CFA Society Hong Kong (“the Society”) is a not-for-profit professional membership association committed to leading the investment profession globally. We are located in Hong Kong, and we own and operate this website and/or our mobile apps if any (collectively as the “Site“).
To effectively and efficiently run our operation, it is necessary for the Society to collect, use, maintain, transfer, and otherwise process certain types of personal and sensitive data (“Personal Data”). We take the privacy of your information seriously. All information collected is intended to be used as a means to better serve our current and future members. The Society is committed to complying with the Personal Data (Privacy) Ordinance of the Hong Kong Special Administrative Region (“Hong Kong”). The Privacy Policy and relevant practices are in force and as amended from time to time without prior notice. Please check this webpage regularly for any modifications and/or supplements which may be made.
Personal Information Collection Statement
- Personal information collected about you will be kept confidential by us for the purpose of communication between you and us.
- Personal information collected about you will also be used for statistical analysis and marketing the Society’s events/activities/initiatives (including events/activities/initiatives solely hosted by the Society, co-hosted with other organizations and other third parties’ events supported by the Society).
- Under the Personal Data (Privacy) Ordinance, you have the right to request access to and correction of personal information held by us related to you. If you wish to access or correct your personal information held by us, please contact us by email at personaldata@cfahk.org.
Privacy Policy Statement
It is our policy to comply fully with the requirements of the Personal Data (Privacy) Ordinance. In doing so, we will ensure compliance by our staff with the strictest standards of security and confidentiality.
This privacy policy (“Privacy Policy“):
- describes how we gather and protect individually identifiable information (“Personal Information“)
- how we use, process, transfer, and share Personal Information.
- describes your personal data privacy rights.
This Privacy Policy applies to Personal Information that we collect through the Site, as well as offline collections of Personal Information about our members (“Members“), candidates in our educational and credentialing programs (“Candidates”), and participants and attendees at our events.
Summary of Key Points
- By using the Site or providing Personal Information to us, you consent to our processing and transfer of your Personal Information as we describe here.
- We collect Personal Information when you provide information to the Society through the Site, when you register for an examination with CFA Institute, or through other communications with the Society. We use Personal Information to provide the Society’s products and services to you.
- We transfer Personal Data to jurisdictions outside of your home country as necessary for the purposes described in this Policy, including to jurisdictions that may not provide the same level of data protection as your home country.
- We use cookies and other technologies to track the use of our Site and for advertising purposes.
- We share Personal Information with member societies, exam preparatory providers and other partners which provide products and services that may be of interest to you. We also share Personal Information that you post on our Social Media and Networking Sites.
- You can change your preferences for how we contact you and view your Personal Information on file with us at any time by visiting your CFA Institute and /or CFA Society Hong Kong Account(s).
- When we process your Personal Information based on your consent, you have a right to withdraw your consent. We also provide you additional rights to access, rectify, and erase your Personal Information, to obtain a portable copy of your Personal Information, and to restrict or object to our processing of your Personal Information. These rights are limited under the applicable local data protection law.
- We maintain reasonable and appropriate technical, physical, and administrative measures to protect the security of your Personal Information. Access to Personal Information is limited.
- Our Site may have links to other sites that we do not control. Their privacy policies may differ from ours. We encourage you to read the privacy statement of any website you may visit.
- If we make any material changes to our privacy practices, we will post a prominent notice on our Site notifying users of the change.
Consent
By using the Site or providing us with Personal Information you consent to our processing and transfer of your Personal Information as we describe here.
If you provide us with “sensitive” Personal Information (which includes information like
- ethnic or racial origin,
- religious or philosophical beliefs, and/or
- health or medical conditions)
this constitutes your consent to the collection, use, transfer, and sharing of that information for the purposes described in the record where you provide the information and in this Privacy Policy. If a specific element of our processing of your Personal Information relies upon your consent you may withdraw your consent as described below in “Your Rights”.
Cross-Border Data Transfers
We transfer Personal Data to jurisdictions outside of your home country as necessary for the purposes described in this Policy, including to jurisdictions that may not provide the same level of data protection as your home country. We provide appropriate protections for cross-border transfers as required by law for international data transfers. With respect to transfers originating from the European Economic Area (“EEA“), we implement standard contractual clauses approved by the European Commission, and other appropriate solutions to address cross-border transfers as required by applicable law. Where required by such laws, you may request a copy of the suitable mechanisms we have in place by contacting us as detailed below.
