GENPLIFY
Genplify Limited
Unit 2A, 17/F, Glenealy Tower, No.1 Glenealy, Central, Hong Kong S.A.R.
Business Registration No.: 79681950
Privacy Policy
PDPO, PDPA & GDPR Compliant
Effective Date: 1 January 2026
1. Who We Are
Genplify Limited (“Genplify”, “we”, “us”) is a company incorporated in Hong Kong SAR (Business Registration No. 79681950), with its registered address at Unit 2A, 17/F, Glenealy Tower, No.1 Glenealy, Central, Hong Kong S.A.R.. We operate the Genplify platform at genplify.com, a cloud-based SaaS service for AI proficiency assessment and training.
For questions about this Privacy Policy or your personal data, please contact us at: legal@genplify.com.
2. Scope
This Privacy Policy explains how we collect, use, share, and protect personal data when you use our website and Service. It applies to: Customer administrators who register for and manage accounts; Authorised Users (typically employees or contractors of our Customers) who use the platform to complete assessments and training; and visitors to our website.
Where we process personal data on behalf of a Customer (i.e., as a data processor), the Customer’s own privacy policy governs the relationship with the relevant individuals. This Privacy Policy applies to the extent that Genplify acts as a data controller.
3. What Data We Collect
3.1 Account and Contact Information
When a Customer registers: name, email address, company name, job title, billing information (processed by our payment provider; we do not store full card details).
3.2 Assessment Data
When Authorised Users use the Service: name and email address (as provided by the Customer); assessment responses, completion times, and interaction data; proficiency scores and analytics generated by the Service.
3.3 Technical Data
Automatically collected: IP address, browser type and version, operating system, and device type. We do not track which pages you visit, how long you spend on them, or where you came from before visiting the Service. Cookies and similar technologies are described in Section 9.
3.4 Communications
If you contact us: the content of your communications, including support requests and feedback.
4. How We Use Your Data
4.1 Service Delivery
We use personal data to: provide, maintain, and improve the Service; generate assessment results and reports; administer Customer accounts and process payments; provide customer support.
4.2 Benchmarking and Research
We use anonymised and aggregated data (which cannot identify any individual) to produce industry benchmarks, improve our assessment methodology, and publish research. This is a core function of the Service and is described in our Terms of Service.
4.3 Communications
We may use your email address to send service-related communications (e.g., account notifications, security alerts, billing information). We will only send marketing communications with your prior consent (opt-in), and you can unsubscribe at any time.
4.4 Security and Compliance
We use technical data to protect the Service against fraud, abuse, and security threats, and to comply with applicable legal obligations.
5. Legal Basis for Processing
5.1 Under the PDPO (Hong Kong)
We collect and process personal data in accordance with the six Data Protection Principles of the PDPO. We collect data only for purposes directly related to the Service, inform data subjects of such purposes, and do not use data for purposes beyond those specified without consent.
5.2 Under the PDPA (Singapore)
Where the PDPA applies, we collect and use your personal data with your consent, obtained at the time of your first login to the Service. We process data solely for the purposes stated in this Privacy Policy. You may withdraw your consent at any time via the My Data page; withdrawal does not affect the lawfulness of processing carried out before withdrawal.
5.3 Under the GDPR (EEA/UK)
Where the GDPR or UK GDPR applies, we rely on the following legal bases: Contract: processing necessary for the performance of our contract with the Customer; Legitimate interests: processing for the purposes of improving the Service, ensuring security, and producing anonymised benchmarks, where such interests are not overridden by the rights and freedoms of the individual; Consent: for marketing communications and non-essential cookies; Legal obligation: where we are required to process data by law.
7. International Transfers
Genplify is based in Hong Kong SAR. Personal data may be processed and stored in Hong Kong and, where relevant, in other jurisdictions where our sub-processors operate.
Where we transfer personal data from the EEA or UK to Hong Kong or other jurisdictions without an adequacy decision, we implement appropriate safeguards, including the EU Standard Contractual Clauses (SCCs) or the UK International Data Transfer Agreement (IDTA), as applicable. Details of these safeguards are set out in our Data Processing Agreement.
Where personal data is transferred outside Singapore, we ensure that the recipient provides a comparable standard of protection to that under the PDPA, through contractual arrangements, in accordance with Section 26 of the PDPA.
