PRIVACY POLICY STATEMENT
1. Pledge
1.1 All entities which are affiliates or subsidiary companies of the Construction Industry Council ("CIC") as set out in the Schedule (each, the "CIC Entity" and together, the "CIC Entities") to this Privacy Policy Statement ("PPS") take the protection of your personal data very seriously. The CIC Entities respect personal data privacy and are committed to fully implementing and complying with the data protection principles and all relevant provisions of the Personal Data (Privacy) Ordinance (Chapter 486 of the Laws of Hong Kong) (“PDPO”).
1.2 This PPS outlines how the CIC Entities collect, use, manage, and protect the personal data that the CIC Entities may collect from or about you. It applies to all individuals whose personal data may be handled, whether as a data user or processor, by the CIC Entities.
2. Collection of Personal Data
2.1 You may be invited by any CIC Entity to provide your personal data, on a voluntary basis, on any CIC Entity's website or in application forms submitted to the CIC Entities for specific purposes at different times. In certain circumstances, your provision of personal data is mandatory as required by the applicable laws (e.g. relevant laws on construction workers registration), and the CIC Entities shall inform you of the consequences of not providing the same.
2.2 The CIC Entities ensure that such data collection, whether by hard copy or through digital means, is limited to what is necessary for the purposes stated under paragraph 4 of this PPS. You will be informed of the specific purpose(s) at the point of collection in the applicable Personal Information Collection Statement.
2.3 Where you are providing your personal data to any CIC Entity for the purposes stated under paragraph 4 of this PPS, it is necessary that you supply the CIC Entities with complete and updated information. Otherwise, the CIC Entities may be unable to provide you with their relevant services. For example, if you do not supply accurate and/or updated contact information when submitting enquiries or complaints to any of the CIC Entities, the CIC Entities may be unable to respond to you in a timely manner.
3. Types of Personal Data Collected
3.1 Depending on the specific purpose(s), you may be required to provide any CIC Entity with your personal data, including your name, gender, age (or age range), date of birth, contact details, email/mailing/residential/correspondence address, contact number, membership number of any CIC Entity or other professional bodies in or outside Hong Kong, educational level, occupation, username and password for any CIC Entity platform, and tracking data on any CIC Entity platform. The CIC Entities will inform you and collect your personal data necessary to achieve the relevant purpose(s) in specific business scenarios.
4. Purposes of Use of Personal Data
4.1 The CIC Entities may collect your personal data for the following purposes:
| 4.1.1 |
|
for registration and enforcement under various schemes managed by the CIC Entities; |
| 4.1.2 |
|
for enrolment on education courses/trade tests/publicity programmes or events run by any CIC Entity (to carry out internal matching procedures whenever necessary) and the related administrative and disciplinary purposes and subscriptions/payments of different types of the CIC Entities' services; |
| 4.1.3 |
|
for registration of the use of imported construction workers’ quarters and the related property management; |
| 4.1.4 |
|
for qualifications recognition and issuance of certificates by third parties in or outside of Hong Kong, and/or for the creation or maintenance of system(s) in or outside of Hong Kong with functions including searches and records of certificates issued; |
| 4.1.5 |
|
for employment-related and human resources management purposes throughout the process from recruitment to post-employment; |
| 4.1.6 |
|
for direct marketing purposes after your consent has been obtained; |
| 4.1.7 |
|
for handling of enquiries and complaints from various stakeholders, to perform the CIC Entities' statutory functions and services; |
| 4.1.8 |
|
for conducting surveys, research or analyses to improve the CIC Entities' performance of statutory functions and services; |
| 4.1.9 |
|
for complying with applicable laws in or outside Hong Kong as may be required by applicable government authorities, courts, law enforcement, regulatory, public or statutory bodies; |
| 4.1.10 |
|
for detecting, investigating and preventing crimes; |
| 4.1.11 |
|
for enforcing the CIC Entities' rights or performing the CIC Entities' statutory functions pursuant to applicable laws (including commencing and defending legal processes, proceedings or claims); and |
| 4.1.12 |
|
for developing and training artificial intelligence ("AI") systems, personalizing the CIC Entities' services, and gaining insights with the help of AI, automated systems, and inferences. |
4.2 In relation to the type(s) of personal data and method of collecting your personal data by the CIC Entities for the purposes as mentioned in paragraph 4.1 above, please refer to the applicable Personal Information Collection Statement at the point of collection in detail.
4.3 If the ultimate purposes of use are not directly related to the intended collection purpose, the CIC Entities will seek consent from you in accordance with the PDPO and the applicable laws.
4.4 The CIC Entities will only retain or use your personal data for direct marketing purposes after obtaining your consent in accordance with the PDPO and the applicable laws. You may request to opt-out from receiving direct marketing material and/or communications or request to cease the use of your personal data for direct marketing purposes at any time. Requests to the CIC Entities (except for the Hong Kong Institute of Construction) may be made through the website of the CIC at https://www.cic.hk/ssl/eng/onlineenquiry/ and requests to the Hong Kong Institute of Construction may be made through its website at https://www.hkic.edu.hk/en/contact-us, in each case without charge and will be honoured in a timely manner.
