1. In this Statement, the following terms shall have their respective meanings: (a) "BCAN": (i) means, in the context of Futu Securities' provision of the Stock Connect Northbound trading services, Broker-to-Client Assigned Number; (ii) in the context of the SFC's Hong Kong investor identification regime and over-the-counter securities transactions reporting regime (when it comes into effect), has the meaning given to it in paragraph 5.6(b)(ii) of the Code of Conduct for Persons Licensed by or Registered with the Securities and Futures Commission (when it comes into effect); (b) "CCASS Rules" means the General Rules of CCASS, as in force from time to time; (c) "CID": (i) means, in the context of Futu Securities' provision of the Stock Connect Northbound trading services, such identification information relating to you as SEHK may request from time to time under the Rules of the Exchange of SEHK; (ii) in the context of the SFC's Hong Kong investor identification regime and over-the-counter securities transactions reporting regime (when it comes into effect), has the meaning given to it in paragraph 5.6(b)(iv) of the Code of Conduct for Persons Licensed by or Registered with the Securities and Futures Commission (when it comes into effect); (d) "data subject", in relation to personal data, means the individual who is the subject of the data; (e) "Futu Group" means Futu Securities and its subsidiaries, holding companies, subsidiaries of those holding companies and other associated or related entities; (f) "Futu Securities", or "we" or "us" means Futu Securities International (Hong Kong) Ltd; (g) "GDCA" means Global Digital Cybersecurity Authority CO., Ltd (数安时代科技股份有限公司); (h) "HKEX" means Hong Kong Exchanges and Clearing Limited; (i) "Hong Kong" means the Hong Kong Special Administrative Region of the People's Republic of China; (j) "China mainland" means the People's Republic of China, excluding Hong Kong, Macau, and Taiwan; (k) "PDPO" means the Personal Data (Privacy) Ordinance (Cap. 486, Laws of Hong Kong); (l) "personal data" means any data: (a) relating directly or indirectly to a living individual; (b) from which it is practicable for the identity of the individual to be directly or indirectly ascertained; and (c) in a form in which access to or processing of the data is practicable; (m) "non-personal data" means any data not falling within the meaning of "personal data"; (n) "SEHK" means the Stock Exchange of Hong Kong; and (o) "SFC" means the Securities and Futures Commission of Hong Kong. 2. Futu Securities is committed to providing its clients with excellent securities services. Based on your service needs, we will collect and use different types of your personal data and non-personal data. We treat the use and confidentiality of our clients' personal data and non-personal data seriously. 3. The security and privacy of our clients' personal data and non-personal data is a matter of utmost importance for Futu Securities. We are committed to protecting the privacy, confidentiality, and security of our clients' personal data and non-personal data; in the case of personal data by complying with the requirements of the PDPO through the implementation of the policies set out in this Statement. 4. Where our operations are also subject to privacy legislation other than that of Hong Kong, such as the privacy laws of China mainland, we will seek to comply with all such applicable laws and regulations to the extent that it is possible for us to do so. Where there is a conflict between different systems of laws, we will, in most cases, comply with the system of law that imposes a stricter standard on us. 5. Please note that this Statement may be amended from time to time, with prior notice to you. Nevertheless, you are advised to check the latest version of this Statement on our websites on a regular basis.
11. Personal data held by Futu Securities will be kept confidential, but may be disclosed to the following persons for one or more of the purposes set out in paragraph 10: (a) Any of our officers, employees, agents, contractors or third party service providers who provide administrative, credit data, debt collection, telecommunications, client verification, due diligence, computing, payment, promotional, marketing or other services related to our business operations to us (e.g. IT vendors, electronic storage vendors, biometric authentication service providers); (b) Any member of the Futu Group; (c) Any of your guarantors and security providers or prospective guarantors and security providers; (d) Any financial institution trading with or intending to trade with you, or any of your counterparties in a trade; (e) Credit data service institutions or debt collecting institutions (where you owe us money or where there has been an event of default (howsoever described)); (f) Any actual or proposed assignee or transferee of Futu Securities, or participant or sub-participant or transferee of Futu Securities in respect of our rights against you; (g) Any person or entity or data recipient who has already established or intends to establish any business relationship with Futu Securities; (h) Any certification authority whether in Hong Kong or other places (including but not limited to China mainland); (i) Any agencies in Hong Kong or other places for compliance with applicable laws, regulations, rules or guidelines regarding the automatic exchange of financial account information or the Foreign Account Tax Compliance Act promulgated by the United States; and (j) Any local or foreign legal agency, regulatory body, government, tax authority, law enforcement agency, administrative or statutory agency, stock exchange or clearing house, or other self-regulatory agency or industry organization or group in Hong Kong or other places (including but not limited to China mainland), and this includes the SEHK, the relevant SEHK Subsidiaries and the SFC. 12. Futu Securities may transfer your personal data to a place outside Hong Kong in accordance with this Statement. Your personal data may not be afforded the same or similar level of protection as it is under the PDPO.
