Skip to main content

Privacy Policy Statement

1. Introduction

Details for Privacy Policy Statement

In this Statement, “HKMC” means The Hong Kong Mortgage Corporation Limited and “HKMC Group” means the HKMC and its subsidiaries (including but not limited to HKMC Annuity Limited, HKMC Insurance Limited and HKMC Mortgage Management Limited). The terms “we”, “our” and “us” mean one or more members of the HKMC Group (including our successors and assigns), as the context requires.

 

This Statement is intended mainly to inform you of our policies and practices in relation to our handling of personal data as well as the kinds of personal data which we hold and the main purposes for which such personal data is or is to be used and to whom any data access or correction request should be addressed.

2. Our Policy

We respect personal data privacy and it is our policy to comply with the Personal Data (Privacy) Ordinance (PDPO) and relevant codes of practice which may be issued by the Privacy Commissioner for Personal Data (PCPD) from time to time. We will ensure that our staff complies with the policies and practices set out in this Statement and maintains appropriate standards of security and confidentiality in meeting such commitment.

3. Our Practices

3.1 Programme Customers

(a)Types of Personal Data Held: In relation to the financial, insurance, credit support, retirement planning, loyalty and related programmes, schemes or services (such as our mortgage purchase programme, mortgage insurance programme, reverse mortgage programme, SME financing guarantee scheme, policy reverse mortgage programme and microfinance scheme) from time to time provided or operated by us (Programmes), we collect or obtain, hold and use personal data of various categories of individuals:
 (i)such personal data may, depending on the Programme concerned, include but is not limited to identification information (including names, Hong Kong Identity Card numbers or passport numbers), contact details, address, age, date of birth, place of birth, jurisdiction(s) of tax residence, tax identification number in that/those jurisdiction(s), gender, relationship with other Data Subjects (as defined below), personal profile, financial information, health condition, medical history, medical diagnosis treatment and expenses, bank account information, employment and remuneration information, educational and professional qualifications, credit standing, bankruptcy/debt restructuring status, information on property(ies), insurance policy(ies) and other assets held or owned as well as any information provided in the course of applications, requests, enquiries, complaints or feedback; and
 (ii)such categories of individuals include but are not limited to:
  (1)existing and prospective applicants, borrowers or customers/users (including policyowner(s), claimant(s), beneficiary(ies) and/or insured(s)) under or in connection with a Programme;
  (2)shareholders, directors, controlling persons, officers and managers of a corporate applicant, borrower or customer/user and its subsidiaries and related entities;
  (3)partners or members of a partnership, or representatives, agents, attorneys or nominees of an applicant, borrower or customer/user; and
  (4)other relevant individuals of any Programme such as sureties and persons providing financial or credit support for/to a customer or borrower, any person who is a joint bank account holder with a customer or borrower where such bank account is or will be used to make or receive payments, and individuals providing supporting services (such as mentoring services), in relation to or under a Programme,
  

(collectively, “Data Subjects” and each, a “Data Subject”).

References to “Programmes” include amendments and enhancements to the Programmes as may be effected from time to time.

