本文載列南華早報出版有限公司及作為其組成部分的全體附屬公司及聯屬公司（「南華早報集團」或「我們」）有關處理個人資料的政策及實務大綱。
聲明通告
我們尊重私隱。南華早報集團承諾遵守所有適用的個人資料私隱法例及法規。
於蒐集及處理個人資料時，我們將確保以法律為依據－包括但不限於發出私隱通告及／或符合所有適用法例項下的任何其他規定。
實務大綱聲明
所蒐集的個人資料類別
我們所收集的個人資料分為以下五大類別（「個人資料類別」）：
訂購紀錄，包括載有出版刊物訂購人個人資料的紀錄、職位空缺提示服務及任何其他經訂購的產品或服務。
人事紀錄，包括求職者及員工的個人資料。
活動出席者紀錄，包括出席由我們所舉辦活動（例如會議、宣傳或慈善活動）的人士的個人資料。
其他營運紀錄，包括新聞採訪、保安檢查、清潔、維護服務、顧問、技術、審核、供應商、服務提供商、許可人及其他就我們營運所需而提供服務的資料當事人的個人資料。
自網絡伺服器收集的紀錄，包括但不限於電郵地址、定位資料及其他線上識別資訊，例如瀏覽我們網站或平台的該等資料當事人的IP地址。
處理所收集個人資料的主要目的
處理訂購紀錄的目的為：(i)提供訂購、職位空缺提示指示及任何其他訂購產品或服務；(ii)用以發出賬單及付款通知（如適用）；及(iii)為統計目的而進行市場調查。
處理人事紀錄的目的為：(i) 用作招聘；及(ii)人力資源管理及就業相關活動，例如僱員福利、終止聘用、績效評估及紀律事宜。
處理活動出席者紀錄的目的為：(i)組織及管理相關活動；及(ii)舉辦相關比賽、抽獎及宣傳活動。
處理其他營運紀錄的目的為促進業務有效營運，例如新聞採訪、保安、維護、顧問、技術、審核、供應商、服務提供商、許可人及其他就我們營運所需而提供服務的資料當事人。
置存自網絡伺服器收集的紀錄的目的為：(i)提供及／或改善向閣下提供的新聞、資訊及相關服務；及(ii)緊貼及分析環球媒體發展的最新趨勢。
資料保護原則
處理個人資料時須根據以下資料保護原則進行：
– 處理個人資料必須遵守合法、公平及透明原則。
– 個人資料僅可為特定、明確及合法目的而收集。
– 處理個人資料必須屬相關及不超過實際所需。
– 個人資料必須準確及不斷更新，並盡一切努力刪除或更正。
– 個人資料必須以只有在有需要處理有關資料時方可識別資料當事人的方式備存。
– 個人資料必須以確保採取適當安全措施的方式進行處理。
資料庫存
此外我們亦置存資料庫存及資料流程程序，以確定我們在資料處理的各個方面，包括：
– 使用個人資料的業務程序。
– 收集及／或使用個人資料的目的。
– 個人資料來源。
– 處理工作。
– 任何資料的轉移，以及向誰轉移。
– 任何資料存取、更正或不接收要求。
該資料庫存將有助南華早報集團追縱其資料及相關處理工作，使我們更能妥善處理以符合相關私隱及其他法例及法規的規定。
資料處理的法律依據
我們確保處理個人資料時以法律為依據。
該等法律依據包括：(i)於處理個人資料時符合南華早報集團的合法商業權益；(ii)如適用法或法規有所要求，尋求閣下特定同意以處理該等個人資料；及／或(iii)適用法律及法規項下的任何其他相關依據。
合法權益
南華早報集團以「合法權益」作為法律依據處理個人資料，即所處理個人資料為南華早報集團達到合法權益所必需的，除非有關權益被資料當事人保護個人資料的權益或基本權利及自由所凌駕。
合法權益評估
於各相關情況下，我們會評估：(i)是甚麼合法權益；(ii)是否有需要處理該等資料以達致目的；及(iii)資料當事人的相關權利；及在有關權利與我們取得有關目的之間取得平衡，並確保在我們確定南華早報集團可根據合法權益處理有關個人資料前，該等權利不會凌駕於南華早報集團的合法權益。
與資料當事人溝通
資料當事人均將獲我們告知收集其個人資料、個人資料類別及處理目的。此乃確保資料當事人清楚了解我們收集及處理其個人資料，而有關收集及處理符合資料當事人的合理預期。
請注意：在任何時候，資料當事人均可拒絕我們收集及處理其個人資料，此外，彼等亦有權要求取得及／或更正由我們管有的彼等個人資料。
資料安全機制
我們亦已實施適當機制、政策及程序以保障我們所收集及處理的個人資料的保密性及安全性。我們尊重該等個人資料涉及的資料當事人的私隱及相關權利，我們已透過包括（但不限於）資料最小化原則、去識別化、加密、限制存取及所有其他技術保安方法及努力以保護個人資料，減少處理個人資料時的風險或潛在負面影響。保障資料當事人私隱及相關權利將容許南華早報集團在處理個人資料時以合法權利作為法律依據。 於徹底進行上述評估後，南華早報集團認為其收集及處理個人資料乃根據以下合法權益進行：a.滿足客戶及營運所需
