HK Express Customer Privacy Policy - Mainland China

At HK Express, we are committed to protecting your Personal Information and your privacy. To ensure that you can make informed decisions and feel confident about sharing certain Personal Information with us, please read this Privacy Policy to understand whom we share your Personal Information with and for what purposes, and the choices you have concerning how your Personal Information is collected and used by us. We may also provide further privacy collection notices highlighting certain uses of your Personal Information, together with the ability to opt in or out of certain uses, when we collect Personal Information from you.

We will notify you of any changes to our Privacy Policy, including by posting the revised policy on our website at www.hkexpress.com (“Website”), and/or other means of contact such as email. The changes will be effective from the date of posting.

By visiting our Website, using its services, or otherwise interacting with us, you acknowledge that you have read and understood this Privacy Policy and agree that we may collect, use, store, transmit and disclose your Personal Information in accordance with this Privacy Policy.

Personal Information means any type of information (recorded via electronic means or otherwise) associated with an identified or identifiable natural person, excluding information after anonymisation handling. Personal Information may include Sensitive Personal Information.

Sensitive Personal Information refers to Personal Information that, once leaked or illegally used, is likely to lead to the violation of the personal dignity of natural persons or harm to personal and property safety, including biometric identification, religious belief, specific identity, medical and health care, financial accounts, whereabouts and track, as well as the Personal Information of minors under 14 years of age. In this Privacy Policy, Sensitive Personal Information is in bold and underlined to draw your attention.

2.1 We will collect and process some or all of the following Personal Information about you where necessary:

(a) Information about you

Your Personal Information such as your full name, salutation, gender, date of birth and nationality, travel document details (including passport number, passport expiry date, country that issued your passport and your country of residence (collectively also known as “Advanced Passenger Information” (API))), your contact details, your parents’/guardian’s names and contact details, address, and photographs and other images

(b) Your payment details

Payment details used to purchase our products and services such as credit or debit card numbers and expiry dates, account information relating to other payment services (such as online or mobile payment services or virtual currency), and other general billing information;

(c) Information we collect in relation to your travel

Information about your travel arrangements such as your booking reference, travel itinerary, flight details, hotel selection, your choice of tours, car rentals or other add-ons to your travel package, details of your travel companions or persons assisting you, your activity at airport departure and arrival halls, your redemption group members, seat and meal preferences, your emergency contacts and any information relating to any special assistance that you require (such as dietary requirements,  health or medical needs that you would like us to know about;

(d) Information about your memberships and transactions

Information about your loyalty programme membership (including travel partner programme affiliations) with us and/or any of our subsidiaries, associated companies and/or business partners, including our affiliate Cathay Pacific Airways Limited (“Cathay Pacific”)’s loyalty programme (“Cathay Membership Programme”);

(e) Information about your use of our products and services

Information such as previous travel arrangements, feedback about your experiences, details of lost luggage and other claims, your use of our inflight facilities, and your purchase of our duty-free products and branded items;

(f) Your interests, preferences and opinions

Information that we collect about your interests, preferences, and opinions such as your hobbies, your language preference, destinations you are interested in, and products and services you have bought;

(g) Our interactions with you

A record of any interactions and correspondence between us such as calls made through our call centre, any interactions you have with our staff or representatives (including whilst on board our flights) and any interactions with us on our Website, mobile applications, social media platforms and/or other communication or advertising channels;

(h) Survey information

Your responses to surveys and contests conducted by us or on our behalf;

(i) Your use of our Website, mobile applications, social media platforms and other communication or advertising channels

Details of your visits to our Website, your use of our mobile applications, social media platforms and other communication or advertising channels, and other information collected through cookies and other tracking technology (including the information that you look at, such as your cookies, device ID, geolocation, login ID and web/behavioural tracking). We may also collect information about you that is publicly available online, including your social media profiles;

(j) Employment and company information

If you are an employee or other person travelling or obtaining products or services in relation to our corporate/business travel services or one of our corporate or government clients, we will collect certain information about your employment, company information or relationship with our corporate or government clients such as your company’s or employer’s name, your professional title, and your work contact information; and

(k) Sensitive Personal Information

We will collect and handle Sensitive Personal Information, for example, your passport identity information, your credit or debit card information, information of your minor children or dependents or when we handle requests for special medical or access assistance or your specific dietary requirements that may indicate your religious beliefs and health issues. We will ask you for your separate consent when collecting and handling your Sensitive Personal Information.

