私隱政策

一、資料類別及來源

視乎您使用的服務，我們收集您提供的資料、獲授權登入服務提供的資料，以及提供服務所產生的紀錄。資料亦可來自您交予本公司的實體會員表格。

• 帳戶及聯絡資料：姓名、電郵地址、電話號碼、會員編號及登入識別資料。
• 訂座及會員服務資料：訂座日期、時段、人數、聯絡資料、備註、到店狀態、積分、投票、獎賞、優惠券分派及兌換紀錄。
• 通訊及申請資料：您向我們提交的查詢、附件及招聘表格資料。
• 運作及安全紀錄：登入、服務使用、系統活動及管理操作紀錄。

請勿在備註、查詢或申請中提供與服務無關的身份證號碼、付款卡資料、健康資料或其他敏感資料。

二、用途及提供資料的選擇

我們為建立及驗證帳戶、處理訂座、管理會員資格及優惠、回應查詢、處理招聘、維護服務及安全、防止濫用，以及履行適用法律責任而使用資料。相關資料亦可在本公司使用的 Café Lounge、Café Club 及 Kitchen 系統之間，按提供相關服務的需要處理。

您可選擇不提供資料；但若欠缺提供某項服務所需的資料，我們可能無法建立帳戶、確認訂座、設定會員資格或處理申請。選填資料不應作為使用無關服務的必要條件。收集時提供的特定聲明會說明該項收集的用途及要求。

三、登入及技術服務供應商

本平台使用 Base44 提供的應用程式、資料儲存及相關技術服務。資料可能由 Base44 及其相關服務供應商處理。其適用條款及私隱資料可於 https://base44.com/privacy-policy 及 https://base44.com/dpa 查閱。

如您選用第三方登入，我們可按您授權的權限取得姓名、電郵地址及登入識別等基本資料；我們不會取得您在該第三方的帳戶密碼。第三方亦按其自身私隱政策處理資料。

供應商的資料處理及人工智能模型訓練安排可能因方案、合約及設定而異。本政策並不代表所有供應商均不使用資料作模型訓練，亦不構成您就任何需要另行取得同意的用途作出同意。

四、披露及境外處理

我們不出售個人資料。為本政策所述目的，我們可按需要向獲授權人員、提供託管、身份驗證、通訊、技術支援或其他相關服務的供應商，以及提供法律或專業服務的顧問披露資料。我們亦可在法律要求或允許，並確有必要處理合法申索或保護合法權益時披露資料。

資料可能在香港以外儲存或處理，包括 Base44 使用的海外基礎設施。實際位置取決於適用服務及設定；本公司並不保證資料僅留在香港。我們會按適用法律採取合約或其他保障措施，處理受託處理者的保安及保存安排。

五、公開內容及招聘

排班、相片及作品功能可公開展示獲准發佈的員工姓名、職務、照片、社交連結、生日月日及相關內容；我們會按適用法律及相關授權處理公開展示。請勿提交未獲授權公開的第三者個人資料。

招聘資料用於評估申請、聯絡申請人及處理招聘事宜。申請表可能另附收集聲明；如有更具體的招聘安排，應一併閱讀。

六、保存及安全

我們只在達成相關目的或履行適用法律責任所需期間保存個人資料，並考慮帳戶狀態、未完成訂座、優惠及申索、招聘進度、防止欺詐及法定保存要求。資料不再需要時，會採取合理步驟刪除或去識別化。

帳戶關閉或紀錄到期不代表所有備份即時清除；備份及供應商紀錄可能按適用保存週期保留，並繼續受到相應保護。我們採取合理的存取控制及技術、管理措施，但沒有系統可保證絕對安全。

七、服務訊息、推廣及技術識別

我們可就訂座、帳戶、安全或服務變更發送必要通知。使用個人資料作直接促銷前，我們會按適用法律提供所需通知並取得所需同意；單純使用本平台或沒有回覆並不代表同意直接促銷。您可聯絡我們停止直接促銷，毋須支付費用。

登入及服務功能可能使用 cookies、本機儲存或類似技術。如使用需要額外通知或同意的分析或廣告技術，我們會按適用要求提供資料及取得所需同意。

八、查閱、更正及刪除要求

您可向下列聯絡方式提出個人資料查閱或更正要求，亦可要求更新會員資料或關閉帳戶及刪除相關資料。我們可能要求合理資料核實身份，不應要求與核實無關的資料。

我們會依適用法律及其例外處理查閱及更正要求；在適用情況下，須於收到要求後四十日內處理。如依法無法依期或全面處理，會按適用要求通知您。資料查閱可收取不超乎適度的費用，並事先告知。

關閉帳戶及刪除要求受適用保存責任、未完成服務及合法申索等限制；我們會說明任何不能刪除的相關資料及原因。

九、未成年使用者

本平台主要供十二歲或以上人士使用。未滿十二歲人士只應在家長或監護人監督下使用。未成年人士在提交個人資料或申請服務前應徵詢家長或監護人；有關成年人可聯絡我們處理兒童資料。

十、更新、語言及聯絡

本政策的版本及生效日期於本頁列明。重大更改會於本平台公布，並在適當情況下透過其他合理方式通知；如法律要求另行取得同意，我們會取得該同意，而非僅依賴繼續使用本平台。

中英文版本旨在具有相同意思。如有差異，請聯絡我們澄清；任何解釋均不限制適用法律下的權利。

私隱查詢、查閱、更正及刪除要求請聯絡：

MM CAFE LIMITED — 香港

電郵：contact@mmcafe.hk

1. Data Categories and Sources

Depending on the services you use, we collect information you provide, information from authorized sign-in services, and records generated in providing services. Information may also come from physical membership forms you submit to us.

