Privacy Policy.

Effective date: 1 January 2026

[English version only]

This Privacy Policy explains how Nextboard Solutions Limited, a company incorporated in Hong Kong, collects, uses, holds, processes, transfers, discloses, and protects personal data in connection with nextboardsolutions.com, our online services, director eCPD courses, BoardPulse Review, BoardMatch, resources, events, newsletters, forms, accounts, and related services.

In this Privacy Policy, “Nextboard”, “we”, “us” and “our” mean Nextboard Solutions Limited.

This Privacy Policy also serves as a Personal Information Collection Statement and Privacy Policy Statement for the purposes of the Personal Data (Privacy) Ordinance, Cap. 486 of the laws of Hong Kong.

1. Scope

This Privacy Policy applies to personal data collected through:

(a) our website;

(b) website forms, quote requests, sign-up forms, contact forms, and login functions;

(d) BoardPulse Review services;

(e) BoardMatch services;

(f) newsletters, governance updates, resources, videos, podcasts, and other content;

(g) emails, calls, messages, meetings, surveys, interviews, and other communications with us;

(h) payment, billing, support, and administrative processes.

This Privacy Policy does not apply to third-party websites, platforms, apps, or services that we do not control.

2. Personal data we collect

We may collect the following types of personal data

Account and contact data: name, email address, telephone number, organisation, job title, login details, account ID, profile details, communication records, and preferences.

Course and eCPD data: course registration details, attendance, viewing history, completion status, assessment responses, certificate requests, certificate records, payment status, and training preferences.

BoardPulse Review data: survey responses, interview notes, meeting observations, role descriptions, board or committee positions, governance views, feedback, comments, and information included in materials provided by you or your organisation.

BoardMatch data: candidate profile, biography, directorships, professional experience, qualifications, skills, industry background, independence or conflict information, availability, board preferences, uploaded CV, profile photo, and communications with us.

Quote, enquiry, and support data: information submitted through contact forms, quote requests, sign-up forms, emails, messages, and support requests.

Payment and transaction data: payment amount, billing information, transaction reference, invoice details, and limited payment confirmation data. Full payment card details are usually processed by payment service providers and not stored by us.

Marketing and event data: newsletter preferences, event registrations, areas of interest, feedback, unsubscribe records, and engagement with our communications.

Technical and usage data: IP address, browser type, device information, operating system, pages viewed, time spent, referring pages, cookies, analytics data, log data, and security records.

We do not intend to collect Hong Kong identity card numbers, passport numbers, medical data, criminal records, or other highly sensitive information through the website unless this is specifically required and separately explained.

3. How we collect personal data

We may collect personal data when you:

(a) visit or use the website;

(b) create or log in to an account;

(d) complete a contact form, quote request, survey, questionnaire, or sign-up form;

(e) join or express interest in BoardMatch;

(f) participate in BoardPulse Review;

(g) subscribe to newsletters, updates, resources, videos, or podcasts;

(h) communicate with us by email, phone, messaging platform, social media, video call, or in person;

(i) pay for services;

(j) provide documents, CVs, board materials, or other information to us;

(k) interact with our embedded videos, social media, analytics tools, or third-party service providers.

We may also receive personal data from your organisation, board, employer, colleagues, advisers, recruiters, candidates, course sponsors, event partners, payment providers, IT providers, public sources, or other persons authorised to provide it.

4. Purposes of use

We may use personal data for the following purposes:

(a) providing, operating, maintaining, and improving the website and services;

(b) creating and managing accounts;

(d) administering director eCPD courses, learning records, certificates, assessments, and attendance records;

(e) providing BoardPulse Review, including surveys, interviews, analysis, reporting, recommendations, and follow-up support;

(f) providing BoardMatch, including candidate profiles, matching, recruiter search, guidance materials, opportunity alerts, events, and communications;

(g) providing governance intelligence, newsletters, resources, articles, videos, podcasts, reports, updates, benchmarking, and analytics;

(h) processing payments, invoices, refunds, and accounting records;

(i) verifying identity, eligibility, authority, course completion, certificate status, and account activity;

(j) personalising content, services, recommendations, and communications;

(k) conducting research, benchmarking, service development, analytics, and product improvement;

(l) maintaining security, preventing fraud, investigating misuse, enforcing terms, and protecting legal rights;

(m) complying with laws, regulations, court orders, regulatory requests, stock exchange requirements, tax obligations, accounting duties, and internal compliance requirements;

(n) direct marketing, where permitted by law and subject to your consent or indication of no objection where required.

If we intend to use your personal data for a new purpose not set out in this Privacy Policy or not directly related to the original purpose of collection, we will take steps required by law before doing so.

5. Mandatory and voluntary data

Where we ask you to provide personal data, some data may be mandatory and some may be voluntary.

If you do not provide mandatory data, we may not be able to provide the relevant service, account, course, certificate, report, BoardMatch profile, BoardPulse Review, quote, response, or support.

