English
1. Who we are
The EdUHK AI Education Platform, including the AIDCEC Attendance mobile app, is operated by the Artificial Intelligence and Digital Competency Education Centre (AIDCEC) at The Education University of Hong Kong (EdUHK) for student attendance, peer assessment, and related teaching and learning activities. This policy is a Personal Information Collection Statement (PICS) issued in accordance with the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486) ("the Ordinance"). AIDCEC acts as a data user on behalf of The Education University of Hong Kong in operating this platform. We comply with the six Data Protection Principles (DPPs) under the Ordinance.
2. Hong Kong legal framework
This policy is governed by the laws of the Hong Kong Special Administrative Region. The Ordinance requires data users to:
- DPP1 — collect data lawfully and fairly, for purposes directly related to our functions
- DPP2 — ensure data is accurate and not kept longer than necessary
- DPP3 — use data only for the purposes stated at collection, or with your consent
- DPP4 — implement practical security measures to protect personal data
- DPP5 — be open about our policies and practices (this document)
- DPP6 — provide access to your personal data on request
You also have the right to request correction of inaccurate data (DPP7 / s.22). We do not use your personal data for direct marketing purposes.
3. Information we collect and why (DPP1)
We collect the minimum personal data needed to operate the platform, for the purposes stated below:
- Account identity — your EdUHK name, university email address, student number, and role (student, teacher, or admin), obtained via EdUHK Single Sign-On (SSO) through AWS Cognito and the university's Microsoft 365 identity provider. Purpose: to verify your identity and course enrollment. We do not receive or store your university password.
- Attendance records — the course session, timestamp, check-in status, and the device platform (mobile or web) used when you scan a session QR code. Purpose: to record and display attendance to you and your instructors.
- Camera access (mobile app only) — the app requests camera permission solely to scan session QR codes on-device. Camera images or video are never recorded, stored, or transmitted — only the decoded attendance code is sent to our servers. Purpose: attendance check-in only.
- Device session data — a secure sign-in token stored on your device (via iOS/Android secure storage on mobile, or an HttpOnly cookie on web) so you stay signed in between sessions. Purpose: maintaining a secure login session.
- Peer assessment and team data — for platform modules you use, such as peer feedback submissions, team formation responses, and presentation practice recordings. Purpose: operating course-specific teaching and learning activities.
We do not collect: precise location/GPS data, advertising identifiers, or
audio/microphone recordings. The Android app declares a RECORD_AUDIO permission inherited
from a system camera library; the app does not use the microphone and no audio is captured or
transmitted. We do not use analytics or crash-reporting SDKs that track you across other apps or
websites.
Provision of data: Where you use the platform for a course, providing your account identity and attendance data is required to operate the service. If you do not sign in or check in, we cannot record your attendance or provide platform features tied to your enrollment. Camera access is requested only when you use the QR check-in feature on mobile; you may decline camera permission, but QR scanning will not be available (alternative check-in methods may be offered by your instructor on the web platform).
4. How we use your information (DPP3)
- To verify your identity and course enrollment via EdUHK SSO.
- To record and display attendance check-ins to you and your instructors.
- To operate peer assessment, team formation, and related course activities.
- To maintain the security, integrity, and reliability of the platform.
We do not sell your personal data, and we do not use it for advertising, direct marketing, or profiling unrelated to your studies. We will not use your data for a new purpose without notifying you, unless permitted by the Ordinance.
5. Data accuracy (DPP2)
Your name, email, and student number are sourced from EdUHK SSO and refreshed when you sign in. If your university records are incorrect, please update them through EdUHK channels; we will reflect corrected SSO data on your next login.
6. Who can see your data (classes of transferees)
Your personal data may be disclosed to the following classes of recipients, strictly for the purposes above:
- Your course instructors and authorized platform administrators, for academic and administrative purposes.
- Service providers that host and operate the platform on our behalf, currently Amazon Web Services (AWS) for application hosting, database storage, and identity federation (Cognito), and Microsoft as the university's SSO identity provider. These providers process data only as instructed by us and do not use it for their own purposes.
- Video hosting used for presentation-practice recordings (where that feature is used).
We do not sell, rent, or otherwise transfer your personal data to third parties for their own marketing or commercial purposes.
7. Cross-border data transfer
Our hosting and identity infrastructure may process data on servers located outside Hong Kong (for example, in AWS data centres in the Asia-Pacific region). Where personal data is transferred outside Hong Kong, we take reasonable steps to ensure it continues to receive a standard of protection comparable to that required under the Ordinance, including encryption in transit and contractual safeguards with our service providers.
8. Data retention
Attendance and assessment records are retained for the academic period and as long as required for course administration and university record-keeping. Presentation-practice recordings are retained for a limited period (currently up to two years) in line with the relevant module's policy. We retain data no longer than is necessary to fulfil the purposes for which it was collected, unless a longer period is required by law or university policy.
9. Your rights — access and correction (DPP6 / DPP7)
Under sections 18 and 22 of the Ordinance, you have the right to request access to, and correction of, the personal data we hold about you. You may also request deletion of your personal data, subject to academic record-keeping requirements and any legal obligation to retain certain records. To exercise these rights, contact us using the details in Section 12 below. We will respond to verifiable requests within the timeframe required by the Ordinance (generally within 40 days).
10. Security (DPP4)
We use encryption in transit (HTTPS/TLS) for all data sent between the app, the web platform, and our servers, secure on-device storage for session tokens, and access controls limiting who can view attendance and assessment data to authorized instructors and administrators.
11. Children's privacy
The platform is intended for university students, faculty, and staff. It is not directed at children under 13, and we do not knowingly collect personal data from children.
12. Contact us
For questions about this policy, or to exercise your data access or correction rights, contact the Artificial Intelligence and Digital Competency Education Centre (AIDCEC), The Education University of Hong Kong, via www.aidcec.eduhk.hk.
13. Changes to this policy
We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date at the top of this page.