Mandatory information

Issuance Date: 3 January 2020

Effective Date: 3 January 2020

HSBC Bank (China) Company Limited (“HSBC”, “the Bank”, “we” or “us”) take personal information confidentiality and security very seriously, and strive at all times to protect personal information and privacy of our customers and other related information subject (“you” or “Personal Information Subject”) according to law. We therefore formulate this Personal Information and Privacy Protection Policy (this “Policy”) to help you understand the purposes, methods, and scope of personal information we collect and use, our practices regarding personal information and privacy protection, your rights and interests with regard to personal information and privacy and how to assert your rights and interests. Please read through this Policy carefully and pay particular attention to the provisions that are bolded and/or underlined.

This Policy shall apply to personal information of you and related parties that may be involved when you visit, browse, or use our website or any mobile device application of us, apply for or use any product, device or service of us, handle any business or make any transaction with us, participate in any of our marketing events and surveys, apply for any position with us, and/or in any way contact or correspond with us, no matter the information is provided by yourself or by the related parties, or collected or acquired by us from other sources according to law, regulation, regulatory provision, or based on your or related parties’ authorisation or consent.

The table of content of this Policy is set out as below:

I. How We Protect Your Personal Information

II. How We Collect Your Personal Information

III. How We Use Your Personal Information

IV. How We Store Your Personal Information

V. To Whom We Disclose Your Personal Information

VI. Special Circumstances for Information Collection, Use and Disclosure

VII. How We Use Cookies and Other Technologies

VIII. Your Rights Relating to Personal Information

IX.Protection of Minors’ Personal Information

X.Formulation, Effectiveness and Update of this Policy and Others

We shall collect, use, store, disclose, and protect your and related parties’ personal information in accordance with this Policy. We may separately issue specific privacy policy tailor made for specific channels, products, services, businesses and activities (such as the Personal Information and Privacy Protection Policy for Digital Banking). The specific privacy policy so made shall apply in the specific scenarios as prescribed in such policy. If there is any discrepancy between this Policy and the other agreements entered into or other terms and conditions agreed between you(or relevant parties of which you are representative or with which you have a relationship) and us, such other agreements or terms and conditions shall prevail.

1. Information security is our top priority. We will endeavour at all times to safeguard your personal information against unauthorised or accidental access, processing or damage. We maintain this commitment to information security by implementing appropriate physical, electronic and managerial measures to secure your personal information. We will take responsibility in accordance with the law if your information suffers from unauthorised access, public disclosure, erasure or damage for a reason attributable to us and so impairs your lawful rights and interests.
   
2. The secure area of our website supports the use of Secure Socket Layer (SSL) protocol and 128-bit encryption technology - an existing industry standard for encryption over the Internet to protect data. When you provide personal sensitive information through our website, it will be automatically converted into codes so as to ensure secure transmission afterwards. Our web servers are protected behind “firewalls” and our systems are monitored to prevent any unauthorised access. Our mobile banking application software has passed Unionpay payment application software security test conducted by Bank Card Test Centre.
   
3. We maintain strict security system to prevent unauthorised access to your personal information. We exercise strict management over our staff members who may have access to your personal information, including but not limited to access control applied to different positions, contractual obligation of confidentiality agreed with relevant staff members, formulation and implementation of information security related policies and procedures, and information security related training offered to staff.
   
4. We will not disclose your personal information to any third party, unless the disclosure is made to comply with laws, regulations and regulatory requirements or according to this Policy or other agreement (if any) or based on your or related parties’ express authorisation or consent. When we use services provided by external service providers (entities or individuals), we also impose strict confidentiality obligations on them and request them to abide by our privacy policy and security standards when processing personal information.
   
