Skip to main content

Privacy Policy Statement

1. Introduction

Details for Privacy Policy Statement

This Statement is intended mainly to inform you of our policies and practices in relation to our handling of personal data as well as the kinds of personal data which we hold and the main purposes for which such personal data is or is to be used and to whom any data access or correction request should be addressed.

 

In this Statement, the HKMC Group means one or more of The Hong Kong Mortgage Corporation Limited and its subsidiaries (including but not limited to HKMC Annuity Limited (HKMCA), HKMC Insurance Limited and HKMC Mortgage Management Limited) and subsidiary undertakings, as appropriate.   References to we, our and us are references to the HKMCA as applicable in the relevant context.

2. Our Policy

We respect personal data privacy and it is our policy to comply with the Personal Data (Privacy) Ordinance (Cap. 486 of the Laws of Hong Kong) (PDPO) and relevant codes of practice which may be issued by the Privacy Commissioner for Personal Data (PCPD) from time to time in the conduct of our business and in the provision of our products and services (Products).  We will ensure that our staff complies with the policies and practices set out in this Statement and maintains appropriate standards of security and confidentiality in meeting such commitment.

3. Our Practices

3.1 For Customers:

(a)Types of Personal Data held: We collect or obtain, hold, process and use the personal data of persons who are interested in or apply to enjoy, or who are enjoying the benefit of, any Product (Customers, including the persons mentioned in paragraph 3.1(a)(ii) below) or other relevant individuals in connection with the provision of the relevant Products to the Customers from time to time:
 (i)such personal data may, depending on the Product concerned, include but is not limited to identification information (including names, Hong Kong Identity Card numbers or passport numbers), contact details, address, age, date of birth, jurisdiction(s) of tax residence, tax identification number in that jurisdiction(s), gender, relationship with the Customer (in respect of persons other than the Customer), personal profile, financial information, educational and professional qualifications, credit standing, bankruptcy/debt restructuring status, information on insurance policy(ies) and other assets held or owned as well as any information provided in the course of enquiries, processing of applications or claims, requests, complaints or feedback; and
 (ii)the information referred to in paragraph 3.1(a)(i) above may include the personal data of the following categories of persons who are individuals:
  a)a Customer;
  b)authorised signatory(ies), or representative(s) of a Customer;
  c)any witness, beneficiary, claimant or assignee;
  d)any person who provides financial support to a Customer; and
  e)any person who is a joint bank account holder with a Customer if such bank account is or will be utilised to make or receive any payment,
  in relation to the relevant Product.
(b)Purposes for Collecting Personal Data: Personal data may be collected or obtained, held, processed and/or used by us and/or the persons set out in paragraph 3.1(c) below, to which the personal data may, depending on the Product concerned, be disclosed and/or transferred, for the following purposes:
 (i)assessing, processing and determining applications or requests made by a Customer for the Products (including but not limited to conducting financial needs analysis, processing payment instructions and seeking internal approvals);
 (ii)administering, maintaining, managing and operating the Products, and performing any functions and activities related thereto, including but not limited to reinsurance, reporting and general servicing and maintenance of online (if any) and other services;
 (iii)confirming and verifying the identity of a Customer or any other person referred to in paragraph 3.1(a)(ii) above and the information provided by any of them, where required;
 (iv)conducting underwriting checks or a credit check (where appropriate);
 (v)determining and recovering any amount of indebtedness owed under the relevant Product;
 (vi)handling any application, request, feedback, claim, enquiry or complaint involving a Customer (for example, personal data provided during a telephone enquiry on the telephone hotline and/or during the sales process may be tape-recorded to enable us to check on and follow up on the matter);
 (vii)any internal management purpose;
 (viii)in connection with any audit, check or review of the HKMCA and/or the Products and/or any insurance policy relating to any Product;
 (ix)designing new or enhancing existing Products;
 (x)any purpose in relation to claims made by or against or otherwise involving a Customer in respect of any Product (including but not limited to claims processing, investigation, litigation and recovery actions in relation to any such claims);
 (xi)research or analysis purposes;
 (xii)informing a Customer of any updates or changes to any Product;
