1. Statement

The Hong Kong, China Kickboxing Association (“the Association”), as a Data User, respects personal data privacy and is committed to fully implementing and complying with the data protection principles and all relevant provisions of the Personal Data (Privacy) Ordinance (Cap 486) and codes of practice issued by the Privacy Commissioner for Personal Data. The Association is equally committed to ensuring that all its officials, staff and agents uphold these obligations. The Association undertakes to:

collect personal data directly related to the functions and activities of the Association only for lawful purposes, and by lawful and fair means;
take all reasonably practicable steps to ensure that personal data are accurate, up-to-date and kept no longer than necessary;
use the personal data collected only for purposes or directly related purposes for which the data were to be used at the time of collection, unless the Data Subject concerned has given his consent to a change of use or such use is permitted by law;
take all reasonably practicable steps to ensure that personal data are protected against unauthorized or accidental access, processing, erasure or other use;
take all reasonably practicable steps to ensure that the public is informed of the kinds of personal data that the Association holds and the purposes for which the data are to be used; and
permit Data Subjects to access and correct their personal data and process the data access / correction requests in a manner permitted or required by law.

2. Types Of Personal Data Processed By The Association

The Association, in the course of its operations, may process the following types of personal data of Officers, Committee Members, members, athletes, staff, participants and other individuals:

Identification data (e.g. name and Hong Kong Identity Card / passport details);
Personal details (e.g. age, sex, date of birth, marital status, occupation, address, telephone number, e-mail address and other contact details);
Health information (e.g. data from medical / anti-doping tests and emergency contact details);
Images (e.g. photo of an individual participating in the Association’s events / activities, and image of a visitor to the events captured by CCTV system).

3. Main Purposes For Processing Personal Data

The purposes for which the Association processes personal data are:

To verify an individual’s identity;
To ensure compliance with the rules and regulations of the Association and that of international sports governing bodies;
To maintain and develop services, including programmes, activities, and events;
To enable athletes and officials to participate in international multi-sports Games, including the selection of potential athletes into the Hong Kong, China Delegation;
To organize, conduct and promote the Association’s events / activities;
To maintain relationships with the Association’s members;
To handle complaints / enquiries as appropriate;
To carry out surveys and statistical analyses;
For purposes related to recruitment of staff, manpower management, and maintenance of employment relationship;
For security purposes; and
Where otherwise reasonably necessary for the Association to carry out its functions.

4. Lawful Bases For Processing Personal Data

The Association only processes personal data where there is a lawful basis for doing so.

Consent: the Data Subject has given clear consent for the Association to process their personal data for a specific purpose.
Contract: the processing is necessary for a contract the Association has with a Data Subject, or because a Data Subject has asked the Association to take specific steps before entering into a contract.
Legal obligation: the processing is necessary for the Association to comply with the law.
Vital interests: the processing is necessary to protect the Data Subject’s life.
Public task: the processing is necessary for the Association to perform a task in the public interest.
Legitimate interests: the processing is necessary for the Association’s legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests.

In addition, the Association will on occasion need to process special category personal data (e.g. when conducting medical / anti-doping tests) or criminal records information (e.g. when carrying out No Criminal / Sexual Conviction Record Checks) in accordance with rights or duties imposed on it by law, including as regards safeguarding and employment, or from time to time by explicit consent where required.

5. How The Association Collects Personal Data

Generally, the Association collects personal data from the individual directly. This may be via a form, an online platform or simply in the ordinary course of interaction or communication.
In some cases, personal data will be supplied by third parties (e.g. a National Sports Association or other professionals or authorities working with that individual) or collected from publicly available resources.
The Association will not collect personal data from a minor without prior consent from a person with parental responsibility for the minor.

6. Access To And Sharing Of Personal Data

The Association may be required to share personal data with third parties, such as:

professional advisers (e.g. lawyers, insurers and auditors);
government authorities;
partners or related organizations (e.g. International Olympic Committee, Organizing Committee of multi-sports Games); and
where appropriate, parties who will be contacted by us during the handling of a complaint / enquiry case including the party being complained against and/or other parties concerned.

For the most part, personal data collected by the Association will remain within the Association and will be processed by appropriate individuals on a “need to know” basis.

Some of the Association’s processing activity is carried out on its behalf by third parties, such as IT systems, web developers or cloud storage providers. All the Association’s service providers are bound by contractual duty to keep confidential any data they come into contact with against unauthorized access, use and retention.

7. Information Collected On The Association’s Websites

A cookie is a small amount of data created in a computer when a person visits a website on the computer. It often includes an anonymous unique identifier. A cookie can be used to identify a computer. Cookies are used by the Association to collect statistics about the number of visits of users to the Association’s websites and the users’ preference of websites and online services offered on the Association’s websites. Users may choose to accept or reject cookies. If users reject cookies, they will not be able to use some of the functions of the websites, such as saving preferences and accessing some online services.

When a user visits the Association’s websites, the webserver makes a record of the visit that includes the user’s IP addresses (and domain names), the types and configurations of browsers, language settings, geo-locations, operating systems, previous sites visited, and time/duration and the pages visited (webserver access log). The Association uses the webserver access log for the purpose of maintaining and improving its websites such as to determine the optimal screen resolution, which pages have been most frequently visited etc. The Association uses such data only for website enhancement and optimization purposes. The Association does not use, and have no intention of using the visitor data to personally identify anyone.

8. Protection Measures

The Association takes appropriate steps to protect the personal data it holds against loss, unauthorized access, use, modification or disclosure. For example, training on personal data protection is provided to staff members who need to handle personal data in their daily work.

9. Retention

Personal data will not be kept longer than is necessary for the fulfilment of the purpose for which it is collected. Personal data that is no longer needed is either irreversibly anonymised (and the anonymised information will be retained) or securely destroyed.

10. Data Access And Correction

Data access requests should be made in writing using the form prescribed by the Privacy Commissioner for Personal Data: https://www.pcpd.org.hk/english/publications/files/Dforme.pdf. The completed form should be email to hkka@hkkickboxing.org.

When handling a data access or correction request, the Association will check the identity of the requester to ensure that he is the person legally entitled to make the data access or correction request.

11. Enquiries

Any enquiries regarding the Association’s personal data privacy policy and practice may be addressed to the Data Protection Officer via email to hkka@hkkickboxing.org.