This Privacy Policy outlines how Oxfam Hong Kong, together with our affiliates (“we”, “us”, “our”) collect, use, process and transfer your personal data, in accordance with the Personal Data (Privacy) Ordinance (Cap. 486 of the Laws of Hong Kong) (the “PDPO”) and other applicable laws. By using our services, you agree to be bound by the terms of this Privacy Policy. Supply of your personal data to us is non-obligatory but failure to do so may affect our ability to provide you with the relevant services or information. This Privacy Policy is incorporated into and forms part of the terms and conditions that you have agreed to in order to use our services. We may from time to time amend or revise the terms of this Privacy Policy. Your continued use of our services indicates your acceptance of the current version of this Privacy Policy. Types of Personal Data Collected We collect personal data that you disclose to us, for example, when you submit your information when donating through our services, sign-up for our events, register for our newsletters, or when you participate in our events. The types of personal data we collect may include, but is not limited to: (a) personal information such as your first name, last name, gender, date of birth, nationality, occupation, and HKID or passport number; (b) contact information such as your telephone number, residential address, office address and email address, as well as contact information of your emergency contacts; (c) donation records such as your donation history, donation date, donation amount, and bank account details; (d) participation records such as event date, event time and number of previous event participations; (e) communications information such as information provided in enquiries, complaints and other correspondence sent to us; (f) photographs and videos such as photographs taken at our events, or footages from CCTV cameras or other security devices in and around our premises (please refer to our section on Photo-taking below); and (g) other records including responses to our surveys or interviews, meeting notes and other operational and administrative records. We may also automatically collect certain data about your use of our website or application such as log files, cookies, browser type and other computer or device information as described in the section on Cookies below. We may also collect information about the equipment or device that you use to access our website or application, such as the operating system, hardware version, device settings, equipment or device location, and connection information, such as your IP address. Purposes of Collection of Personal Data The personal data you provide to us may be used for the following purposes or any directly-related purposes: (a) processing and assessing applications for our activities and services, including verifying your identity, and assessing your suitability; (b) communicating with you regarding our activities and services, including processing and addressing your enquiries or complaints; (c) conducting and carrying out statistical analysis and research; (d) performing administration work related to our operations; (e) subject to your consent, directly marketing and promoting our activities, by, among other methods, sending you newsletters or materials regarding charitable or community causes, programmes, activities and events organized by us (please refer to our section on Direct Marketing below); (f) processing donations and donation-related administrative work, such as preparing and issuing acknowledgements, receipts, payment collection notices and donation records; (g) complying with and enforcing our legal or other rights and obligations, including our rights and obligations under (1) any law, regulation, judgment, court order, sanctions regime, within or outside Hong Kong; (2) any guidelines, demand or requests given or issued by any legal, regulatory, governmental, tax, law enforcement or other authorities or regulators within or outside Hong Kong; or (3) any of the rules or bye-laws of Oxfam Hong Kong or those of our affiliates; (h) preventing, detecting or investigating crime; and (i) any other purposes that we disclose at the time you provide, or when we collect, your personal data. We may also, from time to time, use aggregated or anonymized information which we collect to promote and/or improve the activities we organize or services we offer which will not particularly identify any individual. Photo-taking Our staff may take photographs or record videos of you at our events for promotional, documentation and operational purposes. These images and recordings may be used or published (with or without captions) on our websites, social media channels and/or other marketing materials. Please contact us at [email protected] (general public) / [email protected] (donors) if you have any concerns or if you do not wish to have your images used or published. Direct Marketing Subject to your consent, we may use your personal data for direct marketing carried out by us. For this purpose, we intend to use your name, contact details and demographic information to market any charitable or non-profit making causes or activities offered or arranged by us. We may also transfer your name, contact details and demographic information to our service providers and business partners for direct marketing carried out by them. We will not use your personal data for the abovementioned purposes unless we have received your consent. You can opt-out of marketing communications if you no longer wish any of the personal data provided to be used in any of the above described direct marketing purposes. Disclosure of Personal Data Where disclosure of personal data is necessary to satisfy the purpose, or a directly-related purpose, for which the personal data was collected, we may provide such personal data to the following parties (whether in Hong Kong or overseas): (a) any person or company who is acting for or on behalf of, or jointly with, Oxfam Hong Kong; (b) any financial institutions, including banks, necessary to establish and support the donations of any funding activities organized by Oxfam Hong Kong or payment for any services provided to you; (c) our affiliates, including our parent company, holding company, and subsidiaries; (d) agents, contractors, partners, suppliers and any third party service provider who provides fundraising, administrative, marketing and research, distribution, data processing, telemarketing, telecommunications, computer, payment or other services to Oxfam Hong Kong in connection with our operations; (e) law enforcement agencies, government and regulatory authorities and other organizations, as required by law, by court order or in response to any legally valid inquiry, or otherwise necessary to the establishment of legal claims or defenses, to obtain legal advice, or to exercise and defend Oxfam Hong Kong’s rights; (f) any other person or entity who is under a duty of confidentiality to us and has undertaken to keep such information confidential, provided such person or company has a legitimate right to such information. We may also transfer your personal data to jurisdictions outside Hong Kong for the purposes mentioned above. We will ensure, as far as possible and practicable, that the personal data transferred outside Hong Kong is protected to standards in line with the requirements of the PDPO and other applicable laws. By submitting your personal data to us, you understand and consent to the transfer of such information as described above. Security of Personal Data We are committed to protecting the security, integrity, and confidentiality of the personal data we process. We implement technical and organisational measures designed to safeguard personal data against unauthorized or accidental access, processing, erasure, loss or use. These measures may include encryption, access controls, network and perimeter security, secure software development practices, vulnerability management, and regular monitoring and testing. We restrict access to personal data to personnel on a need-to-know basis and who are bound by confidentiality obligations. While no system can be completely secure, we maintain a risk-based security program and review and enhance our safeguards on an ongoing basis to align with industry standards and applicable legal requirements. All personal data we collect will be stored only for a duration that is relevant to the purpose for which it is collected and for as long as permitted or required by applicable laws. Cookies A "cookie" is a small file containing a string of characters that is placed on your smartphones, tablets or other mobile or wireless devices when you access a website or other web content, including our website. We and our third party tracking-utility partners may from time to time gather certain information automatically via such cookies and similar technologies and store it as log data. We use cookies and similar technologies to personalise your experience on your visit to our website and for various other purposes, including: (a) identifying you. For instance, cookies, and similar technologies can help us identify you as a registered user of our website or keep the preferences or information that you have previously provided; (b) analysing how you use our website. We can use cookies and similar technologies to understand what users are doing on our services, or which pages or sections are most popular; (c) serving advertising. Cookies and similar technologies help us provide you with advertising that we believe are relevant to you; and (d) credit card information and other financial data required to process payments when using services on our website may be collected and stored by third party payment processors or our own payment processors. Those payment processors may provide us with a cookie or similar technology that enables you to make additional purchases using the payment information you have already provided. Data Access, Correction Requests and Other Enquiries You have the right to request access to and correction of your personal data submitted to us in accordance with the PDPO and other applicable laws. If you wish to do so, please contact us at +852 2520 2525 (Hong Kong) / +853 2875 7750 (Macau) by phone or through email at [email protected] (general public) / [email protected] (donors). In relation to your request to access or correct your personal data, we may require that you to verify your identity in order to protect your personal data, this may include requiring you to provide your contact number or correspondence email. Where a request is made, any information obtained may be kept and added to your personal data. Should you have any enquiries about this Privacy Policy or our data handling practices, please contact us by the methods mentioned above. |