[{"id":"ba6c1d5f-e6e4-4d9a-84ab-831eae669a7a","order":1,"text":"DATA PROTECTION AND PRIVACY POLICY","fontSize":"20","textAlign":"center","bold":true,"underline":false,"marginBottom":"30","cflou":false,"active":true},{"id":"415d02ac-7317-4a36-85f8-b3706b4b03a3","order":2,"text":"DOCUMENT CONTROL","fontSize":"16","textAlign":"center","bold":true,"underline":false,"marginBottom":"20","cflou":false,"active":true},{"id":"f8d97cc6-f3d1-4648-bf78-e777e4ef20a9","order":3,"text":"Organisation: [Full legal name of the Organisation]","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"88087d2c-104d-4286-af7c-7fc208bd2809","order":4,"text":"Legal form: a company limited by guarantee","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"d0102223-4df6-4dfd-8c0b-fc2cdef73002","order":5,"text":"Hong Kong registration or reference number: [Hong Kong registration or reference number]","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"880c0b77-1d32-47b2-81fd-7fdd40a8720a","order":6,"text":"Principal address: [Principal address]","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"63ac25de-e8c8-4b6d-858e-c15a5a889060","order":7,"text":"Website: [Website]","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"c3064d25-9d0b-46ec-bd89-7addbc10a3e9","order":8,"text":"General enquiries: [General enquiry email] | [General enquiry telephone]","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"4f047635-7fa2-42b7-82ae-b04747de0292","order":9,"text":"Policy version: [Policy version]","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"d711b9b7-9203-4e4a-ba6d-7f179cb9b151","order":10,"text":"Effective date: [Effective date]","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"8740abbf-646d-441b-bcfb-7413cb675b58","order":11,"text":"Approval date: [Approval date]","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"9c8b06e2-e446-4f61-95ad-a08e10693548","order":12,"text":"Approved by: [Approving body]","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"95636dbc-50c8-4618-9c1f-871f91f90419","order":13,"text":"Privacy contact: [Name or job title of the privacy contact]","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"3af954e9-79c9-4fde-9b28-ea9c9a9e619b","order":14,"text":"Privacy contact address: [Postal address for privacy requests]","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"ab7de091-bf42-42b1-a342-6cb8518d15ff","order":15,"text":"Privacy contact email: [Privacy contact email]","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"8010fbc6-03a7-489c-9be2-f0f2f8a55753","order":16,"text":"Privacy contact telephone: [Privacy contact telephone]","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"30","cflou":false,"active":true},{"id":"4036ee2d-c016-4b88-990f-b798f8a09b5c","order":17,"text":"PREAMBLE","fontSize":"16","textAlign":"center","bold":true,"underline":false,"marginBottom":"20","cflou":false,"active":true},{"id":"440d0432-7c47-402d-baf3-0ce982d481e9","order":18,"text":"[Full legal name of the Organisation] (the \"Organisation\") is established in Hong Kong as a company limited by guarantee under registration or reference number [Hong Kong registration or reference number]. The Organisation handles Personal Data in the course of fundraising, membership administration, volunteer engagement, programme delivery, employment, governance and its other non-profit activities.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"b5e0d6b2-ac36-4768-bb55-75b693cdf87b","order":19,"text":"The Organisation adopts this Policy to regulate the collection, holding, processing and use of Personal Data under the Personal Data (Privacy) Ordinance (Cap. 486) (the \"PDPO\"). The six Data Protection Principles in Schedule 1 to the PDPO apply throughout the life cycle of Personal Data. This Policy also addresses Part VI A of the PDPO where the Organisation uses Personal Data for direct marketing, including the solicitation of donations through direct marketing means.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"48a9d224-d93d-4ef2-9216-aede6142ae2d","order":20,"text":"This Policy is an operational standard. It does not limit any right or obligation under the PDPO or other applicable law. If this Policy conflicts with a mandatory legal requirement, the legal requirement prevails and the Organisation must amend the affected practice without delay.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"086dc17b-f6a8-4825-afe0-886160110bbf","order":21,"text":"1. PURPOSE AND STATUS","fontSize":"16","textAlign":"left","bold":true,"underline":false,"marginBottom":"10","cflou":false,"active":true,"marginTop":"10","sectionNum":"S01"},{"id":"39c3beb6-65a7-433c-839a-5c071df78589","order":22,"text":"The purposes of this Policy are to set clear rules for the lawful and fair handling of Personal Data, assign responsibility, protect Data Subjects, and provide staff and volunteers with procedures they can follow in daily work.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"33ab9f1f-0c2b-4fe8-a274-28da417c699f","order":23,"text":"The Board or governing body has approved this Policy. All directors, trustees, committee members, employees, secondees, interns, volunteers, agency workers, contractors and service providers who handle Personal Data for the Organisation must comply with it. A breach may result in restricted access, disciplinary action, termination of engagement, contractual remedies, notification to authorities, or other proportionate action.