Privacy Policy and Personal Information Collection Statement

Tradelink Electronic Commerce Limited (hereinafter referred to as “Tradelink”, “the Company”, “we”, “our” or “us”) respects the privacy rights of our customers (hereinafter referred to as “the user”, “the applicant”, “you” or “your”) and we are committed to safeguarding your privacy and ensuring that your personal data is protected. This Statement explains, among other things, the types of personal data we collect and how we process and protect that data.

We shall keep your personal data confidential and shall ensure that our policies and practices with respect to the collection, use, retention, disclosure, transfer, processing, security and access of your personal data comply with the Personal Data (Privacy) Ordinance (Cap.486, Laws of the Hong Kong Special Administrative Region) (“PDPO”), as amended from time to time.

The term “personal data” shall have the meaning as ascribed to it under the PDPO.

During registration of “iD-One”, the following types of personal data collected by the “iD-One” mobile application for processing the application and providing “iD-One” services may include:

1. email address;
2. mobile phone number;
3. ICAO e-Passport compliant travel documents (“Passport”) data, including the Passport number, English and/or Chinese name, sex, date of birth, nationality, date of issue and date of expiry, issuing state code, and Hong Kong Identity Card number (applicable to HKSAR Passport only);
4. the image of the Passport; and
5. facial images of the applicants.

After successful registration and in the course of using “iD-One”, personal data (e.g., system identifiers, usage data¹, etc.) may be generated and collected by the “iD-One” system.

The “iD-One” system may collect your personal data from Digi-Sign Certification Service Limited (“Digi-Sign”). This data is collected in accordance with your Personal (Remote) ID-Cert Class 12 digital certificate to facilitate identity verification and secure digital signing within the “iD-One” mobile application.

When logging into “iD-One” account and using the authentication, digital signing and “My-iD” data filling services provided by “iD-One”, the “iD-One” system may collect your facial images for identity verification purposes.

The “iD-One” system will collect and process all the personal data you input, amend or update from time to time (if any) in the “iD-One” profile², for performing account management functions and service delivery.

When performing account management functions, you may be required to provide personal data including account information (including but not limited to your name, the Passport number, date of birth, etc.), contact phone number and/or email address for verification of your identity.

Your facial images, the image of the Passport and the same set of data mentioned in Clause 4 may be collected by the “iD-One” mobile application when conducting account management functions via the “iD-One” mobile application.

The image (e.g., facial image) provided by you during registration or in the course of using “iD-One” for identity verification in various circumstances may be scrutinised by the artificial intelligence (“AI”) solution adopted by “iD-One”. If the image provided by you is detected as "manipulated image" by the AI solution, the “iD-One” system may collect and retain such image and the associated information (including but not limited to the timestamp of the detection and the score of the manipulated image).

The personal data we collect as mentioned in Clauses 4 - 11 above will be used for the following purposes –

1. processing your registration and verifying the information to confirm your eligibility for “iD-One”;
2. providing the “iD-One” services, including but not limited to authenticating your identity, processing your “iD-One” service requests such as authentication, digital signing, “My-iD” data filling, etc., administering your “iD-One” account and processing, handling or communicating with you in respect of any customer services or service support requests relating to “iD-One”;
3. operation of “iD-One”, including but not limited to problem diagnosis, statistical analysis and audit; and
4. processing your application, issuance, renewal and revocation of Personal (Remote) ID-Cert Class 12 digital certificate for “iD-One” authentication and digital signing services.

Please note that it is not mandatory for you to provide the required personal data for registration and using “iD-One”. However, in the event that you do not provide such personal data, the “iD-One” mobile application will not be able to process your registration or may not be able to complete your “iD-One” service requests.

We may disclose your personal data to the following organisations and government entities in the following circumstances –

Digi-Sign Certification Service Limited (“Digi-Sign”)

1. your Passport data and facial images will be sent to Digi-Sign for the purpose as stated in Clause 12(d).

Online Service Providers adopting "iD-One"

(To provide authentication, digital signing, and “My-iD” data filling services, your data may be shared with Tradelink Document Management and Signing Service (DMSS) and Digital Policy Office of HKSAR Government)

1. during the authentication, digital signing, and “My-iD” data filling services of online services with “iD-One”, your personal data including your account information will be passed to the corresponding online service providers. The exact personal data to be passed may vary depending on the requirements of different online services;
2. when you use "iD-One" functions in online services, the "iD-One" may pass your “iD-One” app identifiers to the corresponding online service providers for identifying you without the need of using other sensitive personal information;
3. online service providers and “iD-One” mobile application may use your “iD-One” app identifiers instead of using other sensitive personal information for relaying notification messages to you; and
4. to maintain account integrity, your personal data will be shared with relevant online service providers on a regular basis for identity verification and profile matching. The exact personal data to be passed may vary depending on the requirements of different online services.