If you are located in a country other than the United States, you consent to the transfer of your Personal Information to us in the United States, to third-party data processors located in the United States that we select, and to local Member Societies and third-parties in other countries as we select. Other countries may not provide a level of data protection to your Personal Information equivalent to that provided by your home country.
The Information We Collect
We collect Personal Information to help us better understand your needs, to provide you with personalized and efficient service, and for other purposes described in this Privacy Policy. We generally obtain Personal Information directly through the information that you provide to the Society. We also may obtain Personal Information automatically, through the use of cookies and other technologies, and in some instances from third-parties, such as companies that sponsor programs or conferences in which the Society participates. We do not knowingly collect any Personal Information from children under the age of 16, and users under the age of 16 should not submit any Personal Information to us.
Bases for Processing
Our bases for processing your Personal Information are:
- Contractual Necessity
- Legitimate Interests of CFA Society Hong Kong
- Compliance with Legal Obligations
- Where necessary, Consent
Before we process Personal Information on the basis of the legitimate interests of the Society, we review our processing in light of the interests and fundamental rights and freedoms of the data subject taking into account their reasonable expectations. Where we believe those interests or fundamental rights and freedoms override our legitimate interests, we will seek another valid basis for processing your Personal Information or refrain from that processing activity. Examples of our “legitimate interests” for processing your Personal Information include (but are not limited to):
- processing for direct marketing purposes or preventing fraud
- transmission of personal data for internal administrative purposes
- processing for the purposes of ensuring network and information security
- reporting possible criminal acts or threats to public security to a competent authority
Information you provide to CFA Society Hong Kong and CFA Institute
You may provide Personal Information to the Society in a number of ways, including: (1) through your use of the Site, such as registering for an account and signing up to receive newsletters; (2) through your online account with the Society and/or CFA Institute; (3) upon registering for any CFA Institute examination, including the CFA, CIPM and Investment Foundations examinations; (4) upon becoming a Member; (5) upon communicating directly with the Society either electronically or by providing hard copies of documents; and (6) upon registering for the Society’s conferences or events.
The Personal Information we collect
Listed below are the classes of Personal Information that we collect. Please note, however, we do not collect all these Personal Information from everyone. For example, information on religious affiliation is only collected from candidates in our credentialing programs who request a religious alternate testing date. Similarly, we only collect employee number from our employees. Likewise, Clear GIFs are only collected from visitors to the Site.
- Contact
- Data (name; personal contact information (phone, email address, physical address))
- Financial information
- Credit card data
- Gender
- Birthdate
- Passport number, country of issuance and expiration date
- Educational background
- Criminal history
- Civil liability history
- Professional complaints, or investigations
- CFA Society Hong Kong Membership Number/ CFA Institute ID
- Dependents (name and relationship)
- Marital status
- Data about spouse/domestic partner
- Reference letters
- Government identification number
- Health information
- Dietary needs
- Professional skills and talents
- Professional memberships
- Community involvement
- Geographic mobility interests
- New hire and termination data
- Qualifications
- Type of Browser/Type of Operating System
- Religious affiliation
- Work experience
- Professional conduct statement by employer/sponsor
- Username
- Password
- Biometric data (photograph, video, signature, palm vein)
- Individual’s status in CFA’s programs
- Behavioral data (how members use our content and offerings)
- Work location
- Employee number
- Job/position title
- Assignments
- Work contact data (telephone and fax numbers and email addresses)
- Business group and country code data
- Manager and reporting data
- Employment contract data
- Salary and related compensation data
- Promotion data
- Benefits data
- Language skills
- Training details
- Assessment and performance-related data
- IP Address or Mobile Device ID
- Clear GIFs
- Referring website
Purposes for Which We Use Personal Information
The purposes for which we process your Personal Information are listed below.