5. For the security of your personal information, you take on the same responsibility as us. You shall properly take care of your personal information, such as your account information, identity verification information (e.g. user name, password, dynamic password, verification code, etc.), and all the documents, devices or other media that may record or otherwise relate to such information, and shall ensure your personal information and relevant documents, devices or other media are used only in a secured environment. You shall not, at any time, disclose to any other person or allow any other person to use such information and relevant documents, devices or other media. Once you think your personal information and/or relevant documents, devices or other media have been disclosed, lost or stolen, or may otherwise affect the security of your use of our products, devices or services, you shall notify us immediately so that we may take appropriate measures to prevent further loss from occurring.
6. If unfortunately personal information security incident occurs, we will adopt emergency plan and take relevant actions and remediation measures to mitigate the severity and losses in connection therewith. Meanwhile, we will, following the applicable requirements set out in law and regulation, inform you of the basic information of the security incident and its possible impact, the actions and measures we have taken or will take, suggestions for you to prevent and mitigate the risk, and applicable remediation measures. We will inform you about the security incident by email, mail, call, SMS, push notification or through other methods as appropriate in a timely manner. Where it’s difficult to notify each Personal Information Subject, we will post public notice in a reasonable and effective way. Meanwhile, we will report such personal information security incident and our actions in accordance with applicable law, regulation and regulatory requirements.

The above information is the basic information we must collect to provide you with banking products or services, to perform our contract with you and to comply with laws, regulations and regulatory requirements. If you refuse to provide those information (or the information so provided is incomplete, inaccurate or untrue), you will not be able to use our regular banking products or services.

If you refuse to provide the above information, you are not able to use or enjoy the relevant functions, but your use of other functions of our banking services will not be adversely affected.

9.Please understand that the banking services we provide to you are constantly evolving. If you choose to use any other service not listed above for which we have to collect your information, we will separately explain to you, the purposes, methods, and scope of personal information we collect, through reminders, alerts, interaction with you, agreements entered into with you or other appropriate method, and obtain your consent for that. We will collect, use, store, disclose, and protect your information in accordance with this Policy and other agreements (if any) between you and us. If you choose not to provide certain information, you may be unable to use certain or part of the service, but your use of other services we provide will not be affected.

III.How We Use Your Personal Information

1. We will use your information to realize the purposes and functions mentioned in above Article II of this Policy “How We Collect Your Personal Information”. 
   
2. When you visit, browse, use our website or any of our applications as a visitor, we may use your information for the following purposes:
   (1) to respond to your queries and requests; 
   (2) to provide you with information, products or services that you request from us or which we feel may interest you, subject to your prior consent;
   (3) to perform contracts or agreements entered into between you and us; 
   (4) to allow you to interact with us at our website or applications;
   (5) to notify you about changes to our website or applications;
   (6) to ensure our site or application content is presented in an effective manner on your device; 
   (7) to maintain proper and secure operation of banking business, to prevent and control risk, or to detect and prevent misuse or abuse of our website, applications, products or services; 
   (8) to meet the compliance obligations of us or the HSBC Group, or to comply with any applicable laws and regulations that we and HSBC Group companies are subject to; and
   (9) to make statistics and analysis of the use of our business, products, services or functions. But such statistics will not contain any of your personally identifiable information.
   
3. When you are our prospect or existing individual customer, a connected person of our non-individual customers or a personal guarantor, we may use your information for the following purposes:
   
   (1) to provide you or related parties with products or services, to recognize or verify the identity of you and related parties, or to approve, manage, handle, execute or effect transactions requested or authorised by you;
   (2) to comply with any Applicable Laws (“Applicable Laws” refer to any applicable local or foreign statute, law, regulation, ordinance, rule, judgment, decree, voluntary code, directive, sanctions regime, court order applicable to any member of the HSBC Group, agreement between any member of the HSBC Group and an authority, or agreement or treaty between authorities and applicable to the Bank or a member of the HSBC Group) and any order or requirement from any authority;
   (3) to perform the Bank’s and/or the HSBC Group’s compliance obligations (including regulatory compliance, tax compliance and/or compliance with any Applicable Laws or requirement of any authority), or to implement any policy or procedure made by the Bank and/or the HSBC Group for the performance of compliance obligations;
   (4) to ensure safe and stable financial services, prevention or prohibition of illegal or incompliant activities, to control or reduce risks, to detect, investigate and prevent any real, suspected or potential financial crime (including money laundering, terrorist financing, bribery, corruption, tax evasion, fraud, evasion of economic or trade sanctions, and/or violations, or acts or attempts to circumvent or violate any Applicable Laws relating to these matters) and to manage financial crime risk;
   (5) to collect any amounts due from any debtor;
   (6) to conduct credit or credit reference checks, to verify, obtain or provide credit references or credit information;
   (7) to enforce or defend the Bank or any member of the HSBC Group’s rights, or to perform the Bank or any member of the HSBC Group’s obligations;
   (8) as required by or to fulfil the Bank or the HSBC Group’s internal operational requirements (including for credit and risk management, data statistics, analysis, processing and handling, archiving and recording, system, product and service design, research, development and improvement, planning, insurance, audit and administrative purposes);
   (9) subject to your or relevant parties’ authorization, market or promote relevant products or services to you or relevant parties, to assess your or relevant parties’ interests in relevant products or services, or to conduct market research or survey or satisfaction survey; and
   (10) to obtain or utilize administrative, consultancy, telecommunications, computer, payment, data storage, processing, outsourcing and/or other products or services.
   
