Hong Kong International Airport SkyBiz

For the purpose of this Specific Terms, “Services” means any services provided on and/or in connection with the HKIA SkyBiz web portal platform (including but not limited to creating and managing your membership account, providing various member-exclusive activities and interactions, providing news / information on the services, facilities and activities provided at or in connection with the Hong Kong International Airport).

2.1 When you register an account with us under HKIA SkyBiz, we will collect the following personal data: (a) Your full name (compulsory); (b) Your email address (compulsory); (c) Your company name (compulsory); (d) Your company address (optional); (e) Your job area (compulsory); (f) Your business title (compulsory); (g) Your region and city (compulsory); (h) Referral code (if any) (optional); and

2.2 When you redeem any physical gifts, rewards or items under the relevant promotional campaign or programme , we will also collect the following personal data: (a) Delivery address (compulsory); (b) Phone number (compulsory).

3.1We may use your personal data collected for the following purposes: (a) To provide the Services to you; (b) To verify your eligibility to register for an account; (c) To verify your eligibility to redeem any membership points or gifts in accordance with the terms of the relevant promotional campaign or programme; (d) To deliver to you any gifts, rewards or items redeemed by you under the relevant promotional campaign or programme; (e) To send you notifications, communications, newsletters and other messages relating to the information and updates about the Hong Kong International Airport, including but not limited to trade events, sales campaigns, promotional offers in connection with services or facilities of Hong Kong International Airport; and (f) To contact you for and/or carry out direct marketing activities in connection with the service or facilities of Hong Kong International Airport.

In order for us to carry out any direct marketing activities in connection with the services or facilities provided at the Hong Kong International Airport, we will seek your consent (as necessary) at the time when we collect your relevant personal data.

It is voluntary for you to use HKIA SkyBiz and provide the personal data as described above.

If you do not provide the personal data as required or designated as compulsory, this means that you may not be able to register for an account and/or use the Services, and your personal data will not be collected or retained by us.

We may use your personal data for direct marketing purposes, but we will not do so unless we have separately obtained your express consent.

With your consent, we may use your personal profile information, contact details and location data for carrying out direct marketing activities, including by contacting you via your registered email to promote the services or facilities at Hong Kong International Airport.

You may withdraw your consent to receive direct marketing materials from us through such channels as we may announce from time to time at no cost to you.

Please note that if you choose to withdraw your consent to receive marketing communications, we will still send you communications about your account or other services we provide to you. As a registered account holder, you will continue to receive administrative communications and updates to our Services.

Our general data retention policy is set out under “How long do we retain your personal data?” section of the General Terms.

We will only retain any personal data which we can use to directly identify you for as long as it is necessary to fulfil the Purposes, and we will delete the same after a reasonable period for verification and audit purposes.

In the event that you choose to delete your account with us, we will delete such personal data as soon as reasonably practicable after we receive such notification from you.

7.1 Other than the classes of transferees to whom we may transfer your personal data to mentioned elsewhere in this Policy, for HKIA SkyBiz, we may send your personal information to the following classes of transferees: (a) service providers such as system developers and cloud service providers for administration and maintenance of the SkyBiz web portal and storage of data respectively.

Your personal data may be transferred to and processed in Hong Kong and any other jurisdictions outside your place of residence.

9.1 This Addendum to the Specific Terms for HKIA SkyBiz applies to you if you are an individual in Chinese Mainland. The terms set out in this Addendum are in addition to the terms set out in the Specific Terms for HKIA SkyBiz, the General Terms and Pledge Statement (collectively the “Service Privacy Policy”) and therefore form an integral part of the Service Privacy Policy. In the event of any conflict or inconsistency between the Service Privacy Policy and the terms of this Addendum, this Addendum shall govern and prevail.

9.2 Before you access or user the Services provided by us, please carefully read and fully understand the terms of the Service Privacy Policy. We may update the Service Privacy Policy from time to time, and when we update the Service Privacy Policy, we will notify you through appropriate means as required by law.

10.1 According to applicable data protection laws and regulations in Chinese Mainland, we process your personal information based on one of the following legal bases: (a) Based on your consent; (b) Necessary for entering into or performing a contract to which you are a contracting party; (c) Necessary for the performance of our statutory duties or obligations; (d) Necessary for responding to a public health emergency, or for protecting the life, health or property safety of the natural person in the case of an emergency; (e) In accordance with the law, to a reasonable extent, processing your personal information that has been disclosed by you or otherwise legally disclosed; (f) Other scenarios stipulated by laws and regulations.

