Skip to content
HSBC

Privacy and Security

PRIVACY AND SECURITY POLICY

Please click here to view the Personal Information Collection Statement for HSBC Mandatory Provident Fund.

Please see below for HSBC's policy on Privacy and Security for business customers.

HSBC's Privacy Principles

Our business has been built on trust between our customers and ourselves. To preserve the confidentiality of all information you provide to us, we maintain the following privacy principles:

  • We only collect personal information that we believe to be relevant and required to understand your financial needs and to conduct our business.
  • We may use, transfer and disclose personal information in connection with purposes set out in the Notice Relating to the Personal Data (Privacy) Ordinance (the “Notice”) below (the “Purposes”).
  • We may pass personal information to other HSBC Group companies or agents or other recipients set out in the Notice, as necessary and appropriate for the Purposes.
  • We will not disclose personal information to anyone unless we have your consent or are required by law or public duty or have previously informed you or have legitimate business purposes that require disclosure.
  • We may be required from time to time to disclose personal information to Governmental or judicial bodies or agencies or our regulators, but we will only do so under proper authority.
  • We aim to keep personal information on our records accurate and up-to-date.
  • We maintain strict security systems designed to prevent unauthorised access to personal information by anyone, including our staff.
  • All HSBC Group companies, all our staff and all third parties with permitted access to personal information are specifically required to observe our confidentiality obligations.

By maintaining our commitment to these principles, we at HSBC will ensure that we respect the inherent trust that you place in us.

Your Privacy Matters to Us

This section provides specific details of how we treat any personal information you might wish to provide us when you visit this site.

Data Security

  • Security is our top priority. The Hongkong and Shanghai Banking Corporation Limited ('the Bank') will strive at all times to ensure that your personal data will be protected against unauthorised or accidental access, processing or erasure. We maintain this commitment to data security by implementing appropriate physical, electronic and managerial measures to safeguard and secure your personal data.
  • The secure area of our website supports the use of 128-bit Secure Socket Layer (SSL) encryption technology - an industry standard for encryption over the Internet to protect data. When you provide sensitive information such as credit card details, it will be automatically converted into codes before being securely dispatched over the Internet.
  • Our web servers are protected behind "firewalls" and our systems are monitored to prevent any unauthorised access. We will not send personal information to you by ordinary email. As the security of ordinary email cannot be guaranteed, you should only send email to us using the secure email facility on our website.

All practical steps will be taken to ensure that personal data will not be kept longer than necessary and that the Bank will comply with all statutory and regulatory requirements in the Hong Kong Special Administrative Region concerning the retention of personally identifiable information.

Security Assurance

  • Both you and HSBC play an important role in protecting against online fraud. You should be careful that your bank account details including your User ID and/or Password are not compromised by ensuring that you do not knowingly or accidentally share, provide or facilitate unauthorised use of it. Do not share your User ID and/or password or allow access or use of it by others. We endeavor to put in place high standards of security to protect your interests. If, in the unlikely event, unauthorised transactions have been conducted through your account through no fraud, fault or negligence on your part, we will see that you are covered for your direct loss up to the full amount of the unauthorised transaction.
  • You should safeguard your unique User ID and Password by keeping it secret and confidential. Never write them down or share these details with anyone. HSBC will never ask you for your Internet Banking Password, in order to ensure that you are the only person who knows this information. When choosing your unique User ID and Password for the first time, do not create it using easily identifiable information such as your birthday, telephone number or a recognisable part of your name. If you think your User ID and/or password has been disclosed to a third party, is lost or stolen and unauthorised transactions may have been conducted, you are responsible to inform us immediately.

Collection of Personal Information

  • Use of Cookies, Spotlight Tags and Web Beacons etc

    Your visit to this site may be recorded for analysis of the number of visitors to the site, general usage patterns, your personal usage patterns and ways to improve your experience. Some of this information will be gathered through the use of "cookies".

    Cookies are small bits of information that are automatically stored on your web browser in your computer that can be retrieved by this site. We will be able to access the information stored inside the cookies and record how you use this site.