8. Data Retention
We retain personal data for the duration of the Customer’s subscription. Following termination, Customer Data is available for export for 30 days, after which it is permanently deleted. Backup copies are purged within 30 days of deletion. When you delete your account, your personal data is deleted from our active systems immediately and cannot be recovered.
Certain audit log entries recording actions taken in the system are retained in anonymised form (with personal identifiers removed) for security, compliance, and legal claims defence purposes, in accordance with Article 18(2)(e) of GDPR.
For administrator accounts, a minimal tombstone record is retained after deletion to preserve organisational audit trail integrity. The tombstone contains no personal information.
Upon account deletion, data derived from your assessment responses is retained in fully anonymised form for psychometric calibration. This includes your numerical scores, scoring parameters (such as ability estimates), and your answers to assessment questions — including the text of any open-ended written responses. Anonymisation is implemented with HMAC-SHA256 blind indexes that cannot be reversed to identify you, and all retained data is grouped by month rather than by you or your organisation. This data is used solely to maintain and improve the quality of our assessment instruments. Under GDPR Recital 26 and Article 89(1), this anonymised data falls outside the scope of the regulation.
Anonymised and aggregated data (from which individuals cannot be identified) may be retained indefinitely for benchmarking and research purposes. We may retain certain data for longer periods where required by law (e.g., billing records for tax purposes).
9. Cookies and Tracking Technologies
We use only essential cookies that are strictly necessary for the Service to function. These cookies cannot be disabled because the Service would not work without them. We do not use analytics, advertising, or tracking cookies.
9.1 Cookies We Use
The following cookies are set when you use the Service:
- Session cookies (set by Clerk, our authentication provider): Required for secure sign-in and session management. These are httpOnly, secure, and expire when your session ends or after a set period of inactivity.
- CSRF token cookie: A security cookie that prevents cross-site request forgery attacks. It is httpOnly and expires with each session.
- Auth success cookie (__auth_success): A temporary cookie (60-second lifetime) used during the login redirect process. It is automatically deleted after use.
9.2 Local Storage
We use browser local storage for a single functional purpose: storing a timestamp of the last successful account synchronisation to prevent unnecessary repeat requests. This data is not shared with any third party and does not contain personal information.
9.3 No Tracking
We do not use Google Analytics, advertising pixels, social media tracking scripts, or any other third-party tracking technologies. We do not use advertising or tracking cookies for targeted advertising purposes. Your browsing activity on our platform is not shared with advertisers or data brokers.
10. Your Rights
GDPR provides several distinct rights that are sometimes confused. Genplify implements them as three separate flows with separate consequences:
- Withdraw Consent (Article 7(3)) — your access to features that depend on that consent is immediately restricted; your data is preserved; re-consenting automatically restores access.
- Restrict Processing (Article 18) — your data is frozen and excluded from operational use, but is not deleted; restriction can be lifted to resume normal access.
- Erasure / Right to be Forgotten (Article 17) — your data is permanently deleted through the 25-step cascade described in our Trust page; deletion is irreversible.
Each flow has different legal implications and can be used independently. You may, for example, withdraw consent to certain processing while keeping your account active under other legal bases.
10.1 Under the PDPO
If you are a data subject under Hong Kong law, you have the right to: request access to your personal data (Data Access Request); request correction of inaccurate personal data (Data Correction Request). To exercise these rights, please contact us at legal@genplify.com. We will respond within 40 days of receiving a valid request.
10.2 Under the GDPR
If you are a data subject in the EEA or UK, you have the right to: access your personal data; rectify inaccurate or incomplete personal data; erase your personal data (right to be forgotten); restrict processing of your personal data; data portability (receive your data in a structured, commonly used, machine-readable format); object to processing based on legitimate interests; not be subject to a decision based solely on automated processing (including profiling) that produces legal or similarly significant effects.
To exercise these rights, you can use the self-service options in your account settings (for example, “Delete my account” under Account Actions), or contact us at legal@genplify.com. Self-service deletion requests are processed immediately. We will respond to manual requests within 30 days.
When you delete your account, we also delete records of consents you have given (Article 7), as we no longer process your data on the basis of those consents.
If you are unsatisfied with our response, you have the right to lodge a complaint with your local supervisory authority (e.g., the CNIL in France, the ICO in the UK).
10.2.1 Consent Withdrawal and Restoration
If you withdraw consent under Article 7(3), your access to Service features that depend on that consent is immediately restricted, but your data is preserved (not deleted). If you later choose to re-consent to the current version of the applicable terms, your access is automatically restored — no administrator action, no support contact, and no re-onboarding required. Your previously-recorded data, including assessment history and learning progress, resumes intact.