In order to achieve the purposes outlined in the Service Privacy Policy, we entrust third-party service providers to assist us in providing relevant operational and service support. We may send your personal information to such service providers (e.g., system developers and cloud service providers). For companies, organisations and individuals who we entrust to process your personal information, we require them to handle your personal information in accordance with our instructions, the Service Privacy Policy and applicable laws.

We may provide your personal information with other personal information handlers for the purposes of providing our Services to you and otherwise for legal and administrative purposes.

12.1 Apart from the rights specified in the Service Privacy Policy, you are conferred by the applicable data protection laws and regulations in Chinese Mainland with additional data subject rights as follows.

(a) the right to know and the right to decide on the processing of your personal information; (b) the right to restrict or refuse the processing of your personal information by others; (c) the right to consult and duplicate your personal information; (d) the right to request personal information handlers to correct or supplement your personal information if you discover the information is incorrect or incomplete; (e) the right to withdraw your consent to the processing of personal information based on your consent (but please note that your withdrawal of consent does not affect the validity of the processing of personal information that has been carried out based on your consent before the withdrawal); (f) the right to request the transfer of personal information to your designated personal information handlers (but please note that this right can only be exercised in certain circumstances as provided by the laws of Chinese Mainland, i.e., (i) your identity can be verified as authentic; (ii) the personal information requested for transfer is the one that you consented to provide or that was collected based on a contract; (iii) the transfer of personal information is technically feasible; and (iv) the transfer of personal information does not harm the legitimate rights and interests of others, and if the number of your requests significantly exceeds a reasonable range, we may charge necessary fees based on the costs of transferring personal information); (g) the right to delete your personal information under specific circumstances; (h) the right to request us to stop using your personal information for direct marketing purposes; (i) the right to request us to explain our processing rules for personal information; and (j) the right not to be subjected to automated decision-making, including profiling, which produces a significant impact on your personal interest. If you believe you have been subject to such an automated decision and do not agree with the outcome, please contact us using the contact details provided in “Contact Us” and ask us to explain, and you also have the right to refuse the decisions made only through automated decision-making methods.

If you want to exercise any of these rights, you can contact us using the contact details provided in “Contact Us” section below. To protect the security of your personal information, we may need to verify your identity before responding to your request(s), and we may not be able to respond to the request(s) for rights related to personal information that are not from you or authorised by you (for example, requests to consult personal information of someone else).

Additionally, the rights listed above are subject to limitations and exceptions under applicable law. For example, regarding your right to deletion, if the retention period prescribed by laws or administrative regulations has not expired, or it is technically difficult to delete the personal information, we will cease the processing of personal information, except for the storage and any necessary measure taken for security protection.

12.2 We will respond to your requests of exercising your data subject rights in accordance with the applicable data protection laws and regulations in Chinese Mainland. Having said that, to the extent as permitted by laws and regulations, we may not be able to respond to your request of exercising your rights in the following circumstances: a) If your request is contrary to our obligations under laws and regulations; b) If the requested data is directly related to national security or national defense security; c) If the requested data is directly related to public safety, public health, or significant public interest; d) If the requested data is directly related to criminal investigations, prosecutions, trials and enforcement of judgments, etc.; e) If we have sufficient evidence of your subjective malice or abuse of rights; f) If it is in the interest of safeguarding your or other individuals’ significant legitimate rights and interests, such as life and property, but it is difficult to obtain your authorization or consent; g) If responding to your request to exercise your rights would result in serious harm to your or other individuals’ or organizations’ legitimate interests; h) If the requested data involves trade secrets.

If you have unresolved concerns, you also have the right to lodge a complaint with the relevant supervisory authorities or where applicable, file a lawsuit with the court in accordance with applicable law.

As our business primarily operates in Hong Kong, we provide products and services through resources located in Hong Kong. This means that, with your authorised consent, your personal information may be transferred to or accessed from jurisdictions outside Chinese Mainland when you use the Services. We only transfer your personal information to Hong Kong to the extent necessary to provide our Services to you. For any transfer of your personal information outside your jurisdiction, we will comply with applicable laws and have implemented security safeguards to ensure that all such transfers meet the requirements of the applicable data protection laws and regulations in Chinese Mainland.

Airport Authority Hong Kong, as an organisation located in Hong Kong, acts as an overseas recipient that receives and processes your personal information. We process your personal information in accordance with the purposes and methods outlined in the Service Privacy Policy, and the categories of personal information to be transferred have been disclosed within this Service Privacy Policy.

14.1 Personal Data Handler & Overseas Recipient: Airport Authority Hong Kong

14.2 Address: HKIA Tower, 1 Sky Plaza Road, Hong Kong International Airport, Lantau Island, Hong Kong

14.3 Contact person: General Personal Data Officer

14.4 Email: prcdataprivacy@hkairport.com