Bequest
Start my Will
Privacy and data

Your life, in your words. Your data, in your hands.

How Bequest collects, uses, stores, and shares your personal data, and the rights you hold under Hong Kong law. Written to be read, not skimmed.

Entity
Bequest Limited
Effective
September 2026
Version
5
Governing law
Cap. 486 (PDPO)
The short version

We collect only what we need to help you plan, we never sell your personal data, and you can ask us for a copy of it, correct it, or ask us to delete it. Everything below explains how we do that, the retention limits set out in Section 07, and the rights you hold under Hong Kong law, in full.

If you only read one section, read the Personal Information Collection Statement in Section 14. It tells you what we ask for, whether you have to give it, and what happens if you do not.

Contents
00

About our products

The product you choose determines who processes your data.

Bequest offers two categories of product.

Legal documents

Documents prepared under Hong Kong law, where a qualified Hong Kong solicitor reviews your document. These currently comprise the Will, the Deed of Guardianship, the Enduring Power of Attorney (EPOA) and the Advance Medical Directive (AMD). When you use Bequest for these documents, you enter into two contractual relationships: with Bequest, for the technology platform, and with our partner law firm, for the legal services. Our partner law firm is currently Patricia Ho and Associates, an independent Hong Kong solicitors' firm. Your personal data is processed by both Bequest and our partner law firm, each as an independent data user under the PDPO. The firm's handling of your personal data is governed by its own privacy notice, which will be provided to you when you engage them.

Non-legal documents

Documents provided by Bequest alone, with no solicitor involvement. These currently comprise Final Wishes, a personal document expressing your wishes, which is not a legal instrument. Our partner law firm is not involved, and your data is processed only by Bequest.

01

Who we are

Bequest Limited is a data user under Cap. 486.

Bequest Limited ("Bequest", "we", "our", "us") operates bequest.love, a digital estate planning platform. Our platform guides users through creating estate planning documents using solicitor-reviewed templates designed for use in Hong Kong.

Bequest Limited is a data user for the purposes of the Personal Data (Privacy) Ordinance (Cap. 486) ("PDPO"). This Notice explains how we collect, use, store, and share your personal data, and what rights you have under Hong Kong law.

This Notice applies to all users of bequest.love and any related services we provide. It does not apply to third-party services that may be accessible through our platform; those services are governed by their own privacy policies. In particular, the handling of your personal data by our partner law firm in the course of providing legal services is governed by that firm's own privacy notice.

02

Personal data we collect

The categories of personal data tied to the products and services you use.

Account and contact information
Collected when you register and manage your account with us.
Identity and verification information
Required to produce estate planning documents under Hong Kong law.
Estate planning instructions
Information you provide in connection with the specific product or service you are using, including information about individuals you name in your documents.
Payment and transaction information
Associated with your use of paid services. Card and bank account details are processed directly by our payment processor and are not stored on Bequest systems.
Delivery information
Collected when you request a printed set of your Final Wishes, and used only to send it to you.
Usage and technical information
Collected automatically through cookies and analytics technologies when you interact with our platform.

Information about other individuals

Some of our products require you to provide personal information about other people, such as individuals you name in your estate planning documents. When you provide another person's personal data to us for the purpose of completing your document, Bequest processes that data solely for the purpose of preparing your document as instructed by you. We do not use that data for independent purposes and we do not contact those individuals. This limited processing is consistent with Bequest's obligations under DPP1(3) of the PDPO. We encourage you to inform the individuals you name that their details have been provided to Bequest and to our partner law firm, as applicable, in connection with your estate planning.

03

How we collect your data

Three routes, and no more.

  • Directly from you when you create an account, complete a product workflow, make a payment, submit an enquiry, or contact us for support.
  • Automatically through cookies and analytics technologies when you visit or interact with bequest.love. See Section 08 for details.
  • From third parties only where you have directed us to receive data on your behalf or where permitted by applicable law.
04

Why we collect your data

Under the PDPO, personal data may not be used for purposes materially different from those for which it was collected, without your prescribed consent.

Purpose
Consistent with collection purpose?
Creating and maintaining your account
Yes. Necessary to provide the platform service you requested.
Providing the estate planning platform service, including guiding you through your legal documents and Final Wishes
Yes. The core purpose for which you provided your data.
Processing your payments
Yes. Necessary to complete your transaction.
Sharing your data with our partner law firm for legal services (legal documents only)
Yes. The legal services are integral to the product you requested; you are informed before sharing takes place.
Sending service communications (receipts, security alerts, product updates)
Yes. Ancillary to the provision of the service.
Sending marketing and promotional communications
Only with your consent.
Analytics and platform improvement
Yes. Operational improvement is consistent with the service purpose.
Complying with legal and regulatory obligations
Yes. Required by law.
05

Who we share your data with

We do not sell personal data, and we do not share it for third-party direct marketing without your consent.

