cQ-Core
PRIVACY NOTICE



cQ Core™ | cqcore.com | cqprivate.com | Private Entry Form
Effective 6 August 2026


1. Who we are


APCQ Limited is responsible for the personal data described in this Privacy Notice (the data user under Hong Kong law and, where applicable, the controller under other data protection laws).

APCQ Limited
Business Registration Number (BRN): 74148434
Registered office: Unit 2223, 22/F,
Yan’s Tower, 25–27 Wong Chuk Hang Road,
Aberdeen, Hong Kong

Privacy and contact email: receive@cqprivate.com

This Notice applies when you visit cqcore.com or cqprivate.com, contact us about cQ Core, submit the private entry form embedded on cqprivate.com (the Form), schedule or take part in an online meeting arranged by us through Whereby, or make or attempt a payment to APCQ Limited for cQ Core through Stripe.



2. Personal data we collect


Depending on how you interact with us, we may collect:

• Entry information: your description of what remains unresolved, its current impact, what meaningful change would look like, why you are applying now, and your stated readiness for a 12-month programme;
• Identity and contact information: your full name and private email address;
• Scheduling and online meeting information: appointment date and time, meeting link or room information, optional display name, participant identifier, attendance and call duration, IP address, browser and device information, and connection or diagnostic data. Audio, video and screen-sharing content are processed in real time to provide the meeting;
• Billing and transaction information: payer and billing contact details, billing address, invoice or tax information, amount, currency, payment status, payment method type and limited payment-method details made available to us by Stripe (such as the card brand and last four digits), as well as information about invoices, subscriptions, refunds, disputes and failed or attempted payments;
• Communications: messages you send to us and our replies, including scheduling, meeting and application follow-up;
• Decision and administration information: submission identifier, source, form and notice version, submission date and time, review status, assigned reviewer, internal assessment notes and the outcome of the entry review;
• Technical information: IP address, browser and device information, timestamps, locale, time zone, security and diagnostic logs, and information produced by essential website or Form technologies.

Payment credentials, such as a full card number and card security code, are entered into Stripe-hosted or Stripe-controlled payment fields and are handled directly by Stripe. APCQ Limited does not store those credentials.

Whereby processes audio, video and screen-sharing content to transmit an online meeting. APCQ Limited does not record or transcribe an online meeting unless participants are told in advance and any consent or other permission required by law is obtained. Whereby states that it does not store meeting media except on a strictly transient basis where necessary for transmission, unless a recording feature is deliberately used.

We do not request payment-card information, passwords, document uploads or medical records through the Form.



3. Sensitive information and what not to submit


The Form is designed to assess a private entry request, not to collect medical records or provide medical, psychological or psychotherapeutic services.
Please do not submit passwords, payment-card details, identity documents, medical records, diagnostic reports or other detailed health information.

Your free-text answers may nevertheless reveal sensitive information.
We limit access to those answers, use only information reasonably necessary to review the request, and may ask you to remove, clarify or resubmit information that is unnecessary.
We may redact or delete unnecessary sensitive information where practicable and lawful.



4. Why we use personal data


We use personal data to:

1. receive, validate and review your entry request;
2. communicate with you, schedule and conduct online meetings, and respond to questions;
3. assess suitability, readiness, capacity and alignment with the programme’s entry criteria;
4. provide online meetings and diagnose connection or service issues;
5. prevent duplicate, fraudulent, abusive or technically invalid submissions;
6. operate, secure, troubleshoot and improve the websites, Form and online meeting process;
7. keep an accountable record of notices, submissions, scheduling, human review and decisions;
8. process payments, issue invoices and receipts, administer subscriptions, refunds, failed payments and disputes, prevent payment fraud, and maintain accounting records; and
9. establish, exercise or defend legal rights and meet legal or regulatory obligations.

Supplying personal data is voluntary. However, the fields marked as required are necessary for us to assess and respond to your entry request. If you do not provide them, we will not be able to process the request.

We do not use entry data for direct marketing unless we first provide a separate choice and obtain any permission required by applicable law.



5. Legal grounds


Under the Personal Data (Privacy) Ordinance of Hong Kong, we collect and use personal data only for lawful purposes directly related to our activities, in a manner that is necessary, adequate and not excessive, and consistently with the purposes notified at collection.

Where the UK GDPR, EU GDPR or a similar law applies, we rely on one or more of the following grounds:

• taking steps at your request before entering into an arrangement with you;
• our legitimate interests in operating a selective entry process, communicating with applicants, protecting our systems, maintaining records and improving the application experience, balanced against your rights;
• compliance with legal obligations; and
• establishment, exercise or defence of legal claims.

Where applicable law requires consent for a specific activity, we will ask for it separately. You may withdraw that consent prospectively at any time.



6. Human review and decisions


Submitting the Form does not guarantee admission and does not create a participant, advisory, therapeutic or other professional relationship with APCQ Limited or cQ Core.

Entry requests are reviewed by authorised people. We do not make admission decisions based solely on automated processing that produces legal or similarly significant effects.
Technical rules may flag incomplete, duplicate or suspicious submissions for human review.



7. Who receives personal data


We disclose personal data only where reasonably necessary to the following classes of recipient:

• authorised APCQ Limited personnel and carefully selected reviewers who need it for the entry process;
• service providers supporting the Form, records, communications, online meetings, payments, billing, fraud prevention, website operation, security and technical support;
• professional advisers, auditors, insurers, regulators, courts or public authorities where disclosure is necessary and lawful; and
• a successor or transaction counterparty if APCQ Limited undergoes a genuine reorganisation, financing, sale or transfer, subject to appropriate confidentiality and legal safeguards.