Others

1. any person where such disclosure is required or authorised by law or consented by you;
2. any actual or proposed assignee of Tradelink or transferee of Tradelink’s rights or obligations.

We maintain and execute retention policies of records containing personal data, including facial data, in relation to "iD-One" to ensure personal data will not be kept longer than is necessary for the fulfilment of the purpose for which the data is or is to be used and in accordance with the relevant statutory provisions. The retention periods apply to various kinds of data collected and held in “iD-One” are varied.

The “iD-One” mobile application does not retain or store any face data. The face data captured for facial recognition in the “iD-One” mobile application and/or for the purposes collected under Clauses 4, 7, and 10 is encrypted and sent to the system solely for authentication purposes.

We have been adhering strictly to our policies and guidelines on information technology security as well as the PDPO, in areas such as data security, network and communication security, user access management, application system security, and security measures to protect personal data.

Personal data in “iD-One” is encrypted using prevailing internationally recognised Advanced Encryption Standard (AES) and stored in data centre facilities. To conform to industry encryption standards, Transport Layer Security (TLS) is also adopted to encrypt data to ensure data security and integrity during transmission over the internet.

We are committed to taking all reasonably practicable steps to ensure that the personal data held by us is protected against unauthorised or accidental access, processing, erasure, loss or use, having particular regard to the kind of the data and the harm that could result if any of those things should occur.

In case of data breach, notification will be given to you and the relevant parties as soon as practicable. We shall take remedial actions to lessen the harm or damage that may be caused to you in a data breach. We will inform the Office of the Privacy Commissioner for Personal Data of the data breach incident as appropriate.

The “iD-One” mobile application will access to functions or data on the user's device which may contain personal data or privacy information. Such functions or data include:

1. Camera function – The “iD-One” mobile application may use the camera function of the user’s device to capture users’ selfie and passport images during registration, login, authentication, digital signing, “My-iD” data filling and account management functions of “iD-One”; and
2. Near Field Communication (“NFC”) function – The “iD-One” mobile application may use the NFC function on the user's device to read the encrypted data stored on his/her passport, which will then be passed to the “iD-One” backend system for identity verification.

During your visit to our websites (www.tradelink.com.hk) and use of the “iD-One” mobile application, we may use Cookies and similar tracking technologies (such as Software Development Kits (SDKs) and Mobile Device Identifiers) to collect, store and track the identification and contact details of you as a visitor, your login and authentication details, your activities and/or information on your preferences in relation to the subject matter of the websites and the “iD-One” mobile application. We use such personal data and information for the purposes of:

1. operation, management enhancement and optimisation of our websites and the “iD-One” mobile application;
2. compilation of aggregate statistics on usage of the site and the “iD-One” mobile application;
3. maintaining your identity across multiple webpages and/or internet sessions; and
4. personalising your user experience.

Most web browsers are initially set up to accept Cookies. You may refuse to accept Cookies (by modifying the relevant Internet options or browsing preferences of your computer system), but to do so you may not be able to utilise or activate all of the functions and services of our websites.

You have the right to request access to and correction of personal data held by Tradelink.

You may access and amend the personal data kept in “iD-One” profile through the “iD-One” mobile application.

Other than Clause 25, you may request the access to and correction of your personal data held by Tradelink and/or stored by the “iD-One” mobile application, by a request in writing and addressed to Privacy Compliance Officer, 11/F & 12/F, Tower B, Regent Centre, 63 Wo Yi Hop Road, Kwai Chung, Hong Kong. Tradelink may charge a reasonable amount of fee for handling such request for access or correction.

Any enquiries regarding this Statement may be addressed to the Privacy Compliance Officer, 11/F & 12/F, Tower B, Regent Centre, 63 Wo Yi Hop Road, Kwai Chung, Hong Kong.

If there is any inconsistency or conflict between the English and Chinese versions of this statement, the English version shall prevail.

We may change this Statement from time to time by posting an updated version on our websites (www.tradelink.com.hk) and on the “iD-One” mobile application.

This Statement shall be governed by and construed in accordance with the laws of the Hong Kong Special Administration Area.