Hong Kong Exchanges and Clearing Limited and its affiliated companies (together "HKEX", "we", our” or "us") are committed to protecting all Personal Data under our custody, control, or possession. “Personal Data” is any information that relates to an identifiable individual or can be used to identify an individual – sometimes the individual is referred to as a “Data Subject” or consumer .

HKEX is Hong Kong based and therefore, when using our Website, any Personal Data collected through online forms or cookies will be transferred to Hong Kong even if you are located in another jurisdiction.

This privacy notice (“Notice”) applies to the Personal Data we collect and generate from Data Subjects who access our various websites as indicated in the table below:

As we also provide links to the websites of independent third parties, we encourage you to read the privacy policies on these other websites as we cannot control nor are we responsible for how they handle your Personal Data.

This Notice sets out what Personal Data we process, how we process it, who it might be transferred to, how we protect it, and rights under the applicable data protection laws. We will revise this Notice from time to time to reflect any relevant developments at HKEX relating to our business or operations or in the services delivered through our Website, or due to changes in the applicable laws and regulations.

To the extent required under applicable data protection laws, we will notify Data Subjects of the material changes and, where required, seek their consent.

If the correct Personal Data is not submitted to HKEX then access to certain products and services through the Website cannot be provided and we may also be unable to process requests from the Data Subjects relating to their rights under the applicable data protection laws. HKEX is also required to perform certain regulatory functions which may not be possible if we are not provided with the requested Personal Data.

Before we share Marketing Data within HKEX group (including HKEX group members covered under this Notice) in order to send direct marketing and promotional and informational content relating to our financial products and services (“Marketing Communications”), we may need to first ask for permission by obtaining the Data Subject’s explicit opt in or indication of no objection as required or permitted under the applicable data protection laws. 

To provide our Marketing Communications, we will usually use the name, job title, phone number, email address and contact preferences and, occasionally, we may also make use of the marketing profiles generated from the use of our Website, cookies and similar tracking technologies combined with information directly obtained from the Data Subject and other sources (‘Marketing Data’).

At any time, the Data Subject can opt out or change their marketing preferences in terms of the frequency, delivery channel, and category or type of Marketing Communication – this right exists even if we are not required to obtain consent for the sending of Marketing Communications.  To action this right, the Data Subject can provide their full name, email address, log in name (if applicable) and details of the product and/or service to which they have subscribed to the address in the “Contact Us” section below. We will provide a reminder of this right in each of our Marketing Communications.

Please note that even if an opt-out request has been made, we may still need to send necessary communications such as those relating to the administration of a subscription. In addition, it does not impact the lawfulness of our use of the Personal Data prior to the consent being withdrawn.

Cookies and similar technologies are used in the Marketing Communications to analyse engagement and effectiveness. The specific tools that enable this will track and record clicks and hovers, searches, and distinguish between known and unknown users. For further details on how we adopt cookies and other similar technologies, please refer to our Cookies Policy. 

Occasionally, we will engage third party service providers to support our marketing initiatives and enabling members of the HKEX group to send Marketing Communications. Where required under applicable data protection laws, HKEX shall obtain the Data Subject’s prior consent. Where third party platforms are utilised, we also recommend that you refer to their privacy statements.

HKEX sometimes discloses Personal Data to third party organisations and partners that enable our exchanges and clearing business, so that we can operate this Website, provide you with products and services, improve our offerings, or comply with applicable laws.  These third party Personal Data recipients and specific transfer purposes are set out below:

• Affiliates of Hong Kong Exchanges and Clearing Limited
• Organisations involved in hosting or organising activities for us
• Our vendors who provide marketing and advertising support
• Our contractors or vendors who provide telecommunications, IT security, or other technical assistance
• Our payment service providers and processors
• Our vendors who provide strategy or other consultancy services in respect of our businesses
• Our agents, contractors or vendors who provide administrative support to us
• Our professional service providers such as legal advisors, tax consultants, and accountants

To fulfil our legal obligations, we may also share your Personal Data with courts, regulatory authorities, government and law enforcement agencies, and other public authorities.

Further details about these third parties may be provided upon request to the address in the “Contact Us” section below.  We shall endeavour to provide such information to the extent we are required to do so under applicable data protection laws.

Where required under applicable data protection laws, HKEX will only disclose Personal Data to third parties with your prior consent. In certain jurisdictions, HKEX may also be required to take additional measures prior to giving effect to such transfers (e.g. carrying out privacy impact assessments prior to the transfer).    

HKEX may process Personal Data outside of the Data Subject’s home jurisdiction, including sharing the Personal Data with third parties (such as suppliers). HKEX shall use reasonable endeavours to ensure that the laws and regulations of the destination jurisdiction shall offer the same or comparable level of protection for Personal Data. Where this is not the case, we shall ensure appropriate safeguards are in place at the time of the transfer by implementing standard contractual clauses or other data transfer mechanism approved by the authorities of the relevant jurisdiction.  Where required under applicable data protection laws, we shall also carry out additional measures for the offshore transfer such as carrying out a privacy impact assessment.

The regions where the Personal Data may be hosted or transferred to will vary from time to time, but typically include Hong Kong, the UK, US, EU, Switzerland, Singapore, Japan, India, and Mainland China.

Further details on the processing locations and our measures for safeguarding international transfers (including adequacy decisions) may be obtained upon request to the address in the “Contact Us” section below.

Personal Data is retained in accordance with our internal policies, including our Group Record Retention Policy, and applicable law.

