Emali Limited (“The Company”) is concerned with ensuring that all personal data collected through and held, processed, and used in “KeyPear” system are handled in strict adherence to the relevant provisions of the Personal Data (Privacy) Ordinance (Cap 486) (“the PD(P)O”).
When we collect personal data from individuals, we will provide them with a Personal Information Collection Statement (“PICS”) on or before the collection. The personal data will only be collected and used as stated in the PICS.
“KeyPear” will collect personal data from individuals of age 11-17 (“Minors”) when they register and use “KeyPear”. The personal data of a Minor will only be collected and used as stated in the PICS with prior consent of the parent/guardian of the Minor. Guardian here means the person who has parental responsibility for the Minor under the meaning of “Relevant Person” as defined in Section 2 of the Personal Data (Privacy) Ordinance (Cap. 486).
Statement of Practices
During registration of “KeyPear”, the types of personal data collected by the “KeyPear” system may include the email address, phone number, Hong Kong Identity Card (“HKIC”) number, English name, Chinese name, sex, date of birth, date of issue and image of the HKIC of the “KeyPear” applicants and the parents/guardians of the Minor applicants for processing the application and providing “KeyPear” services.
After successful registration and in the course of using “KeyPear”, personal data (e.g. system identifiers, usage data, etc.) may be generated and collected by the “KeyPear” system.
If the “KeyPear” user provides his/her personal data in a “Verifiable Credential” profile, all personal data provided will be collected by the “KeyPear” system for authentication and verification by peers. The personal data may include residential address, email address, phone number, etc. A user may, on a voluntary basis, provide or partially provide his/her personal data for the generation of a ‘verifiable credential’.
“KeyPear” may collect personal data from online service providers when providing “KeyPear” services to users, including but not limited to Digital Signing, verifiable credential issuance, and Personalised Notification.
“KeyPear” may collect personal particulars from enquirers / complainants, including name, contact number, email address and other information that may be provided in relation to the helpdesk services when handling enquiries/complaints received by phone, and email of “KeyPear” app and “KeyPear” website.
“Verifiable Credential” issuance is a function in “KeyPear” to facilitate online digital trust to allow for the verification and authentication of information in the “KeyPear” application.
Information Security and Privacy Protection
The Company adheres strictly to its policies and guidelines on information technology security as well as the PD(P)O, in areas such as data security, network and communication security, user access management, application system security, and security measures to protect personal data.
Personal data in the “KeyPear” system are encrypted using the prevailing internationally recognized Advanced Encryption Standard and stored in industry standard data center facilities.
Transport Layer Security is adopted to encrypt data to ensure data security and integrity during transmission over the internet.
The Company follows international standards ISO/IEC 27001 and ISO/IEC 27701 on information security management and privacy information management.
Data Breach Handling
The Company takes all reasonably practicable steps to ensure that the personal data held is protected against unauthorized or accidental access, processing, erasure, loss, or use.
In case of a data breach, notification will be given to the data subjects affected and relevant parties as soon as practicable.
Remedial actions will be taken to lessen harm or damage caused to data subjects.
The Company will inform the Office of the Privacy Commissioner for Personal Data of the data breach incident as appropriate.
Data Retention
The Company maintains and executes retention policies of records containing personal data in relation to “KeyPear”.
Personal data will not be kept longer than necessary for the fulfillment of the purpose for which the data is or is to be used, in accordance with statutory provisions.
Disclosure of Data
Except as stated in the PICS applicable to that user, or for exemptions under the PD(P)O, personal data will not be transmitted to any third parties without prior consent.
Exemptions include passing personal data to law enforcement agencies authorized to receive information relating to prevention or detection of crime.
“KeyPear” Website
The Company records visits to the “KeyPear” website without collecting personal data of users.
Information collected is used for statistical reports, diagnosing problems, and research to improve the website and services.
Cookies are stored in computers or mobile devices during browsing. If users do not accept cookies, certain functionality may not be available.
The “KeyPear” App
The app may access functions or data on a user’s device which may contain personal data or privacy information:
Camera function – Used to capture HKIC and selfie images during registration/account management and for QR code scanning.
Access to storage – Images captured are saved temporarily for processing and deleted after the operation.
Biometric authentication – Uses built-in device functions for authentication. “KeyPear” does not collect, store, or transfer biometric data.
Session cookies are used during login sessions and are deleted once the session is finished.
Usage data may be recorded for statistical reports, problem diagnosis, analysis, and app improvements.
Data Access and Correction
Data access requests should be made directly to the “KeyPear” Product Manager by email at [email protected].
The Company will check the identity of the requester to ensure entitlement to make the request.
A fee may be chargeable for data access requests. Requestors will be advised in advance.
Enquiries
Any enquiries regarding the privacy policy may be addressed to the “KeyPear” Product Manager via email at [email protected].