6. Direct marketing

We may use your name, email address, telephone number, organisation, job title, service interests, course history, event history, enquiry history, and website interaction history to send you updates about our courses, certificates, events, resources, governance intelligence, BoardPulse Review, BoardMatch, advisory services, and related services.

We will not use your personal data for direct marketing unless we have complied with applicable legal requirements.

We will not provide your personal data to another person for that person’s direct marketing without your written consent.

You may opt out of direct marketing at any time and free of charge by using the unsubscribe function in our message or contacting us at info@nextboardsolutions.com.

7. Website platform, hosting, and Wix

Our website is built, hosted, and operated through Wix. We may use Wix-related tools, databases, forms, analytics, email, security, login, payment, scheduling, automation, and other website functions.

When you visit or use our website, submit a form, create an account, register for a course, request a quote, subscribe to updates, make a payment, or interact with website functions, your personal data may be collected, hosted, stored, processed, or transmitted through Wix systems and related service providers.

This may include your name, email address, telephone number, organisation, job title, account details, enquiry details, form submissions, course or event registration information, payment-related information, IP address, device information, browser information, usage records, cookies, log data, and other technical or interaction data.

Wix and its related companies and sub-processors may process such data outside Hong Kong. These locations may include Israel, the United States, Ireland, the United Kingdom, other European jurisdictions, and other places where Wix or its sub-processors operate.

We use Wix and other service providers to help us operate the website, store website data, process enquiries, manage accounts, support website security, analyse website traffic, and provide online functions. We remain responsible for handling personal data in accordance with the Personal Data (Privacy) Ordinance, Cap. 486 of the laws of Hong Kong, where applicable.

8. Website forms and account data

If you submit information through a Wix form, login page, sign-up page, course registration page, BoardMatch form, quote request form, or other website function, that information may be stored in the website dashboard, contact management system, email notification system, automation tool, or database provided by Wix or connected third-party tools.

You should not submit confidential, inside, price-sensitive, privileged, restricted, or highly sensitive information through ordinary website forms unless we have separately agreed an appropriate secure channel.

9. Cookies and similar technologies

Our website may use cookies, pixels, tags, log files, analytics tools, and similar technologies provided by Wix or third-party service providers.

These technologies may be used to:

(a) operate the website;

(b) keep you logged in;

(d) support website security;

(e) understand website traffic and usage;

(f) analyse user behaviour;

(g) measure the effectiveness of content, updates, and campaigns;

(h) improve our services;

(i) enable embedded videos, social media functions, and third-party content.

You may disable cookies through your browser settings. Some website functions may not work properly if cookies are disabled.

Where non-essential cookies, analytics cookies, advertising cookies, or third-party tracking tools are used, we may provide a cookie banner, consent tool, or preference management function where required or appropriate.

10. AI and analytics

We may use AI, automation, proprietary tools, analytics, search, and matching technology to support our services, including BoardMatch, BoardPulse Review, course recommendations, governance intelligence, and website analytics.

These tools may help us organise information, generate insights, identify possible matches, classify responses, detect patterns, improve content, and support human review.

We do not intend to make decisions about board appointments, employment, legal rights, or similarly significant matters solely by automated means. Human decision-makers should review AI-assisted output before relying on it.

11. Disclosure and transfer of personal data

We may disclose or transfer personal data to the following classes of persons:

(a) our directors, officers, employees, contractors, consultants, and agents;

(b) related companies, affiliates, or business units within our group, if any;

(c) website hosting providers, cloud service providers, IT vendors, Wix, email systems, customer relationship management systems, analytics providers, survey providers, course platforms, video platforms, payment processors, and other service providers;

(d) professional advisers, including lawyers, auditors, accountants, insurers, and compliance advisers;

(e) listed issuers, boards, recruiters, nomination committees, search partners, or other organisations involved in BoardMatch, where you have requested or authorised such disclosure;

(f) organisations, boards, committees, or coordinators involved in BoardPulse Review, subject to the agreed review scope and confidentiality arrangements;

(g) course sponsors, event partners, certificate verification recipients, or training coordinators, where relevant and appropriate;

(h) regulators, stock exchanges, courts, law enforcement agencies, government authorities, and other persons where required or permitted by law;

(i) any actual or proposed purchaser, investor, successor, assignee, transferee, or adviser in connection with a restructuring, merger, acquisition, sale, financing, or transfer of all or part of our business or assets.

Some recipients may be located outside Hong Kong. We will take reasonably practicable steps to protect personal data in accordance with the Personal Data (Privacy) Ordinance and applicable contractual, technical, and organisational safeguards.

12. International transfers

By using our website or submitting personal data through it, you acknowledge that your personal data may be processed, stored, or accessed outside Hong Kong by Wix, its related companies, its sub-processors, and our other service providers.

