Data protection notice for employees (O_IS_HK)

August 2026

This Data Protection Notice sets out the basis on which Technoform Bautec Hong Kong Limited collects, uses, discloses or otherwise processes the personal data of employees, in accordance with the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong (“PDPO”). It applies to personal data in our possession or under our control, including personal data held by organisations we have engaged to process it on our behalf.

In this Notice, “employees” means all persons engaged in a contract of service with us (whether part-time, temporary or full-time), as well as interns and trainees working at or attached to us, and references to “employment” apply equally to internships and traineeships. “personal data” means any data: (a) relating directly or indirectly to a living individual; (b) from which it is practicable for the identity of the individual to be directly or indirectly ascertained; and (c) in a form in which access to or processing of the data is practicable.
 

1  Data Controller

The organisation responsible for the processing of your personal data is:

Technoform Bautec Hong Kong Limited
2 Chun Cheong Street, Tseung Kwan O Industrial Estate,
Tseung Kwan O, Kowloon, Hong Kong

T +852 2665 6322
E info [dot] tesg [at] ap [dot] technoform [dot] com (info[dot]tesg[at]ap[dot]technoform[dot]com)

For any questions regarding data protection, you may contact our Data Protection Contact using the details set out in Section 5 at any time.

2  Purpose and legal basis

We process your personal data on the basis of the PDPO and all other laws relevant to us in matters of data protection. Where we rely on your consent, you may withdraw it at any time (see Section 4). Where permitted or required by the PDPO or other laws, we may also collect, use or disclose your personal data without consent.

2.1  Employment relationship

We store information about our employees that is necessary for human resource administration and the remuneration process, including, without limitation, your:

• name or alias, gender, Hong Kong Identity Card (HKID) or passport number, date of birth, nationality, and country and city of birth;
• mailing address, telephone numbers, email address and other contact details;
• employment and training history;
• salary information and bank account details;
• Mandatory Provident Fund (MPF) and statutory contribution data;
• details of your next-of-kin, spouse and other family members;
• work-related health issues and disabilities;
• records of leave of absence from work;
• photographs and other audio-visual information;
• performance assessments and disciplinary records; and
• any additional information provided to us by you as a job applicant (prior to being engaged as an employee).

Your personal data will be collected and used, and may be disclosed to third parties where necessary, for purposes including: performing obligations under or in connection with your contract of employment (including payment of remuneration and tax); all administrative and human-resources matters (payroll, granting access to our premises and computer systems, processing leave, administering insurance and benefits, processing claims and expenses, investigating acts or defaults, and developing HR policies); managing and terminating the employment relationship (including monitoring internet and email use to investigate potential breaches of our compliance regulations, and resolving grievances); assessing your suitability for continued employment or appointment; ensuring business continuity; performing obligations in connection with the provision of our goods or services to our clients; and facilitating our compliance with applicable laws and regulations.

Without the provision of the required data, it is not possible to carry out and manage the employment relationship. Where sensitive personal data (such as health data) is processed, we do so only to the extent necessary for the employment relationship or as permitted under the PDPO.

2.2  Microsoft 365

We use Microsoft 365 for internal data processing and management, as well as for communication with customers and business partners. In this context, the credentials and professional contact details of employees are stored in this system, to organise data management and collaboration within the company. On a voluntary basis, you may provide a profile picture, further contact details and personal information in your Microsoft profile, which we will treat as your consent and which you may withdraw at any time by deleting the data. Apart from your direct colleagues, employees of other group companies, customers and business partners may also have access to the above data.

2.3  IT security and monitoring

As part of our security measures, we maintain various log protocols within our IT systems for troubleshooting and to provide evidence of the collection, modification and deletion of data (including device data, access data and user data). We also process data to support fraud detection and prevention, detection and prevention of misuse of services, network analysis to prevent fraud and financial crime, and the collection and use of personal data on company-issued devices to prevent data loss. Log data for IT security is generally deleted after 90 days at the latest, save where retention is required for accountability or in cases of reasoned concern until the matter has been clarified.

2.4  Access control

As part of our security measures, our office premises are equipped with an automatic access control system, for which fingerprint/facial recognition data, names, and arrival and departure times are logged, in order to secure our premises and ensure the integrity, confidentiality and availability of data.

2.5  Publications

We process credentials, contact details, image and video recordings, and any other information you provide, for internal and external corporate communications and for advertising Technoform products and services, on the basis of your voluntary consent. Such content may be used on our website, intranet, in publications and brochures, at trade fairs, and on the internet, including the social media channels of the Technoform Group. It is generally processed only for as long as necessary, may remain available online after a campaign ends, is archived, and is deleted after applicable retention periods or earlier if you withdraw your consent.