Our partner law firm
For legal documents, we share your data with our partner law firm as necessary to provide legal services. Your Will, Deed of Guardianship and EPOA are reviewed and witnessed by the firm. An Advance Medical Directive is reviewed by the firm for completeness. It is not witnessed by the firm. It is witnessed by two witnesses you arrange yourself, one of whom must be a Hong Kong registered medical practitioner, and both must be present at the same time. Bequest and the firm are independent data users, and the firm's handling of your data is governed by its own privacy notice. Before the firm begins work, we send only the minimum needed for it to confirm it is able to act for you: your legal name and the first four characters of your HKID or passport number. We never send the full number at that stage. Everything else is shared only after the firm confirms it can act.
Cloud infrastructure
Your data is stored on servers operated by Google Cloud Platform in the Asia region. Google operates as a data processor on our behalf and is contractually bound to protect your data.
Payment processing
Payment transactions are handled by Stripe, Inc. Stripe processes card and payment data under its own privacy policy. Bequest does not store card details.
Other service providers
We use a small number of other providers to run and improve the platform, covering things like product analytics, email delivery and customer support. Each one acts only on our instructions, may not use your data for its own purposes, and is bound by contract to protect it. None of them receives your identity documents or anything you write in your documents.
Legal requirements
We may disclose personal data where required by law, court order, or a regulatory authority with applicable jurisdiction. Where permitted, we will notify you before any such disclosure.
If you use Final Wishes only, and no legal document, your data is not shared with our partner law firm.
06

Cross-border data transfer

Comparable protection, wherever your data is processed.

Your personal data may be processed or stored outside Hong Kong by the service providers described in Section 05. While section 33 of the PDPO, which would restrict cross-border transfers of personal data, is not currently in force, the data protection principles under the PDPO apply to personal data wherever it is processed.

We follow the Privacy Commissioner's Recommended Model Contractual Clauses for Cross-border Transfer of Personal Data (May 2022 Guidance) as best practice. Where personal data is transferred outside Hong Kong, we take steps to ensure it receives a comparable level of protection to that required by the PDPO, including contractual safeguards with our service providers.

For further information about our cross-border transfer safeguards, contact us at hello@bequest.love.
07

Data retention

We keep data only as long as necessary for the purpose it was collected, in line with DPP2 of the PDPO.

Category
Retention period
Account information
Retained while your account is active. After closure, contact and profile information is deleted within 12 months, subject to the exceptions below, allowing for reactivation and post-closure matters.
Legal document content
Retained for the duration of your account and for 50 years following account closure or your confirmed passing, whichever is later. Estate planning documents must remain accessible to executors and beneficiaries, sometimes decades after signing.
Final Wishes content
Retained for the duration of your account and for seven years following account closure, unless you request earlier deletion.
Payment records
Retained for seven years from the date of transaction, in accordance with Hong Kong revenue law.
Usage and analytics data
Retained in aggregated form for up to 26 months. Individual-level data is deleted or anonymised within 14 months.

You may request deletion of your account and associated personal data at any time by contacting us at hello@bequest.love. We will honour deletion requests subject to the retention periods set out above and any overriding legal obligations.

08

Cookies and tracking technologies

Small text files that help us provide, secure, and improve the platform.

Type
Purpose
Strictly necessary
Required for the platform to function. They enable session management, security features, and access to authenticated areas. These cannot be disabled.
Analytics
Help us understand how people use the platform so we can improve it. These are set by our analytics provider and are tied to an account identifier rather than to your name. We do not use them to build an advertising profile of you.
Marketing
Used to measure the effectiveness of our marketing campaigns and, where you have consented, to show you relevant content.

You can manage your cookie preferences through our cookie consent tool when you first visit the site, or at any time through your browser settings. Disabling certain cookies may affect the functionality of the platform.

09

Your rights under the PDPO

Under Cap. 486, you hold the following rights in respect of your personal data.

Right
What it means
Access (s.18)
You may request a copy of the personal data we hold about you. We respond within 40 days and may charge a reasonable fee where permitted by law.
Correction (s.22)
You may request correction of any personal data we hold about you that is inaccurate, incomplete, or misleading.
Opt out of marketing (s.35G)
You may require us to cease using your personal data in direct marketing at any time, without charge.
Complain
You may lodge a complaint with the Privacy Commissioner for Personal Data, Hong Kong, at www.pcpd.org.hk.