Our current core application service providers include:

• Fillout / Zite (Restly, Inc.), which hosts and transmits the Form;
• Airtable (Formagrid Inc.), which stores and supports the management of entry records;
• Proton, which supports email communications;
• Whereby AS, which provides online video meetings and processes meeting participant information, meeting metadata, connection and diagnostic data, and the transient audio, video and screen-sharing streams needed to carry the call; and
• Stripe and its relevant affiliates and financial partners, which process payments and support billing, invoices, fraud prevention, refunds and disputes.

These providers may use their own subprocessors. They process personal data under their contractual terms and applicable data protection obligations. Whereby may also process certain account, usage and technical information for its own service, security and legal purposes, as described in the Whereby Privacy Policy at https://whereby.com/information/tos/privacy-policy/. Stripe may also process certain transaction and identity data for its own legal, regulatory, security and fraud-prevention purposes, as described in the Stripe Privacy Policy at https://stripe.com/privacy. We do not sell personal data.



8. International transfers


APCQ Limited is established in Hong Kong. Our service providers and authorised recipients may process data in Hong Kong, Norway, Ireland, the United States, Switzerland, other locations in the European Economic Area, and other countries in which they or their subprocessors operate. Online meeting traffic may pass through video-router infrastructure selected according to participant location and network conditions.

Where applicable law restricts international transfers, we use a recognised transfer mechanism or other appropriate safeguards, such as contractual protections, and assess supplementary safeguards where required. You may contact us for further information about the safeguards relevant to your data.



9. Retention


We keep personal data only for as long as reasonably necessary for the purposes described above:

• incomplete or abandoned Form data: up to 30 days, where the Form provider makes it available to us;
• entry requests not progressed or not accepted: normally 12 months after the last substantive contact or final decision;
• requests placed on hold with your agreement for future consideration: up to 24 months after the last substantive contact;
• accepted applicants: entry information is retained as part of the participant onboarding record and becomes subject to any more specific participant privacy information provided at onboarding;
• scheduling and online meeting administration records: normally for the same period as the related entry request or participant record;
• meeting audio, video and screen sharing: not recorded or retained by APCQ Limited unless participants receive advance notice and any permission required by law is obtained; Whereby may process meeting media transiently to provide the call;
• billing, invoice, transaction, refund and accounting records: normally at least seven years after the relevant transaction, or longer where required by applicable tax, accounting, corporate-record or legal-claims requirements;
• security, diagnostic and consent/audit records: normally up to 24 months, unless a shorter provider setting applies.

We may retain limited information for longer where necessary to comply with law, resolve a dispute, enforce an agreement or establish, exercise or defend legal claims. At the end of the applicable period, we delete or irreversibly anonymise the data, subject to secure backup cycles.


10. Cookies and similar technologies


The websites, embedded Form, Whereby meeting pages and Stripe-hosted or Stripe-controlled payment pages may use technologies necessary to display the pages, maintain security, prevent fraud, balance traffic, remember essential settings, submit the Form, join an online meeting and complete a payment. These technologies may process technical information described in section 2.

We do not state that we use optional advertising or behavioural-profiling cookies under this version of the Notice. If we introduce non-essential analytics, advertising or similar technologies, we will update this Notice and provide any choice or consent mechanism required by applicable law before using them.

Your browser may allow you to block technologies, but blocking essential technologies may prevent the Form or parts of the websites from working correctly.



11. Security


We use reasonable administrative, technical and organisational measures designed to protect personal data against unauthorised or accidental access, processing, loss, alteration, erasure, use or disclosure. Measures include access controls, limited-role access, authentication safeguards, provider due diligence and operational review.

No internet transmission or storage system can be guaranteed to be completely secure. Please use the Form only for the limited information requested and do not send sensitive documents by ordinary email unless we have expressly agreed a suitable method.



12. Your rights


Subject to applicable law, you may ask us to:

• confirm whether we hold personal data about you;
• provide access to, or a copy of, that data;
• correct inaccurate or incomplete data;
• delete data that is no longer required;
• restrict or object to certain processing;
• provide certain data in a portable form; or
• withdraw consent where processing is based on consent.

Hong Kong law provides rights of access and correction, subject to statutory requirements and exemptions. We may need to verify your identity before acting on a request. Where permitted by law, a reasonable fee may apply to a formal data access request; we will explain any fee before proceeding.

You may also complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong or, where another data protection law applies, to the competent supervisory authority in your place of residence or work.

To exercise a right or raise a privacy concern, email receive@cqprivate.com. Please use the subject line Privacy Request and do not include additional sensitive information in the first message.


13. Children


cQ Core and the Form are intended only for adults aged 18 or over. We do not knowingly invite or accept entry requests from children. If you believe a child has submitted personal data, contact us so that we can review and delete it where appropriate.



14. Third-party links


The websites may link to third-party websites or services. Their privacy practices are governed by their own notices. This Notice does not apply to a third party’s independent processing.


15. Changes to this Notice


We may update this Notice when our practices, providers or legal obligations change. The current version will be posted at https://www.cqcore.com/privacy and linked from cqprivate.com and the Form. We will change the version and effective date when we make a material update and provide additional notice where required by law.



16. Contact


Privacy questions and requests should be sent to:
APCQ Limited
Email: receive@cqprivate.com

Registered office:
Unit 2223, 22/F,
Yan’s Tower,
25–27 Wong Chuk Hang Road,
Aberdeen, Hong Kong