Privacy Policy

Introduction

XPO8 Limited ("we," "us," "the Company") operates uniexamfocus.com ("the Platform") and is committed to protecting the privacy and security of your personal data. This Privacy Policy explains how we collect, use, store, disclose, and protect information obtained from users of the Platform.

This policy applies to all services offered through the Platform, including exam preparation materials, question banks, test simulations, community features, leaderboards, and all related services across every exam route we support. This policy follows Hong Kong's Personal Data (Privacy) Ordinance (Cap. 486).

By creating an account or using the Platform, you consent to the collection and use of your information as described in this Privacy Policy. If you do not agree, you must stop using the Platform immediately.

Products and Services Covered

This Privacy Policy covers all products and services offered on the Platform. Each product operates as an independent exam preparation community with its own question bank, test simulations, performance analytics, community channels, leaderboard, and subscription access:

• Bocconi Test Prep — question bank, test simulations, and community for Bocconi University admissions (English)
• Bocconi Italia Test Prep — Italian-language preparation for Bocconi University admissions
• CEnT-S Test Prep — preparation for the English CISIA general entrance test covering mathematics, text/data reasoning, biology, chemistry, and physics
• TOLC-I Test Prep — engineering and technical-science admissions covering math, logic, science, and verbal comprehension
• TOLC-E Test Prep — economics and management admissions covering logic, verbal comprehension, and mathematics
• TOLC-B Test Prep — biology and related science admissions covering basic mathematics, biology, physics, and chemistry
• TOLC-F Test Prep — pharmacy and related science admissions covering biology, chemistry, mathematics, physics, and logic
• TOLC-S Test Prep — general science admissions covering mathematics, reasoning, biology, chemistry, physics, and earth sciences
• TOLC-SU Test Prep — humanities and cultural-study admissions covering reading comprehension, acquired knowledge, and logical reasoning
• TOLC-AV Test Prep — agraria and veterinary admissions covering core sciences, mathematics, logic, and verbal comprehension
• TOLC-LP Test Prep — professional and applied-degree admissions covering logic, verbal comprehension, and mathematics
• TOLC-PSI Test Prep — psychology admissions covering reading comprehension, basic mathematics, verbal reasoning, numerical reasoning, and biology

Your data within each exam route (scores, question bank progress, community posts, leaderboard rankings) is kept separate per community. Purchasing access to one exam route does not share your data with another.

Information We Collect

3.1 Personal Data You Provide

When you register for an account or purchase a subscription, we collect:

• Identity Data: Your full name and username
• Contact Data: Your email address
• Authentication Data: Encrypted password (we never store passwords in plain text)
• Payment Data: Transaction information, billing details, and purchase history. We do not store your full credit card number, CVV, or bank account details — all payment processing is handled by our third-party payment processor, Stripe, which maintains PCI-DSS compliance.
• Profile Data: Any optional profile information you choose to provide

3.2 Usage and Performance Data

The Platform automatically captures data related to your use of our exam preparation services. This data is essential for delivering personalised study analytics and is collected across every exam route you subscribe to:

• Test Performance: Test simulation scores, individual answer selections, time spent per question, section-level breakdowns, and historical score trends
• Question Bank Activity: Questions attempted, accuracy rates by topic and difficulty level, practice session history, and completion progress
• Leaderboard Data: Ranking position, points earned, and comparative performance metrics
• Community Activity: Threads created, comments posted, reactions given, and participation frequency in discussion channels
• Calendar and Meetup Data: Events created, RSVPs, and scheduling preferences

3.3 Technical Data

We automatically collect certain technical information when you access the Platform:

• Device Information: IP address, browser type and version, operating system, and device type
• Access Data: Timezone settings, login timestamps, session duration, and pages visited
• Referral Data: How you arrived at the Platform (search engine, direct link, referral)

3.4 Cookies and Tracking Technologies

The Platform uses cookies and similar technologies for the following purposes:

• Essential Cookies: Required for login functionality, session management, and security. These cannot be disabled.
• Analytical Cookies: Used to monitor visitor behaviour, measure Platform performance, and identify areas for improvement.
• Preference Cookies: Store your settings and preferences (such as exam route selection) to provide a more personalised experience.

You can manage cookie preferences through your browser settings. Disabling essential cookies may prevent you from using the Platform.

How We Use Your Information

4.1 Service Delivery

• Delivering exam preparation services including question banks, test simulations, and community features across all supported exam routes
• Generating and storing test results, scores, and performance analytics
• Operating leaderboards and ranking systems within each exam community
• Displaying your profile and contributions within community discussion channels
• Providing personalised study recommendations based on your performance data

4.2 Payments and Subscriptions

• Processing payments and managing subscriptions for individual exam routes
• Sending transaction confirmations and billing notifications
• Administering the Score Improvement Guarantee programme and processing eligible refund requests

4.3 Communication

• Responding to customer support enquiries and resolving technical issues
• Sending essential service notifications (password resets, subscription changes, security alerts)
• With your consent, sending newsletters and updates about new exam routes, features, and promotions

4.4 Platform Improvement

• Analysing usage patterns to improve question quality and Platform features
• Identifying and fixing bugs, errors, and performance issues
• Developing new features and exam route offerings
• Conducting aggregate statistical analysis (anonymised and not linked to individual users)

4.5 Legal and Security

• Complying with applicable laws, regulations, and legal processes
• Detecting, preventing, and addressing fraud, abuse, and security issues
• Enforcing our Terms and Conditions, including account sharing prohibitions

Disclosure of Your Information

We do not sell your personal data to third parties. We may share your information only in the following circumstances:

5.1 Service Providers

We share data with trusted third-party service providers who assist in operating the Platform, solely for the purposes described in this policy. These providers are contractually obligated to protect your data and may only use it for the specific services they provide to us.