(b)How We Use the Personal Data: Depending on the Programmes concerned and the role of the relevant Data Subject(s), the purposes for which personal data may be used by us and/or the persons set out in paragraph 3(c) below to which personal data may be disclosed and/or transferred are as follows:
 (i)processing, assessing and determining applications for and requests relating to the Programmes including financial needs analysis or payment instructions (such applications/requests may be made to us and/or our business counterparts) and, if approved, to comply with the terms of the Programmes;
 (ii)administering, maintaining, managing and operating the Programmes (including enforcing rights and fulfilling obligations under the Programmes), and performing any function and activity related thereto (such as maintenance of online and other services);
 (iii)dealing with any loan, insurance cover or other credit support in relation to the Programmes (including but not limited to reinsurance arrangements);
 (iv)conducting underwriting checks, identity checks and/or credit checks (where appropriate);
 (v)determining and recovering (and assisting any Programme Participant (as defined below) in recovering) any amount of indebtedness owed under the Programmes;
 (vi)any purpose in connection with any claim or withdrawal application made or to be made by or otherwise involving a Data Subject and/or a Programme Participant in respect of the Programmes (including but not limited to processing, analysing, investigating, assessing and determining such claim or withdrawal application);
 (vii)processing any feedback, enquiry or complaint made by or otherwise involving a Data Subject and/or a Programme Participant under the Programmes (for example, personal data provided during an enquiry on the telephone hotline of a Programme may be tape-recorded to enable us to check on and respond to the caller on the matter);
 (viii)any internal management purpose;
 (ix)carrying out any audit, checks or reviews of us, any Programme or any account under a Programme;
 (x)administering and processing any future application by or involving the same Data Subject for any Programme;
 (xi)taking recovery action in relation to any Programme involving a Data Subject (including the use of information provided by a Data Subject for a Programme in the enforcement of his/her payment obligations under another Programme);
 (xii)conducting credit or eligibility assessment, performing customer analysis and profiling, creating and maintaining databases and credit scoring models, or conducting other research and statistical analysis;
 (xiii)communicating with a Data Subject generally (such as updates or changes to any Programme), providing a Data Subject with rewards under any Programme and customer relationship management purposes;
 (xiv)complying with any disclosure, reporting, screening, monitoring, record keeping, payment, withholding of payment, filing or notification or other similar obligations pursuant to any legal, regulatory, judicial, statutory, industry or administrative requirements (as applicable from time to time) including compliance with applicable laws, rules, regulations, codes of practice, guidelines or international and intergovernmental agreements (whether of Hong Kong or any other relevant jurisdictions) including but not limited to compliance with Automatic Exchange of Financial Account Information and Foreign Account Tax Compliance Act, and anti-money laundering, counter-terrorist financing, sanctions or anti-corruption laws, regulations, guidelines and agreements;
 (xv)assisting in law enforcement purposes, investigations by police or other government or regulatory authorities, in Hong Kong or elsewhere;
 (xvi)comparing data of Data Subjects or other persons for credit checking, enforcement of claims, data verification or otherwise producing or verifying data, whether or not for the purpose of taking adverse action against the Data Subjects, and where such comparison amounts to a “matching procedure” under the PDPO, we shall comply with the relevant requirements under the PDPO;
 (xvii)preventing and detecting crime, including fraud and any form of financial crimes;
 (xviii)verifying and comparing personal data with data from any government department or agency (including but not limited to The Hong Kong Housing Authority, The Hong Kong Housing Society, The Urban Renewal Authority, Social Welfare Department and Inland Revenue Department) and/or notifying and disclosing results of the verification and comparison and the personal data to the relevant government departments or agencies which may take action against a Data Subject on the basis of such results;
 (xix)any purpose in connection with an actual or proposed assignment or transfer of any of our interest under any Programme;
 (xx)designing new or enhancing existing products and services provided by us (including financial, insurance, credit support, retirement planning, loyalty and related programmes, services and products);
 (xxi)advertising, marketing and promoting any Programme and other supporting services (including in connection with direct marketing as detailed in paragraph 3.1(d) below; and
 (xxii)any other directly related purposes pertaining to any of the above, or other purposes agreed by a data subject.
