this Privacy Policy, you should discontinue use of the Services immediately.
2. Personal Data We Collect
We may collect the following categories of personal data in connection with your use of StarDeriv:
2.1 Information You Provide Directly
• Account registration data: name, email address, phone number, and username.
• Profile information: profile picture, biographical details, and preferences you choose to provide.
• Communications: records of correspondence with our customer support team, including emails, chat logs, and feedback submissions.
• Payment information: billing details and transaction records related to any paid features of the Services.
• Marketing preferences: your opt-in or opt-out choices for receiving promotional materials.
2.2 Information Collected Automatically
• Device information: device type, operating system version, browser type, IP address, device identifiers (such as IDFA or ADID), and mobile network information.
• Usage data: log data including access times, pages or screens viewed, features used, clicks, session duration, and interaction patterns within the Services.
• Location data: approximate location derived from your IP address, and precise geolocation data if you grant permission through your device settings.
• Cookies and similar technologies: information collected through cookies, pixel tags, web beacons, and similar tracking technologies (see Section 8 for details).
2.3 Information from Third Parties
• Third-party account linking: if you choose to link your StarDeriv account with a third-party service (such as a social media platform or single sign-on provider), we may receive information from that service in accordance with your settings on that platform.
• Analytics providers: aggregated usage data and analytics from third-party analytics services.
• Advertising partners: information about your interactions with our advertisements on third-party platforms.
3. Purposes for Which We Collect and Use Your Personal Data
We collect and use your personal data for the following purposes:
3.1 Provision of Services
• To create, maintain, and administer your StarDeriv account.
• To provide the core functionality and features of the Services to you.
• To process payments for any paid features or subscriptions.
• To provide customer support and respond to your enquiries and requests.
3.2 Service Improvement and Analytics
• To monitor, analyse, and improve the performance, functionality, and user experience of StarDeriv.
• To conduct research, data analytics, and statistical analysis to understand how users interact with the Services.
• To debug, identify, and repair errors or issues affecting the Services.
3.3 Security
• To protect the security and integrity of the Services and our systems.
• To detect, prevent, and respond to cybersecurity threats, unauthorised access, and malicious or fraudulent activities.
• To verify user credentials and authenticate access to accounts.
3.4 Communications and Marketing
• To send you service-related notifications, updates, security alerts, and administrative messages.
• To send you marketing and promotional materials about StarDeriv and related products or services, where you have consented to receive such communications.
• To personalise your experience and deliver relevant content and recommendations.
3.5 Legal Compliance
• To comply with applicable laws, regulations, and legal processes.
• To respond to lawful requests from public and government authorities.
• To enforce our terms and conditions and protect our legal rights.
4. Legal Basis for Processing
We process your personal data based on one or more of the following legal grounds:
• Performance of a contract: processing is necessary for the performance of our agreement with you to provide the Services.
• Legitimate interests: processing is necessary for our legitimate business interests, including improving the Services, ensuring security, preventing fraud, and conducting business analytics, provided such interests are not overridden by your data protection rights.
• Legal obligation: processing is necessary to comply with applicable laws and regulations.
• Consent: where you have given explicit consent for specific processing activities (such as marketing communications), which you may withdraw at any time.
5. Disclosure and Transfer of Personal Data
We may disclose your personal data to the following classes of persons, to the extent necessary for the purposes described in this Privacy Policy:
5.1 Affiliates and Group Companies
• Our parent company, subsidiaries, and affiliated entities that assist in providing the Services and for internal administrative and operational purposes.
5.2 Service Providers
• Cloud hosting and data storage providers.
• Payment processing service providers (for paid features).
• Customer support and communication platform providers.
• Data analytics and business intelligence service providers.
• Marketing and advertising partners (where you have consented to marketing).
• Auditors, legal advisers, and professional consultants.
5.3 Legal and Regulatory Disclosures
• Any law enforcement agency, regulatory authority, court, or government body where we are required to do so by applicable law, regulation, or legal process.
5.4 Business Transfers
• In the event of a merger, acquisition, reorganisation, or sale of all or part of our business or assets, your personal data may be transferred to the acquiring entity, subject to appropriate confidentiality arrangements.