    Cookies allow us to recognise your device, and they store information about your use of this site/app. This information enables us to provide more features that you may find useful, to tailor the content of our website and mobile applications to suit your interests and, if your marketing preference settings allow, to provide you with promotional materials or direct marketing based on your usage patterns. Most browsers are initially set to accept cookies. If you would prefer, you can set your browser to disable cookies or inform you when they are set. However, by disabling them, you may not be able to take full advantage of our website, including HSBC Internet Banking.

    If you accept cookies during your use of this site or you continue to use this app, you will be acknowledging that your information is being collected, stored, accessed and used as outlined above.

    HSBC may also work with third parties including data management agencies and ad networks (such as Tealium, Adobe, Doubleclick, Facebook, Nielsen//NetRatings, WebTrends, The Trade Desk, Google, Yahoo!, Eloqua, Dun & Bradstreet, Optimizely, Heap, LinkedIn, LivePerson and Quantcast) to research certain usage and activities on parts of our web site on our behalf. Tealium, Adobe, Doubleclick, Facebook, Nielsen//NetRatings, WebTrends, The Trade Desk, Google, Yahoo!, Eloqua, Dun & Bradstreet, Optimizely, Heap, LinkedIn, LivePerson and Quantcast use technologies such as spotlight monitoring, web beacons and cookies to collect information for this research. The information collected through technologies such as cookies, spotlight tags and web beacons etc are used to find out more about our users, including user demographics and behaviour and usage patterns, for more accurate reporting and to improve the effectiveness of our marketing. Information recorded through the use of these devices are aggregated and then shared with us. As part of the information that we share with them, we may share your advertising identifier and "installation event" (which means the data in relation to when you first install or use this site). No personally identifiable information about you is collected or shared with HSBC by Tealium, Adobe, Doubleclick, Facebook, Nielsen//NetRatings, WebTrends, The Trade Desk, Google, Yahoo!, Eloqua, Dun & Bradstreet, Optimizely, Heap, LinkedIn, LivePerson and Quantcast with HSBC as a result of this research. Should you wish to disable the cookies associated with these technologies such as spotlight tags and/or web beacons etc, you may do so by changing the setting on your browser. However, you may not be able to enter certain part(s) of our website, including HSBC Internet Banking.

    To find out more about the use of cookies and the information-gathering practices and opt-out procedures of Tealium, Adobe, Doubleclick, Facebook, Nielsen//NetRatings, WebTrends, The Trade Desk, Google, Yahoo!, Eloqua, Dun & Bradstreet, Optimizely, Heap, LinkedIn, LivePerson and Quantcast, please visit:

    • Marketing Promotions

    Occasionally we may collect personal information from visitors to this site and those individuals that participate in a contest or promotion (online or over the telephone,or at one of our branches). Such information is only collected from individuals who voluntarily provide us with their personal information. We may use this information to advise them of products, services and other marketing materials, which we think, may be of interest to them. We may also invite visitors to this site to participate in market research and surveys and other similar activities.

    You can choose to receive marketing and other promotional materials by email. If you do receive email or promotional direct mailings, you will always have an opportunity to opt-out.

    If at any time you would like us to cease sending you direct mailings, please contact our Customer Service Hotline on (852) 2748 8288. We will then, at no cost to you, act on your request within 30 days and ensure that you are not included in future direct marketing promotions.

    If at any time you would like to cease being targeted by our social media advertising partners, please fill in the online form. We will then, at no cost to you, act on your request within 30 days and ensure your email address and/or mobile phone number are not included in future Facebook advertising via custom audience.

    If we do ask you to provide personal information, we will always specify the purpose for which such personal information is collected and ensure that it is only used for the purpose specified at the time of collection.

    *Notice relating to the Personal Data (Privacy) Ordinance (the “Ordinance”)

    This Statement is made by The Hongkong and Shanghai Banking Corporation Limited ("we", "us", "our", including our successors and assigns) in accordance with the Personal Data (Privacy) Ordinance of the Hong Kong Special Administrative Region. The Statement is intended to notify you why personal data is collected, how it will be used and to whom data access requests are to be addressed.

    Collection of Data

    a. We may collect the data of customers and other individuals in connection with the purposes set out in this Notice. These customers and other individuals may include the following or any of them (collectively “you”, “your”):

    • applicants for banking or financial services;
    • persons giving or proposing to give guarantees or security for obligations owed to us;
    • persons linked to a customer or an applicant that is not an individual, including the beneficial owners and officers of that customer or applicant, or in the case of a trust, including the trustees, settlors, protectors and beneficiaries of the trust; and
    • other persons who are relevant to a customer’s relationship with us, including third party service providers with whom the customer interacts in connection with the marketing of our products and services and in connection with the customer’s application for our products and services (including credit references agencies approved for participation in the Multiple Credit Reference Agencies Model (hereinafter referred to as “credit reference agencies” or “CRAs”)).

    b. If the data requested by us is not provided, we may be unable to provide (or continue to provide) products or services to you or to the relevant customer or applicant linked to you.

    c. Data may be:

    1. collected from you directly, from someone acting on your behalf or from another source; and
    2. combined with other data available to members of the HSBC Group (“HSBC Group” and any “member of the HSBC Group” means HSBC Holdings plc and/or its affiliates, subsidiaries, associated entities and any of their branches and offices).

    Use of Data

    d. We will use data for the following purposes or any of them (which may vary depending on the nature of your relationship with us):

    1. considering and processing applications for products and services and the daily operation of products and services (including credit facilities provided to you or the relevant customer linked to you)
    2. conducting credit checks whenever appropriate (including upon an application for consumer credit (including mortgage loans) and when we review credit which normally takes place one or more times each year);
    3. creating and maintaining our credit and risk related models;
    4. assisting other credit providers in Hong Kong approved for participation in the Multiple Credit Reference Agencies Model (hereinafter referred to as “credit providers”) to conduct credit checks and collect debts;
    5. ensuring your ongoing credit worthiness and good standing;
    6. designing financial products and services (including insurance, credit card, securities, commodities, investment, banking and related products and services) for your use;
    7. marketing products, services and other subjects as described in paragraph (f) below;
    8. determining the amount of indebtedness owed to or by you;
    9. exercising our rights under contracts with you, including collecting amounts outstanding from you;
    10. meeting our obligations, requirements or arrangements or those of any member of the HSBC Group, whether compulsory or voluntary, to comply with or in connection with:
      1. any law, regulation, judgment, court order, voluntary code, sanctions regime, within or outside the Hong Kong Special Administrative Region (“Hong Kong”) existing currently and in the future (“Laws”) (e.g. the Inland Revenue Ordinance and its provisions including those concerning automatic exchange of financial account information);
      2. any guidelines, guidance or requests given or issued by any legal, regulatory, governmental, tax, law enforcement or other authorities, or self-regulatory or industry bodies or associations of financial services providers within or outside Hong Kong existing currently and in the future (e.g. guidelines, guidance or requests given or issued by the Inland Revenue Department including those concerning automatic exchange of financial account information) and any international guidance, internal policies or procedures;
      3. any present or future contractual or other commitment with local or foreign legal, regulatory, judicial, administrative, public or law enforcement body, or governmental, tax, revenue, monetary, securities or futures exchange, court, central bank or other authorities, or self-regulatory or industry bodies or associations of financial service providers or any of their agents with jurisdiction over all or any part of the HSBC Group (together the “Authorities” and each an “Authority”) that is assumed by, imposed on or applicable to us or any member of the HSBC Group; or
      4. any agreement or treaty between Authorities;
    11. complying with any obligations, requirements, policies, procedures, measures or arrangements for sharing data and information within the HSBC Group and/or any other use of data and information in accordance with any programmes for compliance with sanctions or prevention or detection of money laundering, terrorist financing or other unlawful activities;
    12. conducting any action to meet our obligations or those of any member of the HSBC Group to comply with Laws or international guidance or regulatory requests relating to or in connection with the detection, investigation and prevention of money laundering, terrorist financing, bribery, corruption, tax evasion, fraud, evasion of economic or trade sanctions and/or any acts or attempts to circumvent or violate any Laws relating to these matters;
    13. meeting our obligations or those of any member of the HSBC Group to comply with any demand or request from the Authorities;
    14. enabling actual or proposed assignee(s) of all or any part of our business and/or assets, or participant(s) or sub-participant(s) of our rights in respect of you to evaluate the transaction intended to be the subject of the assignment, participation or sub-participation and enabling the actual assignee(s) to use your data in the operation of the business or rights assigned; and
    15. any other purposes relating to the purposes listed above.

    Disclosure of Data

    e. Data held by us or a member of the HSBC Group will be kept confidential but we or a member of the HSBC Group may provide data to the following parties or any of them (whether within or outside Hong Kong) for the purposes set out in paragraph (d) above:

    1. any agents, contractors, sub-contractors or associates of the HSBC Group (including their employees, officers, agents, contractors, service providers and professional advisers);
    2. any third party service providers who provide services to us or any member of the HSBC Group in connection with the operation or maintenance of our business (including their employees and officers);
    3. any Authorities;
    4. any persons under a duty of confidentiality to us or a member of the HSBC Group which have undertaken to keep such data confidential;
    5. the drawee bank providing a copy of a paid cheque (which may contain data about the payee) to the drawer;
    6. any persons acting on your behalf whose data are provided, payment recipients, beneficiaries, account nominees, intermediary, correspondent and agent banks, clearing houses, clearing or settlement systems, market counterparties, upstream withholding agents, swap or trade repositories, stock exchanges, companies in which you have an interest in securities (where such securities are held by us or any member of the HSBC Group) or any persons making any payment into a customer’s account
    7. credit reference agencies (including the operator of any centralized database used by credit reference agencies), and, in the event of default, to debt collection agencies;
    8. any persons to whom we are or any member of the HSBC Group is under an obligation or required or expected to make disclosure for the purposes set out in, or in connection with, paragraph (d)(x), (d)(xi) or (d)(xii) above;
    9. any actual or proposed assignee(s) of ours or participant(s) or sub-participant(s) or transferee(s) of our rights in respect of you;
    10. any persons giving or proposing to give a guarantee or security to guarantee or secure your obligations to us; and
      1. any member of the HSBC Group;
      2. third party financial institutions, insurers, credit card companies, securities and investment services providers;
      3. third party reward, loyalty, co-branding and privileges programme providers;
      4. co-branding partners of ours or any member of the HSBC Group (the names of such co-branding partners will be provided during the application process for the relevant products and services, as the case may be);
      5. charitable or non-profit making organisations and
      6. external service providers that we or any member of the HSBC Group engage(s) for the purposes set out in paragraph (d)(vii) above.

    Such data may be transferred in and to a place outside Hong Kong.

    Provision of Data to Credit Reference Agencies (CRA) and Debt Collection Agencies

    A. We may provide the following data relating to you (whether in sole name or joint names with others) to CRAs:

    1. full name;
    2. capacity in respect of each mortgage (as borrower, mortgagor or guarantor);
    3. Hong Kong Identity Card Number or travel document number or certificate of incorporation number;
    4. date of birth or date of incorporation;
    5. correspondence address;
    6. mortgage account number in respect of each mortgage;
    7. type of the facility in respect of each mortgage;
    8. mortgage account status in respect of each mortgage (e.g. active, closed, write-off); and
    9. if any, mortgage account closed date in respect of each mortgage.

    CRAs will use the above data for the purposes of compiling a count of the number of mortgages from time to time held by you (as borrower, mortgagor or guarantor, whether in sole name or joint names with others) with credit providers for sharing in the consumer credit databases of CRAs by credit providers.

    B. You can instruct us to make a request to the relevant CRA to delete from its database any account data relating to any credit that has been terminated by full repayment provided that there has not been, within five (5) years immediately before such termination, a default in payment under the credit for a period in excess of sixty (60) days according to our records

    C. If there is any default in payment, unless the amount in default is fully repaid or written off (other than due to bankruptcy order) before the expiry of sixty (60) days from the date of default, your account repayment data may be retained by CRAs until the expiry of five (5) years from the date of final settlement of the amount in default.

    D. In the event of any amount being written-off due to a bankruptcy order being made against you, CRAs may retain your account repayment data until the earlier of (i) the expiry of five (5) years from the date of final settlement of the amount in default, or (ii) the expiry of five (5) years from the date of your discharge from bankruptcy as notified to CRA(s) by you with evidence.

