Privacy Notice

 

This privacy notice is available in large print. If you require a copy of this privacy notice in large print or any other special assistance, please contact us.


This is the privacy notice of The Bank of East Asia, Limited, UK Branches for our customers and website users that explains who we are, why and how we process your personal information when you are a customer of ours or visit our website and your rights. If you do not wish for your personal information to be used in the ways described within this Privacy Notice then you should not access or use the website that we make available for your use ("Website") and/ or use the services we offer ("services").


Our commitment to protecting your privacy and personal information

We are committed to ensuring that your personal information is used properly, your privacy is protected and the confidentiality of any personal information that you provide to us is safeguarded. This Privacy Notice explains how we use and protect the information we collect about you, how you can instruct us if you prefer to limit the use of that information and the procedures that we have in place to safeguard your privacy.

The controller of your personal data is The Bank of East Asia, Limited, UK Branches registered in England and Wales under UK establishment number BR001344 and with its registered office address at:

75 Shaftesbury Avenue

London

W1D 5BB

("BEAUK", the "Bank", "we", "our" ,or "us")


Information we collect about you


Information you give us


This is information about you that you give us by:


  • applying for products and services;
  • using the message service on the Website;
  • your use of the Website or services; or
  • corresponding with us by phone, e-mail or otherwise.


This may include personal information such as:

  • your name and contact details including personal details such as date of birth, email address, postal address and telephone number;
  • information about your employer and your job function;
  • financial details and any additional details about you or someone else that you may provide us with, such as information about any power of attorney;
  • information relating to you which is necessary for us to process in order to enter into or perform a contract with you;
  • information relating to you that you give us or we otherwise obtain when you visit us or communicate with us (for example, if you sign in or are recorded on CCTV while visiting us, or the voice recordings obtained during your telephone calls with us); and
  • information including your national insurance number and tax information for tax reporting purposes.

Special categories of data

We may collect special categories of personal information about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data).


Criminal Offence data


We may also process criminal offence or conviction data. Occasionally we may receive a Court Production Order (which requires us to share account information) from the Police, His Majesty's Revenue and Customs ("HMRC") or another regulatory body if there is a financial investigation underway.


Further information explaining our use of special category and criminal offence data can be found in our Appropriate Policy Document.


An Appropriate Policy Document (APD) is a document that outlines the legal basis for processing special category data and any safeguarding measures an organisation has in place in order to protect said data. Schedule 1 of the Data Protection Act 2018 requires organisations to have an APD in place when processing special category and criminal offence data under certain conditions.


Further, in light of Consumer Duty coming into force in July 2023 and our work concerning the handling of vulnerable customers, we will begin processing special category data more frequently. It is for that reason a BEAUK APD is necessary. Further information can be found on the website of Information Commissioner's Office.

Information that we obtain from you


Information that we obtain from you when you use our Website or services may include:


  • account and transactional information and history including payment and payee details;
  • technical information, including the Internet protocol ("IP") address used to connect your computer to the Internet, your login information, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform; and
  • information about your visit, including the full Uniform Resource Locators ("URL"), clickstream to, through and from our Website (including date and time), products you viewed or searched for, page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), methods used to browse away from the page, and any phone number used to call our customer service number or social media handle used to connect with our customer service team.

Information we obtain from third parties


We may obtain information about you from third parties:


  • in connection with a mortgage/loan application through necessary enquires to previous and/ or existing lenders about previous or existing loans and insurance companies with whom you have applied for a policy in relation to a mortgage/ loan application;
  • necessary enquiries of persons such as employers, landlords, accountants, bankers, the Land Registry and/or HMRC in connection with mortgage/loan applications to confirm the accuracy of the application information and for credit reference purposes; and
  • information from other banks, third parties or fraud prevention and law enforcement agencies to detect, investigate and prevent financial crime or to receive confirmation of payee.


The Bank may seek references, make searches and additional searches with credit and other reference agencies (the "Agencies"), including searches of the Electoral Register and the Credit Industry Fraud Avoidance System, using the information provided in any mortgage/ loan application, to assist with verifying your identity for the purpose of the mortgage/ loan application and to comply with the Bank's obligations under UK immigration law.


