Privacy Notice – Hactl
Hong Kong Air Cargo Terminals Limited (“Hactl”, “we”, “our” or “us”) is committed to protecting the privacy, confidentiality and security of the personal data we hold by complying with the requirements of Hong Kong’s Personal Data (Privacy) Ordinance and the General Data Protection Regulation (EU) (2016/679). We are equally committed to ensuring that all our employees and agents uphold these obligations.
This privacy notice explains what information we gather about our customers and various other individuals (“you” or “your”), what we use that information for, the purposes for which that information is used and who we give that information to. It also sets out your rights in relation to your information and who you can contact for more information or queries.
Please see the below sections of this privacy notice for details:
– How we use personal data about you
– Use of personal data collected via our Website
– Use of personal data in direct marketing
– The legal grounds we use for processing personal data
– Who we disclose your personal data to
– How long do we keep your personal data
– Protection of your personal data
– Your rights and how to contact us
– Changes to this privacy notice
We recognise the importance of protecting the privacy of personal data and handling personal data in an open, transparent and secure manner.
This privacy notice sets out how we will collect, handle, store, share and protect information about you.
In this privacy notice, we may refer to information which can be used to identify you as your “personal data”. We may also sometimes collectively refer to handling, collecting, protecting and storing your personal data as “processing” such personal data.
We typically collect or obtain personal data because you give it to us (for example, physically or through the specific webpages of careers.hactl.com that provide a link to this notice (“our Website” or “this Website”)), or because other people give that information to us (for example, carriers who engage us or our third party service providers that we use to help operate our business and run our Website), or because it is disclosed on publicly available sources.
We also usually collect or obtain personal data from you because we observe or infer that information about you from the way you interact with us or others.
The personal data that we collect or obtain typically includes, but is not limited to:
Not all this data will be collected at all times as this will be dependent on the nature of our interaction with you. We will only collect the data necessary for us to fulfil the purposes outlined in this privacy notice.
In some cases, the personal data we collect may also include so called ‘sensitive’ or ‘special categories’ of personal data, such as details about your health (like any disabilities that you may have and any accommodations we may need to make for you in the workplace); sexual orientation (for example, if you provide us with details relating to your partner or spouse); ethnicity, race and religious beliefs (for example, for the purpose of equal opportunities monitoring in Hactl); and any criminal convictions you may have (for example, for the purpose of conducting background checks on you). Usually this is because you volunteer this information to us.
The types of personal data and special categories of personal data that we collect will also generally vary depending on the activities for which you engage with us, how you use our Website, and the information you provide to us. In some rare circumstances, we also gather other special categories of personal data about you because you volunteer that information to us or we are required to gather that information because of legal or regulatory requirements imposed on us. If we are so required to gather sensitive personal data from you, we will indicate to you that the provision of this information is mandatory, and the consequences if we cannot collect this information.
In some cases, we will also collect personal data about you indirectly from third parties such as: (i) carriers who engage our services; (ii) third party service providers that help us to operate our Website; and (iii) publicly available sources.
Note that if you refuse or are otherwise unable to supply your personal data as requested, we may be unable to provide you with goods and service or to process your application, where use of your personal data is required.
We will use your personal data in connection with the Hactl Group’s (including Hactl, its subsidiaries, holding companies and affiliates) business. In particular, we will use your personal data for the purposes or, in connection with:
We generally use personal data collected via this Website:
In addition to the purposes set out above, we intend to use your personal data (including name, address, contact numbers and email address) in direct marketing, but we may not so use your personal data to do so unless we have received your consent. We would like to contact you about our products and services relating to our air cargo terminal services (including ground handling, physical cargo handling, air cargo document handling, ramp handling, crew transportation and intermodal services), value-added air cargo terminal services (including pre-arrival customs clearance, import scheduled collection, scheduled empty unit release, airport direct, IATA DG training and Hactl COSAC-Plus training course) and events organised by us on the foregoing services. We would also like to use your personal data for other direct marketing use that we notify you (in the relevant form of collection channels) from time to time.
We will not disclose your personal data to any third parties for direct marketing purposes without your consent.
If you do not agree to such use of your personal data in direct marketing, please indicate your objection in the acknowledgement form that may be provided to you.
If you do not want to continue receiving any marketing materials from us, you can click on the unsubscribe function in the relevant direct marketing communication or e-mail firstname.lastname@example.org.
We generally use your personal data for the purposes outlined above because: (a) it is necessary for our legitimate interest and does not unduly affect your interests or fundamental rights and freedoms (see below); (b) it is necessary for legal and/or regulatory obligations or requests that we are subject to, such as keeping records for tax purposes or providing information to a public body or law enforcement agency; (c) it is necessary to perform contractual obligations that we owe to you or to take pre-contractual steps at your request; (d) it is necessary for the performance of a tasks carried out in the public interest, such as assisting with diversity in the workplace; or (e) in some cases, we have obtained your prior consent.