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"d81156ba-b57c-4b39-9917-e859557aecb2","order":24,"text":"2. SCOPE","fontSize":"16","textAlign":"left","bold":true,"underline":false,"marginBottom":"10","cflou":false,"active":true,"marginTop":"10","sectionNum":"S02"},{"id":"eb1b0c25-59b3-4c8b-ac90-8b6e0c0dbc93","order":25,"text":"This Policy applies to Personal Data controlled by the Organisation in any form, including paper records, emails, messaging platforms, photographs, audio and video recordings, databases, cloud systems, portable devices, archived files and information held by a Data Processor on the Organisation's behalf.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"db4872c5-bae5-4727-9748-9bd62549e063","order":26,"text":"It covers Personal Data relating to donors and prospective donors, members and applicants, volunteers and applicants, beneficiaries and service users, employees and job applicants, directors and office-holders, event participants, website users, complainants, suppliers, professional contacts and any other identifiable individual whose data the Organisation controls.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"ba63e032-a1d0-4345-b079-7fa02fc0b1b2","order":27,"text":"Anonymised information falls outside the PDPO only where it is not practicable for any person to identify an individual directly or indirectly. Pseudonymised information remains Personal Data where re-identification is practicable.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"75bed184-7baa-4306-9e79-daad70c653e7","order":28,"text":"3. DEFINITIONS","fontSize":"16","textAlign":"left","bold":true,"underline":false,"marginBottom":"10","cflou":false,"active":true,"marginTop":"10","sectionNum":"S03"},{"id":"5be86d90-70a7-45a0-9c06-d1d10a88bf2e","order":29,"text":"\"Data Processor\" means a person who processes Personal Data on behalf of another person and does not process the data for that person's own purposes.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"c6a0a868-397d-4acc-b154-b326ff90bd0b","order":30,"text":"\"Data Subject\" means the individual who is the subject of Personal Data.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"94903e24-6633-42df-862f-d7cd9e61b3d6","order":31,"text":"\"Data User\" has the meaning given by the PDPO and, in relation to Personal Data, means a person who alone, jointly or in common with others controls the collection, holding, processing or use of the data. The Organisation is a Data User for the Personal Data it controls.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"7c3de9ab-2cf2-45c3-9a5a-cdfc88a7c9d5","order":32,"text":"\"Direct Marketing\" has the meaning given by Part VI A of the PDPO. It includes communications addressed to a named individual by mail, email, telephone or another direct means that offer or advertise goods, facilities or services, or solicit donations or contributions for charitable or other purposes.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"346cd6ad-b248-4160-9276-cbe9fa060382","order":33,"text":"\"Personal Data\" means any data relating directly or indirectly to a living individual from which it is practicable for the identity of the individual to be directly or indirectly ascertained, in a form in which access to or processing of the data is practicable.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"257abc30-7858-4884-9788-399567f6f8e9","order":34,"text":"\"Personal Information Collection Statement\" or \"PICS\" means a notice supplied on or before the direct collection of Personal Data to provide the information required by DPP1(3), together with any notice and response channel required for Direct Marketing.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"c647a4d7-6b05-441a-9570-d34a3fe68c19","order":35,"text":"\"Prescribed Consent\" means express consent given voluntarily and not withdrawn by notice in writing, as defined by the PDPO.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"fdbe27d1-2efa-475d-aa84-c1ece44bf745","order":36,"text":"\"Privacy Contact\" means [Name or job title of the privacy contact], or any replacement appointed in writing by the Organisation.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"135ada5b-d2cc-4cf3-95ae-dc01422ef5f5","order":37,"text":"4. GOVERNANCE AND ACCOUNTABILITY","fontSize":"16","textAlign":"left","bold":true,"underline":false,"marginBottom":"10","cflou":false,"active":true,"marginTop":"10","sectionNum":"S04"},{"id":"1e3beb17-cc90-41c6-969d-497d8315cd51","order":38,"text":"The Board or governing body retains oversight of compliance with the PDPO. It must receive material privacy risk reports, approve this Policy and significant changes, and ensure that the Organisation allocates reasonable resources to privacy and information security.