1. Introduction

Ping An Digital Bank (International) Limited, together with its affiliates (collectively, “we”, the “Bank” or “Ping An Digital Bank”) are committed to protecting personal data in accordance with the Personal Data (Privacy) Ordinance (Chapter 486 of the Laws of Hong Kong) (the “PDPO”).

We will only collect, use, transfer or disclose personal data in accordance with the PDPO, our Personal Information Collection Statement (“PICS”) and this Privacy Policy (“Privacy Policy”).

We may amend this Privacy Policy at any time and for any reason. The updated version will be available on our website at www.pingandb.com. You should check the Privacy Policy regularly for changes.

In this Privacy Policy, unless inconsistent with the context or otherwise specified,

“data subject(s)” has the meaning given to it in the PDPO and includes applicants or accountholders for the Bank’s products and services, customers, security providers, guarantors, referees, corporate officers and managers, (e.g. authorised signatories, contact persons, company secretary, directors, shareholders, beneficial owners of a corporate), trustees, settlors, protectors, beneficiaries, suppliers, agents, contractors, service providers and other contractual counterparties and any third party transacting with or through the Bank; and

“personal data” means any data:

(a) relating directly or indirectly to a living individual;

(b) from which it is practicable for the identity of the individual to be directly or indirectly ascertained; and

(c) in a form in which access to or processing of the data is practicable.

2. When and what personal data do we collect

The types of personal data we collect from a data subject will depend on the circumstances in which that information is collected. If the personal data that we request from a data subject is not provided, we may be unable to provide or continue to provide products and services to the data subject.

The personal data collected and compiled by Ping An Digital Bank usually includes the full name, identity card number, date of birth, address, contact details, information relating to bank accounts and transactions, geographic data and location data collected from a data subject’s electronic device or otherwise and biometric data (including, without limitation, fingerprint or facial recognition data) of a data subject. Where facial recognition or authentication is required in connection with our products or services, we may collect a facial image, including a selfie captured for liveness detection and identity verification purposes (“Face Data”).

We may collect personal data about a data subject when the data subject:

  • use our online platform and request for services, product or activities – including the data subject’s identity and contact details, geographic data and location data, the data subject’s biometric data, financial information about the data subject, information about the data subject’s income and existing investments;
  • apply to open an account with us and use this account, and during the continuation of the bank-customer relationship – including financial information about the data subject, information about the data subject’s income and existing investments;
  • are a signatory, shareholder or director or officer or guarantor of a corporation or a person related to an unincorporated body opening an account with us – including the data subject’s identity and contact details;
  • apply for employment with us – including the data subject’s identity and contact details, information about the data subject’s skills and abilities, bank account information for payroll purposes, details regarding family members for medical insurance purposes, information about criminal record and other information relevant to our compliance obligations; or
  • send us correspondence – including the data subject’s contact details in order to respond to the data subject.

3. What do we use personal data for

The purposes for which a data subject’s personal data may be used will depend on the circumstances in which that personal data is collected.

We will inform the data subject of the purposes for which we intend to use the data subject’s personal data and the classes of persons to whom his/her data may be transferred (among other things) in the PICS at or before the time we collect the data subject’s personal data.

Generally, we may use a data subject’s personal data for:

  • the purpose for which the data subject provided it to us;
  • purposes which are directly related to the purpose for which the data subject provided it to us;
  • any other purposes to which the data subject has consented;
  • complying with any law and regulation binding on us, and any guideline or notice given or issued by any legal, regulatory, governmental, tax, law enforcement or other authorities, or self-regulatory or industry bodies or associations in connection with us and our products and services;
  • complying with the obligations, requirements or arrangements for disclosing and using personal data that apply to the Bank or that the Bank is expected to comply with according to:

    (1) any law in or outside Hong Kong, whether existing currently or in the future, including the laws relating to the detection, investigation and prevention of money laundering, terrorist financing, bribery, corruption, tax evasion, fraud, evasion of economic or trade sanctions or other unlawful activities, and/or acts or attempts to circumvent or violate these laws (collectively, the “Crime-countering Matters”) (e.g. the Hong Kong Inland Revenue Ordinance requiring automatic exchange of financial account information amongst tax authorities in Hong Kong and overseas);

    (2) any guideline, direction, demand or request given or issued by any local or foreign legal, regulatory, governmental, tax, law enforcement or other authorities, self-regulatory or industry bodies of financial institutions, or stock exchanges (collectively, the “Authorities and Organisations”), whether existing currently or in the future, including those relating to any law or Crime-countering Matters (e.g. guideline issued by the Hong Kong Inland Revenue Department on automatic exchange of financial account information);

    (3) any present or future contractual or other commitment with any of the Authorities and Organisations that is assumed by or imposed on the Bank by reason of its financial, commercial, business or other interests or activities in or related to the jurisdiction of the relevant Authority or Organisation; and

  • comparing or matching personal data, whether or not for the purpose of taking adverse action against the data subject.

