The MTR Corporation Limited ("MTR Corporation", "we", "our" or "us") respects your legal rights of privacy when collecting, storing, using and transmitting personal data and this PICS explains our privacy practices. It is our policy to pledge to comply with the requirements of the Personal Data (Privacy) Ordinance (Cap. 486) of the Laws of Hong Kong Special Administrative Region. In doing so, we will ensure compliance by our staff to the strictest standards of security and confidentiality.
We limit the collection and use of personal data (which is information about individuals from which it is possible to identify that individual) to the specific information we need to operate our business, provide our services to you and offer various opportunities and information which may be of interest to you.
This statement explains our practice in relation to the collection, retention, storage and sharing of personal data.
We collect your personal data when you register as a member of the website at the URL www.mtr.com.hk/throughtrain (“Website”). If you are under the age of 13 you must ask a parent or your guardian before providing any personal data to us.
If you want us to process your registration to be a member of the Website, you must provide the personal data marked as “mandatory” in the Membership Registration Form. Such personal data provided by you will be used by MTR Corporation for the purposes of:
(i) application, administration, continuation and termination of the use of the services of the Website;
(ii) providing you with news, notices and other communications of MTR Corporation and/or Intercity;
(iii) processing billing and payment, determining amounts outstanding, and, if necessary, collection of outstanding payments;
(iv) handling and following up service calls, enquiries and complaints;
(v) verification of your identity;
(vi) meeting the requirements to make disclosure to any governmental authority in Hong Kong under the requirements of any law binding on MTR Corporation; and
(vii) to enable us to better understand the demographics of our registered members.
It is entirely voluntary for you to provide personal data which is not marked as “mandatory” in the Membership Registration Form. Purposes for which it is only voluntary for you to provide your personal data are:
(a) to enable us to better understand the demographics of our members; and
(b) to enable us to provide other services better tailored to your needs.
We intend to use your personal data in direct marketing, and we may not so use your personal data unless we have received your consent (which includes an indication of no objection to the use or provision).
We shall use your Surname, Given Name and Email Address for marketing the following products and services:
(i) train products and services of Intercity;
(ii) rewards, promotions, events and benefits related to or offered by MTR Corporation and/or Intercity (such as through-train cuisine tour or festival/theme packages); and
(iii) joint promotion with merchants and business partners offering discounts, special offer or other benefits to our members from and in relation to goods and services of or relating to the following industries (such as through-train/theme-park package):
- transportation, travel and tourism;
- food and beverages; and
- entertainment, leisure and sports.
If you object to our use of your personal data for the relevant direct marketing purposes, please tick the box in the direct marketing section of our PICS. If you do not tick the box, you agree that we may use your personal data for the relevant direct marketing purposes. If you desire to opt-out from receiving any direct marketing materials from us in the future, you can do so at any time by updating your profile online or contacting our Intercity Through Train Customer Service Centre at email@example.com.
Some personal data may be gathered over the Internet through the use of “cookies”. Cookies are small bits of information that are automatically stored by a website on a person’s web browser in their computer that can be retrieved by that website. The information collected by “cookies” is anonymous aggregated research data and contain no name or address information or any information that will enable anyone to contact you via telephone, e-mail or any other means. Most web browsers automatically accept cookies, but you can edit your browser options to block them. However, if you do so, you may not be able to access certain areas of our website.
In cases where we do collect personal data from you, we will:
(i) tell you that we are doing so and the use that we will make of such personal data we collect;
(ii) give you the opportunity to object to particular use of your personal data; and
(iii) tell you how we will store your personal data and how you can review, change and delete the personal data we have stored.
We will take all practicable steps to keep your personal data confidential but we may transfer/assign such data to the following parties:
(a) if MTR Corporation decides to sell any relevant part of business, to any actual or proposed assignee, transferee or successor of or to MTR Corporation’s rights in respect of your personal data;
(b) any agent, adviser, auditor, contractor or service provider who provides services to us in connection with our operations insofar as required to enable us to provide, or assist us in providing, the services to you;
(c) any person to whom MTR Corporation is under an obligation to make disclosure under the requirements of any law binding on MTR Corporation or for the purposes of any guidelines or codes of practice issued by regulatory or other authorities with which MTR Corporation is expected to comply.
Except as mentioned in paragraph 3 above, your personal data, however stored, will be accessed only by our employees or contractors who are authorised to do so. Where personal data is stored electronically, it will be kept on a secured server and will be password-protected (or under some equivalent form of protection) and accessible only by authorised personnel of MTR Corporation or its contractors. Employees and contractors designated to handle personal data will be instructed to do so only in accordance with this PICS.
If it becomes necessary that we have to take action against you for any reason whatsoever including recovering from you any money you owe us, you expressly agree that the personal data provided by you can be relied upon in identifying and taking legal action against you.
You may at any time request access to and to correct personal data relating to you in any of our records. You may also ask us to delete you or your personal data from any active mailing or distribution list. To exercise any of your rights, contact us at the address, facsimile number or email below, marking your communication “Confidential”. In response, we may ask you to provide certain details about yourself so that we can be sure you are the person to whom the data refers. We are required to respond to your requests within 40 days, but we may charge you a reasonable fee for doing so. We will not retain your personal data if you request us to terminate your membership registration. In the case of termination, we will erase your personal data as soon as practicable after we are no longer obliged to retain such data by law.
The person to whom (1) requests (i) for access to data or correction of data, (ii) for general information regarding our policies and practices with respect to personal data and (iii) about the kinds of personal data that we hold and (2) general questions and complaints should be addressed is as follows:
MTR Corporation Limited
MTR Headquarters Building
[Secretarial & Legal Department]
Personal Data Privacy Officer
We will keep your personal data for as long as necessary to fulfil the purpose for which the data was collected. We may also retain archived personal data for statistical purposes. Personal Data which is no longer required will be destroyed.