CHARLTONS’ WEBSITE PRIVACY AND COOKIE POLICY

Charltons respects your privacy and is committed to protecting your personal data. Our privacy policy will inform you as to how we look after your personal data and your privacy rights. Our privacy policy aims to give you information on how Charltons collects and processes your personal data through your use of this website, including any data you may provide through this website when you subscribe to our newsletters, make an enquiry through the enquiry form or make a booking via Indemandly.

We use cookies on this website. Information on our cookie policy is set out below.

Charltons is the controller and responsible for your personal data (collectively referred to as “Charltons”, “we”, “us” or “our” in this privacy policy). Our contact details are below.

The data we collect

Personal data means any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

We may collect, use, store and transfer your personal data as follows:

• Newsletter Subscription: if you subscribe to our newsletter via our website, we ask for personal data (your name and email address);
• Enquiry Form: if you make an enquiry on our enquiry form webpage, we ask for personal data (person/company name, contact person, and contact person’s phone and email address);
• Indemandly: if you make a booking via Indemandly on our website, the Indemandly application asks for your personal data (first and last name, email address and phone number), which is transferred to us.

Legal grounds for use of personal data

We will only use your personal data when the law allows us to.

We rely on consent as a ground for processing your personal data. We only process your personal data for the specific purposes referred to below. You have the right to withdraw consent at any time by contacting us, or by unsubscribing to our newsletters (for personal data processed for newsletter subscription). This does not affect the lawfulness of processing based on consent before its withdrawal.

In relation to enquiries and bookings, we rely on our legitimate interests as a ground for processing your personal data. This is necessary for the purpose of facilitating contact between you and us for our provision of legal services. We do not use your personal data for activities where our interests are overridden by your interests or fundamental rights and freedoms (unless we have your consent or are otherwise required or permitted to by law).

If subsequently, we enter into a contract with you, we will need to process your personal data for the purpose of performance of a contract.

Purposes for which we will use your personal data

In relation to your personal data provided on the subscription for newsletter webpage, we will use such data for emailing our newsletters to you.

In relation to your personal data provided on the enquiry form webpage, we will use such data for directly communicating with you in relation to your enquiry and provision of our legal services.

In relation to your personal data provided via the Indemandly application, we will use such data for directly communicating with you in relation to organising a meeting and provision of our legal services.

Change of purpose

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us.

If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

Your duty to provide us with accurate data and inform us of changes

It is important that the personal data we hold about you is accurate and current. Please ensure that the data you provide us is accurate. In addition, please keep us informed if your personal data changes.

Failure to provide personal data

In order to receive our newsletters by email, you must provide us with your email address. Alternatively, you can regularly check the newsletter section of our website to read our latest newsletters.

If you wish to make an enquiry or make a booking, you can fill out your details on the enquiry form or make a booking via the Indemandly application on our website, or alternatively contact us via phone or email (see contact details below).

Prior to providing any legal services to you, we are required under the Law Society of Hong Kong’s rules to obtain certain “Know-your-client” (KYC) documents from you.

Data retention period

The data will be stored for the following periods:

• in relation to newsletters, until the earliest of the following: (i) they are no longer necessary for the purposes for which they were collected (i.e. we cease emailing out our newsletters), (ii) you unsubscribe from our newsletters, or (iii) you no longer consent to the processing of your personal data;
• in relation to data provided for enquiries and booking meetings, until you no longer consent to the processing of your personal data.

If you are engaged by us, we are required to follow the Law Society of Hong Kong’s record-keeping requirements. Files including records for client identification and due diligence should be kept for the period as follows:

• Conveyancing matters – 15 years;
• Tenancy matters – 7 years;
• Other matters, except criminal cases – 7 years; and
• Criminal cases – 3 years from expiration of any appeal period.

We may be required to keep certain records for a longer period of time if required by any relevant law, regulation or court order.

Cookies

Our website uses cookies to distinguish you from other users of our website. This helps us to provide you with a quality experience when you browse our website and also allows us to improve our website. We do not use cookies to determine the personal identity of persons who are visiting our website.

What are cookies?

Cookies are small text files sent from our website and stored on your browser. For more information on cookies, please see http://www.allaboutcookies.org/. We are not responsible for the content of http://www.allaboutcookies.org/.

What type of cookies do we use?

We place strictly necessary cookies on your browser to ensure that our website delivers you information speedily, securely and optimally. You must accept these cookies to be able to access our website. These cookies expire at the end of your session on Charltons’ website.

Our website also uses third party services, who may set their own cookies on your browser.

Our website uses Google Analytics which uses cookies to provide us with information on how people use our website, including the number of visitors to our website and the webpages they visited. This information helps us to analyse the performance of our website so that we can make improvements. According to Google, Google Analytics collects first-party cookies, data related to your device/browser, IP address and on-site/app activities to measure and report statistics about your interactions on websites and/or apps that use Google Analytics. Google Analytics uses your IP address to derive your geolocation. Charltons has enabled IP address anonymisation, so that Google Analytics anonymises your IP address as soon as technically feasible at the earliest possible stage of the collection network. Charltons has also set the data retention period to 26 months so that Google Analytics will retain your data for 26 months before automatically deleting it. For more information about Google Analytics, please see http://www.google.com/analytics/learn/privacy.html.

Our website uses AddThis which uses cookies to allow you to share our webpages on your social media accounts. According to AddThis, AddThis also uses cookies to track your online behaviour, and such data may be used by AddThis for targeted advertising. Personal data collected by AddThis includes IP address, Mobile Advertising ID and geo-location. Further, in certain circumstances, you may opt to share your email address with AddThis to facilitate AddThis’ services. AddThis keeps data for up to twenty four months. For more information, please see AddThis Privacy Policy and AddThis Terms of Service.