2.2 Certain Personal Information (particularly details of your travel documentation, payment details, and contact information) are required for many of our products and services and if you fail to supply such Personal Information as requested for specific services, we may be unable to deliver you the products and services in full.

3.1 We will collect some Personal Information from you directly. We will collect other Personal Information from third parties including:

(a) travel agents (including corporate travel managers) and other persons that make bookings or otherwise interact with us on your behalf;

(b) our service providers and agents such as our ground handling agents who assist you with check-in and boarding or our call centre agents who provide customer service;

(c) third parties such as other airlines, providers of other travel-related services with whom we partner to provide you with goods, services or offers based upon your experiences or that we believe will be of interest to you (“Strategic Business Partners”). Examples of Strategic Business Partners include travel and tour partners, time share partners, rental car providers, and travel booking platforms. Strategic Business Partners are independent from HK Express;

(d) our third party marketing partners;

(e) operators of our partner loyalty programmes such as Cathay Membership Programme;

(f) organisations which conduct credit, fraud, and other passenger checks;

(g) immigration, customs, border security and law enforcement bodies, airport authorities and other government or regulatory bodies; and

(h) providers of third party websites, mobile applications, social media platforms and other communication or advertising channels.

3.2 If you provide us with information about other individuals, you must tell those individuals and let them know where they can find a copy of this Privacy Policy, and obtain their lawful consent if required under applicable laws.

3.3 Your Personal Information may be accessed, transferred and/or stored outside of the PRC by staff or suppliers.

4.1 We may collect, store, and use your Personal Information to provide our service and products to you, or to improve our services. Below we have listed the purposes for which we process your Personal Information and the types of Personal Information corresponding to each purpose:

(a) Ticketing and itinerary management

When you purchase a ticket through our online platforms, we will collect the passenger’s name, title, mobile number, fare type, email address, membership number, departure location, travel destination, travel category (round trip/single trip), flight number, flight time, seat number, and payment information (credit or debit card information, payment record). The above information is necessary to complete the purchase of tickets, and will be used to identify and verify your identity, to handle travel and service arrangements for you, to contact you and send you communication information about the services, and to provide you with travel packages or requested services, if you do not provide such information, you will not be able to purchase tickets and enjoy subsequent services.

In addition, we will continue to use the above information when you, through our online platforms, change your ticket, refund your ticket, pre-check in, and manage your trip. In order to provide you with a better travel service, we may also collect information about your lost baggage and other claims, your use of inflight facilities, as well as your purchase of duty-free products and brand product information.

If you book the flight ticket on our online platforms on behalf of other passengers, you are required to submit these passengers’ name and contact information. You should ensure that you have obtained such passengers’ consent on providing their Personal Information to us before booking the flight ticket.

(b) Member registration and login

When you register as a member through our online platforms, we will collect your name, title, mobile number, date of birth, email address, and the password you set. The above information is necessary for the completion of membership registration and is also necessary for us to provide membership services for you. If you do not provide such information, you will not be able to register as a member.

In addition, you may choose to provide us with your mailing address, country or territory of residence, travel documents (including passport number, passport validity date, country/territory of issue and country/territory of residence), emergency contacts, associated accounts under the Cathay Membership Programme, seat and meal preferences, so that we can provide you with better service and experience. However, even if you do not provide this information, it will not affect your membership and access to the corresponding basic services.

When you log in to our online services, we require you to enter your mobile number (or email/membership number/username) and password, or complete the login through an associated account. This information is necessary to complete the login. If you do not provide this information, you will not be able to successfully log in.

(c) Operate and facilitate your participation in our partner loyalty programmes

Where you are a member of our partner loyalty programmes including the Cathay Membership Programme, we will use Personal Information that we collect about you for the operations of the programmes (such as processing your membership application and to ensure that you get the benefit of the partner loyalty programmes, including to track your earning and claiming of club points, your accrual and redemption activities, and record your mileage credits (where applicable)). If you are a member of the Cathay Membership Programme and where we have your consent to do so, we will also disclose your Personal Information to our affiliate Cathay Pacific so they can send you details of any offers or promotions in connection with your travels with us, which may be of interest to you

(d) Your interactions with us

You may voluntarily provide us with your Personal Information when you send an email, make a call to our call centre, interact with our online platforms’ features, interact with our employees or representatives (including on our flights), and interact with us on our Website, mobile applications, social media platforms and/or other communication or advertising channels or with posts that mention us, to ensure that we are able to confirm your identity and respond to your needs (including baggage claims, flight delays, etc.). Such Personal Information includes name, title, email address, mobile phone number and service-related information (such as itinerary information and information about other products and/or services). If necessary, we may also request you to provide other Personal Information with your consent.

