1. Introduction
The objective of this Personal Data Policy Statement (“Policy”) is to provide you with information with respect to how we collect and process personal information and sensitive personal information in accordance with applicable laws and regulations on data privacy, including the Personal Information Protection Law of the People’s Republic of China (“PIPL”). References in this Policy to “we”, “us” and “our” mean, unless the context otherwise requires means, CLSA Limited and its Affiliates (including their representatives and/or agents). “Affiliates” means any legal entity that, at any time, is directly or indirectly: (i) controlling CLSA; (ii) controlled by CLSA; (iii) under common control with CLSA; or (iv) controlled by CITIC Securities International Company Limited, including CITIC Securities International Company Limited itself, including CSI itself. “CLSA Group” means CLSA together with all Affiliates of CLSA.
We ask that you read this Policy carefully as it contains important information regarding the collection, use, disclosure and transfer (within or outside relevant jurisdiction) of Personal Data (as defined below).
In addition, this Policy is intended to provide you with sufficient information to enable you to notify and obtain consent from any natural person (a “Relevant Person”) whose Personal Data may have been provided or may be provided by you or your agent to us from time to time. As used in this Policy, a “data subject” refers to a natural person whose personal, sensitive personal, or privileged information is processed.
This Policy supplements but does not supersede or replace any other consents you may have previously provided to us in respect of your Personal Data, and your consents herein are additional to any rights which we may have at law to collect, use or disclose your Personal Data.
2. Personal Data
In this Policy, “Personal Data” refers to all kind of Personal Data or personal information (including any sensitive personal information, each as defined under PIPL) about you or a Relevant Person, which would identify you or such natural person (as the case may be), or from which such identity can be reasonably and directly ascertained when put together with other information, which are electronically or otherwise recorded, excluding information that has been anonymized.
Examples of such Personal Data you may provide us include your or a Relevant Person’s name, license details, passport or other identification number, telephone number(s), age, marital status, mailing address, email address and any other information relating to you or any Relevant Person which you have provided or will provide to us in any forms you may have submitted to us, or via any other form of interaction with you.
3. Purposes for the Collection, Use and Disclosure of Personal Data
We collect, use, disclose, and/or process Personal Data for the following purposes (collectively, the “Purposes”):
(a) Processing applications for account opening, account closing, account maintenance, and operations relating to your account(s).
(b) Processing your applications or requests for services and/or products.
(c) Providing services and/or products to you, including the services and products of external providers.
(d) Managing your relationship with us and/or administration of your account with us, including (where you act as agent for another party) the accounts of your underlying principals; managing indebtedness and payments between you and us.
(e) Carrying out your instructions or responding to your enquiries or feedback.
(f) Conducting identity and/or credit checks, assisting other financial institutions to conduct credit checks, and undertaking customer due diligence, screenings, and ongoing monitoring as required under applicable laws, including but not limited to the Anti-Money Laundering Act, US Foreign Account Tax Compliance Act (FATCA), and internal policies designed to combat bribery, corruption, money laundering, terrorist financing, and other financial crimes.
(g) Preventing, detecting, and investigating fraud, misconduct, or any unlawful activities, whether or not requested by any relevant governmental or regulatory authority, and analysing and managing commercial risks.
(h) Complying with all applicable laws, regulations, rules, directives, orders, instructions, and requests from any governmental, tax, law enforcement, or other authorities (whether local or foreign).
(i) Managing our infrastructure, business operations, employees, and complying with policies and procedures required under applicable laws and regulations, including those relating to risk control, compliance, security, audit, finance and accounting, human resources, systems, and business continuity.
(j) Addressing or investigating any complaints, claims, or disputes.
(k) Developing new services and/or products and providing updates on our products and services.
(l) Unless you have opted out, providing you with marketing as described below .
(m) Carrying out research, planning, and statistical analysis.
(n) Organizing promotional events, conferences, seminars, and company visits.
(o) Enforcing our legal and/or contractual rights against you, including recovering any amounts owed to us.
Direct Marketing
With your consent as required under applicable law, we may use the Personal Data you provide for direct marketing, specifically:
(a) Your personal data, including your name, contact details (such as email addresses and phone numbers), product and service preferences, transaction history, financial background, and demographic data, may be used by CLSA or Affiliates, or with third-party subcontractors, agents, or service providers work for us, whether located locally or overseas, for the purposes of direct marketing.
(b) The types of services, products, and subjects that may be marketed to you, whether currently available or developed in the future by CLSA or Affiliates, include:
• News, updates, offers, and promotional information;
• Investment, financial, insurance products or services;
• Reward, loyalty, or privilege programs, along with related offerings; and
• Products and services provided by our co-branding partners.