• Account and contact information: name, email address, telephone number, membership ID and sign-in identifiers.
• Reservation and membership information: reservation dates, slots, party sizes, contact details, notes, attendance status, points, votes, rewards, voucher distributions and redemption records.
• Communications and applications: enquiries, attachments and recruitment form information you submit.
• Operational and security records: sign-in, service usage, system activity and administrative action records.

Do not include identity card numbers, payment card details, health information or other sensitive information unrelated to the service in notes, enquiries or applications.

2. Purposes and Your Choices

We use information to establish and verify accounts, handle reservations, administer memberships and benefits, respond to enquiries, process recruitment, maintain services and security, prevent misuse, and meet applicable legal obligations. Relevant information may also be processed between the Café Lounge, Café Club and Kitchen systems we use, as needed for the relevant service.

You may choose not to provide information, but without information needed for a particular service we may be unable to create an account, confirm a reservation, set up membership or process an application. Optional information should not be a condition of unrelated services. Collection-specific notices explain the purposes and requirements for that collection.

3. Sign-in and Technology Providers

The Platform uses application, data storage and related technology services provided by Base44. Information may be processed by Base44 and its relevant service providers. Its applicable terms and privacy information are available at https://base44.com/privacy-policy and https://base44.com/dpa.

If you choose third-party sign-in, we may receive basic information such as your name, email address and sign-in identifiers according to your authorized permissions. We do not receive your password for that third-party account. Third parties also process information under their own privacy policies.

Providers' data processing and AI-model training arrangements may vary by plan, contract and settings. This policy does not represent that all providers exclude data from model training, and does not constitute your consent to any purpose requiring separate consent.

4. Disclosure and Overseas Processing

We do not sell personal data. For the purposes described in this policy, we may disclose information as needed to authorized personnel; providers of hosting, authentication, communications, technical support or other relevant services; and legal or professional advisers. We may also disclose information where required or permitted by law and genuinely necessary to address lawful claims or protect legitimate rights.

Information may be stored or processed outside Hong Kong, including through overseas infrastructure used by Base44. Actual locations depend on the relevant services and settings; we do not guarantee that information remains only in Hong Kong. We take contractual or other safeguards under applicable law to address entrusted processors' security and retention arrangements.

5. Public Content and Recruitment

Schedule, photo and artwork features may publicly display staff names, roles, photographs, social links, birthday month and day, and related content authorized for publication. We handle public display in accordance with applicable law and relevant permissions. Do not submit third-party personal data without authorization for publication.

Recruitment information is used to assess applications, contact applicants and manage recruitment. Application forms may include separate collection notices, which should be read alongside any more specific recruitment arrangements.

6. Retention and Security

We retain personal data only as long as necessary for the relevant purposes or applicable legal obligations, considering account status, outstanding reservations, benefits and claims, recruitment progress, fraud prevention and statutory retention requirements. When information is no longer needed, we take reasonable steps to delete or de-identify it.

Account closure or record expiry does not mean immediate erasure from all backups. Backups and provider records may remain under applicable retention cycles and continue to receive appropriate protection. We use reasonable access controls and technical and organizational measures, but no system can guarantee absolute security.

7. Service Messages, Marketing and Technical Identifiers

We may send necessary notices about reservations, accounts, security or service changes. Before using personal data for direct marketing, we provide required notices and obtain required consent under applicable law. Merely using the Platform or not responding does not constitute consent to direct marketing. You may contact us to stop direct marketing without charge.

Sign-in and service functions may use cookies, local storage or similar technologies. If we use analytics or advertising technologies requiring additional notice or consent, we will provide information and obtain required consent in accordance with applicable requirements.

8. Access, Correction and Deletion Requests

You may use the contact details below to request access to or correction of personal data, update membership information, or request account closure and deletion of related information. We may request reasonable information to verify identity, but should not request information unrelated to verification.

We handle access and correction requests under applicable law and its exceptions, including the applicable requirement to comply within 40 days after receiving a request. If we cannot lawfully comply on time or in full, we will notify you as required. A fee that is not excessive may be charged for data access, with advance notice.

Account closure and deletion requests are subject to applicable retention obligations, outstanding services and lawful claims, among other relevant limitations. We will explain any relevant information that cannot be deleted and why.

9. Younger Users

The Platform is primarily intended for people aged 12 or above. Children under 12 should use it only with parental or guardian supervision. Minors should consult a parent or guardian before submitting personal data or applying for services. Relevant adults may contact us concerning children's information.

10. Updates, Languages and Contact

This page identifies the policy version and effective date. Material changes will be announced on the Platform and, where appropriate, through other reasonable means. Where separate consent is legally required, we will obtain it rather than rely only on continued use.

The Chinese and English versions are intended to have the same meaning. Please contact us to clarify any discrepancy; no interpretation limits rights under applicable law.

For privacy enquiries and access, correction or deletion requests, contact:

MM CAFE LIMITED — Hong Kong

Email: contact@mmcafe.hk