13. Futu Securities may use your personal data to send you information about products, services and other marketing materials that we think you might be interested in. 14. You can choose to receive direct marketing materials by email, direct mail and/or other means. If you do not wish to receive such direct marketing materials, you may elect to opt-out at any time by contacting out Customer Services Department. Futu Securities intends to use your personal data for direct marketing purposes, for which we have to obtain your consent (which includes an indication of no objection). In this regard, please note that: In this regard, please note that: (a) Your name, contact details, product and service, investment portfolio information, trading patterns and conduct, financial background and statistics held by Futu Securities from time to time may be used for direct marketing; (b) The following categories of services, products and subjects may be marketed to you: (i) Finance, insurance, securities, commodities, investment and related services and products and facilities; (ii) reward, loyalty, co-branding or privileges programmes and related products and services; (iii) financial or banking products and services offered by our business partners (the names of such partners will be provided to you); and (iv) donations and contributions for charitable and/or non-profit making purposes; (c) The above services, products and subjects may be marketed by Futu Securities and/or the following persons: (i) Any member of the Futu Group; (ii) Third-party financial institutions, underwriters, securities, commodities and investment service providers; (iii) Providers of third-party reward, loyalty, co-branding or privileges programme (the names of such co-branding partners will be provided to you); (iv) Our business partners; (v) Charitable and/or non-profit organizations; (d) In addition to promoting the above services, products and subjects, Futu Securities may provide the personal data mentioned in paragraph 14(a) to any of the persons as mentioned in paragraph 14(c) above for the purpose of promoting their services, products and subjects. In order for us to do so, we need to obtain your written consent (which includes an indication of no objection) for this purpose; (e) If you do not wish Futu Securities to use or provide your personal data to other persons for the direct marketing purposes set out in paragraph 14(d), please notify our Customer Service Department; and (f) We may receive money or other property in return for providing your personal data to the other persons in paragraph 14(d) and, when requesting your consent or no objection we will inform you if we will receive any money or other property in return for providing the personal data to the other persons.
15. Where you provide to us personal data about another person, you must give to that person a copy of this Statement and, in particular, tell him/her that you have provided us with their personal data and how we may use his/her personal data.
16. Futu Securities implements protective measures to safeguard and secure personal data to ensure it is protected against unauthorised or accidental access, processing, or erasure. These measures include the following:
- Access or use of such data is limited to authorized staff or agents on a “need to know” basis and such data is accessed utilizing secured methods (e.g. personal data is encrypted when necessary);
- We do not distribute your personal data to other persons except to the classes of transferees set out in this Statement and for the purposes set out in this Statement;
- The use and transfer of your personal data between members of the Futu Group is subject to strict internal security standards, confidentiality policies, privacy laws and other applicable laws;
- We ensure that our employees fully comply with such standards, policies and laws; and
- We provide training to our staff on the proper handling of your personal data.
18. According to and in accordance with the terms of the PDPO, you have the right to:
- obtain information regarding the processing of your personal data and access the personal data which we hold about you;
- request that we rectify your personal data if it is inaccurate or incomplete; and
- lodge a complaint with the Privacy Commissioner for Personal Data if you think that any of your data privacy rights have been infringed by us;
24. We will not keep personal data longer than is necessary for the fulfillment of the purpose for which it was collected. The retention period of personal data collected depends on different factors, including:
- Usage: we may have to continue to retain the personal data for the purpose(s) for which it was collected for; and
- Legal obligations: there may be minimum retention periods for that personal data, as stipulated in applicable laws and regulations.