This Policy Statement provides information on the obligations and policies of Café de Coral Holdings Limited and, its subsidiaries, affiliates, and associated companies (the “Company”) under the HKSAR Personal Data (Privacy) Ordinance - Cap. 486 (“the Ordinance”). We respect the privacy rights of our customers and recognise the importance of protecting the information collected from you. This policy guides how we collect, store, and use the information you provided and applies only to Website (“site”) maintained by the Company but no other companies or organisations to which we link. Throughout this policy, the meaning of the term “personal data” is as defined in the Ordinance.
This policy specifically addresses the Company’s obligations in respect of the data privacy laws of the HKSAR. Where the Company’s operations are subject to privacy legislation other than that of HKSAR, then this policy shall be applied so far as applicable and consistent with such local legislation.
The Company’s Corporate Policy
The Company shall fully comply with the obligations and requirements of the Ordinance. The Company’s officers, management, and members of staff shall, at all times, respect the confidentiality and endeavour to keep safe any and all personal data collected and/or stored and/or transmitted and/or used for, or on behalf of, the Company.
The Company shall endeavour to ensure all collection, storage, transmission and other handling or usage of personal data by the Company shall be done in accordance with the obligations and requirements of the Ordinance.
Type of Personal Data Collected
When you come to our Site, for the purpose of carrying out the Company’s businesses, including sale, provision, administration of the membership services and related products and services, you may be requested to provide personal data such as
(a) Your name;
(b) Corresponding and/or billing address;
(c) Account details;
(d) Octopus card numbers;
(e) Contact details such as contact name, telephone number or email address; or
(f) Information for the verification of identity.
In some occasion, you may be requested to provide:
(c) salary range;
(d) education and profession;
(e) hobbies and leisure activities,
that may be used to further improve the Company’s products and services that presented to you. Failure to provide such requested data or information may sometimes defer or prevent us from providing the products or services to you.
The Site may also collect data relating to your online session, the use of which is to provide statistical information so that we can better the services and take necessary actions against any unscrupulous party who places any illegal or unlawful contents on any website through the Company’s web servers. The types of data may include but are not limited to the browser type and version; operating system; the IP address and /or domain name; and URLs.
Our Company’s Site may place a "cookie" on your machine. This personal information collected may include relevant login and authentication details as well as information relating to your activities and preferences across the Company’s Site. This is done without the users being aware that it is occurring. Generally cookies are used to estimate audience size, track users' progress and number of entries in our promotional activities and to measure users’ traffic patterns.
Under certain circumstances, telephone calls made to and from the Company’s order and/or services hotlines and/or inquiry telephone numbers will be recorded for the purposes of quality control, appraisal, as well as staff management and development. At all times, care is taken to protect such recordings from unauthorised access.
Use of Personal Data
Your personal data may be used for:
- verifying your identity; provision of goods and services to you;
- marketing and advertising of any goods and/or services to you by the Company, agents, contractors and third party upon your consent in accordance with the requirement of the Ordinance;
- business planning and improving goods and/or services to you by the Company;
- processing of any benefits or membership application in connection with the supply of goods and services to you;
- checking of your credit, payment and/or status in relation to the supply of goods and services to you;
- prossessing of any payment instructions or credit facilities in relation to supply of goods and services to you;
- enabling the daily operation of your membership account and/or collection of amounts outstanding in your account with the Company;
- prevention of crime;
- disclosure as required by law;
- handling of complaints and enquiries of the customers; and
- any other purposes as may be agreed between you and the Company apart from this Policy.
Accuracy of Personal Data
The Company may require validating the personal data provided to ensure accuracy or authenticity of the identity document supplied from you to us. We may request you to produce the identity document in person for checking at a time convenient to you.
Retention of Personal Data
The Company will destroy any personal data it may hold in accordance with its internal policy.
(i) Personal data will only be retained for as long as is necessary to fulfill the original or directly related purposes for which it was collected, unless the personal data are also retained to satisfy any applicable statutory or contractual obligations; and
(ii) Personal data are purged from the Company’s electronic and other filing systems in accordance with the schedules based on the company’s internal procedures.
Disclosure of Personal Data
All personal data held by the Company will be kept confidential and will not be disclosed or transferred to any other party but the Company may, where such disclosure is necessary to satisfy the purpose, or a directly related purpose, for which the data was collected, provide such information to the following parties:
(i) any subsidiaries, associated companies, or affiliates of, or companies controlled by, or under common control with or within the Company upon your consent in accordance with the requirement of the Ordinance;
(ii) any person who is acting for or on behalf of the Company or jointly with the Company, in respect of the purpose or a directly related purpose for which the data was collected, for administrative and other purposes deemed necessary to maintain service and improve service ;
(iii) Any other person or company who is under a duty of confidentiality to the Company and has undertaken to keep such information confidential provided such person or company has a legitimate right to such information;
(iv) Government and regulatory authorities and law enforcement agencies and other organisations as required or authorized by law;
Transfer of Personal Data Outside Hong Kong
It may be necessary for the Company to transfer certain personal data to places outside the HKSAR in order to carry out the purposes or directly related purposes, for which the personal data were collected. Where such a transfer is performed, your consent in accordance with the requirement of the Ordinance will be obtained.
Access and Correction of Personal Data
(i) You have the right to request access to and correction of personal data in its possession which is inaccurate for the purpose for which it is being used by means of a data access request ("right of correction"). You have further right to ascertain whether the Company holds any personal data relating to you and, if so, obtain copies of such data (“right of access”).
(ii) You may exercise his or her right of access by completing the “Data Access Request Form” as prescribed under the Ordinance and sending the completed form to us. Our staff will make a call to you after receiving the completed form and respond to your request upon authenticity and verification is satisfied.
The Company will honour your request not to use his or her personal data for the purpose of direct marketing unless your consent is obtained. You may at any time send request to our Customer Services Centre with registered name and contact telephone number to stop receiving the promotion materials or to start receiving the same.
Handling of Personal Data for Recruitment and Employment
During the recruitment process, job applicants may be required to provide sufficient personal data so that the Company may assess the applicant’s suitability for the position of the Company and determine the preliminary remuneration and benefit packages. Sometimes the applicant’s credentials and/or experience is needed to be verified. The personal data will include:
(i) The applicant’s name, contact details including address and telephone number;
(ii) Employment history and relevant experience; and
(iii) Education and training.
The personal data so provided may be transferred to between our subsidiaries and associated companies which are involved in the assessment of the applicant’s suitability for the position applied for and/or other positions, which may be, or may become, available within the Company.
The Company shall retain the personal data of unsuccessful applicants for future recruitment purposes for a period of two years from the day on which the recruitment period ends. The personal data of successful applicants shall be retained for the duration of their employment by the Company as described below under the sub-heading “Employment”.
Employment including Post-Employment:
In the course of employment by the Company, personal data of employees will be collected and used for various Human Resources management purposes. These purposes include, but are not limited to, provision of benefits, compensation and payroll, facilitating performance appraisals, promotion and career development activities, making tax returns, administering staffing, training, insurance, welfare, provident fund administration, security/identification purposes and other purposes so as to comply with the legal requirements. It will be transferred to those internal departments, intra-company, and/or to other third parties such as the insurers, bankers, medical practitioners as is necessary for the purposes.
The Company retains certain personal data of employees when they cease to be employed by us. Such data are required for any residual employment-related activities in relation to a former employee including, but not limited to the provision of job references, processing application for re-employment matters, retirement benefits and allowing us to fulfil contractual or statutory obligations.