處理個人資料類別的主要目的已於上文載列。該等目的為南華早報集團處理個人資料的合法權益，是南華早報集團作為企業及傳媒機構滿足其客戶及營運所需的關鍵所在。
企業如南華早報集團需要員工處理其業務（及因此需要置存人事紀錄）及服務提供商確保其正常營運（及因此需要置存其他營運紀錄）。
傳媒機構如南華早報集團需要置存報章訂購人、活動出席人士及網頁瀏覽者的個人資料，以便能夠及時提供相關資料及／或其他服務（及因此需要置存訂購及活動出席者紀錄以及自網站伺服器收集的紀錄）。
b.通知公眾
作為一家新聞機構，南華早報集團一向重視公眾的知情權，公眾有權瞭解我們社區及世界各地正在發生的事情。根據法例及新聞從業員道德操守，南華早報集團有責任通知公眾有關事情（「通知責任」）。
我們從瀏覽我們各個網絡和媒體資產（「公眾瀏覽資料」）的資料當事人收集及處理資料，以便為我們的資料當事人提供改進的和更好的內容體驗。
這些推介不會阻止或限制任何人士瀏覽其可隨時到訪的有關網站的所有其他文章或內容。
c.市場分析
我們會對公眾瀏覽資料加以分析，以(i)深入瞭解公眾的閱讀習慣、喜好或品味；及(ii)進行市場細分及相關研究。
有關分析是必需的，其可提升南華早報集團作為一家全球數碼新聞機構履行其通知責任以及為國際社會福利作出貢獻的能力。憑藉有關分析所得的瞭解及研究結果，南華早報集團將可更有效地履行其通知責任，為公眾提供更為相關及即時的資訊、產品及服務。
有關分析不僅有利於南華早報集團，同時亦有利於整個國際社會。現時，全球化日益顯著，世界各地相互聯繫，於某一地區發生的事情，都可能會對其他地區帶來即時、深遠的後果。
d.直銷
根據合法權益的一部分，南華早報集團亦有權使用個人資料作直銷用途，除非資料當事人明確反對或根據適用法例明確禁止。
閣下如何與南華早報集團的產品或服務（例如新聞，媒體，廣告，活動等）進行互動，或會顯示出 閣下的消費偏好或傾向。根據有關偏好或傾向，我們會運用有關個人資料，直銷由南華早報集團、其聯屬公司或合作夥伴所提供的各項產品及／或服務，包括但不限於:
a. 保險、銀行及金融產品及服務；
b. 有關航空公司、酒店、健身俱樂部、旅遊及餐旅的產品及服務；
c. 美容、護膚、健康、醫療儀器、生物科技、醫藥及健康；
d. 眼鏡、時裝、運動、運動賽事、運動俱樂部、鐘錶及珠寶、花店、文儀用品、玩具、百貨公司及購物中心；
e. 資訊科技、電子產品及電器、手提電話及配件、通訊及媒體產品及服務；
f. 餐飲及食肆；
g. 設計、汽車、教育、古董及拍賣、藝術及畫廊、船及配件、兒童服務、房地產、建築、傢俱及家庭用品、室內設計、領事服務、貿易或行業協會、非政府組織、政府服務、能源、活動及展覽、個人公告、寵物及配飾、郵政及快遞服務、公共設施、專業服務、職業、保安服務、購物、運輸及物流。
我們注意到，鑒於我們的業務範圍遍及全球，於若干情況下，使用個人資料作直銷用途會受若干司法權區（如香港）的法例監管，需要就此取得資料當事人的同意。有關詳細資料，請參閱下文「同意」一節。
同意
倘適用法例規定我們處理個人資料（包括作直銷用途）前需取得具體同意，我們將確保有關具體同意將按下列方式取得：
A.有關同意須清晰、明確及具體；
B.資料當事人全面知悉我們擬使用的個人資料的類型；有關用途的目的（例如改善我們向資料當事人提供的服務或直銷）；及
C.資料受讓人的名稱／身份（倘我們擬轉移 閣下的資料），以及資料受讓人使用 閣下的個人資料的方式。
Cookies
Cookies是存儲在 閣下設備上的數據文件。當 閣下訪問我們的網站時，我們的網站會自動在 閣下的瀏覽器上安裝和使用Cookies。我們使用cookies可為 閣下提供更好的網站瀏覽體驗。
我們的網站使用了兩種一般類型的cookies :-
臨時Cookies：臨時Cookies僅在每次到訪我們的網站期間使用，並將在每次訪問結束時刪除。臨時cookies用於編譯有關我們網站使用的匿名統計資訊。
持久性Cookies：持久性Cookies是較長一點時間保留在瀏覽器中的Cookies，用於編譯有關使用我們網站的匿名統計資訊和/或跟蹤和記錄 閣下的愛好。
要瞭解有關cookies的更多資訊，請訪問 www.allaboutcookies.org 。
