Privacy Notice

Cash Bank Limited Corporation Ltd. (CBL) and its affiliated entities are committed to being responsible custodians of the information you provide to us and the information we collect in the course of operating our business and providing corporate, retail and premier banking, fund administration and investment management services.

CBL includes: Cash Bank Limited., Cash Bank Limited Fund Services Ltd., Cash Bank Limited Securities Ltd., Cash Bank Limited Trust Co. Ltd., and their respective subsidiaries (CBL Entities). References to we, us or our in this Notice are references to the relevant CBL Entity responsible for processing your data. References to you or your include you as a client or potential client of a CBL Entity, as well as any person acting on your behalf.

This privacy notice (Notice) sets out how CBL as a data controller (and the relevant CBL Entities insofar as they are joint data controllers) may collect, use and share information in relation to the provision of their services, and describes:

The types of information, including personal information, we may collect;
How we may use and share the information we collect;
The legal grounds for using personal information;
The measures we have in place to protect and safely store the information we collect;
Retention of the information we collect;
How we make decisions about you;
Your choices and rights in respect of the information we hold;
How to contact us;
Complaints; and
Changes to this Notice.

The types of information we collect

"Personal Information" is any information that can be used to identify you or that we can link to you as an individual.

We may collect personal information from a range of sources and it may relate to any of our products or services you apply for, currently hold or have held in the past. We may also collect information about you when you interact with us, (e.g. visit our website at www.cashfinancelimited.com) (Website) call us or visit one of our branches, or ask about any of our products and services.

Some of the personal information will come directly from you, for example when you provide identification to open an account. It can also come from third parties including your financial advisor, broker or mortgage intermediary or other CBL Entities. We might also collect personal information from publicly available sources.

We may also collect, store and use the following “special categories” of more sensitive personal information, including:

Racial or ethnic origin;
Data concerning physical or mental health or disabilities; or
Marital or family status.

Information you provide to us:

The types of personal information that we collect will differ depending on the product or service we are providing to you. The personal information we collect may include:

Full name, previous name, date and place of birth, gender, marital status, education level, dependents;
Contact details including postal and physical address, email address, landline, facsimile and mobile telephone numbers;
Information concerning your identity including passport, driving licence, taxpayer status and identity, voter identification, or photographic identity, and other Know Your Customer information;
Information from third party references, or your employer;
User login and subscription data such as login credentials for online banking;
Company or organisation details;
Information we collect automatically through cookies and similar tracking technologies through our website or other online services (our Cookies and Tracking Technologies Notice contains more details).
We may also collect information that you voluntarily provide to us, including when you communicate with us via email, phone, on social media or other channels, when you register for our updates and when you respond to our communications or requests for information.

Information we collect or generate about you:

your financial information and information about your relationship with us, including the products and services you hold, the channels you use and your ways of interacting with us, your ability to get and manage your credit, your payment history, transactions records, market trades, “know your customer” and source of funds information to substantiate transactions, payments into your account, including salary details, and information concerning complaints and disputes;
information we use to identify and authenticate you;
geographic information, including which branches or ATMs you use, or where you access our services;
information included in customer documentation such as a record of advice that we may have given you;
risk rating information, credit risk rating and transactional behaviour;
investigations data, due diligence checks, sanctions and anti-money laundering and counter-terrorism checks, external intelligence reports, content and metadata related to relevant exchanges of information between and among individuals;
information that we need to support our regulatory obligations, including information about transaction details, detection of any suspicious and unusual activity and information about parties connected to you or these activities;
records of correspondence and other communications between us; and
To help keep you and your funds safe, we may record details of your interactions with us. We may record and keep track of discussions you have with us, including phone calls and face-to-face meetings. We also use closed circuit television (CCTV) in and around our sites and these may collect photos or videos of you.

Information we may collect from third party sources:

We may receive information about you from other sources, including third parties that help us prevent or detect fraud or process payments. We may also receive information that you have asked us to collect for you, including information about your accounts or holdings with other companies.

