Hong Kong Exchanges and Clearing Limited and its affiliated companies (together "HKEX", "we", our” or "us") are committed to protecting all Personal Data under its custody, control or possession. Under the applicable data protection laws, HKEX is the “Data Controller”. “Personal Data” is any information that relates to an identifiable individual or can be used to identify an individual – sometimes the individual is referred to as “you” or a “Data Subject”.

This privacy notice (“Notice”) applies to Data Subjects who create an online account on our recruitment portal and/or apply for a role with HKEX. This Notice sets out Personal Data we collect, generate, and otherwise process, how we process it, who it might be transferred to, how we protect it and Data Subjects’ rights under the applicable data protection laws. By creating an online account and/or submitting an application, you acknowledge that you have understood this Notice.

We will revise this Notice from time to time and to reflect any relevant developments at HKEX relating to our business or operations that impact our recruitment strategy/process, or due to changes in the applicable laws and regulations. To the extent required under applicable data protection laws, we will notify Data Subjects of material changes and, where required, seek their consent.

If we do not receive correct or complete Personal Data, then we may not be able to maintain an online account for you such that you may not receive updates on new roles and/or submit an application for a role or we may not be able to process your application. We may also be unable to process requests relating to your rights as a Data Subject under the applicable data protection laws. HKEX is required to perform certain regulatory functions that may not be possible if we are not provided with the requested Personal Data.

Sometimes we will aggregate information into aggregated data, but aggregated data will not necessarily constitute Personal Data. Any aggregated data that does constitute Personal Data will be processed in accordance with this Notice.

HKEX discloses Personal Data to third party organisations that provide services which facilitate our recruitment. These third party Personal Data recipients and specific transfer purposes are set out below:

• Affiliates of Hong Kong Exchanges and Clearing Limited
• HR-related vendors who provide services relating to the following services:
  

  Services	Vendor(s)
  Talent sourcing	Hays PrimePeak Group TRUST Professional Driver Search Adecco Personnel JOBS DB Hong Kong Charterhouse IKas International (Asia) KOS International 北京科锐国际人力资源股份有限公司 上海科之锐人才咨询有限公司
  Skills assessment	AON Enterprise Solutions (Shanghai) Hirevue
  Recruitment portal	Workday

• Our general vendors who provide administrative, insurance, and technical infrastructure services
• Any individual or entity acting on your behalf according to your authorisation
• Any regulator or other authority of HKEX or of our affiliates

To fulfil our legal obligations, we may also share your Personal Data with courts, regulatory authorities, government and law enforcement agencies, and other public authorities.

Further details about these third parties may be provided upon request to the address in the "Contact Us" section below. We shall endeavour to provide such information to the extent we are required to do so under applicable data protection laws.

Where required under applicable data protection laws, HKEX will only disclose Personal Data to third parties with your prior consent. In certain jurisdictions, HKEX may also be required to take additional measures prior to giving effect to such transfers (e.g. carrying out privacy impact assessments prior to the transfer).

HKEX may process Personal Data outside of the Data Subject's home jurisdiction, including sharing the Personal Data with third parties (such as suppliers). HKEX shall use reasonable endeavours to ensure that the laws and regulations of the destination jurisdiction shall offer the same or comparable level of protection for Personal Data. Where this is not the case, we shall ensure appropriate safeguards are in place at the time of the transfer by implementing standard contractual clauses or other data transfer mechanism approved by the authorities of the relevant jurisdiction. Where required under applicable data protection laws, we shall also carry out additional measures for the offshore transfer such as carrying out a privacy impact assessment.

The regions where the Personal Data may be hosted or transferred to will vary from time to time, but typically include Hong Kong, the UK, US, EU, Switzerland, Singapore, Japan, India, and Mainland China.

Further details on the processing locations and our measures for safeguarding international transfers (including adequacy decisions) may be obtained upon request to the address in the "Contact Us" section below.

Your Personal Data will be retained by us for as long as is necessary to fulfil the purposes required for the processing outlined in this Notice and, in any event, retained in accordance with applicable law.

HKEX will refer to the following factors when determining or confirming the appropriate retention period of Personal Data:

• original purpose of collection;
• termination of any contract involving the Data Subject’s Personal Data;
• limitation period as defined in the applicable law;
• existence of any legal or regulatory investigations or legal proceedings;
• specific laws or regulations setting out HKEX’s functions, obligations, and responsibilities;
• retention period set out in non-statutory guidelines issued by our regulators or international bodies ;
• sensitivity of the Personal Data and the degree of risk from the associated processing activity.

Therefore, HKEX applies differing retention periods for the Personal Data in its possession The Personal Data of unsuccessful candidates is typically retained for no longer than 1 year from the date of rejection during which time we shall continue to retain it for our legitimate interests, such as notifying/considering you for other current/future employment opportunities (subject to your consent). You may also request deletion of your candidate profile in line with your Data Subject Rights. If you are successful in your application, then we may also retain the Personal Data provided during the recruitment process as part of your personnel records.

