Skip to Primary Content
Alternative BannerMain Banner

Privacy Policy Statement

1. Introduction

This Statement is intended mainly to inform you of our policies and practices in relation to our handling of personal data as well as the kinds of personal data which we hold and the main purposes for which such personal data is or is to be used and to whom any data access or correction request should be addressed.

 

In this Statement, "HKMC" means The Hong Kong Mortgage Corporation Limited and the "HKMC Group" means one or more of the HKMC, its subsidiaries (including but not limited to HKMC Annuity Limited, HKMC Insurance Limited and HKMC Mortgage Management Limited) and subsidiary undertakings, as appropriate.  The terms "we", "our", "us" means one or more members of the HKMC Group in respect of its respective Programme Customers (as defined in this Statement), as the context requires.

2. Our Policy

We respect personal data privacy and it is our policy to comply with the Personal Data (Privacy) Ordinance (PDPO) and relevant codes of practice which may be issued by the Privacy Commissioner for Personal Data (PCPD) from time to time.  We will ensure that our staff complies with the policies and practices set out in this Statement and maintains appropriate standards of security and confidentiality in meeting such commitment.

3. Our Practices

3.1  For Programme Customers:

(a)Types of Personal Data held: We collect or obtain, and hold and use, personal data of persons who are interested in, apply to enjoy or who are enjoying the benefit of any of our programmes, schemes or services (Programme Customers, including the persons mentioned in paragraph 3.1(a)(ii) below) or other relevant individuals in connection with the provision of the relevant programmes and services to you (such as Mortgage Purchase Programme ("MPP"), Mortgage Insurance Programme ("MIP"), SME Financing Guarantee Scheme ("SFGS"), Reverse Mortgage Programme ("RMP"), Microfinance Scheme ("MFS"), and Premium Loan Insurance Scheme ("PLIS")) from time to time provided or operated by us (Programmes):
 (i)such personal data may, depending on the Programme concerned, include but is not limited to identification information (including names, Hong Kong Identity Card numbers or passport numbers), contact details, age, personal profile, financial information, educational and professional qualifications, credit standing, bankruptcy/debt restructuring status, information on property(ies), insurance policy(ies) and other assets held or owned as well as any information provided in the course of enquiries, processing of applications or claims, requests, complaints or feedback;
 (ii)the information referred to in paragraph 3.1(a)(i) above may include the following categories of persons who are individuals:
  a)

a Programme Customer;

  b)authorised signatory(ies), or representive(s) of a Programme Customer;
  c)

in cases where a Programme Customer is a business enterprise, authorised signatory(ies), representative(s), equity owner(s), shareholder(s), director(s) or employee(s), or equity owner(s), shareholder(s) or director(s) of its subsidiaries, related entities or related companies; and

