Personal data policy statement – Singapore
Data Protection Policy
(For Corporate, Institutional and Individual Customers)
1. Introduction
The objective of this Data Protection Policy is to inform you of how the entity identified as your contracting party under the applicable Terms of Business and/or account documentation/confirmation (the “Contracting Entity”), and where the context requires, its Affiliates (collectively “our group”), as well as its representatives, affiliates and/or agents, (collectively referred to herein as “us”, “we” or “our”) manages Personal Data (as defined below) which is subject to the privacy or personal data protection laws of the relevant jurisdictions, including the Singapore Personal Data Protection Act (No. 26 of 2012) (“PDPA”). “Affiliate” means any legal entity that, at any time, is directly or indirectly: (i) controlling the Contracting Entity; (ii) controlled by the Contracting Entity; (iii) under common control with the Contracting Entity; or (iv) controlled by CITIC Securities International Company Limited, including CITIC Securities International Company Limited itself. We ask that you read this Data Protection Policy carefully as it contains important information about what to expect when we collect Personal Data about you or from you and how we will use and/or disclose such Personal Data.
In addition, this Data Protection Policy is intended to provide you with sufficient information to enable you to notify, and obtain consent from, any natural person (a “Relevant Person”) in respect of whom Personal Data may have been provided or may be provided by you or your agent to us from time to time.
This Data Protection Policy supplements but does not supersede or replace any other notices, terms or consents you may have previously provided to us or received in respect of your Personal Data, and your consents herein are additional to any rights to which we may have at law to collect, use or disclose your Personal Data.
Scope and Application
(a) Singapore contracting clients. This Data Protection Policy applies where the entity that provides you with services and/or products is a Singapore entity (the “Singapore Contracting Entity”). In that case, the Singapore Contracting Entity is responsible for complying with the PDPA in respect of Personal Data that it collects, uses or discloses, including where it engages third party service providers to process Personal Data on its behalf.
(b) Non Singapore contracting entities marketing into Singapore. This Data Protection Policy also describes how Personal Data may be handled where a CLSA Group entity that is not a Singapore contracting entity sends you marketing or promotional communications into Singapore. In such cases, the relevant CLSA Group entity remains responsible for its own processing. Where Singapore requirements apply, CLSA will take appropriate steps to comply, including managing consents/opt out and marketing preferences as applicable.
2. Personal Data
In this Data Protection Policy, “Personal Data” refers to any data about you or a Relevant Person, whether true or not, such that you or such natural person (as the case may be) can be identified (a) from that data; or (b) from that data and other information to which we have or are likely to have access, including data in our records as may be updated from time to time.
Examples of such Personal Data you may provide us include your name, NRIC, passport or other identification number, telephone number(s), mailing address, email address and any other information relating to any Relevant Person which you have provided us in any forms you may have submitted to us, or via any other form of interaction with you. Apart from Personal Data, we may collect other types of information which is not linked to a natural person and which is anonymous. For example, the number of website visitors and the number of website users using a particular service. In this way, we hope to improve our customer services.
For avoidance of doubt, the PDPA excludes “business contact information” (such as an individual’s name, position or title, business telephone number, business address, and business email address) from the definition of “personal data”. Where the PDPA does not apply to such business contact information, we may use it for B2B communications and relationship management. Where we handle such business contact information, we may nonetheless apply safeguards consistent with our information protection standards. The Singapore Do Not Call (DNC) provisions may still apply where we send marketing messages to a Singapore telephone number (including a business number), even if that number constitutes business contact information.
3. Purposes for the Collection, Use and Disclosure of Personal Data
Generally, we collect, use and disclose Personal Data for the following purposes:
a) processing applications for account opening, account maintenance and operations relating to your account(s), including without limitation, processing your applications or requests for services and/or products, processing your transactions, operating and closing your account(s);
b) providing services and/or products to you (including the services and products of external providers) from time to time and dealing with all matters relating to the services and products;
c) managing your relationship with us and/or administration of your account with us including (where you act as agent for another party) those of your underlying principals;
d) carrying out your instructions or responding to your enquiries or feedback;
e) conducting identity and/or credit checks, and carrying out customer due diligence and other checks and screenings and ongoing monitoring that may be required under any applicable law, regulation or directive or our internal policies and procedures (including but not limited to those designed to combat bribery and corrupt practices, money laundering, terrorist financing and financial crime);
f) preventing, detecting and investigating fraud, misconduct or any unlawful activities, whether or not requested by any relevant governmental or regulatory authority, and analysing and managing commercial risks;
g) complying with all applicable laws, regulations, rules, directives, orders, instructions and requests from any governmental, tax, law enforcement or other authorities (whether local or foreign);
h) managing our infrastructure and business operations and complying with our policies and procedures that may be required by applicable laws and regulations including those relating to risk control, security, audit, finance and accounting, systems and business continuity;
i) addressing or investigating any complaints, claims or disputes;
j) developing new services and/or products and updating you on our products and services from time to time;
k) managing and developing our relationship with you across our business lines and business units, including cross-business servicing and business development activities (including facilitating introductions and coordinating coverage across our group where appropriate) and where applicable, enabling cross-sector marketing across different entities of our group;
l) analytics and segmentation to tailor communications and improve our services and operational effectiveness including using your stated preferences and interaction history to identify content that may be relevant to you (subject to applicable law and your marketing preferences);
m) any member of our group may provide you with marketing, advertising and promotional information, materials and/or documents relating to banking, investment, credit and/or financial products and/or services that we may be selling, marketing, offering or promoting, whether such products or services exist now or are created in the future, subject to applicable law and your marketing preferences, subject always to Section 4 (Direct Marketing) and applicable law (including DNC where relevant);
n) carrying out research, planning and statistical analysis;
o) organising promotional events; and
p) enforcing our legal and/or contractual rights against you including, but not limited to, recovering any and all amounts owed to us,
(collectively, the “Purposes”).
