Legal Mentions

BNP Paribas, acting through its Hong Kong branch

Notice to Customers Relating to the Personal Data (Privacy) Ordinance (the "Ordinance")

1. COLLECTION OF PERSONAL DATA

1.1. From time to time, it is necessary for data subjects to supply BNP Paribas (the “Bank”) with data in connection with the opening or operation of accounts and the establishment or maintenance of banking facilities or provision of banking, financial and/or brokerage services or products and the continuation of such matters.

1.2. Failure to supply such data may result in the Bank being unable to open or continue accounts or establish or continue banking facilities or provide banking, financial and/or brokerage services or products.

1.3. It is also the case that data is collected from data subjects in the ordinary course of the continuation of the banking or client relationship, for example, when data subjects write cheques, deposit money or carry out transactions. 

1.4. For the purpose of this Notice:

(a) “data subjects” means customers and/or other individuals including without limitation: applicants for financial services, brokerage services, and banking facilities, sureties and persons providing security or guarantee for banking facilities, contractual counterparties, and directors, shareholders, beneficial owners, controlling persons, officers and managers of customers, of applicants or of any third party transacting with or through the Bank; and

(b) “BNP Paribas Group” means each of or collectively the Bank, its group companies and affiliates, and their respective subsidiaries (including each branch or representative office).

2. USE OF PERSONAL DATA 

2.1. The purposes for which data relating to data subjects may be used are as follows:

    (a) the daily operation of the services and credit facilities provided to data subjects;

    (b) conducting credit checks at the time of application for credit and at the time of regular or special        reviews which normally will take place one or more times each year;

    (c) creating and maintaining the Bank’s credit scoring models;

    (d) assisting other financial institutions to conduct credit checks and collect debts;

    (e) ensuring ongoing credit worthiness of data subjects;

    (f) designing financial services or related products for data subjects' use;

    (g) marketing services, products and other subjects (please see further details in Section 5 below);

    (h) determining amounts owed to or by data subjects;

    (i) collection of amounts outstanding from data subjects and those providing security or guarantee for datasubjects' obligations;

    (j) complying with the obligations, requirements or arrangements for disclosing and using data that apply to the Bank or any member of the BNP Paribas Group, or that it is expected to comply according to:

        i. any law binding or applying to it within or outside the Hong Kong Special Administrative Region (“HongKong”) existing currently and in the future (e.g. the Inland Revenue Ordinance and its provisions including those concerning automatic exchange of financial account information);

        ii. any guidelines or guidance given or issued by any legal, regulatory, governmental, tax, law enforcement or other authorities, or self-regulatory or industry bodies or associations of financial services providers within or outside Hong Kong existing currently and in the future (e.g. guidelines or guidance given or issued by the Inland Revenue Department including those concerning automatic exchange of financial account information); or

        iii. any present or future contractual or other commitment with local or foreign legal, regulatory,governmental, tax, law enforcement or other authorities, or self-regulatory or industry bodies orassociations of financial services providers that is assumed by or imposed on the Bank or any memberof the BNP Paribas Group by reason of its financial, commercial, business or other interests or activities in or related to the jurisdiction of the relevant local or foreign legal, regulatory, governmental, tax, law enforcement or other authority, or self-regulatory or industry bodies or associations;

    (k) complying with any obligations, requirements, policies, procedures, measures or arrangements for sharing data and information within the BNP Paribas Group and/or any other use of data and information in accordance with any group-wide programmes for compliance with sanctions or prevention or detection of money laundering, terrorist financing or other unlawful activities;

    (l) in connection with the Bank or any member of the BNP Paribas Group defending or responding to any legal, governmental, regulatory or quasi-governmental related matter, action or proceeding;

    (m) organizing and delivering seminars for data subjects;

    (n) enabling an actual or proposed assignee of the Bank, or participant or sub-participant of the Bank's rights in respect of the data subjects to evaluate the transaction intended to be the subject of the assignment,participation or sub- participation; and

    (o) any purposes relating thereto.

