RW Community operates RW Haus, a private members' club in Causeway Bay, Hong Kong, together with this website and member platform (collectively, the "Platform"). This Privacy Policy explains what personal data we collect, how we use and protect it, and the rights you have under the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486) (the "PDPO"). In this Policy, "we", "us", and "RW" refer to RW Community / RW Haus.
By creating an account, applying for membership, purchasing a guest or visitor pass, or otherwise using the Platform or our premises, you acknowledge that you have read and understood this Policy.
1. Personal data we collect
We collect the following categories of personal data, depending on how you interact with us:
- Account & membership data: your name, email address, phone number, date of birth, profile photo or avatar, membership tier, and login credentials. For visitor passes, we may record your passport-holder status (non-Hong Kong residents) and identity details required for admission.
- Payment data: membership fees, class and rental bookings, and shop purchases are processed by our third-party payment processor, Stripe. We do not store full payment card numbers on our servers; we retain transaction records, amounts, and payment status.
- Access-control & biometric data: entry to RW Haus is managed through a BioStar 2 access-control system. Depending on the credentials you enrol, this may include access cards, mobile credentials, or biometric identifiers (such as facial or fingerprint templates), along with entry and exit logs (date, time, and door). Biometric data is sensitive; we collect it only to verify identity and secure the premises, and only where you have enrolled such a credential.
- Guest & family data: details of guests you invite via guest passes, and — for RW Youth Club families — information about children (ages 6–16) provided by a parent or legal guardian.
- Booking & activity data: your event registrations, class bookings, cancellations, venue-rental reservations, and check-in history.
- Web3 & NFT data: your membership NFT and, where applicable, the public blockchain wallet address associated with it. Blockchain addresses and transactions are public by nature and are not controlled by us.
- Usage & device data: we use PostHog product analytics to understand how the Platform is used. This may include your IP address, device and browser type, pages visited, and interactions, collected via cookies and similar technologies.
- Communications: messages you send us (for example, via the contact form or by email) and your marketing preferences.
2. How we use your data
Under the PDPO, we collect personal data for lawful purposes directly related to our functions and activities as a members' club. We use your data to:
- create and administer your account and membership;
- control and secure access to RW Haus, including verifying identity at entry;
- process payments, refunds, and credits, and maintain financial records;
- manage event registrations, class and venue bookings, and guest passes;
- operate the RW Youth Club and related family programmes;
- communicate with you about your membership, bookings, and club announcements;
- send you marketing and promotional updates where you have consented (see Section 3);
- understand and improve the Platform through analytics; and
- comply with applicable laws and protect the safety of members, guests, and staff.
3. Direct marketing
We will not use your personal data for direct marketing without your consent. With your consent, we may send you information about upcoming events, exclusive programmes, and club announcements by email or other channels you have agreed to. You may withdraw your consent and opt out of direct marketing at any time, at no cost, by using the unsubscribe link in our emails or by contacting us at info@rwhaus.xyz. We will act on your request promptly.
4. Photography & media at events
We may capture photographs and video at RW Haus events, which may be used for marketing, promotional, and social-media purposes, as described in our Terms of Service. If you would prefer not to appear in such materials, please let our staff or organisers know at the event, or contact us, and we will use reasonable efforts to accommodate your request.
5. How we share your data
We do not sell your personal data. We disclose it only as follows:
- Service providers: trusted processors who act on our behalf, including Stripe (payments), PostHog (analytics), our access-control / BioStar 2 vendor, email and hosting providers, each permitted to use your data only to provide services to us.
- Within RW: authorised RW staff and administrators who need the data to operate the club.
- Legal & safety: where required by law, regulation, court order, or to protect the rights, property, or safety of RW, our members, guests, or staff.
6. Cross-border transfer
Some of our service providers operate outside Hong Kong, so your personal data may be processed in other jurisdictions. Where this occurs, we take reasonable steps to ensure your data receives a level of protection comparable to that required under the PDPO.
7. Cookies & analytics
We use cookies and similar technologies to keep you signed in, remember your preferences, and measure how the Platform is used (via PostHog). You can control cookies through your browser settings; disabling them may affect some features of the Platform.
8. Data retention
We keep your personal data only for as long as necessary to fulfil the purposes described in this Policy, including to meet membership, accounting, tax, and legal requirements. Access logs and biometric credentials are retained only while needed for security and are deleted or de-identified when they are no longer required — for example, when your membership ends and any retention period has lapsed.
9. Data security
We take practicable steps to safeguard your personal data against unauthorised access, loss, or misuse, including access controls, encryption in transit, and restricting data to staff who need it. No system is completely secure, but we work to protect your information and to respond appropriately to any incident.
10. Children's data
The RW Youth Club serves children aged 6–16. We collect and process children's personal data only with the consent of, and as provided by, a parent or legal guardian, and use it solely to operate youth programmes and ensure children's safety on the premises.
11. Your rights under the PDPO
Subject to the PDPO, you have the right to:
- request access to the personal data we hold about you (a "data access request");
- request correction of any data that is inaccurate;
- withdraw consent to direct marketing at any time; and
- ask how your data is being used.
To exercise these rights, contact us at info@rwhaus.xyz. We may charge a reasonable fee for complying with a data access request, as permitted by the PDPO. If you believe we have not handled your data properly, you may also lodge a complaint with the Office of the Privacy Commissioner for Personal Data, Hong Kong (PCPD).
12. Third-party links
The Platform may link to third-party sites or services (for example, payment pages or social media). We are not responsible for the privacy practices of those third parties; please review their policies separately.
13. Changes to this Policy
We may update this Privacy Policy from time to time. We will post the updated version here and revise the "Last updated" date above. Significant changes may be communicated to you directly.
14. Contact us
For any questions about this Policy or your personal data, contact us at info@rwhaus.xyz or write to us at RW Haus, Causeway Bay, Hong Kong.
This Privacy Policy is provided for general information and transparency and does not constitute legal advice. We recommend it be reviewed by qualified counsel before publication.