4. When you apply for any position with us, we may use your information for the following purposes:
   
   (1) to assess and administer your application for employment, and to conduct background vetting;
   (2) to communicate with you in relation to your application;
   (3) to comply with any Applicable Laws and any order or requirement from any authority;
   (4) to perform the Bank’s and/or the HSBC Group’s compliance obligations (including regulatory compliance, tax compliance and/or compliance with any Applicable Laws or requirement of any authority), or to implement any policy or procedure made by the Bank and/or the HSBC Group for the performance of compliance obligations;
   (5) to monitor and review our recruitment practices; and
   (6) to facilitate our advice to you of other employment opportunities within HSBC Group which may interest you.
   
5. The above information collection and use in this Policy shall not impact our use of your information for the purposes as otherwise agreed between you and us.
6. If we use your personal information for the purposes other than the scope and purposes of information collection and use as set forth in this Policy or in other agreement between you and us, we shall obtain your consent before using your personal information for such additional purposes.
   

IV. How We Store Your Personal Information

Such provision or disclosure will involve cross border transmission of personal information, including information being transmitted to or being accessed from overseas only when the above recipient(s) is an overseas institution/person. Whether it is processed domestically or overseas, in accordance with applicable data protection legislation, your personal information will be protected by a strict code of secrecy and security which, the Bank, other members of the HSBC Group, their staff and third parties are subject to.

2. Transfer
Without your express consent, we will not transfer your personal information to any other company, organization or individual, except in the case of business/asset transfer, restructure, disposal (including securitization), merger, spin-off or acquisition transactions where the transfer is necessary. Where any personal information is transferred, we will request the receiving company, organization or individual to comply with this Policy. Otherwise, they shall obtain separate consent from you.

3. Public Disclosure

We will not disclose your personal information to the public unless we have your explicit consent. If public disclosure is needed, we will inform you the purpose of such disclosure, the type(s) of information being disclosed, and any sensitive information involved.

VI. Special Circumstances for Information Collection, Use and Disclosure

To the extent allowed by laws and regulations, we may collect, use or disclose your personal information without your consent under the following circumstances:

1. where it directly relates to state security or national defence security;
2. where it directly relates to public security, public sanitation or major public interest;
   
3. where it directly relates to criminal investigation, prosecutions, trials or execution of rulings, etc.;
   
4. when it’s urgently required to protect your or other’s life, property or relevant material legal rights and interests while difficult to obtain your authorisation or consent;
   
5. where the information is made available to the public by yourself;
   
6. where the information is from the legitimate public sources, like the legitimate news report, information disclosure by government or other authorities;
7. where it’s required by performance of obligations set out in laws or regulations, or of obligations for financial compliance; or
   
8. where it’s necessary to enter into or perform the contracts at your request.

VII.How We Use Cookies and Other Technologies

1. Your visit, browse, use of any of our website or mobile device applications may be recorded for analysis on the number of visitors to the site and/or applications, general use patterns and your personal use patterns and improving your experience. Some of this information will be gathered through the use of “Cookies”. Cookies are small bits of information automatically stored on web browser in computer or mobile device, which can be retrieved by website and/or applications. Cookies can enable our website or applications to recognise your device and store information about your use of website and/or applications so to provide more useful features to you and to tailor the content of our website/applications to suit your interests and, where permitted by you, to provide you with promotional materials based on your use patterns. We will be able to access the information stored on the Cookies.
   