2.6  Employee welfare

As part of our employee welfare programme, we may work with partners such as insurers and benefit providers, processing names, addresses, contact details, dates of birth, and contract and benefit details to administer the relevant benefits, sharing data only to the extent necessary.

3.  Recipients of personal data

We will only disclose your personal data to third parties where necessary to fulfil the purposes set out above. Data may be transferred to government authorities and statutory bodies (for example, the Inland Revenue Department or the Mandatory Provident Fund Schemes Authority) where required or authorised by law, and to customers and business partners to the extent necessary for operational purposes. For bookkeeping, payroll and tax matters, the relevant data is transferred to our external service providers and advisers. Where we engage data intermediaries, we require them, by contract, to protect your personal data in a manner consistent with the PDPO and this Notice.

4.  Your rights

Subject to the PDPO and applicable exceptions, you have the following rights in relation to your personal data:

4.1  Withdrawal of consent

Where we rely on your consent, that consent remains valid until withdrawn in writing. You may withdraw consent by submitting a written request to our Data Protection Contact. Upon receipt, we may require reasonable time to process your request and will notify you of the likely consequences, and we shall generally seek to do so within ten (10) business days. Withdrawing consent does not affect our right to continue processing personal data where such processing without consent is permitted or required under applicable law.

4.2  Access and correction

Under the PDPO, you have the right to request access to, and correction of, your personal data held by us. Such requests should be submitted in writing to our Data Protection Contact. A reasonable fee may be charged for an access request, and we will inform you of the fee beforehand. We will generally respond within twenty-one (21) business days; if we are unable to do so within thirty (30) days, we will inform you in writing of the time by which we will respond. Where a record forms a negligible part of a document, we may provide confirmation of the personal data we hold rather than the entire document.

4.3  Accuracy of personal data

We generally rely on the personal data provided by you (or your authorised representative). To ensure your personal data remains current, complete and accurate, please inform our Data Protection Contact in writing of any changes to your personal data.

4.4  Protection of personal data

To safeguard your personal data from unauthorised access, collection, use, disclosure, copying, modification, disposal or similar risks, we have implemented appropriate administrative, physical and technical measures. These include minimised data collection, authentication and access controls, encryption, up-to-date antivirus protection, regular patching, secure disposal of storage media, and the use of two-factor or multi-factor authentication. While no method of transmission or storage is completely secure, we continually review and enhance our information security measures.

4.5  Retention of personal data

We retain your personal data for as long as necessary to fulfil the purposes for which it was collected, or as required or permitted by applicable law. We will cease to retain your personal data, or remove the means by which it can be associated with you, as soon as it is reasonable to assume that retention no longer serves those purposes and is no longer necessary for legal or business purposes.

4.6  Transfers of personal data outside Hong Kong

We generally do not transfer your personal data to places outside Hong Kong. However, where we do so — including transfers to other companies within the Technoform Group or to cloud-based service providers — we will take steps to ensure that your personal data continues to receive a standard of protection comparable to that required under the PDPO, and will obtain your consent where required.

4.7  Data breach notification

In the event of a personal data breach, we will assess the incident promptly and take appropriate remedial measures. Where appropriate, and in accordance with the guidance issued by the Office of the Privacy Commissioner for Personal Data, we may notify the PCPD and affected individuals.

4.8  Direct marketing consent

We will not use your personal data for direct marketing purposes without first obtaining your explicit consent. If you consent, you may withdraw such consent at any time, without charge, by contacting our Data Protection Contact.

5 Data Protection Contact

You may contact our Data Protection Contact if you have any enquiries or feedback on our personal data protection policies and procedures, or if you wish to make any request in relation to your personal data:

Contact number: +852 2665 6322
Email: info [dot] tesg [at] ap [dot] technoform [dot] com (info[dot]tesg[at]ap[dot]technoform[dot]com)

All enquiries sent to this mailbox will be reviewed and handled by our designated compliance staff in accordance with the PDPO.

6 Validity and modification of this data protection notice 

This Notice is currently valid (see date in the heading) and applies in conjunction with any other policies, notices, contractual clauses and consent clauses relating to the collection, use and disclosure of your personal data by us. Due to the further development of our offerings, or changes in legal or regulatory requirements, it may become necessary to amend this Notice from time to time without prior notice. You may determine whether any revision has taken place by referring to the date on which this Notice was last updated. Your continued business relationship or dealings with us constitute your acknowledgement and acceptance of any such changes.