Skip to Primary Content
Alternative BannerMain Banner

The Hong Kong Mortgage Corporation Limited

Privacy Policy Statement

1. Introduction

In this Statement, unless the context does not permit or otherwise requires,

 

Company, we, our and us mean the company named in the document collecting the relevant data (which is a member of the HKMC Group) and its successors and assigns;

 

Data Subject, in relation to personal data, means the individual who is the subject of the personal data; and

 

HKMC Group means The Hong Kong Mortgage Corporation Limited, its subsidiaries and subsidiary undertakings.

 

This Statement is intended mainly to inform you of our policies and practices in relation to our handling of personal data as well as the kinds of personal data which we hold and the main purposes for which such personal data is or is to be used and to whom any data access or correction request should be addressed.

2. Our Policy

We respect personal data privacy and it is our policy to comply with the Personal Data (Privacy) Ordinance (PDPO), relevant codes of practice which may be issued by the Privacy Commissioner for Personal Data (PCPD) from time to time and other applicable data protection laws and regulations. We will ensure that our staff members comply with the policies and practices set out in this Statement and maintain appropriate standards of security and confidentiality in meeting such commitment.

3. Our Practices

Paragraph 3.1 below does not apply to our Infrastructure Financing and Securitisation Business. Please refer to paragraph 3.4 below for details.

 

3.1  Customers 

(a)Types of Personal Data Held: In relation to our products/services/events (including their amendments and enhancements as may be effected from time to time) relating to our financing, loans and loans acquisition, retirement planning, insurance and credit support businesses (such as our mortgage purchase programme, mortgage insurance programme, reverse mortgage programme, SME financing guarantee scheme and policy reverse mortgage programme) from time to time provided or operated by us (Services), we collect or obtain, hold and use personal data of various categories of individuals:
 (i)Such personal data may, depending on the Service concerned, include but is not limited to identification information (including names, Hong Kong Identity Card numbers or passport numbers), contact details, address, age, date of birth, place of birth, jurisdiction(s) of tax residence, tax identification number in that/those jurisdiction(s), gender, relationship with other Data Subjects, personal profile, financial information, health condition, medical history, medical diagnosis treatment and expenses, bank account information, employment and remuneration information, educational and professional qualifications, credit standing, bankruptcy/debt restructuring status, information on property(ies), insurance policy(ies) and other assets held or owned as well as any information provided in the course of applications, requests, enquiries, complaints or feedback; and
 (ii)such categories of individuals include but are not limited to:
  (1)

existing and prospective applicants, borrowers or customers/users (including policyowner(s), claimant(s), beneficiary(ies) and/or insured(s)) under or in connection with a Service;

  (2)shareholders, directors, controlling persons, officers and managers of a corporate applicant, borrower or customer/user and its subsidiaries and related entities;
  (3)

partners or members of a partnership, or representatives, agents, attorneys or nominees of an applicant, borrower or customer/user; and

  (4)other relevant individuals of any Service such as sureties and persons providing financial or credit support for/to a customer or borrower, any person who is a joint bank account holder with a customer or borrower where such bank account is or will be used to make or receive payments, and individuals providing supporting services, in relation to or under a Service.
(b)

How We Use the Personal Data: The purposes for which personal data of a Data Subject may be used will vary depending on the circumstances and context of its collection, but the purposes perceived by us will include the following:

 (i)administering, maintaining and operating our Services;
 (ii)processing and evaluating any applications, requests, enquiries or complaints involving the Data Subject relating to our Services;
 (iii)providing subsequent or ongoing services in relation to our Services involving the Data Subject, including but not limited to providing information, administering the policies or guarantees issued or the loans or credit supports granted;
 (iv)any purposes in connection with any claim or requests made by or against or otherwise involving the Data Subject in respect of our Services, including the related verification and investigation work;
 (v)detecting, investigating and preventing fraud, crime, wrongdoing or irregularity;
 (vi)facilitating design of products/services/events of any members of the HKMC Group;
 (vii)conducting research and maintaining databases for marketing, statistical, actuarial, product development or other purposes;
 (viii)matching any personal data held which relates to the Data Subject from time to time for any of the purposes listed herein and verifying data or information provided by any third party;
 (ix)creating and maintaining Data Subject profile and segregation and business model and performing risk management;
 (x)evaluating any future application by or involving the Data Subject in relation to our Services;
 (xi)registering Data Subjects and administering the provision of Services through telecommunications or online channels, or mobile applications;
 (xii)conducting underwriting, identity and credit checks and debt collection;
 (xiii)offering, providing and marketing to the Data Subject the Services of the Company, other members of the HKMC Group or our business partners (see “Use and Provision of Personal Data in Direct Marketing” section below);
 (xiv)carrying out business co-operation with the Data Subject (including referral or other modes of co-operation);
 (xv)sending to the Data Subject newsletters and printed materials about educational, recreational or other events of any member of the HKMC Group;
 (xvi)providing benefit to the Data Subject for relationship management purposes;
 (xvii)making disclosures as required by any applicable law, rules, regulations, codes of practice or guidelines or for assisting law enforcement purposes, investigations by police or other government or regulatory authorities in Hong Kong or elsewhere;
 (xviii)complying with the laws, regulatory requirements and any other rules, guidelines or orders of any applicable jurisdiction which we are expected to or would normally comply with;
 (xix)complying with any obligations, requirements, policies, procedures, measures or arrangements for sharing personal data and information within the HKMC Group and/or any other use of personal data and information for compliance with sanctions or prevention or detection of money laundering, terrorist financing or other unlawful or prohibited activities or conduct;
 (xx)enabling an actual or potential assignee of us, or participant or sub-participant of our rights in respect of a Data Subject to evaluate the transaction intended to be the subject of the assignment, participation or sub-participation; and
 (xxi)purposes directly relating to any of the above.
(c)Disclosing the Personal Data: Personal data will be kept confidential but, subject to the provisions of any applicable law, may be provided to the following parties (within or outside Hong Kong) for the purposes outlined in paragraph 3.1(b) above:
 (i)any member of the HKMC Group;
 (ii)any broker, referrer or introducer of the Data Subject in Hong Kong or elsewhere;
 (iii)any co-applicant or co-borrower, and any person proposing to provide or providing any financial or credit support in relation to a Data Subject’s obligations in connection with our Services;
 (iv)any business partner which has participated in programmes operated by any member of the HKMC Group in relation to our Services;
 (v)any person in connection with any claims made by or against or otherwise involving the Data Subject in respect of any Services provided by the Company or any member of the HKMC Group;
 (vi)any agent, contractor or third party, which provides administrative, audit, data-processing, document management, technology, telecommunication, storage, payment or other services (including direct marketing services) to any member of the HKMC Group in Hong Kong or elsewhere under a duty of confidentiality to the same;
 (vii)where applicable, any insurer or reinsurer (including any re-reinsurers of such reinsurer) of, or any entity providing financial support in relation to our Services;
 (viii)any valuer, medical service provider or a provider of products or services which is, or will be paid by funds drawn from the Services;
 (ix)credit reference agencies or, in the event of default, debt collection agencies;
 (x)any agent, auditor, accountant, tax adviser, lawyer, consultant or other professional adviser;
 (xi)any court, tribunal or administrative, governmental or regulatory body or enforcement agency in Hong Kong or elsewhere (including local or foreign tax authorities); and
 (xii)any actual or potential assignee, transferee, participant or sub-participant of our rights or business.
(d)Use and Provision of Personal Data in Direct Marketing
 (i)We intend to:
  (1)use the names, contact details, Services portfolio information, transaction pattern and behaviour, financial, employment or other background and demographic data of a Data Subject held by us from time to time for direct marketing and we cannot use such data unless we have received the Data Subject’s consent or indication of no objection; and
  (2)

conduct direct marketing in relation to the following classes of products/services/events:

 

  • insurance, financial services, retirement planning and related products/services/events; and

 

  • reward, loyalty, co-branding or privilege programmes, and related products/services/events.
 (ii)The above products/services/events may be provided or solicited by us and/or:
  (1)any member of the HKMC Group;
  (2)third-party financial institutions and insurers; and
  (3)third-party reward, loyalty, co-branding or privilege programme providers or operators.
 (iii)In addition to marketing the above products/services/events, we may provide a Data Subject’s information described in paragraph 3.1(d)(i)(1) to all or any of the persons described in paragraph 3.1(d)(ii) above for use by them in marketing those products/services/events, and we require the Data Subject’s written consent (which includes an indication of no objection) for that purpose.
 If a Data Subject does not wish us to use or provide to other persons his/her personal data for use in direct marketing as described above, the Data Subject may exercise his/her opt-out right by notifying us.

 

3.2  Job Applicants, Staff and Directors

(a)Types of Personal Data Held: We collect or obtain, and hold, the personal data of persons who are (1) applying for employment, (2) employed or appointed by, or seconded to us as one of our officers or staff, (3) hired or engaged to provide services to us under any contract or form of arrangement other than employment, appointment or secondment, (4) our prospective and current officers and staff (including secondees and interns) and (5) no longer our officers and staff (including secondees and interns). Other records that contain personal data held by us include records of our shareholders:
 (i)such personal data may include but is not limited to identification information (including names, Hong Kong Identity Card numbers or passport numbers), biometric data (e.g. fingerprint), age, contact details, curriculum vitae, past employment and remuneration related information, educational and professional qualifications, training records, appraisal information and references; and
 (ii)certain personal data of family members of our staff and officers who will enjoy or who are enjoying any of our staff benefits (including identification information (such as names, Hong Kong Identity Card numbers or passport numbers), age and contact details) will also be collected or obtained, and held, by us.
(b)How We Use the Personal Data: Generally, we hold and use such personal data mainly for the following purposes:
 (i)consideration of employment, appointment or secondment as one of our officers or staff;
 (ii)consideration of hiring or engagement to provide services to us as one of our staff under any contract or form of arrangement other than employment, appointment or secondment;
 (iii)recruitment, staff supervision, training and human resources management;
 (iv)determination and review of salaries, bonuses and other benefits;
 (v)consideration for and facilitating appraisals, promotion, career development, staff planning, training, secondment or transfer;
 (vi)administration of staff benefits, compensation, payroll and entitlements;
 (vii)provision of staff references;
 (viii)administration of the mandatory provident fund schemes (MPF) and occupational retirement schemes (ORSO);
 (ix)making tax returns;
 (x)staff disciplinary matters;
 (xi)review of decision on employment, appointment, secondment or hiring or engagement under any contract or other form of arrangement;
 (xii)application, registration, waiver(s) or exemption(s) in relation to any licence, approval or registration required to carry out duties;
 (xiii)support of our development;
 (xiv)compliance with any disclosure, reporting, filing or notification or other similar obligation pursuant to any judicial, statutory or regulatory requirement including compliance with applicable laws, regulations and guidelines, whether of Hong Kong or any other relevant jurisdiction, which we are bound by or any failure to comply with will result in adverse consequences (sanctions, penalties, imprisonment etc.) for us or our officers and staff;
 (xv)conducting user authentication on the systems or devices (e.g. Windows operating systems) and providing access to authorized resources for selected users; and
 (xvi)monitoring and taking action in relation to compliance with legal, regulatory and internal policy requirements.
(c)Disclosing the Personal Data: Such personal data held by us will be kept confidential but we may disclose or transfer such information to the following parties (whether within or outside Hong Kong) for the purposes set out in paragraph 3.2(b) above:
 (i)any member of the HKMC Group for which you may be seconded or which you may be assigned to provide any services;
 (ii)any insurance broker and insurance company;
 (iii)any bank in relation to remuneration arrangements;
 (iv)any bank, fund, professional investor, broker and arranger in relation to MPF and ORSO arrangements;
 (v)any service provider (such as payroll administrators) providing administrative or other support services for staff matters and/or us;
 (vi)a/an auditor, accountant, tax adviser, lawyer, consultant or other professional advisor;
 (vii)any court, tribunal, administrative, governmental or regulatory body or enforcement agency in relation to the purposes set out in paragraphs 3.2(b)(xiv) and (xvi) above; and
 (viii)any person with the Data Subject’s consent (including any potential future employer).

 

3.3  Business Counterparts

(a)Types of Personal Data Held: We collect or obtain, and hold, the personal data of persons who serve as officers, agents or representatives of the Service Participants, potential and actual vendors/suppliers of goods, services and support to us and potential and actual business counterparts (Business Contacts). Such personal data may include but is not limited to identification information, contact details, information as regards Business Contact’s official capacity and employment status.
(b)How We Use the Personal Data: Generally, we hold and use Business Contacts’ personal data mainly for the following purposes:
 (i)managing our business relationships;
 (ii)communicating on business, administrative, logistical and/or promotional arrangements in relation to Services and/or any function and activity related thereto;
 (iii)communicating on quotations or bids for goods or services;
 (iv)liaising on goods, services and/or support contracted for or agreed upon;
 (v)complying with obligations and enforcing rights under terms of contracts or arrangements we are a party to;
 (vi)handling any feedback, requests, claims, enquiries or complaints;
 (vii)ascertaining authority for execution of legal documents; and
 

(viii)

complying with any disclosure, reporting, filing or notification or other similar obligation pursuant to any judicial, statutory or regulatory requirement including compliance with applicable laws, regulations and guidelines, whether of Hong Kong or any other relevant jurisdiction, which we are bound by or any failure to comply with will result in adverse consequences (sanctions, penalties, imprisonment etc.) for us or our officers and staff.
(c)Disclosing the Personal Data: Business Contacts’ personal data held by us will be kept confidential but we may disclose or transfer such information to the following parties (whether within or outside Hong Kong) for the purposes set out in paragraph 3.3(b) above:
 (i)a/an auditor, accountant, tax adviser, lawyer, consultants or other professional advisor;
 

(ii)

any service providers (such as technical experts, due diligence service providers etc.) providing technical and other expert advice and services including advice on any quotation for goods and/or services;
 

(iii)

any non-governmental organisations providing community, educational or charitable services;
 (iv)other Service Participants; and
 

(v)

any court, tribunal, administrative, governmental or regulatory body in relation to the purposes set out in paragraph 3.3(b)(viii) above.

 

3.4  Infrastructure Financing and Securitisation Business

In relation to the infrastructure financing and securitisation business and related programmes, services and products from time to time provided or operated by us in connection with such business (IFS Business), we may collect or obtain, hold and use personal information of various categories of individuals.
For further details about our collection, processing, use, disclosure, correction and/or erasure of such personal information (including in relation to individuals located in the European Economic Area or the United Kingdom), please refer to the “Personal Information Collection Statement for the IFS Business of the HKMC”, which is available on our website at “www.hkmc.com.hk”.

 

3.5  Use of Cookies

We may use cookies and/or similar tracking technologies (Cookies) to store and track information about the users of any mobile application from time to time operated by us (App). Cookies are small data files which are placed on the users’ mobile device when they use or access our App. Cookies enable our App to remember the users and their preferences when they use or access the App. The information collected by Cookies may include information of the users’ mobile device, browser details, IP addresses, and their behavioural and usage patterns.
We may use Cookies to enhance user experience of our App, including by monitoring and analysing the effectiveness of our App, tailoring the content of our App to suit users’ interests, and providing the users with customised advertising or promotional materials.

 

3.6  Accuracy and Retention of Personal Data

We have certain procedures in place to maintain, so far as is reasonably practicable, the accuracy, completeness and relevance of the personal data held by us in relation to the purposes for which the data is used. We aim to keep the personal data accurate and updated. However, we rely primarily on the relevant Data Subject to disclose all material information to the Service Participant(s) (which will update us) or us, as appropriate, and to inform the Service Participant(s) and/or us of any inaccuracy or changes in such information.
We maintain and execute retention policies of records containing personal data to ensure that such personal data is not kept longer than necessary for the fulfilment of the purposes for which it is or is to be used. Different retention periods apply to the various kinds of personal data collected or obtained and held by us in accordance with our internal policies on retention of personal data, and also as prescribed or permitted by applicable laws and regulations.
For further details, please contact our Data Protection Officer or Contact whose contact details are set out in paragraph 4.1 below.

 

3.7  Security of Personal Data

We take appropriate steps to protect the personal data we hold against unauthorised or accidental access, processing, erasure, loss or use of the personal data. These steps include restricting physical and electronic access to personal data on a “need-to-know” and “need-to-use” basis, and having in place internal security policies and practices which require our staff to comply with the requirements of the PDPO and other applicable laws and regulations. We also provide relevant training, including induction and on-going training, to staff to handle personal data properly.

 

3.8  Outsourcing Arrangements

Our internal IT systems are developed and maintained by our in-house staff and local third party service provider(s). The third party service provider(s) do not have access to personal data stored in our IT system except when it is carrying out maintenance/checking/trouble shooting supervised by our IT staff. Where we engage external third party to handle or process information, we use contractual or other reasonably practicable steps to prevent unauthorised or accidental access, processing, erasure, loss or use of any personal data and, where applicable, require such third party data processor not to keep the relevant data longer than is necessary for processing of the data.

4. Data Access Request and Data Correction

4.1

A Data Subject may request access to or correction of his/her personal data by making a request in writing to our Data Protection Officer at 19/F, Two Harbour Square, No. 180 Wai Yip Street, Kwun Tong, Kowloon, Hong Kong.

 

Data Subjects located in the European Economic Area or the United Kingdom and involved in the IFS Business transactions may have additional rights under relevant laws and regulations and may write to our Data Protection Contact as specified in the “Personal Information Collection Statement for the IFS Business of the HKMC” for exercising their rights.

4.2

We may charge a fee which is not excessive for processing any data access request, to the extent permitted pursuant to applicable laws or regulations.

5. Enquiries

Should you have any query on this Statement or wish to obtain further information on our privacy policies and practices, please contact our Data Protection Officer or Contact whose contact details are set out in paragraph 4.1 above.

6. No Limitation of Rights

Nothing in this Statement shall limit any rights of a Data Subject under the PDPO and other applicable laws and regulations.

7. Amendment of this Privacy Policy Statement

This Statement may from time to time be revised or updated by us.

 

 

 

 

The Hong Kong Mortgage Corporation Limited

April 2022

 

Important Notice

1) Personal Information Collection Statement (May 2021)
Download PDFDownload PDF
2) Privacy Policies, Notices and Statements - IFS Business (Apr 2022)
Download PDFDownload PDF