• the daily operation of the services and credit facilities provided to Data Subjects or the Bank's corporate customers;
• provision of bank references;
• conducting credit checks (including without limitation upon applications for credit and upon periodic or special reviews of credit) and carrying out matching procedures (as defined in the Ordinance);
• building and maintaining the Bank's credit and risk related systems;
• maintaining a credit track record of Data Subjects (whether or not there exists any relationship between Data Subjects and the Bank) for present and future reference;
• assisting other financial institutions, credit card issuing companies and debt collection agents to conduct credit checks and collect debts;
• monitoring ongoing credit worthiness of Data Subjects;
• designing banking/financial services or related products for Data Subjects' use;
• as a voluntary purpose, marketing of services or products and other subjects;
• determining the amounts of indebtedness owed to or by Data Subjects;
• enforcement of Data Subjects' obligations, collection of debts owed by Data Subjects and from those providing security for Data Subjects' obligations;
• complying with the obligations, requirements or arrangements for disclosing and using data that apply to the Bank or with which it is expected to comply according to:-
  • any law binding or applying to it within or outside the Hong Kong Special Administrative Region ( "Hong Kong" ) existing currently and in the future;
  • any guidelines or guidance given or issued by any legal, regulatory, governmental, tax, law enforcement or other authorities, or self-regulatory or industry bodies or associations of financial services providers within or outside Hong Kong existing currently and in the future; and
  • any present or future contractual or other commitment with local or foreign legal, regulatory, governmental, tax, law enforcement or other authorities, or self-regulatory or industry bodies or associations of financial services providers that is assumed by or imposed on the Bank by reason of its financial, commercial, business or other interests or activities in or related to the jurisdiction of the relevant local or foreign legal, regulatory, governmental, tax, law enforcement or other authority, or self-regulatory or industry bodies or associations;
• complying with any obligations, requirements, policies, procedures, measures or arrangements for sharing data and information within the group of the Bank and/or any other use of data and information in accordance with any group-wide programmes for compliance with sanctions or prevention or detection of money laundering, terrorist financing or other unlawful activities;
• enabling an actual or proposed assignee of the Bank, or participant or sub-participant of the Bank's rights in respect of Data Subjects to evaluate the transaction intended to be the subject of the assignment, participation or sub-participation; and
• fulfilling any other purposes relating thereto.

• the name, contact details, products and services portfolio information, transaction pattern and behaviour, financial background and demographic data of a Data Subject held by the Bank from time to time ("Specified Data") may be used by the Bank in direct marketing;
• the following classes of services, products and subjects ("Specified Services") may be marketed:
  • financial related services and products; and
  • reward, customer loyalty or privileges programmes and related services and products
• the Specified Services may be provided or (in the case of donations and contributions) solicited by the Bank and/or the following persons (the "Marketing Users"):-
  • the Bank's group companies;
  • third party financial institutions, insurers, credit card companies, securities and investment services providers;
  • third party reward, loyalty, co-branding or privileges programme providers;
  • co-branding partners of the Bank and the Bank's group companies (the names of such co-branding partners can be found in the application form(s) for the relevant services and products, as the case may be); and
  • charitable or non-profit making organisations;
• in addition to marketing the Specified Services itself, the Bank also intends to provide the Specified Data to all or any of the Marketing Users for use by them in marketing the Specified Services, and the Bank requires the Data Subject's written consent (which includes an indication of no objection) for that purpose;
• the Bank may receive money or other property in return for providing the data to the Marketing Users in paragraph (f)(iv) above and, when requesting the Data Subject's consent or no objection as described in paragraph (f)(iv) above, the Bank will inform the Data Subject if it will receive any money or other property in return for providing the data to the other persons.
• the Bank and the Marketing Users may also, from time to time, engage third parties to provide marketing services on their behalf, and may share the Specified Data with these third parties for direct marketing purpose.

To indicate consent/ no consent to the use/provision of his/her personal data for direct marketing purpose as described in this paragraph, the relevant Data Subject is required to fill out an "Statement relating to the Use/Provision of Personal Data in Direct Marketing" provided by the Bank ("Statement") or provide the consent/no consent orally to the Bank, where applicable.

If a Data Subject does not wish the Bank to use or provide to other persons his/ her personal data for use in direct marketing as described above and also wants the Bank to advise other persons to stop using his/her data for such direct marketing purpose, the Data Subject may indicate so in the Statement or notify the Bank of the same at any other time.

• head office of the Bank located in the People's Republic of China, any agent, contractor or third party service provider who provides administrative, telecommunications, computer, payment data processing or storage, securities clearing or other services to the Bank in connection with the operation of its business;
• any other person under a duty of confidentiality to the Bank including a group company of the Bank which has undertaken to keep such information confidential;
• the drawee bank providing a copy of a paid cheque (which may contain information about the payee) to the drawer;
• a person making any payment into the Data Subject's account (by providing a copy of a deposit confirmation slip which may contain the name of the Data Subject);
• credit reference agencies, and, in the event of default, also to the debt collection agencies;
• any person to whom the Bank is under an obligation or otherwise required to make disclosure under the requirements of any law binding on or applying to the Bank, or any disclosure under and for the purposes of any guidelines or guidance given or issued by any legal, regulatory governmental, tax, law enforcement or other authorities, or self-regulatory or industry bodies or associations of financial services providers with which the Bank is expected to comply, or any disclosure pursuant to any contractual or other commitment of the Bank with local or foreign legal, regulatory, governmental, tax, law enforcement or other authorities, or self-regulatory or industry bodies or associations of financial services providers, all of which may be within or outside Hong Kong and may be existing currently and in the future;
• any actual or proposed assignee of the Bank or participant or sub-participant or transferee of the Bank's rights in respect of the Data Subject;
• any party giving or proposing to give a guarantee or third party security to guarantee or secure the Data Subject's obligations; and
• also the following parties:-
  • the Bank's group companies;
  • third party financial institutions, insurers, credit card companies, securities and investment services providers;
  • third party reward, loyalty, co-branding and privileges programme providers;
  • co-branding partners of the Bank and the Bank's group companies (the names of such co-branding partners can be found in the application form(s) for the relevant services and products, as the case may be);
  • charitable or non-profit making organisations; and
  • external service providers (including but not limited to mailing houses, telecommunication companies, telemarketing and direct sales agents, call centres, data processing companies and information technology companies) that the Bank engages for the purposes set out in paragraph (e)(ix) above.
  The Bank may disclose data to any or all the parties stated above and may do so notwithstanding that the recipient's place of business is outside Hong Kong, including Mainland China, or that such information following disclosure will be collected, held, processed or used by such recipient in whole or part outside Hong Kong.

• educating the Bank's staff as to their obligations with regard to personal information, including but not limited to data process, handling, storage, retention and destruction;
• employing firewalls, intrusion detection systems and virus scanning tools to protect against unauthorized persons and viruses from entering the Bank's systems;
• using dedicated secure networks or encryption when the Bank transmits electronic data for purposes of outsourcing; and
• ensuring physical security controls in place to protect against unauthorized access to buildings.

The Data Protection Officer

Industrial Bank Co., Ltd. Hong Kong Branch