Privacy Policy

Last updated: 4 June 2024

Introduction

We are Justice Centre Hong Kong Limited, a company limited by guarantee and incorporated in Hong Kong (“we” or “us”), with our registered address at Unit 5, 10/F, Hermes Commercial Centre, 4 Hillwood Road, Tsim Sha Tsui, Hong Kong. 

Your privacy is important to us.  We are committed to protecting the privacy, confidentiality and security of the personal data we hold by complying with the requirements under applicable laws and regulations.  We are equally committed to ensuring that all our employees, service providers and agents uphold these obligations.   

When we provide services for you or otherwise handle your personal data for our benefit, we will be the “data controller” for your personal data.   

This policy applies to all of our activities where we act as a data controller.  This policy explains how we collect, use, process, manage and disclose personal data within our organisation.   

For more information about us, please see the Contact details section of this policy. 

Explaining the legal basis we rely upon to process your personal data

Data protection laws set out various grounds on which an organisation may lawfully collect and process your personal data.  These include: 

Consent

We can collect and process your data with your consent. For example, when we are processing sensitive or special personal data, such as information relating to your health or religious beliefs. In many circumstances, if we rely on your consent as our legal basis for processing your personal data, you have the right to withdraw that consent at any time.   

To do so, please contact us using the Contact details section of this policy. 

Contractual obligations

In many circumstances, we require your personal data to comply with contractual obligations.  If you are unable to provide such information to us, we may not be able to perform the contract we have with you or your organisation or enter into a contract with you or your organisation.

Legal compliance 

If the law requires us to, we may need to collect and process your personal data.  If you are unable to provide such information to us, we may not be able to perform the contract we have with you or your organisation or enter into a contract with you or your organisation. 

Legitimate interests

In many situations, we require your personal data to pursue our legitimate interests in a way which might reasonably be expected as part of running our organisation and which does not materially impact on your rights, freedoms or interests. Data protection laws do vary across the different jurisdictions in which we operate.  Please contact us if you require details of the specific legal ground we are relying on to process your personal data.    

How we collect personal data

We collect personal data about you in the following ways:   

  • when you visit our centre  
  • when you attend any of our events and/or participate in any of our programmes 
  • when you visit our website 
  • when you contact us 
  • when you submit a query to us 
  • where you register to receive emails from us regarding upcoming events 
  • when you request services from us (e.g. psychosocial services or legal services) 
  • when you attend a meeting between you and our staff 
  • when you make a donation to us 
  • when you respond to a survey that we run or fill in forms on one of our websites 
  • by tracking your use of our website  
  • from public sources 
  • from third parties who are entitled to disclose that information to us 
  • when you apply for a job, internship, fellowship, legal clinic, or other position with us 

In some cases we may be required by law to collect certain types of personal data about you. 

Where we collect personal data from you, we will generally do so ourselves.  However, in some cases we may collect personal data from a third party, such as through your family, medical practitioners, charitable organisations, religious organisations, social welfare organisations, government authorities or departments, representatives, or other bodies who provide services to us, or third parties who refer you to us because they think we may be of assistance. 

Kinds of personal data we collect, use, hold and disclose

The kinds of personal data that we collect, use, hold and disclose about you may include: 

For all persons: 

  • identifying information, such as your name and date of birth 
  • nationality (including previous country(ies) of residence) 
  • contact information, such as your postal address, email address and telephone number 
  • social media handles and other social media profile information that you make available to us or to the public 
  • financial information, such as credit card, bank account or other payment details (only where this is needed to fulfil a transaction which you make with us) 

For persons seeking our legal/psychological/other services:   

  • sensitive information may be collected about you.  This includes, but is not limited to  medical information (including physical and mental health), racial or ethnic origin, political affiliations, sexual orientation, immigration status (including in relation to any claim(s) for non-refoulement protection you have made in Hong Kong or any other jurisdiction), education level and/or previous criminal convictions 
  • information in relation to any legal proceedings relating to you in Hong Kong 
  • information relating to the provision of welfare support to you by the Social Welfare Department, International Social Service Hong Kong Branch, or any other welfare services provider  
  • any other information that may be necessary or of assistance to us in providing services to you.   

Without this information, we may not be able to provide you with our services or to accurately respond to queries or requests that you submit to us. 

Purposes for which we collect, use and/or disclose personal data

We collect, use and/or disclose personal data for different purposes (depending on the circumstances as to how and why we engage with you).  Not all purposes will apply to all persons.  We will only collect personal data necessary for the specific purpose(s) applicable to you.  