3. DISCLOSURE OF PERSONAL DATA

3.1. Data held by the Bank relating to data subjects will be kept confidential but the Bank may provide such information to the following parties for the purposes set out in Section 2:

    (a) any agent, contractor or third party service provider who provides administrative, telecommunications, computer, payment or securities clearing or other services to the Bank or any member of the BNP Paribas Group in connection with the operation of its business;

    (b) any other person under a duty of confidentiality to the Bank or any member of the BNP Paribas Group;

    (c) the drawee bank providing a copy of a paid cheque (which may contain information about the payee) to the drawer;

    (d) credit reference agencies, and, in the event of default, to debt collection agencies;

    (e) any person to whom the Bank or any member of the BNP Paribas Group is under an obligation or otherwise required to make disclosure under the requirements of any law binding on or applying to the Bank or any member of the BNP Paribas Group, or any disclosure under and for the purposes of any guidelines or guidance given or issued by any legal, regulatory, governmental, tax, law enforcement or other authorities, or selfregulatory or industry bodies or associations of financial services providers with which the Bank or any member of the BNP Paribas Group is expected to comply, or any disclosure pursuant to any contractual or other commitment of the Bank or any member of the BNP Paribas Group with local or foreign legal, regulatory, governmental, tax, law enforcement or other authorities, or self-regulatory or industry bodies or associations of financial services providers, all of which may be within or outside Hong Kong and may be existing currently and in the future;

    (f) any actual or proposed assignee of the Bank or participant or sub-participant or transferee of the Bank's rights in respect of data subjects;

    (g) any member of the BNP Paribas Group;

    (h) third party financial institutions, insurers, credit card companies, securities and investment services providers;

    (i) any party giving or proposing to give a guarantee or third party security to guarantee or secure the data subject’s obligations;

    (j) third party reward, loyalty and privileges programme providers;

    (k) co-branding partners of the Bank or any member of the BNP Paribas Group (the names of such co-branding partners can be found in the application form(s) for the relevant services and products, as the case may be);

    (l) charitable or non-profit making organisations; and

    (m) external service providers (including but not limited to mailing houses, telecommunication companies, telemarketing and direct sales agents, call centres, data processing companies and information technology companies) that the Bank or any member of the BNP Paribas Group engages for the purposes set out in Section 2.1(g).

3.2. Such data may be disclosed, transferred to or stored in a place outside Hong Kong. Such data may also be processed, kept, transferred or disclosed in accordance with the local practices and laws, rules and regulations (including any governmental acts and orders) in such country.

4. CREDIT REFERENCE AGENCIES

4.1. In the event of any default of payment relating to an account, unless the amount in default is fully repaid or written off (other than due to a bankruptcy order) before the expiry of 60 days from the date such default occurred, the account repayment data (as defined in Section 6.1(e) may be retained by the credit reference agency until the expiry of five years from the date of final settlement of the amount in default.

4.2. In the event any amount in an account is written-off due to a bankruptcy order being made against a data subject, the account repayment data (as defined in Section 6.1(e)) may be retained by the credit reference agency, regardless of whether the account repayment data reveal any default of payment lasting in excess of 60 days, until the expiry of five years from the date of final settlement of the amount in default or the expiry of five years from the date of discharge from a bankruptcy as notified by the data subject with evidence to the credit reference agency, whichever is earlier.

4.3. With respect to data in connection with mortgages applied by a data subject (whether as a borrower, mortgagor or guarantor and whether in the data subject’s own name or in joint names with others) on or after 1 April 2011, the following data relating to the data subject (including any updated data of any of the following data from time to time) may be provided by the Bank, on its own behalf and/or as agent, to a credit reference agency:

    (a) full name;

    (b) capacity in respect of each mortgage (as borrower, mortgagor or guarantor, and whether in the data subject’s own name or in joint names with others);

    (c) Hong Kong Identity Card Number or travel document number;

    (d) date of birth;

    (e) correspondence address;

    (f) mortgage account number in respect of each mortgage;

    (g) type of the facility in respect of each mortgage;

    (h) mortgage account status in respect of each mortgage (e.g., active, closed, write-off (other than due to abankruptcy order), write-off due to a bankruptcy order); and

    (i) if any, mortgage account closed date in respect of each mortgage.

