GENERAL

1. Octopus Rewards Limited respects the privacy of its Members and understands the importance of privacy to visitors to its website. Octopus Rewards Limited (the "Company", "we", "our" or "us") collects and stores information so that it can efficiently provide services to its Members. This Personal Data Policy Statement is designed to help you understand what information the Company gathers and what it does with the information.

DEFINITIONS AND INTERPRETATION

2. In this Personal Data Policy Statement, unless the context otherwise requires,
   "matching procedure" - has the meaning assigned to it by Section 2 of the Ordinance;
   
   "Member" means the Member of Octopus Rewards program (the "Program");
   
   "Membership Octopus" means the Octopus card or product (which we will refer to as "Octopus" below) you hold that you have registered in the Program by providing the number of that Octopus;
   
   "Ordinance" means the Personal Data (Privacy) Ordinance (Cap. 486) of the Laws of the Hong Kong Special Administrative Region;
   
   "Our Partners" means our business partners who wish to offer you benefits and targeted offers ("Our Issuing Partners") or redemption offers ("Our Redemption Partners") in the Program;
   
   "personal data" means any personal data held by the Company including all information provided by Members in the Registration Forms and all the information relating to the use of the Membership Octopus;
   
   "Registration Form" means any form containing an application by the Member for the Octopus Rewards program; and
   
   "Terms and Conditions" means the Terms and Conditions for Octopus Rewards program by Octopus Rewards Limited as amended from time to time.
   

OUR COMPANY POLICY

3. It is our policy to comply with the requirements of the Ordinance. The Company shall endeavor to ensure all collection and/or storage and/or transmission and/or usage of personal data by the Company shall be done in accordance with the obligations and requirements of the Ordinance. The Company's officers, management, and members of staff will, at all times, respect the confidentiality of and endeavor to keep safe any and all personal data collected and/or stored and/or transmitted and/or used for, or on behalf of, the Company.

STATEMENT OF PRACTICES

TYPES OF PERSONAL DATA COLLECTED

4. For the purpose of carrying on the Company's business (including relevant online services), you may be requested to provide personal data such as, but not limited to, the following, without which it may not be possible to satisfy your request:
   1. Your name;
   2. Your gender;
   3. Contact details, including contact name, contact address and telephone number or email address;
   4. Information for the verification of identity, including identification type and identification number;
   5. Your date of birth;
   6. Your Membership Octopus number; and
   7. Your Membership Octopus usage data.
5. The Company's web servers may also collect data relating to your online session including your IP address and/or domain name, the use of which is to provide aggregated, anonymous, statistical information on the server's usage so that we may better meet the demands and expectations of browsers to our websites.
6. The Company may place a "cookie" on your machine and "cookies" are small pieces of information that are stored by your browser on your computer's hard drive. We use "cookies" to track use of our websites, for example, to provide personalised services and/or maintain your identity across multiple pages within or across one or more sessions. This information may include, but is not limited to, relevant login and authentication details as well as information relating to your activities and preferences across our websites. Most browsers automatically accept "cookies" but if you like, you can edit your browser options to block them in the future but in doing so, you may be unable to enter certain part(s) of our websites.
7. Your personal data may be used for the following purposes:
   1. processing your registration for Membership;
   2. providing you with carefully selected offers, promotions and benefits by us, our subsidiaries, our affiliates and/or Our Partners. We, our subsidiaries, our affiliates and Our Partners may need to carry out matching procedure (as defined in the Ordinance) to enable us/them to better understand your characteristics and to provide other services better tailored to your needs (such as offering special birthday promotions to you), to assist us and Our Partners in selecting goods and services that are likely to be of interest to you and to establish whether you already have a relationship with our selected business partners;
   3. provide you with regular communications (other than direct marketing materials) from us with details of the program and its benefits;
   4. the normal management, operation and maintenance of the Octopus Rewards system, including audit;
   5. designing new or improving existing services provided by us, our subsidiaries and our affiliates (that is, any other entity which directly or indirectly controls us, is controlled by us, or is under common control with us) for customers' use;
   6. investigation of complaints, suspected suspicious transactions and research for service improvement;
   7. prevention or detection of crime;
   8. disclosure as required by law;
   9. aggregated behavioral analysis which is non-identifying and anonymous. This may be shared with Our Partners and third parties; and
   10. as a source of information and data for other related purposes.