5.5 With Your Consent
• Any other third party where you have provided explicit consent for such disclosure.
5.6 Cross-Border Data Transfers
Your personal data may be transferred to, stored, and processed in jurisdictions outside Hong Kong, including jurisdictions where our servers, affiliates, or service providers are located. Where such transfers occur, we will ensure that appropriate safeguards are in place to protect your personal data in accordance with the PDPO and applicable data protection laws. These safeguards may include contractual clauses or data transfer agreements.
6. Retention of Personal Data
We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable laws and regulations.
The retention period is determined based on the following criteria:
• The duration of your account with StarDeriv and your active use of the Services.
• The nature and sensitivity of the personal data.
• Any legal or regulatory obligations that require us to retain certain data for a specified period.
• The need to resolve disputes, enforce our agreements, or establish, exercise, or defend legal claims.
When personal data is no longer required, we will take reasonable steps to securely destroy or anonymise it.
7. Data Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised or accidental access, processing, erasure, loss, or use. These measures include:
• Encryption of data in transit and at rest using industry-standard protocols.
• Access controls to limit access to authorised personnel only.
• Regular security assessments and vulnerability monitoring.
• Employee training on data protection and information security obligations.
• Physical security measures at data centre facilities.
While we strive to protect your personal data, no method of electronic transmission or storage is completely secure. We cannot and do not guarantee absolute security. If you have reason to believe that your interaction with StarDeriv is no longer secure, please contact us immediately using the details in Section 13.
8. Cookies and Tracking Technologies
StarDeriv uses cookies, pixel tags, web beacons, and similar tracking technologies to collect information about your interaction with the Services. These technologies help us:
• Recognise you when you return to the Services and maintain your session.
• Remember your preferences and settings.
• Analyse usage patterns and improve the functionality of the Services.
• Deliver relevant advertising and measure the effectiveness of marketing campaigns.
• Detect and prevent fraudulent or unauthorised activities.
You can manage cookie preferences through your browser or device settings. Please note that disabling certain cookies may affect the functionality and performance of the Services.
9. Your Data Protection Rights
Under the PDPO and other applicable data protection laws, you have the following rights in relation to your personal data:
9.1 Right of Access
You have the right to request access to your personal data held by us and to obtain a copy of such data. We may charge a reasonable fee for processing data access requests in accordance with the PDPO.
9.2 Right of Correction
You have the right to request that we correct any personal data that is inaccurate or incomplete. You may also update certain information directly through your StarDeriv account settings.
9.3 Right to Withdraw Consent
Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out before the withdrawal. Please note that withdrawing consent for certain processing may affect your ability to use some features of the Services.
9.4 Right to Opt-Out of Marketing
You may opt out of receiving marketing communications from us at any time by using the "Unsubscribe" link in our emails, adjusting your notification settings in the StarDeriv application, or contacting us directly.
9.5 Lodging a Complaint
If you have concerns about how we handle your personal data, you have the right to lodge a complaint with the Office of the Privacy Commissioner for Personal Data (PCPD) of Hong Kong.
10. Use of Services by Minors
StarDeriv is not intended for use by individuals under the age of 18 (or the minimum age of contractual capacity in the relevant jurisdiction). We do not knowingly collect personal data from individuals under this age. If we become aware that we have inadvertently collected personal data from a minor without appropriate consent, we will take steps to delete such data promptly.
11. Third-Party Services and Links
StarDeriv may contain links to third-party websites, applications, or services that are not operated by us. This Privacy Policy does not apply to those third-party services. We encourage you to review the privacy policies of any third-party services before providing your personal data to them. We are not responsible for the privacy practices or content of any third-party services.
12. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the functionality of StarDeriv. When we make material changes, we will notify you through the Services (such as by in-app notification or email) at least 14 days before the changes take effect, where practicable. The "Last Updated" date at the top of this Privacy Policy indicates when it was last revised. Your continued use of StarDeriv after any changes to this Privacy Policy constitutes your acceptance of the updated terms.
13. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our handling of your personal data, please contact us at:
• Email: leo@starderiv.com
14. Language
This Privacy Policy is drafted in the English language. In the event of any inconsistency between the English version and any translated version, the English version shall prevail, except as otherwise required by applicable law.
— End of Privacy Policy —