 (xiii)complying with any disclosure, reporting, payment, withholding of payment, filing or notification or other similar obligations pursuant to any judicial, statutory or regulatory requirements, including compliance with applicable laws, regulations, guidelines and international and inter-governmental agreements, whether of Hong Kong or any other relevant jurisdiction which we are bound by, or any failure to comply with will result in adverse consequences (such as sanctions, penalties or imprisonment) for us or our officers and staff, including but not limited to compliance with the laws, regulations, guidelines and agreements in respect of, the automatic exchange of financial account information, the U.S. Foreign Account Tax Compliance Act, or anti-money laundering, counter-terrorist financing, sanctions or anti-corruption matters;
 (xiv)comparing data of data subjects or other persons for credit checking, enforcement of claims, data verification or otherwise producing or verifying data, whether or not for the purpose of taking adverse action against the data subjects, and where such comparison amounts to a matching procedure under the PDPO, we shall comply with the relevant requirements of the PDPO;
 (xv)preventing, detecting and co-operating in the investigation of crime, including fraud and any form of financial crime, and analysing and managing other commercial risks;
 (xvi)assisting and facilitating any local or foreign authority, governmental, regulatory or judicial body or agency in crime prevention, detection and investigation, and enforcement of laws;
 (xvii)verifying and comparing personal data with the information or data from any government department or agency (including but not limited to Social Welfare Department and Inland Revenue Department) and/or notifying, informing, disclosing and passing results of the verification and comparison and such personal data to the relevant government departments or agencies which may take action against a data subject on the basis of the result of such data verification or comparison;
 (xviii)in connection with an actual or proposed assignment or transfer of any of our interest under any Product;
 (xix)launching, improving and promoting any Product regardless of whether a Customer had applied for it (for example, dissemination of information on news, activities and events relating to a Product);
 (xx)with a Customer’s consent, using, the name, gender, date of birth, part of identity card or passport number, contact information (including but not limited to email address, telephone number and address) and information about the Products the Customer has applied or enjoyed, in carrying out direct marketing activities to him/her from time to time in relation to a) enhancement from time to time of the relevant Products in relation to the Customer, and b) the programmes, products or services of the HKMC Group when any of them may be made available to the Customer (in compliance with the relevant requirements of Part 6A of the PDPO);
 (xxi)any other directly related purpose pertaining to any of the above; and
 (xxii)other purposes agreed by or at the time of personal data collection, as notified to the data subject.
(c)Transfer/Disclosure of Personal Data: Any personal data held by us will be kept confidential but we may disclose or transfer such information to the following parties (whether within or outside Hong Kong) for or in relation to the purposes set out in paragraph 3.1(b) above:
 (i)any member of the HKMC Group (including for purposes not limited to the direct marketing purposes set out in paragraph 3.1(b)(xx) above, in compliance with the relevant requirements of Part 6A of the PDPO);
 (ii)any person or entity authorised to act as our agent for the distribution of the Products;
 (iii)any person or entity in connection with any claim made by or against or otherwise involving a Customer or in relation to the recovery of any claim or amount outstanding under any Product (as appropriate);
 (iv)a/an agent, contractor or third party service provider which provides administrative, application or claim processing, telecommunications, data analysis, processing and/or storage, due diligence, computer, payment, debt restructuring, debt recovery, financial, medical, marketing, advertising or public relations services or facilities to any member of the HKMC Group;
 (v)where applicable, any reinsurer (including any re-reinsurer of such reinsurer) of, or any entity providing financial support in relation to, the Products;
 (vi)a/an auditor, accountant, tax adviser, lawyer, consultant or any other professional adviser;
 (vii)any local or foreign court, tribunal, administrative, governmental or regulatory body (including local or foreign tax authorities and law enforcement agencies) in relation to the purposes set out in paragraphs 3.1(b)(xiii), (xiv), (xv), (xvi) and (xvii);
 (viii)any person or entity with the data subject’s consent;
 (ix)any actual or proposed assignee or transferee of any of our interests under any Product;
  (x)any debt collection agency (in the event of default under any Product involving a Customer, where applicable);
  (xi)any co-applicant under any Product, and any person proposing to provide or is providing financial support for a Customer’s obligations under any Product;
  (xii)any person (such as trustee in bankruptcy, liquidator or receiver) acting on our behalf or in connection with any insolvency or other analogous proceedings (including but not limited to bankruptcy, winding-up or receivership proceedings) relating to a Customer which affect any Product (as applicable); and
 (xiii)other persons as notified to the data subject at the time of personal data collection.