閣下可以通過修改瀏覽器或互聯網安全軟件的設置功能拒絕接受cookies。但是，如果閣下這樣做， 閣下可能無法使用或啟動我們網站的某些特性和/或功能。
資料當事人的權利
南華早報集團認為資料當事人享有下列有關資料處理及有關其資料的權利：
1. 要求存取所持資料的性質以及知悉獲披露有關資料的人士。
2. 阻止可能會導致損失或危險的處理。
3. 阻止作直銷用途的處理。
4. 獲悉將對其有重大影響的自動決策程序機制。
5. 避免僅由自動程序作出且將對其構成影響的重大決策。
6. 採取行動以糾正、阻止及刪除不正確的資料，包括被遺忘或銷毀該等不正確資料的權利。
7. 要求監管機構（例如個人資料私隱專員公署或資料保護專員）評估有否違反任何相關私隱及其他法例條文。
8. 以清晰、通用及機器可讀的格式向其提供個人資料，以及向其他資料管控員傳輸有關資料的權利。
9. 反對任何正在進行的自動分析。
轉移個人資料
我們持有的個人資料將予以保密，有關資料可能會於香港境內轉移給下列人士以作上述用途。
i. 南華早報集團的派遞員，以派送有關訂閱或免費試用的報章或其他刊物；
ii. 向南華早報集團提供其營運所需的行政、技術或其他服務的代理、承包商或第三方；
iii. 信貸資料服務機構或收賬公司；及
iv. 南華早報集團的任何聯屬公司。
倘作出有關轉移，南華早報集團應使用合約或其他方法以確保資料受讓人將對有關個人資料予以保密，並遵守所有相關個人資料私隱法例及規例。
就有關上述第(iv)分段所述的情況而言，倘有關南華早報集團聯屬公司之間的集團間轉移涉及跨境資料轉移，南華早報集團可能會採取具約束力的公司規則來保障有關個人資料的安全；並確保所有有關聯屬公司遵守相關私隱及其他法例。
外包安排
南華早報集團一直利用公司的內部資源開發及維護其資訊科技系統。偶爾，南華早報集團會委聘第三方供應商提供若干有關其資訊科技系統的服務。於正常情況下，有關供應商無權存取儲存於資訊科技系統內的個人資料。
於特殊情況下，倘有關供應商有權存取相關資料，南華早報集團會採取合理措施以確保：(i)該供應商在合約上有責任對有關個人資料予以保密，並採取適當的手段防止任何未經授權的存取、使用、遺失、保存、修改、轉移或其他。
資料保存
我們實施資料保存政策及記錄，以確保個人資料的保存時間不會超過收集目的所需的時間。
我們所持的各類個人資料有著不同的保存期，視乎各有關資料收集／使用目的及相關法例要求而定。
資料保護專員
我們已委聘一名資料保護專員，其職責包括下列各項：
1. 通知及建議南華早報集團及其僱員於適用私隱及其他法例及規例（統稱為「私隱法例」）下的責任；
2. 監察南華早報集團遵守該等私隱法例的情況；
3. 與監管機構（如個人資料私隱專員公署或同等機關）合作；及
4. 作為監管機構在資料處理及相關事宜方面的聯絡員。
資料存取／更正及其他查詢
閣下有權知悉南華早報集團是否持有 閣下的個人資料、存取資料及／或更正任何有關不正確的資料。 閣下亦有權合理查詢有關南華早報集團的個人資料政策及程序。 閣下有權隨時反對處理 閣下的個人資料或撤回 閣下的同意（倘適用）。然而， 閣下務請注意，倘 閣下反對處理 閣下的個人資料，可能會影響南華早報集團向 閣下提供所需服務的能力，或影響有關服務的質素。倘 閣下撤回 閣下的同意（倘適用），南華早報集團將停止向 閣下提供根據適用法例需取得具體同意的服務。
上述所有要求需以書面方式向我們的資料保護專員作出，並電郵至 dataprotection@scmp.com。
歐盟或英國資料當事人的代表
我們重視 閣下的私隱和作為資料當事人的權利，因此我們已任命Prighter作為我們的私隱代表和 閣下的聯繫點。
Prighter使 閣下可以輕鬆地行使與私隱相關的權利（例如，存取或刪除個人資料的要求）。如果 閣下想通過我們的代表Prighter與我們聯繫或利用閣下的資料當事人的權利，請訪問：
https://prighter.com/q/16203020
南華早報集團可能會就處理 閣下的要求而產生的行政費用向 閣下收取合理費用。
我們定期檢討我們的私隱通知，並保留權利不時修改有關通知（倘適用）。
本通知的最後更新日期為二零二一年一月二十五日。
This sets out the policies and practices of South China Morning Post Publishers Limited and all subsidiaries and affiliated companies of which it forms part (“SCMP GROUP” or “We”) in relation to the handling of personal data.