This restoration mechanism applies only where the restriction was caused by your own consent withdrawal. Restrictions initiated by you for other reasons, or by your organisation administrator, follow separate procedures described in our Terms of Service.
10.3 Under the PDPA (Singapore)
If you are located in Singapore or your personal data is processed in connection with a Singapore-based organisation, you have the right to: request access to your personal data; request correction of inaccurate personal data. We will respond within 30 days of receiving a valid request. A reasonable fee may apply for access requests. To exercise these rights, please contact us at legal@genplify.com or via the My Data page. If you believe your personal data has been mishandled, you may lodge a complaint with the Personal Data Protection Commission (PDPC) at www.pdpc.gov.sg.
10.4 Automated Decision-Making
The Service generates assessment scores using a combination of automated scoring and psychometric analysis. These scores are provided to the Customer for informational purposes. Genplify does not make any employment decisions about Authorised Users. Any decisions based on Assessment Results are made by the Customer, and the Customer is responsible for ensuring compliance with applicable laws regarding automated decision-making.
11. Automated Processing and Artificial Intelligence
11.1 AI-Assisted Scoring
Genplify uses artificial intelligence to evaluate certain assessment responses. Specifically, we use Anthropic’s Claude AI model to score open-ended written responses against rubric criteria. Five questions per assessment are evaluated this way; all other questions are scored by deterministic algorithms (Item Response Theory).
11.2 What Is Sent to the AI
When an open-ended response is evaluated, only the following is transmitted to the AI provider: the question text, the rubric criteria for that question, and your written response.
No identifying information is transmitted. We do not send your name, email address, user ID, organisation name, or any other identifier to the AI provider. The AI evaluates your response based solely on the rubric, without knowing who wrote it.
11.3 How AI Scores Are Used
AI-generated scores are advisory. They are presented to your organisation’s administrators alongside other information, and administrators make decisions about training, programmes, and assessments based on multiple factors. AI-generated scores do not automatically trigger any decision about you. There is always a human decision-maker between the AI’s score and any consequence.
11.4 Your Rights Regarding Automated Processing
Under GDPR Article 22 and the EU AI Act (where applicable), you have the right to: be informed when AI processing has been applied to your data; request human review of any score generated by AI; express your point of view on the AI’s evaluation; contest the result of AI processing; and receive an explanation of how your score was generated.
11.5 How to Request Human Review
To request review of an AI-generated score, contact us directly at legal@genplify.com. Please include your name and email address, the assessment date or session reference, and the reason for your request.
Reviews are conducted by qualified Genplify staff (not by your organisation’s administrators). Reviews are acknowledged within 5 business days and resolved within 30 days. The outcome may be a revised score, additional context, or no change with explanation.
11.6 EU AI Act
Under the EU AI Act, this system may be classified as high-risk (Annex III, Category 4(b)) when used to monitor or evaluate employee performance. We maintain technical documentation, human oversight mechanisms, and audit trails as required.
12. Data Security
We implement appropriate technical and organisational measures to protect personal data, including: encryption at rest and in transit; access controls and multi-factor authentication; regular security assessments; employee training on data protection; incident response procedures. No system is perfectly secure, and we cannot guarantee the absolute security of your data. If we become aware of a data breach, we will notify affected parties in accordance with applicable law, including within 72 hours under the GDPR (Article 33) and within 3 calendar days under the PDPA (Section 26D).
12.5. Data Protection Officer
Our Data Protection Officer can be contacted at legal@genplify.com for questions about your personal data, to exercise your data rights, or to raise a concern about our data processing practices.
13. Children
The Service is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will delete it promptly.
14. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. Where changes are material, we will notify Customers via email and update the “Effective date” above. We encourage you to review this Privacy Policy periodically.
15. Contact
Genplify Limited
Unit 2A, 17/F, Glenealy Tower, No.1 Glenealy, Central, Hong Kong S.A.R.
Email: legal@genplify.com
Data Protection Officer: legal@genplify.com
For complaints under the PDPO: Office of the Privacy Commissioner for Personal Data, Hong Kong (www.pcpd.org.hk)
For complaints under the PDPA: Personal Data Protection Commission, Singapore (www.pdpc.gov.sg)
For complaints under the GDPR: your local supervisory authority (e.g., CNIL in France, ICO in the UK)