We collect, use and/or disclose personal data about you for the following purposes: 

  • to provide services to you, including, but not limited to services relating to: 
  • your claim for protection/asylum in Hong Kong (including any appeals), pursuant to the Unified Screening Mechanism (“USM”) process or otherwise 
  • in relation to matters involving immigration, the police, food, housing, health care, education, employment, getting married and having a family 
  • assisting with enquiries with regards to immigration options other than USM, including resettlement  
  • to provide psychosocial services 
  • to carry out a transaction with you (including processing any donation payments) 
  • to provide you with direct marketing communications (in accordance with the “Direct marketing” section below) 
  • to determine your eligibility to access our services  
  • to communicate with you on refugee issues and causes in line with our mission 
  • to conduct campaigns in line with our mission 
  • to provide reports on our operations to our donors, funders, board, and/or other supporters from time to time 
  • to improve our website based on your information and feedback 
  • to answer your queries and requests 
  • to comply with any applicable rules, laws or regulations, regulatory policies, industry codes of practice or guidelines, judgments, orders, notices, directions or requests issued by any court, or any administrative, governmental or regulatory body, whether in Hong Kong or otherwise, including but not limited to the carrying out of audit checks, surveillance and investigations  
  • to carry out market analysis and research 
  • to carry out education and training programs for our staff including our volunteers 
  • to manage and resolve any complaints or issues 
  • to carry out planning and forecasting activities and other internal business processes 
  • to keep you informed about our activities  

We may also collect, use and/or disclose your information for other purposes in accordance with your requests or instructions. 

Research reports

In some instances for persons who are seeking legal/psychological/other services from us, we may use your personal data in the preparation of reports and in compiling aggregate data concerning USM cases and immigration cases more generally.   

In such cases, we seek to anonymise your name and personal data however there may be instances where your personal data is disclosed.      

We will only use your data in this way with your consent.  If you do not wish us to use your data in this way, please contact us using the Contact details section of this policy. 

Direct marketing

We may from time to time use your personal data in order to send you marketing materials about our activities that we think you may be interested in (including in some cases services and events that are provided by a third party).   This may include information about fundraising and/or educational or other related activities in line with our mission. 

Marketing material may be in various forms, including advertisements, special event notifications or newsletters and delivered via various methods including but not limited to email, instant messaging, and telephone. 

We may not use your personal data in this manner unless we have received your consent. 

You have a choice about whether or not you wish to receive information from us.  You may partially or entirely opt-out of receiving such direct marketing materials by contacting us using the Contact details section of this policy.  

We will then stop any further marketing related activities from ourselves.  Please note that you may continue to receive communications for a short period after changing your preferences while our systems are fully updated.   

We will only share your personal data with a company outside our company for any marketing purposes where we have your prior and express consent.  

We may use your following personal data for the purpose of direct marketing:   

  • identifying information, such as your name and date of birth 
  • contact information, such as your postal address, email address and telephone number 
  • other personal data that may be relevant to services and/or events that we or a third party provide 

We may also use and disclose your information for other purposes in accordance with your requests or instructions. 

People to whom we may disclose personal data

We may share personal data about you with: 

For all persons: 

  • our internal staff who need the information to discharge their duties (including for employment purposes) 
  • our business partners, agents and service providers 
  • payment system operators (to the extent we accept a donation from you only) 

For persons seeking and/or receiving legal/psychological/other services: 

  • your representatives, advisers and other professionals  you have authorised pursuant to our “Authority” notice to interact with us on your behalf, including, but not limited to: 
  • the Duty Lawyer Service (including court liaison officer and/or duty lawyer and/or pilot lawyer scheme lawyer) 
  • other lawyer(s) (whether a solicitor or barrister) 
  • the Legal Aid Department, Social Welfare Department, International Social Service Hong Kong Branch, Hospital Authority, Immigration Department, and/or Torture Claims Appeal Board, the United Nations High Commissioner for Refugees (‘UNHCR’),  
  • legal volunteers who have signed our “agreement for volunteer placement” form 
  • professional advisers who we engage to provide advice including medical practitioners and external lawyers/legal representatives 
  • our funders and donors  
  • government authorities who ask us to disclose that information or which we have requested personal information from, or to other people as required by law, including: 
  • the Director of Immigration and/or their departmental staff (including any immigration office(s) 
  • the Torture Claims Appeal Board 
  • the Social Welfare Department 
  • the Legal Aid Department 
  • the Hospital Authority 
  • any other government or court officials 

We may also collect, use and/or disclose your information to other organisations in accordance with your requests or instructions. 