For example, we may use a data subject’s personal data when the data subject:

  • use our online platform – to process and evaluate the data subject’s application, open and administer an account, verify the data subject’s identity, provide banking, investment or other financial services to the data subject, conduct credit checks and providing credit facilities to the data subject, assist securities brokerage firms or funds houses and their related service providers or other financial institutions to conduct credit checks, collect amounts from the data subject and pay amounts to the data subject, provide security for the data subject’s obligations, design new financial services and products, detect, investigate and prevent fraudulent or criminal activities, malware, or unauthorised access to the data subject’s account and make any disclosure or transfer that is permitted or required by law;
  • use Face Data in connection with our online platform, products or services – to conduct liveness detection, establish and verify the data subject’s identity, authenticate the data subject in connection with an application, instruction, transfer or transaction, protect the security of the data subject’s account, and detect, investigate and prevent impersonation, fraud or unauthorised access;
  • apply for products/services and/or to open an account with us – to process and evaluate the data subject’s application, open and administer an account, provide products/services to the data subject, conduct credit checks and providing credit facilities to the data subject, assist securities brokerage firms or funds houses and their related service provider or other financial institutions to conduct credit checks, collect amounts from the data subject and pay amounts to the data subject, provide security for the data subject’s obligations, design new financial services and products, and make any disclosure or transfer that is permitted or required by law;
  • are a signatory, shareholder or director or officer or guarantor of a corporation or a person related to an unincorporated body opening an account with us – to register the data subject as a signatory or guarantor and comply with legal requirements;
  • apply for employment with us – to evaluate the data subject’s application, administer payroll, benefits and taxation, performance evaluations, promotions, disciplinary matters, contingency planning, training, recruitment, diversity planning, provision of references to third parties, internal reorganisation of employees, and comply with legal requirements, and make any disclosure or transfer that is permitted or required by law; and
  • send us correspondence – to respond to the data subject.

4. Our use of cookies

By accessing our online platform, you acknowledge that you have been informed of the practice of using cookies and authorise us to use any information collected through our use of cookies in connection with the purpose set out in this Privacy Policy. “Cookies” are data files stored on your electronic devices (such as your computer or mobile phone) after you access certain websites or mobile applications.

Cookies are primarily used to identify visitors when they return to a site, so that certain information already provided by the visitor to a site is not required to be provided again. Cookies are also used to gather data on which areas of a site or app are visited frequently and which are not. Keeping data on which areas of a site are most popular allows a site operator to better plan and enhance the site.

We use the following cookies:

Strictly Necessary Cookies: These are essential for the running of our website and mobile apps. They are required to:

  • Allow our web server to determine the cookies setting and whether data can be collected from your web browser
  • Temporarily allow you to carry information between pages in our website to avoid re-enter that information
  • Temporarily identify your devices after log-in and maintain a dialogue between our web server and your web browser in order to maintain certain activities
  • We use the following Strictly Necessary Cookies:

    • _ga
    • _gat

Performance Cookies: These cookies are only used to improve our websites and identify issues that you may have when using our services. They help us to improve the customer experience and help us to provide better services to you. The information collected in these cookies are anonymous.

Functionality and Profile Cookies: These cookies help our website to remember your preferences and can help us to provide tailor services and features to you. These cookies may be used to ensure that all our services and communications are relevant to you. The tracking is only within Ping An Digital Bank websites or apps and the information in these cookies collect cannot track your browsing activity on other websites. Our website cannot remember your choices previously made or personalised your browsing experience without these cookies.

Marketing Cookies: These cookies and similar technologies are used to get the information about browsing habits. They remember a previous visit and may share this information with others, such as marketing companies and advertisers in order to deliver contents that are more relevant to your interests. Although these cookies and similar technologies are capable of tracking visits to other websites, they usually do not know who you are.

We acknowledge that you may wish to disable cookies. This can be done by changing your web browser settings, but may result in more limited functionality and you may not be able to utilise or activate certain functions available on our online platform.

5. Do we use personal data for direct marketing

We do use some of the personal data we collect to send marketing material and special offers to the intended recipients via telemarketing, electronic means, direct mail or such other appropriate means, but only in accordance with the rules about direct marketing contained in the PDPO.

Personal data used in direct marketing may include the name, contact details, products and services portfolio information, transaction pattern and behaviour, geographic data and location data, financial background and demographic data of a data subject held by the Bank from time to time.