The credit reference agency will use the above data supplied by the Bank for the purposes of compiling a count of the number of mortgages from time to time held by the data subject with credit providers in Hong Kong, as borrower, mortgagor or guarantor respectively and whether in the data subject’s own name or in joint names with others, for sharing in the consumer credit database of the credit reference agency by credit providers (subject to the requirements of the Code of Practice on Consumer Credit Data approved and issued under the Ordinance).

5. USE OF PERSONAL DATA IN DIRECT MARKETING

5.1. The Bank intends to use a customer’s data in direct marketing and the Bank requires their consent (which includes an indication of no objection) for such purpose. In this connection, please note that:

    (a) the name, contact details, products and services portfolio information, transaction pattern and behaviour, financial background and demographic data of a customer held by the Bank from time to time may be used by the Bank in direct marketing;

    (b) the following classes of services, products and subjects may be marketed:

        i. financial, insurance, credit card, banking, brokerage and related services and products;

        ii. reward, loyalty or privileges programmes and related services and products;

        iii. services and products offered by the Bank’s co-branding partners (the names of such co-branding partners can be found in the application form(s) for the relevant services and products, as the case may be); and

        iv. donations and contributions for charitable and/or non-profit making purposes; and

(c) the above services, products and subjects may be provided or (in the case of donations and contributions) solicited by the Bank and/or:

        i. any member of the BNP Paribas Group;

        ii. third party financial institutions, insurers, credit card companies, securities and investment services providers;

        iii. third party reward, loyalty, co-branding or privileges programme providers;

        iv. co-branding partners of any member of the BNP Paribas Group (the names of such co-branding partners can be found in the application form(s) for the relevant services and products, as the case may be); and

5.2. In addition to marketing the services, products and subjects described in Section 5.1(b), the Bank also intends to provide the data described in Section 5.1(a) to all or any of the persons described in Section 5.1(c) for use by them in marketing those services, products and subjects; and regarding an individual customer, the Bank requires his/her written consent (which includes an indication of no objection) for that purpose.

5.3. The Bank may receive money or other property in return for providing the data to the other persons in Section 5.2 and, when requesting the customer’s consent or no objection as described in Section 5.2, the Bank will inform the customer if it will receive any money or other property in return for providing the data to the other persons.

5.4. If a customer does not wish the Bank to use or provide to other persons their data for use in direct marketing as described in Section 5, he/she may exercise their opt-out right by notifying the Data Protection Officer of the Bank in writing at the address in Section 6.3. If the Bank receives an opt-out request from any customer as mentioned in this Section, the Bank will without charge cease to use such data for direct marketing as requested by such customer.

6. DATA ACCESS AND CORRECTION

6.1. Under and in accordance with the terms of the Ordinance and the Code of Practice on Consumer Credit Data approved and issued under the Ordinance, any data subject has the right:

    (a) to check whether the Bank holds data about him and of access to such data;

    (b) to require the Bank to correct any data relating to him which is inaccurate;

    (c) to ascertain the Bank's policies and practices in relation to data and to be informed of the kind of personal data held by the Bank;

    (d) to be informed on request which items of data are routinely disclosed to credit reference agencies or debt collection agencies, and be provided with further information to enable the making of an access and correction request to the relevant credit reference agency or debt collection agency; and

    (e) in relation to any account data (including, for the avoidance of doubt, any account repayment data) which has been provided by the Bank to a credit reference agency, to instruct the Bank, upon termination of the account by full repayment, to make a request to the credit reference agency to delete such account data from its database, as long as the instruction is given within five years of termination and at no time was there any default ofpayment in relation to the account, lasting in excess of 60 days within five years immediately before account termination. Account repayment data includes amount last due, amount of payment made during the last reporting period (being a period not exceeding 31 days immediately preceding the last contribution of account data by the Bank to a credit reference agency), remaining available credit or outstanding balance and default data (being amount past due and number of days past due, date of settlement of amount past due, and date of final settlement of amount in default lasting in excess of 60 days (if any)).

6.2. In accordance with the terms of the Ordinance, the Bank has the right to charge a reasonable fee for the processing of any data access request.

6.3. The person to whom requests for access to data or correction of data or for information regarding policies and practices and kinds of data held are to be sent to our Data Protection Officer in writing by post. The contact details of our Data Protection Officer is as follows:

    The Data Protection Officer,

    BNP Paribas

    63/F Two International Finance Centre,

    8 Finance Street, Hong Kong

6.4. The Bank may have obtained a credit report on data subjects from a credit reference agency in considering any application for credit. In the event data subject wishes to access the credit report, the Bank will advise the contact details of the relevant credit reference agency.