Statement of Notice
We respect privacy. SCMP GROUP is committed to complying with all applicable personal data privacy laws and regulations.
When we collect and process personal data, we will ensure that there is legal basis for us to do so – including but not limited to issuing a Privacy Notice and/or fulfilling any other requirements as provided under all applicable laws.
Statement of Practice
Kinds of Personal Data Collected
We collect personal data in five broad categories below (“Categories of Personal Data”):
Subscription Records which include records containing the personal information of the subscribers of our publications, job alert services and any other subscription based products or services.
Personnel Records which include job applicants and our employees’ personal information.
Event Attendee Records which include the personal information provided by the attendees of our events such as conferences, promotion or charity activities.
Other Operational Records which include the personal data of such data subjects involved in news gathering, security checks, cleaning, maintenance services, consultancy, technology, auditing, supplier, service provider, licensor and other data subjects providing services in relation to all aspects of our operations.
Records collected on/from Web Servers which include but not limited to the email addresses, location data and other online identifiers such as IP addresses of such data subjects who visit our websites and platforms.
Main Purposes of Processing Collected Personal Data
Subscription Records are processed for the purposes of: (i) provision of subscription, job alert orders and any other subscription based products or services; (ii) billing and payment (if applicable); and (iii) conducting market research for statistical purposes.