- Any purpose relating to or in connection with compliance with any law, regulation, court order or request of a regulatory body (for all the Society’s members and all website visitors), and/or breach of the Code and Standard of the CFA Institute (for the Society’s Regular/Affiliate Members) and the Society’s Code and Standards (for Associate Members/Student Associates);
- For any other purpose relating to or in connection with the business of the Society;
For Members, Candidates and Attendees at our Events:
- General membership and account management
- Processing your orders
- Processing applications and registrations that you submit to us
- Providing examination services and administering and scoring examinations
- Marketing
- Website Management
- Scholarship Program Award and Administration
- Measuring effectiveness of our products and services
- Maintain the online CFA Institute Member directory;
- Volunteering related matters;
- For any other purpose relating to or in connection with the business of the Society
For Employees and Job Applicants (and where applicable dependents):
- General business administration
- Benefits Administration
- Compensation Related Activities
- Workflow Administration
- IT Support
- Monitoring
For visitors to the Site:
- General account management and the Society’s administration
- Marketing
- Website Management
- Website Improvement
- Scholarship Program Award and Administration
- Measuring effectiveness of prep courses and exam
Cookies and Other Tracking Technology
Our Site uses cookies and other tracking devices to collect information automatically. These tracking devices may be placed by us or by our thirdparty partners or vendors. By using the Site, you agree to the use of cookies and other tracking devices as described below. You may configure your Internet browser to notify you when a cookie is sent (giving you the option to decide whether to accept it or not), and to reject or remove cookies. To remove cookies, please follow your browser’s instructions or contact your browser provider for more information. You may also manage many of the cookies on our Site through your Profile. By removing or refusing to accept cookies, you may be unable to use or acce ss some features of our Site
Cookies
Cookies are small pieces of information that a website transfers to your computer. Our Site uses session ID cookies (expire when you close the browser) and persistent cookies (persist even after you close the browser), which help our Site run more smoothly and tailor content for you. Our Site includes a mechanism to manage the cookies that we use on our Site through your Profile. Additionally, most web browsers have options that allow you to control whether to accept cookies and give you the option to delete all cookies. However, disabling may prevent access to some parts of our Site. Do Not Track Signals: If you wish to not be tracked during your visit to our Site, please follow your browser’s “Do Not Track” instructions or contact your browser provider for more information. By sending a Do Not Track Signal, you may be unable to use or access some features of our Site.
Devices IDs
Some portions of this Site and our mobile app collect and store a unique device ID associated with your particular device to track the number of unique visitors using our Site or mobile applications and to enable you to interact with and use those resources. We link your device ID with the technical information accessed through your use of our Site or the mobile application for the uses described in this Privacy Policy.
Clear Gifs (Web Beacons/ Web Bugs)
Our Site may employ a software technology called clear gifs (a.k.a. Web Beacons/Web Bugs), which helps us to better manage content on our Site by informing us what content is viewed or clicked on. Clear gifs are tiny graphics with a unique identifier similar in function to cookies. In contrast to cookies, which are stored on a visitor’s computer, clear gifs are embedded invisibly on web pages and e-mails and are about the size of a period.
Log Files
We also gather Personal Information automatically and store it in log files. For instance, when you visit our Site or use our mobile app, the server may automatically recognize information about you, including: the date and time you visited our Site, the pages you visited, the referrer (the website you came from), the type of browser you are using (e.g., Firefox, Internet Explorer), the type of operating system you are using (e.g., Window s or Mac OS), and the domain name and address of your internet service provider.
Online Behavioral Advertising
Our Site places and recognizes cookies and similar technologies on your browser or device when you visit it for purposes of serving you targeted advertising (a.k.a. “online behavioral advertising”). We also work with third-party analytics and advertising companies who place their own cookies or similar technology on your browser or device when you visit our Site and other third-party websites, in order to provide analytics to us or serve customized advertisements to you. As noted above, you can set your device or browser to accept or reject most cookies, or at least notify you in most situations that the technology is offered. You can also manage the cookies you receive through your Profile.
Please note that even if you reject these devices, you may continue to receive advertisements, but the advertisements will not be tailored to your browsing activities and interests.
How We Share Information
We share Personal Information as follows:
Third-Party Processors and Transaction Processing
We engage third-parties to perform services in connection with the operation of this Site and our organization. Examples of these third-parties include website hosting service providers, technology service providers, payment processors, legal advisers and consultants, examination supervisors and/or related services. We share Personal Information with these third-parties, but we authorize them to use this Personal Information only in connection with the services they perform on our behalf. Such parties are bound by contract to establish appropriate measures to protect your Personal Information from unauthorized access, use, or disclosure. In addition, we share certain Personal Information with third-parties as necessary to facilitate our offering of products and services to you.
Third-Party Products and Services
If you authorize us to do so by opting in, then we will share your Personal Information with selected third-parties that offer services or products that we believe may be of interest to you. These third-parties may contact you with communications regarding their own services or products. Such third-parties may include exam preparatory providers, exhibitors at and sponsors of the Society events, University Program Partners, and other partners of the Society. Please note that, if you receive any communications from these third-parties, you may contact them directly to opt-out of receiving further communications from them.
Member Societies and Employers
As part of the services that we provide, we share Personal Information of CFA and CIPM candidates (Investment Foundations candidates may opt-in) and Members with CFA Institute Member Societies (“Societies“) to enable Societies to contact you regarding membership in the Society, volunteer opportunities, events, services, products, and other opportunities. If you no longer wish to receive these communications, you may opt-out with the Society directly.
We share Personal Information of Members with their employers in order to validate membership and/or charterholder status. We share Personal Information of Investment Foundations candidates with their employers to validate candidate status and exam pass/fail result where the candidate has registered for the Investment Foundations exam using an employer-issued voucher.
CFA Institute Member Directories
CFA Institute make Member name, location, and charter status information publicly available through the CFA Institute online Member Directory, which is searchable on the CFA Institute public website, as well as by phone and email upon a third-party’s request. Members may choose to make additional information available on the Member Directory by changing their account preferences. Names of individuals holding any CFA Institute issued certificate is available to the general public.
Event Attendees
For some of the Society’s events, we make Personal Information of all event attendees available to other event attendees and event sponsors. The Personal Information made available includes name, employer, address, and email address.
Legal Compliance
We share Personal Information of CFA charterholders with government regulators in connection with charterholder reporting obligations. We also share Personal Information with our Professional Conduct Hearing Panels or similar functions, and otherwise share Personal Information as required by law or at the request of government regulators or other law enforcement officials and the courts.
CFA Society Hong Kong Sites and Social Media Sites
The Site offer opportunities to engage in social networking, interact with others and/or submit or post messages or other content. The Site may also provide for interactions with third-party websites or services including social media websites through plug-ins. Please note that any information or materials that you post or submit through such Sites will be publicly posted to everyone that has access to the relevant Site. Posts to third-party social media or other sites (“Social Media Sites“), including any content on our Site that you “share” or “like,” will be controlled by and subject to the terms of such social media or other sites. We encourage you to use caution when you submit any information or materials on or through any of the Society Site or interact with third-party websites or services through plug-ins. Your use of the Sites is governed by our Terms and Conditions.
Your Communication Preferences
You may change your preferences for how we contact you at any time by visiting your Account(s) (account login required) on the CFA Institute/CFA Society Hong Kong website, or by contacting us using the information provided under the “Contact Us” section.
In order to provide you with superior service, we may contact you to resolve a problem even if you have asked us not to contact you for other purposes. For example, if you are a Member and we cannot deliver your Annual Dues Bill and Professional Conduct Statement, we may contact you to verify delivery details.
Accessing and Updating Your Personal Information
You may view your Personal Information on file with us at any time by visiting your Account(s) (account login required) on the CFA Institute website or CFA Society Hong Kong website, where you may change some of your Personal Information. Please note that CFA Institute website and CFA Society Hong Kong website may be separately managed on self-serve basis, and we may require additional information to authenticate your identity.
Your Rights
We provide you with the rights to:
- Withdraw your consent to processing your Personal Information.
- Request access to your Personal Information.
- Request rectification of your Personal Information.
- Request erasure of your Personal Information.
Please note that all of these rights are limited under your applicable local data protection law. If you exercise or seek to exercise any of those rights, our obligations to respond are limited by and subject to applicable law.
Right to withdraw your consent
If a specific element of our processing of your Personal Information relies upon your consent (in particular regarding the receipt of direct marketing communication via email, SMS/MMS, fax, and telephone), you may withdraw your consent at any time with future effect. Such a withdrawal will not affect the lawfulness of the processing prior to the consent withdrawal.
In instances where you have opted-in to share your Personal Information with test prep providers or other third parties, you may contact CFA Institute/us to opt-out of future sharing of your Personal Information with such parties in the future; however, such withdrawal will not affect the lawfulness of the transfers that occurred prior to the consent withdrawal.