The Agencies will record details of the Bank’s searches for the purpose of an application, whether or not the mortgage/ loan application is approved, and may include a scoring method, which may affect your credit rating.


We may use credit-scoring methods to assess a mortgage/ loan application and to verify your identity and the credit searches on other information provided to the Bank and/or the Agencies about you and those with whom you are linked financially may be used by the Bank and may be disclosed to other companies for the purposes of assessing whether to lend to you or other members of your household.


The information held about you by the Agencies may be used by the Bank, and/or other companies, for the purpose of identity verification, credit assessment, debt recovery and the prevention of financial crime.


How we use the information collected about you

Information you give us


If you send us information via our online form or message service, e.g. to obtain any further information about our services or if you have any suggestions for us, you will be requested to provide information about yourself. A padlock symbol on the page will inform you that the transmission of the messages will be encrypted for your protection. We will use this personal information to provide you with the information that you have requested, which is in our legitimate interests (being to manage and respond to enquiries where we have deemed that these are not overridden by your privacy rights).

We and other members of the group of The Bank of East Asia, Limited ("BEA Group") will use your information (which may include your personal information) to take steps in order to enter into a contract with you or carry out obligations arising from any contract entered with you, including; to supply services to you; to manage your account, to give you statements and provide our services; for assessment and analysis (including credit and/or behaviour scoring, market and product analysis); and to develop and improve our products and services. We may also use the information to ensure in our legitimate interests or the legitimate interests of third parties (where these are not overridden by your privacy rights) to improve our services; to provide confirmation of payee details; to monitor, prevent or detect fraud; to ensure that content from our Website is presented in the most effective manner for you and your computer; or as otherwise described in this privacy notice. Any research and statistical analysis we use will not include information that can be used to identify any individual. We may also use the information to trace your whereabouts to recover debts and to help detect, investigate or prevent fraud and/or money laundering, in accordance with our legal obligation or where it is in our legitimate interests to do so. BEA Group may also use your information to enable us to comply with our legal and regulatory obligations.


The Bank will use your information for the purposes of considering any mortgage/ loan application and, if granted, administering the mortgage /loan and its lawful basis for doing so is that the processing is necessary for performance of a contract with you. Please note that if you do not provide us with the requested information, we will not be able to process your mortgage/loan application.

Where an applicant is a company, the Bank may collect information about any third party mortgagors, company directors, shareholders, controllers and beneficial owners of the company and process that information for the any of the purposes described below (except for marketing purposes) as though those individuals were the applicant. The applicant warrants and represents that it has made these individuals aware of this and of the existence of the Bank's privacy policy.

In the case of any joint application, by applying in joint names you will create a financial association with each other.

Where permitted in our legitimate interest to market our services or with your prior consent where required by law, we and BEA Group may also wish to provide you with information about special features of our Website or any other products or services we think may be of interest to you. If you would rather not receive this information, please write to us at our address provided below, you can contact us at one of our branches or send us a message via our online form.


Information we collect about you


We may use the information we collect about you to ensure in our legitimate interests (where we have considered these are not overridden by your rights) that:


  • we deliver the services effectively and for internal operations, including technical administration, troubleshooting, data analysis, testing, research and statistical; and
  • we provide you with a better experience, to improve the quality, value, functionality and general user friendliness of the Website, and as part of our efforts to keep the services safe and secure.


You can see a summary of which data we process for what purposes and the lawful basis for such processing (please refer to Annex 1).


Who we give your information to


We may use other members of the BEA Group, service providers and/or agents in another country to provide services on our behalf which may include the processing of your personal information. We may also share your personal information with other appropriate third parties including:


  • our business partners, customers, suppliers and sub-contractors for the performance of any contract we enter into or other dealings we have in the normal course of business with you; our auditors, legal advisors and other professional advisors or service providers including solicitors and valuers acting for the Bank, debt recovery agents, letting agents, insurers and providers of information technology services;
  • any actual or proposed assignee of the Bank or participant or sub-participant or transferee of the Bank’s rights;
  • credit reference agencies for the purpose of assessing your credit score where this is in the context of us entering into a contract with you;
  • information or documentation relating to mortgage /loan accounts (and any additional loans) to any guarantors while they remain liable on their guarantees;
  • where we are required by law and by law enforcement agencies, judicial bodies, government entities, tax authorities or regulatory bodies around the world (including the Financial Conduct Authority and the Prudential Regulation Authority) for the purpose of monitoring compliance with any regulatory rules and to the Financial Ombudsman Service for the purpose of complaints investigation;
  • other banks and third parties to confirm payee details in connection with the confirmation of payee service; and
  • to LexisNexis Risk Solutions for the purpose of development and maintenance of the LexisNexis® Digital Identity Network (DIN) used for the detection, investigation and prevent of fraud and other financial crime. The DIN collects and processes intelligence from millions of daily consumer interactions including logins, payments and new account applications. For more information, please refer to LexisNexis Risk Solutions ThreatMetrix Processing Notice available at: https://risk.lexisnexis.com/corporate/processing-notices/threatmetrix.


We will treat your personal information as private and confidential (even if you are no longer a customer) and we will not disclose any such information outside of BEA Group, service providers and/or agents (to provide services on our behalf) other than in the exceptional cases permitted by law specified below.


We will disclose your personal information only in the following exceptional cases permitted by law:


  • where we are required or legally compelled to disclose, or to apply our Website Terms of Use and other agreements;
  • where there is a duty to the public to disclose; where our legitimate interests or the legitimate interests of third parties (where we have considered these are not overridden by your rights) requires disclosure (e.g. to detect, investigate or prevent fraud or for confirmation of payee), but this will not be used as a reason for disclosing information about you or your accounts to anyone else, including other companies in our group, for marketing purposes;
  • where disclosure is made at your request or with your explicit consent; and
  • where we have a legitimate interest (where we have considered these are not overridden by your rights) in transferring it to any member of BEA Group.

We may give information about the debts that you owe us to Credit Reference Agencies ("CRA") if:


  • you have fallen behind with your payments;
  • the amount owed is not in dispute; or
  • you have not made satisfactory proposals to us for repaying your debt, following our formal demand.

In these cases, we will give you at least 28 days' notice that we plan to give such information. At the same time, we will explain to you the role of a CRA and the effect the information they provide can have on your ability to obtain credit.


Other disclosures we may make


We will disclose your personal information to third parties:


  • in the event that we sell or buy any business or assets, in which case we will disclose your personal information to the prospective seller or buyer of such business or assets subject to the terms of this privacy policy;
  • if the Bank or substantially all of its assets are acquired by a third party, in which case personal information held by it about its customers will be one of the transferred assets;
  • if we are under a duty to disclose or share your personal information in order to comply with any legal obligation, or in order to enforce or apply our terms of supply terms and other agreements with you or the company you work for; or to protect the rights, property, or safety of the Bank, our customers, or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction and to prevent cybercrime.


How we protect your information


We follow strict standards of security and confidentiality to protect any personal information you provide to us. To safeguard your use of our online services, we use encryption when transmitting your information between your browser and BEAUK.


Unfortunately, the transmission of information via the internet is not completely secure. While we do our best to protect your personal information, we cannot guarantee the security of your information transmitted to us over the email or through the Website; any such transmission is at your own risk.


How long we keep your information


Account holders

We retain personal information for as long as you have an account with us in order to meet our contractual obligations to you and for seven years after that to identify any issues, resolve any legal proceedings and to comply with legal or regulatory requirements.


Individuals that do not have an account

If you provide us with your personal data but decide not to open an account with us or use our services, or are a Website user but do not have an account with us, we will retain your information for two years after our last contact with you or for a period required to comply with any legal, regulatory or legitimate requirements. We may also retain aggregate information beyond this time for research purposes and to help us develop and improve our services. You cannot be identified from aggregate information retained or used for these purposes.


Your rights


You have a number of rights in relation to how we process your personal information in certain circumstances. These include:


  • the right to access the personal information that we may hold about you;
  • the right to rectify any inaccurate personal information that we may hold about you;
  • the right to have your personal information erased in certain circumstances, for example, where it is no longer necessary for us to process your personal information to fulfil our processing purposes; or where you have exercised your right to object to the processing;
  • the right to restrict the processing of your personal information where, for example, the information is inaccurate or it is no longer necessary for us to process such information or where you have exercised your right to object to our processing;
  • the right to object to the processing of your personal information which may be exercised in certain circumstances, for example, where we are processing your personal information for direct marketing purposes, or where your own legitimate interests outweigh ours;
  • the right to have your data ported to a new service provider if you no longer wish to use the services; and
  • the right to withdraw your consent without detriment at any time where we are relying on consent as the lawful basis for the processing of your personal information.