(e) Activities and Marketing

You may participate in our online or offline activities, some of which may require you to submit your Personal Information, such as your name, title, email address, mobile phone number, membership number, etc. The specific Personal Information collection is subject to the relevant instructions on our activity page.

With your consent, we may use your Personal Information for marketing and promotional purposes, including (i) sending you the latest news about our products and services (and the products and services of our Cathay Pacific Group companies), offers and promotions; (ii) sending you joint marketing activities regarding our travel services and packages, membership programmes, contests and raffles, tax-free sales, and ancillary services such as travel insurance, hotel transfers, and car rentals; or (iii) customising and tracking your interactions with Internet banner ads and links from third-party sites to our sites.

We may send you marketing, promotional and research activities by mail, telephone or online (including via email, SMS, social media platform and/or other communication or advertising channels) and, where appropriate and necessary, we will ask for your consent to collect your information or give you the option to opt out of receiving marketing materials. We will provide the option to unsubscribe or stop receiving newsletters within any direct communications we send to you (you can contact us using the contact information provided in section 9 below). If you choose to unsubscribe or stop receiving marketing materials, we will still send you information about your HK Express flight and any other services information we provide. If you are a Cathay Membership Programme member, you will continue to receive account summaries and updates on Cathay Pacific’s services.

(f) Survey Statistics

In order to improve our products and/or services, we may conduct market research to collect, through cookies and tracking technology, details of your visit to our online platforms, use of our Website, mobile applications, social media platforms and/or other communication or advertising channels, including information you see.

With your consent, we may also use your Personal Information to analyse market trends. This may integrate the Personal Information we have about your use of our services with the information we collect about your network usage. We may also combine the information we collect about you with information we collect about other customers to gain these insights and identify market trends.

(g) To comply with our legal obligations and for legal and administrative purposes

In order to fulfil the obligations stipulated by laws and regulations and ensure the security and compliance of the online and offline services we provide, we may collect your name, bank card information, passport information, and web log information for following purposes: (1) identifying verification and payment processing; (2) detecting fraud; (3) detecting misuse of reservations, money laundering and other criminal or illegal activities; (4) accounting, billing and audit purposes; (5) developing, maintaining and testing our systems; (6) processing of claims; (7) emergency response to ensure the safety and security of all our staff and passengers; and (8) understanding, exercising, enforcing or protecting our legal rights and those of others.

4.2 Legal grounds for processing of Personal Information

In accordance with the applicable laws and regulations, we may process your Personal Information based on one of the following legal bases:

• Based on your consent;
• Necessary for entering into or performing a contract with you;
• Necessary for the performance of our statutory duties or obligations;
• Necessary to respond to public health emergencies or to protect the life, health and property safety of natural persons in emergency situations;
• Conduct news reporting, public opinion supervision and other activities for the public interest, and process Personal Information within a reasonable scope;
• In accordance with the law, to a reasonable extent, process your own or other Personal Information that has been disclosed legally;
• Other scenarios stipulated by laws and regulations.

We will, on the basis of the above legal bases, process the Personal Information we collect in accordance with the terms and conditions of this Privacy Policy and for purposes necessary to provide our products and/or our services.

HK Express is committed to ensuring the protection of children’s Personal Information. According to local laws and regulations, we consider an individual to be a child if they are under the age of 14. Children are not allowed to create accounts under our membership programme and / or purchase tickets without parental or guardian consent. If we find that we have collected Personal Information of children without parental or guardian consent, we will delete that data as soon as possible. For more information about our processing of children’s Personal Information, please read the Children Privacy Notice. If you have concerns about your child’s privacy, or if you believe that your child may have entered Personal Information without parental or guardian consent, please contact us using our contact details as stated in section 9 of this Privacy Policy.

In certain circumstances, we will disclose your Personal Information to third parties as described below. You can find a list of the third parties to whom we may transfer the Personal Information in the PRC: List of Third Parties in Mainland China.

6.1 Our service providers and members of the Cathay Pacific group who process Personal Information on our behalf for the purposes described in section 4

We will permit our third-party service providers, including agents, contractors and other partners, our affiliates, subsidiaries and other Cathay Pacific group companies, to use your Personal Information on our behalf for the purposes set out in section 4. Examples of such third parties include our ground handling agents who assist you with check-in and boarding, our airport lounge operators, operators of our IT systems and call centre agents. We may also disclose your Personal Information to third parties in order to facilitate any special arrangements that you may have requested, such as liaising with airport authorities to arrange wheelchair assistance or our catering providers to accommodate any special meal requests.

