Last Updated: 18 October 2026
Koalaty Music Limited, company number 3187731 (Koalaty Music, we, us or our), respects your privacy. This Privacy Policy explains how we collect, hold, process, use, disclose and protect personal data when you visit www.koalatymusic.com, create an account, purchase or use our online courses and related products or services, contact us, or otherwise interact with us (together, the Services).
For Hong Kong personal-data purposes, Koalaty Music is the data user responsible for determining the purposes for which, and the manner in which, personal data is collected, held, processed or used. Our registered office, principal place of business and designated privacy contact details are Room 1103, 11th Floor, Shanghai Industrial Investment Building, 48-62 Hennessy Road, Wanchai, Hong Kong.
This Policy should be read together with any personal-information collection statement presented when we collect data, our Terms and Conditions, and our Cookie Notice, if separately provided.
1.1 We handle personal data in accordance with the laws that apply to the relevant processing, including the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong (PDPO) where applicable.
1.2 The Services may be accessible outside Hong Kong. Additional privacy notices or rights may apply where another jurisdiction’s law applies. We do not state that a foreign privacy law applies unless that position has been confirmed.
1.3 This Policy applies to personal data relating directly or indirectly to an identifiable living individual. Information that has been irreversibly anonymised so that an individual is no longer identifiable is not personal data.
2.1 Information provided by an adult account holder, purchaser or contact may include:
• name, email address, account credentials and communication preferences;
• billing address, transaction reference, order history and payment-status information;
• payment details submitted to a payment provider, noting that we do not intend to store full credit- or debit-card numbers;
• messages, support requests, complaints, survey responses and feedback; and
• any other information voluntarily provided through an authorised feature of the Services.
2.2 Information about a Child provided by a parent or legal guardian may include the Child’s first name or nickname, approximate age or age range, language preference, course selection, answers, learning activity and progress.
2.3 Information collected automatically may include:
• IP address and approximate location derived from it;
• browser type, operating system, device identifiers and technical settings;
• pages viewed, links selected, dates and times of access, course or lesson activity, progress and error logs;
• referring pages or campaign information; and
• cookie identifiers and information collected through cookies or similar technologies.
2.4 The specific data fields, whether each field is mandatory or optional, and the consequences of not providing mandatory information must be stated at or before collection in an appropriate personal-information collection statement. Where information is required to create an Account, complete a purchase or provide a Service, we will indicate this at collection. If required information is not provided, we may be unable to provide the relevant Service.
2.5 We aim to collect personal data that is adequate but not excessive for the stated purposes. We do not intentionally request sensitive information unless it is necessary and appropriate for a disclosed purpose. Any collection of health, accessibility or special educational information requires separate assessment.
3.1 We collect personal data directly from you when you create or manage an Account, make a purchase, register a Child, use a Course, contact support, subscribe to marketing, submit content or otherwise communicate with us.
3.2 We may collect information automatically from the Website and Services through server logs, cookies, analytics tools and similar technologies, as described in section 10.
3.3 We may receive personal data from payment providers, hosting and authentication providers, analytics providers, marketing platforms, delivery providers for merchandise, or other service providers.
4.1 We may use personal data for the following purposes, where relevant and permitted:
• creating, authenticating and managing Accounts;
• processing orders, confirming payment status, providing access and maintaining transaction records;
• personalising course settings, recording lesson activity and showing learning progress;
• providing customer support, responding to enquiries, complaints and rights requests;
• operating, maintaining, securing, troubleshooting and improving the Website and Services;
• conducting analytics and research using aggregated or de-identified information where reasonably possible;
• sending essential service communications, including purchase confirmations, security notices, Account updates and changes to the Services or policies;
• sending direct marketing only in accordance with section 9;
• preventing, detecting and investigating fraud, misuse, intellectual-property infringement and security incidents;
• complying with legal obligations, responding to lawful requests and establishing, exercising or defending legal claims; and
• carrying out a corporate transaction such as a genuine reorganisation, financing, sale or transfer, subject to appropriate confidentiality and legal safeguards.
4.2 We will not use personal data for a new purpose that is not the original purpose or a directly related purpose unless we have a lawful basis to do so and provide any notice or obtain any consent required by applicable law.
4.3 If a foreign privacy regime applies, the relevant legal bases for processing and any required supplementary disclosures are following jurisdiction-specific review.
5.1 Our Courses are designed for Children but are intended to be purchased and managed by a parent or legal guardian. A parent or guardian should create and manage the Account, decide what Child information is provided, and supervise the Child’s use of the Services.
5.2 We seek to collect only the Child information reasonably necessary to provide and support the learning experience. The parent or guardian should use a nickname rather than a full legal name where a full name is not required.
5.3 We do not knowingly collect personal data directly from a Child under 13 without the involvement and authorisation of a parent or guardian. Our Courses are intended to be purchased and managed by a parent or legal guardian. Information about a Child should be provided through, or with the involvement of, that parent or guardian.
5.4 If we learn that Child data was provided without appropriate authority or contrary to this Policy, we will investigate and take appropriate steps, which may include restricting the Account and deleting the data unless retention is required or permitted by law.
5.5 A parent or guardian may contact us to request access to, correction of or, where appropriate, deletion of the Child’s personal data. We may need to verify identity and authority before acting on a request.
5.6 We will not use a Child’s image, voice, performance, testimonial or learning record for public marketing, social media or unrelated product development without a separate lawful basis and, where appropriate, specific permission from the parent or guardian.