   The information collected by Cookies is anonymous aggregated data, and contains no name or address information or any information that will enable anyone to contact you via telephone, email or any other means.
2.  Our website and/or applications may also work with third parties to research certain use and other activities on the website and/or application. These third parties include without limitation to Doubleclick, Yahoo!, Nielsen//NetRatings, WebTrends, Google and Adobe.They use technologies such as spotlight monitoring, Web Beacons and Cookies etc. to collect information for such research. They use the information collected through such technologies (i) to find out more about users, including user demographics and behaviour and use patterns, (ii) for more accurate reporting and (iii) to improve the effectiveness of our marketing. They aggregate the information collected and then share it with us. No personally identifiable information about you is collected or shared by Doubleclick, Yahoo!, Nielsen//NetRatings, WebTrends, Google and Adobe with us as a result of this research.
3. Most browsers and/or applications are initially set to accept Cookies. You can manage or disable Cookies based on your own preference. Should you wish to disable the Cookies, you may do so by changing the setting on your browsers and/or applications. However, after changing the setting you may not be able to enjoy the convenience that Cookies bring, but your normal use of other functions of the website and/or applications will not be affected.Different browsers and devices offer different methods for setting changes, and you can find information on how to manage cookie settings on certain browsers via the following links.

1. The Policy is made by us and published at our websites and takes effect on the date of issue. The Policy may be amended or updated from time to time, particularly in the events of major changes as follows:
   
   (1) Major changes in our service model, such as changes in the purpose of processing personal information, changes in the types of personal information being processed, the use methods of personal information, etc.;
   (2) Major changes in our ownership structure, organisational structure, etc., such as changes as result of business adjustments, bankruptcy, mergers, etc.;
   (3) Changes in the main objects of personal information sharing, transfer or public disclosure;
   (4) Significant changes in your rights relating to personal information or in the methods to exercise such rights;
   (5) Changes of our contacts for personal information related requests/enquiries, changes of our contacts for complaint or feedback;
   (6) Other major changes which may significantly impact your interests in personal information.
   We will post the changes to the Policy or the updated Policy through pop-ups, announcements, etc. on our website. Changes to the Policy shall not diminish or limit the rights you should have as a Personal Information Subject under Chinese law.
   
2. Where you provide to us personal information about another person, you should ensure that person acknowledges this Policy and, in particular, tell him/her how we may use his/her information. You should remind that person to read this Policy in advance and may also give him/her a copy of this Policy.
3. In case of discrepancy between the Chinese and English versions of this Policy, the Chinese version shall apply and prevail.

Issuance Date: 14 September 2020

Effective Date: 14 September 2020

HSBC Bank (China) Company Limited ("HSBC", "the Bank", "we" or "us") take personal information confidentiality and security very seriously, and strive at all times to protect personal information and privacy of our customers and other related information subject ("you" or "Personal Information Subject") according to law. We therefore formulate this Personal Information and Privacy Protection Policy for Digital Banking Services (this "Policy") to help you understand the purposes, methods, and scope of personal information we collect and use, our practices regarding personal information and privacy protection, your rights and interests with regard to personal information and privacy and how to assert your rights and interests. Please read through this Policy carefully and pay particular attention to the provisions that are bolded and/or underlined.

This Policy applies to your use of our personal digital banking services (including internet banking, mobile banking and WeChat Account).

The table of content of this Policy is set out as below:

I. How We Protect Your Personal Information

II. How We Collect Your Personal Information

III. How We Use Your Personal Information

IV. How We Store Your Personal Information

V. To Whom We Disclose Your Personal Information

VI. Special Circumstances for Information Collection, Use and Disclosure

VII. How We Use Cookies

VIII. Your Rights Relating to Personal Information

IX. Protection of Minors' Personal Information

X. Formulation, Effectiveness and Update of this Policy and Others

We shall collect, use, store, disclose, and protect your and related parties' personal information in accordance with this Policy.If there is any discrepancy between this Policy and the other agreements entered into or other terms and conditions agreed between you and us, such other agreements or terms and conditions shall prevail.