 

3.2  For Job Applicants, Staff and Directors:

(a)Types of Personal Data held: We collect or obtain, hold, process and use the personal data of persons who are applying for employment or who are employed by us as well as our prospective and current officers and staff (including but not limited to secondees and interns).  Other records that contain personal data held by us include records of our shareholders.  Such personal data may include but is not limited to:
 (i)identification information (including names, Hong Kong Identity Card numbers or passport numbers), contact details, age, curriculum vitae, past employment and remuneration related information, educational and professional qualifications, training records, appraisal information and references; and
 (ii)certain personal data of family members of our staff and officers who will enjoy, or who are enjoying, any of our staff benefits (including identification information (such as names, Hong Kong Identity Card numbers or passport numbers), age and contact details).
(b)

Purposes for Collecting Personal Data: Generally, we collect or obtain, hold, process and/or use such personal data mainly for the following purposes:

 (i)considering appointment as one of our officers or staff;
 (ii)recruitment, supervision, training and human resources management;
 (iii)determining and reviewing salaries, bonuses and other benefits;
 (iv)consideration for promotion, training, secondment or transfer;
 (v)administration of staff benefits and entitlements;
 (vi)providing staff references;
 (vii)mandatory provident fund schemes (MPF) and occupational retirement schemes (ORSO) participation;
 (viii)staff disciplinary matters;
 (ix)application, registration, waiver(s) or exemption(s) in relation to any licence, approval or registration required to carry out duties;
 (x)support of our development;
 (xi)complying with any disclosure, reporting, filing or notification or other similar obligations pursuant to any judicial, statutory or regulatory requirement including compliance with applicable laws, regulations and guidelines, whether of Hong Kong or any other relevant jurisdiction, which we are bound by or any failure to comply with will result in adverse consequences (such as sanctions, penalties or imprisonment) for us or our officers and staff; and
 (xii)monitoring and taking action in relation to compliance with legal, regulatory and internal policy requirements.
(c)Transfer/Disclosure of Personal Data: Such personal data held by us will be kept confidential but we may disclose or transfer such information to the following parties (whether within or outside Hong Kong) for the purposes set out in paragraph 3.2(b) above:
 (i)any insurance broker and insurance company;
 (ii)any bank in relation to remuneration arrangements;
 (iii)any bank, fund, professional investor, broker and arranger in relation to MPF and ORSO arrangements;
 (iv)any service provider (such as payroll administrators) providing administrative or other support services for staff matters and/or us;
 (v)a/an auditor, accountant, tax adviser, lawyer, consultant or any other professional adviser;
 (vi) any court, tribunal, administrative, governmental or regulatory body in relation to the purposes set out in paragraph 3.2(b)(xi) above;
 (vii)any person with the data subject’s consent (including any potential future employer); and
 (viii)other persons as notified to the data subject at the time of personal data collection.

 

3.3  For Business Counterparts:

(a)Types of Personal Data held: We collect or obtain, hold, process and use the personal data of persons who serve as officers, agents or representatives of our business counterparts (including agent banks and other persons/entities participating in our business including sale and distribution of the Products (collectively, Business Participants)) as well as potential and actual vendors/suppliers of goods, services and support to us (Business Contacts).  Such personal data may include but is not limited to identification information, contact details, information as regards a Business Contact’s official capacity and employment status.
(b)Purposes for Collecting Personal Data: Generally, we collect or obtain, hold, process and/or use such personal data mainly for the following purposes:
 (i)managing our business relationships;
 (ii)communicating on business, administrative, logistical and/or promotional arrangements in relation to our products, services, operation, agreements and other business activities;
 (iii)communicating on quotations or bids for goods or services;
 (iv)liaising on goods, services and/or support contracted for or agreed upon;
 (v)complying with obligations and enforcing rights under terms of contracts or arrangements we are a party to;
 (vi)handling any feedback, claim, enquiry or complaint;
 (vii)ascertaining authority for execution of legal documents; and
 (viii)complying with any disclosure, reporting, filing or notification or other similar obligations pursuant to any judicial, statutory or regulatory requirement including compliance with applicable laws, regulations and guidelines, whether of Hong Kong or any other relevant jurisdiction, which we are bound by or any failure to comply with will result in adverse consequences (such as sanctions, penalties or imprisonment) for us or our officers and staff.
(c)Transfer/Disclosure of Personal Data: Such personal data held by us will be kept confidential but we may disclose or transfer such information to the following parties (whether within or outside Hong Kong) for the purposes set out in paragraph 3.3(b) above:
 (i)a/an auditor, accountant, tax adviser, lawyer, consultants or any other professional adviser;
 (ii)any service provider (such as technical experts and due diligence service providers) providing technical and other expert advice and services including advice on any quotation for goods and/or services;
 (iii)any non-governmental organisation providing community, educational and charitable services;
 (iv)other Business Participants;
 (v)any court, tribunal, administrative, governmental or regulatory body in relation to the purposes set out in paragraph 3.3(b)(viii) above; and
 (vi)other persons as notified to the data subject at the time of personal data collection.