In some cases the people to whom we disclose your personal data may be located overseas.  Further, we may have servers located overseas.  The jurisdictions in which these people and/or servers are likely to be located include the Hong Kong Special Administrative Region, Asia Pacific and Ireland. There may not be in place data protection laws which are substantially similar to, or serve the same purposes as the applicable data privacy laws in Hong Kong.  This means your personal data may not be protected to the same or similar level as in Hong Kong. 

We will never sell your personal data to any third party.  

Cookies

We use cookies to monitor and observe your use of our websites, compile aggregate data about that use, and provide you with a more effective service (which may include customising parts of our websites based on your preferences and past activities on those websites).  “Cookies” are small text files created and stored on your hard drive by your internet browser software, in order to hold relevant information about the web page you are currently viewing.  Most internet browsers have a facility that will allow you to disable cookies altogether – please refer to your browser’s help menu to find out how to do this.  While you will still be able to browse our websites with cookies disabled on your internet browser, some website functionality may not be available or may not function correctly. 

Google Analytics

Our website uses Google Analytics, a web analytics service provided by Google, Inc. (“Google”).  Google Analytics uses cookies to help the website analyse how users use our website.  

The information generated by the cookie about your use of our website (including your IP address) will be transmitted to and stored by Google on servers in the United States.  Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activity for website operators and providing other services relating to website activity and internet usage.  Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google’s behalf.  Google will not associate your IP address with any other data held by Google. 

You may refuse the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full functionality of our website.  By using our website, you consent to the processing of data about you by Google in the manner and for the purposes set out above. 

Social media links

On our website and throughout out services, we have included links to our social media profiles.  The relevant social networks might also collect personal data about you.   

Please refer to their privacy policies for more information. 

Storage and security of personal data

We generally store the personal data that we collect in electronic databases, some of which may be held on our behalf by third party data storage providers.  In particular, we use cloud-based software systems which store data in servers located in Ireland, the United States of America, and/or Canada.  Third-party data storage providers and their services are tested, certified and endorsed as secure.   

Sometimes we also keep hard copy records of this personal data in physical storage facilities.   

We use a range of physical and technical security processes and procedures to protect the confidentiality and security of the information that we hold, and we update these from time to time to address new and emerging security threats that you become aware of. 

We also take steps to monitor access to and modification of your information by our staff, and ensure that our staff are aware of and properly trained in their obligations for managing your privacy. 

Retention of personal data

Your personal data will only be kept as long as required for the purposes for which such personal data was collected, used and/or disclosed, or for any legal or business purposes.  

We may retain your personal data for a period of up to 12 years.  At our discretion, we may retain personal data for longer than the said period if we consider it necessary or desirable to do so to meet our legal or regulatory obligations.   

Where your data may be processed

To facilitate our services, we may transfer, store and process your information around the world.  

For those individuals residing in the European Economic Area (“EEA”), this may sometimes involve the transferring of your personal data out of the EEA.  Laws in these countries may differ from the laws applicable to your country of residence.  Where we transfer, store and process your data outside of the EEA we have ensured that appropriate safeguards are in place to ensure an adequate level of data protection.  This may be an adequacy decision of the European Commission confirming an adequate level of data protection in the respective non-EEA country or an agreement on the basis of the European Union (“EU”) Model Clauses (a set of clauses issued by the European Commission). 

Further information on these EU Model Clauses and the rights they provide to data subjects can be found on the European Commission website. 

Please contact us if you require further information on the specific mechanism used by us when transferring your personal data outside of the EEA. 

Your consent

By using our website, providing personal data, attending our events, contacting us, and/or using any of our services, you agree that: 

  • you consent to this privacy policy, as updated from time to time; and 
  • if you have provided personal data to us relating to any other person, you: 
  • have a right to provide that information;  
  • have provided a copy of this privacy policy, as updated from time to time, to that person; and  
  • each such person has agreed to those terms.   

What are your rights over your personal data? 

You have a number of rights in relation to the personal data that we hold about you.  These rights are subject to certain exemptions and do differ across the jurisdictions in which we operate.  To exercise these rights, please contact us using the Contact details section of this policy. 

Request access to the personal data we hold about you  

You have the right to access any of the personal data that we hold about you and you have the right to be informed about the processing of your personal data (and if you did not give it to us, information as to the source). 