I. How We Protect Your Personal Information

1. Information security is our top priority. We will endeavour at all times to safeguard your personal information against unauthorised or accidental access, processing or damage. We maintain this commitment to information security by implementing appropriate physical, electronic and managerial measures to secure your personal information. We will take responsibility in accordance with the law if your information suffers from unauthorised access, public disclosure, erasure or damage for a reason attributable to us and so impairs your lawful rights and interests.
2. The secure area of our website supports the use of Secure Socket Layer (SSL) protocol and 128-bit encryption technology - an existing industry standard for encryption over the Internet to protect data. When you provide personal sensitive information through our website, it will be automatically converted into codes so as to ensure secure transmission afterwards. Our web servers are protected behind "firewalls" and our systems are monitored to prevent any unauthorised access. Our mobile banking application software has passed Unionpay payment application software security test conducted by Bank Card Test Centre.
3. We maintain strict security system to prevent unauthorised access to your personal information. We exercise strict management over our staff members who may have access to your personal information, including but not limited to access control applied to different positions, contractual obligation of confidentiality agreed with relevant staff members, formulation and implementation of information security related policies and procedures, and information security related training offered to staff.
4. We will not disclose your personal information to any third party, unless the disclosure is made to comply with laws, regulations and regulatory requirements or according to this Policy or other agreement between you and us, or based on your express consent or authorisation. When we use services provided by external service providers (entities or individuals), we also impose strict confidentiality obligations on them and request them to abide by our personal information and privacy protection policy and security standards when processing personal information.
5. For the security of your personal information, you take on the same responsibility as us. You shall properly take care of your personal information, such as your account information, identity verification information (e.g. user name, password, dynamic password, verification code, etc.), and all the documents, devices or other media that may record or otherwise relate to such information, and shall ensure your personal information and relevant documents, devices or other media are used only in a secured environment. You shall not, at any time, disclose to any other person or allow any other person to use such information and relevant documents, devices or other media. Once you think your personal information and/or relevant documents, devices or other media have been disclosed, lost or stolen, or may otherwise affect the security of your use of our digital banking services, you shall notify us immediately so that we may take appropriate measures to prevent further loss from occurring.
6. If unfortunately personal information security incident occurs, we will adopt emergency plan and take relevant actions and remediation measures to mitigate the severity and losses in connection therewith. Meanwhile, we will, following the applicable requirements set out in law and regulation, inform you of the basic information of the security incident and its possible impact, the actions and measures we have taken or will take, suggestions for you to prevent and mitigate the risk, and applicable remediation measures. We will inform you about the security incident by email, mail, call, SMS, push notification or through other methods as appropriate in a timely manner. Where it's difficult to notify each Personal Information Subject, we will post public notice in a reasonable and effective way. Meanwhile, we will report such personal information security incident and our actions in accordance with applicable law, regulation and regulatory requirements.
   

II. How We Collect Your Personal Information

If you refuse to provide those information, you will not be able to register or logon our digital banking service account, or will not be able to safely use our regular digital banking services.

If you refuse to provide the above information, you are not able to use or enjoy the relevant functions,but your use of other functions of our digital banking will not be adversely affected.

For those functions that need your permission, you may, at your free choice, decide whether to additionally grant the permission for the said functions on mobile banking applications.If you refuse to grant permission for a specific function, you are not able to use that specific function,but your use of other functions in our mobile banking will not be adversely affected.

If you do not agree the above information to be collected by SDK of third party service provider, you may not be able to use or enjoy relevant services or functions, but your use of other services or functions of our mobile banking application will not be adversely affected.

5. Please understand that the digital banking services we provide to you are constantly evolving. If you choose to use any other service not listed above for which we have to collect your information, we will separately explain to you, the purposes, methods, and scope of personal information we collect, through reminders on pages, interaction with you or agreements entered into with you, and obtain your consent for that. We will collect, use, store, disclose, and protect your information in accordance with this Policy and other agreements (if any) between you and us. If you choose not to provide certain information, you may be unable to use certain or part of the service, but your use of other services we provide will not be affected.

III. How We Use Your Personal Information 

1. We will use your information in the following circumstances:
   (1) To realize the purposes and functions mentioned in above Article II of this Policy "How We Collect Your Personal Information"; to contact you, or to approve, process or execute your application or instruction for transactions;
   (2) To ensure safe and stable financial services, we will use your information for identity verification, safety precaution, fraud detection, prevention or prohibition of illegal or incompliant activities, control or reduce of risks, recording or filing purposes;
   (3) To report to relevant regulators or other authorities according to laws, regulations or regulatory requirements;
   (4) To maintain and improve digital banking service or any function thereof, develop new service or function (if use of your personal information in the new service or function goes beyond your consent, we will obtain your additional consent before we use your information for such new service or function);
   (5) Subject to your authorisation, to promote the Bank's other products and services and to recommend to you the products or services that may interest you;
   (6) To make statistics and analysis of the use of our business, products, services or functions; we may share such statistics to the public or third parties to present overall trend of relevant business, products, services or functions. But such statistics will not contain any of your personally identifiable information.
2. The above content related to information collection and use in this Policy shall not impact our use of your information for the purposes as otherwise agreed between you and us separately.
3. If we use your personal information for the purposes other than the scope and purposes of information collection and use as set forth in this Policy or in other agreement between you and us, we shall obtain your consent before using your personal information for such additional purposes.