If we intend to use any personal data of a data subject for direct marketing purposes or provide any personal data of a data subject to third parties for direct marketing purposes, we will inform the data subject beforehand according to the PICS or in any other manner. We will provide the data subject with an opportunity to opt-out of direct marketing at that time.

If a data subject does not opt-out of direct marketing at that time, but the data subject later decides that he/she no longer wishes to receive direct marketing, he/she may ask us to cease any further direct marketing by contacting the Data Protection Officer at the address below.

The following classes of services, products and subjects may be marketed:

  • financial, insurance, cards (including credit card, debit card, payment card and stored value card), securities, investment, banking and related services and products;
  • reward, loyalty or privileges programmes and related services and products;
  • services and products offered by the Bank’s co-branding partners (the names of such co- branding partners can be found in the application form(s) for the relevant services and products, as the case may be); and
  • donations and contributions for charitable and/or non-profit making organisations.

6. To whom do we disclose personal data

Personal data held by us will be kept confidential but we may provide or disclose the personal data to third parties from time to time for the following purposes.

The classes of third parties to whom we may disclose a data subject’s personal data are set out in the PICS.

Generally, we may disclose a data subject’s personal data as necessary for:

  • the purpose for which the data subject provided it to us;
  • purposes which are directly related to the purpose for which the data subject provided it to us; and
  • any other purposes to which the data subject has consented.

For example, we may disclose a data subject’s personal data to:

  • third party agents, contractors, advisors who provide administrative, communications, computer, payment, security or other services which assist us to carry out the above purposes (including telemarketers, mailing houses, IT service providers, data processors, etc.);
  • our legal and professional advisors;
  • our related companies (as that term is defined in the Companies Ordinance (Chapter 622 of the Laws of Hong Kong));
  • any other person under a duty of confidentiality to the Bank including a group company of the Bank which has undertaken to keep the personal data confidential;
  • government agencies and authorities as required by any law, regulation, rule or codes binding on us or our related companies; and
  • any other person to whom the data subject has consented.

Where personal data is transferred to place(s) outside of Hong Kong in connection with such purposes, such place(s) may or may not offer the same or a similar level of personal data protection as in Hong Kong.

Except as set out below, Face Data is collected, processed and stored internally by the Bank and is not disclosed to any third party. We may disclose Face Data where required or permitted by applicable law or regulatory requirements, or where authorised by the data subject. Where Face Data is disclosed to a third party acting on our behalf or pursuant to the data subject’s authorisation, we will require that third party to use it only for the purpose of disclosure and provide the same or an equivalent level of protection as described in this Privacy Policy. Where disclosure is made to a governmental, regulatory, judicial or law enforcement authority, we will take all reasonably practicable steps to protect the Face Data in accordance with applicable laws and regulations.

7. Use of algorithmic assessments, big data analytics and artificial intelligence (“BDAI”)

We may use certain algorithms and BDAI technologies and applications for various purposes, including without limitation for the purpose of considering and processing your application for our products and services, providing our products and services to you (which may also involve the use of customer-facing BDAI tools), carrying out risk assessments, and to detect crime and money laundering activities. Generally, artificial intelligence refers to a family of technologies that mimic human intelligence and involve the use of computer programmes and machines to perform or automate tasks, including solving problems, providing recommendations and predictions, making decisions and generating contents by inferring from input data. BDAI involves computers generally to mimic human intelligence, so that they can learn, sense, think and act in order to achieve automation and gain analytics insights from large volumes of structured and unstructured data created by the preservation and logging of activity from human, tools and machines. Examples of BDAI include machine learning, biometric authentication technology, natural language processing, decision tree, internet cookies and web logs.

The algorithms and BDAI may provide automated assessments and decisions based on the data we collect from data subjects, which may be personal and non-personal data. We will always ensure that the parameters selected and used in the algorithmics and BDAI assessments would have been selected to provide a fair and objective assessment of data subject’s personal data, and they must also be tested for reliability and fairness. We have in place robust policies and procedures to ensure the security and integrity of data, and the use of BDAI is fair and in accordance with applicable laws and regulations. Our fundamental principles for the use of algorithmic assessments and BDAI are that we will ensure the benefits brought by the application of technology outweigh the risks, and we remain responsible for all the automated decisions made and contents generated.

We may, by ourselves or via our service providers, use BDAI for: (a) analysing statistics, trends, markets, behaviour, usage patterns, customer segments and pricing; (b) planning, research and developments, designing services or products, improving customer experience; (c) predicative modelling; (d) performing credit, anti-money laundering, fraud prevention and other risk assessments; and (e) any other purposes relating thereto. For more information on how we will use your personal data, please see our Personal Information Collection Statement.