Personnel Records are processed for the purposes of: (i) recruitment; and (ii) human resources management and employment related activities such as employment benefits, termination, performance appraisal, and discipline.
Event Attendee Records are processed for the purposes of: (i) organising and managing the relevant events; and (ii) running the related competitions, prize drawings, and promotions.
Other Operational Records are processed for the purposes of facilitating the effective operation of our business such as news gathering, security, maintenance, consultancy, technology, auditing, supplier, service provider, licensor, and other data subjects providing services in relation to all aspects of our operations.
Records collected from Web Servers are kept for the purposes of: (i) providing and/or improving on the news, information and related services to you; and (ii) keeping abreast of and analysing the latest trends in the global media landscape.
Data Protection Principles
All processing of personal data shall be conducted according to the data protection principles as follows:
– Personal data must be processed lawfully, fairly and transparently.
– Personal data can only be collected for specific, explicit and legitimate purposes.
– Personal data must be relevant and limited to what is necessary for processing.
– Personal data must be accurate and kept up to date with every effort to erase or correct.
– Personal data must be kept in a form such that the data subject can only be identified if it is necessary for processing.
– Personal data must be processed in a manner that ensures the appropriate security.
Data Inventory
We have also kept a data inventory and data flow process to determine various aspects of our data processing including:
– Business processes that use personal data.
– Purposes for collecting and/or using the personal data.
– Source of personal data.
– Processing activities.
– Any data transfer, and to whom.
– Any data access, correction or opt-out request.
Such data inventory would facilitate SCMP GROUP in tracking its data and the related processing activities, and put us in a better position to comply with the relevant privacy and other laws and regulations.
Legal Basis of Data Processing
We ensure that there is legal basis for our processing of personal data.
Such legal basis includes: (i) legitimate business interests of SCMP GROUP in processing personal data; (ii) if required by applicable laws or regulations, seeking your specific consent to process such personal data; and/or (iii) any other relevant basis under applicable laws and regulations.
Legitimate Interests
SCMP GROUP processes personal data under the “legitimate interests” legal basis which means that the processing of the personal data is necessary for the legitimate interest pursued by SCMP GROUP except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which requires the protection of personal data
Legitimate Interests Assessment
In each relevant situation, we assess: (i) what these legitimate interests are; (ii) whether it is necessary to process such data to attain the objective; and (iii) the relevant rights of the data subjects; and balance such rights against our interests in achieving such objective, and ensure that such rights do not override SCMP GROUP’s legitimate interests before we conclude that SCMP GROUP can process the personal data on the basis of legitimate interests.
Communicate with the Data subjects
All data subjects will be informed that we are collecting their personal data, the Categories of Personal Data concerned and the purpose of processing. This is to ensure that the data subjects are clear about our collection and processing of personal data and such collection and processing are within the data subjects’ reasonable expectations.
Please be informed that all data subjects can object to our collection and processing of their personal data at any time, in addition to their rights of requesting for accessing and/or correcting their personal data in our possession.
Data Security Mechanisms
We have also implemented appropriate mechanisms, policies and procedures to protect the confidentiality and security of the personal data that we collect and process, as we respect the privacy and related rights of the data subjects relating to such personal data by reducing the risks or potential negative impact of processing including but not limited to data minimisation, de-identification, encryption, restricted access and all other technical security methods and efforts to protect personal data. Such protection of the privacy and related rights of the data subjects would enable SCMP GROUP in processing personal data under the legitimate interest legal basis.
Having conducted the above assessment thoroughly, SCMP GROUP concludes that it is collecting and processing personal data under legitimate interest as follows:
a. Serving Customer and Operational Needs
The main purposes for processing the Categories of Personal Data have been set out above. There are legitimate interests for SCMP GROUP to process the same because all such purposes are essential to SCMP GROUP serving its customers and its operational needs as a corporation and a media organisation.
A corporation like SCMP GROUP needs employees to work for its business (and hence Personnel Records) and service providers to keep it running (and therefore Other Operational Records).