IV. How We Store Your Personal Information

When we collect or process your information, we will, according to applicable laws and regulations, regulatory, archival, accounting, auditing or reporting requirements, and the purposes as set forth in this Policy, store your information for a period as minimum as necessary to fulfill the purposes of information collection.

After the retention period expires, we will destroy, delete or anonymise relevant information, except for the information that needs to be retained according to applicable laws and regulations, regulatory, archival, accounting, auditing or reporting requirements, special agreement between you and us, or for settlement of indebtedness between you and us, or for record check or enquiry from you, regulators or other authorities.

V. To Whom We Disclose Your Personal Information

1. Entrusted Processing and Sharing
   
   For the purposes set out above in this Policy, we may provide or disclose all or part of your personal information to the following recipients under the preconditions that such provision or disclosure is necessary and is made with proper protective measures (please refer to Article I of this Policy "How We Protect Your Personal Information" for details) and the recipients may also, for the aforesaid purposes, use, process or further disclose the information they receive provided that corresponding protective measures are adopted pursuant to the applicable laws or our requirements: 
   (1)   any member of the HSBC Group;
   (2)   any contractor, subcontractor, agent, third party product or service provider, licensor, professional consultant, business partner, or associated person of the HSBC Group (including their employees, directors and officers);
   (3)   any regulator of the Bank or any member of the HSBC Group or any other authority, or any organisation or individual designated by such regulators or authorities;
   (4)   anyone acting on your behalf according to your authorisation or according to law, payment recipients, beneficiaries, account nominees, intermediary, correspondent and agent banks (e.g. for CHAPS, BACS, SWIFT), clearing houses, clearing or settlement systems, upstream withholding agents, swap or trade repositories, stock exchanges, companies in which you have an interest in securities (where such securities are held by us for you), or anyone making any payment to you;
   (5)   any person or related party who has the right or obligation, acquires an interest or assumes risk, in or in connection with any product or service you receive from the Bank, or any business you handle at the Bank or any transaction you make with the Bank (for example, the person who provides or intends to provide any mortgage or other security for any of your debt to the Bank, or the beneficiary of the insurance product that the Bank distributes to you);
   (6)   other financial institutions, industrial associations, bank card organisations, credit rating agencies, credit reference agencies (including without limitation, the People's Bank of China's credit information database) or information service providers;
   (7)   any third party fund manager providing you with asset management services through us;
   (8)   any third party to whom we provide referral, agency or intermediary service;
   (9)   any party in connection with any business/asset transfer, restructure, disposal (including securitisation), merger, spin-off or acquisition transactions of the Bank. 
   Such provision or disclosure will involve cross border transmission of personal information, including information being transmitted to or being accessed from overseas only when the above recipient(s) is an overseas institution/person. Whether it is processed domestically or overseas, in accordance with applicable data protection legislation, your personal information will be protected by a strict code of secrecy and security which, the Bank, other members of the HSBC Group, their staff and third parties are subject to.
   
   
2. Transfer
   
   Without your express consent, we will not transfer your personal information to any other company, organization or individual, except in the case of business/asset transfer, restructure, disposal (including securitization), merger, spin-off or acquisition transactions where the transfer is necessary. Where any personal information is transferred, we will request the receiving company, organization or individual to comply with this Policy. Otherwise, they shall obtain separate consent from you.
   
   
3.  Public Disclosure
   
   We will not disclose your personal information to the public unless we have your explicit consent. If public disclosure is needed, we will inform you the purpose of such disclosure, the type(s) of information being disclosed, and any sensitive information involved.

