Skip to Primary Content
Alternative BannerMain Banner

Privacy Policy Statement

1. Introduction

This Statement is intended mainly to inform you of our policies and practices in relation to our handling of personal data as well as the kinds of personal data which we hold and the main purposes for which such personal data is or is to be used and to whom any data access or correction request should be addressed.

2. Our Policy

We respect personal data privacy and it is our policy to comply with the Personal Data (Privacy) Ordinance (PDPO) and relevant codes of practice which may be issued by the Privacy Commissioner for Personal Data (PCPD) from time to time.  We will ensure that our staff complies with the policies and practices set out in this Statement and maintains appropriate standards of security and confidentiality in meeting such commitment.

3. Our Practices

3.1  For Programme Customers:

(a)Types of Personal Data held: We collect or obtain, and hold, personal data of persons who are interested in, apply to enjoy or who are enjoying the benefit of any of our programmes, schemes or services (Programme Customers, including the persons mentioned in paragraph 3.1(a)(ii) below) (such as our mortgage purchase programme, mortgage insurance programme, reverse mortgage programme, SME financing guarantee scheme, premium loan guarantee scheme and microfinance scheme) from time to time provided or operated by us (Programmes):
 (i)such personal data may, depending on the Programme concerned, include but is not limited to identification information (including names, Hong Kong Identity Card numbers or passport numbers), contact details, age, personal profile, bank account information, employment and remuneration information, educational and professional qualifications, credit standing, bankruptcy/debt restructuring status, information on property(ies), insurance policy(ies) and other assets held or owned as well as any information provided in the course of enquiries, complaints or feedback; and
 (ii)the information listed in paragraph 3.1(a)(i) above of any person who intends to or is providing credit support (such as a guarantee) for any Programme Customer may also be collected or obtained, and held, by us.
(b)How We Use the Personal Data: Generally, we hold and use Programme Customers’ personal data mainly for the following purposes:
 (i)assessing, administering and processing the Programme application made by/involving the Programme Customer to a Programme Participant (as defined under paragraph 3.3(a) below) and/or us (as the case may be) and, if approved, to comply with the terms of the Programme;
 (ii)operating a Programme including providing support (such as providing an administrative and operating platform in relation to our Programmes and/or credit support in the form of insurance cover, guarantee or otherwise) under the Programme (Support) (for example, we provide insurance cover to banks to support the reverse mortgage loans made by them to borrowers in our reverse mortgage programme) and acquisition of assets under a Programme;
 (iii)dealing with any loan, insurance cover or other credit support in relation to the relevant Support and/or Programme (including but not limited to re-insurance arrangements);
 (iv)conducting a credit check (where appropriate);
 (v)determining and recovering any amount of indebtedness owed under the relevant Support and/or Programme;
 (vi)handling any feedback, claims, enquiries or complaints involving the Programme Customer and/or the Programme Participant (for example, personal data provided during a telephone enquiry on our mortgage insurance programme or SME financing guarantee scheme telephone hotline will be tape-recorded to enable us to check on and follow-up on the matter);
 (vii)any internal management purposes;
 (viii)in connection with any audit, checks or review of us, any Support and/or Programme;
 (ix)administering and processing any future application by the Programme Customer for any Programme;
 (x)taking recovery action in relation to any Programme involving the Programme Customer (for example, any information provided by a Programme Customer for our mortgage insurance programme may be used by us in the enforcement of his/her payment obligations under any mortgage loan acquired by us under our mortgage purchase programme);
 (xi)research or analysis purposes;
 (xii)informing the Programme Customer of any updates or changes to any of our Programmes;
 (xiii)complying with any disclosure, reporting, filing or notification or other similar obligation pursuant to any judicial, statutory or regulatory requirement including compliance with applicable laws, regulations and guidelines, whether of Hong Kong or any other relevant jurisdiction, which we are bound by or any failure to comply with will result in adverse consequences (sanctions, penalties, imprisonment etc.) for us or our officers and staff (for example, compliance with anti-money laundering, sanctions or anti-corruption laws);
 (xiv)in connection with an actual or proposed assignment or transfer of our interests under any Programme;
 (xv)launching, improving and promoting any Programme regardless of whether the Programme Customer had applied or not (for example, dissemination of information on news, activities and events relating to a Programme); and
 (xvi)any other directly related purposes pertaining to any of the above or other purposes agreed by the Programme Customer.
(c)Disclosing the Personal Data: Programme Customers’ personal data held by us will be kept confidential but we may disclose or transfer such information to the following parties (whether within or outside Hong Kong) for the purposes set out in paragraph 3.1(b) above:
 (i)our subsidiary, associated company, affiliate or any entity controlled by us which supports or provides services in relation to the relevant Support and/or Programme (HKMC Affiliate) (for example, our subsidiary, HKMC Mortgage Management Limited provides servicing support for our mortgage purchase programme);
 (ii)any Programme Participant in relation to the relevant Support and/or Programme (as appropriate);
 (iii)a/an agent, valuer, contractor or third party service provider which provides administrative, application or claim processing, telecommunications, data processing and/or storage, due diligence, computer, payment, debt restructuring, debt recovery, financial, marketing, advertising, public relations services or facilities to us and any HKMC Affiliate;
 (iv)where applicable, any reinsurers (including any re-reinsurers of such reinsurers) of, or any entity providing financial support in relation to, the relevant Support and/or Programme;
 (v)a/an auditor, accountant, tax adviser, lawyer, consultant or other professional advisor;
 (vi)any court, tribunal, administrative, governmental or regulatory body in relation to the purposes set out in paragraph 3.1(b)(xiii);
 (vii)person(s) with the Programme Customer’s consent;
 (viii)any actual or proposed assignee or transferee of any of our interests under any Programme;
 (ix)any debt collection agencies (in the event of default under any of the Programmes involving the Programme Customer, where applicable);
 (x)any co-applicant under any Programme, and any person proposing to provide or is providing financial support for the Programme Customer’s obligations under any Programme; and
 (xi)any person (such as a trustee in bankruptcy, liquidator or receiver) acting on our behalf in connection with any insolvency or other analogous proceeding (including but not limited to bankruptcy, winding-up or receivership) relating to the Programme Customer which affects any relevant Support and/or Programme (as applicable).

