Privacy Policy

Continua is operated by BNET-TECH COMPANY LIMITED (“we”, “us”). This policy covers our website, the Continua web application, the staff self-service portal and the Continua mobile app.

We handle personal data in two different capacities:

• As a data processor for our customers. When an employer (our Customer) uses Continua to keep records about its employees, interns and contractors, the employer is the data user under the PDPO. The employer decides what is collected and why, and we process that data only on its instructions. If you are an employee, your employer's own Personal Information Collection Statement also applies to you.
• As a data user in our own right, for the personal data of people who sign up for an account, contact us or visit our website, and for the security and operational records we keep in order to run the Service.

Account data. Name, login email address, roles and company memberships, language preference, and a one-way hash of your password (we never store passwords in readable form). If two-factor authentication is set up, the authenticator secret is stored encrypted.

Employment records entered by the employer, or by the employee through self-service, which may include:

• identity: surname and given name, sex, Hong Kong identity card or passport number, date of birth, and copies of identity, right-to-work, age and student-status documents;
• contact: phone number, personal email address, residential address and area, and emergency contact details;
• family: marital status and the spouse's identity document number, where needed for the IR56B return;
• employment: employee number, job title, department, start and end dates, employment type, contracted hours, schedules, benefit plan, probation and termination details;
• pay: salary, allowances, deductions, bank account details for wage payment, MPF enrolment and exemption details, payslips and the IR56 series of returns;
• self-employed contractors: name, business registration number, payment records and IR56M returns.

Work activity. Clock-in and clock-out times and, where permitted, your location at those moments; rosters, tasks, projects and timesheets; leave, overtime, time off in lieu and work-from-home applications and their approvals; expense and daily travel claims, including journeys, fares, transport mode and receipts; and notifications.

Health-related data. Sick-leave applications and supporting documents such as medical certificates, and medical examination records where the employer requires them. This is sensitive data, and access to it is restricted.

Technical data. Session tokens and your language preference, stored in your browser or device; the app version sent by the mobile app; push-notification device tokens; and IP addresses, which we process briefly for security and to limit excessive requests, and which may appear in server logs.

Connected accounts. If a Google Drive or Google Calendar account is connected, we store the connected Google account's email address and access tokens, both encrypted.

• from the employer and its HR, finance and management staff, who enter and approve records;
• from you directly, when you use self-service to submit an application, claim, timesheet or change to your profile (profile changes take effect only after HR approves them);
• automatically, when you clock in or out, use the app or receive notifications;
• from Google, if you choose to connect a Google account.

Personal data is used only for purposes directly related to the employment relationship and to providing the Service, including:

• keeping employment records and administering attendance, rosters, leave, overtime and claims;
• verifying attendance, including comparing the clock-in location with the place of work;
• calculating wages, MPF contributions, statutory entitlements and termination payments;
• preparing tax returns for the employer to review and sign;
• sending account emails, in-app notifications and push notifications;
• securing the Service, preventing fraud and keeping an audit trail of who did what;
• providing support, fixing faults and meeting legal obligations.

We do not sell personal data. We do not use personal data for direct marketing unless you have given your consent under Part 6A of the PDPO, and we never use Workers' data for our own marketing.

We do not use personal data for personality profiling, psychological assessment or behavioural scoring.

The Service calculates some statutory matters automatically from hours and pay records — for example, whether a Worker meets the continuous contract (“468”) requirement, and what leave pay is due. These calculations follow the published statutory rules, not any judgement about the person. Where the Service suggests an amount, both the suggested and the approved figures are kept. If you think a calculation about you is wrong, please raise it with your employer, who can correct the underlying records.

Your location is recorded only at the moment you clock in or out, and only if you have allowed the app or browser to access it. It is not tracked in the background or at any other time.

Your employer uses it to check the record against your place of work. If you refuse permission you can still clock in, but the record may be marked for review. You can change the permission at any time in your phone or browser settings.

If your employer has enabled the AI chat assistant and you use it, the message you type, together with the minimum context needed to understand it (such as the titles of your own tasks that day), is sent from our servers to a third-party AI model provider. We do not keep a transcript of the conversation in our database.

When an administrator imports a staff handbook to draft FAQ answers, the text of the handbook is sent to the same provider. The file itself is not kept.

Please do not type identity card numbers, medical details or other sensitive information into the chat.

AI providers may process data outside Hong Kong (see section 9).

Within the employer, access follows the roles the employer assigns. Managers and department administrators can see only the Workers in their own departments. Identity details — such as identity card numbers, home address, date of birth, marital status and emergency contacts — are visible only to roles the employer has specifically authorised.