    E. For the purposes of paragraphs C and D above, account repayment data are the amount last due, amount of payment made during the last reporting period, remaining available credit or outstanding balance and default data (being amount past due and number of days past due, date of settlement of amount past due, and date of final settlement of amount in material default (that is, default in payment for a period in excess of sixty (60) days) (if any)).

    Use of Data in Direct Marketing

    f. Where you are a customer, we intend to use your data in direct marketing and we require your consent (which includes an indication of no objection) for that purpose. Please note that:

    1. your name, contact details, products and other service portfolio information, transaction pattern and behavior, financial background and demographic data held by us from time to time may be used by us in direct marketing;
    2. the following classes of products, services and subjects may be marketed:
      1. financial, insurance, credit card, banking and related products and services;
      2. reward, loyalty, co-branding or privileges programmes and related products and services;
      3. products and services offered by our co-branding partners (the names of such co-branding partners will be provided during the application for the relevant products and services, as the case may be); and
      4. donations and contributions for charitable and/or non-profit making purposes;
    3. the above products, services and subjects may be provided by or (in the case of donations and contributions) solicited by us and/or:
      1. any member of the HSBC Group;
      2. third party financial institutions, insurers, credit card companies, securities and investment services providers;
      3. third party reward, loyalty, co-branding or privileges programme providers;
      4. co-branding partners of ours or any member of the HSBC Group (the names of such co-branding partners will be provided during the application of the relevant products and services, as the case may be); and
      5. charitable or non-profit making organisations;
    4. in addition to marketing the above products, services and subjects ourselves, we may provide the data described in paragraph (f)(i) above to all or any of the persons described in paragraph (f)(iii) above for use by them in marketing those products, services and subjects, and we require your written consent (which includes an indication of no objection) for that purpose; and
    5. we may receive money or other property in return for providing the data to the other persons in paragraph (f)(iv) above and, when requesting your consent or no objection as described in paragraph (f)(iv) above, we will inform you if we will receive any money or other property in return for providing the data to the other persons.

    If you do not wish us to use or provide to other persons your data for use in direct marketing as described above, you may exercise your opt-out right by notifying us.

    Transfer of Data to Third Party Service Providers Using Bank Application Programming Interfaces (API)

    g. We may, in accordance with your instructions to us or third party service providers engaged by you, transfer your data to third party service providers using our API for the purposes notified to you by us or third party service providers and/or as consented to by you in accordance with the Ordinance.

    Provision of Another Person’s Data

    h. Where you provide to us data about another person, you should give to that person a copy of this Notice and, in particular, tell him/her how we may use his/her data.

    Data Access Requests

    i. You have the right:

    1. to check whether we hold data about you and to access such data;
    2. to require us to correct any data relating to you which is inaccurate;
    3. to ascertain our policies and practices in relation to data and to be informed of the kind of data held by us; and
    4. in relation to consumer credit, to be informed on request which items of data are routinely disclosed to credit reference agencies or debt collection agencies, and be provided with further information to enable the making of access and correction requests to the relevant credit reference agency(ies) or debt collection agency(ies).

    j. In accordance with the provisions of the Ordinance, we have the right to charge a reasonable fee for the processing of any data access request.

    k. You should send requests for access to data or correction of data or for information regarding policies and practices and kinds of data held to:
    The Data Protection Officer
    The Hongkong and Shanghai Banking Corporation Limited
    PO Box 72677
    Kowloon Central Post Office
    Hong Kong
    E-mail: dfv.enquiry@hsbc.com.hk

    l. We may have obtained credit report(s) on you from credit reference agency(ies) in considering any application for credit. In the event you wish to access the credit report(s), we will advise the contact details of the relevant credit reference agency(ies).

    m. Nothing in this Notice shall limit your rights as a data subject under the Ordinance.

    Note: In case of discrepancies between the English and Chinese versions, the English version shall apply and prevail.

    *You may be subject to an earlier version of this Notice (known as Notice to Customers relating to the Personal Data (Privacy) Ordinance) if you have not consented to subsequent changes to the earlier notice.

    Personal Information Collection Statement for HSBC Mandatory Provident Fund

    For more information, please click here (PDF, 20KB).