Privacy Policy

Omniwin Limited, a company incorporated in the Hong Kong Special Administrative Region, trading as PremioKey ("we," "us," "our," or the "Company"), is committed to protecting your privacy and personal data.

This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use the PremioKey property management platform (the "Service"). This policy applies to all users of our Service worldwide, including users in Hong Kong, the European Economic Area (EEA), the United Kingdom, California, and other jurisdictions.

1. Regulatory Framework

We process personal data in accordance with applicable data protection laws, including:

• Hong Kong Personal Data (Privacy) Ordinance (PDPO): Cap. 486 of the Laws of Hong Kong, including the six Data Protection Principles
• EU General Data Protection Regulation (GDPR): Regulation (EU) 2016/679, applicable to users in the EEA and UK
• California Consumer Privacy Act (CCPA): As amended by the California Privacy Rights Act (CPRA), applicable to California residents
• Other applicable laws: Including but not limited to Singapore PDPA, Australia Privacy Act, and other regional data protection legislation

2. Personal Data We Collect

We collect the following categories of personal data:

2.1 Account Data

• Full name
• Email address
• Phone number (optional)
• Password (kept only as a one-way hash)
• Profile photograph (optional)
• Account preferences and settings
• Role (landlord, tenant, team member)

2.2 Property Data

• Property addresses and descriptions
• Lease terms and rental amounts
• Property photographs and documents
• Maintenance records and service history
• Utility information

2.3 Payment Data

• Payment transaction history within PremioKey
• Landlord bank account details you enter for standing-order instructions (stored by PremioKey; never shared with Stripe)
• Subscription billing information
• Invoice and receipt records

2.4 Usage Data

• Pages visited and features used
• Time spent on the platform
• Click patterns and navigation paths
• Error logs for troubleshooting
• Feature usage analytics

2.5 Device Data

• Device type and operating system
• Browser type and version
• IP address
• Approximate location (country/city level, derived from IP)
• Screen resolution and viewport size
• Timezone and language preferences

3. Legal Basis for Processing

Under the Hong Kong PDPO and GDPR, we process your personal data based on the following lawful grounds:

4. How We Use Your Personal Data

We use your personal data for the following purposes:

• Service Provision: Enable property management, tenant communications, lease tracking, and payment management
• Payment Processing: Facilitate subscription billing and marketplace listing fees through our payment processor, and record the rent payments you confirm
• Communications: Send transactional emails, payment reminders, maintenance updates, and account notifications
• AI-Powered Features: Provide intelligent assistance, automated responses, and property management insights (with your consent where required)
• Platform Improvement: Analyze usage patterns to enhance features, fix bugs, and improve user experience
• Customer Support: Respond to your inquiries, troubleshoot issues, and provide technical assistance
• Security: Detect, prevent, and investigate fraud, abuse, security incidents, and unauthorized access
• Legal Compliance: Meet regulatory requirements, respond to legal requests, and protect our legal rights

5. Who We Share Data With

We share your personal data only with trusted third-party service providers (data processors) necessary to operate our Service:

We do not sell your personal data. We may disclose data to law enforcement or regulatory authorities if required by law or to protect our legal rights, users, and the public.

6. International Data Transfers

As a global service, your personal data may be transferred to and processed in countries other than your country of residence. Our primary data infrastructure is located in Singapore (Supabase), with additional processing in the United States and other regions.

6.1 Transfer Safeguards

When we transfer personal data internationally, we ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs): For transfers from the EEA/UK, we use the European Commission's Standard Contractual Clauses as approved under GDPR Article 46(2)(c)
• UK International Data Transfer Agreement: For UK transfers, we comply with the UK IDTA requirements
• Adequacy Decisions: Where the destination country has received an adequacy decision from the European Commission or relevant authority
• Supplementary Measures: Additional technical and organizational measures as required by Schrems II guidance

6.2 Hong Kong PDPO Cross-Border Transfers

Under the Hong Kong PDPO, we ensure that any cross-border transfer of personal data is made only where:

• The recipient jurisdiction has laws providing an adequate level of protection
• The data subject has consented to the transfer
• The transfer is necessary for the performance of a contract
• We have taken all reasonable precautions to ensure the data will not be used in a manner inconsistent with the PDPO

7. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, unless a longer retention period is required by law. Our retention schedule:

Once a record has been minimized under this schedule, it is no longer linked to your account — so an account-based access or deletion request may no longer be able to locate it.

If your former landlord closes their account, the tenancy's financial records — and the documents the law requires to be kept with them — are kept as records only, with the former landlord's account details removed. Your own details inside those documents stay as they are.

8. Your Rights

Depending on your location and applicable law, you have the following rights regarding your personal data:

8.1 Rights Under Hong Kong PDPO

• Right of Access: Request access to personal data we hold about you (Data Access Request under section 18)
• Right of Correction: Request correction of inaccurate personal data (Data Correction Request under section 22)
• Right to be Informed: Know the policies and practices we adopt in relation to your personal data

8.2 Additional Rights Under GDPR (EEA/UK Users)

• Right to Erasure: Request deletion of your personal data ("right to be forgotten")
• Right to Data Portability: Receive your data in a structured, machine-readable format (JSON or CSV)
• Right to Restriction: Request restriction of processing in certain circumstances
• Right to Object: Object to processing based on legitimate interests or for direct marketing
• Rights Related to Automated Decision-Making: Not be subject to decisions based solely on automated processing
• Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent
• Right to Lodge a Complaint: Lodge a complaint with your local data protection supervisory authority

8.3 Rights Under CCPA (California Residents)

• Right to Know: Request disclosure of the categories and specific pieces of personal information we collect
• Right to Delete: Request deletion of your personal information
• Right to Correct: Request correction of inaccurate personal information
• Right to Opt-Out of Sale/Sharing: Opt out of the sale or sharing of personal information
• Right to Non-Discrimination: Not be discriminated against for exercising your privacy rights
• Right to Limit Use of Sensitive Personal Information: Limit our use of sensitive personal information

To exercise any of these rights, please contact us at privacy@premiokey.com. We answer verified requests without delay, and always within one month; if a request is unusually complex and the law where you live allows more time, we will tell you inside that first month.