In relation to paragraph 3.1(b)(i) above, “business counterparts” include banks and other financial institutions and non-government organisations, and any other persons/entities (1) participating in a Programme, (2) authorised to act as our agents for the distribution a Programme, or (3) referring any business to us pursuant to an agreement (collectively, “Programme Participants”).
(c)Disclosing the Personal Data: Any personal data held by us will be kept confidential but we may disclose or transfer such information to the following parties (within or outside Hong Kong) for or in relation to the purposes in paragraph 3.1(b) above:
 (i)any member of the HKMC Group;
 (ii)any Programme Participant in relation to a Programme, or in relation to the recovery of any claim or amount outstanding under a Programme involving a Data Subject (as appropriate);
 (iii)any agent, contractor or third party service provider which provides administrative, application or claim processing, telecommunications, data analysis, data processing or storage, due diligence, information technology, computer, payment, debt restructuring, securities clearing, debt recovery, financial, mailing, printing, marketing, advertising or public relations services/facilities to any member of the HKMC Group in connection with the operation of the member’s business;
 (iv)where applicable, any valuer and medical service provider;
 (v)where applicable, any reinsurer (including any re-reinsurer of such reinsurer) of, or any entity providing financial support in relation to, a Programme;
 (vi)any auditor, accountant, tax adviser, lawyer, consultant or other professional adviser;
 (vii)any court, tribunal or administrative, governmental or regulatory body or enforcement agency in Hong Kong or elsewhere (including local or foreign tax authorities);
 (viii)any actual or proposed assignee or transferee of any of our interest under any Programme;
 (ix)any credit reference agency, and, in the event of default involving a Data Subject, any debt collection agency or company carrying on claim or investigation services;
  (x)any co-applicant or co-borrower under a Programme, and any person proposing to provide or is providing financial or credit support for/to a Data Subject’s obligations under a Programme;
  (xi)any person (such as a trustee in bankruptcy, liquidator or receiver) acting on our behalf in connection with any insolvency or other analogous proceeding (including but not limited to bankruptcy, winding-up or receivership) relating to a Data Subject which affects a Programme (as applicable);
  (xii)for the purposes of direct marketing, any person specified under paragraph 3.1(d) below; and
 (xiii)any person with the consent of a Data Subject.
(d)Use and Provision of Personal Data in Direct Marketing: We may use Data Subject’s personal data in direct marketing and we require the Data Subject’s consent (which includes an indication of no objection) for that purpose. In this connection:
(i)the name, contact details, products and services portfolio information, transaction pattern and behaviour, financial background and demographic data of a Data Subject held by a member of the HKMC Group from time to time may be used by such member or other members of the HKMC Group in direct marketing;
(ii)the following classes of services, products and subjects may be marketed:
(1)financial, insurance, credit support, retirement planning and related services and products;
(2)reward, benefit offering, loyalty, membership, club, referral or privilege programmes and related services, products, facilities (such as related mobile applications) and events; and
(3)services and products which may be made available under any programme, service, product, facility and event under paragraph 3.1(d)(ii)(2) above, including financial, insurance and banking, real estate agency and property management, membership, entertainment, maintenance and renovation, health care and senior care, telecommunication, consumer products and services by retail outlets and/or online businesses, sports and recreation, dining, travel and accommodation, transportation and logistics, household, apparel, food and beverage, grocery, publications, professional advice and/or consultation and charitable initiatives;
(iii)the above services, products and subjects may be provided by the relevant HKMC Group member and/or:
(1)any member of the HKMC Group;
(2)third party financial institutions and insurers;
(3)third party reward, benefit offering, loyalty, membership, club, referral or privilege programme providers or operators; and
(4)any Programme Participant; and
(iv)in addition to marketing the above services, products and subjects itself, the relevant HKMC Group member may provide a Data Subject’s name and contact details to all or any of the persons described in paragraphs 3.1(d)(iii)(2) to (4) above (and in the case of any member of the HKMC Group, the data described in paragraph 3.1(d)(i) above) for use by them in marketing those services, products and subjects, and the relevant HKMC Group member requires the Data Subject’s written consent (which includes an indication of no objection) for that purpose.
If a Data Subject does not wish the relevant HKMC Group member to use or provide to other persons his/her data for use in direct marketing as described above, the Data Subject may exercise his/her opt-out right by notifying the relevant HKMC Group member.

