HONG KONG POPULATION DATA SERVICE (Item check 0324) | ID NUMBER 101508
• Supplier hosts the Supplier Data
• Supplier is a Sub-processor of Client Information
• Client Information includes Personal Data
• The Sub-processor is located in the Hong Kong Special Administrative Region of the People’s Republic of China
• The Sub-processor is located outside of the EEA
• This Supplier has not agreed to be subject to GDPR but has agreed to equivalent data protection provisions.
• The Supplier has passed GBG’s full GDPR due diligence assessment and information security review.
• Where GDPR applies to the End User, the End User must rely on a derogation to transfer Client Information to the Sub-processor based outside of the EEA in accordance with Article 49 GDPR
• The End User must not provide Personal Data belonging to EEA Data Subjects for sub-processing by this Data Supplier
The Supplier Data that GBG uses to provide the Hong Kong Population Data Service is supplied by Trans Union Limited (“TransUnion”) and includes consumer credit information about Hong Kong Data Subjects. GBG is obliged under the terms of its agreement with TransUnion to ensure that all End Users agree to comply with the following provisions:
1. DEFINITIONS
1.1. In these Additional Terms, the following definitions shall apply, in addition to the definitions set out in the General Terms:
“Database” means the database owned and maintained by TransUnion which contains the consumer credit data and other items of data including consumer address and certain identifier information that it is allowed to collect and retain under the Code of Practice on Consumer Credit Data issued by the Privacy Commissioner.
“Data Subject” means the individual who is the subject of the Input Data and the Personal Data contained in the Database.
“Deliverable” means the output delivered by TransUnion.
“Hong Kong” means the Hong Kong Special Administrative Region of the People’s Republic of China.
“Input Data” means the data provided by the End User for processing as part of the Service.
“Ordinance” means the Personal Data (Privacy) Ordinance (Chapter 486 of the Laws of Hong Kong) in force from time to time.
“Permitted Purpose” means the verification of the information collected from individual consumers for anti-money laundering, identification and risk mitigation purposes.
“Personal Data” means the personal data as defined under the Ordinance.
“Privacy Commissioner” means the Privacy Commissioner for Personal Data, Hong Kong.
“Prohibited Purpose” means one or more of the prohibited purposes described at clause 2.2.
“Service” means the processing of Input Data and the provision of a Deliverable as requested by the End User.
2. USE OF THE SERVICE
2.1 Before accessing the Hong Kong Population Data Service, the End User must confirm and verify that its organisation:
a) is a legitimate existing business;
b) does not carry out business activities which are illegal, illicit, immoral or offensive to a reasonable person, or likely to have negative impact on TransUnion's reputation in its reasonable opinion;
c) has the appropriate consent required under the Ordinance in order to access and use the Personal Data of the Data Subjects and the Deliverables as more particularly detailed in clause 6.1;
d) shall only use the Hong Kong Population Data Service for the Permitted Purposes and that it will not in any circumstances use the Hong Kong Population Data Service for the Prohibited Purposes;
e) is using the Hong Kong Population Data Service for its own benefit and that it does not intend to resell or otherwise release the information to another third-party business, entity or person, except with the prior written consent of TransUnion.
2.2 The End User must not use the Hong Kong Population Data Service for any of the following Prohibited Purposes:
a) Adult entertainment service of any kind (but not including legal online gaming);
b) Attorney or Law Firm engaged in the practice of law, unless engaged in collection or using the Service or Deliverable in connection with a consumer bankruptcy pursuant to the written authorization of the consumer;
c) Bail Bondsman, unless licensed by the state or region in which they are operating;
d) Credit counselling, except not-for-profit credit counsellors;
e) Credit repair clinic;
f) Dating service;
g) Financial counselling, except a registered securities broker dealer;
h) Genealogical or heir research firm;
i) Massage service;
j) Company that locates missing children;
k) Pawn shop;
l) Private detective, detective agency or investigate company;
m) Company that handles third party repossession;
n) Subscriptions (magazines, book clubs, record clubs, etc.);
o) Tattoo service;
p) Company seeking information in connection with time shares (exception: financers of time shares);
q) Law enforcement agency;
r) Asset location service; or
s) News agency or journalist.
2.3 The End User shall not maintain, copy, capture or otherwise retain in any manner the Deliverables or any information contained therein except for accounting, customer service, regulatory and/or compliance purposes. The End User shall purge any such information from its systems and destroy all hard copies on a daily basis, except for the information retained solely for the purposes of customer service, regulatory and compliance purposes for a reasonable period that is not longer than necessary.
2.4 The End User must track and maintain records of each inquiry carried out using the Hong Kong Population Data Service. Such records must include a copy of the authorisation from each individual consumer in accordance clause 6.1. All records must be retained for the term of this Agreement and for a period of at least three (3) years thereafter.
2.5 Copies of records kept in accordance with clause 2.4 must be provided to TransUnion within fourteen (14) Business Days of a request to do so.
3. DUE DILLIGENCE AND AUDIT
3.1 Prior to granting the End User access to the Hong Kong Population Data Service, the End User acknowledges that GBG must use reasonable endeavours to ensure that the End User has a legitimate reason to access the Service and that the End User’s intended use or the Service complies with relevant laws and meets the minimum standards specified TransUnion.
3.2 The End User acknowledges and agrees that access to the Hong Kong Population Data Service is dependent on it passing GBG’s review carried out in accordance with clause 3.1 and that it shall cooperate with GBG and provide all necessary information to enable GBG to comply with its obligations.