VI. Special Circumstances for Information Collection, Use and Disclosure

To the extent allowed by laws and regulations, we may collect, use or disclose your personal information without your consent under the following circumstances:

(1) where it directly relates to state security or national defence security;

(2) where it directly relates to public security, public sanitation or major public interest;

(3) where it directly relates to criminal investigation, prosecutions, trials or execution of rulings, etc.;

(4) when it's urgently required to protect your or other's life, property or relevant material legal rights and interests while difficult to obtain your authorisation or consent;

(5) where the information is made available to the public by yourself;

(6) where the information is from the legitimate public sources, like the legitimate news report, information disclosure by government or other authorities;

(7) where it's required by performance of obligations set out in laws or regulations, or of obligations for financial compliance; or

(8) where it's necessary to enter into or perform the contracts at your request.

VII. How We Use Cookies

1. Your visit, browse, use of any of our website or digital banking service related applications may be recorded for analysis on the number of visitors to the site and/or applications, general use patterns and your personal use patterns and improving your experience. Some of this information will be gathered through the use of "Cookies". Cookies are small bits of information automatically stored on your local terminal, which can be retrieved by your local terminal. Cookies can enable our website or applications to recognise your device and store information about your use of website and/or applications so to provide more useful features to you and to tailor the content of our website/applications to suit your interests and, where permitted by you, to provide you with promotional materials based on your use patterns. We will be able to access the information stored on the Cookies.
   The information collected by us via above methods is anonymous aggregated data, and contains no name or address information or any information that will enable anyone to contact you via telephone, email or any other means.
2. Most local terminals are initially set to accept Cookies. You can manage or disable Cookies based on your own preference. Should you wish to disable the Cookies, you may do so by changing the setting on your local terminals. However, after changing the setting you may not be able to enjoy the convenience that Cookies bring, but your normal use of other functions of the local terminals will not be affected. 

VIII. Your Rights Relating to Personal Information

1. You have the right to request us to protect and secure your personal information in accordance with the provisions of the law, regulation and this Policy.
2. You have the right to check with us whether we hold your personal formation and to check the personal information you have provided to us.
3. You have the right and obligation to update your personal information with us to ensure all information be accurate and up-to-date. You have the right to request us to provide convenience for you to update your personal information with us and to correct any of your information that is inaccurate.
4. In relation to personal credit, you have the right to request to be informed of your personal information that is disclosed to credit reference agencies by us, so as to enable your request to the relevant credit reference agencies for access to and correction of your information.
5. You have the right to request us to delete or otherwise properly dispose of your personal information that is beyond retention period in accordance with the applicable law and regulation, this Policy, and other agreement between you and us.
6. You have the right to uninstall digital banking service related applications. Please note that to uninstall the applications will not close your digital banking account. You have the right to close your digital banking account (by closing your bank account or disabling the digital banking functions of your bank account, for the sake of account safety you should visit our branches or sub-branches in person for such closure) and request for deletion of your personal information in accordance with the applicable law and regulation, this Policy, and other agreement between you and us. After you close your digital banking account, we will no longer collect your information through relevant channel, and will delete relevant personal information in accordance with the applicable law and regulation, this Policy, and other agreement between you and us, except for those we keep according to the applicable laws and regulations, regulatory, archival, accounting, auditing and reporting requirements, agreement between you and us, or for settlement of any indebtedness between you and us, or for record check or enquiry from you, regulators or other authorities.
   
7. How to contact us
   Requests for access to, correction or deletion of personal information, for withdrawal of authorisation or disposal of personal information beyond retention period, for a copy of this Policy, or enquiries about our practices regarding personal information and privacy protection, should be addressed to:
   Chief Data Officer, WPB
   HSBC Bank (China) Company Limited
   19/F HSBC Building, Shanghai IFC, 8 Century Avenue, Pudong, Shanghai, 200120
   E-mail: hsbcaoc@hsbc.com.cn
   Tel: +86 400-820-3090 (8:30am - 5:30pm, Monday to Friday during the working days)
   Upon the receipt of your request, we will reply to you within 15 working days or shorter period as prescribed by law and regulation (if any).
   We will not charge fees for the processing of your above-mentioned reasonable requests for checking, correcting or otherwise disposing of your personal information.
   Notwithstanding the foregoing, we may reject illegal, noncompliant, unnecessarily repeated, unreasonable or technically impracticable requests. Due to the requirements of law and regulation, we may not be able to respond to your request under any of the following circumstances: 
   