Examples of the ‘legitimate interests’ referred to above are:
To the extent that we process any sensitive personal data relating to you for any of the purposes outlined above, we will do so because either: (1) you have given us your explicit consent to process that information; (2) the processing is necessary for reasons of substantial public interest on the basis of applicable law (for example where we are required by law or regulatory requirements to process that information in order to ensure that we meet our anti-money laundering obligations); (3) the processing is necessary to carry out our obligations under employment, social security or social protection law; (4) the processing is necessary for the establishment, exercise or defence of legal claims; or (5) you have made the information manifestly public.
The legal grounds for processing sensitive personal data outlined above appear at 2(a), 2(g), 2(b), 2(f) and 2(e) of Articles 9 – Processing of Special Categories of Personal Data of the EU’s General Data Protection Regulation respectively.
Where we are legally required to obtain your explicit consent to provide you with certain marketing materials, we will only provide you with such marketing materials where we have obtained such consent from you.
If you do not want to continue receiving any marketing materials from us, you can click on the unsubscribe function in the communication or e-mail email@example.com.
In connection with one or more of the purposes outlined in the “How we use personal data about you” section above, we generally disclose details about you within or outside Hong Kong to:
We do not sell or trade your personal data with any third parties.
Where we disclose personal data about you to other members of the Hactl Group, they will either act as another controller under this privacy notice or will only process personal data on behalf and upon request of the controller.
Your personal data may be accessed and processed by our personnel and the personnel of our partners, affiliates and third party service providers, who may operate within or outside of Hong Kong. Your personal data will only be transferred to locations outside of Hong Kong where we are satisfied that adequate or comparable levels of protection are in place to protect personal data held in that jurisdiction, and (where we are required to do so) with your consent.
If personal data is transferred from the EEA to outside the EEA, we typically use a data transfer agreement based on the Model Clauses with our service providers, so as to ensure that there are adequate safeguards in place to protect your personal data that comply with our legal obligations.
We will hold your personal data on our systems for as long as is necessary to fulfil the purposes for which it was collected or to comply with legal, regulatory or internal policy requirements. The information will either be irreversibly anonymised or securely disposed when it is no longer needed. Your personal data will be retained according to the below retention schedules:
|Personal data||Retention Schedule|
|Information relating to IATA course registration||7 years from the date of course registration|
|Information relating to third-party vendors who provide services to Hactl||7 years after termination of contract|
|Information relating to Hactl annual events/activities registration||7 years after registration of events/activities|
|Information relating to working permit application or renewal for working at Hactl premises||7 years after working permit application|
|Information relating to Hactl restricted area registration||5 years after the registration|
|Information relating to inbound and outbound cargo handling services which including the shipment release, details of inbound and outbound cargo shipment, etc.||6 months after the completion of relevant services|
|Information relating to acknowledgement receipt of over-paid x-ray charge and ex-gratia payment in respect of damage/loss of consignment handled by Hactl||7 years after acknowledgement of receipt|
|Information relating to application for accessing Hactl computer rooms or facilities for providing the IT maintenances and supports to Hactl||1 year after the registration|
|Information relating to car park registration at Hactl premises||1 year upon termination of usage of car park|
We will only hold your personal data longer than the above periods when:
We use a range of physical, electronic and managerial measures to ensure that we keep your personal data secure, accurate and up to date. These measures include:
Although we use appropriate security measures once we have received your personal data, the transmission of data over the internet (including by e-mail) is never completely secure. We endeavour to protect personal data, but we cannot guarantee the security of data transmitted to us or by us.
In general, and subject to certain exemptions, you have a right to:
To exercise any of your rights, or if you have any other questions about our use of your personal data, please feel free to e-mail our Corporate Communications Officer at firstname.lastname@example.org or write to the following address:
6/F North Office Block
Super Terminal 1
9 Chun Wan Road
Hong Kong International Airport
You may also use these contact details if you wish to make a complaint to us relating to your privacy.
Should you wish to report a complaint or if you feel that we have not addressed your concern in a satisfactory manner, you also have the right to refer the matter to the Office of the Privacy Commissioner for Personal Data in Hong Kong and/or to a data protection regulator in the place where you live or work, or in the place where you think an issue in relation to your personal data has arisen. A list of national data protection regulators in the European Union can be found here: http://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm.
This notice was last updated in May 2021.
The governing version of this privacy notice is the English version and shall prevail when there are inconsistencies between the English version and the Chinese version. This privacy notice does not extend to third-party websites that may be linked from our Website, or from any other broadcast affiliated with us.
It may be subject to amendments. Any future changes or additions to the processing of personal data as described in this privacy notice affecting you will be communicated to you through an appropriate channel, depending on how we normally communicate with you.