PRIVACY STATEMENT

The Hong Kong Institute of Certified Public Accountants takes the privacy of your information seriously. This policy statement provides information on the obligations and policies of the Institute under the Personal Data (Privacy) Ordinance, Cap 486.

Our Privacy Policy

When the Institute collects information from you, it is our policy to meet fully the requirements of the ordinance, which regulates the treatment of personal data. Throughout this policy, the meaning of the term “personal data” is as defined in the ordinance. In dealing with personal data, we will ensure compliance by our staff with the standards of security and confidentiality prescribed under the ordinance.

This statement explains our practice in relation to the collection, retention, storage and sharing of personal data.

Statement of Practices

Types of Personal Data Collected

The type of personal information collected includes, but is not limited to:

• your name;
• your gender;
• your nationality;
• your Hong Kong identity card number;
• your passport number and place of issue;
• your electronic mail address;
• your residential, business and postal mailing address;
• your home and work telephone number(s);
• your home and work facsimile number(s);
• your mobile number;
• your academic qualification;
• your professional attainments;
• your employment details and practical experience in accountancy;
• your interests;
• your credit card number and expiry date;
• your membership number.

Online users

Our servers may automatically collect data about your Internet address when you visit us. This information, known as an internet protocol address, or IP address, is a number that is automatically assigned to your computer by your internet service provider whenever you are on the internet. When you request pages from our site, our servers may log your IP address and, if applicable, your domain name. Your IP address is used to help identify you and to gather demographic information about our members and users as a whole, but does not include personally identifiable information. Our server may also record the referring page that linked you to us (e.g., another web site or a search engine); the pages you visit on this site; the web site you visit after this site; other information about the type of web browser, computer, platform, related software and settings you are using; any search terms you have entered on this site or a referral site; and other web usage activity and data logged by our servers. We use this information for internal system administration, to help diagnose problems with our servers, and to administer our services.

Cookies are pieces of information that a website transfers to an individual's hard drive for record keeping. Cookies make web-surfing easier by saving preferences and browsing patterns while you are at the site. Cookies may be used to analyze the site usage, improve content, customize the site's content and layout and for other customer service purposes. A cookie may enable us to relate your use of our site to other information about you, including your personal information. All of these purposes serve to improve and personalize your experience on our site. Most web browsers can be set to inform you when a cookie has been sent to you and provide you with the opportunity to refuse that cookie. However, refusing a cookie may, in some cases, preclude you from using, or negatively impact the display or function of, the site or certain areas or features of the site.

Disclaimer: We cannot be responsible for the privacy policies and practices of other sites even if you access them using links from our site and recommend that you check the policy of each site you visit and contact its owner or operator if you have any concerns or questions. In addition, if you linked to this site from a third party site, we cannot be responsible for the privacy policies and practices of the owners or operators of that third party site and recommend that you check the policy of that third party site and contact its owner or operator if you have any concerns or questions.

Use of personal data

Your personal data may be used for one or more of the following purposes or any purposes directly related to them:

• verify your identity;
• to administer the Professional Accountants Ordinance – Cap. 50 and Professional Accountants By-laws ;
• to process any application or enrolment request that you may make under the PAO and By-laws;
• for the promotion and provision of various membership services to you;
• for the purposes of performing the Institute's statutory functions under the PAO and By-laws, including organizing examinations and handling of complaints, investigation, practice reviews or disciplinary action;
• to consider any nomination for committee appointment and/or participation in the Institute's special projects;
• to fulfill your specific request, application, enrolment or nomination relating to our services;
• to process your complaints, enquiries or feedback;
• to collect information with regard to use of forums or discussion groups maintained by the Institute for research or statistical purposes;
• other purposes as permitted by law;
• any other purposes as maybe agreed between you and the Institute.

The provision of personal data or any information is voluntary, however, failure to provide the requested personal data may result in the Institute being unable to process your request, perform its statutory functions or deliver its services to you.

The Institute may occasionally use the personal data collected to send you materials regarding our services via your choice of communication channel. You may opt out from receiving such materials at any time by sending an e-mail to us at support@citylinkers.com.hk or a letter to the Institute's privacy officer.

Data Retention

Unless otherwise agreed, hard copies of any documents containing your personal data that you provide to the Institute will become the property of the Institute and will not be returned to you. Personal data will be retained only for such period as may be necessary for carrying out the purposes stated in this policy or as otherwise specified at the time of collection. The Institute will destroy any personal data it holds in accordance with its internal policy.

Disclosure and Sharing of Personal Information

Personal data held by the Institute will be kept confidential but the Institute may, where such disclosure or transfer is necessary to satisfy the purpose, or directly related purpose, for which the data was collected, provide such information or copies to the following relevant parties:

• authorized personnel including contractors, consultants and lawyers for performing various statutory functions under the PAO and By-laws on behalf of the Institute;
• other accountancy bodies (local and overseas);
• government bodies and other regulators as required under the law or pursuant to any regulatory arrangements between the Institute and the relevant government body or regulator;
• any person under a duty of confidentiality to the Institute and who has undertaken to keep such information confidential, provided that such person has a legitimate right to such information;
• any person to whom we are required to make disclosure under any law applicable in Hong Kong.

Personal data may also be disclosed to any person or persons pursuant to any statutory or contractual obligations or as required by court of law, provided such person or persons are able to prove the required right or authority to access such information. In addition, personal data may be disclosed under any of the circumstances described in part VIII of the ordinance in which the concerned personal data are exempt from the provisions of data protection principle 3 of the ordinance.

Except as stated above or with your prior consent, the Institute will not transfer or disclose your personal information to any third party.

The Institute will do its best to ensure compliance with the ordinance by providing guidelines to and monitoring compliance of the relevant parties listed above. However, the Institute cannot control how third parties use your personal information and assumes no responsibility for the privacy protection provided by such third parties.

Transfer of personal data outside of Hong Kong

At times it may be necessary and prudent for the Institute to transfer certain personal data to places outside of Hong Kong SAR in order to carry out the purposes, or directly related purposes, for which the personal data were collected. Where such a transfer is performed, it will be done in compliance with the requirements of the ordinance.

Security

When collecting personal data over the internet, the Institute will secure the transmission as appropriate according to the nature of the data being collected. All information stored in our computer system is protected from access by unauthorized users.

Where personal data is stored electronically, it will be kept in a password-protected form. Personal data, whether stored in electronic form on computers or in hard-copy form will be accessible only by authorized officers or employees of the Institute. Information that is stored in document form is kept in secure, locked offices to prevent access by unauthorized persons. Persons designated by the Institute to handle personal data will be made acquainted with this privacy policy and told how to fulfill our obligations to you.

Personal information access and correction

You have the right to request access to your personal data in accordance with the provisions of the ordinance. Your right of access includes the right to obtain a copy of the personal data the Institute holds about you. A charge will be made to cover the cost of photocopying personal data supplied in response to a data access request.

You may also exercise your right of correction by writing to the Institute's privacy officer at the address listed below, specifying the data obtained through the data access request mentioned above which needs to be corrected.

Satisfactory proof and explanation of the inaccuracy is essential before the Institute will correct the data.

Upon satisfying itself of the authenticity and validity of the correction request, the Institute will comply with and respond to the request as required under the ordinance.