Effective as of [May 2021]
HashKey XPert Limited (together with its affiliates, “XPERT COMPANY”) or known as HashKey XPert is committed to protecting the privacy, confidentiality, and security of the personal data held by HashKey XPert complying with the requirements of Personal Data (Privacy) Ordinance (Cap. 486) (“PDPO”) with respect to the management of personal data. Meanwhile, HashKey XPert is equally committed to ensuring that all its employees and agents uphold these obligations.
HashKey XPert will take reasonable and practicable steps to ensure the security of the users’ personal data and to avoid unauthorised or accidental access, erasure or use for other purposes. This includes physical, technical, and procedural security methods, where appropriate, to ensure that the users’ personal data may only be accessed by authorised personnel.
Please note that if the users do not provide HashKey XPert with personal data (or relevant personal data relating to persons appointed by the users to act on their behalf), HashKey XPert may not be able to provide the information, products or services the users have asked for or process the users’ requests, applications, subscriptions or registrations.
From time to time HashKey XPert may collect the users’ personal data in relation to identification information and contact details, including but not limited to the user’s name, government-issued ID, mailing address, mobile number, email address, and login name for the following purposes:
◊ processing the users’ applications and registration for using or accessing HashKey XPert’s products and services;
◊ providing the users with HashKey XPert’s products and services and administering the users’ account in relation to such products and services;
◊ the daily operations of the services provided by HashKey XPert to the users and designing services or related products for the users’ use;
◊ conducting due diligence (“Know-you-customer”), Anti-Money Laundering and Counter-Terrorism Financing review or credit enquiries or checks relating to the users and observing any legal, regulatory or other requirements to which any HashKey XPert’s associated entities or any other persons may be subject;
◊ giving effect to user’s orders relating to transactions or otherwise, and carrying out user’s other instructions;
◊ determining and collection of amounts due, enforcement of security, charge or other rights and interests in favour of HashKey XPert and any HashKey XPert’s associated entities;
◊ marketing existing and future services or products of any HashKey XPert’s associated entities;
◊ to enforce or defend the rights of any members of HashKey XPert and its associated entities and their employees, officers, and agents; and
◊ for other purposes directly relating to any of the above.
Passport or Identity Card Number
HashKey XPert may also collect and process the users’ passport or identity card number in compliance with PDPO (for example, conducting Anti-Money Laundering and Counter-Terrorism Financing review for the prevention or detection of crime) for the purpose of identifying the users.
Utilisation of the users’ personal data
HashKey XPert may be required to retain, process and/or disclose the users’ personal data to the following parties, to which HashKey XPert does not assume any liability for any loss or damage that the user may sustain, in order to
(1) comply with applicable laws and regulations;
(2) comply with a court order, subpoena or other legal process (whether in Hong Kong or elsewhere);
(3) comply with a request by a government authority, law enforcement agency or similar body (whether situated in Hong Kong or elsewhere);
(4) provide to the third-party database for submitting behaviors concerning anti-money laundering, terrorism financing, and evading trade and economic sanctions;
(5) provide to a third party which provide services (such as legal, financial, management, operation, market surveillance or technical services) or is associated or acting as a nominee to HashKey XPert;
(6) provide to any third party to whom HashKey XPert’s businesses or any part of HashKey XPert’s businesses will be sold, assigned or transferred to, if applicable; or
(7) HashKey XPert may need to retain, process and/or disclose the users’ personal data in order to enforce any agreement with the users, protect HashKey XPert’s rights, property or safety, or the rights, property or safety of HashKey XPert’s employees.
Such information may be transferred to a place outside Hong Kong.
Termination or cancellation
Should the users’ account or relationship with HashKey XPert be cancelled or terminated at any time, HashKey XPert shall cease processing the users’ personal data as soon as reasonably practicable following such cancellation or termination, provided that HashKey XPert may keep copies of the users’ data as is reasonably required for reasonable purposes, such reasonable purposes shall include keeping of records, use in relation to any actual or potential dispute, complying with applicable laws and regulations, enforcing any agreement HashKey XPert have with the users, and protecting HashKey XPert’s rights, property or safety, or the rights, property or safety of HashKey XPert’s employees.
Retention of the users’ personal data
Personal data provided by the users are retained for as long as the above-mentioned purposes for which such data were collected continue. As a general rule, the maximum retention period will be 7 years from the purposes for those collection are achieved.
Contact HashKey XPert
In accordance with the terms of the PDPO, HashKey XPert has the right to charge a reasonable fee for the processing of any data access request.