Information directly submitted by or collected from Data Subject (and/or any applicable recruitment agency of which Data Subject is a client)

• Identity data such as name, any referral contact and right to work/immigration status;
• Contact data such as phone number and email address;
• Professional and work background data such as employment history, skills, any professional certifications and membership(s), education history, and (optional) current/proposed compensation;
• Personal background data such as languages spoken and disability (if any), and declarations on outside business activities, conflicts of interest (including any relationships which may give rise to conflicts of interest) (if/where applicable);
• LinkedIn data such as user ID;
• Opinion data such as candidate’s responses during interview and/or written tests.

Information generated by HKEX

• Evaluation data such as interview notes (including indications of expected compensation) and feedback from application or internship related activities.

Information collected automatically from a device or system

• Technical data such as unique device identifiers, IP addresses, login credentials and access logs;
• Audio-visual data such as phone recordings, meeting recordings, CCTV recordings and photographs;
• Opinion data such as recorded coding assessments.

Information collected from third parties

• Candidate profile (including expectations on compensation package) data shared by a recruitment firm / search agency.

Specifically, for further information on our Personal Data collection for Data Subjects in Chinese Mainland, please see Addendum 1; and for Data Subjects who are California residents, please see Addendum 2.

Information directly submitted by or collected from Data Subject (and/or any applicable recruitment agency of which Data Subject is a client)

• Identity data such as name, nationality, government issued identification document (e.g. passport, national insurance, social security, identity card, residence permit) and right to work/immigration status;
• Contact data such as phone number, residential address and email address;
• Professional data such as employment history, skills, any professional certifications and membership(s), education history, referees and their contact details and compensation proof;
• Personal background data such as date of birth and languages spoken;
• Payments (Payroll) data such as payee name and bank account number;
• Due diligence and compliance check data such as any alias, any outside business activities, any potential or actual conflict of interests with HKEX as a business and/or existing members of HKEX staff or any other relationships which may give rise to conflicts of interest, any criminal convictions, and any position in management or a board (if any);
• Social Media data such as user IDs, posts, and comments.

Regulatory filing and disclosure data

• Regulatory filing and disclosure data such as name, age, education, work experience, position and shareholding in a company.

Information collected automatically from a device or system

• Technical data such as unique device identifiers, IP addresses, login credentials and access logs;
• Audio-visual data such as phone recordings, meeting recordings, CCTV recordings and photographs.

Information collected by/from third parties

• Information retrieved from publicly available sources such as: (i) print and digital media; (ii) websites of organisations with which the Data Subject is connected; and (iii) government, regulator, or industry registries;
• Due diligence data retrieved from external service providers (e.g. background screening, criminal record check and credit checks) that we have engaged to facilitate our onboarding process.

Specifically, for further information on our Personal Data collection for Data Subjects in Chinese Mainland, please see Addendum 1; and for Data Subjects who are California residents, please see Addendum 2.

Information directly submitted by or collected from Data Subject

• Identity data such as name, signature, nationality, government issued identification document (e.g. passport and other travel documents, national insurance, social security, identity card and residence permit), employee identification number, race and ethnicity, photograph, right to work/immigration status, and vehicle licence plate number;
• Contact data such as preferred phone number, residential address, email address and emergency contact;
• Professional data such as acquired skills and professional achievements, relevant professional certifications and membership(s), continuing education, professional (internal/external) development and training and voluntary work;
• Role data such as acceptance of terms and conditions of employment;
• Personal background data such as date of birth, marital status, languages spoken, disability (if any) and next-of-kin;
• Payments (Payroll) data such as payee name, bank account number and tax information;
• Benefits data such as payment receipt for reimbursement of rental payment, education costs, pension enrolment, private members club membership, medical, life and personal accident insurance enrolment, and home ownership status;
• Dependents’ data such as birth certificate of child, marriage certificate, information on minors, information of spouse or spouse equivalent, and the enrolment of dependents in the medical, life and personal accident insurance provided by HKEX (as well as any claims);
• Digital content data such as videos featuring Data Subject and statements made by Data Subject for use on the HKEX website or social media channels;
• Due diligence and compliance check data such as any alias, any outside business activities and in-scope financial transactions, any potential or actual conflict of interests with HKEX as a business and/or existing members of HKEX staff or any other relationships which may give rise to conflicts of interest, any criminal convictions, and any applicable position in management on a board (if any);
• Employee claims and complaints data such as the subject matter of grievances, whistleblowing disclosures, employment-related investigations and litigation, and relevant insurance claims;
• Medical information such as letters issued by medical practitioners.

Regulatory filing and disclosure data

• Regulatory filing and disclosure data such as name, age, education, work experience, position and shareholding in a company.

Information generated by HKEX about Data Subject

• Identity data such as parking space assignment number;
• Professional data such as any feedback on Data Subject’s performance in internal development and training;
• Role data such as job title, department, cost centre, management level, reporting lines, job description, terms and conditions of employment, and use of and access to corporate resources;
• Communication, meeting and training data such as attendance records, minutes, attendance notes, transcripts, audios and/or video recordings of meetings or trainings attended by Data Subject;
• Payroll data such as payments issued in respect of benefits and for reimbursement of expenses, and tax information;
• Benefits data such as salary and incentive payment, leave entitlement and leave taken, pension entitlement, private members club membership, transportation entitlement, further education sponsorship funding entitlement, medical, life, and personal accident insurance entitlement, and other employee benefits (if any);
• Opinion data such as the rating and feedback given by another employee for performance appraisals (including performance improvement plans and internal transfer);
• Evaluation data such as interview notes and feedback in relation to any promotion and staff award, and any meeting notes, feedback, and reviews (including any warnings issued) under a disciplinary procedure;
• Employee claims and complaints data such as responses to any grievances, whistleblowing disclosures, employment-related investigations and litigation, and relevant insurance claims that are made;
• Health & safety data such as statements provided for physical security assessments/audits and incident/accident investigations;
• Termination data such as date and reason for exit, employment proof, outstanding payments owed by/to HKEX, exit interview notes (if any), and any additional post-employment information collected (if any).

Information collected automatically from a device or system

• Identity data such as access card number;
• Technical data such as unique device identifiers, IP addresses, login credentials, system and premises access logs, download and print records;
• Communication data such as call recordings, audio and/or video recordings, instant messaging transcripts and emails;
• Audio-visual data such as phone recordings, meeting recordings, CCTV recordings and photographs.

Information collected from third parties

• Health and safety data provided in the form of reports by insurance providers or law enforcement as part of an incident/accident investigation;
• Payments (payroll) data such as tax documents;
• Information retrieved from publicly available sources such as: (i) print and digital media; (ii) websites of organisations with which you as the Data Subject are connected; and (iii) government, regulator, or industry registries.

Specifically, for further information on our Personal Data collection for Data Subjects in Chinese Mainland, please see Addendum 1; and for Data Subjects who are California residents, please see Addendum 2.

In addition to the generally applicable provisions in the Notice, this addendum sets out additional information for the corresponding sections that specifically apply to Data Subjects in Chinese Mainland:

Section 1 – What Personal Data do we collect and how do we collect it?

Section 1.1 – For Data Subjects who create an online account on our recruitment portal and/or apply for a role with HKEX:

• To verify identity, we may process name;
• To provide access to our online recruitment portal, we may process name, email address and passwords;
• To administer the recruitment process (including scheduling interviews/assessments), we may process name, phone number, email address, and social media ID such as WeChat ID and LinkedIn user ID;
• To manage the application and selection process, we may process name, education history, employment history, audio-visual data, skills, assessment/testing results and compensation details, and declarations on any outside business activities, conflicts of interest and/or relationships with politically exposed persons (if/where applicable);
• To inform Data Subject about future job opportunities and recruitment events, we may process name, email address, and other personal data provided by you during the recruitment process;
• To register Data Subject for our recruitment events (which may be hosted on HKEX premises), we may process name, email address, government issued identification document number, and audio-visual data;
• To carry out network security measures, we may process password, unique device identifiers, IP address, browser type and settings;
• To protect Data Subject’s life, health and/or property in emergencies, we may process name, government issued identity document number and emergency contact.

Section 1.2 – For Data Subjects who have accepted an offer for a role from HKEX and are subject to our onboarding process:

• To verify identity, we may process name, nationality, government issued identification document number or other personally identifiable number, and signature;
• To administer the onboarding process, we may process name, phone number, email address, contact preferences, audio-visual data;
• To conduct the onboarding, we may process name, date of birth, government issued identification document number, working visa and signature;
• To conduct due diligence, we may process name, government issued identity document number, social media ID, signature, any criminal convictions and civil litigation, expanded global sanctions, and credit history;
• To carry out network security measures, we may process password, unique device identifiers, IP address, browser type and settings;
• To protect Data Subject’s life, health and/or property in emergencies, we may process name, government issued identity document number and emergency contact.

Section 1.3 – For Data Subjects who, after completion of the onboarding process, have successfully joined as an employee of HKEX:

• To verify identity, we may process name, nationality, race and ethnicity, government issued identification document number or other personally identifiable number, and signature;
• To provide access to our HR portal, we may process email address and passwords (where required);
• To administer payments, we may process payee name, bank account number, hukou information, social insurance and housing fund account information, and tax information;
• To manage the internal mobility or promotion process, we may process name, current role and responsibilities, education history, employment history, assessment/testing results, and compensation details;
• To conduct due diligence and compliance check, we may process name, government issued identity document number, social media ID, signature, any criminal convictions, credit check reference, conflict of interests, outside business interests and in-scope financial transactions;
• To administer employee benefits relating to dependents, we may process dependents data such as birth certificate of child, marriage certificate, information on minors, government issued identification documents of spouse or spouse equivalent, and the enrolment of dependents in the medical, life and personal accident insurance provided by HKEX (as well as any claims);
• To comply with regulatory requirements, we may process name, government issued identification document number or any other personally identifiable number;
• To administer leave register, we may process information required for the leave application, including information regarding medical condition, jury service, month of birth (for birthday leave), relationship certificate and proof of death for close relatives (including spouse, children, parents/parents-in-law, siblings, grandparents/grandparent-in-law) (for compassionate leave), single child certificate (for family care leave), training program (for education leave) and examination (for examination leave);
• To carry out network security measures, we may process password, unique device identifiers, IP address, browser type and settings;
• To protect Data Subject’s life, health and/or property in emergencies, we may process name, government issued identity document number and emergency contact.

Section 2 – Sensitive Personal Data

We collect Sensitive Personal Data for the purposes of the relevant recruitment, onboarding, employment and/or human resources management-related processes, functions and activities (as the case may be):

• To provide you with access to our online recruitment portal and/or our systems (as the case may be), we may process your password, unique device identifier and IP address;
• To verify your identity, we may process your specific identity information in the form of government issued identification documents;
• To administer employee benefits relating to dependents, we may process dependents data such as birth certificate of child, marriage certificate, information on minors, government issued identification documents of spouse or spouse equivalent, and the enrolment of dependents in the medical, life and personal accident insurance provided by HKEX (as well as any claims);
• To provide regulatory disclosure of interest under applicable laws, we may process and publish your government issued identification document number;
• To communicate with you, we may process your residential address;
• To conduct due diligence, we may process your residential address and criminal/administrative non-compliance records (if applicable);
• To conduct employee compliance, we may process your in-scope financial transactions (if applicable).

You will need to carefully consider whether or not your Sensitive Personal Data should be disclosed to us, and we will need your separate consent to process it. However, we may not be able to perform our relevant recruitment, onboarding, employment and/or human resources management-related processes, functions and activities (including but not limited to process your application or offer you an internship or employment, or we may not be able to onboard you as an employee, or we may not be able to conduct human resources management (including compensation administration), if/where applicable, as the case may be) if we do not receive this separate consent:

Section 3 – Legal Basis

Without affecting the other provisions in Section 3 of the Notice, the specific row in Sections 3.1, 3.2 and 3.3 on consent as the applicable legal basis for processing of Personal Data of Data Subjects in Chinese Mainland will read as follows:

Section 7 – Rights Over Your Personal Data: Additional Rights of Data Subjects

Additional rights for Data Subjects in Chinese Mainland:

• Explain the rules of processing the Personal Data;
• Extend Data Subject rights to a surviving next-of-kin where the applicable laws permit;
• Transfer Data Subject’s Personal Data to his/her designated party, where the applicable laws permit.

In addition to the generally applicable provisions in the Notice, this addendum sets out additional information for the corresponding sections that specifically apply to Data Subjects who are California residents:

Section 1 – What Personal Data do we collect and how do we collect it?

To the extent the California Privacy Rights Act applies, the types of Personal Data we collect (and have collected in the past 12 months) include the categories for the corresponding types of Data Subjects listed below, as defined by California state law:

Section 1.1 – For Data Subjects who create an online account on our recruitment portal and/or apply for a role with HKEX:

Section 1.2 – For Data Subjects who have accepted an offer for a role from HKEX and are subject to our onboarding process:

Section 1.3 – For Data Subjects who, after completion of the onboarding process, have successfully joined as an employee of HKEX:

Section 2 – Sensitive Personal Data

We do not use or disclose Sensitive Personal Data we collect for purposes other than those generally permitted under California law, including prevention of fraud or illegal actions. We collect Sensitive Personal Data for the purposes of the relevant recruitment, onboarding, employment and/or human resources management-related processes, functions and activities (as the case may be):

• Account access credentials;
• Governmental identifier: social security number, driver licence number or other state ID number, and passport information;
• Minor/child (as Data Subject’s dependent) data;
• Biometric information;
• Message contents not for HKEX business purposes;
• Health information;
• Sexual orientation (optional).

