Personal Data Privacy Ordinance

The Hongkong and Shanghai Banking Corporation Limited (“we”, “us”, “our”, including our successors and assigns)
Notice to Customers relating to the Personal Data (Privacy) Ordinance (the “Ordinance”)

a. We may collect the data of customers and other individuals in connection with the purposes set out in this Notice. These customers and other individuals may include the following or any of them (collectively “you”, “your”):

• applicants for banking or financial services;
• persons giving or proposing to give guarantees or security for obligations owed to us; and
• other persons who are relevant to a customer’s relationship with us, including third party service providers with whom the customer interacts in connection with the marketing of our products and services and in connection with the customer’s application for our products and services (including credit references agencies approved for participation in the Multiple Credit Reference Agencies Model (hereinafter referred to as “credit reference agencies” or “CRAs”)).

b. If the data requested by us is not provided, we may be unable to provide (or continue to provide) products or services to you or to the relevant customer or applicant linked to you or comply with any laws or guidelines issued by regulatory or other authorities.

c. We may collect your data in the ordinary course of the continuation of the banking relationship. This includes information obtained from credit reference agencies.

d. We will use data for the following purposes or any of them (which may vary depending on the nature of your relationship with us):

1. the daily operation of products and services (including credit facilities provided to you or the relevant customer linked to you);
2. conducting credit checks whenever appropriate (including upon an application for consumer credit (including mortgage loans) and when we review credit which normally takes place one or more times each year);
3. creating and maintaining our credit and risk related models;
4. assisting other credit providers in Hong Kong approved for participation in the Multiple Credit Reference Agencies Model (hereinafter referred to as “credit providers”) to conduct credit checks and collect debts;
5. ensuring your ongoing credit worthiness and good standing;
6. designing financial products and services (including insurance, credit card, securities, commodities, investment, banking and related products and services) for your use;
7. marketing products, services and other subjects as described in paragraph (f) below;
8. determining the amount of indebtedness owed to or by you;
9. exercising our rights under contracts with you, including collecting amounts outstanding from you;
10. meeting the requirements to make disclosure under the requirements of any law binding on us or any of our branches (e.g. the Inland Revenue Ordinance and its provisions including those concerning automatic exchange of financial account information) or under and for the purposes of any guidelines issued by regulatory or other authorities with which we or any of our branches are expected to comply (e.g. guidelines issued by the Inland Revenue Department including those concerning automatic exchange of financial account information);
11. enabling actual or proposed assignee(s) of all or any part of our business and/or assets, or participant(s) or sub-participant(s) of our rights in respect of you to evaluate the transaction intended to be the subject of the assignment, participation or sub-participation and enabling the actual assignee(s) to use your data in the operation of the business or rights assigned; and
12. any other purposes relating to the purposes listed above.

e. Data held by us will be kept confidential but we may provide data to the following parties or any of them (whether within or outside the Hong Kong Special Administrative Region (“Hong Kong”)) for the purposes set out in paragraph (d) above:

1. any of our agents or contractors;
2. any third party service providers who provide services to us in connection with the operation or maintenance of our business;
3. any persons under a duty of confidentiality to us which have undertaken to keep such data confidential;
4. the drawee bank providing a copy of a paid cheque (which may contain data about the payee) to the drawer;
5. any person making any payment into your account (by providing a deposit confirmation which may contain your name);
6. credit reference agencies (including the operator of any centralized database used by credit reference agencies), and, in the event of default, to debt collection agencies
7. any persons to whom we are or any of our branches is under an obligation or required or expected to make disclosure for the purposes set out in, or in connection with, paragraph (d)(x) above;
8. any actual or proposed assignee(s) of ours or participant(s) or sub-participant(s) or transferee(s) of our rights in respect of you;
9. any persons giving or proposing to give a guarantee or security to guarantee or secure your obligations to us; and
10. 1. any member of the HSBC Group (“HSBC Group” and any “member of the HSBC Group” means HSBC Holdings plc and/or its affiliates, subsidiaries, associated entities and any of their branches and offices);
    2. third party financial institutions, insurers, credit card companies, securities and investment services providers;
    3. third party reward, loyalty, co-branding and privileges programme providers;
    4. co-branding partners of ours or any member of the HSBC Group (the names of such co-branding partners will be provided during the application process for the relevant products and services, as the case may be);
    5. charitable or non-profit making organisations; and
    6. external service providers that we or any member of the HSBC Group engage(s) for the purposes set out in paragraph (d)(vii) above.

Such data may be transferred in and to a place outside Hong Kong.

A. We may provide the following data relating to you (whether in sole name or joint names with others) to CRAs:

1. full name;
2. capacity in respect of each mortgage (as borrower, mortgagor or guarantor);
3. Hong Kong Identity Card Number or travel document number or certificate of incorporation number;
4. date of birth or date of incorporation;
5. correspondence address;
6. mortgage account number in respect of each mortgage;
7. type of the facility in respect of each mortgage;
8. mortgage account status in respect of each mortgage (e.g. active, closed, write-off); and
9. if any, mortgage account closed date in respect of each mortgage.

CRAs will use the above data for the purposes of compiling a count of the number of mortgages from time to time held by you (as borrower, mortgagor or guarantor, whether in sole name or joint names with others) with credit providers for sharing in the consumer credit databases of CRAs by credit providers.

B. You can instruct us to make a request to the relevant CRA to delete from its database any account data relating to any credit that has been terminated by full repayment provided that there has not been, within five (5) years immediately before such termination, a default in payment under the credit for a period in excess of sixty (60) days according to our records.

C. If there is any default in payment, unless the amount in default is fully repaid or written off (other than due to bankruptcy order) before the expiry of sixty (60) days from the date of default, your account repayment data may be retained by CRAs until the expiry of five (5) years from the date of final settlement of the amount in default.

D. In the event of any amount being written off due to a bankruptcy order being made against you, CRAs may retain your account repayment data until the earlier of (i) the expiry of five (5) years from the date of final settlement of the amount in default, or (ii) the expiry of five (5) years from the date of your discharge from bankruptcy as notified to CRA(s) by you with evidence.

E. For the purposes of paragraphs C and D above, account repayment data are the amount last due, amount of payment made during the last reporting period, remaining available credit or outstanding balance and default data (being amount past due and number of days past due, date of settlement of amount past due, and date of final settlement of amount in material default (that is, default in payment for a period in excess of sixty (60) days) (if any)).

f. Where you are a customer, we intend to use your data in direct marketing and we require your consent (which includes an indication of no objection) for that purpose. Please note that:

1. your name, contact details, products and other service portfolio information, transaction pattern and behavior, financial background and demographic data held by us from time to time may be used by us in direct marketing;
2. the following classes of products, services and subjects may be marketed:
   1. financial, insurance, credit card, banking and related products and services;
   2. reward, loyalty, co-branding or privileges programmes and related products and services;
   3. productsand services offered by our co-branding partners (the names of such co-branding partners will be provided during the application for the relevant products and services, as the case may be); and
   4. donations and contributions for charitable and/or non-profit making purposes;
3. the above products, services and subjects may be provided by or (in the case of donations and contributions) solicited by us and/or:
   1. any member of the HSBC Group;
   2. third party financial institutions, insurers, credit card companies, securities and investment services providers;
   3. third party reward, loyalty, co-branding or privileges programme providers;
   4. co-branding partners of ours or any member of the HSBC Group (the names of such co-branding partners will be provided during the application of the relevant products and services, as the case may be); and
   5. charitable or non-profit making organisations;
4. in addition to marketing the above products, services and subjects ourselves, we may provide the data described in paragraph (f)(i) above to all or any of the persons described in paragraph (f)(iii) above for use by them in marketing those products, services and subjects, and we require your written consent (which includes an indication of no objection) for that purpose; and
5. we may receive money or other property in return for providing the data to the other persons in paragraph (f)(iv) above and, when requesting your consent or no objection as described in paragraph (f)(iv) above, we will inform you if we will receive any money or other property in return for providing the data to the other persons.

If you do not wish us to use or provide to other persons your data for use in direct marketing as described above, you may exercise your opt-out right by notifying us.

g. We may, in accordance with your instructions to us or third party service providers engaged by you, transfer your data to third party service providers using our API for the purposes notified to you by us or third party service providers and/or as consented to by you in accordance with the Ordinance.

h. You have the right:

1. to check whether we hold data about you and to access such data;
2. to require us to correct any data relating to you which is inaccurate;
3. ascertain our policies and practices in relation to data and to be informed of the kind of data held by us; and
4. in relation to consumer credit, to be informed on request which items of data are routinely disclosed to credit reference agencies or debt collection agencies, and be provided with further information to enable the making of access and correction requests to the relevant credit reference agency(ies) or debt collection agency(ies).

i. In accordance with the provisions of the Ordinance, we have the right to charge a reasonable fee for the processing of any data access request.

j. You should send requests for access to data or correction of data or for information regarding policies and practices and kinds of data held to: The Data Protection Officer
The Hongkong and Shanghai Banking Corporation Limited
PO Box 72677
Kowloon Central Post Office
Hong Kong
E-mail: dfv.enquiry@hsbc.com.hk

k. We may have obtained credit report(s) on you from credit reference agency(ies) in considering any application for credit. In the event you wish to access the credit report(s), we will advise the contact details of the relevant credit reference agency(ies).

l. Nothing in this Notice shall limit your rights as a data subject under the Ordinance.