Privacy Policy

Last updated 30 September 2026

This policy explains how bulb ("bulb", "we", "us") handles personal data in our software for education providers, in accordance with the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong. Our separate policy at www.bulb-hk.com covers the bulb for families platform.

1. Who controls the data

Providers are the data user for their families' records. We hold and process that data on their instructions, as their data processor, under our agreement with them. The family's relationship is with the provider they booked with.

We are the data user for a provider's own account data, and for enquiries made through this website.

2. What data we hold

Data we hold includes provider details from enquiries, records held on a provider's behalf about their families, including children's details, health information relevant to their care, consents, attendance, incident records and communications. Payment records, though card details are held by our payment providers and never by us. Provider staff details, and an audit log of actions taken in the software.

3. What we use the data for

We provide operating system services to providers, enabling them to take and manage bookings, take payment and issue refunds, hold registers and attendance, keep children safe in class, and send communications to families. We keep the service secure, maintain it and improve it, including with artificial intelligence features. We respond to enquiries made through this website. We do not use a provider's family data for our own marketing, and we do not sell or trade personal data.

4. Who else sees the data

We use third-party providers for hosting, databases, authentication, payments, email and messaging, customer support, analytics and artificial intelligence services, each under its own data protection terms. Some of these providers are located outside Hong Kong. This website sets no advertising or tracking cookies. The platform uses the cookies it needs to run, and may use analytics. Any advertising tags on a provider's booking pages are the provider's own.

5. How long we keep the data

We keep data for as long as it is needed for the purposes above, and for any longer period required by law or by the limitation periods that apply to claims. Financial records are kept for seven years, records about child safety and care until seven years after the child reaches 18. Providers may ask us to remove family records sooner, subject to those periods. When a provider stops using the platform, we return or delete their family data on their instruction.

6. Security

Personal data is encrypted in transit and at rest. Access is limited by role and by venue, every provider's data is kept separate from every other provider's, and changes to records are logged. If personal data held for a provider is compromised, we will tell that provider promptly and support them in handling it.

7. Your rights

Under the PDPO you may request access to and correction of your personal data, and we will respond within 40 days. You may also ask us to delete personal data that is no longer needed for the purpose it was collected for.

8. Direct marketing

We may contact providers about bulb using the details they give us, with your consent, which you can withdraw at any time. A provider's families are only contacted with messages that the provider has set up with their consent.

9. Contact us

Please contact bulb, Level 23, One Island East, 18 Westlands Road, Quarry Bay, Hong Kong. hello@bulb-hk.com. Business Registration 41624592.

To exercise rights over a child's or a family's records, please contact the provider you booked with.

10. Changes to this policy

We may update this policy from time to time. Changes will be posted on this page, and we inform providers directly about any change that affects how their families' data is handled.