4.5 The CIC Entities will only retain or use your personal data to develop and train AI systems, personalizing the CIC Entities' services, and gaining insights with the help of AI, automated systems, and inferences after obtaining your consent. You may request to opt-out from your personal data being used for such purposes at any time. Any such request may be made through the points of contact set out in paragraph 4.4 above.
5. Collection of Information via Cookies
5.1 Internet cookies, which can identify a device but not the identity of individual users of the website, are used by the CIC Entities to collect statistics about the number of visits of users to the CIC Entities' websites, the users’ preference of websites and online services offered on the CIC Entities' websites.
5.2 You may choose to accept or reject cookies. If you reject the cookies, you will not be able to use some of the functions of the CIC Entities' websites, such as saving your preferences in using the CIC Entities' websites and accessing some online services on the CIC Entities' websites.
6. Transfer of Personal Data to Third Parties
6.1 To serve any specific purposes, your personal data may be transferred to and stored in the following third parties (or any of them) on behalf of the CIC Entities, whether in or outside of Hong Kong:
| 6.1.1 |
|
the CIC Entities as set out in the Schedule to this Privacy Policy Statement; |
| 6.1.2 |
|
any third party service providers, contractors/sub-contractors that, on behalf of the CIC Entities, operate or maintain membership, event registration, tour booking, research and/or analyses, or carry out back-end services, administrative services, verification services, cloud services or information technology services, or provide necessary support or services to the CIC Entities to enable the CIC Entities to provide services, including any insurance, banking or third party payment gateway services used by the CIC Entities; |
| 6.1.3 |
|
any CIC Entity's professional advisors, including but not limited to lawyers, accountants and auditors; |
| 6.1.4 |
|
any third party whether in or outside of Hong Kong which is responsible for qualification recognition and issuance of certificates, and/or any third party whether in or outside of Hong Kong which is responsible for the creation or maintenance of system(s) with functions including searches and records of certificates issued; or |
| 6.1.5 |
|
any relevant regulators and law enforcement agencies in Hong Kong to facilitate the performance of their statutory functions. |
6.2 If required by the applicable laws, before providing your personal data to any third party, the CIC Entities will seek your express consent and adopt stringent measures to safeguard your personal data entrusted to such third party service providers, which include obligations in relation to the confidentiality, security, and lawful processing of any personal data the CIC Entities share with them.
6.3 The personal data may be transferred to jurisdictions that are outside Hong Kong that have similar data protection laws as the applicable laws (depending on the circumstances, the applicable laws may include, but are not limited to, the General Data Protection Regulation in the European Union ("GDPR"), and the Personal Information Protection Law in the People's Republic of China ("PRC"), (together, "Applicable Laws")). Before providing personal data to overseas third parties, we will follow the requirement of the applicable laws.
6.4 Where personal data are to be transferred to jurisdictions that are outside of Hong Kong which do not have similar data protection laws to the Applicable Laws, the CIC Entities will take all reasonable precautions and exercise all due diligence to ensure that your personal data is afforded a level of protection comparable to the Applicable Laws.
7. Retention
7.1 The CIC Entities will retain your personal data for a period not longer than necessary for the fulfilment of the purposes for which they are to be used. Retention periods for personal data may vary subject to business needs or legal requirements.
7.2 The CIC Entities comply with their policy on personal data retention and review it from time to time.
8. Security and Storage
8.1 The CIC Entities take all practical steps, including technical and operational measures and organisational measures to safeguard your personal data.
8.2 The physical records of your personal data will be stored in secure places with restricted access by the CIC Entities and those with whom the CIC Entities share your personal data in accordance with this PPS and the applicable Personal Information Collection Statement. The electronic records of your personal data will be stored in the servers of the CIC Entities and/or relevant CIC Entities' service providers (whether in or outside Hong Kong) located in secure places and protected by adequate IT security measures (including but not limited to measures of encryption and access control).
8.3 The CIC Entities' websites use TLS protocol to encrypt data during network transmission to protect your personal data. All personal data you provide to the CIC Entities via the CIC Entities' websites are secured, and access to them is restricted to authorised personnel of the CIC Entities and the authorised personnel of third party service providers of the CIC Entities only.
9. Data Access and Correction
9.1 In accordance with the PDPO, your right to access personal data can be exercised by completing the Data Access Request Form (https://www.pcpd.org.hk/english/publications/files/Dforme.pdf). The CIC Entities may apply a reasonable administrative charge for providing you with access to your personal data in response to such request. For data access requests, if the points of contact differ from those listed in paragraph 9.2 below, please contact the channel specified in the applicable Personal Information Collection Statement attached to the form at the time your personal data was collected. You may also request necessary corrections to the data following the data access request.