A media organisation such as SCMP GROUP needs the personal data of its newspaper subscribers, event attendees and website visitors so as to be able to have relevant and timely provision of information and/or other services (and thereby subscription and event attendee records together with records collected on web servers).
b. Inform the Public
As a news organisation – SCMP GROUP respects the public’s right to know about what is happening in our community and the world. SCMP GROUP has a duty both under law and journalistic ethics to inform the public of such happenings (“duty to inform”).
We collect and process data from data subjects who visit our various web and media properties (“Public View Data”) in order to provide improved and better content experience to our data subjects.
These recommendations do not prohibit or restrict anyone from viewing all of the other articles or content on such websites which they can access at any time as available.
c. Market Analysis
We analyse the Public View Data to: (i) gain insightful knowledge of the reading habits, preferences or tastes of the public; and (ii) conduct market segmentation and related studies.
Such analysis is necessary because it enhances SCMP GROUP’s capability to carry out its duty to inform and contribute to the welfare of our international community as a global digital news organisation. The knowledge and study results from such analysis would enable SCMP GROUP to fulfil its duty to inform more effectively by providing more relevant and timely information, products, and services to the public.
This would benefit not just SCMP GROUP – but also the international society as a whole. Our world is becoming more globalised and inter-connected. What is happening in one part of the world could have instant, far-reaching ramifications on others.
d. Direct Marketing
SCMP GROUP also uses personal data for direct marketing purposes as part of its legitimate interests unless the data subject explicitly objects or such is otherwise specifically prohibited under applicable laws.
How you interact with SCMP GROUP’s products or services (such as news, media, advertising, events, etc.) may indicate your consumption preferences or inclinations. Based on such preferences or inclinations, we use such personal data to conduct direct marketing in respect of various goods and/or services offered by SCMP GROUP, its affiliates or business partners including but not limited to:
(a) Insurance, banking and financial products and services;
(b) Products and services relating to airlines, hotel, health club, travel and hospitality;
(c) Beauty, skin care, health, medical devices, biotechnology, pharmacy and wellness;
(d) Eyewear and optical, fashion, sports, sports events, sports clubs, watches and jewellery, flower shop, stationery, toys, department stores and shopping malls;
(e) IT, electronic goods and electrical appliances, mobile phones and accessories, telecommunications and media products and services;
(f) Food and beverages and restaurants;
(g) Design, automotive, education, antique and auction, arts and gallery, boat and accessories, services for children, real property, construction, furniture and household items, interior design, consular services, trade or industry associations, non-governmental organisations, government services, energy, events and exhibitions, personal announcements, pets and accessories, post and courier services, public utilities, professional services, career, security services, shopping, transportation and logistics.
We note that given the global spread of our businesses, there may be cases where our use of personal data for direct marketing is governed by the laws of certain jurisdictions (such as Hong Kong) which require the consent of the data subject(s) in this regard. Please refer to the “Consent” section immediately below for more information.
Consent
Where applicable legal requirement demands specific consent must be obtained before we can process personal data including conducting direct marketing, we will ensure that such specific consent will be obtained as follows:
(A) the consent has to be clear, explicit and specific;
(B) data subject is fully aware of the types of the personal data that we intend to use; and the purposes of such usage (such as improving our services to the data subject or direct marketing); and
(C) the name/identity of the transferee (if we ever intend to transfer your data) and how the transferee shall use your personal data.
Cookies
Cookies are data files stored on your device. Our website automatically installs and uses cookies on your browser when you access it. We use cookies to give you a better browsing experience on our website
Two general types of cookies are used on our website: –
Session Cookies: temporary cookies are only used during a visit to our website and will be deleted at the end of each visit. Session cookies are used to compile anonymous statistics about the use of our website.
Persistent Cookies: persistent cookies remain in your browser for a longer period of time for the purpose of compiling anonymous statistics about the use of our website and/or tracking and recording your preferences.
To find out more about cookies, please visit www.allaboutcookies.org .
You may refuse to accept cookies by modifying the settings feature of your browser or internet security software. However, if you do so you may not be able to utilise or activate some of the features and/or functions of our website.
Rights of the Data subjects
SCMP GROUP respects that data subjects have the following rights about the data processing, and the data which is recorded about them:
(1) To request for access regarding the nature of information held and to whom it has been disclosed.