Right to request access
As described above, you may view your Personal Information on file with us at any time by visiting your Account (account login required) on the CFA Institute and/or CFA Society Hong Kong website, where you may change some of your Personal Information.
You also have the right to obtain from us confirmation as to whether Personal Information concerning you is being processed, and, where that is the case, to request access to the Personal Information. This access information includes:
- the purposes of the processing,
- the categories of Personal Information concerned, and
- the recipients or categories of recipient to whom the Personal Information have been or will be disclosed.
However, this is not an absolute right and the interests of other individuals can restrict your right of access.
You have the right to obtain a copy of the Personal Information undergoing processing while the Society may impose a reasonable fee based on administrative costs.
Unless otherwise agreed, hard copies of any documents containing your personal data that you have provided to the society become the property of the Society and will not be returned to you. The Society will destroy any documents it holds in accordance with its internal policy and applicable ways.
Right to request rectification
You have the right to obtain from us the rectification of inaccurate Personal Information concerning you. Depending on the purposes of the processing, you may have the right to have incomplete Personal Information completed, including by means of providing a supplementary statement. You may also change some of your Personal Information by visiting Your Account(s).
Right to request erasure (“Right to be forgotten”)
You have the right to obtain from us the erasure of Personal Information concerning you.
Right to request restriction of processing
Under some circumstances, you have the right to obtain from us restriction of processing your Personal Information. In such case, the respective data will be marked and may only be processed by us for certain purposes.
Right to request data portability
Under certain circumstances, you have the right to receive the Personal Information concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and you have the right to transmit those data to another entity without hindrance from us.
Right to object
Under certain circumstances, you have the right to object, on grounds relating to your particular situation, at any time to the processing of your Personal Information by us and we can be required to no longer process your Personal Information. Such right to object may especially apply if we collect and process your Personal Information for profiling purposes in order to better understand your interests in our products and services or for direct marketing. If you have a right to object and you exercise this right, your Personal Information will no longer be processed for such purposes by us. You may exercise this right by contacting us as stated in this Privacy Policy. Such a right to object may, in particular, not exist if the processing of your Personal Information is necessary to take steps prior to entering into a contract or to perform a contract already concluded.
To exercise your rights, please contact us as stated under “Contact Us”. In some cases you also have the right to lodge a complaint with the competent data protection supervisory authority.
Security
We maintain reasonable and appropriate technical, physical, and administrative measures to protect the security of your Personal Information. Access to Personal Information is limited to only those employees, contractors, or authorized agents of the Society who have authorization to access such Personal Information and such access is limited to the extent such information is needed to fulfill the task for which the Personal Information was collected. While we strive to protect your Personal Information, we cannot ensure the security of the information you transmit. We recommend you to take every precaution in protecting your Personal Information when you are on the internet. For example, change your passwords often, use a combination of letters and numbers when creating passwords, and make sure you use a secure browser.
Links
This Site provide links to websites or services created and maintained by other individuals or organizations, including CFA Institute. Please note that these websites’ privacy policies may differ from this Privacy Policy. We encourage you to read the privacy statement of any website you may visit, as we are not responsible for such websites’ content and policies. We do not control these links or sites nor are we responsible for the accuracy, timeliness, security, or continued availability or existence of the information provided on these sites. Other organizations l inked from the Site may collect information about you when you visit their websites. We cannot control this collection of information. You should contact these companies directly if you have any questions about how they use the information they collect.
Changes
Except where limited by applicable law, we reserve the right to update this Policy to reflect changes to our information practices by prominently posting notice of the update on this Site, and, if required, obtaining your consent. Any updates will become effective immediately after posting the updates to this Policy and apply to all information collected about you, or where required, upon your consent. You agree that you will review this Policy periodically. If we make any changes to this Policy, we will change the “Last Updated” date above. You are free to decide whether or not to accept a modified version of this Policy, but accepting this Policy, as modified, is required for you to continue using the Site.
If we make any changes to this Policy that materially and adversely impacts previously collected information about you, we will obtain your prior express consent for processing information previously collected about you in such a manner.
Contact Us
For further information about the Society ‘s privacy practices, please contact us.
(Version Date: 8 March 2024)