How we use the information we collect

We may use the information we collect:

to deliver our products and services;
to carry out your instructions;
to conduct know-your-client and anti-money laundering and other sanctions checks;
to request source of funds documentation to verify the source of any deposits to your account;
to carry out checks in relation to your creditworthiness;
to manage our relationship with you, respond to your enquiries or to any problems that may arise and to investigate and resolve complaints;
to inform you of important changes or developments to the services or our policies and to provide you with technical, support or administrative notifications;
to understand how you use your accounts and other services;
prevent or detect crime, including fraud and financial crime, financing for terrorism and human trafficking;
for employment purposes;
to ensure security, prevent fraud;
to ensure business continuity;
risk management;
to provide online services;
to undertake data analytics to better understand your circumstances and preferences so we can make sure we can provide you with the best advice and offer you a tailored service;
to protect our legal rights and comply with our legal obligations;
to correspond with lawyers, surveyors, valuers, other lenders and third party intermediaries;
for insurance, audit and administrative purposes;
to send you marketing communications, and other information or materials that may be of interest you or which you have expressed an interest in receiving (and subject to your ability to opt-out from receiving those communications);
for internal development of new products or services;
for our internal business purposes, including data analysis, invoicing and detecting, preventing, and responding to actual or potential fraud, illegal activities, or intellectual property infringement; and
as we believe reasonably necessary, advisable or appropriate to comply with our legal or regulatory obligations and to respond to legal, regulatory, arbitration or government process or requests for information issued by government authorities or other third parties or to protect your, our, or others’ rights.

Further, we may aggregate personal and other data captured by us so that the data is no longer capable of identifying an individual. Aggregated data may cover patterns of usage, and we reserve the right to use this aggregated information for the purposes of improving and enhancing our services, generating insights, for use in marketing to other users and current and potential partners and otherwise for the purposes of our business. Provided that such aggregated data does not directly or indirectly identify you as an individual, this data is not considered to be personal information for the purpose of this Notice.

How we may share the information we collect

We may share the personal information we collect with our current or future affiliated entities, as explained at the beginning of this Notice.

We may also disclose information we collect:

To our counterparties or correspondent financial institutions which are necessary to effect your instructions.
To our affiliated entities, associated companies and third party service providers (including our auditors) that perform services on our behalf, including web-hosting companies, analytics providers and information technology providers, or which have reporting obligations in relation to our business. In these circumstances contractual and other technical and security safeguards will be put in place with the affiliated entities, associated companies or third party service provider, including to ensure that your personal information is processed only in accordance with this Notice.
To law enforcement, other government authorities, or third parties (within or outside the jurisdiction in which you reside) as may be permitted or required by the laws of any jurisdiction that may apply to us, as provided for under contract, as we deem reasonably necessary to provide legal services or if we believe your actions are inconsistent with our agreements and policies. In these circumstances, we will take reasonable efforts to notify you before we disclose information that may reasonably identify you or your organisation, unless prior notice is prohibited by applicable law or is not possible or reasonable in the circumstances.
To service providers, advisors, potential transactional partners, or other third parties in connection with the consideration, negotiation, or completion of a transaction in which we are acquired by or merged with another company or we sell, liquidate, or transfer all or a portion of our assets. Upon completion of such a transaction, your personal information will continue to be processed in accordance with this Notice, except as agreed otherwise by you or permitted by applicable law.
To our employees, sub-contractors, agents or service providers who work for us where required or necessary for the performance of their duties and in line with the reasons for processing.

We may also share your information, where lawful to do so, with:

any joint account holders, trustees, beneficiaries, administrators or executors;
people who give guarantees or other security for any amounts you owe us;
people you make payments to and receive payments from;
your beneficiaries, intermediaries, correspondent and agent banks, clearing houses, clearing or settlement systems, market counterparties and any companies you hold securities in through us;
other financial institutions, lenders and holders of security over any property you charge to us, tax authorities, credit reference agencies, payment service providers and debt recovery agents;
any fund managers who provide asset management services to you and any brokers who introduce you to us or deal with us for you;
any entity that has an interest in the products or services that we provide to you, including if they take on the risk related to them;
our card processing supplier(s) to carry out credit, fraud and risk checks, process your payments, issue and manage your card; and
any other party that you, your agent, or a joint account holder has so instructed us. ;

We do not sell, rent, or otherwise share personal information that reasonably identifies you or your organisation with unaffiliated entities for their independent use except as expressly described in this Notice or with your prior permission. We may share information that does not reasonably identify you or your organisation as permitted by applicable law.