(c) The above services, products, and subjects may be communicated or solicited through the following channels:
• Email, telephone, mobile application, SMS and other electronic means
• Either directly to you or through your representatives/contact persons, if you are a corporate entity.
We may collect Personal Data for the above mentioned Purposes directly from you or from other sources (e.g. social media, third party’s online platforms, and other publicly available sources) and through our Affiliates, service providers, business partners, official authorities, or third parties (e.g. third-party custodians, sub-custodians, and partner brokers).
4. The Legal Grounds for Processing Personal Data
We may use your Personal Data for the purposes as set out in sections 3 above and, for each purpose, based on the following legal grounds, among other things:
(a) Performance of a contract – this is when the processing of your Personal Data is necessary in order to perform our obligations under a contract;
(b) Legal obligation – this is when we are required to process your Personal Data in order to comply with a legal obligation, statutory functions, or statutory obligations, such as keeping records for tax purposes or providing information to a public body or law enforcement agency;
(c) Public interests – we may process your Personal Data where it is for the performance of a task carried out in the public interest or protection of life, health or assets of natural persons under emergency;
(d) Your consent – we process your Personal Data with your consent, and we will only process your Data if you agree to us doing so;
(e) Disclosed information – we may process your Data that is disclosed by you or otherwise legally disclosed.
5. Consent
By interacting with us and submitting information to us, or signing up for any products or services offered by us, you represent and agree that:
(a) we shall collect, use, disclose and share Personal Data for the Purposes stated in this Policy;
(b) we shall be authorised to disclose such Personal Data to our Affiliates, authorised service providers and relevant third parties in the manner set forth in this Policy and in the PIPL;
(c) we shall be authorized to process your sensitive personal information (as defined in the PIPL) for the Purposes stated in this Policy;
(d) we shall be authorized to disclose your Personal Data outside of relevant jurisdictions;
(e) we shall be allowed to disclose and/or transfer your Personal Data to our Affiliates and other third parties as provided below; and
(f) each Relevant Person has consented to our collection, use, disclosure and/or process of his/her Personal Data for the Purposes stated above, and such Relevant Person has been informed of and has accepted this Policy.
If you do not wish for us to continue to use your Personal Data or the Personal Data provided by you to us for any of the Purposes at any time in the future, you must notify us to withdraw your consent (see Section 13). Depending on the circumstances, your withdrawal of consent may result in our inability to provide you with certain services and/or products that we have been offering to you, and consequently, may result in the termination of your relationship and/or accounts with us if permitted under the applicable laws. The withdrawal of consent will not affect the lawfulness of the collection, use, and disclosure of your Personal Data based on your consent before it was withdrawn.
Where the Personal Data protection laws of the relevant jurisdictions permit us to collect, use or disclose the Personal Data without your or the Relevant Person’s consent, such permission granted by law will continue to apply.
6. Disclosure, Sharing and Transfer of Personal Data Overseas
As a global financial institution, our services are supported by certain entities within the CLSA and its Affiliates. These entities process your data as necessary to operate effectively, efficiently, and securely in facilitating transactions and providing products and services to our clients.
Subject to the provisions of any applicable law, we may send your Personal Data overseas whenever it is necessary for the performance of, but not limited to, providing products and services to you, fulfilling the client agreement, complying with legal requirements, or conducting direct marketing activities. Such transfers may involve sharing your Personal Data with our Affiliates and other parties listed below who provide services to us, including those who operate or store data outside your local jurisdiction. Where your information is sent overseas, it is likely to be in the following jurisdictions: Hong Kong, Singapore, Thailand, Philippines, Indonesia, Malaysia, Japan, Korea, India, Australia, the Netherlands, the United Kingdom, and the United States.
The Personal Data that we collect from you may be transferred to, and stored at, a destination outside China. It may also be processed by individuals operating outside your local jurisdiction who work for CLSA or for our suppliers. This includes jurisdiction that may not have the same level of protection for Personal Data. At CLSA, we are committed to protecting your Personal Data and your privacy. Where your Personal Data is sent outside your local jurisdiction, we ensure that appropriate data handling, security measures, and legal safeguards are in place. We employ a range of measures to keep your information safe and secure, which may include encryption and other security measures. Our employees and any third parties who carry out work for us must comply with appropriate compliance standards, including the responsibility to protect any information and implement appropriate measures for its use and transfer.