 

3.2  Job Applicants, Staff and Directors 

(a)Types of Personal Data Held: We collect or obtain, and hold, the personal data of persons who (1) are applying for employment, (2) are employed by or seconded to us, (3) are our prospective and current officers and staff (including secondees and interns) and (4) are no our longer officers and staff (including secondees and interns). Other records that contain personal data held by us include records of our shareholders:
 (i)such personal data may include but is not limited to identification information (including names, Hong Kong Identity Card numbers or passport numbers), biometric data (e.g. fingerprint), age, contact details, curriculum vitae, past employment and remuneration related information, educational and professional qualifications, training records, appraisal information and references; and
 (ii)certain personal data of family members of our staff and officers who will enjoy or who are enjoying any of our staff benefits (including identification information (such as names, Hong Kong Identity Card numbers or passport numbers), age and contact details) will also be collected or obtained, and held, by us.
(b)How We Use the Personal Data: Generally, we hold and use such personal data mainly for the following purposes:
 (i)consideration of employment, appointment or secondment as one of our officers or staff;
 (ii)recruitment, staff supervision, training and human resources management;
 (iii)determination and review of salaries, bonuses and other benefits;
 (iv)consideration for and facilitating appraisals, promotion, career development, staff planning, training, secondment or transfer;
 (v)administration of staff benefits, compensation, payroll and entitlements;
 (vi)provision of staff references;
 (vii)administration of the mandatory provident fund schemes (MPF) and occupational retirement schemes (ORSO);
 (viii)making tax returns;
 (ix)staff disciplinary matters;
 (x)review of employment decisions;
 (xi)application, registration, waiver(s) or exemption(s) in relation to any licence, approval or registration required to carry out duties;
 (xii)support of our development;
 (xiii)compliance with any disclosure, reporting, filing or notification or other similar obligation pursuant to any judicial, statutory or regulatory requirement including compliance with applicable laws, regulations and guidelines, whether of Hong Kong or any other relevant jurisdiction, which we are bound by or any failure to comply with will result in adverse consequences (sanctions, penalties, imprisonment etc.) for us or our officers and staff;
 (xiv)conducting user authentication on the systems or devices (e.g. Windows operating systems) and providing access to authorized resources for selected users; and
 (xv)monitoring and taking action in relation to compliance with legal, regulatory and internal policy requirements.
(c)Disclosing the Personal Data: Such personal data held by us will be kept confidential but we may disclose or transfer such information to the following parties (whether within or outside Hong Kong) for the purposes set out in paragraph 3.2(b) above:
 (i)any member of the HKMC Group for which you may be seconded or which you may be assigned to provide any services;
 (ii)any insurance broker and insurance company;
 (iii)any bank in relation to remuneration arrangements;
 (iv)any bank, fund, professional investor, broker and arranger in relation to MPF and ORSO arrangements;
 (v)any service provider (such as payroll administrators) providing administrative or other support services for staff matters and/or us;
 (vi)a/an auditor, accountant, tax adviser, lawyer, consultant or other professional advisor;
 (vii)any court, tribunal, administrative, governmental or regulatory body or enforcement agency in relation to the purposes set out in paragraphs 3.2(b)(xi) and (xiii) above; and
 (viii)any person with the data subject’s consent (including any potential future employer).

 

3.3  Business Counterparts 

(a)Types of Personal Data Held: We collect or obtain, and hold, the personal data of persons who serve as officers, agents or representatives of the Programme Participants, potential and actual vendors/suppliers of goods, services and support to us and potential and actual business counterparts (Business Contacts). Such personal data may include but is not limited to identification information, contact details, information as regards Business Contact’s official capacity and employment status.
(b)How We Use the Personal Data: Generally, we hold and use Business Contacts’ personal data mainly for the following purposes:
 (i)managing our business relationships;
 (ii)communicating on business, administrative, logistical and/or promotional arrangements in relation to Programmes and/or any function and activity related thereto;
 (iii)communicating on quotations or bids for goods or services;
 (iv)liaising on goods, services and/or support contracted for or agreed upon;
 (v)complying with obligations and enforcing rights under terms of contracts or arrangements we are a party to;
 (vi)handling any feedback, requests, claims, enquiries or complaints;
 (vii)ascertaining authority for execution of legal documents; and
 

(viii)

complying with any disclosure, reporting, filing or notification or other similar obligation pursuant to any judicial, statutory or regulatory requirement including compliance with applicable laws, regulations and guidelines, whether of Hong Kong or any other relevant jurisdiction, which we are bound by or any failure to comply with will result in adverse consequences (sanctions, penalties, imprisonment etc.) for us or our officers and staff.
(c)Disclosing the Personal Data: Business Contacts’ personal data held by us will be kept confidential but we may disclose or transfer such information to the following parties (whether within or outside Hong Kong) for the purposes set out in paragraph 3.3(b) above:
 (i)a/an auditor, accountant, tax adviser, lawyer, consultants or other professional advisor;
 

(ii)

 

any service providers (such as technical experts, due diligence service providers etc.) providing technical and other expert advice and services including advice on any quotation for goods and/or services;
 

(iii)

 

any non-governmental organisations providing community, educational or charitable services;
 (iv)other Programme Participants; and

(v)

any court, tribunal, administrative, governmental or regulatory body in relation to the purposes set out in paragraph 3.3(b)(viii) above.