4. Direct Marketing
We may use and share your Personal Data within our Group to deliver an integrated client experience and to conduct coordinated marketing and promotional activities, unless you have opted out and subject to applicable law.
Our marketing practices are designed to align with the PDPA’s requirements on reasonable purposes, notification and consent, and with your expressed marketing preferences.
We may, from time to time, use Personal Data for marketing and promotional purposes where permitted under applicable law and subject to any required consent and your marketing preferences. For direct marketing, we do not rely on deemed consent by notification; where consent is required, it will be obtained through appropriate consent mechanisms (and you may opt out at any time).
In this regard, please note that:
(i) Your personal data, including your name, contact details (such as email addresses and phone numbers), product and service preferences, may be used by the Contracting Entity and/or other entities of our group (as applicable), or with third-party subcontractors, agents, or service providers who work for us, whether located locally or overseas, for the purposes of direct marketing.
(ii) The types of services, products, and subjects that may be marketed to you, whether currently available or developed in the future by our group, include:
• News, updates, offers, and promotional information;
• Investment, financial, insurance products or services;
• Reward, loyalty, or privilege programs, along with related offerings; and
• Products and services provided by us (including those offered in collaboration with partners where applicable).
(iii) The above services, products, and subjects may be communicated or solicited through the following channels:
• Email, telephone, mobile application, SMS and other electronic means
• Either directly to you or through your representatives/contact persons, if you are a corporate entity.
(iv) Our group marketing: Where permitted and subject to any required consent, we may (a) send marketing communications itself, and/or (b) facilitate other entities of our group sending marketing communications to you, in each case consistent with your marketing preferences.
(v) Do Not Call (DNC) Registry (Singapore telephone numbers): Where we send marketing messages to a Singapore telephone number (voice call, text/SMS or fax), we will comply with the PDPA Do Not Call provisions, including obtaining clear and unambiguous consent in evidential form where required or otherwise checking the DNC Registry as applicable, and providing an opt-out facility where required. We will also include clear sender identification and contact information and, where required, an opt-out facility in such marketing messages. Where the PDPA Do Not Call provisions apply, they prevail over any general marketing consent language in this Policy.
5. Consent
By interacting with us, submitting information to us, or signing up for any products or services offered by us, you agree and consent (or are deemed to consent where permitted by law) to:
a) us collecting, using, disclosing and sharing Personal Data for the Purposes (including where applicable, marketing as set out in Section 4 (Direct Marketing)); and
b) disclosing and sharing such Personal Data to our authorised service providers and relevant third parties in the manner set forth in this Data Protection Policy.
Where permitted under applicable law, we may send you marketing communications as described in Section 4.
If you do not wish for us to continue to use your Personal Data or the Personal Data provided by you to us for any of the Purposes at any time in the future, you must notify us in writing to withdraw your consent (see Section 13).
Depending on the circumstances, your withdrawal of consent may result in our inability to provide you with the services and/or products that we have been offering to you, and consequently, may result in the termination of your relationship and/or accounts with us. If you withdraw consent or opt out only in respect of marketing communications, we will stop sending you marketing communications (as applicable), but this will not of itself affect the provision of core services to you. However, this may affect our ability to provide you with certain marketing-related benefits, invitations, event communications, or tailored offerings.
Where the personal data protection laws of the relevant jurisdictions permit us to collect, use or disclose the Personal Data without your or the Relevant Person’s consent, such permission granted by law will continue to apply. This includes, where permitted, relying on deemed consent (for example, where you voluntarily provide Personal Data for a purpose and it is reasonable that you would do so) and other applicable statutory exceptions.
Deemed consent by notification (non-marketing):
Where permitted by applicable law, we may notify you of, and rely on deemed consent for, the collection, use and disclosure of your Personal Data for purposes that are reasonably related to the original Purposes, provided that you are given reasonable prior notice of such purpose and a reasonable opportunity to opt out. For the avoidance of doubt, this clause does not limit or replace any requirements that apply to marketing communications (including the PDPA Do Not Call provisions) or other applicable marketing message laws; we will comply with those requirements where they apply.
Direct marketing communications will be handled in accordance with Section 4 (Direct Marketing), including any applicable consent and DNC requirements and your marketing preferences. For avoidance of doubt, we do not rely on deemed consent by notification for sending of direct marketing messages.
