Legal

Privacy Notice

Last updated: 13 October 2026

M4W Group Limited (M4W, we, us or our), a company registered in Hong Kong under company number 1062425, operates XBorder Leadership Academy (XBorder). This notice explains how we collect, use, disclose, retain and protect personal data when you visit www.xborderleadership.com, contact us, apply for or participate in a programme, join the XBorder community, attend an event, or otherwise interact with us.

This notice is designed primarily for compliance with the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong (PDPO). Additional mandatory privacy rights may apply depending on where you live. Where the UK GDPR, EU GDPR or another applicable law gives you rights that cannot lawfully be excluded, we will respect those rights.

1 Who is responsible for your personal data

M4W Group Limited is the data user under the PDPO and, where applicable, the controller of your personal data. XBorder Leadership Academy is operated by M4W Group Limited and is not a separate legal entity.

Privacy enquiries and rights requests: Director of M4W Group, M4W Group Limited, 10/F, Yu Yuet Lai Building, 43-55 Wyndham Street, Central, Hong Kong, privacy@xborderleadership.com. General enquiries: hello@xborderleadership.com.

2 Personal data we collect

Identity and contact information, including name, email address, telephone number, country, employer, organisation and job title.
Enquiry and application information, including professional background, application answers, leadership objectives, location, availability and correspondence.
Recommendation information, including a recommender’s contact details and comments. Applicants must tell recommenders before sharing their information.
Financial-support information, including eligibility evidence. We will request only what is necessary and apply additional access controls.
Programme records, including admission decisions, enrolment, attendance, participation, completion, feedback, community membership and communications.
Payment and transaction information. Payment-card details are processed by the appointed payment provider and are not stored by M4W unless explicitly stated otherwise.
Accessibility and adjustment information voluntarily provided to enable participation. This may include health-related information and will be used only as necessary to arrange support.
Testimonials, photographs, audio and video where separate permission has been obtained.
Marketing preferences and records of consent, objection, withdrawal or unsubscribe requests.
Technical and usage information, including IP address, device and browser information, pages viewed, referring pages and consent choices, where permitted by law. Website usage is measured with Google Analytics only where you have consented; the Cookie Policy explains what is collected and how to change your choice.

3 How we collect personal data

We collect data directly from you, from a recommender or sponsor, from an employer enrolling or funding you, from programme facilitators and service providers, from publicly available professional sources where appropriate, and automatically through cookies and similar technologies after any required consent.

4 Purposes and legal grounds

Purpose	Basis or justification
Responding to enquiries and administering applications	Taking steps at your request, legitimate business purposes and compliance with the PDPO.
Assessing admission and financial support	Taking steps before enrolment, programme administration and, where required, consent for sensitive information.
Delivering programmes and membership	Performance of the enrolment agreement and legitimate administration.
Payments, accounting and fraud prevention	Performance of contract, legal obligations and legitimate interests.
Accessibility adjustments	Your request and, where required, explicit consent or another lawful condition.
Website analytics and improvement	Consent where required; otherwise legitimate purposes permitted by applicable law.
Direct marketing	Prior informed consent where required. You may withdraw consent at any time.
Testimonials, images and recordings	Specific permission or release for the stated use.
Legal claims, security and compliance	Legal obligations and legitimate protection of rights, systems and participants.

5 Direct marketing

We will not use personal data for direct marketing unless we have provided the information required by applicable law and obtained the necessary consent. Marketing consent is optional and separate from programme administration. You may unsubscribe at any time without charge. Withdrawal does not affect communications required to administer an enquiry, application, enrolment or membership.

Website, cloud-hosting, form, email, CRM, analytics, scheduling, payment and video-conferencing providers acting under contract.
Facilitators, assessors and programme partners who need the information to assess applications or deliver the programme.
Cohort members, but only for professional and learning interaction reasonably expected within the programme.
Employers or sponsors where they fund participation, limited to agreed enrolment, attendance, completion or billing information.
Professional advisers, insurers, auditors, banks and authorities where necessary or legally required.
A purchaser or successor in a genuine restructuring, merger or sale, subject to appropriate confidentiality and data-protection safeguards.

We do not sell personal data. Providers may process data only for authorised purposes and subject to appropriate safeguards. The final provider list will be recorded internally and material providers may be identified in this notice or the Cookie Policy.

7 International transfers

XBorder operates internationally and may transfer personal data outside Hong Kong, including to locations in which service providers, facilitators or participants operate. Before doing so, we will assess the purpose, destination and recipient and use reasonable contractual, organisational and technical safeguards. Where UK or EU transfer restrictions apply, we will use an approved transfer mechanism where required, such as applicable standard contractual clauses, a UK transfer addendum or another lawful safeguard. No transfer mechanism eliminates all risk.

8 Retention

Record	Retention period
General enquiries	12 months after the last substantive contact.
Unsuccessful applications	24 months after the decision, unless a shorter period is requested or required.
Participant and membership records	7 years after the later of programme completion or membership expiry.
Financial and tax records	7 years, or longer where required by applicable law.
Financial-support evidence	Delete or securely minimise after the decision and any appeal, unless needed for audit or legal purposes.
Marketing records	Until withdrawal, plus a minimal suppression record to honour the choice.
Analytics and consent records	According to configured tool settings and the approved cookie schedule.
Recordings	For the period disclosed in the specific recording notice or consent form.

9 Your rights

Under the PDPO, you may request confirmation of whether we hold personal data about you, access to that data and correction of inaccurate data, subject to lawful exceptions and any permitted reasonable fee. You may also opt out of direct marketing at any time. Other applicable laws may provide additional rights, including erasure, restriction, objection, portability, withdrawal of consent and complaint to a regulator. We will verify identity and respond within the period required by the applicable law.

10 Security and incidents

We use reasonable administrative, technical and physical safeguards proportionate to the nature of the data, including access controls, secure transmission, provider review, staff confidentiality and retention controls. No system is completely secure. We maintain an incident-response process and will notify affected individuals and regulators where required by applicable law or otherwise appropriate.

11 Automated decisions and children

We do not currently make decisions producing legal or similarly significant effects solely by automated means. The website and programmes are intended for adults aged 18 or over. If this changes, the notice and collection process must be reviewed before data is collected from minors.

12 Complaints, changes and contact

Please contact privacy@xborderleadership.com first so we can investigate. You may also complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong, or another regulator with jurisdiction over your complaint. We may update this notice and will post the revised date. Material changes will be communicated where appropriate.