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"760c1f44-e9e5-4619-bc6e-4a6086f4353b","order":39,"text":"The Privacy Contact administers this Policy, maintains the data inventory and retention schedule, reviews PICS wording, coordinates data access and correction requests, advises on new uses and systems, manages privacy complaints, keeps breach records and reports material issues to senior management and the Board.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"bde664a6-5bbc-4912-8f39-c5753135ec73","order":40,"text":"Each programme or function owner is responsible for the Personal Data used by that programme or function. Before starting a new collection, disclosure, technology, fundraising campaign or service provider arrangement, the owner must identify the lawful purpose, establish necessity, minimise the data, prepare or update the PICS, set access controls, assign a retention period and obtain privacy review where the risk is material.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"807aadbe-3f06-43d6-ba5b-7650980dbc48","order":41,"text":"Privacy must be built into the design of new programmes, forms and systems. The Privacy Contact must require a documented privacy impact assessment before a project that involves large-scale data, systematic monitoring, new technology, vulnerable persons, higher-risk information, public disclosure, automated decisions or a material change of purpose proceeds.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"009bf2a5-308a-4b37-a2a2-490d364350ac","order":42,"text":"The Organisation must maintain an inventory recording the principal categories of Personal Data, the purpose of use, source, system or location, responsible owner, permitted users, classes of transferees, processor arrangements, overseas access and retention period.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"3cf52c11-448f-43f8-a594-707c1311d4b7","order":43,"text":"5. DPP1: PURPOSE AND MANNER OF COLLECTION","fontSize":"16","textAlign":"left","bold":true,"underline":false,"marginBottom":"10","cflou":false,"active":true,"marginTop":"10","sectionNum":"S05"},{"id":"e1137520-8fc8-4e30-bd34-9e63ebf2c1bf","order":44,"text":"The Organisation may collect Personal Data only for a lawful purpose directly related to one of its functions or activities. The data collected must be necessary, adequate and not excessive for that purpose. Convenience, possible future usefulness or customary practice is not, by itself, a sufficient reason to collect data.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"8548f421-8c77-4771-96df-3a05efdc0991","order":45,"text":"Collection must be lawful and fair. The Organisation must not mislead an individual about its identity, the purpose of a form, whether a field is mandatory, the consequences of non-provision, or the intended recipients of the data. Staff must take particular care where there is a power imbalance, language barrier, disability, emergency, or a child or vulnerable person is involved.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"eba5c92c-8088-4ee7-8fb0-6070b9b2478b","order":46,"text":"On or before collecting Personal Data directly from a Data Subject, the Organisation must provide a clear and conspicuous PICS. Mandatory and optional fields must be marked. The PICS must state whether supply is obligatory or voluntary, the consequences of failing to supply obligatory data, the purposes of use, the classes of possible transferees, the rights of access and correction, and the name or job title and address of the person who handles those requests.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"c917938e-39b0-4a6f-a25a-95d610fcb67f","order":47,"text":"The Organisation must comply with the PCPD's Code of Practice on the Identity Card Number and Other Personal Identifiers, as revised or replaced from time to time. It must not collect a Hong Kong Identity Card number or a copy of an identity document unless the collection is permitted by law and necessary in the circumstances. Where identity can be verified by a less intrusive method, that method must be used. Copies must not be retained merely because an original was inspected.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"fa527068-f93b-45e4-9a54-770a4d6ffadd","order":48,"text":"Health information, criminal record information, financial details, identity document data, safeguarding information and information about vulnerable persons require a written necessity assessment and controls proportionate to the harm that unauthorised or accidental use could cause.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"e538e43a-1160-4b4a-98dc-c6b6593ff21f","order":49,"text":"6. CATEGORIES OF PERSONAL DATA AND PURPOSES","fontSize":"16","textAlign":"left","bold":true,"underline":false,"marginBottom":"10","cflou":false,"active":true,"marginTop":"10","sectionNum":"S06"},{"id":"1a1bd9ad-9975-4d9a-8e95-cd233b5e6626","order":50,"text":"For donors and prospective donors, the Organisation may hold identity and contact details, donation history, payment references, tax receipt information, communication preferences, event participation, relationship notes and due diligence records. It may use them to process and acknowledge donations, issue receipts, maintain financial and audit records, prevent fraud, comply with legal duties, manage donor relationships and, where the applicable Direct Marketing requirements are met, communicate fundraising appeals and charitable activities.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"34affd13-a47f-4f5a-b492-b9821b3a5494","order":51,"text":"For members and applicants, the Organisation may hold application details, eligibility information, contact details, membership status, subscriptions or fees, attendance, voting and governance records, committee roles, interests and communication preferences. It may use them to assess applications, administer membership, collect fees, provide member services, convene meetings, conduct elections, maintain statutory or constitutional records and communicate activities.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"379c4602-744d-4a15-ba6a-f52358faa6aa","order":52,"text":"For volunteers and applicants, the Organisation may hold identity and contact details, availability, skills, qualifications, references, training, attendance, performance, emergency contacts, safeguarding checks, health adjustments and incident records. It may use them to assess suitability, allocate and supervise work, provide training and support, protect beneficiaries and volunteers, administer expenses, investigate concerns and meet legal or insurance requirements.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"23664543-0307-4300-a7bd-e0a47a0fdf4a","order":53,"text":"For beneficiaries and service users, the Organisation may hold contact, demographic, eligibility, case, service, assessment, referral, safeguarding, health, accessibility, outcome and feedback information where relevant to a programme. The Organisation must limit access to personnel with a genuine need to know and must not reuse case information for publicity, fundraising stories, research or unrelated programmes without a lawful basis and any Prescribed Consent required by DPP3.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"22dd1987-aeef-4426-aa96-5a07774d5598","order":54,"text":"For employees, applicants, directors, office-holders, contractors and suppliers, the Organisation may hold identity, contact, recruitment, employment, payment, tax, insurance, performance, governance, conflict, disciplinary, access and contractual records. Recruitment and employment data must be handled in accordance with the PCPD's Code of Practice on Human Resource Management, as revised or replaced from time to time. Separate notices or procedures may supplement this Policy for human resources and governance processing.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"c4445b08-4354-4a74-8802-b205ebd40455","order":55,"text":"For website users and event participants, the Organisation may hold registration data, enquiry content, device and log data, cookie information, photographs, recordings, accessibility needs and attendance records. The Organisation must give notice of online tracking and any intended publication of an identifiable photograph, recording, directory or testimonial.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"695dbe05-acb2-41f3-a4ab-cf59842bc98e","order":56,"text":"7. DPP2: ACCURACY AND RETENTION","fontSize":"16","textAlign":"left","bold":true,"underline":false,"marginBottom":"10","cflou":false,"active":true,"marginTop":"10","sectionNum":"S07"},{"id":"d3e52c52-537d-49a7-8393-aaca00bda333","order":57,"text":"The Organisation must take all reasonably practicable steps to ensure that Personal Data is accurate having regard to the purpose for which it is used. A programme owner must correct or flag material inaccuracies promptly and must not use data known to be inaccurate until the issue is resolved. Where inaccurate data has been disclosed, the Organisation must consider notifying the recipient where reasonably practicable and necessary to prevent harm.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"7dc7a4ad-b96a-4446-8e9a-288907465bb1","order":58,"text":"Personal Data must not be kept longer than necessary for the purpose for which it is used, including any directly related purpose. The retention periods in Appendix A are maximum routine periods, not automatic minimum periods. Data must be erased or irreversibly anonymised earlier when it is no longer needed, unless a legal obligation, active dispute, investigation, safeguarding need or documented legal hold requires continued retention.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"2c749cda-2b95-4ee7-adf8-01cec663e96c","order":59,"text":"Where section 51C of the Inland Revenue Ordinance (Cap. 112) applies, business records of income and expenditure must be retained for at least seven years. The Organisation must identify the transaction or other event from which the statutory period runs and must check whether another tax, accounting, corporate or funding rule requires a longer period.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"ca27c975-1f84-48c5-b6bf-80d64aca4bae","order":60,"text":"Electronic and paper copies, duplicates, exports, shared-drive copies, local downloads and processor-held copies must be covered by disposal procedures. Disposal must be secure and recorded for higher-risk or bulk records.