3.3 The End User shall cooperate with GBG and TransUnion in relation to any audit or review carried out in accordance with this clause 3 and/or any audit right contained within the General Terms, including any requests to correct any deficiencies discovered during such audits within a period of time mutually agreed upon. In such circumstances, GBG reserves the right to suspend any further transmission of the Deliverables until such deficiencies are corrected.
4. LIABILITY
TransUnion is not a party to any contractual arrangement entered into between GBG and the End User, and is not liable for any dispute that arises between GBG and the End User. Furthermore, the End User acknowledges and accepts that it shall not be entitled as a third party beneficiary or otherwise, to take any action or have any recourse against TransUnion in respect of any claim based upon any actual or alleged failure to perform under this Agreement.
5. EXCLUSION OF WARRANTIES
TransUnion shall use good faith in obtaining and assembling such information from sources TransUnion considers reliable and shall use all reasonable endeavours to ensure that the records contained within the Database are current, up-to-date, accurate and of equal quality and currency to that are provided to other clients. However, TransUnion does not guarantee the accuracy nor completeness of any Service, Deliverable and/or data furnished. TransUnion makes no warranties, express or implied including, but not limited to, the implied warranties of merchantability or fitness for a particular purpose, with respect to the services or any deliverables, furnished under this Agreement.
6. DATA PROTECTION AND COMPLIANCE WITH RELEVANT LAWS
6.1 The End User warrants that it will not use the Hong Kong Population Data Service, which involves the processing of Personal Data, unless:
a) a clear and conspicuous disclosure is first made in writing to the Data Subject;
b) it has obtained consent from its Data Subjects including but not limited to, under any and all data protection and privacy laws and regulations and any other applicable law, to provide any and all information including but not limited to, the Input Data, to TransUnion for performance under this Agreement;
c) the End User has obtained the authorisation and such other documents from each Data Subject in accordance with the Ordinance and any other applicable privacy laws in Hong Kong; and
d) the Service, the Deliverables and any information contained or derived therefrom are not to be used in violation of any applicable Hong Kong law or regulations.
6.2 In particular, the End User warrants that, before making request for the Service from TransUnion it has obtained the authorisation and such other documents the language which consists of the terms set out below from each Data Subject in accordance with the Ordinance and any other applicable privacy laws in Hong Kong:
“For verifying my identity for the purposes of anti-money laundering, identification and risk mitigation, I, [Name], voluntarily provide [You] (“Service Provider”) and/or GB Group PLC (“GBG”) with my Personal Data (as defined below) and hereby expressly consent to and authorise the following:
“Personal Data” refers to such data only consist of the following (and shall include any updated data of the following items from time to time):
(a) my full name, including surname, given name and other name;
(b) my Hong Kong Identity Card Number;
(c) my date of birth;
(d) my correspondence address; and
(e) my telephone number.
This consent and authorization is given by me to the Service Provider on its own behalf, and on behalf of, and as agent for, GBG and TransUnion Limited (“TransUnion”) for the following uses of my Personal Data:
(i) the transfer to TransUnion by the Service Provider, through GBG, of my Personal Data for verification of my Personal Data;
(ii) TransUnion checking if my Personal Data is on the database of TransUnion;
(iii) TransUnion providing the matching result to GBG and Service Provider, which may or may not be located inside Hong Kong, without having sent me any copy of the result for my review; and
(iv) Retention of the Personal Data for the period necessary.
By submitting this data, I understand the above and I give consent to and authorize the Service Provider, GBG and TransUnion to act in accordance with (i) to (iii) above. Further, I agree and acknowledge that the use of my Personal Data for the above by the Service Provider, GBG and TransUnion shall not be made the basis for any complaint, claim, suit, demand or cause of action or other proceeding against the Service Provider, GBG, or TransUnion Limited by me or any third party.
__________________
[Name of Data Subject]
[Date]”
6.3 The authorisation consent form from Data Subject set out in clause 6.2 serves as a sample only and the End User shall be entitled to insert clauses which are similar to those set out at 6.2 or clauses that give the same effect.
6.4 The Supplier Data used to provide this element of the Service is hosted by the Data Supplier. In order to perform the Services, the Data Supplier shall act as Sub-processor of Client Information (including any Personal Data supplied) for the sole purpose of delivering this element of the Service. The Client authorises GBG to appoint the Data Supplier as Sub-Processor for the purposes specified in this clause 6.4.
6.5 TransUnion is based in Hong Kong which is located outside of the EEA. Where GDPR applies to the End User, the End User acknowledges that prior to submitting Client Information to GBG for processing it shall determine, and is solely liable for ensuring that it can rely on a derogation to transfer Client Information to TransUnion acting as the Sub-processor based outside of the EEA in accordance with Article 49 GDPR.
6.6 TransUnion has not agreed to be subject to GDPR but has agreed to equivalent data protection obligations and has passed GBG’s full GDPR due diligence assessment and information security review. The End User warrants that it shall not provide Personal Data belonging to EEA Data Subjects for sub-processing by TransUnion.
7. TERMINATION
Notwithstanding the other termination provisions contained within the Agreement, under the terms of GBG’s agreement with TransUnion the supply of the Hong Kong Population Data Service may be terminated immediately upon notice if required to ensure compliance with any applicable law, or in the event that there is a material change in existing legal requirements which adversely affects GBG’s Agreement with TransUnion.
8. GOVERNING LAW AND JURISDICTION
Any matter concerning the Hong Kong Population Data Service and these terms and conditions shall be governed by the laws of Hong Kong and the End User agrees to submit to the courts in Hong Kong.