  d)any person who intends to or is providing credit support (such as a guarantee) for any Programme Customer,
  in relation to a Programme.
 (iii)when Programme Customers access and use our website, we collect and store certain identification information which they input when using the on-line tools available on our website.  For example, the MIP Status Enquiry service requires the entry of certain information which would enable us to verify the Programme Customer's identity and provide him/her with an update on his/her application status and such identification information will be stored on our systems.
(b)Purposes of Collecting Personal Data: Personal data may be collected or obtained, held, processed and/or used by us and/or the persons set out in paragragh 3.1(c) below, to which the personal data may, depending on the Programme concerned, be disclosed and/or transferred, for the following purposes:
 (i)assessing, administering and processing the Programme application made by or involving the Programme Customer to us and/or our business counterparts (including banks, or other financial institutions, non-government organisations, other person/entities participating in the Programme to offer services or products to Programme Customers ("Programme Participants") (as the case may be) and, if approved, to comply with the terms of the Programme;
 (ii)operating a Programme including providing support (such as providing an administrative and operating platform in relation to our Programmes and/or credit support in the form of insurance cover, guarantee or otherwise) under the Programme (Support) (for example, we provide insurance cover to banks to support the reverse mortgage loans made by them to borrowers (i.e. Programme Customers) in the RMP) and acquisition of assets under a Programme;
 (iii)dealing with any loan, insurance cover or other credit support in relation to the relevant Support and/or Programme (including but not limited to re-insurance arrangements);
 (iv)conducting a credit check (where appropriate);
 (v)determining and recovering (and assisting any Programme Participant in recovering) any amount of indebtedness owed under the relevant Support and/or Programme;
 (vi)handling any request, feedback, claims, enquiries or complaints involving the Programme Customer and/or a Programme Participant (for example, personal data provided during a telephone enquiry on the telephone hotline of the Programme will be tape-recorded to enable us to check on and follow-up on the matter);
 (vii)any internal management purposes;
 (viii)in connection with any audit, checks or review of us, any Support and/or Programme;
 (ix)administering and processing any future application by the Programme Customer for any Programme;
 (x)taking recovery action in relation to any Programme involving the Programme Customer (for example, any information provided by a Programme Customer for the MIP may be used by us in the enforcement of his/her payment obligations under any mortgage loan acquired by us under the MPP);
 (xi)research or analysis purposes;
 (xii)informing the Programme Customer of any updates or changes to any of our Programmes;
 (xiii)complying with any disclosure, reporting, payment, withholding of payment, filing or notification or other similar obligation pursuant to any judicial, statutory or regulatory requirement including compliance with applicable laws, regulations and guidelines, whether of Hong Kong or any other relevant jurisdiction, which we are bound by or any failure to comply with will result in adverse consequences (sanctions, penalties, imprisonment etc.) for us or our officers and staff (for example, compliance with anti-money laundering, sanctions or anti-corruption laws);
 (xiv)comparing data of data subjects or other persons for credit checking, enforcement of claims, data verification or otherwise producing or verifying data, whether or not for the purpose of taking adverse action against the data subjects, and where such comparison amounts to a "matching procedure" under the PDPO, we shall comply with the relevant requirements under the PDPO;
 (xv)preventing, detecting and co-operating in the investigation of crime, including fraud and any form of financial crime, and analyzing and managing other commercial risks;
 (xvi)assisting and faciliating any local or foreign authorities, governmental, regulatory or judicial bodies or agencies in crime prevention, detection and investigation, and enforcement of laws;
 (xvii)verifying and comparing your personal data with the information or data from any government departments or agencies (including but not limited to The Hong Kong Housing Authority, The Hong Kong Housing Society, Social Welfare Department and Inland Revenue Department) and/or notifying, informing, disclosing and passing results of the verification and comparison and your personal data to the relevant government departments or agencies which may take action against you on the basis of the result of the data verification or comparison;
 (xviii)in connection with an actual or proposed assignment or transfer of our interests under any Programme;
 (xix)launching, improving and promoting any Programme regardless of whether the Programme Customer had applied or not (for example, dissemination of information on news, activities and events relating to a Programme); and
 (xx)using, the names, gender, date of birth, part of identity card or passport number, contact information (including but not limited to email address, telephone number and address), information about the Programmes and/or services the Programme Customer has applied or enjoyed, in carrying out direct marketing activities to him/her from time to time in relation to (i) enhancement from time to time of the relevant Programme in relation to the Programme Customer, and (ii) when programmes, products or services of the HKMC Group may be made available to the Programme Customer (in compliance with the relevant requirements of Part 6A of the PDPO); and
 (xxi)any other directly related purposes pertaining to any of the above, or other purposes agreed by the Programme Customer.
(c)Transfer/Disclosure of Personal Data: Any personal data held by us will be kept confidential but we may disclose or transfer such information to the following parties (whether within or outside Hong Kong) for or in relation to the purposes set out in paragraph 3.1(b) of this Statement:
 (i)any member of the HKMC Group (including for purposes not limited to, the direct marketing purposes set out in paragraph 3.1(b)(xx) above, in compliance with the relevant requirements of Part 6A of the PDPO);
 (ii)any Programme Participant in relation to the relevant Support and/or Programme or in relation to the recovery of any claims or amounts outstanding under any of the Programmes (as appropriate);
 (iii)a/an agent, valuer, contractor or third party service provider which provides administrative, application or claim processing, telecommunications, data analysis, processing and/or storage, due diligence, computer, payment, debt restructuring, debt recovery, financial, marketing, advertising, public relations services or facilities to any member of the HKMC Group;
 (iv)where applicable, any reinsurers (including any reinsurers of such reinsurers) of, or any entity providing financial support in relation to, the relevant Support and/or Programme;
 (v)a/an auditor, accountant, tax adviser, lawyer, consultant or other professional adviser;
 (vi)any court, tribunal, administrative, governmental or regulatory body in relation to purposes set out in paragraph 3.1(b)(xiii), (xv), (xvi), (xvii);
 (vii)person(s) with Programme Customer’s consent;
 (viii)any actual or proposed assignee or transferee of any of our interests under any Programme;
 (ix)any debt collection agencies (in the event of default under any of the Programmes involving the Programme Customer, where applicable);
 (x)any co-applicant under any Programme, and any person proposing to provide or is providing financial support for the Programme Customer’s obligations under any Programme;
 (xi)any person (such as trustee in bankruptcy, liquidator or receiver) acting on our behalf of in connection with any insolvency or other analogous proceeding (including but not limited to bankruptcy, winding-up or receivership) relating to the Programme Customer which affects any relevant Support and/or Programme (as applicable); and
 (xii)other persons as notified to the Programme Customer at the time of personal data collection.
        