6.2 Third parties such as other airlines, hotel partners, travel operators and travel agents in order to facilitate and administer your travel arrangements

In order to facilitate and administer your travel arrangements, we may transfer your Personal Information to third parties such as other airlines (including our partner and codeshare airlines in the context of codeshare and interline arrangements where we are the marketing carrier), hotel partners, land or sea transport operators, as well as to travel agents or other persons who interact with us on your behalf. Your Personal Information will be used by such third parties in accordance with their privacy policies. The privacy policies of our interline and codeshare partner airlines can be found in the International Air Transport Association (“IATA”) privacy policy repository at http://www.iatatravelcenter.com/privacy. For others, please visit the third parties’ website for more details.

6.3 Our third-party partners for marketing purposes

To the extent permissible under applicable data protection laws, we may disclose your Personal Information to third parties so they can provide marketing services or conduct marketing or social interaction activities on our behalf (such as campaigns, contests, sweepstakes, market research, customer surveys and data analytics) to help us improve and tailor our marketing activities, products, and services. Subject to us having obtained appropriate consent from you, we may also disclose your Personal Information to our third-party marketing partners in order that they may market their products and services to you. If you are a member of Cathay Membership Programme, we will also share your Personal Information with Cathay Pacific for the above purposes, as well as to enable Cathay Pacific to combine your Personal Information with the Personal Information they hold about you.

6.4 Our Partner Loyalty Programmes

We may transfer your Personal Information to Cathay Pacific, or to operators of our partner loyalty programmes, to facilitate your participation in the relevant programmes.

6.5 Our corporate or government clients

For employees or other persons travelling or obtaining products or services in relation to one of our corporate or government clients, we will disclose your travel details and information concerning your use of our service to our corporate or government clients.

6.6 Government and regulatory bodies and other individuals, bodies, and organisations (for example immigration, customs, border security, regulators, and the police) for the purposes of complying with our legal obligations, for reasons of safety and security, to enable us to provide our products and services to you and otherwise for legal and administrative purposes.

We may disclose your Personal Information to governments and regulatory authorities and bodies and to other individuals, bodies and organisations such as immigration, customs, border security, airport authorities, dispute resolution, prosecution and law enforcement bodies, legal advisers, organisations which conduct credit, fraud and other passenger checks, and other individuals, bodies and organisations for the purposes of complying with our legal obligations, for example, where we are required by laws in the United States, European Union member states and other countries to disclose your Personal Information in relation to your travel document, booking details, and flight itinerary (also known as Passenger Name Record (PNR) and/or Advanced Passenger Information (API)) to relevant customs and immigration authorities as required by laws. We may also disclose your Personal Information to such individuals, bodies, and organisations for reasons of safety and security, to enable us to provide our products and services to you and otherwise for legal and administrative purposes.

7.1 Subject to your consent, we may use Personal Information for marketing and promotional purposes, including: (i) for sending or showing you updates on latest news, offers and promotions in connection with our products and services (and the products and services of our group companies such as Cathay Pacific and third parties) (ii) for sending or showing you joint marketing offers about our travel services and packages, loyalty programmes, contests and sweepstakes, duty-free sales and ancillary services such as travel insurance, hotel transfers and car rentals; or (iii) for tailoring and tracking your interactions with content on our Website, mobile applications, social media platforms and other communication or advertising channels (including banner advertisement and links) and from third-party websites to our Website, mobile applications, and social media.

7.2 Subject to your consent, we may also use Personal Information to analyse our customers’ preferences and market trends and derive insights, which we may use to tailor the types of products and offers that we present to you. This may involve us combining Personal Information that we hold about your use of our services with information that we have collected about your web usage. We may also combine information that we have collected about you with information that we have collected about our other customers in order to derive these insights and establish market trends. We may provide these insights to our third-party partners and Cathay Pacific pursuant to the Cathay Membership Programme for their marketing and promotional purposes. We also use advertising services and products provided by third party service providers (such as marketing agencies and social media platforms) for marketing and promotional purposes, which may involve us sharing Personal Information that we hold about you with them.

7.3 We may communicate marketing, promotions, and research invitations to you by post, telephone, or online (including by email or through your mobile device or via online banner advertisement) and, as appropriate and where required, we will ask you for your consent, or otherwise provide you with the opportunity to choose not to receive marketing, at the time we collect your data.