To protect the integrity and security of the information we hold, we may ask that you follow a defined access procedure, which may include steps to verify your identity.  There may be cases where we are unable to provide the information you request, such as where it would interfere with the privacy of others or result in a breach of confidentiality.  In these cases we will let you know why we cannot comply with your request. 

Even if you do not request access to and/or correct your personal data held by us, if we are satisfied that, having regard to the reasons for which we hold your personal data, that personal data is inaccurate, incomplete, out-of-date, irrelevant or misleading, we may take reasonable steps to correct that information.  

For EU residents, we will do this for no fee, in accordance with applicable legislation. 

Right of correction  

If the information we hold about you is inaccurate, you have the right to have this information correction.  You may also request that we restrict the processing of that information. 

Right to erasure / ‘Right to be forgotten’ 

You can ask us to delete or remove your information in certain circumstances, such as where: 

  • the personal data is no longer necessary for the purpose for which it was collected; 
  • you withdraw your consent to consent based processing and no other legal justification for processing applies; 
  • you object to processing for direct marketing purposes; 
  • we unlawfully processed your personal data; and 
  • erasure is required to comply with a legal obligation that applies to us. 

We will proceed to comply with an erasure request without delay unless continued retention is necessary for: 

  • exercising the right of freedom of expression and information; 
  • complying with a legal obligation under EU or other applicable law; 
  • the performance of a task carried out in the public interest; 
  • archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes, under certain circumstances; or 
  • the establishment, exercise, or defence of legal claims. 

For EU residents, whenever you have given us your consent to use your personal data, you have the right to change your mind at any time and withdraw that consent.  

In cases where we are processing your personal data on the basis of our legitimate interests, you can ask us to stop processing your data for reasons connected to your individual situation.   

We must then do so unless we believe we have a legitimate overriding reason to continue processing your personal data.  

Right to object 

In certain circumstances, you have a right to object to processing being carried out by us.  These circumstances include where: 

  • you contest the accuracy of the personal data; 
  • where processing is unlawful you may request, instead of requesting erasure, that we restrict the use of the unlawfully processed personal data; 
  • we no longer need to process your personal data but need to retain your information for the establishment, exercise, or defence of legal claims.   

You also have the right to object to processing of your personal data under certain circumstances, such as where the processing is based on your consent and you withdraw that consent.  This may impact the services we can provide and we will explain this to you if you decide to exercise this right. 

Where personal data is being processed for direct marketing purposes, you have a right to object at any time.   

To protect the confidentiality of your information, we will require you to verify your identity before proceeding with any request.   

If you have authorised a third party to submit a request on your behalf, we will ask them to prove they have your permission to act. 

Complaints

We try to meet the highest standards in order to protect your privacy.   

However, if you are concerned about the way in which we are managing your personal data and think we may have breached any applicable privacy laws, or any other relevant obligation, please contact our privacy compliance team using the Contact details section of this policy. 

We will make a record of your complaint and refer it to our senior management team for further investigation.  We will deal with the matter as soon as we can, and keep you informed of the progress of our investigation. 

If we have not responded to you within a reasonable time or if you feel that your complaint has not been resolved to your satisfaction, you can lodge a complaint with the Privacy Commissioner for Personal Data (“PCPD”).  

You may contact the PCPD using the below details: 

Privacy Commissioner for Personal Data 

12/F, Sunlight Tower 

248 Queen’s Road East 

Wan Chai 

Hong Kong  

Phone: +852 2827 2827 

Fax: +852 2877 7026 

Website: www.pcpd.org.hk 

Hyperlinks

We may provide hyperlinks from this website to websites of other organisations or associated companies.  

The privacy policies of others may differ significantly from this policy.  Therefore, we encourage you to read the privacy policies of each and every website that you interact with. 

Review of this policy

We may make changes to this policy from time to time, to take into account changes to our standard practices and procedures or where necessary to comply with new laws and regulations.   

The latest version of this policy will always be the version that is available on our website.   

We encourage you to review this policy whenever you access or use our website to stay informed about our information practices and the choices available to you. 

Contact details

The accuracy and security of your information is important to us.  If you: 

  • do not want us to use your personal data in the manner set out in this policy; 
  • need to advise us of any changes to your personal data; 
  • would like to exercise a right granted under this policy or applicable law; or 
  • if you would like any more information about the way in which we collect and use your personal data,  

please contact our team by mail at: 

Unit 5, 10/F, Hermes Commercial Centre, 4 Hillwood Road

Tsim Sha Tsui, Hong Kong 

Questions can also be sent by email to: info@justicecentre.org.hk