Privacy policy

This policy explains what personal data Local Hong Kong (“we”, “the operator”) collects when you use the site, why, how we use it, how long we keep it and what rights you have. It is our privacy policy statement and personal information collection statement under the Personal Data (Privacy) Ordinance (Cap. 486) (“PDPO”). Short version: we collect very little, we never sell personal data, we do not use it for direct marketing, and most pages work without any account at all.

Effective 14 October 2026.

1. Who we are

The data user responsible for your personal data is the site operator named on the operator details page. For questions about personal data, email us.

2. What personal data we collect

2.1 Data you give us

You can read the whole directory without telling us who you are. We collect personal data only when you:

• Create an account: e-mail address, display name and a salted password hash (never the password itself), plus a two-factor secret if you enable it;
• Add or claim a business: your name, work e-mail, phone number, your role in the business, your message and any documents you send us for verification;
• Buy a paid service: the details needed to issue an invoice and record the payment (we do not receive full card numbers);
• Contact us or report content: whatever you put in the message.

Unless a field is marked optional, the information is needed for the purpose stated; if you do not provide it, we may not be able to open your account, process your claim or answer your message.

2.2 Data collected automatically

• Server logs: IP address, user agent, requested page and time, kept for security and for a short period (section 4);
• Cookies: described in section 8;
• Outbound clicks: we count clicks on business website links per listing; the count is not linked to you;
• Quick-search questions: what people type into the search box or the assistant is stored as text with a counter, without any IP address or identifier, to improve search;
• Approximate location: when the assistant suggests places near you, it uses the country and city hint our CDN attaches to the request, or coordinates you explicitly share with the location button. Neither is stored.

2.3 Business listings

Listings contain business contact details that are already public: name, address, phone, website, opening hours, Google rating and the latest public reviews as shown on Google Maps. Where an individual’s name forms part of a business name (for example a sole proprietor or a doctor’s clinic), it is shown as it appears in public sources, for the purpose of helping the public find and contact the business. To correct or remove a listing, use the notice and takedown process.

We do not ask for your Hong Kong Identity Card number, and we do not take decisions about you based solely on automated processing.

3. Purposes of use (DPP1 and DPP3)

• To run the site and keep it secure (logs, rate limiting, abuse prevention);
• To operate your account, claims and listings and to e-mail you about them (the terms of use);
• To verify that a claimant represents a business (claim verification policy);
• To answer messages and reports;
• To improve search and the assistant, using aggregated queries that identify nobody;
• To provide paid services and keep the records the law requires;
• To show advertising (section 8).

We use personal data only for these purposes or directly related purposes. For any new purpose we will ask for your express and voluntary consent first.

Direct marketing. We do not use your personal data in direct marketing and we do not provide it to anyone else for use in direct marketing. If we ever wish to do so, we will first tell you what data we would use and for what kinds of products or services, and we will act only with your consent, as Part 6A of the PDPO requires. You may opt out at any time free of charge. Transactional e-mails (claim decisions, password resets) are not marketing and are the only messages we send.

Visitors from the European Union. If the EU General Data Protection Regulation (GDPR) applies to you, you have in addition the rights of access, rectification, erasure, restriction, portability and objection, and the right to complain to the data protection authority of your country. The contact for these requests is the same.

4. Retention (DPP2)

We keep personal data no longer than necessary for the purpose for which it is used:

• Server logs: 30 days;
• Verification documents: deleted within 30 days of the claim decision;
• Account data: until you delete the account, then deleted within 30 days, except records we must keep by law (for example business records of payments for paid services, kept for the period required by Hong Kong tax law, generally seven years);
• Listing edits and claim records: for as long as the listing exists, so we can show who changed what;
• Aggregated statistics and query counters: indefinitely, because they identify nobody.

5. Transfer, processors and disclosure

We do not sell personal data and we do not share it with third parties for their own marketing. Personal data may be transferred to:

• Infrastructure providers (data processors): our hosting provider DigitalOcean, LLC (United States) and our CDN and security provider Cloudflare, which see the traffic needed to deliver the site. We use contractual means to require them to protect the data and not to keep it longer than necessary;
• Advertising and analytics partners such as Google, which set their own cookies as described in section 8;
• Google, whose image servers deliver listing photos directly to your browser (we send no referrer and do not tell them who you are);
• Law enforcement agencies, regulators and courts, where required or permitted by law;
• A successor, if the site changes hands, under this same policy.

Servers outside Hong Kong. The site’s servers are located outside Hong Kong, in data centres of DigitalOcean, LLC, and traffic passes through Cloudflare’s global network. Personal data you give us is therefore stored and processed outside Hong Kong, in places whose laws may not offer the same protection as the PDPO. We limit what is transferred to what is needed to run the site and protect it with the measures described in section 9.

6. Access and correction (DPP6)

Under the PDPO you have the right to:

• ask whether we hold personal data about you and request a copy of it (a data access request);
• ask us to correct personal data that is inaccurate (a data correction request);
• be told our policies and practices on personal data and the kinds of data we hold (DPP5);
• delete your account yourself from your account page;
• complain to the Office of the Privacy Commissioner for Personal Data (pcpd.org.hk).

To make a request, email us from the e-mail address on the account, or with enough detail for us to find your data. You may use the PCPD’s data access request form. We will comply within 40 days of receiving the request, as the PDPO requires, or tell you within that period why we cannot. We may ask you to confirm your identity. As permitted by the PDPO, we may charge a fee that is not excessive for complying with a data access request; we will tell you the amount before we proceed, and we do not charge for correcting data.

Children. The site is not directed at children, and accounts are for people aged 18 or over. We do not knowingly collect personal data of children; if you believe a child has given us personal data, tell us and we will delete it.

7. Withdrawing consent and closing your account

Write to us (email us) with the subject “Withdrawal of consent” from the e-mail address on your account, or delete the account from your account page. We then stop using your data for the purposes you consented to and delete it within 30 days, unless the law requires us to keep it (for example the payment records mentioned in section 4). Withdrawal does not affect use made before it.

8. Cookies and similar technologies

Our own cookies are only the essential ones without which the site cannot do what you asked:

Advertising cookies. Where advertising is shown, Google AdSense and its partners may set cookies to show and measure ads, including personalised ads based on your visits to this and other websites. We do not control those cookies. You can opt out of personalised advertising at adssettings.google.com, and browsers let you block or delete cookies; the directory keeps working without them, you may simply see non-personalised ads.

No analytics trackers. We do not use third-party analytics scripts. Our traffic figures come from our own server logs, aggregated.

9. Security (DPP4)

Passwords are stored as salted hashes, accounts can be protected with two-factor authentication, admin sessions require it, the site is served over HTTPS only, access to data is limited to the people who need it, and requests are rate-limited. No system is perfectly secure; if a data breach occurs that is likely to cause real harm, we will notify the people affected and the Privacy Commissioner for Personal Data where appropriate, following the PCPD’s guidance on data breach handling.

10. Changes to this policy

We may update this policy as the site changes. The effective date at the top tells you when. Material changes are announced on the site, and by e-mail to account holders. The current version is always available at this address. If the Chinese and English versions differ, the Chinese version prevails.

11. Contact

For questions, data access or correction requests, email us. Some links on this site are affiliate or sponsored links. If you book or buy through them we may earn a commission at no extra cost to you.