7. GENERAL PROVISIONS

7.1. Nothing in this Notice shall limit the rights of data subjects under the Personal Data (Privacy) Ordinance.

7.2. Should there be any inconsistencies between the English and Chinese versions of this Notice, the English version shall prevail.

April 2017

For Singapore users, please assess the Data Protection Policy by reading below.

DATA PROTECTION POLICY - SINGAPORE

At BNP Paribas, Singapore Branch, we take our responsibilities under Singapore’s Personal Data Protection Act 2012 (the “PDPA”) seriously. We also recognize the importance of the personal data you have entrusted to us and believe that it is our responsibility to properly manage, protect and process your personal data.

This Data Protection Policy is designed to assist you in understanding how we generally collect, use, disclose and/or process the personal data you have provided to us, as well as to assist you in making an informed decision before providing us with any of your personal data.

If you, at any time, have any queries on this policy or any other queries in relation to how we manage, protect and/or process your personal data, please do not hesitate to contact us and attention your queries to our Data Protection Officer for the following entities :

1              INTRODUCTION TO THE PDPA

1.1          “Personal Data” is defined under the PDPA to mean data, whether true or not, about an individual who can be identified from that data, or from that data and other information to which an organisation has or is likely to have access. Common examples of personal data could include names, identification numbers, contact information, medical records, photographs and video images.

1.2          We will collect your personal data in accordance with the PDPA. We will notify you of the purposes for which your personal data may be collected, used, disclosed and/or processed, as well as obtain your consent for the collection, use, disclosure and/or processing of your personal data for the intended purposes, unless an exception under the law permits us to collect and process your personal data without your consent.

2              PURPOSES FOR COLLECTION, USE, DISCLOSURE AND PROCESSING OF PERSONAL DATA

2.1          The personal data which we collect from you may be collected, used, disclosed and/or processed for various purposes, depending on the circumstances for which we may/will need to process your personal data, including :

(a)           processing your enquiries and application for account opening as well as products and services;

(b)           providing you with products and/or services, the entry into and/or performance of any transactions with us, and the facilitation of any of the foregoing;

(c)           administering and/or managing your relationship and/or account(s) with us (including the outsourcing of any related functions to authorised service providers or third party vendors who provide operational services to us, including those relating to auditing, finance and accounting, billing and collections, IT systems, data and website hosting, training, testing, business continuity, and records, document and print management);

(d)           carrying out your instructions or responding to any enquiries by you;

(e)           carrying out due diligence or other screening activities (including background checks) in accordance with legal or regulatory obligations or risk management procedures (including but not limited to those designed to combat financial crime, “know-your customer”, anti-money laundering, counter-terrorist financing or anti-bribery), that may be required by law or that may have been put in place by us;

(f)            dealing in any matters relating to the products and/or services offered or provided by us under the agreement(s) between you and us (including the printing and mailing of correspondence, statements, invoices, confirmations, advices, information, reports or notices to you, which could involve disclosure of certain Personal Data to bring about delivery of the same as well as on the external cover of envelopes/mail packages);

(g)           facilitating your business asset transactions (which may extend to any mergers, acquisitions or asset sales);

(h)           the recovery of any and all amounts owed to us;

(i)             the process of reviewing and approving the account(s), and the conduct of initial and anticipatory credit checks and assessments, relevant checks, ongoing assessment and verification of ongoing credit worthiness and standing;

(j)             preventing, detecting and investigating crime, fraud, misconduct, any unlawful action or omission, whether relating to your application or any other matter relating to your account(s), and whether or not there is any suspicion of the aforementioned;

(k)           managing our infrastructure and business operations, and complying with policies and procedures that may be required by law, applicable regulation, guidelines or notices and/or that may have been put in place by us, including those relating to regulatory review and/or oversight, auditing (whether internal or external), finance and accounting, billing and collections, IT systems, data and website hosting, training, testing, business continuity, and records, document and print management;

(l)             processing and/or storing information related to your relationship with us;

(m)          complying with applicable law, regulations, guidelines and/or notices in administering and managing your relationship with us; and

(n)           any other purposes which we may notify you of at the time of obtaining your

consent,(collectively, the “Purposes”).