 

3.4  Accuracy and Retention of Personal Data

We have certain procedures in place to maintain, so far as is reasonably practicable, the accuracy, completeness and relevance of the personal data held by us for the purposes for which the data is used.  We aim to keep the personal data on our records accurate and up-to-date.  However, we rely primarily on the data subject to disclose all material information to the Business Participant(s) (which will update us) or us, as appropriate, and to inform the Business Participant(s) and/or us of any inaccuracy or changes in such information.

 

We maintain and execute retention policies of records containing personal data to ensure that such personal data is not kept longer than necessary for the fulfilment of the purposes for which it is or is to be used.  Different retention periods apply to the various kinds of personal data collected or obtained and held by us in accordance with our internal policies on retention of personal data, and also as prescribed or permitted by applicable laws and regulations.

 

3.5  Security of Personal Data

We take appropriate steps to protect the personal data we hold against unauthorised or accidental access, processing, erasure, loss or use of the personal data.  These steps include restricting physical and electronic access to personal data on a “need-to-know” and “need-to-use” basis, and having in place internal security policies and practices which require our staff to comply with the requirements of the PDPO.  We also provide relevant training, including induction and on-going training, to staff to handle personal data properly.

 

3.6  Outsourcing Arrangements

Our internal Information Technology (IT) systems are developed and maintained by our in-house staff and local third party service provider(s).  The third party service provider(s) does not have access to personal data stored in our IT system except when it is carrying out maintenance/checking/trouble shooting supervised by our IT staff.  Where we engage external third party to handle or process information, we use contractual or other reasonably practicable steps to prevent unauthorised or accidental access, processing, erasure, loss or use of any personal data and, where applicable, require such third party data processor not to keep the relevant data longer than is necessary for processing of the data.

4. Data Access and Correction Right
4.1

In accordance with the PDPO, an individual has the right to check whether we hold his/her personal data, to require us to provide a copy of such personal data, to correct any of his/her personal data which is inaccurate and to change his/her consent or objection to the use or transfer of his/her personal data for direct marketing purposes.  Such data access request can be made in writing using the form prescribed by the PCPD (which can be downloaded from the website “www.pcpd.org.hk”).  A data correction request and a change of consent or objection to the use or transfer of personal data for direct marketing purposes can be made to us in writing.

 

Please send the relevant requests to our Data Protection Officer at the following address:

 The Data Protection Officer
The HKMC Group
34/F Cosco Tower (High Block)
Grand Millennium Plaza
183 Queen’s Road Central
Hong Kong
4.2When we handle a data access or correction request, we will check the identity of the requestor to ensure that he/she is legally entitled to make such request.  In this regard, we may require the requestor to provide his/her identity proof, e.g. by production of his/her Hong Kong Identity Card or other identification documents.  In the case of a request made by a relevant person (as defined in the PDPO), he/she will be required to provide proof of his/her identity and the identity of the data subject concerned as well as documents showing his/her capacity as the relevant person, such as written authorisation signed by the data subject, birth certificate or court order (as the case may be).  If we cannot reasonably ascertain the identity of the data subject or establish the relationship between the requestor and the data subject, we will refuse to comply with the request.
4.3We will respond in writing to a data access or correction request as soon as practicable and in any event no later than 40 days after receiving the request in accordance with the relevant requirements of the PDPO.  We will comply with the requirement of a data subject to cease using his/her personal data in direct marketing upon receipt of such request.
4.4We have the right to charge a fee which is not excessive for the processing of any data access request.
5. Enquiries

Should you have any query on this Statement or wish to obtain further information on our privacy policies and practices, please contact our Data Protection Officer whose contact details are set out in paragraph 4.1 above.

6. No Limitation of Rights under PDPO

Nothing in this Statement shall limit any rights of a data subject under the PDPO.

7. Amendment of this Privacy Policy Statement

We may amend and update this Statement from time to time.

 

 

HKMC Annuity Limited

June 2018

 

 

 

Important Notice

1) Personal Information Collection Statement (February 2019)