9. Security Measures

These are the main ways we protect your personal data:

• Encrypted connections between your device and PremioKey
• Encrypted storage for our database and files, with a second, separate layer of encryption for bank account numbers
• Passwords kept only as a one-way hash, never in a form that can be read back
• Two-factor authentication with an authenticator app, which landlords and their team members can turn on in their account settings
• Access controls based on each person's role in an account
• Daily database backups, kept for 7 days

No way of sending or storing data over the internet is completely secure. You can help protect your account: if you sign in with a password, use one you don't use anywhere else and keep it to yourself, and, if you are a landlord or a team member, turn on two-factor authentication.

10. Cookies and Similar Technologies

We use minimal, essential cookies to operate our Service:

Essential Cookies

• Session authentication tokens
• Security tokens (CSRF protection)
• User preference storage (language, theme)

Analytics

We use analytics to understand how the platform is used. Analytics cookies are only set in your browser if you accept them, and you can change that choice at any time using the Your Privacy Choices link. If your browser sends a Global Privacy Control signal, we treat that as declining analytics. Separately, and without using cookies, our servers send PostHog a short record of key product events — Section 5 (Who We Share Data With) explains what we send and who receives it. If you decline analytics, we stop the in-browser analytics and we stop the server-side events that are identified by your account. A small number of records are filed under a property portfolio, a tenancy, a maintenance ticket or an email-preferences link rather than under an account; those keep running, because they are how we check that billing and notifications worked correctly.

We do not use third-party advertising cookies. You can change your analytics choice at any time using the Your Privacy Choices link. You can also manage cookies in your browser settings, but that only changes what is stored in your browser — it does not change the server-side records described above — and disabling essential cookies may affect how the platform works.

Your Privacy Choices

If you do not have a PremioKey account, you can contact us at privacy@premiokey.com about these records.

11. Children's Privacy

12. Hong Kong Personal Data (Privacy) Ordinance

We comply with the six Data Protection Principles under the Hong Kong PDPO:

For complaints about our data practices, you may contact the Office of the Privacy Commissioner for Personal Data, Hong Kong at www.pcpd.org.hk.

13. GDPR (European Economic Area and United Kingdom)

If you are located in the European Economic Area (EEA) or United Kingdom, the following additional information applies:

Data Controller

Omniwin Limited is the data controller responsible for your personal data. We are established in Hong Kong and have no establishment in the EEA or the UK. We have not designated a local representative in any country or region outside Hong Kong. Where data protection law requires us to designate one, we will do so and publish their contact details in this policy.

Data Protection Officer

We have appointed a Data Protection Officer to look after everything to do with your personal data — a question, a concern, or a request to use any of the rights set out in this policy. Write to dpo@premiokey.com. We appoint one as a matter of policy, and will continue to wherever local law requires it.

Legal Basis for Processing

We process your personal data based on: (a) performance of our contract with you, (b) compliance with legal obligations, (c) our legitimate interests where not overridden by your rights, or (d) your consent where specifically requested.

Data Protection Impact Assessments

If we plan processing that is likely to result in a high risk to people's rights and freedoms, we will carry out a Data Protection Impact Assessment before that processing begins.

Supervisory Authority

You have the right to lodge a complaint with your local data protection supervisory authority. A list of EEA supervisory authorities is available at edpb.europa.eu.

14. CCPA (California Residents)

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), provides you with additional rights.

Categories of Personal Information Collected

In the preceding 12 months, we have collected the following categories of personal information as defined by the CCPA:

• Identifiers (name, email, phone number, IP address)
• Personal information categories listed in Cal. Civ. Code § 1798.80(e)
• Commercial information (transaction history, subscription details)
• Internet or network activity (browsing history, interactions with our Service)
• Geolocation data (approximate location from IP address)
• Professional information (for landlords and property managers)

Sale and Sharing of Personal Information

Sensitive Personal Information

We may collect certain sensitive personal information (financial account information for payment processing). This information is used only as necessary to provide our Service and is not used for profiling or advertising purposes.

Exercising Your CCPA Rights

To exercise your CCPA rights, you may:

• Email us at privacy@premiokey.com
• Use the data export feature in your account settings
• Submit a request through our platform

We will verify your identity before processing requests. You may designate an authorized agent to submit requests on your behalf.

15. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes:

• We will update the "Last Updated" and "Effective Date" at the top of this policy
• We will notify you via email at least 30 days before material changes take effect
• We may display a prominent notice within the platform
• For material changes affecting your rights, we may require you to re-consent

Your continued use of PremioKey after the effective date of changes constitutes acceptance of the revised policy.

16. Contact Information

For questions about this Privacy Policy, our data practices, or to exercise your data protection rights, please contact us: