1. From time to time, it is necessary for data subjects to supply the Bank with data in connection with matters such as:-
   1. 1. the opening or operation of accounts,
      2. the establishment or maintenance of facilities; and/or
      3. the establishment or operation or provision of products or services offered by or through the Bank (which include banking, cards, financial, insurance, fiduciary, securities and/or investments products and services as well as products and services relating to these); (collectively, Facilities, Products and Services), and/or
   2. the receipt of supplies and services to the Bank.
2. Failure to supply such data may result in the Bank being unable to establish, maintain or provide Facilities, Products and Services to data subjects.
3. It is also the case that data are collected, directly or indirectly, by the Bank from data subjects transacting with or through the Bank in the ordinary course of the Bank’s business, including (without limitation) information received from third parties, the public domain, collected through use of the websites, cookies and electronic banking services of the Standard Chartered Group, and/ or when data subjects write cheques or deposit money or effect transactions through cards.
4. Data relating to a data subject may be used for any one or more of the following purposes:-
   1. processing applications from the data subject (including assessing the merits and/or suitability of the data subject’s application(s)) for the establishment of Facilities, Products and Services;
   2. operating, maintaining and providing Facilities, Products and Services to the data subject, including to enable the Bank or any member of the Standard Chartered Group to fulfil any contract for Facilities, Products and/ or Services that a data subject has requested and/or to understand the overall picture of the relationship of a data subject with the Standard Chartered Group by linking data in respect of all accounts such data subject is connected to;
   3. conducting credit checks on the data subject (whether in respect of an application for Facilities, Products and Services or during regular or special review which normally will take place once or more each year);
   4. creating and maintaining the Bank’s credit scoring models;
   5. maintaining credit history of the data subject for present and future reference;
   6. assisting other financial institutions to conduct credit checks and collect debts;
   7. ensuring ongoing credit worthiness of the data subject;
   8. designing banking, cards , financial, insurance, securities and investment services or related products for data subject’s use;
   9. marketing services, products and other subjects (please see further details in paragraph (g) below);
   10. determining the amount of indebtedness owed to or by data subjects;
   11. enforcement of data subjects’ obligations, to the Bank or any other member of the Standard Chartered Group, including but not limited to the collection of amounts outstanding from data subjects and those providing security for data subjects’ obligations;
   12. meeting or complying with any obligations, requirements or arrangements for disclosing and using data that apply to the Bank or any other member of the Standard Chartered Group or that it is expected to comply according to:-
       1. any law or regulation binding on or applying to it within or outside Hong Kong existing currently and in the future (e.g. the Inland Revenue Ordinance and its provisions including those concerning automatic exchange of financial account information);
       2. any guidelines or guidance given or issued by any legal, regulatory, governmental, tax, law enforcement or other authorities, or self-regulatory or industry bodies or associations of financial services providers within or outside Hong Kong existing currently and in the future (e.g. guidelines or guidance given or issued by the Inland Revenue Department including those concerning automatic exchange of financial account information);
       3. any present or future contractual or other commitment with local or foreign legal, regulatory, governmental, tax, law enforcement or other authorities, or self-regulatory or industry bodies or associations of financial services providers that is assumed by or imposed on the Bank or any member of the Standard Chartered Group by reason of its financial, commercial, business or other interests or activities in or related to the jurisdiction of the relevant local or foreign legal, regulatory, governmental, tax, law enforcement or other authority, or self-regulatory or industry bodies or associations;
   13. meeting or complying with any obligations, requirements, policies, procedures, measures or arrangements for sharing data and information within the Standard Chartered Group and/or any other use of data and information in accordance with any group-wide programmes for compliance with sanctions or prevention or detection of money laundering, terrorist financing or other unlawful activities;
   14. enabling an actual or potential assignee of all or any part of the business and/or asset of the Bank or participant or sub-participant of the Bank’s rights in respect of the data subject, to evaluate the transaction intended to be the subject of the assignment, participation or sub-participation;
   15. in connection with any member of the Standard Chartered Group defending or responding to any legal, governmental, or regulatory or quasi-governmental related matter, action or proceeding (including any prospective action or legal proceedings), including where it is in the legitimate interests of the Bank or any member of the Standard Chartered Group to seek professional advice, for obtaining legal advice or for establishing, exercising or defending legal rights;
   16. in connection with any member of the Standard Chartered Group making or investigating an insurance claim or responding to any insurance related matter, action or proceeding;
   17. organizing and delivering seminars for the data subjects;
   18. managing, monitoring and assessing the performance of any agent, contractor or third party service provider who provides administrative, telecommunications, computer, payment or securities clearing or other services to the Bank in connection with the establishment, operation, maintenance or provision of Facilities, Products and Services; and/or
   19. any other purposes relating to the purposes listed above.
5. Data the Bank holds relating to a data subject is kept confidential but the Bank may provide, transfer or disclose such data or information to any one or more of the following parties (whether within or outside Hong Kong*) for the purposes set out in paragraph (d):-
   1. any agent, contractor or third party service provider who provides administrative, telecommunications, computer, payment or securities clearing or other services to the Bank in connection with the establishment, operation, maintenance or provision of Facilities, Products and Services;
   2. any other person under a duty of confidentiality to the Bank including any other member of the Standard Chartered Group which has undertaken to keep such information confidential;
   3. the drawee bank providing a copy of a paid cheque (which may contain information about the payee) to the drawer;
   4. credit reference agencies and, in the event of default, to debt collection agencies;
   5. any person or entity to whom the Bank or any other member of the Standard Chartered Group is under an obligation or otherwise required to make disclosure under the requirements of any law or regulation binding on or applying to the Bank or any other member of the Standard Chartered Group, or any disclosure under and for the purposes of any guidelines, guidance, directives, rules, codes, circulars or other similar documents issued or given by any legal, regulatory, governmental, tax, law enforcement or other authorities, or self- regulatory or industry bodies or associations of financial services providers with which the Bank or any other member of the Standard Chartered Group is expected to comply, or any disclosure pursuant to any contractual or other commitment of the Bank or any other member of the Standard Chartered Group with local or foreign legal, regulatory, governmental, tax, law enforcement or other authorities, or self-regulatory or industry bodies or associations of financial services providers, all of which may be within or outside Hong Kong and may be existing currently and in the future;
   6. any financial institution and merchant acquiring company with which a data subject has or proposes to have dealings;
   7. any actual or proposed assignee of all or any part of the business and/or asset of the Bank or participant or sub-participant or transferee of the Bank’s rights in respect of the data subjects;
   8. any party giving or proposing to give a guarantee or third party security to guarantee or secure the data subject’s obligations; and/ or
   9. 1. any member of the Standard Chartered Group which may include a Head Office function acting as a data controller in respect of data subject’s data;
      2. third party financial institutions, insurers, credit card companies, securities and investment services providers;
      3. third party reward, loyalty, co-branding and privileges programme providers;
      4. co-branding partners of the Bank and/or any member of the Standard Chartered Group (the names of such co-branding partners can be found in the application form(s) for the relevant services and products, as the case may be);
      5. charitable or non-profit making organisations; and
      6. external service providers (including but not limited to mailing houses, telecommunication companies, telemarketing and direct sales agents, call centres, data processing companies and information technology companies) that the Bank engages for the purposes set out in paragraph (d)(ix) above.

1. 1. With respect to data in connection with mortgages applied by a data subject (in any capacity) on or after 1 April 2011, the following data relating to the data subject (including any updated data of any of the following data from time to time) may be provided by the Bank, on its own behalf and/or as agent, to a credit reference agency:-
      1. full name;
      2. capacity in respect of each mortgage (as borrower, mortgagor or guarantor, and whether in the data subject’s sole name or in joint names with others);
      3. Hong Kong Identity Card Number or travel document number;
      4. date of birth;
      5. correspondence address;
      6. mortgage account number in respect of each mortgage;
      7. type of the facility in respect of each mortgage;
      8. mortgage account status in respect of each mortgage (e.g., active, closed, write-off (other than due to a bankruptcy order), write-off due to a bankruptcy order); and
      9. if any, mortgage account closed date in respect of each mortgage.
   2. The credit reference agency will use the above data supplied by the Bank for the purposes of compiling a count of the number of mortgages from time to time held by the data subject with credit providers in Hong Kong, as borrower, mortgagor or guarantor respectively and whether in the data subject’s sole name or in joint names with others, for sharing in the consumer credit database of the credit reference agency by credit providers (subject to the requirements of the Code of Practice on Consumer Credit Data approved and issued under the Ordinance).
   3. The Bank may from time to time access the mortgage count held by the credit reference agency in the course of:-
      1. considering mortgage loan application(s) made by the data subject (in any capacity);
      2. reviewing any credit facility (including mortgage loan) granted or to be granted to the data subject (in any capacity) which is in default for a period of more than 60 days with a view to putting in place any debt restructuring, rescheduling or other modification of the terms of such credit facility by the Bank;
   4. 1. reviewing any credit facility (including mortgage loan) granted or to be granted to the data subject (in any capacity), where there is in place any debt restructuring, rescheduling or other modification of the terms of such credit facility between the Bank and the data subject consequent upon a default in the repayment of such credit facility for implementing such arrangement, and/or
      2. reviewing any credit facility (including mortgage loan) granted or to be granted to the data subject (in any capacity), with a view to putting in place any debt restructuring, rescheduling or other modification of the terms of any credit facility initiated by the request of the data subject.
   5. The Bank may from time to time access the mortgage count held by the credit reference agency in the course of (after 31 March 2013):-
      1. reviewing and renewing mortgage loans granted or to be granted to the data subject (in any capacity); and/or
      2. considering the application for credit facility (other than mortgage loan) by the data subject (in any capacity other than mortgagor) and/or reviewing or renewing any facility (other than mortgage loan) granted or to be granted to the data subject (in any capacity other than mortgagor), in each case where such facility is in an amount not less than such level or to be determined by a mechanism as prescribed or approved by the Privacy Commissioner for Personal Data from time to time.
2. USE OF DATA IN DIRECT MARKETING
   The Bank intends to use a data subject’s data in direct marketing and the Bank requires the data subject’s consent (which includes an indication of no objection) for that purpose. In this connection, please note that:-
   1. the name, contact details, products and services portfolio information, transaction pattern and behaviour, financial background and demographic data of a data subject held by the Bank from time to time may be used by the Bank in direct marketing;
   2. the following classes of services, products and subjects may be marketed:-
      1. financial, insurance, fiduciary, investment services, credit card, securities, investment, banking and related services and products;
      2. reward, loyalty or privileges programmes and related services and products;
      3. services and products offered by the Bank’s co-branding partners (the names of such co-branding partners can be found in the application form(s) for the relevant services and products, as the case may be); and
      4. donations and contributions for charitable and/or non-profit making purposes;
   3. the above services, products and subjects may be provided or (in the case of donations and contributions) solicited by the Bank and/ or:-
      1. any member of the Standard Chartered Group;
      2. third party financial institutions, insurers, credit card companies, securities and investment services providers;
      3. third party reward, loyalty, co-branding or privileges programme providers;
      4. co-branding partners of the Bank and/or any member of the Standard Chartered Group (the names of such co-branding partners can be found in the application form(s) for the relevant services and products, as the case may be); and
      5. charitable or non-profit making organisations;
   4. in addition to marketing the above services, products and subjects itself, the Bank also intends to provide the data described in paragraph (g)(i) above to all or any of the persons described in paragraph (g)(iii) above for use by them in marketing those services, products and subjects, and the Bank requires the data subject’s written consent (which includes an indication of no objection) for that purpose;
   5. the Bank may receive money or other property in return for providing the data to the other persons in paragraph (g)(iv) above and, when requesting the data subject’s consent or no objection as described in paragraph (g)(iv) above, the Bank will inform the data subject if it will receive any money or other property in return for providing the data to the other persons.
   If a data subject does not wish the Bank to use or provide to other persons his/her data for use in direct marketing as described above, the data subject may exercise his/her opt-out right by notifying the Bank.
3. Under and in accordance with the terms of the Ordinance and the Code of Practice on Consumer Credit Data approved and issued under the Ordinance, any data subject has the right:-
   1. to check whether the Bank holds data about him and/or access to such data;
   2. to require the Bank to correct any data relating to him which is inaccurate;
   3. to ascertain the Bank’s policies and procedures in relation to data and to be informed of the kind of personal data held by the Bank and/or he/she has access to;
   4. to be informed on request which items of data are routinely disclosed to credit reference agencies or debt collection agencies, and be provided with further information to enable the making of an access or correction request to the relevant credit reference agency or debt collection agency; and
   5. in relation to any account data (including, for the avoidance of doubt, any account repayment data) which has been provided by the Bank to a credit reference agency, to instruct the Bank, upon termination of the account by full repayment, to make a request to the credit reference agency to delete such account data from its database, as long as the instruction is given within five years of termination and at no time was there any default of payment in relation to the account, lasting in excess of 60 days within five years immediately before account termination. Account repayment data includes amount last due, amount of payment made during the last reporting period (being a period not exceeding 31 days immediately preceding the last contribution of account data by the Bank to a credit reference agency), remaining available credit or outstanding balance and default data (being amount past due and number of days past due, date of settlement of amount past due, and date of final settlement of amount in default lasting in excess of 60 days (if any)).
4. In the event of any default of payment relating to an account, unless the amount in default is fully repaid or written off (other than due to a bankruptcy order) before the expiry of 60 days from the date such default occurred, the account repayment data (as defined in paragraph (h)(v) above) may be retained by the credit reference agency until the expiry of five years from the date of final settlement of the amount in default.
5. In the event any amount in an account is written- off due to a bankruptcy order being made against a data subject, the account repayment data (as defined in paragraph (h)(v) above) may be retained by the credit reference agency, regardless of whether the account repayment data reveal any default of payment lasting in excess of 60 days, until the expiry of five years from the date of final settlement of the amount in default or the expiry of five years from the date of discharge from a bankruptcy as notified by the data subject with evidence to the credit reference agency, whichever is earlier.
6. Without limiting the generality of the foregoing, the Bank may from time to time access the personal and account information or records of a data subject held by the credit reference agency for the purpose of reviewing any of the following matters in relation to the existing credit facilities granted to a data subject or a third party whose obligations are guaranteed by a data subject:-
   1. an increase in the credit amount;
   2. the curtailing of credit (including the cancellation of credit or a decrease in the credit amount); and
   3. the putting in place or the implementation of a scheme of arrangement with the data subject or the third party.
7. The Bank may have obtained a credit report on a data subject from a credit reference agency in considering any application for credit. In the event a data subject wishes to access the credit report, the Bank will advise the contact details of the relevant credit reference agency.
8. Data of a data subject may be processed, kept and transferred or disclosed in and to any country as the Bank or any person who has obtained such data from the Bank referred to in (e) above considers appropriate. Such data may also be processed, kept, transferred or disclosed in accordance with the local practices and laws, rules and regulations (including any governmental acts and orders) in such country.
9. In accordance with the terms of the Ordinance, the Bank has the right to charge a reasonable fee for the processing of any data access request.
10. Data subjects located in the European Union may also have the following additional rights:-
    1. the Bank or any other member of the Standard Chartered Group will use profiling, including behavioral analysis, to assist in providing data subjects with better Facilities, Products and/or Services, to make decisions and to prevent money laundering, terrorism, fraud and other financial crime, for example profiling will help to try and detect whether use of a credit card may be fraudulent. If any profiling will result in an automated decision relating to a data subject who is an accountholder, we will let the accountholder know and the accountholder will have the right to discuss the decision with the Bank;
    2. in some circumstances a data subject has the right to ask the Bank to delete the personal data of such data subject, for example if the Bank no longer has a valid reason to process it;
    3. in some circumstances a data subject may have the right to object to how the Bank processes the personal data of such data subject but this does not mean that the data subject can decide or choose how the Bank processes the personal data other than in relation to marketing. If a data subject has any concerns about how the Bank processes his/her/its personal data, such data subject should discuss this at a branch or with a relationship manager. The Bank may not be able to offer Facilities, Products or Services if the data subject does not want the Bank to process the personal data the Bank considers necessary to process to provide such Facilities, Products or Services;
    4. in some circumstances a data subject may have the right to restrict how the personal data of such data subject is processed;
    5. in some circumstances a data subject may have the right to request the personal data that has been given to the Bank in a machine readable format. An accountholder may already be able to do this through online banking in relation to banking transactions;
    6. a data subject has the right to complain to the Privacy Commissioner for Personal Data, or if the data subject is located in the European Union, the UK Information Commissioner. Details can be provided by emailing privacy@sc.com
11. The person to whom requests for access to or correction of data held by the Bank, or for information regarding the Bank’s data policies and practices and kinds of data held by the Bank are to be addressed is as follows:
    
    Data Protection Officer
    STANDARD CHARTERED BANK (HONG KONG) LIMITED
    GPO Box 21, Hong Kong
    Should you have any queries, please do not hesitate to contact either your relationship manager or our designated hotline 2282 2313.
12. Nothing in this document shall limit the rights of data subjects under the Ordinance.
13. Security:-
    1. The security of personal data is important to the Bank. The Bank has technical and organisational security measures in place to safeguard each the personal data of each data subject. When using external service providers, the Bank requires that they adhere to security standards mandated by the Bank and the Standard Chartered Group. The Standard Chartered Group may do this through contractual provisions, including any such provisions approved by a privacy regulator, and oversight of the service provider. Regardless of where personal data is transferred, the Bank takes all steps reasonably necessary to ensure that personal data is kept securely.
    2. Data subject(s) should be aware that the Inter net is not a secure form of communication and they must not send the Bank any personal data over the Internet as this carries with it risks including the risk of access and interference by unauthorised third parties. Information passing over the Internet may be transmitted internationally (even when sender and recipient are located in the same country) via countries with weaker privacy and data protection laws than in the country of residence of a data subject.
14. The Bank and the Standard Chartered Group retain personal data in line with applicable legal and regulatory obligations and for business and operational purposes. In the majority of cases this will be for seven years from the end of a data subject’s relationship with the Standard Chartered Group.
15. To the extent permitted by law, the Bank and other members of the Standard Chartered Group may record and monitor electronic communications with data subjects to ensure compliance with legal and regulatory obligations and internal policies for the purposes outlined at paragraph (d) above.
16. Data subjects should also read the cookie policy when using the Bank’s online services.