For Data Subjects in Mainland China, we usually retain the Personal Data for not more than three years from the last activity or interaction with us. Further details of our Personal Data retention period may be obtained upon request to the address in the "Contact Us section below.

If you attend our premises for any recruitment event, interview, and/or assessment, please note that images recorded by CCTV on our premises are retained for 60 days unless requested by law enforcement, such as when there may have been an incident.

Where the retention period has expired, we shall take reasonable measures to delete the relevant Personal Data (although all or part of the Personal Data may continue to be retained as necessary for use in any actual or potential dispute or for compliance with applicable laws)

We will take all practicable and reasonable steps to promote the security of the Personal Data we process in a manner consistent with applicable data protection laws and established international security standards. This includes physical, technical and administrative safeguards to help prevent unauthorised access, collection, use, disclosure, copying, modification, disposal or similar risks, such as:

• storage of Personal Data in a secure operating environment with restricted access;
• relevant third parties being required to apply appropriate safeguards; and
• rigorous verification of identity prior to access being granted to HKEX premises.

Where we occasionally provide links to third-party websites, this Notice will not apply and we recommend that you check their respective privacy statements to understand how your Personal Data will be governed.

Where these rights apply, we shall use reasonable endeavours to fulfil the request or provide an explanation. If you withdraw your consent to the processing of your data, this will not affect any processing which has already taken place on the basis of that consent. Please note that under applicable data protection law, we are only obligated to respond to Personal Data requests from the same Data Subject up to two times in a 12-month period, and we may be limited in what Personal Data we can disclose which is also for the protection of your Personal Data.

We will endeavour to respond to you as soon as possible and, in any event, within the timeframe stipulated under the applicable data protection law. In the event of a potential delay, we will provide an explanation and the expected timeframe for delivery. Under applicable data protection law, we may also be required to charge a reasonable fee for the cost of processing the request.

Please note that we may need to seek confirmation of identity or clarification in order to fulfil the request. If you as the Data Subject would like to appoint an authorised agent to make a request on your behalf, we may require you to verify your identity with us directly before we provide any requested information to your authorised agent unless your authorised agent has power of attorney or acts as a conservator. Information collected for purposes of verifying your request will only be used for verification. For deletion requests, you will be required to submit a verifiable request for deletion and then confirm separately that you want Personal Data about you to be deleted.

If you would like to exercise your Data Subject rights, please contact the HKEX Group Data Protection Office via one of the channels under the Contact Us section below.

If you have any questions or comments relating to the content of this Notice, report any concerns about our Personal Data processing, or if you would like to exercise your Data Subject Rights, please contact us through the channels below:

By post:

Group Data Protection Officer
GDPO Office
Hong Kong Exchanges and Clearing Limited
8/F., Two Exchange Square
8 Connaught Place
Central
Hong Kong

By email: dataprivacy@hkex.com.hk

UK Representative: 10 Finsbury Square, London, EC2A 1AJ, United Kingdom

EU Representative: De Cuserstraat 91, 1081 CN Amsterdam, Postbus/PO Box 7902, 1008 AC Amsterdam, Netherlands (hkex.eurep@eversheds-sutherland.com)

Please include the following details in any request to exercise your Data Subject Rights:

Identity of Data Subject

• Full name*
• Company name
• Email address*
• Address of principal residence
• Identity particulars if acting on behalf of a Data Subject
• Contact details held on file*

Nature of the Request

• Specific Right*
• Purpose of the Request
• Preferred communication channel and address for receiving the results of the request*
• Document(s) to support the rights request

*required field

Any Data Subject who has contacted us to express concerns about the way we manage their Personal Data and is of the view that we have not addressed the matter satisfactorily, may also contact the relevant privacy regulator to resolve the matter or seek assistance.

The privacy regulator in the United Kingdom is the Information Commissioner, who may be contacted at https://ico.org.uk/make-a-complaint/ or by post to: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom.

If you live outside of the UK, you may contact the relevant data privacy regulator in your country of residence.

Last Update: Oct 2024

This Notice relates to privacy practice of the following HKEX group entities. For the contact details of the following entities, please refer to the “Contact Us” section.

• The Stock Exchange of Hong Kong Limited
• Hong Kong Futures Exchange Limited
• Hong Kong Securities Clearing Company Limited
• HKFE Clearing Corporation Limited
• The SEHK Options Clearing House Limited
• OTC Clearing Hong Kong Limited
• HKEX Information Services Limited
• HKEX Information Services (China) Limited
• HKEX (China) Limited
• HKEX Investment (China) Limited
• HKEX Investment (Hong Kong) Limited
• Hong Kong Futures Exchange Limited Singapore Branch
• The Stock Exchange of Hong Kong Limited Singapore Branch
• HKEX (U.S.) LLC