This sets out the policies and practices of DigitalPay Limited 數字支付有限公司, in relation to the handling of personal data. We respect privacy. DigitalPay Limited is committed to complying with all applicable personal data privacy laws and regulations.
When we collect and process personal data, we will ensure that there is legal basis for us to do so – including but not limited to issuing a Privacy Notice and/or fulfilling any other requirements as provided under all applicable laws.
Kinds of Personal Data Collected We collect personal data in five broad categories below (“Categories of Personal Data”):
Subscription Records which include records containing the personal information of the subscribers of our publications, job alert services and any other subscription-based products or services.
Personnel Records which include job applicants and our employees’ personal information.
Event Attendee Records which include the personal information provided by the attendees of our events such as conferences, promotion or charity activities.
Other Operational Records which include the personal data of such data subjects involved in news gathering, security checks, cleaning, maintenance services, consultancy, technology, auditing, supplier, service provider, licensor, and other data subjects providing services in relation to all aspects of our operations.
Records collected on/from Web Servers which include but not limited to the email addresses, location data and other online identifiers such as IP addresses of such data subjects who visit our websites and platforms.
Main Purposes of Processing Collected Personal Data Subscription Records are processed for the purposes of: (i) provision of subscription, job alert orders and any other subscription based products or services; (ii) billing and payment (if applicable); and (iii) conducting market research for statistical purposes.
Personnel Records are processed for the purposes of: (i) recruitment; and (ii) human resources management and employment related activities such as employment benefits, termination, performance appraisal and discipline.
Event Attendee Records are processed for the purposes of: (i) organising and managing the relevant events; and (ii) running the related competitions, prize drawings, and promotions.
Other Operational Records are processed for the purposes of facilitating the effective operation of our business such as news gathering, security, maintenance, consultancy, technology, auditing, supplier, service provider, licensor, and other data subjects providing services in relation to all aspects of our operations.
Records collected from Web Servers are kept for the purposes of: (i) providing and/or improving on the news, information and related services to you; and (ii) keeping abreast of and analysing the latest trends in the global media landscape.
Data Protection Principles All processing of personal data shall be conducted according to the data protection principles as follows:
• Personal data must be processed lawfully, fairly and transparently. • Personal data can only be collected for specific, explicit and legitimate purposes. • Personal data must be relevant and limited to what is necessary for processing. • Personal data must be accurate and kept up to date with every effort to erase or correct. • Personal data must be kept in a form such that the data subject can only be identified if it is necessary for processing. • Personal data must be processed in a manner that ensures the appropriate security.
Data Inventory We have also kept a data inventory and data flow process to determine various aspects of our data processing including:
• Business processes that use personal data. • Purposes for collecting and/or using the personal data. • Source of personal data. • Processing activities. • Any data transfer, and to whom. • Any data access, correction or opt-out request.
Such data inventory would facilitate DigitalPay Limited in tracking its data and the related processing activities, and put us in a better position to comply with the relevant privacy and other laws and regulations.
Legal Basis of Data Processing We ensure that there is legal basis for our processing of personal data.
Such legal basis includes: (i) legitimate business interests of DigitalPay Limited in processing personal data; (ii) if required by applicable laws or regulations, seeking your specific consent to process such personal data; and/or (iii) any other relevant basis under applicable laws and regulations.
Legitimate Interests DigitalPay Limited processes personal data under the “legitimate interests” legal basis which means that the processing of the personal data is necessary for the legitimate interest pursued by DigitalPay Limited except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which requires the protection of personal data.
Legitimate Interests Assessment In each relevant situation, we assess: (i) what these legitimate interests are; (ii) whether it is necessary to process such data to attain the objective; and (iii) the relevant rights of the data subjects; and balance such rights against our interests in achieving such objective, and ensure that such rights do not override DigitalPay Limited legitimate interests before we conclude that DigitalPay Limited can process the personal data on the basis of legitimate interests.
Communicate with the Data subjects All data subjects will be informed that we are collecting their personal data, the Categories of Personal Data concerned and the purpose of processing. This is to ensure that the data subjects are clear about our collection and processing of personal data and such collection and processing are within the data subjects’ reasonable expectations.
Please be informed that all data subjects can object to our collection and processing of their personal data at any time, in addition to their rights of requesting for accessing and/or correcting their personal data in our possession.
We note that given the global spread of our businesses, there may be cases where our use of personal data for direct marketing is governed by the laws of certain jurisdictions (such as Hong Kong) which require the consent of the data subject(s) in this regard. Please refer to the “Consent” section immediately below for more information.
Consent Where applicable legal requirement demands specific consent must be obtained before we can process personal data including conducting direct marketing, we will ensure that such specific consent will be obtained as follows:
the consent has to be clear, explicit and specific; data subject is fully aware of the types of the personal data that we intend to use; and the purposes of such usage (such as improving our services to the data subject or direct marketing); and the name/identity of the transferee (if we ever intend to transfer your data) and how the transferee shall use your personal data.
Rights of the Data subjects DigitalPay Limited respects that data subjects have the following rights about the data processing, and the data which is recorded about them.
Transfer of Personal Data We will keep confidential the personal data that we hold, which may be transferred to the following parties within Hong Kong for the purposes as stated above.
In the event of such transfer, DigitalPay Limited shall use contractual or other means to ensure that the data transferees shall keep the transferred personal data confidential and comply with all relevant personal data privacy laws and regulations.
Data Retention We implement data retention policies and records to ensure that personal data will not be kept longer than is necessary in relation to the purpose for which they were collected.
Different retention periods apply to various types of personal data that we hold, depending on the respective data collection/usage purpose and relevant legal requirements.