As the purposes for which we may/will collect, use, disclose or process your personal data depend on the circumstances at hand, such purpose may not appear above. However, we will notify you of such other purpose at the time of obtaining your consent, unless processing of your personal data without your consent is permitted by the PDPA or by law.

2.2          In order to conduct our business operations more smoothly, we may also be disclosing the personal data you provide to us to our third party service providers, agents and/or our affiliates or related corporations, and/or other third parties, who may be sited in or outside of Singapore, for one or more of the above-stated Purposes.

3              SPECIFIC ISSUES FOR THE DISCLOSURE OF PERSONAL DATA TO THIRD PARTIES

3.1          We will respect the confidentiality of the personal data you provide to us.

3.2          In that regard, we will not disclose your personal data to third parties without first obtaining your consent permitting us to do so. However, please note that we may disclose your personal data to third parties without first obtaining your consent in certain situations, including, without limitation, the following :

(a)           cases in which the disclosure is required or authorized based on the applicable laws and/or regulations;

(b)           cases in which the purpose of such disclosure is clearly in your interests, and if consent cannot be obtained in a timely way;

(c)           cases in which the disclosure is necessary to respond to an emergency that threatens the life, health or safety of yourself or another individual;

(d)           cases in which the disclosure is necessary for any investigation or proceedings;

(e)           cases in which the personal data is disclosed to any officer of a prescribed law enforcement agency, upon production of written authorisation signed by the head or director of that law enforcement agency or a person of a similar rank, certifying that the personal data is necessary for the purposes of the functions or duties of the officer;

(f)            cases in which the disclosure is to a public agency and such disclosure is necessary in the public interest; and/or

(g)           where such disclosure without your consent is permitted by the PDPA or by law.

3.3          The instances listed above in the foregoing paragraph are not intended to be exhaustive. For more information on the exceptions, you are encouraged to peruse the Second, Third and Fourth Schedules of the PDPA which are publicly available at http://statutes.agc.gov.sg.

3.4          Where we disclose your personal data to third parties with your consent, we will employ our best efforts to require such third parties to protect your personal data.

4              REQUEST FOR ACCESS AND/OR CORRECTION OF PERSONAL DATA

4.1          You may request to have access to and/or correct your personal data currently in our possession by contacting us using the hotlines provided in this policy.

4.2          We reserve the right to charge you a fee for handling and processing your requests to access and/or correct your personal data.  Such fee will depend on the nature and complexity of your request.

5              ADMINISTRATION AND MANAGEMENT OF PERSONAL DATA

5.1          We will make reasonable efforts to ensure that your personal data is accurate and complete, if your personal data is likely to be used by us to make a decision that affects you, or disclosed to another organisation. However, this means that you must also update us of any changes in your personal data from time to time. We will not be responsible for relying on inaccurate or incomplete personal data arising from your not updating us of any changes in your personal data from time to time in a timely manner.

5.2          We will also put in place reasonable security arrangements to ensure that your personal data is adequately protected and secured. Appropriate security arrangements will be taken to prevent any unauthorized access, collection, use, disclosure, copying, modification, leakage, loss, damage and/or alteration of your personal data. However, we cannot assume responsibility for any unauthorized use of your personal data by third parties which are wholly attributable to factors beyond our control.

5.3          We will also put in place measures such that your personal data in our possession or under our control is destroyed and/or anonymized as soon as it is reasonable to assume that (i) the purpose for which that personal data was collected is no longer being served by the retention of such personal data; and (ii) retention is no longer necessary for any other legal or business purposes.

6              UPDATES ON DATA PROTECTION POLICY

6.1          As part of our efforts to ensure that we properly manage, protect and process your personal data, we will be reviewing our policies, procedures and processes from time to time.

We reserve the right to amend the terms of this Data Protection Policy at our absolute discretion. Any amended Data Protection Policy will be posted on our website . You are encouraged to visit our website from time to time to ensure that you are well informed of our latest policies in relation to personal data protection.

Last Updated on 30^th June 2014