7.4 You do, however, have the right to unsubscribe or opt out of receiving marketing communications at any time. We will provide an option to unsubscribe or opt out of further communication on any direct marketing communication sent to you. You may also opt out by contacting us as set out in Chapter 9 below.

7.5 Please note that if you choose to unsubscribe or opt out of marketing communication, we will still send you communications about your travel with us and any other services that we provide to you.

8.1 IT Security

We have put in place appropriate security measures to prevent your Personal Information from being accidentally lost, used, altered, disclosed or accessed in an unauthorised way.  We make sure the technical and organisational measures taken provide a level of security appropriate to the risks involved in the processing undertaken and the nature of the Personal Information involved in accordance with the requirements of applicable data protection laws.

All Personal Information we collect about you is stored on our or our subcontractors’ secure servers. We comply with our security policies and standards when accessing or using this information and restrict access to your Personal Information to those persons who need to use it for the purpose(s) for which it was collected. You are responsible for keeping any information that we send to you confidential and for complying with any other security procedures that we notify you of. In particular, where we have given you (or where you have chosen) a password which enables you to access certain parts of our Website or mobile applications, we ask you not to share a password with anyone.

8.2 Exporting your Personal Information

We may be required to export your Personal Information to jurisdictions located outside of the PRC. Where we transfer your Personal Information abroad, we ensure that appropriate safeguards are in place and that the transfer is conducted in compliance with applicable laws and regulations.

As an entity headquartered in Hong Kong, we are an overseas recipient which receives and processes your Personal Information. We process your Personal Information within the purposes and methods provided in this Privacy Policy and the categories of processed Personal Information have also been disclosed in this Privacy Policy.

Your Personal Information may also be provided by us to the following overseas entities or organisations (this list also disclose the purpose for which your Personal Information is processed): List of Third Parties in Mainland China.

8.3 Retention period

We will retain your Personal Information for the period necessary for the purpose of providing your products and services, except where otherwise required by law or regulation or where we have other legal basis, such as potential or pending litigation, contractual requirements, or legal retention requirements. After the above retention period expires, we will delete or anonymise your Personal Information.

9.1 General rights

You have the right to ask us to:

• provide you with access to your Personal Information and copies of certain Personal Information we hold about you;
• update or correct inaccurate and/or incomplete Personal Information about you;
• provide you with further details on how we use and process your Personal Information;
• delete Personal Information we no longer have grounds to process in certain circumstances permitted by law;
• terminate your account when you no longer use our services or products;

Please note that we will not charge a fee when we deal with your requests in the exercise of the above rights.

9.2 In addition, under certain conditions, you have the right to:

• where processing is based on consent, withdraw the consent; and
• object to direct marketing (including any profiling for such purposes) at any time.

9.3 Right to opt out of direct marketing

You have the right to ask us not to process your Personal Information for direct marketing purposes. You can exercise your right to prevent such processing by indicating that you do not consent to direct marketing at the point at which we collect your Personal Information. You can also exercise the right at any time after we have collected and used your Personal Information for direct marketing purposes by:

• following the opt-out instructions contained in the relevant communications; or
• by writing to our Data Protection Officer.
  
  

9.4 Right of access for deceased persons relatives

In the event of the death of a natural person, close relatives of the deceased person may, for their own lawful and legitimate interests, exercise the rights to request access, copy, correct, and delete the relevant Personal Information of the deceased, unless the deceased had otherwise arranged before his/her death.

9.5 Right to data portability

You have the right to request transfer of your Personal Information to designated Personal Information processors if the following conditions are met: (1) the transfer is technically feasible; (2) your request is reasonable and (3) the legal conditions specified by regulatory authority is satisfied. The Personal Information will be provided in a structured, commonly used, and machine-readable form.

9.6 Contact us

Customers requesting to exercise their rights or needing more information or clarification on our Personal Information usage are welcome to contact us at dpo@hkexpress.com or write to us at the below mailing addresses. We will respond to you as soon as practicable and in compliance with applicable laws and regulations.

The Data Protection Officer
Hong Kong Express Airways Limited
1st Floor, 11 Tung Fai Road,
Hong Kong International Airport, Lantau, Hong Kong

This Website contains links to other sites that are operated by third-party companies with different privacy practices. You should remain alert when you leave our site and read the privacy statements of other websites. We have no control over Personal Information that you submit to or receive from these third parties.