 

3.2  For Job Applicants, Staff and Directors:

(a)Types of Personal Data held: We collect or obtain, hold, process and/or use the personal data of persons who are applying for employment or who are employed by us as well as our prospective and current officers and staff (including but not limited to secondees and interns).  Other records that contain personal data held by us include records of our shareholders:
 (i)such personal data may include but is not limited to identification information (including names, Hong Kong Identity Card numbers or passport numbers), contact details, age, curriculum vitae, past employment and remuneration related information, educational and professional qualifications, training records, appraisal information and references; and
 (ii)certain personal data of family members of our staff and officers who will enjoy or who are enjoying any of our staff benefits (including identification information (such as names, Hong Kong Identity Card numbers or passport numbers), age and contact details) will also be collected or obtained, and held, by us.
(b)Purpose for Collecting Personal Data: Generally, we collect or obtain, hold, process and/or use such personal data mainly for the following purposes:
 (i)considering appointment as one of our officers or staff;
 (ii)recruitment, supervision, training and human resources management;
 (iii)determining and reviewing salaries, bonuses and other benefits;
 (iv)consideration for promotion, training, secondment or transfer;
 (v)administration of staff benefits and entitlements;
 (vi)providing staff references;
 (vii)mandatory provident fund schemes (MPF) and occupational retirement schemes (ORSO) participation;
 (viii)staff disciplinary matters;
 (ix)application, registration, waiver(s) or exemption(s) in relation to any licence, approval or registration required to carry out duties;
 (x)support of our development;
 (xi)complying with any disclosure, reporting, filing or notification or other similar obligation pursuant to any judicial, statutory or regulatory requirement including compliance with applicable laws, regulations and guidelines, whether of Hong Kong or any other relevant jurisdiction, which we are bound by or any failure to comply with will result in adverse consequences (sanctions, penalties, imprisonment etc.) for us or our officers and staff; and
 (xii)monitoring and taking action in relation to compliance with legal, regulatory and internal policy requirements.
(c)Transfer/Disclosure of Personal Data: Such personal data held by us will be kept confidential but we may disclose or transfer such information to the following parties (whether within or outside Hong Kong) for the purposes set out in paragraph 3.2(b) above:
 (i)any insurance broker and insurance company;
 (ii)any bank in relation to remuneration arrangements;
 (iii)any bank, fund, professional investor, broker and arranger in relation to MPF and ORSO arrangements;
 (iv)any service provider (such as payroll administrators) providing administrative or other support services for staff matters and/or us;
 (v)a/an auditor, accountant, tax adviser, lawyer, consultant or other professional advisor;
 (vi)any court, tribunal, administrative, governmental or regulatory body in relation to the purposes set out in paragraph 3.2(b)(xi) above;
 (vii)any person with the data subject’s consent (including any potential future employer); and
 (viii)other persons as notified to the data subject at the time of personal data collection.

 

3.3  For Business Counterparts:

(a)Types of Personal Data held: We collect or obtain, hold, process and use the personal data of persons who serve as officers, agents or representatives of the Programme Participants (for example, mentors in our microfinance scheme) as well as potential and actual vendors/suppliers of goods, services and support to us (Business Contacts).  Such personal data may include but is not limited to identification information, contact details, information as regards Business Contact’s official capacity and employment status.
(b)Purpose for Collecting Personal Data: Generally, we hold, process and use Business Contacts’ personal data mainly for the following purposes:
 (i)managing our business relationships;
 (ii)communicating on business, administrative, logistical and/or promotional arrangements in relation to Programmes and/or Support;
 (iii)communicating on quotations or bids for goods or services;
 (iv)liaising on goods, services and/or support contracted for or agreed upon;
 (v)complying with obligations and enforcing rights under terms of contracts or arrangements we are a party to;
 (vi)handling any feedback, claims, enquiries or complaints;
 (vii)ascertaining authority for execution of legal documents; and
 (viii)complying with any disclosure, reporting, filing or notification or other similar obligation pursuant to any judicial, statutory or regulatory requirement including compliance with applicable laws, regulations and guidelines, whether of Hong Kong or any other relevant jurisdiction, which we are bound by or any failure to comply with will result in adverse consequences (sanctions, penalties, imprisonment etc.) for us or our officers and staff.
(c)Transfer/Disclosure of Personal Data: Business Contacts’ personal data held by us will be kept confidential but we may disclose or transfer such information to the following parties (whether within or outside Hong Kong) for the purposes set out in paragraph 3.3(b) above:
 (i)a/an auditor, accountant, tax adviser, lawyer, consultants or other professional advisor;
 (ii)any service providers (such as technical experts, due diligence service providers etc.) providing technical and other expert advice and services including advice on any quotation for goods and/or services;
 (iii)any non-governmental organisations providing community, educational and charitable services;
 (iv)other Programme Participants; and
 (v)any court, tribunal, administrative, governmental or regulatory body in relation to the purposes set out in paragraph 3.3(b)(viii) above.