Your Personal Data may be disclosed, transferred, shared with, or retained by the following entities—regardless of location—for any of the purposes outlined in this Policy, or for processing in connection any of Purposes:
(a) our Affiliates;
(b) any third party service providers, including archival management service providers, subject to the provisions of the PIPL; (Upon request by you we may provide you (where available) with the privacy policies of third parties to whom we provide your Personal Data.)
(c) our professional advisers (including lawyers) and agents or third parties necessary for us performing/providing services to you (including our executing brokers, clearing houses and settlement agents) or for any other Purpose as stated in this Policy;
(d) our auditors;
(e) any person to whom disclosure is permitted or required by law or any court order;
(f) any local or foreign government agencies, regulatory authorities and statutory bodies having jurisdiction over us; and
(g) any of their respective successors and assigns.
To the extent that we may need to transfer Personal Data outside the relevant jurisdiction, we shall do so in accordance with the applicable Personal Data protection law with reasonably practicable monitoring to ensure that we provide an adequate standard of protection to the Personal Data.
7. Retention
Personal Data will be held for as long as it is necessary to fulfil the purpose for which it was collected or as required or permitted by applicable laws. We shall cease to retain Personal Data, or remove the means by which the Personal Data can be associated with particular individuals, as soon as it is reasonable to conclude that the purpose for which that Personal Data was collected is no longer being served by retention of the Personal Data and retention is no longer necessary for legal, regulatory or business purposes.
8. Data Security
We have taken and will continue to take reasonable efforts to protect Personal Data in our possession or control by making reasonable security arrangements to prevent unauthorised access, collection, use, disclosure, copying, modification, disposal or similar risks.
While we strive to protect your Personal Data, we cannot ensure the security of any Personal Data which you may have transmitted to us via methods using an unsecure browser, and we urge you to take every precaution to protect your Personal Data and use a secure browser.
9. Updates to the Data Protection Policy
We may update this Policy to ensure that it is consistent with our future developments, industry trends and/or any changes in legal or regulatory requirements. Such changes will be posted on our website.
Such changes to our Policy shall apply from the time that we post the same on this website https://www.clsa.com/terms-of-business/ . Your continued use of our service will be taken as acceptance of and consent to the updated Policy.
10. Cookies
A cookie is an alphanumeric identifier which we transfer to your hard drive through your web browser when you visit our website. It enables our own system to recognise you when you visit our website again and improve our service to you. The information is used to track visitor use of the website and to compile statistical reports on website activity. For further information about cookies visit www.aboutcookies.org or www.allaboutcookies.org. Cookies may also be used to compile aggregate information about areas of our website that are visited most frequently. This traffic information can be used to enhance the content of our website and make your use of it easier. If you wish to reject our cookie, you can configure your browser to do so. However, in a few cases some of our website features may not function if you remove cookies from your browser.
11. Third Party Websites
We have not reviewed any of the websites linked by our website. We will not be responsible for the content of any other websites or pages linked to or linking to our website and usage of any of such linked websites or pages. Such links are provided solely for your convenience and information. Following links to any other websites or pages shall be at your own risk. Visitors are advised to check the privacy statements of those websites to understand their policies on the collection, usage, transfer and disclosure of Personal Data.
12. Rights of the Data Subjects
Under the PIPL, you have the right to:
• be informed about the collection and use of your/or Relevant Person’s Personal Data;
• withdraw consent;
• know and decide on the processing of your and/or Relevant Person’s Personal Data;
• object to the collection, use, or disclosure of your and/or Relevant Person’s Personal Data;
• restrict to the collection, use, or disclosure of your and/or Relevant Person’s Personal Data;
• consult and duplicate Personal Data;
• Personal Data transfer (conditions specified under PIPL are met);
• request correction of incorrect Personal Data;
• supplement relevant information if in case of incomplete Personal Data;
• erasure of Personal Data;
If you would like to exercise any of these rights, you may contact us at the address set out in Section 13 below referencing “Data Protection Policy”.
13. Contacting Us
If you wish to withdraw your consent for us to use your Personal Data for direct marketing or any of purposes outlined above at any time in the future, you must notify us formally of your decision to withdraw. Please note that in certain circumstances, withdrawal may prevent us from providing certain products or services to you. Your withdrawal will not retrospectively affect the lawfulness of our prior collection, use, or disclosure of your data based on your consent prior to withdrawal.
For any queries, clarifications, questions or comments about the collection, use or disclosure of your Personal Data or this Policy, you may contact us at the address below referencing “Personal Data Protection Policy Statement”:
Data Protection Officer
CLSA Limited
18/F One Pacific Place
88 Queensway
Hong Kong
Tel: 26008888
Email: dataprotectionofficer@clsa.com