Casentra — Privacy Policy

This Policy is provided in English and Chinese. The English version prevails in the event of any conflict.

Scope and Our Role

This Privacy Policy explains how Casentra collects, uses, discloses and protects personal data in connection with the Casentra platform, applications, websites and related services (the "Service"). This Policy should be read together with the Terms of Service.

·Casentra is a data user/controller for personal data relating to Users and their use of the Service, including account information, subscription information and usage data.

·Casentra acts as a data processor for personal data relating to a User’s clients, prospects or other third parties submitted through the Service ("Client Data"). For Client Data, the User remains responsible for lawful collection, notices, consents, permissions and regulatory compliance. Casentra processes Client Data only on documented instructions and as described in the applicable Data Processing Addendum.

Personal Data We Collect

·Account and professional information, including name, email, phone number, licence or registration information, organisation, role and verification information.

·Content and Client Data submitted through the Service, including documents, files, notes, communications, recordings, prompts and other information provided by Users.

·Usage and technical information, including logs, feature usage, device information, browser information and security information.

How We Use Personal Data

·process Client Data according to User instructions to provide Service functionality;

·generate AI-assisted summaries, drafts, suggestions and other Outputs requested by Users;

·maintain, analyse and improve the Service using appropriate aggregated, anonymised or de-identified information where permitted by law; and

AI Processing and Model Usage

The Service uses artificial intelligence technologies, including third-party AI providers, to process inputs and generate Outputs.

Inputs may be transmitted to relevant AI providers only to the extent technically necessary to provide requested functionality.

Casentra does not use Client Data, prompts, uploaded files or Customer-specific content submitted through the Service to train or fine-tune general-purpose AI models for unrelated customers.

Casentra requires AI providers used in connection with the Service to apply contractual restrictions regarding the use of Customer Data submitted through the Service for model training purposes.

Casentra may use aggregated, anonymised or de-identified information that does not reasonably identify any User, client or individual for purposes including analytics, security, reliability and improvement of the Service, where permitted by Applicable Laws.

PDPO Compliance and Customer Responsibilities

Casentra processes personal data in accordance with applicable privacy laws, including the Personal Data (Privacy) Ordinance (Hong Kong).

For Client Data, Users are responsible for ensuring that they have a lawful basis, provide required notices and obtain necessary consents or authorisations before submitting such data through the Service.

Disclosure and Service Providers

We may disclose personal data to service providers and sub-processors that process data on our behalf under appropriate confidentiality, security and data protection obligations, including:

·other technology providers necessary to provide, maintain and secure the Service.

A current list of material sub-processors may be maintained and updated from time to time.

We may also disclose information where required by law, regulation, court order or competent authority, or in connection with corporate transactions.

Data Location and International Transfers

Casentra may process and store personal data in Hong Kong and other jurisdictions where Casentra, its affiliates, cloud infrastructure providers, artificial intelligence providers or other service providers operate.

Certain Service features, including AI-powered functionality, may require personal data to be processed by third-party technology providers located outside Hong Kong.

Where personal data is transferred across jurisdictions, Casentra will implement reasonable contractual, technical and organisational safeguards appropriate to the nature of the processing and applicable legal requirements.

The location of infrastructure, models and service providers may change from time to time as Casentra develops and operates the Service.

Data Retention

Casentra retains personal data only for as long as reasonably necessary for the purposes described in this Policy, the Terms of Service, applicable agreements and legal obligations.

Retention periods may vary depending on the nature of the data, Service configuration, Customer requirements and applicable laws.

Security

Casentra implements reasonable technical and organisational measures designed to protect personal data, taking into account the nature of the data processed and risks associated with the Service.

Such measures may include access controls, authentication mechanisms, encryption safeguards, monitoring and other security practices appropriate to the circumstances.

No electronic transmission or storage method can be guaranteed to be completely secure.

Data Rights

Individuals may request access to or correction of their personal data in accordance with applicable law.

Requests relating to Client Data should generally be directed to the relevant User or organisation responsible for that data. Casentra will assist Users as appropriate where acting as a processor.

Direct Marketing

Where Casentra conducts direct marketing using personal data relating to Users, it will comply with applicable legal requirements and provide appropriate opt-out mechanisms.

Cookies and Analytics

Casentra may use cookies and similar technologies to operate the Service, maintain security, remember preferences and understand usage patterns.

We record where you first came to Casentra from, such as the referring website or a campaign code, to understand which channels are useful to users.

Children

The Service is intended for professional users and is not directed to children under 18.

Contact

Changes to this Policy

Casentra may update this Privacy Policy from time to time. Material changes will be notified through the Service or by email where appropriate.