 

3.4  Accuracy and Retention of Personal Data

We have certain procedures in place to maintain, so far as is reasonably practicable, the accuracy, completeness and relevance of the personal data used by us in relation to the purposes for which the data is used.  We aim to keep the personal data on our records accurate and up-to-date.  However, we rely primarily on the data subject to disclose all material information to the Programme Participant(s) (which will update us) or us, as appropriate, and to inform the Programme Participant(s) and/or us of any inaccuracy or changes in such information.
We maintain and execute retention policies of records containing personal data to ensure that such personal data is not kept longer than necessary for the fulfilment of the purposes for which it is or is to be used.  Different retention periods apply to the various kinds of personal data collected or obtained and held by us in accordance with our internal policies on retention of personal data, and also as prescribed or permitted by applicable laws and regulations.
Should you have any query on this Statement, please do not hesitate to contact our Data Protection Officer whose contact details are set out in paragraph 4.1 below.

 

3.5  Security of Personal Data

We take appropriate steps to protect the personal data we hold against unauthorised or accidental access, processing, erasure, loss or use of the personal data. These steps include restricting physical and electronic access to personal data on a “need-to-know” and “need-to-use” basis, and having in place internal security policies and practices which require our staff to comply with the requirements of the PDPO. We also provide relevant training, including induction and on-going training, to staff to handle personal data properly.

 

3.6  Outsourcing Arrangements

Our internal Information Technology (IT) systems are developed and maintained by our in-house staff and local third party service provider(s).  The third party service provider(s) do not have access to personal data stored in our IT system except when it is carrying out maintenance/checking/trouble shooting supervised by our IT staff.  Where we engage external third party to handle or process information, we use contractual or other reasonably practicable steps to prevent unauthorised or accidental access, processing, erasure, loss or use of any personal data and, where applicable, require such third party data processor not to keep the relevant data longer than is necessary for processing of the data.

4. Data Access Request and Data Correction

4.1

In accordance with the PDPO, an individual has the right to check whether we hold his/her personal data and to require us to provide a copy of such personal data and to correct any of his/her personal data which is inaccurate.  Such requests can be made in writing using the form prescribed by the PCPD (which can be downloaded from the website www.pcpd.org.hk) to our Data Protection Officer at the following address:

 

The Data Protection Officer

34/F Cosco Tower (High Block)

Grand Millennium Plaza

183 Queen’s Road Central

Hong Kong

4.2

When we handle a data access or correction request, we will check the identity of the requestor to ensure that he/she is legally entitled to make such request.  In this regard, we may require the requestor to provide his/her identity proof, e.g. by production of his/her Hong Kong Identity Card or other identification document.  In the case of a request made by a "relevant person" (as defined in the PDPO), he/she will be required to provide proof of his/her identity and the identity of the data subject concerned as well as documents showing his/her capacity as the relevant person, such as written authorisation signed by the data subject, birth certificate or court order (as the case may be).  If we cannot reasonably ascertain the identity of the data subject or establish the relationship between the requestor and the data subject, we will refuse to comply with the request.

4.3

We will respond in writing to any such request as soon as practicable and in any event no later than 40 days after receiving the request in accordance with the relevant requirements of the PDPO.

4.4

We have the right to charge a fee which is not excessive for the processing of any data access request.

5. Enquiries

Should you have any query on this Statement or wish to obtain further information on our privacy policies and practices, please contact our Data Protection Officer whose contact details are set out in paragraph 4.1 above.

6. No Limitation of Rights under PDPO

Nothing in this Statement shall limit any rights of a data subject under the PDPO.

7. Amendment of this Privacy Policy Statement

We may amend and update this Statement from time to time.

 

 

The Hong Kong Mortgage Corporation Limited

May 2018