We will take reasonably practicable steps to protect personal data transferred or stored outside Hong Kong, including by using reputable service providers, contractual safeguards, access controls, and other appropriate technical and organisational measures.

13. BoardPulse Review confidentiality and aggregation

For BoardPulse Review, we may collect survey responses, interview input, role information, and governance feedback from individual participants.

Unless otherwise agreed in writing, we may report results on an aggregated or summarised basis where appropriate. We may also include quotations or themes in a way that is designed to support useful governance discussion.

If anonymity or non-attribution is agreed for a particular review, we will take reasonable steps to follow that arrangement. However, anonymity may not be absolute where the sample size is small, the context makes a person identifiable, or disclosure is required by law.

14. BoardMatch profile visibility

If you create or submit a BoardMatch candidate profile, we may use your profile to assess potential board opportunities and to facilitate matching.

Subject to your selected settings, instructions, or separate agreement, parts of your profile may be made available to potential recruiters, listed issuers, boards, nomination committees, search partners, or other relevant organisations.

You should not include information in your BoardMatch profile that you do not want to be considered for matching or shared for board opportunity purposes.

15. Third-party apps and integrations

Our website may use third-party apps, plug-ins, widgets, payment tools, analytics tools, video tools, social media tools, scheduling tools, email tools, CRM tools, or other integrations.

Personal data processed by these third-party tools may not be fully controlled through Wix’s standard visitor data export or deletion functions. If you make a data access, correction, deletion, or opt-out request, we may need to review both Wix-held data and data held by relevant third-party service providers.

16. Security

We take practicable steps to protect personal data against unauthorised or accidental access, processing, erasure, loss, use, disclosure, or transfer.

These steps may include access controls, password protection, encryption where appropriate, service provider due diligence, staff access limits, confidentiality obligations, backup controls, monitoring, and security review.

No website, email, cloud service, or online transmission is completely secure. You should use strong passwords, protect your account, and avoid sending highly sensitive information through unsecured channels.

17. Retention

We will keep personal data only for as long as reasonably necessary for the purposes for which it was collected or for directly related purposes, unless a longer retention period is required or permitted by law.

Our indicative retention periods are:

(a) account data, for the life of the account and up to 24 months after closure or inactivity;

(b) course and certificate records, for up to 7 years for certificate verification, regulatory, contractual, accounting, or dispute purposes;

(d) payment, invoice, and accounting records, for up to 7 years or as required by applicable law;

(e) BoardPulse Review working files, survey data, and interview records, for the period agreed with the client or, if not agreed, up to 24 months after completion of the review;

(f) BoardPulse Review final reports, for the period agreed with the client or, if not agreed, up to 7 years;

(g) BoardMatch profiles, until withdrawal, account closure, or 24 months after inactivity, unless a longer period is agreed;

(h) marketing data, until you unsubscribe or we no longer need it for the relevant purpose;

(i) technical logs, cookies, and analytics data, for a reasonable period based on operational and security needs.

We may retain de-identified, aggregated, or statistical data indefinitely, provided that it no longer identifies an individual.

18. Accuracy

We take reasonably practicable steps to keep personal data accurate, complete, and up to date.

Please notify us if your personal data changes or if you believe that any personal data we hold about you is inaccurate.

BoardMatch users are responsible for keeping candidate profiles, qualifications, experience, directorships, independence information, conflicts, and availability up to date.

19. Access, correction, and deletion requests

Under the Personal Data (Privacy) Ordinance, you have the right to request access to and correction of your personal data.

Requests should be sent to:

Privacy Officer
Nextboard Solutions Limited
Hong Kong
Email: info@nextboardsolutions.com

We may ask you to verify your identity before handling a request. We may charge a reasonable fee for handling a data access request, as permitted by law.

Where your personal data is held through Wix or connected website tools, we may need to search our website dashboard, contact records, form submissions, account records, course records, payment records, email systems, and relevant third-party tools.

Some records may need to be retained for legal, accounting, contractual, fraud prevention, certificate verification, dispute handling, or legitimate business purposes. We may therefore be unable to delete all records immediately upon request where retention is required or permitted by law.

20. Third-party websites and platforms

The website may contain links to or embedded content from third-party websites or platforms, including video platforms, podcast platforms, social media platforms, payment processors, analytics providers, Wix apps, and other external services.

We are not responsible for the privacy practices, security, or content of third-party websites or platforms. You should review their privacy policies before providing personal data to them.

21. Children

The website and services are intended for adults, professionals, directors, candidates, organisations, and governance users. They are not intended for children under 18.

We do not knowingly collect personal data from children under 18. If we become aware that we have collected such data without appropriate consent, we will take reasonable steps to delete it.

22. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The updated version will be posted on the website with a new effective date.

Your continued use of the website or services after the updated Privacy Policy is posted means that you acknowledge the updated Privacy Policy.

23. Contact

If you have any questions about this Privacy Policy or our handling of personal data, please contact: