Hong Kong Exchanges and Clearing Limited and its affiliated companies (together "HKEX", "we", our” or "us") are committed to protecting all Personal Data under our custody, control, or possession. Under the applicable data protection laws, HKEX is the “Data Controller”. “Personal Data” is any information that relates to an identifiable individual or can be used to identify an individual (referred to as “you” or a “Data Subject” in this Notice).

This privacy notice (“Notice”) applies to the Personal Data we collect and further process from Data Subjects who seek access to our premises as visitors (including but not limited to ad hoc contractors, deliverers, guests and other visitors).

We will revise this Notice from time to time to reflect any relevant developments at HKEX relating to our business or operations, or due to changes in the applicable laws and regulations. To the extent possible where required under applicable data protection laws, we will notify Data Subjects of material changes.

If the correct Personal Data is not submitted to HKEX, we may not be able to permit your visit to our premises and/or we may be unable to process requests relating to your rights as Data Subjects under the applicable data protection laws. HKEX is required to perform certain regulatory functions that may not be possible if we are not provided with the requested Personal Data.

The Notice is available in English and Chinese versions. In the event of any conflicts or discrepancies between these different language versions, the English version will prevail.

HKEX discloses Personal Data to one or more third party organisations that enable us to facilitate our daily operations, and these include:

• Affiliates of Hong Kong Exchanges and Clearing Limited 
• Our contractors or vendors who provide telecommunications, IT security, or other technical assistance
• Our agents, contractors or vendors who provide administrative support to us
• Our professional advisers, such as lawyers, tax advisers and auditors

To fulfil our legal obligations, we may also share your Personal Data with courts, regulatory authorities, government and law enforcement agencies, and other public authorities.

Further details about these third parties may be provided upon request to the address in the “Contact Us” section below.  We shall endeavour to provide such information to the extent we are required to do so under applicable data protection laws. 

Further details on the processing locations and our measures for safeguarding international transfers (including adequacy decisions) may be obtained upon request to the address in the “Contact Us” section below.

Your Personal Data will be retained by us for as long as is necessary to fulfil the purposes required for the processing. HKEX will also refer to the following factors when determining or confirming the appropriate retention period of Personal Data:

• the original purpose of collection
• the termination of any contract involving the Data Subject’s Personal Data
• the limitation period as defined in the applicable law
• the existence of any legal or regulatory investigations or legal proceedings
• specific laws or regulations setting out HKEX’s functions, obligations, and responsibilities
• retention period set out in non-statutory guidelines issued by our regulators or international bodies 
• the sensitivity of the Personal Data and the degree of risk from the associated processing activity

Further details of our Personal Data retention period may be obtained upon request to the address in the “Contact Us” section below.

Where any Personal Data is no longer necessary for the purposes for which it is collected, we shall cease the processing of that Personal Data as soon as reasonably practicable (although copies may be retained as necessary for archival purposes, for use in any actual or potential dispute, or for compliance with applicable laws), and take reasonable measures to destroy the relevant Personal Data.

Where these rights apply, we shall use reasonable endeavours to fulfil the request or provide an explanation.  Please note that under applicable data protection law, we are only obligated to respond to Personal Data requests from the same consumer up to two times in a 12-month period, and we may be limited in what Personal Data we can disclose which is also for the protection of your Personal Data.

We will endeavour to respond to you as soon as possible and, in any event, within the timeframe stipulated under the applicable data protection law. In the event of a potential delay, we will provide an explanation and the expected timeframe for delivery.  Under applicable data protection law, we may also be required to charge a reasonable fee for the cost of processing the request.

Please note that we may need to seek confirmation of identity or clarification in order to fulfil the request. If you as the Data Subject would like to appoint an authorised agent to make a request on your behalf, we may require you to verify your identity with us directly before we provide any requested information to your authorised agent unless your authorised agent has power of attorney or acts as a conservator. Information collected for purposes of verifying your request will only be used for verification. For deletion requests, you will be required to submit a verifiable request for deletion and then confirm separately that you want Personal Data about you deleted.

If you would like to exercise your data subject rights, please contact the HKEX Group Data Protection Office via one of the channels below.  

We only process Personal Data of minors when they visit our premises for the relevant purposes in the same manner as set out in this Notice. If we discover that processing has taken place in any other circumstances, we shall ensure it has occurred with a Lawful Basis or otherwise cease the processing and make reasonable efforts to dispose of the Personal Data in accordance with our internal policies.

The age of minors in respect of Personal Data consent differs across jurisdiction:

If you have any questions or comments relating to the content of this Notice, report any concerns about our Personal Data processing, or if you would like to exercise your Data Subject Rights, please contact us through the channels below:

By Post:

Group Data Protection Officer
GDPO Office
Hong Kong Exchanges and Clearing Limited
8/F., Two Exchange Square
8 Connaught Place
Central
Hong Kong

By email: DataPrivacy@hkex.com.hk

UK Representative:
10 Finsbury Square, London, EC2A 1AJ, United Kingdom

EU Representative:
De Cuserstraat 91, 1081 CN Amsterdam, Postbus/PO Box 7902, 1008 AC Amsterdam, Netherlands
hkex.eurep@eversheds-sutherland.com

Please include the following details in any request to exercise your Data Subject Rights:

Identity of Data Subject

• Full Name
• Company Name
• Email Address
• Address of principal residence
• Identity particulars if acting on behalf of a Data Subject
• Contact details held on file or Document(s) to verify identity

Nature of the Request

• Product or Service to which the Data Subject has subscribed
• Specific Right
  • Purpose of the Request
  • Preferred communication channel and address for receiving the results of the request
  • Document(s) to support the rights request

Any Data Subject who has contacted us to express concerns about the way we manage their Personal Data and is of the view that we have not addressed the matter satisfactorily, may also contact the relevant privacy regulator to resolve the matter or seek assistance.

The privacy regulator in the United Kingdom is the Information Commissioner, who may be contacted at https://ico.org.uk/make-a-complaint/ or by post to: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom.

If you live outside of the UK, you may contact the relevant data privacy regulator in your country of residence.

Last Updated: 9 July 2025