To exercise your rights, contact us at hello@bequest.love. Please provide sufficient information for us to identify your account and verify your identity.

10

Marketing communications

We obtain your consent before any direct marketing, under Part 6A of the PDPO.

With your consent, we may send you promotional emails, product updates, and educational content about estate planning. We obtain your consent separately before including your personal data in any direct marketing activity, in compliance with Part 6A of the PDPO (ss. 35C to 35H).

Withdrawing consent

You may withdraw your consent to receive marketing communications at any time by:

  • Clicking the unsubscribe link in any marketing email we send you
  • Contacting us at hello@bequest.love

Withdrawal of consent stops all future marketing use of your personal data. Marketing sent before your withdrawal, at a time when your consent was valid, is not affected. Withdrawal does not affect service communications, which we may continue to send in connection with your account.

11

Security

Technical and organisational measures, with extra safeguards for estate planning data.

We implement technical and organisational measures designed to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include encryption of data in transit and at rest, access controls and role-based permissions, and regular security reviews of our systems.

Despite these measures, no internet-based system can guarantee absolute security. You are responsible for keeping your account credentials confidential and for notifying us immediately if you believe your account has been compromised.

Given the particularly sensitive nature of estate planning data, we apply additional safeguards to legal documents stored on our platform, including access logging. Where document content requires review by a qualified solicitor, as part of the legal services provided by our partner law firm, access is restricted to authorised personnel at that firm.

12

Changes to this notice

We will tell you before material changes take effect.

We may update this Privacy Notice from time to time to reflect changes in our services, our data practices, or applicable law. The version number and effective date at the top of this page show which version of this Notice applies.

Where we make material changes to how we collect, use, or share your personal data, we will notify you by email or through a prominent notice on our website before the changes take effect. Continued use of our platform after that date constitutes acceptance of the updated Notice.

13

Contact us

For access or correction requests, questions about this Notice, or privacy complaints.

Bequest Limited
Address
Hong Kong
Office of the Privacy Commissioner
Hotline
(852) 2827 2827

You have the right to lodge a complaint directly with the Office of the Privacy Commissioner for Personal Data, Hong Kong.

14

Personal Information Collection Statement

What we ask you for, why, and what happens if you would rather not say.

This statement is given to you under Data Protection Principle 1(3) of the PDPO. It applies every time we ask you for personal data: when you create an account, when you complete any document workflow, when you request a printed set, and when you contact us.

What we collect and when

When you create an account: your name, email address and password. When you complete a document workflow: identity details including your HKID or passport number, and the personal details of anyone you name in your document. When you pay: your billing details, handled by our payment processor. When you request a printed set: a delivery address in Hong Kong. When you contact us: whatever you choose to tell us.

Why we need it

To create and maintain your account, to prepare the document you asked for, to pass what is needed to our partner law firm so it can provide the legal services that form part of a legal document product, to take payment, to deliver printed items, and to answer you. Section 04 sets out every purpose in full.

Whether you have to give it

Giving us your data is voluntary. You are never obliged to supply it. But some of it is necessary, and if you do not supply it we cannot do the work:

  • Without your name and email address we cannot create an account for you.
  • Without your identity details, including your HKID or passport number, our partner law firm cannot confirm it is able to act for you, and cannot prepare or witness a legal document. Hong Kong law requires a person making a Will, an EPOA, a Deed of Guardianship or an AMD to be identified.
  • Without your billing details we cannot take payment.
  • Without a delivery address we cannot send you a printed set.
  • Anything else we ask for is optional, and leaving it blank does not affect the service.

Who we may pass it to

Our partner law firm, for legal document products only. Our cloud infrastructure provider, our payment processor, and the other service providers described in Section 05, each acting only on our instructions. Anyone we are required by law, court order or a regulator to disclose to. We do not sell your personal data and we do not pass it to anyone else for their own marketing. Section 05 sets this out in full.

Marketing

We use your name and email address for direct marketing only if you have separately told us we may. That means emails about our products, guides about estate planning in Hong Kong, and occasional offers. You can tell us to stop at any time, free of charge, and we will. Section 10 explains how.

Access and correction

You may ask us for a copy of the personal data we hold about you, and you may ask us to correct anything that is wrong. Write to the Privacy Officer, Bequest Limited, at hello@bequest.love. We reply within 40 days and may charge only the direct cost of complying.

A question of trust

Estate planning asks for your most private details. We treat them that way.

If anything here is unclear, or you would like to access, correct, or delete your data, a real person will help.