5.2 Payment Processors

Payment information is shared with Stripe for transaction processing. Stripe operates under its own privacy policy and maintains PCI-DSS compliance. We do not have access to your full card details.

5.3 Legal Requirements

We may disclose your information when required to:

• Comply with a legal obligation, court order, or government request
• Protect the rights, property, or safety of XPO8 Limited, our users, or the public
• Investigate potential violations of our Terms and Conditions

5.4 Business Transfers

In the event of a merger, acquisition, reorganisation, or sale of assets, your personal data may be transferred to the successor entity. You will be notified of any such change and your choices regarding your data.

Direct Marketing

With your explicit consent, we may send you newsletters and updates about new exam routes, Platform features, study tips, and promotional offers. You can opt out of marketing communications at any time by:

• Clicking the unsubscribe link included in every marketing email
• Contacting us at enquiry@xpo8.com

Opting out of marketing does not affect essential service communications (such as subscription confirmations, security alerts, or Terms updates).

Data Security

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it:

• Encryption in Transit: We use Secure Socket Layer (SSL) / TLS technology to encrypt all data transmitted between your browser and our servers.
• Encryption at Rest: All passwords are stored using industry-standard cryptographic hashing. Sensitive data is encrypted in our database.
• Access Controls: Access to personal data is restricted to authorised personnel with a legitimate business need. All access is logged and audited.
• Infrastructure Security: Our infrastructure is hosted on Supabase, which provides enterprise-grade security, including network isolation, regular security audits, and automated backups.

While we strive to protect your data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security, but we continuously review and improve our security practices.

Data Retention

8.1 Active Accounts

Your data is retained for as long as your account remains active. This includes all test results, question bank progress, community contributions, and leaderboard history across every exam route you have subscribed to.

8.2 Inactive Accounts

Accounts that have been inactive for an extended period (approximately 2 years) may be scheduled for deletion. We will attempt to notify you via email before deleting an inactive account, giving you the opportunity to reactivate it.

8.3 Account Deletion Requests

You may request deletion of your account and associated data at any time by contacting enquiry@xpo8.com. Upon receiving a valid deletion request, we will:

• Delete your personal data within 30 days
• Remove your community posts and leaderboard entries
• Retain anonymised, aggregate data that can no longer be linked to you (for statistical purposes)
• Retain transaction records as required by applicable accounting and tax laws

Your Legal Rights

Under Hong Kong's Personal Data (Privacy) Ordinance (Cap. 486), you have the following rights regarding your personal data:

• Right of Access: You may request a copy of the personal data we hold about you.
• Right of Correction: You may request correction of any inaccurate or incomplete personal data.
• Right to Opt Out: You may opt out of receiving direct marketing communications at any time.
• Right to Deletion: You may request deletion of your account and personal data, subject to our legal retention obligations.

To exercise any of these rights, contact our Data Protection Officer at enquiry@xpo8.com. We will respond to your request within 40 days as required by the Ordinance. Reasonable administrative fees may apply for data access requests.

Children's Privacy

The Platform is not intended for children under the age of 16. We do not knowingly collect personal data from children under 16. If you are under 16, you may only use the Platform with the consent and supervision of a parent or legal guardian who agrees to be bound by our Terms and this Privacy Policy. If we become aware that we have collected personal data from a child under 16 without parental consent, we will delete that data promptly.

International Data Transfers

XPO8 Limited is incorporated in Hong Kong. Your data may be processed and stored in jurisdictions outside your country of residence, including jurisdictions that may have different data protection standards. By using the Platform, you consent to the transfer of your data to Hong Kong and other jurisdictions where our service providers operate. We take steps to ensure your data receives an adequate level of protection wherever it is processed.

Third-Party Links

The Platform may contain links to third-party websites or services that are not operated by us. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party sites you visit.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. For material changes, we will attempt to provide at least 30 days' notice before the updated policy takes effect, either via email or a prominent notice on the Platform.

Your continued use of the Platform after changes take effect constitutes acceptance of the updated Privacy Policy. We encourage you to review this policy periodically.

Contact Information

For questions, concerns, or requests regarding this Privacy Policy or our data practices, contact us at:

XPO8 Limited
Data Protection Officer
Unit 1603, 16th Floor
The L. Plaza
367-375 Queen's Road Central
Sheung Wan HK, Hong Kong, 999077
enquiry@xpo8.com