Privacy Policy Statement
Risk-Spark ("we", "us" or "our") respects your privacy. This Privacy Policy Statement explains what personal data we collect when you use the Risk-Spark AI anti-money laundering (AML) policy document review tool (the "Service"), how we use it, and the choices you have. We handle personal data in accordance with the Personal Data (Privacy) Ordinance (Cap. 486) of the Laws of Hong Kong (the "PDPO").
1. Personal Data We Collect
When you submit a document for review, we collect:
- Organisation and contact details: company name, licence number (optional), contact person's name, job title, email address and telephone number.
- Uploaded documents: the AML policy document you upload, together with its file name, size and type. Your document may itself contain personal data; please remove any personal data that is not needed for the review before uploading.
- Analysis results: the compliance score, risk rating, summary and recommendations generated for your submission, and a reference number.
- Technical data: your IP address and the date and time of your submission, recorded for security and audit purposes.
2. How We Use Your Personal Data
- To analyse your uploaded document and generate the compliance review report.
- To send the report to the email address you provide, when you request it.
- To contact you about your submission, where necessary.
- To keep audit records, prevent misuse of the Service and maintain its security.
- To comply with applicable laws and regulatory requirements.
We do not sell your personal data, and we do not use it for direct marketing.
3. Third-Party Processing
To perform the AI analysis, your uploaded document is transmitted to Google's Gemini API (Google LLC) and compared against reference guidelines held in a Google File Search Store. Google processes this data under its own terms and privacy policy, and data may be processed on servers outside Hong Kong. Apart from this processing, and any disclosure required by law or by a regulator, we do not transfer your personal data to third parties.
4. Data Retention
Your submission record, uploaded document and report are stored on our server and kept only for as long as necessary to provide the Service, maintain audit records and meet legal obligations. You may ask us to delete your submission at any time (see Section 7).
5. Data Security
We take reasonable technical and organisational measures to protect personal data against unauthorised access, loss or misuse, including restricting administrative access to authorised personnel. However, no method of transmission over the internet or of electronic storage is completely secure, and we cannot guarantee absolute security.
6. Cookies
The public pages of the Service do not use tracking or advertising cookies. A session cookie is used only on the administrator console to keep authorised staff signed in.
7. Your Rights
Under the PDPO, you have the right to request access to, and correction of, your personal data held by us. You may also ask us to delete your submission. To make a request, please contact us using the details below. We may charge a reasonable fee for processing a data access request, as permitted by the PDPO.
8. Changes to This Policy
We may update this Privacy Policy Statement from time to time. The updated version will be posted on this page with a revised "Last updated" date.
9. Contact Us
For any questions or requests relating to this Privacy Policy Statement or your personal data, please email support@risk-spark.com.