This Privacy Policy describes the methods adopted by CRIF Hong Kong Limited (“CRIF HK”) in the management of its website, https://www.crif.hk, with reference to the processing of the personal data of visitors who access it. This is a general information notice provided to all visitors to the website in accordance with the Personal Data (Privacy) Ordinance (Chapter 486) (“PDPO”) and all other applicable data protection laws and regulations (“Applicable Data Protection Legislation”).

When using certain services provided by CRIF HK, a specific and detailed Personal Information Collection Statement ("PICS”) will be provided to visitors in accordance with the requirements of Data Protection Principle ("DPP”) 1 and DPP5 under the PDPO., if necessary.

The Data User (equivalent of “data controller” under GDPR)

Following access and consultation of this site, data relative to identified or identifiable persons may be processed.

The Data User is CRIF HK, with registered offices in Flat 11, 11/Floor, Wing On Plaza, 62 Mody Road, Tsim Sha Tsui East, Kowloon, Hong Kong Special Administrative Region of the People’s Republic of China.

Location of Data Processing

The processing of data collected with reference to those who access the website is carried out at the at the CRIF HK offices in compliance with Applicable Data Protection Legislation. The data shall be handled by persons with relative technical skills; employees or associates, who have been specifically assigned data processing roles.

Methods of Data Processing

The data shall be processed in a lawful, correct fashion, so as to ensure data security and confidentiality in accordance with Applicable Data Protection Legislation. Personal data shall be processed using electronic, or at any rate, computerized devices.

Purpose of Data Processing

Visitors’ data may be processed for:

1. the performance of the operations strictly necessary to provide the services or respond to enquires that may be requested by the visitors, including navigating the website.
2. the provision of technology services (remote or on-site assistance and maintenance, etc.), including by specifically authorized third parties.
3. statistical processing of aggregated data in relation to website services.
4. direct marketing for promotion of CRIF HK service

On the website pages where your personal data is explicitly collected, you will find, where necessary, any additional privacy specifications, as well as the methods for acquiring your consent and/or identifying any further basis for the legitimacy of the processing pursuant to Applicable Data Protection Legislation.

Legal basis for Data Processing

Visitors’ personal data will be processed on the basis of one or more of the following conditions. In particular, processing carried out for the purposes referred to in points: no. 1 and 2 above, have as their legal basis the need to fulfil the requests for the provision of a service or to response an inquiry directly available through the website. Therefore, this type of data processing is strictly necessary and connected to a pre-contractual and/or contractual phase or designed to respond to a specific request according to DPP1 of the PDPO, and as such, the personal data collected is necessary. If the data is not provided, it will not be possible to provide the service or to respond to visitors’ request.

Categories of recipients of personal data

The data may be communicated to different categories of recipients, according to the service requested by the CRIF client. For each service requested by the CRIF client, a special information notice will be provided with the details of the recipients of the personal data.

Transfer of personal data

Generally, the data provided by CRIF clients may be transferred outside Hong Kong to its parent company CRIF S.p.A., its headquarter office with the address at Via Mario Fantin 1-3, 40131 Bologna (BO), Italy or its affiliates. This transfer may occur according to the individual service provided by CRIF. For each service requested by the CRIF client, a PICS will be provided with the details of the countries to which the data will be transferred. However, should personal data be transferred outside Hong Kong, the transfer will be carried out in accordance with the provisions of the PDPO and all other applicable laws (as will be indicated in the PICS).

Type of personal data processed

With reference to browsing data, the computer systems and software procedures used to operate this Website acquire, during their normal operation, some personal data whose transmission is implicit to the use of Internet communication protocols. This information is not collected in association with identified data subjects, but by its very nature could, through processing and association with data held by third parties, allow visitors to be identified. This data category includes the IP addresses or domain names of computers used by visitors who connect to the Website, Uniform Resource Identifier (URI) addresses of the requested resources, the time of the request, the method used to submit the server request, and other parameters related to the visitors’ operating system and computing environment. The optional and voluntary sending of e-mails to the addresses indicated on the website involves the acquisition of the visitor’s personal data which is necessary to respond to visitor requests.

Data Submission

Visitors are free to decide whether to provide the personal data necessary for CRIF HK to supply the requested services. Failure to provide this data may make it impossible CRIF HK to supply the requested information or services.

Retention period

CRIF HK retains the navigation data for a period not exceeding 18 months from the last interaction with the Website. For each service or initiative requested by the CRIF client, a special information notice will be provided with details of the data retention period or the criteria used to determine this period.

Cookies

For details about the use of cookies on this Website, please refer to the Cookie Policy.

Data Subjects Rights

Pursuant to the Applicable Data Protection Legislation, the visitor can exercise the following rights: the right to access his or her personal data, ask for the amendment or deletion of the data, or restriction of the processing. Visitors also have the right to oppose the processing, as well as the right to portability. In addition, visitors can withdraw their consent at any time, it being understood that the withdrawal of consent does not affect the lawfulness of the processing carried out up to the point of withdrawal. In any case, for each service requested by the CRIF client, the PICS will be provided with details of the rights that can be exercised and the ways in which to exercise them. In such cases, visitor can exercise his/her rights by contacting the Data User using the following contact details:

Address: Flat 11, 11/Floor, Wing On Plaza, 62 Mody Road, Tsim Sha Tsui East, Kowloon, Hong Kong Special Administrative Region of the People’s Republic of China.

E-mail: info.hk@crif.com