9.2 Requests for the above should be addressed to:
Officer-in-charge (Data Access Request)
Construction Industry Council
38/F, COS Centre
56 Tsun Yip Street
Kwun Tong, Kowloon
Or via email at [email protected].
10. Compliance with the European Union's GDPR
10.1 If you are located in the European Union, this paragraph 10 applies to you. Pursuant to the GDPR, you may be granted the following rights in relation to the personal data the CIC Entities collect from or about you. Detailed information of your rights under the GDPR are available on https://commission.europa.eu/law/law-topic/data-protection/information-individuals_en. These rights include:
| 10.1.1 |
|
Right to be informed: You can obtain information about the processing of your personal data; |
| 10.1.2 |
|
Right of access: You can obtain access to the personal data held about you; |
| 10.1.3 |
|
Right to rectification: You can ask for incorrect, inaccurate or incomplete personal data to be corrected; |
| 10.1.4 |
|
Right to erasure: You can request that personal data be erased when it is no longer needed or if processing it is unlawful; |
| 10.1.5 |
|
Right to restriction of processing: You can request the restriction of the processing of your personal data in specific cases; |
| 10.1.6 |
|
Right to data portability: You can receive your personal data in a machine-readable format and send it to another controller; |
| 10.1.7 |
|
Right to object: You can object to the processing of your personal data for marketing purposes or on grounds relating to your particular situation; and |
| 10.1.8 |
|
Rights in relation to automated decision-making and profiling: You can request that decisions based on your personal data and that significantly affect you are made by natural persons, not only by computers. |
10.2 You also have the right to lodge a complaint to the local data protection authority if you consider that any CIC Entity has not addressed your concern, or processed your personal data in a satisfactory manner.
10.3 To exercise any of your rights under the GDPR, please contact any of the CIC Entities at the correspondence address provided in paragraph 9.2 above.
10.4 The CIC Entities may process and use personal data for one or more of the purposes set out in paragraph 4.1 above on the following legal bases:
| |
Purposes of processing |
Legal bases for processing |
| 1. |
for registration and enforcement under various schemes managed by the CIC Entities |
§ legal obligations |
| 2. |
for enrolment on education courses/trade tests/publicity programmes or events run by any CIC Entity (to carry out internal matching procedures whenever necessary) and the related administrative and disciplinary purposes and subscriptions/payments of different types of the CIC Entities' services |
§ legitimate interests (managing and administering the CIC Entities' courses/trade tests/publicity programmes or events) |
| 3. |
for registration of the use of imported construction workers’ quarters and the related property management |
§ legitimate interests (monitoring and managing workers’ quarters, ensuring safety and proper facility usage) |
| 4. |
for qualifications recognition and issuance of certificates by third parties in or outside of Hong Kong, and/or for the creation or maintenance of system(s) in or outside of Hong Kong with functions including searches and records of certificates issued |
§ legal obligations
§ legitimate interests (to perform the CIC Entities' statutory functions and services) |
| 5. |
for employment-related and human resources management purposes throughout the process from recruitment to post-employment |
§ fulfilling contractual obligations
§ legitimate interests (to improve the CIC Entities' performance of statutory functions and services) |
| 6. |
for direct marketing purposes |
§ your consent |
| 7. |
for handling of enquiries and complaints from various stakeholders |
§ legitimate interests (to improve the CIC Entities' performance of statutory functions and services) |
| 8. |
for conducting surveys, research or analyses |
§ legitimate interests (to improve the CIC Entities' performance of statutory functions and services) |
| 9. |
for complying with applicable laws in or outside Hong Kong as may be required by applicable government authorities, courts, law enforcement, regulatory, public or statutory bodies |
§ legal obligations |
| 10. |
for detecting, investigating and preventing crimes |
§ legitimate interests (to prevent crime) |
| 11. |
for enforcing the CIC Entities' rights or performing the CIC Entities' statutory functions pursuant to applicable laws (including commencing and defending legal processes, proceedings or claims) |
§ legal obligations |
| 12. |
for developing and training AI systems, personalizing the CIC Entities' services, and gaining insights with the help of AI, automated systems, and inferences |
§ legitimate interests (to improve the CIC Entities' performance of statutory functions and services) |
11. Compliance with the Personal Information Protection Law
11.1 If you are located in the PRC, please refer to the Personal Information Processing Notice ("Notice") for information on how your personal data will be processed in accordance with the PRC Personal Information Protection Law. This PPS should be read in conjunction with the Notice, which can be found HERE.
12. Enquiries, Complaints, and Suggestions
12.1 If you have any questions, complaints, or suggestions regarding this PPS or personal data protection matters, please contact the correspondence address provided in paragraph 9.2 above. The CIC Entities reserve the right to update this PPS at any time.
13. Inconsistencies or Conflicts
13.1 In the event of any inconsistencies and/or discrepancies between the English and Chinese version of this PPS, the English version shall prevail.