6. Disclosure, Sharing and Transfer of Personal Data Overseas
As a global financial institution, our services are supported by certain entities within our group. These entities process your data as necessary to operate effectively, efficiently, and securely in facilitating transactions and providing products and services to our customers.
Subject to the provisions of any applicable law, Personal Data may be disclosed or transferred to, shared with or kept by the following entities, wherever located, for any of the Purposes or for processing for any of the Purposes:
a) other members of our group of companies;
b) any third party service providers, including archival management service providers subject to appropriate confidentiality and data protection obligations;
c) our professional advisers (including lawyers) and agents (including our executing brokers, clearing houses and settlement agents);
d) our auditors;
e) any person to whom disclosure is permitted or required by law or any court order;
f) any local or foreign government agencies, regulatory authorities and statutory bodies having jurisdiction over us; and
g) any of their respective successors and assigns.
Where your information is sent overseas, it is likely to jurisdictions where our group operates including but not limited to the following jurisdictions: Hong Kong, China, Thailand, Philippines, Indonesia, Malaysia, Japan, Korea, India, the Netherlands, the United Kingdom, and the United States.
Where Personal Data is transferred outside Singapore by a Singapore organisation, we will do so in accordance with the PDPA, including by taking appropriate steps to ascertain whether the overseas recipient is bound by legally enforceable obligations to provide a standard of protection comparable to that under the PDPA. Such legally enforceable obligations may be imposed by contract, binding intra-group rules or other mechanisms recognised under applicable law.
Accordingly, we generally rely on such legally enforceable obligations, rather than individual consent, to satisfy the PDPA’s transfer limitation requirements in respect of overseas transfers. As part of these transfers, we may share Personal Data within our group and with marketing service providers located in jurisdictions where our group operates to support the Purposes, to execute cross-border marketing and client development activities.
7. Access And Correction
If you would like to obtain access and make corrections to your Personal Data, you may contact us in writing at the address set out in Section 13 below referencing ‘Data Protection Policy’. We may charge a reasonable administrative fee for this service. In exceptional circumstances, we reserve the right to deny you access to your Personal Data and may provide an explanation as required by applicable laws.
8. Retention
Personal Data will be held for as long as it is necessary to fulfil the purpose for which it was collected, or as required or permitted by applicable laws. We shall cease to retain Personal Data, or remove the means by which the Personal Data can be associated with particular individuals, as soon as it is reasonable to conclude that the purpose for which that Personal Data was collected is no longer being served by retention of the Personal Data and retention is no longer necessary for legal or business purposes.
9. Data Security
At our group, we have taken and will continue to take reasonable efforts to protect Personal Data in our possession or control by making reasonable security arrangements to prevent unauthorised access, collection, use, disclosure, copying, modification, disposal or similar risks. We employ a range of measures to keep your information safe and secure, which may include encryption and other security measures. Our employees and any third parties who carry out work for us must comply with appropriate compliance standards, including the responsibility to protect any information and implement appropriate measures for its use and transfer.
While we strive to protect your Personal Data, we cannot ensure the security of any Personal Data which you may have transmitted to us, via the Internet, and we urge you to take every precaution to protect your Personal Data and use a secure browser.
10. Updates to the Data Protection Policy
We may from time to time update this Data Protection Policy to ensure that it is consistent with our future developments, industry trends and/or any changes in legal or regulatory requirements. Such changes will be posted on our website.
Such changes to our Data Protection Policy shall apply from the time that we post the same on this website. Your continued use of our service will be taken as acceptance of the updated Data Protection Policy.
11. Cookies
A cookie is an alphanumeric identifier which we transfer to your hard drive through your web browser when you visit our website. It enables our own system to recognise you when you visit our website again and improve our service to you.
The information is used to track visitor use of the website and to compile statistical reports on website activity. Cookies may also be used to compile aggregate information about areas of our website that are visited most frequently. This traffic information can be used to enhance the content of our website and make your use of it easier.
For further information about cookies visit www.aboutcookies.org or www.allaboutcookies.org. If you wish to reject our cookie, you can configure your browser to do so. However, in a few cases some of our website features may not function if you remove cookies from your browser.
12. Third Party Websites
Our website may contain links to other websites. Please note that we are not responsible for the privacy practices of such other websites and you are advised to read the privacy statement of each website you visit which may collect your Personal Data.
13. Contacting Us
If you have any comments or questions about the collection, use or disclosure of your Personal Data or this Data Protection Policy, please contact us in writing at the address below referencing ‘Data Protection Policy’. If you are in Singapore or your query relates to marketing communications sent into Singapore, you may contact the Singapore Data Protection Officer using the details below, and we will route your request to the appropriate entity of our group where relevant. For marketing communications, you may use any unsubscribe or opt-out facility offered in our marketing messages, or by contacting your relationship manager.
Data Protection Officer
CITIC Securities Singapore
West Tower Unit #33-01
IOI Central Boulevard Towers
2 Central Boulevard, Singapore 018916
Email: dpo-sg@clsa.com
Telephone: +65 6416 7888