6.1 We do not sell personal data.
6.2 We may disclose personal data, only as reasonably necessary, to:
• payment processors and fraud-prevention providers;
• website hosting, cloud storage, content-delivery, authentication and technical-support providers;
• email, customer-support and communications providers;
• analytics and cookie providers;
• professional advisers, auditors and insurers under duties of confidentiality;
• delivery and fulfilment providers where merchandise is purchased;
• a purchaser, investor or successor in connection with a genuine corporate transaction, subject to appropriate safeguards; and
• courts, regulators, law-enforcement bodies or other authorities where disclosure is required or permitted by law.
6.3 Service providers are expected to process personal data only for authorised purposes and subject to appropriate contractual, confidentiality and security obligations.
6.4 We do not permit service providers to use personal data for their own direct marketing unless this has been separately disclosed and lawfully authorised.
7.1 The Website and its service providers may process or store personal data outside Hong Kong.
7.2 Where personal data is transferred or made accessible outside its place of collection, we will assess applicable requirements and use appropriate contractual, organisational or technical safeguards where required or reasonably appropriate. No representation is made in this Policy that another country provides the same level of protection as Hong Kong.
7.3 Before actively offering the Services in another jurisdiction, we will assess whether local transfer notices, contractual clauses, risk assessments or other measures are required.
8.1 Payments are expected to be processed by third-party payment providers. We may receive limited information such as payer name, billing contact details, payment status, transaction reference, payment method type and partial card details. We do not intend to receive or store full payment-card numbers.
8.2 The identity of each payment provider, the information it collects, its processing locations and a link to its privacy notice are https://stripe.com/en-hk/privacy. Payment providers process information under their own privacy terms as well as any obligations they owe to us.
9.1 We may use the contact details and other categories of personal data specified in the relevant marketing notice to send information about categories of Koalaty Music products or services only after providing the required information and obtaining consent where required by applicable law.
9.2 Marketing consent must be separate from acceptance of the Terms where appropriate. We will not treat silence or failure to opt out as consent where affirmative consent is required.
9.3 You may opt out at any time by using the unsubscribe link in a marketing email or contacting info@koalatymusic.com. We may retain limited suppression information to respect the opt-out. Opting out of marketing does not stop essential service communications.
10.1 Cookies and similar technologies may be used to operate the Website, remember settings, maintain security, measure performance and understand how the Services are used. For Cookies Policy, please refer to https://www.koalatymusic.com/cookies.
10.2 Where consent is required, non-essential technologies will be used only after valid consent and users will be given a means to withdraw or change that consent. A statement that continued browsing alone constitutes consent should not be used where affirmative consent is legally required.
10.3 Users can also control cookies through browser settings, although disabling necessary cookies may affect Website functions. Browser controls do not replace any consent control that applicable law requires us to provide.
11.1 We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, including providing the Services, maintaining transaction and consent records, resolving disputes, enforcing agreements, protecting security, and meeting legal, accounting or reporting requirements.
11.2 Retention periods or criteria for Account data, Child profiles and progress, support messages, payment and transaction records, marketing consents, security logs, cookies.
11.3 When personal data is no longer required, we will take reasonable steps to delete it securely or anonymise it, subject to backup cycles, legal holds and technical limitations. Anonymised information may be retained where it no longer identifies an individual.
12.1 We use reasonable and appropriate technical and organisational measures designed to protect personal data against accidental or unauthorised access, alteration, loss, use, disclosure or destruction. Measures should reflect the nature and sensitivity of the data and the risks involved.
12.2 No online system is completely secure, and we cannot guarantee absolute security. You should use a strong, unique password, keep Account credentials confidential and notify us promptly of suspected unauthorised access.
13.1 Subject to applicable law, you may request access to personal data we hold about you and correction of inaccurate personal data. Other rights, such as deletion, withdrawal of consent, objection, restriction, portability or complaint, may apply depending on the relevant jurisdiction and circumstances.
13.2 A request may be submitted to info@koalatymusic.com. Please describe the request and the relevant Account or relationship. We may ask for information reasonably necessary to verify identity, authority and the scope of the request.
13.3 For a request concerning a Child, we may verify that the requester is the Child’s parent, legal guardian or other authorised person.
13.4 We will respond within the period required by applicable law.
13.5 We may refuse or limit a request only where applicable law permits and will explain the reason where required. A reasonable fee may be charged for an access request only where permitted by law.
14.1 The Website may contain links to third-party websites or services. Their privacy practices are governed by their own notices, and this Policy does not apply to processing that Koalaty Music does not control.
14.2 Embedded videos, social-media plugins, single-sign-on tools or other third-party features may collect information directly.
15.1 We may update this Policy to reflect changes in the Services, data practices, providers or applicable requirements. The revised version will be posted with an updated “Last Updated” date.
15.2 Where a change is material, we will provide an appropriate additional notice, such as by email, through the Account or prominently on the Website. If consent is required for a new use, we will seek it before that use begins.
16.1 Questions, complaints and privacy requests may be sent to:
• Koalaty Music Limited (Company No. 3187731)
• Email: info@koalatymusic.com
16.2 You may also have the right to complain to a relevant privacy or data-protection authority. In Hong Kong, information about the Office of the Privacy Commissioner for Personal Data is available through its official website. We recommend confirming the appropriate complaint wording and whether a postal address or direct link should be included before publication.
