Privacy Policy

This Privacy Policy explains how HKPAPA collects, uses, stores, discloses, and processes personal data for the purposes of aviation training, regulatory compliance, safety, and operational requirements.

By enrolling in any HKPAPA programme, registering for any event, using HKPAPA facilities, or entering any training premises, the individual (“Student”) acknowledges and agrees to this Privacy Policy in full.

HKPAPA may collect, use, store, and process the following categories of personal data:

2.1 Identification & Contact Information

• Full name (English & Chinese)

• HKID and/or passport number & full copy

• Date of birth

• Residential address

• Email address, phone number, emergency contact

​

2.2 Aviation Security & Restricted-Area Data

• Facial images, video recordings, CCTV footage

• Information required for obtaining airside permits, visitor passes, or access to controlled or restricted aviation facilities

• Travel document details for Hong Kong and Mainland China border control

• Any data required by AVSECO, AAHK, CAD, CAAC, or other aviation security authorities

​

2.3 Training Data

• Flight training records, simulator recordings, flight logs

• Performance evaluations, instructor reports

• Attendance records and disciplinary records

• Incident / safety reports

​

2.4 Medical & Fitness Information

• Any information voluntarily provided by the Student relevant to fitness to train or participate in aviation activities
  (HKPAPA will not request medical records unless required by applicable laws or regulators.)

​

2.5 Payment and Administrative Data

• Payment records and receipts

• Billing information

HKPAPA collects personal data for purposes including but not limited to:

• Identity verification and student registration

• Safety screening and aviation security compliance

• Applying for access to airside zones, restricted areas, or Mainland training facilities

• Compliance with Hong Kong and Mainland aviation laws

• Flight training, qualification assessment, and record retention

• Incident reporting, emergency response, and safety investigations

• Communications, scheduling, operational changes, and emergency notifications

• Billing, receipts, and administrative follow-up

• Insurance claims or legal matters if required

​

If a Student refuses to provide data required for aviation-security or regulatory compliance, HKPAPA may decline or terminate training with no refund.

HKPAPA may provide personal data to the following recipients where necessary for training, safety, legal compliance, or regulatory obligations:

​

4.1 Regulatory Authorities

• Hong Kong Civil Aviation Department (CAD)

• Civil Aviation Administration of China (CAAC)

• Airport Authority Hong Kong (AAHK)

• Aviation Security Company Limited (AVSECO)

• Hong Kong Police Force, Fire Services Department

• Hong Kong Immigration Department

• Mainland China immigration, border control, airport authorities

​

4.2 Operational & Training Partners

• Zhuhai flight training organisations

• Aircraft owners and operators

• Simulator centres and aviation facilities

• Insurance providers

• Legal and professional advisers

​

HKPAPA may disclose data without prior consent when required by law, aviation security protocols, or regulatory obligations.

Personal data may be transferred to and processed in Mainland China or other jurisdictions where aviation training or related operations occur.

HKPAPA will take reasonably practicable steps to ensure the data is handled securely and in accordance with Hong Kong PDPO requirements.

HKPAPA retains personal data only as long as necessary for training, safety, regulatory, or legal purposes:

• Flight records & training logs: minimum 7 years

• Accident / incident data: permanent or as required by regulators

• Identity verification documents: duration of training relationship

• Payment records: 7 years (tax compliance)

• CCTV recordings: 30–90 days, unless required for investigation

By enrolling or attending any HKPAPA activity, the Student automatically consents to HKPAPA’s use of:

• Photos

• Videos

• Audio recordings

• Training footage (including simulator and cockpit views)

• Testimonials

• Student names and likeness

​

for the following purposes:

• Marketing, advertising, promotional campaigns

• Social media (Facebook, Instagram, YouTube, etc.)

• Internal training, documentation, educational materials

• Media releases, publications, websites, and press content

​

No recourse clause

The Student acknowledges that:

• There is no right to claim compensation, removal, damages, or objection once participating in training or HKPAPA events.

• If the Student does not agree with this clause, they must not enrol, attend, or participate in HKPAPA activities.

This protects HKPAPA from later disputes, takedown demands, or reputational claims.

The Student may request:

• Access to their personal data

• Correction of inaccurate data

HKPAPA may charge a reasonable administrative fee for data access requests. Withdrawal of consent may prevent HKPAPA from providing training services and will not entitle the Student to any refund.

The Student agrees to indemnify and hold harmless HKPAPA, its directors, officers, staff, instructors, contractors, and training partners, from any loss, liability, damage, claim, or cost arising from:

• The Student’s failure to provide accurate information

• Misuse of HKPAPA facilities or data

• Breach of HKPAPA policies

• Misrepresentation or fraudulent submission of documents

• Non-compliance with aviation security or regulatory requirements

​

For students under the age of 18:

• A parent or legal guardian must provide written consent for data collection and processing.

• The guardian acknowledges that restricted-area access may involve security vetting and data disclosure to authorities.

• The guardian consents to the use of the minor’s images, videos, and recordings for training and marketing (automatic opt-in).

• The guardian assumes full responsibility for the accuracy of the minor’s information.

HKPAPA will take reasonably practicable steps to safeguard all personal data, including:

• Encryption and secure digital storage

• Restricted access to authorised personnel only

• Locked storage of physical documents

• Regular security reviews

• Mandatory confidentiality obligations for staff

This Privacy Policy is governed by the laws of the Hong Kong Special Administrative Region. Any disputes shall be subject to the exclusive jurisdiction of the Hong Kong courts.

If any provision of this Privacy Policy is held to be invalid, illegal, or unenforceable, that provision shall be severed, and the remainder shall continue in full force and effect.

HKPAPA is a Hong Kong–based organisation and does not offer, market, or provide any services to individuals located in the European Union (EU), European Economic Area (EEA), the United Kingdom (UK), or the United States (US).

​

HKPAPA does not intend to collect, store, process, or transfer personal data of individuals who are:

• residents of the EU/EEA

• residents of the UK

• residents of the United States

• physically located in those jurisdictions at the time of data collection

​

14.1 No GDPR / UK GDPR Applicability

HKPAPA’s operations are not subject to the EU General Data Protection Regulation (GDPR) or the UK GDPR.
Individuals located in the EU/EEA/UK must not register for, enrol in, or participate in any HKPAPA programme, event, service, or activity.

​

If HKPAPA becomes aware that personal data from an EU/EEA/UK resident has been inadvertently collected, such data will be deleted without notice and the individual may be denied participation in HKPAPA activities.

​

14.2 No CCPA / U.S. Privacy Law Applicability

HKPAPA does not offer services to U.S. residents and does not fall within the scope of the California Consumer Privacy Act (CCPA) or other U.S. state privacy laws.

​

Individuals resident in the United States must not enrol in HKPAPA programmes or provide personal data to HKPAPA.

If HKPAPA inadvertently receives personal data from a U.S. resident, such data may be deleted immediately, and HKPAPA reserves the right to refuse training or participation.

​

14.3 Student Responsibility

It is the Student’s sole responsibility to ensure that they are not located in a restricted jurisdiction.
Submission of personal data to HKPAPA constitutes a declaration that the individual is not an EU/EEA/UK/US resident and is not subject to those jurisdictions’ data protection requirements.

​

14.4 Consequences of Misrepresentation

If a Student attempts to enrol while being an EU/EEA/UK/US resident:

• HKPAPA may immediately terminate their training or participation

• No refund will be issued

• HKPAPA will not be liable for any costs, losses, or claims arising therefrom