 

3.2  For Job Applicants, Staff and Directors:

(a)Types of Personal Data held: We collect or obtain, and hold, the personal data of persons who are applying for employment or who are employed by us as well as our prospective and current officers and staff (including secondees and interns).  Other records that contain personal data held by us include records of our shareholders:
 (i)such personal data may include but is not limited to identification information (including names, Hong Kong Identity Card numbers or passport numbers), age, contact details, curriculum vitae, past employment and remuneration related information, educational and professional qualifications, training records, appraisal information and references; and
 (ii)certain personal data of family members of our staff and officers who will enjoy or who are enjoying any of our staff benefits (including identification information (such as names, Hong Kong Identity Card numbers or passport numbers), age and contact details) will also be collected or obtained, and held, by us.
(b)How We Use the Personal Data: Generally, we hold and use such personal data mainly for the following purposes:
 (i)considering appointment as one of our officers or staff;
 (ii)recruitment, supervision, training and human resources management;
 (iii)determining and reviewing salaries, bonuses and other benefits;
 (iv)consideration for promotion, training, secondment or transfer;
 (v)administration of staff benefits and entitlements;
 (vi)providing staff references;
 (vii)mandatory provident fund schemes (MPF) and occupational retirement schemes (ORSO) participation;
 (viii)staff disciplinary matters;
 (ix)application, registration, waiver(s) or exemption(s) in relation to any licence, approval or registration required to carry out duties;
 (x)support of our development;
 (xi)complying with any disclosure, reporting, filing or notification or other similar obligation pursuant to any judicial, statutory or regulatory requirement including compliance with applicable laws, regulations and guidelines, whether of Hong Kong or any other relevant jurisdiction, which we are bound by or any failure to comply with will result in adverse consequences (sanctions, penalties, imprisonment etc.) for us or our officers and staff; and
 (xii)monitoring and taking action in relation to compliance with legal, regulatory and internal policy requirements.
(c)Disclosing the Personal Data: Such personal data held by us will be kept confidential but we may disclose or transfer such information to the following parties (whether within or outside Hong Kong) for the purposes set out in paragraph 3.2(b) above:
 (i)any insurance broker and insurance company;
 (ii)any bank in relation to remuneration arrangements;
 (iii)any bank, fund, professional investor, broker and arranger in relation to MPF and ORSO arrangements;
 (iv)any service provider (such as payroll administrators) providing administrative or other support services for staff matters and/or us;
 (v)a/an auditor, accountant, tax adviser, lawyer, consultant or other professional advisor;
 (vi)any court, tribunal, administrative, governmental or regulatory body in relation to the purposes set out in paragraph 3.2(b)(xi) above; and
 (vii)any person with the data subject’s consent (including any potential future employer).

 

