How we handle personal data.

Effective date: 29 July 2026. This Privacy Policy Statement (PPS) explains how the operator of NAR1 Easy Fill (the “service”, “we”, “us” or “our”) collects, holds, uses and protects personal data when you use aachart.com.

This PPS is intended to be read with any Personal Information Collection Statement (PICS) shown beside a form or sign-in flow. A PICS gives collection-specific information, including whether a field is obligatory or voluntary, the purpose of collection and the classes of transferees.

1. Who operates the service

Operator: the owner or entity operating NAR1 Easy Fill. The operator’s legal name and correspondence address should be inserted here before launch.

Privacy contact: [email protected]. Please replace this address if it is not a monitored mailbox. We may ask for reasonable information to verify your identity before handling a request.

2. Personal data we may collect

• Account data: your email address, account identifier, authentication records and sign-in security metadata.
• Saved return data: the NAR1 answers you choose to save, such as company details, return date, registered office, directors, members, share information and presentor details.
• Reusable person profiles: names, correspondence addresses, email or partial identification particulars that you explicitly save for quick filling. These profiles are kept in browser storage on your device and are not sent to our database.
• Technical data: IP address, browser and device information, request logs, approximate location derived from an IP address, and security or error information.
• Usage and consent data: pages and features used, download events, cookie choices and other events sent through Google Tag Manager, Google Analytics or advertising tags when those tags are enabled.
• Communications: information you include when contacting us about support, privacy or security.

We aim to collect only data that is adequate, relevant and not excessive for the stated purposes. Do not enter a full Hong Kong identity-card number, passport number or other sensitive identifier unless the official filing requirement clearly calls for it.

3. How we collect and use data

We collect data when you use the form, sign in, choose to save a return, import a prior PDF, contact us or interact with the site. We use it to:

• provide the guided NAR1 preparation tool and generate a PDF;
• authenticate you and load saved return details in a later year;
• keep the service secure, troubleshoot errors, prevent abuse and maintain backups;
• understand performance and improve the service; and
• serve and measure advertising where permitted by your choices and applicable requirements.

Providing information is voluntary unless a particular field or service is clearly marked as required. If required information is not provided, we may be unable to generate a complete form, save a return or provide account support.

4. Browser processing and accounts

The NAR1 PDF is generated in your browser. The import feature reads a selected prior PDF locally; it does not upload that file to a separate PDF-processing service. If you use the tool without signing in, answers are kept in the current browser session and are not saved by our database after you leave.

If you choose “Save this person”, the reusable profile is stored in this browser so it can be selected for a secretary, director or member later. You can remove saved profiles from the quick-fill control or clear this browser’s site data.

If you sign in and choose to save, the answer set is sent over HTTPS to our self-hosted Supabase-compatible authentication and database service. Saved records are associated with your account and row-level access controls are used to restrict them to that account. Anyone who can access your account or device may be able to view saved records, so protect your sign-in link and device.

5. Cookies, analytics and advertising

We may use essential cookies or browser storage for authentication, security and basic functionality. With the relevant consent or other lawful permission, Google Tag Manager may load Google Analytics or other tags selected by the operator. Google AdSense may use cookies or similar technologies to serve, personalise and measure ads.

Tag Manager is a container: tags enabled in the live container may collect information described in their own notices. The operator must keep the container, this PPS and the site’s consent message aligned. For visitors in the EEA, the UK or Switzerland, Google’s certified consent requirements may apply; you can change your choice through the consent controls where available.

6. Service providers and disclosures

We may disclose personal data to service providers who help us operate the service, only for the purposes described here and subject to appropriate confidentiality and security arrangements. Depending on the live configuration, these may include:

• our hosting, network and security provider, including Cloudflare where its proxy or security services are enabled;
• our self-hosted database and authentication infrastructure;
• AWS Simple Email Service (SES), if configured, to deliver account or support emails; and
• Google services such as Tag Manager, Analytics and AdSense, subject to your consent choices and their own privacy terms.

We may also disclose information where required or permitted by law, to protect the rights and security of the service, or in connection with a change of operator. We do not sell your saved NAR1 answers.

7. Where data is stored

Our infrastructure and service providers may process or store data in Hong Kong or other jurisdictions. Where this happens, we take reasonable steps to select providers and safeguards appropriate to the sensitivity of the data and the purposes described in this PPS. The operator should update this section if the hosting region or providers change.

8. Retention and deletion

We retain account and saved-return data while your account is active or for as long as needed to provide the service, meet legal obligations, resolve disputes and maintain security records. When data is no longer required, we will delete it or remove identifying details unless retention is required or permitted by law.

You may request deletion of your account and saved return records by contacting [email protected]. Deletion from active systems may not immediately remove data held in encrypted backups or security logs; those copies are deleted or overwritten in accordance with the operator’s backup and log-retention schedule.

9. Security and incidents

We use reasonable technical and organisational measures, including HTTPS, access controls, least-privilege database permissions and row-level security, to protect personal data against unauthorised or accidental access, processing, loss or disclosure. No internet transmission or storage system is completely secure. If we identify a material personal-data incident, we will assess it and take steps required by applicable law, including notifying affected persons or regulators where appropriate.

10. Access and correction

Under the Personal Data (Privacy) Ordinance (Cap. 486), you may request access to personal data we hold about you and request correction of inaccurate data. Send a written request to [email protected], describing the data and the account or email address concerned. We may charge a fee that is not excessive for a data access request and may need to verify your identity.

We will respond to a data access or correction request within 40 days as required by the Ordinance, or explain in writing within that period if we cannot fully comply. You may also withdraw consent for non-essential analytics or advertising through the available consent controls, although this will not affect processing that is necessary for the service or required by law.

11. Links and policy changes

The service may link to the Companies Registry, Google or other sites that have their own privacy practices. We are not responsible for those third-party sites. We may update this PPS when the service, providers or legal requirements change. The effective date above will change when a revised version is published.

12. Hong Kong privacy framework

This PPS is designed around the openness, collection, use, security, retention and access/correction principles of Hong Kong’s Personal Data (Privacy) Ordinance. For more information, visit the Office of the Privacy Commissioner for Personal Data.