In this document, unless inconsistent with the context or otherwise specified, the words in italic shall have the following meanings:-

account(s) means, for each facility, service or product which the Bank may from time to time make available to the data subjects, the account that is, opened and/ or maintained in respect of it from time to time.

accountholder(s) means holder(s) of an account, and includes joint accountholder(s) in case there is more than one holder for an account.

card means an ATM card, a debit card, a credit card, or a revolving card or all of them, as the context requires.

data subject(s) has the meaning given to it in the Ordinance and includes applicants or accountholders for Facilities, Products and Services, customers, security providers, referees, corporate officers and managers, (e.g. authorized signatories, contact persons, company secretary, directors, shareholders, beneficial owners of a corporate), suppliers, agents, contractors, service providers and other contractual counterparties and any third party transacting with or through the Bank.

disclose, disclosing or disclosure, in relation to personal data, includes disclose or disclosing information inferred from the data.

Hong Kong means the Hong Kong Special Administrative Region.

in any capacity means whether as a borrower, mortgagor or guarantor and whether in the data subject’s sole name or joint names with others.

mortgage count means the number of mortgage loans held by the data subject (in any capacity) with credit providers in Hong Kong from time to time.

Standard Chartered Group means each of or collectively Standard Chartered PLC and its subsidiaries and affiliates (including each branch or representative office).

Please circulate this document to any and all data subject(s) relating to your account(s) at our Bank. Should there be any inconsistencies between the English and Chinese versions, the English version shall prevail.

Standard Chartered Bank (Hong Kong) Limited
February 2020