3.3  For Business Counterparts:

(a)Types of Personal Data held: We collect or obtain, and hold, the personal data of persons who serve as officers, agents or representatives of our business counterparts (including banks or other financial institutions, non-governmental organisations, other persons/entities participating in our Programmes (for example, mentors in our microfinance scheme) (Programme Participants) as well as potential and actual vendors/suppliers of goods, services and support to us (Business Contacts).  Such personal data may include but is not limited to identification information, contact details, information as regards Business Contact’s official capacity and employment status.
(b)How We Use the Personal Data: Generally, we hold and use Business Contacts’ personal data mainly for the following purposes:
 (i)managing our business relationships;
 (ii)communicating on business, administrative, logistical and/or promotional arrangements in relation to Programmes and/or Support;
 (iii)communicating on quotations or bids for goods or services;
 (iv)liaising on goods, services and/or support contracted for or agreed upon;
 (v)complying with obligations and enforcing rights under terms of contracts or arrangements we are a party to;
 (vi)handling any feedback, claims, enquiries or complaints;
 (vii)ascertaining authority for execution of legal documents; and
 (viii)complying with any disclosure, reporting, filing or notification or other similar obligation pursuant to any judicial, statutory or regulatory requirement including compliance with applicable laws, regulations and guidelines, whether of Hong Kong or any other relevant jurisdiction, which we are bound by or any failure to comply with will result in adverse consequences (sanctions, penalties, imprisonment etc.) for us or our officers and staff.
(c)Disclosing the Personal Data: Business Contacts’ personal data held by us will be kept confidential but we may disclose or transfer such information to the following parties (whether within or outside Hong Kong) for the purposes set out in paragraph 3.3(b) above:
 (i)a/an auditor, accountant, tax adviser, lawyer, consultants or other professional advisor;
 (ii)any service providers (such as technical experts, due diligence service providers etc.) providing technical and other expert advice and services including advice on any quotation for goods and/or services;
 (iii)any non-governmental organisations providing community, educational and charitable services;
 (iv)other Programme Participants; and
 (v)any court, tribunal, administrative, governmental or regulatory body in relation to the purposes set out in paragraph 3.3(b)(viii) above.

 

3.4  Accuracy and Retention of Personal Data

We have certain procedures in place to maintain, so far as is reasonably practicable, the accuracy, completeness and relevance of the personal data held by us in relation to the purposes for which the data is used.  We aim to keep the personal data accurate and updated.  However, we rely primarily on the data subject to disclose all material information to the Programme Participant(s) (which will update us) or us, as appropriate, and to inform the Programme Participant(s) and/or us of any inaccuracy or changes in such information.
We maintain and execute retention policies of records containing personal data to ensure that such personal data is not kept longer than necessary for the fulfilment of the purposes for which it is or is to be used.  Different retention periods apply to the various kinds of personal data collected or obtained and held by us in accordance with our internal policies on retention of personal data, and also as prescribed or permitted by applicable laws and regulations.
For further details, please contact our Data Protection Officer whose contact details are set out in paragraph 4.1 below.  

 

3.5  Security of Personal Data

We take appropriate steps to protect the personal data we hold against unauthorised or accidental access, processing, erasure, loss or use of the personal data. These steps include restricting physical and electronic access to personal data on a “need-to-know” and “need-to-use” basis, and having in place internal security policies and practices which require our staff to comply with the requirements of the PDPO. We also provide relevant training, including induction and on-going training, to staff to handle personal data properly.

 

3.6  Outsourcing Arrangements

Our internal IT systems are developed and maintained by our in-house staff and local third party service provider(s).  The third party service provider(s) do not have access to personal data stored in our IT system except when it is carrying out maintenance/checking/trouble shooting supervised by our IT staff.  Where we engage external third party to handle or process information, we use contractual or other reasonably practicable steps to prevent unauthorised or accidental access, processing, erasure, loss or use of any personal data and, where applicable, require such third party data processor not to keep the relevant data longer than is necessary for processing of the data.

4. Data Access Request and Data Correction

4.1

In accordance with the PDPO, an individual has the right to check whether we hold his/her personal data and to require us to provide a copy of such personal data and to correct any of his/her personal data which is inaccurate.  Such requests can be made in writing using the form prescribed by PCPD (which can be downloaded from the website “www.pcpd.org.hk”) to our Data Protection Officer at the following address:

 

The Data Protection Officer

34/F Cosco Tower (High Block)

Grand Millennium Plaza

183 Queen’s Road Central

Hong Kong

4.2

When we handle a data access or correction request, we will check the identity of the requestor to ensure that he/she is legally entitled to make such request.  In this regard, we may require the requestor to provide his/her identity proof, e.g. by production of his/her Hong Kong identity card or other identification document.  In the case of a request made by a “relevant person” (as defined in the PDPO), he/she will be required to provide proof of his/her identity and the identity of the data subject concerned as well as documents showing his/her capacity as the relevant person, such as written authorisation signed by the data subject, birth certificate or court order (as the case may be).  If we cannot reasonably ascertain the identity of the data subject or establish the relationship between the requestor and the data subject, we will refuse to comply with the request.

4.3

We will respond in writing to any such request as soon as practicable and in any event no later than 40 days after receiving the request in accordance with the relevant requirements of the PDPO.

4.4

We have the right to charge a fee which is not excessive for the processing of any data access request.

5. Enquiries

Should you have any query on this Statement or wish to obtain further information on our privacy policies and practices, please contact our Data Protection Officer whose contact details are set out in paragraph 4.1 above.

6. No Limitation of Rights under PDPO

Nothing in this Statement shall limit any rights of a data subject under the PDPO.

7. Amendment of this Privacy Policy Statement

We may amend and update this Privacy Policy Statement from time to time.

 

 

The Hong Kong Mortgage Corporation Limited

August 2015