The accuracy of assessments and decisions generated by the algorithms and BDAI tools will largely depend on the accuracy of the personal data provided. If we are uncertain about the accuracy of the data that may be used in an assessment, we will endeavour to seek clarification from you. You may also enquire or request reviews on the decisions made by our BDAI applications via the channels which we may designate from time to time. There may be certain other risks associated with the use of algorithms and BDAI, including, but not limited to, risks related to input data, design (e.g. coding errors) as well as output decisions (e.g. incorrect interpretation of the output).

In order to manage the abovementioned risks and issues associated with algorithmic assessments and BDAI tools, we will ensure that appropriate human oversight is in place for the assessments. Should you have any enquiries, or if you wish to review the decisions made by the algorithmic assessments and BDAI tools, you may contact our customer service hotline at +852 3762 9900. In the event that you wish to make any complaint against our use of algorithmic assessments and BDAI tools, you may contact us via [email protected].

8. How is personal data secured?

We will take all reasonably practicable steps to ensure that personal data relating to a data subject is protected against unauthorised access, disclosure, processing, erasure, loss or use. These steps include restricting access to personal data to the relevant officers and employees of the Bank, providing relevant training to the officers and employees of the Bank regarding proper handling of personal data, and applying encryption or other technology to protect the personal data. We require our service providers and other third parties that handle, access or process personal data on our behalf to implement similar confidentiality, data privacy and security standards and measures comparable to ours. If Face Data is disclosed in accordance with Section 6, the recipient will be required, where applicable, to provide the same or an equivalent level of protection as described in this Privacy Policy. Face Data is stored in the Bank’s systems and protected by appropriate technical and organisational measures, including access controls, encryption or other security technology, having regard to the nature and sensitivity of the data.

9. Retention of personal data

We will take all reasonably practicable steps to ensure that personal data relating to a data subject is not kept longer than is necessary for the fulfilment of the purposes for which the data is collected. Once the purposes for which personal data was retained have been fulfilled and we no longer need to keep it in order to comply with applicable legal or regulatory requirements or in accordance with our internal data retention policy, we will take steps to delete, destroy and/or stop using it.

Face Data will be retained only for as long as reasonably necessary for the purposes for which it was collected, including identity verification, authentication, account and transaction security and fraud prevention, and as required or permitted by applicable legal or regulatory requirements and our internal data retention policy. When Face Data is no longer required for those purposes, we will take steps to delete, destroy, anonymise and/or stop using it in accordance with our internal data retention and deletion procedures. For a completed application where a customer relationship is established, Face Data may be retained for the duration of that relationship and thereafter for the period required or permitted by applicable legal or regulatory requirements and our internal data retention policy. For an application that is cancelled, withdrawn, unsuccessful or rejected, Face Data will be deleted after the applicable application and regulatory record-retention period expires, unless continued retention is required or permitted by applicable legal or regulatory requirements or is reasonably necessary for audit, security, fraud prevention, dispute resolution or record-keeping purposes.

Where we rely on a data subject’s consent to collect or use personal data, including Face Data, the data subject may withdraw that consent or request deletion of his/her Face Data by contacting the Data Protection Officer using the contact details in Section 10. We will process the request in accordance with applicable legal and regulatory requirements. Withdrawal of consent will not affect any processing carried out before the withdrawal takes effect. We may retain Face Data where required or permitted by applicable legal or regulatory requirements or where reasonably necessary for audit, security, fraud prevention, dispute resolution or record-keeping purposes. Withdrawal of consent or deletion of Face Data may affect our ability to verify or authenticate the data subject or provide the relevant products, services or functions.

10. Accessing, correcting or making other requests concerning your personal data

A data subject may contact us to seek access to or correction of the personal data which we hold about him/her, withdraw consent where the relevant processing is based on consent, request deletion of personal data (including Face Data), or enquire about our data privacy policies and practices. There are certain exemptions under the PDPO which may apply to personal data access and correction requests. We may require the person making a data access or correction request to provide necessary information to verify his/her identity and right to access or correct the personal data. We may charge an administration fee for complying with a data access request which must not be excessive.

Requests for access to or correction or deletion of personal data, withdrawal of consent, or enquiries about our data privacy policies and practices should be addressed to:

The Data Protection Officer
Ping An Digital Bank (International) Limited
Rooms 1903-1904, 19th Floor, NEO Building
123 Hoi Bun Road
Kowloon
Hong Kong

11. If there is any inconsistency between the English and Chinese versions of this Privacy Policy, the English version shall prevail.