1. Our Privacy Policy

Barrenjoey Asia Limited and its related bodies corporate (“Barrenjoey”, “we”, “us” or “our”) respect the privacy of people we deal with and are committed to protecting the information provided to us by clients, employees, contractors, service providers, and other persons.

This Privacy Notice applies to anyone whose Personal Data (as defined in section 1.3 below) is provided to us in or from Hong Kong, specifically pursuant to our obligation(s) under the Personal Data (Privacy) Ordinance (“PDPO”). This Privacy Notice sets out how and why we collect store, use and share your Personal Data. It also tells you about your privacy rights and how the law protects you.

We explain in this Privacy Notice what is considered Personal Data, methods of collection, the purposes for which it is used, the third parties to whom it may be disclosed and how individuals can exercise their rights in relation to their Personal Data.

It is important that you read and retain this notice, together with any other Privacy Notice we may provide to you on specific occasions, so that you are aware of how and why we are using your Personal Data.

1.1 Recitals
Barrenjoey will usually be the controller of your Personal Data. We may engage third party service providers to process Personal Data on our behalf and those third parties act as processors of your data. Your Personal Data may be transferred or shared within Barrenjoey and third-party service providers in or outside of Hong Kong.

1.2 Scope
This Privacy Notice applies to the following individuals (“you”):
• Our prospective employees (job applicants);
• Anyone involved in any transaction or interaction with us, whether it is in your personal capacity or as a representative of a legal entity (for example, director, a company manager, agent, legal representative, staff, other authorised representative etc);
• Anyone receiving services from us;
• Our business partners;
• Our suppliers, advisors, consultants and/or secondees; and
• Website visitors.

This Privacy Notice applies to all Personal Data collected, maintained, transmitted, stored, retained, or otherwise used (i.e. processed) by us regardless of the media on which that Personal Data is stored.

1.3 What is “Personal data”?
“Personal Data” means information (such as name, address, mobile number, image, identification number, or electronic ID, geographic location) which relates to a living individual and can be used to identify that individual. It must also exist in a form which access to or processing of is reasonably practicable.

1.4 Data protection principles
The PDPO stipulates data protection principles (“DPPs”) which outline how we should collect, handle and use Personal Data and requires us to demonstrate that any Personal Data we hold about you is:

• Collected and processed lawfully, fairly and transparently;
• Processed for specified, explicit and legitimate purposes and consent is obtained where required;
• Adequate, relevant and limited to what is necessary;
• Accurate and, where necessary, kept up to date;
• Kept for no longer than is necessary;
• Kept securely; and
• Accessible to you at your request.

1.5 Obtaining Personal Data
We obtain your Personal Data as follows:

• From the information you provide to us when you meet or interact with us;
• From information about you provided to us by your company or an authorised intermediary;
• When you visit our website, we collect cookie data;
• When you communicate with us by telephone, email or other forms of electronic communication; in this respect, we may monitor, record and store any such communication;
• When you complete (or we complete on your behalf) client on-boarding or applications or other forms; or
• From publicly available sources or from third parties, most commonly where we need to conduct background checks about you.

1.6 Collection of Personal Data
The Personal Data we may collect from or in relation to you includes for example:

• information establishing your identity (for example, your name, address, email address, date of birth, passport or Hong Kong Identity card, photograph);
• documents to verify information supplied to us, such as bills issued by third parties or endorsements or statements issued by employers or institutions such as banks;
• reference checking information obtained via third parties such as credit reference agencies, and sanctions lists;
• financial information (for example, bank or investment account details);
• information provided so that we are able to fulfil our regulatory compliance obligations including anti-money laundering and “know your client” checks (for example, the information establishing your identity as set out above);
• information you provide when you enter into any agreement or provide other documentation or information in respect of your interactions with us, or when you use our services;
• any information you independently choose to provide to us (for example, if you send us an email or call us);
• information relating to your use of our website (for example, domain name, IP address and cookies) or information you provide when you register for alerts and subscriptions and when you report a problem with any of our website services; and
• any video from CCTVs or recordings from Teams meetings or telephone lines.

1.7 Purposes of collection and processing
The purposes for which your Personal Data is collected and processed by us include the following:

• It is necessary for the performance of a contract or to enable us to enter into a contract (for example, providing the services you requested).
• It is necessary for the management of your account(s) with us, including for example, conducting identity checks, marketing and providing investment or financial services or products for you.
• When we have a legitimate interest in processing data about you to operate our business or protect our interests (for example, to provide, maintain, and improve our services, conduct data analytics, and communicate with you).
• To comply with our legal, tax, judicial, governmental and regulatory obligations (for example, collecting due diligence information and documents to comply with the Securities and Futures Ordinance and related rules (“SFO”) and to comply with our obligations under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance) and any judgment, court order, voluntary code, sanctions regime, within or outside Hong Kong.
• When we have your consent to do so (for example, when you opt in to receive marketing communications from us). When consent is the legal basis for our processing data about you, you may withdraw such consent at any time by contacting us using the details in the Contact Us section below.

Failure to provide your Personal Data may affect our ability to provide you with the services required, to fulfil obligations under a contract, or carry out your instructions to us. We may be required, in some cases, to suspend or discontinue our services to you, terminate our contract with you or terminate your account(s) with us.

1.8 Sharing and transferring Personal Data
We will only disclose your Personal Data to third parties if we are legally obliged to do so or where there is a need to comply with our contractual obligations to you, for instance we may need to pass on certain information to any external service providers including consultants or third-party screening platform providers.

To comply with our legal, regulatory, tax, judicial or other governmental obligations, we may also disclose Personal Data to the relevant government, supervisory and judicial authorities such as:

• Public authorities, regulators and supervisory bodies in the countries in which we operate.
• Tax authorities may require us to report customer assets or other Personal Data such as your name and contact details and other information about your organisation; for this purpose, we may process your identification data such as national identifier in accordance with applicable law.
• Judicial/investigative authorities such as the police, public prosecutors, courts and arbitration/mediation bodies on their express and legitimate request.

Where there is a requirement to use an intermediary or third-party service provider, we will ensure that the Personal Data is exported to one who is either located in a jurisdiction that is deemed by the Privacy Commissioner of Personal Data in Hong Kong (“PCPD”) as an adequate jurisdiction or have a safeguard in place such as standard contractual clauses or a legal derogation. You may request further information on this from Barrenjoey (see contact details below).

1.9 Data retention
Generally, we will keep information relevant to our dealings with you for at least seven (7) years following the termination of our relationship with you. We will retain data about you for as long as necessary to fulfil the purposes for which we collected it, in accordance with our legal obligations, or for the establishment, exercise or defence of legal claims. In doing this, we will consider the amount, nature, and sensitivity of the data, the potential risk of harm from unauthorised use or disclosure of the data, the purposes for which we process the data and whether we can achieve those purposes through other means, and the applicable legal requirements.

In some circumstances, data about you may be anonymised, so that it can no longer be associated with you, in which case it is no longer personal data.

Once we no longer require data about you for the purposes for which we collected it, we will securely destroy, anonymise, pseudonymise or securely encrypt the data in accordance with applicable laws and regulations.

1.10 Your Rights as a Data Subject
As a data subject, you have a number of rights with regard to your Personal Data. You have the right to request to access and rectify your data as well as for it to be erased and to restrict the processing of your data in certain circumstances.

You also have the right to lodge a complaint with the PCPD (further details below) if you feel that we have not complied with our obligations under applicable data protection law regarding how we deal with your Personal Data.

Your rights pursuant to the PDPO amongst others:

• Request access to your Personal Data; this enables you to receive a copy of the Personal Data we hold about you.
• Request correction of the Personal Data that we hold about you; this enables you to have any incomplete or inaccurate information we hold about you corrected.
• Request erasure of your Personal Data; this enables you to ask us to delete or remove Personal Data where there is no good reason for us to continue to process it. You also have the right to ask us to delete or remove your Personal Data.
• Object to processing of your Personal Data; you have the right to object where we are processing your Personal Data for direct marketing purposes.
• Request the restriction of processing of your Personal Data; this enables you to ask us to suspend the processing of Personal Data about you, for example, if you want us to establish its accuracy or the reason for processing it.

We typically do not charge you a fee to respond to one of the above requests. However, we may charge a reasonable fee if your request is unreasonable or excessive, or we may refuse to comply with the request in such circumstances.

1.11 Consent and Use of Data in Direct Marketing
To the extent we are required to rely on your explicit consent to process your Personal Data, we will provide you with full details of the information that we would like and the reason we need it so that you can carefully consider whether you wish to consent. You should be aware that it is not a condition of your relationship with us that you agree to any request for consent from us.

We may use your Personal Data for direct marketing purposes:

(1) Your name and contact details may be used from time to time in direct marketing to you and the entity you are representing or for which you are authorised to act; and
(2) The classes of services and products which may be marketed include financial services and products, services and products offered by the affiliates of Barrenjoey Asia Limited, and contributions for charitable and/or non-profit making purposes.

We will not provide your Personal Data to any third parties for direct marketing purposes unless we obtain your express consent in doing so.

If you do not consent to us using your Personal Data for the direct marketing purposes described above or to withdraw your consent at any time, please contact us using the email provided below.

Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so under an applicable law. Withdrawal of your consent for us to continue processing your Personal Data may in some cases cause delays or lead to refusal of certain products and services.

1.12 To inform us of changes
It is important that the Personal Data we hold about you is accurate and, where necessary, kept up to date. Please keep us informed if your Personal Data changes during your working relationship with us and respond promptly to our request for updates of your data.

1.13 Are you obliged to provide us with your Personal Data?
In some cases, we are legally required to collect Personal Data, or your Personal Data may be needed before we may perform certain services and provide certain products. We undertake to request only the Personal Data that is strictly necessary for the relevant purpose. Failure to provide the necessary Personal Data may cause delays or lead to refusal of certain products and services.

1.14 How do we protect your Personal Data?

We have implemented reasonable administrative, technical, and physical measures to protect your Personal Data against unauthorised or accidental access, processing, erasure, loss or use.

1.15 Contact Us: Questions and Complaints
You have the right to request access to and correction of your Personal Data held by us at any time. To withdraw your consent or in case of any privacy-related questions, you can also contact us by any of the following means:

Email: notices@barrenjoey.com
Address: Attention Barrenjoey Legal,
Unit 1004, 10/F, Dina House Ruttonjee Centre
3-11 Duddell Street,
Hong Kong

You have the right to make a complaint at any time to the Privacy Commissioner of Personal Data in Hong Kong, which is the relevant authority that safeguards your interests.

Contact Details:

Email: complaints@pcpd.org.hk
Telephone: +852 3423 6666
Address: Unit 1303, 13/F, Dah Sing Financial Centre,
248 Queen’s Road East,
Wanchai,
Hong Kong

2. Changes to this Privacy Notice

Our practices with respect to data about you may vary from time to time, and we may update this Privacy Notice at any time. If we make changes, we will notify you by revising the date at the bottom of this notice and, in some cases, we may provide you with additional notice (such as adding a statement to our website or sending you a notification). The latest version of this Privacy Notice will be made available to you on our website, and we encourage you to review this Privacy Notice regularly to stay informed about our data practices with respect to data about you and the choices available to you.