The data we collect
Personal data means any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
We may collect, use, store and transfer your personal data as follows:
- Newsletter Subscription: if you subscribe to our newsletter via our website, we ask for personal data (your name and email address);
- Enquiry Form: if you make an enquiry on our enquiry form webpage, we ask for personal data (person/company name, contact person, and contact person’s phone and email address);
- Indemandly: if you make a booking via Indemandly on our website, the Indemandly application asks for your personal data (first and last name, email address and phone number), which is transferred to us.
Legal grounds for use of personal data
We will only use your personal data when the law allows us to.
We rely on consent as a ground for processing your personal data. We only process your personal data for the specific purposes referred to below. You have the right to withdraw consent at any time by contacting us, or by unsubscribing to our newsletters (for personal data processed for newsletter subscription). This does not affect the lawfulness of processing based on consent before its withdrawal.
In relation to enquiries and bookings, we rely on our legitimate interests as a ground for processing your personal data. This is necessary for the purpose of facilitating contact between you and us for our provision of legal services. We do not use your personal data for activities where our interests are overridden by your interests or fundamental rights and freedoms (unless we have your consent or are otherwise required or permitted to by law).
If subsequently, we enter into a contract with you, we will need to process your personal data for the purpose of performance of a contract.
Purposes for which we will use your personal data
In relation to your personal data provided on the subscription for newsletter webpage, we will use such data for emailing our newsletters to you.
In relation to your personal data provided on the enquiry form webpage, we will use such data for directly communicating with you in relation to your enquiry and provision of our legal services.
In relation to your personal data provided via the Indemandly application, we will use such data for directly communicating with you in relation to organising a meeting and provision of our legal services.
Change of purpose
We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us.
If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.
Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.
Your duty to provide us with accurate data and inform us of changes
It is important that the personal data we hold about you is accurate and current. Please ensure that the data you provide us is accurate. In addition, please keep us informed if your personal data changes.
Failure to provide personal data
In order to receive our newsletters by email, you must provide us with your email address. Alternatively, you can regularly check the newsletter section of our website to read our latest newsletters.
If you wish to make an enquiry or make a booking, you can fill out your details on the enquiry form or make a booking via the Indemandly application on our website, or alternatively contact us via phone or email (see contact details below).
Prior to providing any legal services to you, we are required under the Law Society of Hong Kong’s rules to obtain certain “Know-your-client” (KYC) documents from you.
Data retention period
The data will be stored for the following periods:
- in relation to newsletters, until the earliest of the following: (i) they are no longer necessary for the purposes for which they were collected (i.e. we cease emailing out our newsletters), (ii) you unsubscribe from our newsletters, or (iii) you no longer consent to the processing of your personal data;
- in relation to data provided for enquiries and booking meetings, until you no longer consent to the processing of your personal data.
If you are engaged by us, we are required to follow the Law Society of Hong Kong’s record-keeping requirements. Files including records for client identification and due diligence should be kept for the period as follows:
- Conveyancing matters – 15 years;
- Tenancy matters – 7 years;
- Other matters, except criminal cases – 7 years; and
- Criminal cases – 3 years from expiration of any appeal period.
We may be required to keep certain records for a longer period of time if required by any relevant law, regulation or court order.
What are cookies?
Cookies are small text files sent from our website and stored on your browser. For more information on cookies, please see http://www.allaboutcookies.org/. We are not responsible for the content of http://www.allaboutcookies.org/.
What type of cookies do we use?
We place strictly necessary cookies on your browser to ensure that our website delivers you information speedily, securely and optimally. You must accept these cookies to be able to access our website. These cookies expire at the end of your session on Charltons’ website.
Our website also uses third party services, who may set their own cookies on your browser.
Cookies – consent, withdrawal and disabling
Please note that if you disable cookies, our website may not function properly.
AddThis also have an opt-out option. Where a user opts-out, AddThis places a cookie on the user’s computer. The cookie informs AddThis not to use your information for delivering relevant online advertisements. If you would like to opt-out of AddThis, you may select opt-out on its website.
Disclosure of your personal data to third parties
We will not disclose your personal data to any other third parties unless we are obliged to under a court order or other legislative or regulatory requirement, as well as any applicable rule or guideline issued by the Law Society of Hong Kong.
Transfer of personal data outside the European Economic Area (“EEA”)
Since we operate in Hong Kong, your personal information will be transferred and processed outside of the EEA. In the absence of an adequacy decision in relation to Hong Kong and appropriate safeguards under Article 46 of the General Data Protection Regulation (EU) 2016/679 (“GDPR”) , there are possible risks associated with such transfers. These risks include that you may not be able to exercise your legal rights (see below), and that your data may not be processed in accordance with the principles under the GDPR (i.e. processed lawfully, fairly and in a transparent manner; collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed; accurate and, where necessary, kept up to date; kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; processed in a manner that ensures appropriate security of the personal data). However, Charltons will take measures to safeguard your personal data and comply with the provisions of the GDPR.
Where Google Analytics, and AddThis transfer your data to outside the EEA, in the absence of an adequacy decision in relation to the relevant jurisdiction, appropriate safeguards will be in place, including standard contractual clauses, and/or the U.S. and Swiss -U.S. Privacy Shield.
Your legal rights
Under the GDPR, you have the following rights in relation to your personal data:
- the right to obtain confirmation as to whether or not personal data concerning you are being processed, and where that is the case, access to your personal data;
- the right to obtain the rectification of inaccurate personal data and have incomplete data completed;
- the right to obtain the erasure of personal data concerning you without undue delay in certain circumstances, including where the personal data are no longer necessary in relation to the purposes for which they were collected, where you withdraw your consent, where you have successfully exercised your right to object to processing (see below), where your personal data has been unlawfully processed or where your personal data has to be erased to comply with a legal obligation;
- the right to obtain restriction of processing in any of the following circumstances: (a) if you want us to establish the data’s accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) where you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it;
- the right to receive your personal data which you have provided to us (in a structured, commonly used and machine-readable format) and the right to transmit those data to a third party, only where the processing is carried out by automated means and the lawfulness of the processing is based on your consent or necessity for the performance of a contract;
- the right to object to processing of personal data in certain circumstances, including where we are relying on our own or a third party’s legitimate interests to process your personal data, except where we can demonstrate legitimate grounds for the processing which override your interests, rights and freedoms;
- the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, except where it is necessary for entering into, or performance of, a contract between yourself and us;
- the right to withdraw consent at any time where we are relying on consent to process your personal data; and
- the right to lodge a complaint with a supervisory authority (however, we would value the opportunity to address your concerns before you approach a supervisory authority, so please contact us in the first instance).
If you wish to exercise any of the rights set out above, please contact us.
What we may need from you
We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right or authority to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
Time limit to respond
We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.
Third party links
If you have any queries, our contact details are:
Address: 12th Floor Dominion Centre
43-59 Queen’s Road East
Telephone: (852) 2905 7888
Facsimile: (852) 2854 9596