DISCLOSURE OF PERSONAL DATA

8. All personal data will be kept confidential but the Company may, where such disclosure is necessary to satisfy the purpose, or a directly related purpose, for which the data was collected provide such information to the following parties: (whether within or outside the Hong Kong Special Administrative Region ( " Hong Kong" )):
   1. any agent, contractor or third party service provider under a duty of confidentiality to us who provides administrative, telecommunications, computer, payment, data processing or other services to us in connection with the operation of our business;
   2. any other person under a duty of confidentiality to us including our subsidiaries, our affiliates and Our Partners; and
   3. any person to whom we, our subsidiaries, our affiliates or Our Partners, is under a binding obligation to make disclosure under the requirements of any law, rule and regulation, including those of countries outside of Hong Kong for data transferred to those countries, but such disclosure will only be made under proper authority.

SECURITY OF PERSONAL DATA

9. Physical records containing personal data are securely stored in locked areas and/or containers when not in use. Personal data may be stored on computer systems and storage media to which access is strictly controlled and/or are located within restricted areas.
10. If you submit your personal data to us through the Internet, your personal data may be intercepted or tampered with by third parties without your knowledge or consent during the transmission. The Company accepts no responsibility for your personal data being intercepted or tampered with. If you are concerned about such risks, please do not submit your personal data through the Internet.

ACCESS AND CORRECTION OF PERSONAL DATA

11. A Member has the right to:
    1. check whether we hold data about you and to have access to that data;
    2. require us to correct any data relating to you which is inaccurate;
    3. ascertain our policies and practices in relation to personal data and to be informed of the kind of personal data held by us; and
    4. request us not to use your personal data for direct marketing purposes as described in clause 7 (b), above , in which case we will cease to do so at no cost to you.
12. The Member may exercise his or her right of access by completing the form "Data Subject Access Request" (the prescribed form of which (form: OPS003) is available at the office of the Privacy Commission for Personal Data) and sending the completed form, along with appropriate proof of identity (a copy of the Member's Hong Kong Identity Card or Passport) and the prescribed fee to the Company's Data Protection Officer at the address listed below.
13. The Member may exercise his/her right of correction by writing to the Company's Data Protection Officer at the address listed below, specifying the data which he/she believes to be incorrect, the reason he/she believes it is incorrect, and the applicable corrections provided that the Member can provide "proof of identity" verifying that the individual making the request is authorized to request such corrections.
14. The address of the Company's Data Protection Officer is P. O. Box 38170, Hing Fat Street Post Office, Hong Kong.

DIRECT MARKETING

15. The Company will honor the Member's request not to use his or her personal data for the purposes of direct marketing. If you do not wish to receive direct marketing material from the Company, please inform us by calling our hotline at 3690-1313.

16. Any such request should clearly state details of the personal data in respect of which the request is being made. Please also state clearly the authority under which you are authorized to make such a request.

17. Unless otherwise instructed as per the above, the Company may use any of the personal data collected in the normal course of its business for marketing purposes.

LINKS TO OTHER WEBSITES

18. The Company will, from time to time, contain links to other sites. Please note that when you enter these other sites (using the links on the Company's websites), you are entering a site for which the Company has no responsibility. We work with each of these sites to maintain the same level of confidentiality with respect to the Member's information that we provide under the terms of our personal data policy. However, we cannot guarantee the same level of confidentiality. We recommend that you read the personal data policy of these sites because they may have a personal data policy that differs from ours.

CHANGE OF PERSONAL DATA POLICY

19. The Company reserves the right, at any time and without notice, to add to, change, update or modify this Personal Data Policy Statement, simply by posting such change, update or modification on this website. If the Company decides to change its personal data policy, those changes will be posted on this page so that you are always aware of what information the Company collects, how the Company uses the information, and under what circumstances the information is disclosed by the Company. Any such change, update or modification will be effective immediately upon posting on the web site.

ENGLISH VERSION

20. If there is any inconsistency or conflict between the English and Chinese versions, the English version shall prevail.

CONDITIONS

21. Nothing in this Personal Data Policy Statement shall affect the rights and obligations of the Company under the Terms and Conditions.