   (1) where the request is in direct relation to state security or national defence security;
   (2) where the request is in direct relation to public security, public sanitation, or major public interests;
   (3) where the request is in direct relation to criminal investigations, prosecutions, trials, execution of rulings, etc.;
   (4) where there is sufficient evidence that you are intentionally malicious or abuse your rights;
   (5) where responses to your request will give rise to serious damage to your or any other individual or organisation's legal rights and interests; or
   (6) where the request involves any trade secret.
8. Unless we have your prior consent, we will not send you advertisement promotion message. If at any time you would like us to cease using or providing to others your personal information for advertisement promotion purpose, you are entitled to notify us and exercise your right of choice, not to receive such advertisement promotion any more. If you so choose to reject advertisement promotion message, please contact our Call Centre by calling +86 400-820-8878. After receipt of your request we will, as soon as practical (usually no later than 30 days from your request), take actions to ensure no more advertisement promotion message should be sent to you.
9. You may supervise or make suggestions for our practices regarding personal information and privacy protection, and lodge complaints or demand compensation according to law against us or our staff for any infringement of your rights and interests in your personal information and privacy.
   If you have any query, complaint, feedback, comment or suggestion, please Contact HSBC. You may contact us through the contact information listed in this Policy, by calling our hotline or visiting our branches or sub-branches. You may also visit our official website www.hsbc.com.cn or official WeChat account "汇丰中国客户服务" (WeChat ID: HSBCeBanking) to enquire the nearby branches or sub-branches, or other contact information of us suitable for you.
10. Nothing in this Policy shall limit the rights you should have as a Personal Information Subject under Chinese law.

IX. Protection of Minors' Personal Information

1. We pay particular attention to protection of the minors' personal information. We have no intention to collect any minors' personal information, unless it is agreed by their parents or guardians and it is necessary for the products or services offered to the minors (for example, the minors may be the holders of the Junior Account offered by us, the holders of supplementary card of certain credit cards issued by us, the beneficiaries of the insurance products that we distribute, the heirs of our customers, etc.).
2. If you are under 18 years of age, it is suggested that your parents or guardians should carefully read this Policy and any of your personal information should be provided only after seeking consent from them. Meanwhile, it is suggested that your use of our products and services should be under the guidance of your parents or guardians. If they do not agree you to provide your personal information or to use any of our products or services, you should immediately stop providing the information or stop using our products and services. Please notify us of such event as soon as possible, so as to allow us to take appropriate measures accordingly.
3. If you are under 18 years of age, for those personal information we collect with the consent of your parents or guardians, we will only use or disclose such information to the extent allowed by law and regulation or expressly consented by your parents or guardians or necessary for protection of the minors' interests.

X. Formulation, Effectiveness, Update of this Policy and Others

1. The Policy is made by us and published at our digital banking service related websites or applications and takes effect on the date of issue. The Policy may be amended or updated from time to time, particularly in the events of major changes as follows:
   (1) Major changes in our service model, such as changes in the purpose of processing personal information, changes in the types of personal information being processed, the use methods of personal information, etc.;
   (2) Major changes in our ownership structure, organisational structure, etc., such as changes as result of business adjustments, bankruptcy, mergers, etc.;
   (3) Changes in the main objects of personal information sharing, transfer or public disclosure;
   (4) Significant changes in your rights relating to personal information or in the methods to exercise such rights;
   (5) Changes of our contacts for personal information related requests/enquiries, changes of our contacts for complaint or feedback;
   (6) Other major changes which may significantly impact your interests in personal information.
    We will post the changes to the Policy or the updated Policy through push notifications, pop-ups, announcements, etc. on our digital banking service related websites and/or applications. Changes to the Policy shall not diminish or limit the rights you should have as a Personal Information Subject under Chinese law.
   You may check this Policy on our mobile banking application via "My HSBC- General - Legal - Privacy and Security" or on our WeChat account "HSBC China Customer Service" via "My HSBC - Help and Tool – Privacy Terms". 
2. Where you provide to us personal information about another person, you should ensure that person acknowledges this Policy and, in particular, tell him/her how we may use his/her information. You should remind that person to read this Policy in advance and may also give him/her a copy of this Policy.
3. In case of discrepancy between the Chinese and English versions of this Policy, the Chinese version shall apply and prevail.