Privacy Statement

PERSONAL INFORMATION COLLECTION STATEMENT (“PICS”)

1.Your Privacy

MTR Corporation Limited (“MTR CORPORATION”, “we”, “our” or “us”) respects your legal rights of privacy when collecting, storing, using and transmitting personal data and this PICS explains our privacy practices. It is our policy to comply with the requirements of the Personal Data (Privacy) Ordinance (Cap. 486) of the Laws of the Hong Kong Special Administrative Region. In doing so, we will ensure compliance by our staff to the strictest standards of security and confidentiality.

Please read the following carefully to understand our policy and practices regarding how your personal data will be treated. This policy applies to all registered and unregistered users of the Website and may from time to time be revised, or otherwise changed where we deem necessary.

Words or terms used in this PICS which are not specifically defined in this PICS have the meaning given to them in the Terms of Use , MTR Club Rules, or the Airport Express “Ride to Rewards” Programme Rules.

If there is any inconsistency between the English and Chinese version of this PICS, the English version shall prevail.

“personal data” means any personally identifying information or data (such as names, occupations, mobile number, Octopus Card numbers, your age, your income, education level, record of trips undertaken) from which it is practicable for the identity of an individual to be ascertained.

2. Purposes for which we will use your Personal Data

We collect your personal data when you register as a user of the Website.

If you are under the age of 13 you must ask your parent or guardian before providing any personal data to us.

The purposes for which we may use your personal data are divided into obligatory purposes and voluntary purposes. If personal data is to be used for an obligatory purpose, you MUST provide your personal data to us if you want us to provide the service for which you are applying. If personal data is only to be used for a voluntary purpose, you can tell us not to use your personal data for that purpose and we will not do so.

Purposes for which it is obligatory for you to provide your personal data are:
i. application, termination and continuation of the use of the Website and membership of the MTR Club or Airport Express “Ride to Rewards” Programme;
ii. processing billing and payment;
iii. handling and following up service calls, enquiries and complaints;
iv. participation in the MTR Club or Airport Express “Ride to Rewards” in connection with the use of the Website;
v. verification of your identity;
vi. meeting the requirements to make disclosure to any governmental authority in Hong Kong under the requirements of any law binding on MTR Corporation;
vii. to enable the provision and downloading of games;
viii. to enable us to better understand the demographics of our registered users; and
ix. to operate your Member’s Account (if any) and deal with any accumulated Bonus Points in accordance with the Rules.

Purposes for which it is only voluntary for you to provide personal data are:
i. our future marketing purposes and/or joint promotion with subsidiaries or third parties;
ii. other promotions of our operations; and
iii. for direct marketing of our products and services.

If you do not want us to use your personal data for the voluntary purposes listed above, please tick the “opt out” box when you register as a member or indicate your request in your member’s profile.

3. Disclosure

In cases where we do collect personal data from you, we will:
i. tell you (by way of this PICS or by a separate notification) that we are doing so and the use that we will make of such personal data we collect;
ii. where relevant, give you the opportunity to “opt out” (that is to restrict the uses we will make of such personal data); and
iii. tell you how we will store your personal data and how you can review, change and delete the personal data we have stored.
We will to take all practicable steps to keep your personal data confidential but we may transfer/assign such data to the following parties:

i. any agent, contractor or third party service provider who provides administrative, telecommunications, computer and other services to MTR Club or Airport Express “Ride to Rewards” Programme with respect to the operation of its business; and
ii. any person to whom MTR Corporation is under an obligation to make disclosure under the requirement of any law binding on MTR Corporation or for the purposes of any guidelines or codes of practice issued by regulatory or other authorities with which MTR Corporation is expected to comply;

4. Links to Other Websites

This PICS only applies to this Website. If you click on any advertisement or hyperlink linking to another website, you will leave this Website for another location. At any other website, the protection of your privacy, personal data and your exposure to cookies are not our responsibility and you are advised to refer to the privacy policy of that other location (if any).

5. Web Logs

When you come to our Website, our server software records the domain name of your computer. We also track the pages you visit. We do these things so that we can measure traffic, gauge the popularity of various parts of the Website, to gain some general knowledge about our audience, and market the Website to advertisers with whom we may share summarised traffic data. This information does not identify you as an individual.

6. Security

Except as mentioned in point 3 above, your personal data, however stored, will be accessed only by our employees or contractors who are authorised to do so. Upon registering on our web-site, your personal data will be encrypted, transferred to a dedicated MTR server and stored electronically with password protection. Personal data is accessible only by authorised personnel of MTR Corporation or its contractors under a duty of confidentiality to MTR Corporation. Such authorised personnel of MTR Corporation or its relevant contractors designated to handle personal data will be instructed to do so only in accordance with this PICS

7. Use of Personal Data in Legal Proceedings

If it becomes necessary that we have to take action against you for any reason whatsoever including recovering from you any money you owe us, you expressly agree that the personal data provided by you can be relied upon in identifying and taking legal action against you.

8. Your Right to Access and Retention

You may at any time request access to and correct personal data relating to you in any of our records. You may also ask us to delete you or your personal data from any active mailing or distribution list. To exercise any of your rights, contact us at the address or email below marking your communication “Confidential”. In response, we may ask you to provide certain details about yourself so that we can be sure you are the person to whom the data refers. We are required to respond to your requests within 40 days and we will endeavour to do so wherever possible, but we may charge you a reasonable fee for doing so.

We will not retain your personal data if you request us to cease your membership of the MTR Club. We retain the right to erase your personal data as soon as practicable after we are no longer obliged to retain such data by law, or if your Member’s Account has been inactive for 12 months.

9. Personal Data Privacy Officer

The person to whom (1) requests i) for access to data or correction of data, ii) for general information regarding our policies and practices with respect to personal data and iii) about the kinds of personal data that we hold and (2) general questions and complaints should be addressed is as follows:-

MTR Corporation Limited

Personal Data Privacy Officer
[Secretarial & Legal Department]
(Marked Confidential)
Address :
MTR Headquarters Building, 33 Wai Yip Street
Kowloon Bay
Kowloon
Hong Kong
email: PDPO@mtr.com.hk

THIS PERSONAL INFORMATION COLLECTION STATEMENT IS SUBJECT TO CHANGE. ANY CHANGES WILL BE POSTED ON THIS PAGE

10. Retention of Data

We will keep your personal data for as long as necessary to fulfil the purpose for which the data was collected.
Personal Data which is no longer required will be destroyed.