(2) To prevent processing likely to cause damage or distress.
(3) To prevent processing for purposes of direct marketing.
(4) To be informed about the mechanics of automated decision-making process which will significantly affect them.
(5) Not to have significant decisions that will affect them taken solely by automated process.
(6) To take action to rectify, block and erase including the right to be forgotten or destroy inaccurate data.
(7) To request the supervisory authority (eg. a privacy commissioner or a data protection officer) to assess whether any provision of the relevant privacy and other laws has been violated.
(8) To have personal data provided to them in a structured, commonly used and machine-readable format, and the right to have such data transmitted to another data controller.
(9) To object to any automated profiling which is occurring.
Transfer of Personal Data
We will keep confidential the personal data that we hold, which may be transferred to the following parties within Hong Kong for the purposes as stated above.
(ii) Agents, contractors or third parties which/who provide administrative, technology or other services to SCMP GROUP for its operations;
(iii) Credit reference or debt collection agencies; and
(iv) Any affiliates of SCMP GROUP.
In the event of such transfer, SCMP GROUP shall use contractual or other means to ensure that the data transferees shall keep the transferred personal data confidential and comply with all relevant personal data privacy laws and regulations.
Regarding the situation as described under sub-clause (iv) above – If such intra-group transfer among SCMP GROUP affiliates involves cross-border data transfer, SCMP GROUP may adopt binding corporate rules for safeguarding the security of such personal data; and ensuring that all affiliates involved shall comply with the relevant privacy and other laws.
Outsourcing Arrangements
SCMP GROUP has been using internal resources to develop and maintain its IT systems. Occasionally SCMP GROUP engages third-party vendors to provide certain services relating to its IT systems. Such vendor does not have access to the personal data stored under usual circumstances.
In the exceptional case where such vendor has such access, SCMP GROUP uses reasonable measures to ensure that: (i) such vendor is contractually bound to keep such personal data confidential and adopt appropriate means to prevent any unauthorised access, use, loss, retention, modification, transfer or otherwise.
Data Retention
We implement data retention policies and records to ensure that personal data will not be kept longer than is necessary in relation to the purpose for which they were collected.
Different retention periods apply to various types of personal data that we hold, depending on the respective data collection/usage purpose and relevant legal requirements.
Data Protection Officer
We have appointed a Data Protection Officer whose responsibilities include the following:
(1) To inform and advise SCMP GROUP and its employees of their obligations pursuant to the applicable privacy and other laws and regulations (collectively “Privacy Laws”);
(2) To monitor SCMP GROUP’s compliance with such Privacy Laws;
(3) To co-operate with the supervisory authority (eg. privacy commissioner or equivalent bodies); and
(4) To act as the point of contact for the supervisory authority on issues regarding the data processing and related matters.
Data Access / Correction and Other Inquiries
You have the right to know whether SCMP GROUP holds your personal data, access the data and/or correct any inaccuracies of such data. You also have the right to make reasonable inquiries about SCMP GROUP’s personal data policies and procedures. You have the right to object to the processing of your personal data or withdraw your consent (if applicable) at any time. Please note however that if you object to the processing of your personal data, it may affect SCMP GROUP’s ability to provide the services that you required to you or may affect the quality of such services. If you withdraw your consent (if applicable), SCMP Group will stop providing such services to you which applicable laws require specific consent.
All of the above requests should be made in writing to our Data Protection Officer at dataprotection@scmp.com
Representation for Data Subjects in the European Union or in the United Kingdom
We value your privacy and your rights as a data subject and have therefore appointed Prighter as our privacy representative and your point of contact.
Prighter gives you an easy way to exercise your privacy-related rights (e.g. requests to access or erase personal data). If you want to contact us via our representative Prighter or make use of your data subject rights, please visit:
https://prighter.com/q/16203020
A reasonable fee may be charged in light of the administrative costs that SCMP GROUP shall incur in addressing your request(s).
We keep our Privacy Notice under regular review, and reserve the right to amend it from time to time as appropriate.
This Notice was last updated on 25 January 2021.