Grounds for using your personal information

We rely on the following legal grounds to process your personal information, namely:

Necessity for performance of a contract – We may need to collect and use your personal information to enter into a contract with you or to perform a contract that you have with us;
Legal obligation – We may process your personal information as may be required to comply with any legal or regulatory obligations that may apply to us.
Legitimate interests – We may use your personal information for our legitimate interests to improve our services. Consistent with our legitimate interests and any consents that may be required under applicable laws, we may use technical information as described in this Notice and use personal information for our marketing purposes provided that those interests are not outweighed by your interests, rights and freedoms.
With your consent - We may use personal information as described in this Notice subject to your consent. To withdraw your consent you can contact us via our Contact Us page, or you may be able to disable the sharing of location information in your browser or mobile application settings. Where required by applicable laws, we will rely on your consent for direct marketing and to collect information from your device or computer.

Third party services and content

Our Website may include integrated content or links to content provided by third parties (such as social media content, plug-ins and applications). Please refer to our Cookies and Tracking Technologies Notice for more information.

Protection and storage of the information we collect

We deploy administrative, technical and physical safeguards designed to comply with applicable legal requirements and to safeguard the information that we collect. This includes, when required or appropriate and feasible, obtaining written assurances from third parties that may access your data that they will protect the data with safeguards designed to provide a level of protection equivalent to that adopted by the Issuer.

No information system can be 100% secure. We cannot guarantee the absolute security of your information. Moreover, we are not responsible for the security of information you transmit to us over networks that we do not control, including the internet and wireless networks.

We may store the information we collect in on our servers, both cloud based or in servers located in secure data centres within the Hong Kong Islands but also in countries where we or our service providers have facilities. Therefore, we may transfer information to countries outside the Hong Kong Islands or your country of residence which may have data protection laws and regulations that differ from those in your country.

Retention of the information we collect

We retain the information we collect for no longer than is reasonably necessary to fulfil the purposes for which we collect the information and to comply with our legal obligations.

How we make decisions about you

We may use automated systems to help us make decisions (e.g. when you apply for products and services, to make credit decisions, to effect standing instructions, and to carry out fraud and money laundering checks). We may use technology that helps us identify the level of risk involved in customer or account activity (e.g. for credit, fraud or financial crime reasons, or to identify if someone else is using your card without your permission). Ultimately, all decisions about you are made with human intervention.

Your choices and rights

Under local law, you may have certain rights regarding your personal information that we have collected. Customers have the right to request (i) access to your personal information, (ii) rectification or erasure of personal information, (iii) restriction of processing concerning you, and (iv) objection to processing that is based upon our legitimate interests. Your ability to exercise these rights will depend on a number of factors and, in some instances, we will not be able to comply with your request, for example because we have legitimate grounds for not doing so or where the right does not apply to the particular information we hold on you. If you would like to discuss or exercise the rights you may have, you can contact us through the methods stated below.

It is important that any personal information we hold about you is accurate and current. Please keep us informed if your personal information changes whilst we continue to retain such information. If you provide information for another person (for example, a joint account holder or a dependant), you will need to direct them to this Notice. If we need that person’s consent, we will ask you to confirm that you have obtained such consent. We encourage you to contact us to update or correct your information if it changes or if you believe that any information that we have collected about you is inaccurate or out of date. You can also ask us to see what personal information we hold about you and to erase your personal information if it is no longer required. You may also tell us if you object to our use of your personal information.

Conflicts

In relation to data protection, if there is any conflict between the terms of this Notice and any other provision in any other agreement or other terms in relation to CBL or any of its services, the terms of this Privacy Notice shall prevail to the extent of the conflict.

Changes to this Notice

We may update this Notice from time to time and we encourage you to periodically review this Notice. The use of certain of our services may also be governed by other applicable terms and policies regarding privacy and the sharing of personal information, which supplement, and should be reviewed alongside, this Notice.

If we make any material changes to this Notice regarding the way we collect, use, and/or share the personal information that you have provided and we hold your email or other contact information, we will notify you by email or other communication.

Last updated: 30 September 2019