 

3.4  Accuracy and Retention of Personal Data

We have certain procedures in place to maintain, so far as is reasonably practicable, the accuracy, completeness and relevance of the personal data held by us in relation to the purposes for which the data is used. We aim to keep the personal data accurate and updated. However, we rely primarily on the relevant data subject to disclose all material information to the Programme Participant(s) (which will update us) or us, as appropriate, and to inform the Programme Participant(s) and/or us of any inaccuracy or changes in such information.

 

We maintain and execute retention policies of records containing personal data to ensure that such personal data is not kept longer than necessary for the fulfilment of the purposes for which it is or is to be used. Different retention periods apply to the various kinds of personal data collected or obtained and held by us in accordance with our internal policies on retention of personal data, and also as prescribed or permitted by applicable laws and regulations.

 

For further details, please contact our Data Protection Officer whose contact details are set out in paragraph 4.1 below.

 

3.5  Security of Personal Data

We take appropriate steps to protect the personal data we hold against unauthorised or accidental access, processing, erasure, loss or use of the personal data. These steps include restricting physical and electronic access to personal data on a “need-to-know” and “need-to-use” basis, and having in place internal security policies and practices which require our staff to comply with the requirements of the PDPO. We also provide relevant training, including induction and on-going training, to staff to handle personal data properly.

 

3.6  Outsourcing Arrangements

Our internal IT systems are developed and maintained by our in-house staff and local third party service provider(s). The third party service provider(s) do not have access to personal data stored in our IT system except when it is carrying out maintenance/checking/trouble shooting supervised by our IT staff. Where we engage external third party to handle or process information, we use contractual or other reasonably practicable steps to prevent unauthorised or accidental access, processing, erasure, loss or use of any personal data and, where applicable, require such third party data processor not to keep the relevant data longer than is necessary for processing of the data.

4. Data Access Request and Data Correction

4.1

In accordance with the PDPO, an individual has the right to check whether we hold his/her personal data and to require us to provide a copy of such personal data and to correct any of his/her personal data which is inaccurate. Such requests can be made in writing using the form prescribed by PCPD (which can be downloaded from the website “www.pcpd.org.hk”) to our Data Protection Officer at the following address:

 

The Data Protection Officer

The HKMC Group

34/F Cosco Tower (High Block)

Grand Millennium Plaza

183 Queen’s Road Central

Hong Kong

4.2

When we handle a data access or correction request, we will check the identity of the requestor to ensure that he/she is legally entitled to make such request. In this regard, we may require the requestor to provide his/her identity proof, e.g. by production of his/her Hong Kong identity card or other identification document. In the case of a request made by a “relevant person” (as defined in the PDPO), he/she will be required to provide proof of his/her identity and the identity of the data subject concerned as well as documents showing his/her capacity as the relevant person, such as written authorisation signed by the data subject, birth certificate or court order (as the case may be). If we cannot reasonably ascertain the identity of the data subject or establish the relationship between the requestor and the data subject, we will refuse to comply with the request.

4.3

We will respond in writing to any such request as soon as practicable and in any event no later than 40 days after receiving the request in accordance with the relevant requirements of the PDPO.

4.4

We have the right to charge a fee which is not excessive for the processing of any data access request.

5. Enquiries

Should you have any query on this Statement or wish to obtain further information on our privacy policies and practices, please contact our Data Protection Officer whose contact details are set out in paragraph 4.1 above.

6. No Limitation of Rights under PDPO

Nothing in this Statement shall limit any rights of a data subject under the PDPO.

7. Amendment of this Privacy Policy Statement

We may amend and update this Privacy Policy Statement from time to time.

 

 

HKMC Annuity Limited

September 2019

 

 

 

Important Notice

1) Personal Information Collection Statement (February 2019)