You may exercise these rights by contacting us using the details provided at the end of this Privacy Notice. If your request or concern is not satisfactorily resolved by us, you may approach your local data protection authority, (see https://ec.europa.eu/info/law/law-topic/data-protection_en). The Information Commissioner is the supervisory authority in the UK and can provide further information about your rights and our obligations in relation to your personal information, as well as deal with any complaints that you have about our processing of your personal information.

 

No fee usually required


You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.


What we may need from you


We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal information (or to exercise any of your other rights). This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.


Time limit to respond


We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.


Changes to our Privacy Notice


We may make changes to this Privacy Notice at any time. The most updated version of this Privacy Notice will always be posted on this webpage. We recommend that you revisit this page regularly in order to remain up to date on our policy.


Links to other websites


Our Website contains hyperlinks to other websites. It does not mean that we endorse their contents. We recommend you read the Privacy Notice on any external websites you visit. We have no control over external websites and therefore are not liable for your use of them.


Where we store your personal information


The data that we collect from you will be transferred to, and stored at, a destination within the United Kingdom or the European Economic Area ("EEA"). We will take all steps reasonably necessary to ensure that your personal information is treated securely and in accordance with this Privacy Notice.

Owing to the global nature of the internet infrastructure, the information you provide may be transferred in transit to countries outside the EEA that do not have similar protections in place regarding your data and its use as set out in this Privacy Notice. These include Hong Kong and the rest of Greater China, Singapore, Malaysia and the United States. If this occurs, we will ensure that adequate procedures are put in place to protect your personal information, including the use of European Commission approved standard contractual clauses and other supplemental measures.

In circumstances where we transfer your personal information to a BEA Group member, service provider or agent, we will ensure that the BEA Group member, service provider or agent will apply the same levels of protection as we are required to apply to information held in the UK, by implementing appropriate safeguards such as the European Commission approved model clauses.


Cookies


We use cookies to distinguish you from other users of the Website. This helps us to provide you with a smooth experience when you visit the Website, and also allows us to improve the Website. A cookie is a small text file that can be placed on your computer or other device when using the Website.

What do we use cookies for

The cookies on this Website may be from any of two categories:

  1. Strictly Necessary cookies - these cookies are used for technical reasons and are necessary to enable the Website to operate efficiently so that you can navigate the Website with ease and use specific features. These include, for example, cookies that help us to debug any errors. If these cookies are blocked or disabled, some of the Website may not operate effectively.
  2. Functionality cookies - these cookies are used to improve the functionality of the Website and make it easier to use. They help us to identify you as a repeat user of the Website and help us remember your preferences (for example, your choice of language or region), improving your user experience.


How do I control my cookie settings on my computer or device

Please be aware that if you decide to disable or block cookies, parts of the Website may not function correctly, or at all.


Should you choose however to disable or block our cookies on your computer or other device you will need to do this through your browser. Click on the 'Help' menu on your particular browser to learn how to manage your cookie preferences. Alternatively, you can visit www.aboutcookies.org or www.youronlinechoices.eu for comprehensive information on how to manage cookies.

For more details on the types of cookies we use on our Website, please see: https://www.hkbea.co.uk/html/en/cookie-information.html.


How to contact us


You must notify us of any changes to your details as soon as possible to safeguard the security of your information. We may request documentary evidence to support the changes. You should notify us of any change by writing to the address below.


We welcome your views about our Website and our Privacy Notice. If you would like to contact us with any queries or comments, please email:

DPO@hkbea.co.uk


Alternatively, you may write to:


Data Protection Officer
The Bank of East Asia, Limited, London Branch
75 Shaftesbury Avenue
London W1D 5BB

Should you have any concerns about how we handle your personal information, please contact us in the first instance. We will do our best to resolve your concern. For further information about your rights, or to make a direct complaint, please contact the Information Commissioner’s Office.