Easy-idp Privacy Policy

1. Introduction

We operate an online service to help customers apply for an International Driving Permit (IDP) and related documents. This policy explains how we collect, use, store, and protect personal data when you use our websites and application form (order flow).

This Privacy Policy also applies to our social media publishing applications, including our TikTok application "easy-idp", as well as our integrations with Facebook, Instagram, and YouTube. We use these applications solely to publish and manage promotional video content (Reels/Shorts) about our International Driving Permit service on our own official social media accounts. The "easy-idp" app and our other social media integrations access each platform's API only to upload, schedule, and manage videos on accounts we own; they do not collect, store, or process personal data belonging to other users of these platforms.

We are incorporated in Hong Kong. We process data under the Personal Data (Privacy) Ordinance (PDPO) (Cap. 486) of Hong Kong. If you are in the European Economic Area or the United Kingdom, additional rights may apply to you (see Section 11).

2. Personal data we collect (from your order form)

When you place an order, we collect the information you enter, including:

• Identity & contact: email address, first name, last name, postal address (line 1 & 2), city, state/region, postcode, country, phone country code, phone number.
• Birth details: date of birth, place of birth, country of birth, sex.
• Physical description: height, unit of measure, eye colour (for the permit).
• Driving licence: licence number, country of issue, licence categories (A–E) and dates, destination country where you will drive, permit duration (1 or 3 years), delivery option.
• Documents you upload: driving licence front and back (image or PDF), passport-style photo, digital signature (drawn on screen or uploaded).
• Payment: we do not store full card numbers on our servers; payment is handled by Stripe and/or PayPal (see Section 5).
• AI support chat (optional): messages you send in the chat widget; session identifier stored in cookie ia_chat_session and browser localStorage (30 days) so the conversation can continue across pages.

If you use the contact page, we collect: name, email, and message content.

3. How we use your data

We use personal data to:

• Process and fulfil your IDP application.
• Verify eligibility for the destination country you select.
• Communicate with you about your order (email).
• Process payments and prevent fraud.
• Provide customer support (including the AI assistant, powered by a third-party AI provider).
• Comply with legal and accounting obligations.
• Maintain the security and proper operation of our websites (server logs).

We do not sell your personal data.

4. Legal basis (summary)

• Contract: processing necessary to provide the service you request.
• Legal obligation: retention for tax and regulatory purposes where applicable.
• Legitimate interests: security, fraud prevention, improving our service.
• Consent: where required for optional features or marketing (if you add newsletters later).

5. Recipients and processors

Your data may be shared with:

• Hosting: OVH (for server, website, and database hosting).
• Payment: Stripe, Inc. and PayPal — payment processing (their privacy policies apply).
• Email: our SMTP provider for transactional emails.
• AI provider: Google (Gemini) or equivalent — only for chat messages you submit, if enabled.
• Internal tools: authorised staff and our back-office application.

We require processors to protect data and use it only for the stated purpose.

6. International transfers

We are based in Hong Kong. Your data may be stored or processed in Hong Kong, the European Union (hosting), the United States (payment and AI providers), or other countries where our providers operate. We take reasonable steps to ensure appropriate safeguards where required by law.

7. Retention

• Order and application data: 7 years after completion for legal and accounting purposes.
• Uploaded documents: duration of processing + 6 months, then deleted or archived securely.
• Chat session cookie: (ia_chat_session) 30 days.
• Server access logs: 90 days for security (standard web server logs; we do not use Google Analytics or advertising trackers on the public site unless stated in an updated policy).
• Payment records: as required by Stripe/PayPal and tax law.

8. Security

We use HTTPS (TLS), access controls on our servers, and restricted access to production systems. No method of transmission over the Internet is 100% secure; we cannot guarantee absolute security.

9. Cookies and similar technologies

Strictly necessary cookies / storage:

We do not use third-party advertising cookies at this time. You may control cookies through your browser settings; blocking necessary cookies may limit chat or language features.

10. Your rights

Under Hong Kong PDPO, you may request access to and correction of your personal data. Contact: privacy@easy-idp.org.

If GDPR applies to you, you may also have rights to erasure, restriction, portability, and to object to certain processing, and to lodge a complaint with your local supervisory authority.

We will respond within a reasonable time and may ask for proof of identity.

11. Children

Our service is not directed at children under 18. We do not knowingly collect data from minors.

12. Changes

We may update this policy. The “Last updated” date will change. Material changes may be notified on the website.