We use the following service providers (data processors) to run the Service:

• Amazon Web Services — application hosting and database, in the Asia Pacific (Hong Kong) region of Amazon Web Services;
• Google — Google Drive (file storage in the employer's own Drive account), Google Calendar (only if a Worker connects it) and Firebase Cloud Messaging (Android push notifications);
• an email delivery provider — account and notification emails;
• an AI model provider — the AI-assisted features, where enabled.

We require our service providers to protect personal data and to use it only to provide their services to us.

We may also disclose personal data where required by law or by a court, to protect the rights and safety of any person, or to a successor in a transfer of our business, subject to this policy. We do not submit returns or other data to the Inland Revenue Department, the Mandatory Provident Fund Schemes Authority or any other authority on the employer's behalf; the employer does that itself.

Our main database is hosted in the Asia Pacific (Hong Kong) region of Amazon Web Services. Files uploaded through the Service are stored in the employer's own Google Drive, and Google may keep them in any of its data centres. The AI model provider, Google and email providers may process data outside Hong Kong, including in the United States. Where data is transferred outside Hong Kong, we take reasonable steps, including contractual terms with our providers, to ensure it is protected to a standard comparable to the PDPO.

We keep Customer Data while the employer's subscription is active, and as the employer instructs. Employers must keep certain records for minimum periods by law. For example, the Inland Revenue Ordinance requires records of income to be kept for 7 years, and the Employment Ordinance requires wage and employment records covering the last 12 months of employment to be kept until 6 months after the employment ends.

Requests to delete personal data held for an employer are decided by that employer. If you send such a request to us, we will inform the employer's administrator. Before any record is deleted, it is checked against those statutory retention periods: a record still within a legal retention period is restricted so that it is no longer used in day-to-day work, and is deleted when that period ends. Other records are deleted without undue delay.

The audit log is kept for as long as the records it relates to, and is never edited.

Files in the employer's Google Drive are kept according to the employer's own settings for that Drive.

After a subscription ends, data remains available for export for 60 days and is then deleted or anonymised within a further 90 days, apart from routine backups, which expire on their normal cycle.

• encrypted connections (HTTPS/TLS) between your device and our servers;
• additional application-level encryption (AES-256-GCM) for residential addresses, spouses' identity document numbers, bank account numbers, two-factor secrets and connected-account tokens;
• passwords stored only as one-way hashes, optional or company-required two-factor authentication, and limits on repeated login attempts;
• role-based access with department scoping, so that each person sees only what their role requires;
• an append-only audit log of changes, and of each time a receipt, document or another person's payslip is opened;
• access to the employer's Google Drive limited to files that Continua itself created.

No system is completely secure. If a data breach affecting personal data occurs, we will notify the affected employers without undue delay and help them assess whether to notify the Privacy Commissioner for Personal Data and the people affected.

Under the PDPO you may ask for access to, and correction of, your personal data.

• Employees: please make requests to your employer first, since it is the data user for your employment records. You can see much of your own data — including payslips, leave and attendance — in the self-service portal, and propose corrections to your contact details there. We will help your employer respond.
• Account holders and other people: please contact us at info@bnet-tech.com.

We will respond to a data access request within 40 days, as the PDPO requires. We may charge a fee for complying with a data access request, which will not be excessive.

You can withdraw permission for optional features at any time: turn off location or notifications in your device settings, or disconnect Google Calendar in the app.

You can opt out of any direct marketing from us at any time.

We use only the storage the Service needs in order to work: your signed-in session, your language and display-theme choices, and, if you choose it, a “trusted device” marker for two-factor authentication. These are kept in your browser's local storage or the app's secure storage. We do not use advertising cookies, and we do not use third-party analytics or tracking tools.

• Location (only while the app is in use) — to record where you clock in or out.
• Camera and photos — only when you choose to photograph or attach a receipt.
• Notifications — to tell you about approvals, payslips and reminders.

Login details on your phone are kept in the device's secure storage.

The Service is intended for businesses. Employers may keep records of young persons they employ, including proof of age, as the law requires. We do not knowingly collect personal data from children other than through their employer's records.

As the data user, you are responsible for giving each Worker a Personal Information Collection Statement on or before collecting their data. It should explain the purposes of collection, the classes of people the data may be transferred to (including us, as your data processor), and how to request access and correction. The Service provides a document type for recording each Worker's signed acknowledgement of that statement.

You should tell Workers that location is recorded when they clock in or out, and tell them about the AI assistant if you enable it.

We may update this policy. We will publish the new version here with a new date, and give notice in the Service or by email for material changes.

Data protection enquiries: info@bnet-tech.com

BNET-TECH COMPANY LIMITED, Unit 323, 3/F, Building 16W, Phase Three, Hong Kong Science Park, Pak Shek Kok, New Territories, Hong Kong

If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong (www.pcpd.org.hk).