Cookies – consent, withdrawal and disabling

We rely on consent as the ground for using cookies. We will only use cookies for the specific purposes referred to above. You have the right to withdraw consent at any time. This does not affect the lawfulness of processing based on consent before its withdrawal.

You may refuse consent or withdraw your consent to the use of cookies at any time by disabling cookies. You may disable cookies by adjusting your browser settings accordingly. If you want to remove previously stored cookies, you may clear your browser’s cookies. Please refer to your browser’s help menu for instructions on how to disable and/or remove cookies. For further information, please see http://www.allaboutcookies.org/manage-cookies/. We are not responsible for the content of http://www.allaboutcookies.org/manage-cookies/.

Please note that if you disable cookies, our website may not function properly.

To provide website visitors the ability to prevent their website visit activity being available to Google Analytics, Google has developed the Google Analytics opt-out browser add-on for the Google Analytics JavaScript (ga.js, analytics.js, dc.js). If you would like to opt-out of Google Analytics, you should download and install the add-on for your web browser. The use of the opt-out browser add-ons does not prevent data from being sent to our website itself or to other web analytics services. However, use of opt-out browser add-ons can affect some website functions.

AddThis also have an opt-out option. Where a user opts-out, AddThis places a cookie on the user’s computer. The cookie informs AddThis not to use your information for delivering relevant online advertisements. If you would like to opt-out of AddThis, you may select opt-out on its website.

Disclosure of your personal data to third parties

If you make a booking via Indemandly, Indemandly will receive your personal data. Third parties who receive your personal data via cookies placed on our website are Google Analytics, and AddThis. These third parties may also transfer your data to third parties in certain circumstances – please see “When Google shares your information” under Google’s Privacy Policy, and “Disclosing AddThis Data to Third Parties” under AddThis’ Privacy Policy.

We will not disclose your personal data to any other third parties unless we are obliged to under a court order or other legislative or regulatory requirement, as well as any applicable rule or guideline issued by the Law Society of Hong Kong.

Transfer of personal data outside the European Economic Area (“EEA”)

Since we operate in Hong Kong, your personal information will be transferred and processed outside of the EEA. In the absence of an adequacy decision in relation to Hong Kong and appropriate safeguards under Article 46 of the General Data Protection Regulation (EU) 2016/679 (“GDPR”) , there are possible risks associated with such transfers. These risks include that you may not be able to exercise your legal rights (see below), and that your data may not be processed in accordance with the principles under the GDPR (i.e. processed lawfully, fairly and in a transparent manner; collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed; accurate and, where necessary, kept up to date; kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; processed in a manner that ensures appropriate security of the personal data). However, Charltons will take measures to safeguard your personal data and comply with the provisions of the GDPR.

Where Google Analytics, and AddThis transfer your data to outside the EEA, in the absence of an adequacy decision in relation to the relevant jurisdiction, appropriate safeguards will be in place, including standard contractual clauses, and/or the U.S. and Swiss -U.S. Privacy Shield.

Your legal rights

Under the GDPR, you have the following rights in relation to your personal data:

• the right to obtain confirmation as to whether or not personal data concerning you are being processed, and where that is the case, access to your personal data;
• the right to obtain the rectification of inaccurate personal data and have incomplete data completed;
• the right to obtain the erasure of personal data concerning you without undue delay in certain circumstances, including where the personal data are no longer necessary in relation to the purposes for which they were collected, where you withdraw your consent, where you have successfully exercised your right to object to processing (see below), where your personal data has been unlawfully processed or where your personal data has to be erased to comply with a legal obligation;
• the right to obtain restriction of processing in any of the following circumstances: (a) if you want us to establish the data’s accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) where you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it;
• the right to receive your personal data which you have provided to us (in a structured, commonly used and machine-readable format) and the right to transmit those data to a third party, only where the processing is carried out by automated means and the lawfulness of the processing is based on your consent or necessity for the performance of a contract;
• the right to object to processing of personal data in certain circumstances, including where we are relying on our own or a third party’s legitimate interests to process your personal data, except where we can demonstrate legitimate grounds for the processing which override your interests, rights and freedoms;
• the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, except where it is necessary for entering into, or performance of, a contract between yourself and us;
• the right to withdraw consent at any time where we are relying on consent to process your personal data; and
• the right to lodge a complaint with a supervisory authority (however, we would value the opportunity to address your concerns before you approach a supervisory authority, so please contact us in the first instance).

If you wish to exercise any of the rights set out above, please contact us.

What we may need from you

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right or authority to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

Time limit to respond

We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

Third party links

Our website contains links to other websites, and also includes functionality allowing users to share our webpages on third party social media applications, including LinkedIn, Facebook and Twitter. If you follow a link to another website or share a webpage on third party social media applications, this may allow third parties to collect or share data about you. We do not control third party websites and we do not accept any responsibility or liability for their privacy and cookie policies. When you leave our website, we encourage you to read the privacy and cookie policy of every website you visit.

Amendments to this privacy and cookie policy

We may update this privacy and cookie policy from time to time to reflect our practices. We will provide a notice on our website if the policy is amended. This version was last updated on 25 May 2018.

Contact us

If you have any queries, our contact details are:

Name: Charltons
Address: 12th Floor Dominion Centre
43-59 Queen’s Road East
Hong Kong
Telephone: (852) 2905 7888
Facsimile: (852) 2854 9596
Email: enquiries@charltonslaw.com