Section 7 – Rights Over Your Personal Data: Additional Rights of Data Subjects

Additional rights for Data Subjects who are California residents:

• Request that we disclose the Personal Data we have collected about you, the categories of sources from which we collected the information, the purposes of collecting the information, the categories of third parties with whom we have shared the information, and the categories of Personal Data that we have shared with third parties for a business purpose (if any).

We are only obligated to respond to Personal Data requests from the same Data Subject up to two times in a 12-month period.

In addition to the generally applicable provisions in the Notice, this addendum sets out additional information for the corresponding sections that specifically apply to Data Subjects in the UK or EU:

Section 2 – Sensitive Personal Data

We collect Sensitive Personal Data for the purposes of the relevant recruitment, onboarding, employment and/or human resources management-related processes, functions and activities (as the case may be):

• To verify your identity, we may process your specific identity information in the form of government issued identification documents;
• To facilitate occupational health requirements, process leave applications and accident reports, and to provide awareness of day-to-day health concerns which may require support such as epilepsy, we may process your health data;
• To administer employee benefits relating to dependents, we may process dependents’ data such as a birth certificate of child, marriage certificate, information on minors, government issued identification documents of spouse or spouse equivalent, and the enrolment of dependents in the medical, life and personal accident insurance provided by HKEX (as well as any claims);
• To promote diversity and inclusion initiatives, we may process your demographic/diversity information (e.g. in the course of your participation in the HKEX MOSAIC and HKEX Pride networks, we may process data shared on your sexual orientation);
• To facilitate physical security arrangements, we may process your biometric data.

Section 7 – Rights Over Your Personal Data: Additional Rights of Data Subjects

Additional rights for Data Subjects in the UK or EU:

• Object to certain processing: you have the right to object to processing to the extent we process your Personal Data because such processing is based on our legitimate interests.

Section 8 – Contact Us

For Data Subjects in the UK or EU, if you have any questions or comments relating to the content of this Notice, report any concerns about our Personal Data processing, or if you would like to exercise your Data Subject Rights, please contact us through your applicable channel below:

As already mentioned above in Section 8, any Data Subject who has contacted us to express concerns about the way we manage their Personal Data and is of the view that we have not addressed the matter satisfactorily, may also contact the relevant privacy regulator to resolve the matter or seek assistance.

The privacy regulator in the UK is the Information Commissioner, who may be contacted at https://ico.org.uk/make-a-complaint/ or by post to: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom.

If you live outside of the UK, you may contact the relevant data privacy regulator in your place of residence.

In addition to the generally applicable provisions in the Notice, this addendum sets out additional information for the corresponding sections that specifically apply to Data Subjects in the KSA:

Section 2 – Sensitive Personal Data

We collect Sensitive Personal Data for the purposes of the relevant recruitment, onboarding, employment and/or human resources management-related processes, functions and activities (as the case may be):

• To conduct background checks on you, we may process criminal record;
• To facilitate physical security arrangements, we may process biometric data;
• To administer employee benefits relating to dependents, we may process dependents data such as birth certificate of child, marriage certificate, information on minors, government issued identification documents of spouse or spouse equivalent, and the enrolment of dependents in the medical, life and personal accident insurance provided by HKEX (as well as any claims);
• To facilitate occupational health requirements, process leave applications and accident reports, and to provide awareness of day-to-day health concerns which may require support such as epilepsy, we may process health data.

Section 3.3 – Legal Basis

Without affecting the other provisions in Section 3 of the Notice, the specific row in Sections 3.1, 3.2 and 3.3 on consent as the applicable legal basis for processing of Personal Data of Data Subjects in the KSA will read as follows:

Section 8 – Contact Us

As already mentioned above in Section 8, any Data Subject who has contacted us to express concerns about the way we manage their Personal Data and is of the view that we have not addressed the matter satisfactorily, may also contact the relevant privacy regulator to resolve the matter or seek assistance.

The privacy regulator in the KSA is the Saudi Data and Artificial Intelligence Authority (SDAIA), who may be contacted through the National Data Governance Platform.

In addition to the generally applicable provisions in the Notice, this addendum sets out additional information for the corresponding section that specifically applies to Data Subjects in Singapore:

Section 7 – Rights Over Your Personal Data: Additional Rights of Data Subjects

Additional rights for Data Subjects in Singapore:

• In certain circumstances, receive information about the ways in which Personal Data has been or may have been used or disclosed by us in the year before the date of the request.