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"c49e074d-eccc-4d48-80c4-34abfd6ea061","order":61,"text":"Where a Data Processor is engaged, the Organisation must use contractual or other means to prevent the processor from retaining Personal Data longer than necessary. At the end of the service, the processor must return or securely erase the data, including recoverable copies, subject only to a specific legal retention duty.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"954e3289-3735-4ad7-b756-aa0f36d912b4","order":62,"text":"8. DPP3: USE OF PERSONAL DATA AND CHANGE OF PURPOSE","fontSize":"16","textAlign":"left","bold":true,"underline":false,"marginBottom":"10","cflou":false,"active":true,"marginTop":"10","sectionNum":"S08"},{"id":"02daa503-589a-424b-91bd-cc9b13897aae","order":63,"text":"The Organisation may use Personal Data only for the purpose for which it was collected or a directly related purpose that a reasonable person would expect in the circumstances. Disclosure and transfer are forms of use.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"016c936c-d321-4759-a69e-15e1ab8444f8","order":64,"text":"Before using Personal Data for a new purpose, the Organisation must obtain the Data Subject's Prescribed Consent unless the PDPO or another law permits or requires the use without consent. The request must identify the new purpose and must not be bundled with access to an unrelated service. A Data Subject may withdraw Prescribed Consent by notice in writing, subject to any use already lawfully made and any continuing legal duty.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"bccec241-fc6e-413e-b2f9-01a6ff4f153e","order":65,"text":"Data collected for programme delivery must not be used for donor profiling, publicity, testimonials, research, training materials, artificial intelligence training, automated decision-making or another materially different purpose without documented review and any required consent.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"506060d4-60a4-449f-890d-6e7206a99a23","order":66,"text":"9. DIRECT MARKETING AND FUNDRAISING","fontSize":"16","textAlign":"left","bold":true,"underline":false,"marginBottom":"10","cflou":false,"active":true,"marginTop":"10","sectionNum":"S09"},{"id":"95b0b4b8-fa24-44eb-9b54-4d0309178702","order":67,"text":"The Organisation may use Personal Data for Direct Marketing only after it has provided the notice required by Part VI A of the PDPO and received the Data Subject's consent or indication of no objection through a valid response channel. Silence or failure to return an opt-out form does not, by itself, constitute consent under this Policy.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[{"field":"dfc4dced-b56c-4ecc-97fd-51a2e004570a","value":"Yes","type":"add","operator":"="}]},{"id":"5acdafdc-b7b0-4b23-a2f7-2ebcda2fe631","order":68,"text":"Before the first Direct Marketing use, the Organisation must tell the individual that it intends to use the data and cannot do so without consent, specify the kinds of Personal Data to be used, specify the classes of marketing subjects, and provide a channel through which the individual may indicate consent. The notice must be readily understandable and easily readable.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[{"field":"dfc4dced-b56c-4ecc-97fd-51a2e004570a","value":"Yes","type":"add","operator":"="}]},{"id":"1a10dfe5-7af7-4663-8115-33f467be3811","order":69,"text":"The permitted kinds of data are limited to the individual's name, email address, postal address, telephone number and recorded communication preferences. The permitted marketing subjects are the Organisation's charitable appeals, fundraising campaigns, events, membership opportunities, volunteer opportunities and information about its non-profit programmes. A campaign must remain within the consent actually obtained.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[{"field":"dfc4dced-b56c-4ecc-97fd-51a2e004570a","value":"Yes","type":"add","operator":"="}]},{"id":"1f08660a-dcee-4238-9c4e-40d7e0aa3eb1","order":70,"text":"The Organisation must identify itself in each Direct Marketing communication and provide a simple means to opt out. On the first use of Personal Data for Direct Marketing, it must inform the individual of the right to require cessation. An opt-out request must be honoured without charge and recorded promptly across relevant channels and lists.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[{"field":"dfc4dced-b56c-4ecc-97fd-51a2e004570a","value":"Yes","type":"add","operator":"="}]},{"id":"a0adedf3-2181-4036-aafd-972c5c026b0c","order":71,"text":"Electronic marketing and fundraising messages must also comply with the Unsolicited Electronic Messages Ordinance (Cap. 593) where it applies.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[{"field":"dfc4dced-b56c-4ecc-97fd-51a2e004570a","value":"Yes","type":"add","operator":"="}]},{"id":"825aa55d-67d6-4d7f-b88a-182dfa319ec6","order":72,"text":"The Organisation will not provide Personal Data to another person for that person's Direct Marketing. Any proposal to do so requires prior legal review, a notice meeting the requirements governing provision of data to third parties, written consent, and a formal amendment to this Policy.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[{"field":"dfc4dced-b56c-4ecc-97fd-51a2e004570a","value":"Yes","type":"add","operator":"="}]},{"id":"aa5e64ab-7f40-4f56-8ee7-f277b66a674e","order":73,"text":"The Organisation will not use Personal Data for Direct Marketing or named fundraising solicitations. It may send service, payment, governance, safety and other non-promotional communications that are necessary for an existing relationship. Any proposal to begin Direct Marketing requires Board approval, revised PICS wording, a valid consent process, an opt-out mechanism and an amendment to this Policy before the first use.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[{"field":"dfc4dced-b56c-4ecc-97fd-51a2e004570a","value":"No","type":"add","operator":"="}]},{"id":"6a88ac95-3537-4605-a3c6-b6c7bd62b2d0","order":74,"text":"10. DPP4: SECURITY OF PERSONAL DATA","fontSize":"16","textAlign":"left","bold":true,"underline":false,"marginBottom":"10","cflou":false,"active":true,"marginTop":"10","sectionNum":"S10"},{"id":"169bf2ba-c85e-4823-9737-ec505379b85d","order":75,"text":"The Organisation must take all reasonably practicable steps to protect Personal Data against unauthorised or accidental access, processing, erasure, loss or use. Measures must reflect the nature and volume of the data, the likely harm, the storage location, the integrity and competence of persons with access, equipment safeguards and transmission risks.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"53139289-adfb-4c63-b007-dc52fcfeb982","order":76,"text":"Required controls include access based on role and least privilege, prompt removal of access when roles change, strong authentication, multi-factor authentication for higher-risk systems, encryption for higher-risk transmission and portable storage, supported software, security updates, malware protection, secure backups, physical security, clean-desk and secure printing practices, approved disposal, and logging where proportionate.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"71f34d26-dad3-4d69-ab88-221f3ec94a66","order":77,"text":"Personal Data must be shared only through approved channels. Staff and volunteers must not use personal email, unapproved consumer cloud storage, public links or personal devices for Personal Data unless the Organisation has expressly authorised the arrangement and applied suitable controls.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"ec3feebb-ca92-401b-b30f-88eb4901eca7","order":78,"text":"Higher-risk Personal Data must not be included in routine email or messaging where a safer method is reasonably available. Passwords or access codes must be sent separately from protected files. Recipient details and attachments must be checked before transmission.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"8bba3182-7a24-4b92-b5c2-b34e97b0cf1e","order":79,"text":"11. DATA PROCESSORS AND SERVICE PROVIDERS","fontSize":"16","textAlign":"left","bold":true,"underline":false,"marginBottom":"10","cflou":false,"active":true,"marginTop":"10","sectionNum":"S11"},{"id":"416259cd-dc0c-457b-a68d-83a844c54fda","order":80,"text":"Before appointing a Data Processor, the Organisation must assess the processor's reliability, security, location, sub-processors, retention practices, incident history and ability to assist with access, correction, erasure and breach response.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"2805aaad-3143-4fc8-aac3-c34b6be7357b","order":81,"text":"The written agreement must define the subject matter, duration, purposes, permitted instructions, confidentiality, access controls, security measures, retention and erasure, sub-processing, overseas access, breach notification, audit information, return or deletion at termination and consequences of non-compliance.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"93eec25b-59bf-44c4-9f08-ff60a91874fe","order":82,"text":"The Organisation remains responsible for using contractual or other means to prevent unauthorised or accidental handling and excessive retention by processors, whether the processor is in or outside Hong Kong. Programme owners must monitor material processors and document significant changes.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"07957e55-62e1-4f77-a6ae-590533a41678","order":83,"text":"12. SHARING, DISCLOSURE AND PUBLICATION","fontSize":"16","textAlign":"left","bold":true,"underline":false,"marginBottom":"10","cflou":false,"active":true,"marginTop":"10","sectionNum":"S12"},{"id":"74e8ca0c-08ce-4322-9c66-057feb753d6b","order":84,"text":"Personal Data may be disclosed only to classes of recipients identified in the relevant PICS, for the stated or directly related purpose, or where the Data Subject has given the required consent or law permits or requires the disclosure.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"d27fa564-ef3b-4451-8339-ed26c5963aa9","order":85,"text":"Depending on the activity, permitted recipients may include banks and payment processors, information technology and cloud service providers, mailing and event service providers, insurers, auditors, professional advisers, regulators, law enforcement bodies, courts, funding bodies where reporting is lawful and proportionate, and partner organisations directly involved in delivering the relevant programme.