Your Personal Data will be retained by us for as long as is necessary to fulfil the purposes required for the processing. HKEX will also refer to the following factors when determining or confirming the appropriate retention period of Personal Data:

• the original purpose of collection
• the termination of any contract involving the Data Subject’s Personal Data
• the limitation period as defined in the applicable law
• the existence of any legal or regulatory investigations or legal proceedings
• specific laws or regulations setting out HKEX’s functions, obligations, and responsibilities
• retention period set out in non-statutory guidelines issued by our regulators or international bodies
• the sensitivity of the Personal Data and the degree of risk from the associated processing activity

For Data Subjects in Mainland China, we usually retain the Personal Data for not more than 3 years from the last activity or interaction with us.  Further details of our Personal Data retention period may be obtained upon request to the address in the “Contact Us” section below.

Where  any Personal Data is no longer necessary for the purposes for which it is collected, we shall cease the processing of that Personal Data as soon as reasonably practicable (although copies may be retained as necessary for archival purposes, for use in any actual or potential dispute, or for compliance with applicable laws), and take reasonable measures to destroy the relevant Personal Data.

We will take all practicable and reasonable steps to promote the security of the Personal Data we process in a manner consistent with applicable data protection laws and established international security standards. This includes physical, technical and administrative safeguards, to help prevent unauthorised access, collection, use, disclosure, copying, modification, disposal or similar risks, and the loss of any storage medium or device on which the Personal Data is stored, and to maintain the general security of the data.

Whilst we endeavour to protect the Personal Data collected or generated by us or transferred to us, we request that users of the Website maintain up-to-date security settings on their systems. It is also important that any User ID and password used to access the Website are kept confidential.

Where we occasionally provide links to third-party websites, this Notice will not apply and we recommend that you check their respective privacy statements to understand how your Personal Data will be governed.

Where these rights apply, we shall use reasonable endeavours to fulfil the request or provide an explanation.  Please note that under applicable data protection law, we are only obligated to respond to Personal Data requests from the same consumer up to two times in a 12-month period, and we may be limited in what Personal Data we can disclose which is also for the protection of your Personal Data.

We will endeavour to respond to you as soon as possible and, in any event, within the timeframe stipulated under the applicable data protection law. In the event of a potential delay, we will provide an explanation and the expected timeframe for delivery.  Under applicable data protection law, we may also be required to charge a reasonable fee for the cost of processing the request.

Please note that we may need to seek confirmation of identity or clarification in order to fulfil the request. If you as the Data Subject would like to appoint an authorised agent to make a request on your behalf, we may require you to verify your identity with us directly before we provide any requested information to your authorised agent unless your authorised agent has power of attorney or acts as a conservator. Information collected for purposes of verifying your request will only be used for verification. For deletion requests, you will be required to submit a verifiable request for deletion and then confirm separately that you want Personal Data about you deleted.

If you would like to exercise your data subject rights, please contact the HKEX Group Data Protection Office via one of the channels  under the Contact Us section below. 

Some browsers incorporate a “Do Not Track” feature that lets you tell the websites you browse that you do not want your online activities to be tracked. We are currently in the process of configuring our Website to detect and respond to these “Do Not Track” preference signals. In addition, our Website shall support the Global Privacy Control described at https://globalprivacycontrol.org/, which you can enable by downloading a participating browser or browser extension. 

As our Website is not aimed at children, we only knowingly process Personal Data of minors when they visit our premises. If we discover that processing has taken place in any other circumstances, then we shall ensure it has occurred with a Lawful Basis or otherwise cease the processing and make reasonable efforts to dispose of the Personal Data in accordance with our internal policies

The age of minors in respect of Personal Data consent differs across jurisdiction:

If you have any questions or comments relating to the content of this Notice, report any concerns about our Personal Data processing, or if you would like to exercise your Data Subject Rights, please contact us through the channels below:

By Post:

Group Data Protection Officer
GDPO Office
Hong Kong Exchanges and Clearing Limited
8/F., Two Exchange Square
8 Connaught Place
Central
Hong Kong

UK Representative: 10 Finsbury Square, London, EC2A 1AJ, United Kingdom

EU Representative: De Cuserstraat 91, 1081 CN Amsterdam, Postbus/PO Box 7902, 1008 AC Amsterdam, Netherlands

By email: DataPrivacy@hkex.com.hk

Please include the following details in any request to exercise your Data Subject Rights:

Identity of Data Subject

• Full Name
• Company Name
• Email Address
• Address of principal residence
• Identity particulars if acting on behalf of a Data Subject
• Contact details held on file or Document(s) to verify identity

Nature of the Request

• Product or Service to which the Data Subject has subscribed
• Specific Right
  • Purpose of the Request
  • Preferred communication channel and address for receiving the results of the request
  • Document(s) to support the rights request

Any Data Subject who has contacted us to express concerns about the way we manage their Personal Data and is of the view that we have not addressed the matter satisfactorily, may also contact the relevant privacy regulator to resolve the matter or seek assistance.

The privacy regulator in the United Kingdom is the Information Commissioner, who may be contacted at https://ico.org.uk/make-a-complaint/ or by post to: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom.

If you live outside of the UK, you may contact the relevant data privacy regulator in your country of residence.

Last Updated: 31 January 2023

This Notice relates to privacy practice of the following HKEX group entities. For the contact details of the following entities, please refer to the “Contact Us” section.

• The Stock Exchange of Hong Kong Limited
• Hong Kong Futures Exchange Limited
• Hong Kong Securities Clearing Company Limited
• HKFE Clearing Corporation Limited
• The SEHK Options Clearing House Limited
• OTC Clearing Hong Kong Limited
• HKEX Information Services Limited
• HKEX Information Services (China) Limited
• HKEX (China) Limited, HKEX Investment (China) Limited
• HKEX Investment (Hong Kong) Limited
• Hong Kong Futures Exchange Limited Singapore Branch
• The Stock Exchange Of Hong Kong Limited Singapore Branch
• HKEX (U.S.) LLC