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"404e628f-fc39-4134-bf7f-4de674515fc6","order":86,"text":"The Organisation must disclose the minimum data necessary. A recipient must not receive a full file where a confirmation, aggregate statistic, redacted record or limited extract will meet the purpose.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"af7966aa-3f55-4f3b-859a-b197b478c5bd","order":87,"text":"Names, photographs, case studies, testimonials, membership directories and volunteer details must not be published merely because the Organisation holds them. The intended publication and audience must be stated at collection or separately authorised before publication. Publicly available Personal Data remains subject to the PDPO.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"b0b6c94b-5c4b-4ce4-98c5-69da9c1a26ea","order":88,"text":"The doxxing provisions introduced by the Personal Data (Privacy) (Amendment) Ordinance 2021 create criminal offences for disclosing a Data Subject's Personal Data without the Data Subject's relevant consent where the person making the disclosure intends, or is reckless as to whether, specified harm would be or would likely be caused to the Data Subject or a family member. If the disclosure causes specified harm, the more serious indictable offence may apply. Personnel must never publish, forward, repost or otherwise disclose Personal Data in circumstances that may amount to either doxxing offence.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"df955277-b44c-4f57-8bcb-f40c9aeade60","order":89,"text":"Before any public or targeted disclosure about a beneficiary, volunteer, member, donor, employee or other individual, the programme owner must consider the proposed audience, the possibility of copying or onward disclosure, and whether the information could be used to locate, contact, threaten, intimidate or harass the individual or a family member. A suspected doxxing disclosure must be reported immediately to the Privacy Contact. The Organisation must take practicable steps to restrict or remove the material, preserve evidence, protect affected persons and consider notifying the PCPD or the Police.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"dccf4aeb-bb67-44b0-a3d6-3bbac4068dba","order":90,"text":"13. CROSS-BORDER TRANSFERS AND REMOTE ACCESS","fontSize":"16","textAlign":"left","bold":true,"underline":false,"marginBottom":"10","cflou":false,"active":true,"marginTop":"10","sectionNum":"S13"},{"id":"61584959-caef-4dab-a674-0fa6236e118c","order":91,"text":"At the date of this Policy, section 33 of the PDPO has not commenced. The Organisation nevertheless treats overseas hosting, support access, remote administration and disclosure outside Hong Kong as material privacy risks and follows the guidance of the Privacy Commissioner for Personal Data on cross-border transfers.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"9ec3f8df-1520-46c9-8222-86c39152bcba","order":92,"text":"Before any transfer or overseas access, the Organisation must identify the data, purpose, destination, recipient, onward transfers, local legal risks, security measures, retention and the method for handling Data Subject rights. It must assess whether the transfer is consistent with the original purpose and PICS and whether Prescribed Consent is required.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"3976e657-ab48-45ec-a9c7-fd4daf8348a9","order":93,"text":"The Organisation should use contractual terms that provide protection comparable to the PDPO, including purpose limitation, confidentiality, security, incident notification, limits on onward transfer, assistance with rights, retention, erasure, audit and return of data. The PCPD's recommended model contractual clauses should be considered where appropriate.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"1d455c23-7d1a-4279-883b-86644ff599fd","order":94,"text":"If section 33 comes into operation, the Organisation must review existing and proposed transfers and satisfy its requirements before continuing any transfer that falls within the section.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"581f136b-333c-45c5-ab99-51f36c370a4e","order":95,"text":"The Organisation does not currently permit routine overseas hosting, processing, support or remote access. A proposed overseas arrangement must complete the review and approval process in this Policy before it begins.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[{"field":"06ad2368-24a0-4f9e-8923-5dffddd4f0a9","value":"No","type":"add","operator":"="}]},{"id":"a47a7b4e-f808-4005-8ea1-ff88283c9028","order":96,"text":"The Organisation currently uses or permits overseas hosting, processing, support or remote access. The specific arrangements and safeguards are recorded in the additional section below.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[{"field":"06ad2368-24a0-4f9e-8923-5dffddd4f0a9","value":"Yes","type":"add","operator":"="}]},{"id":"0349f9a5-8f85-4791-9590-09a2954b4006","order":97,"text":"14. ADDITIONAL CROSS-BORDER SAFEGUARDS","fontSize":"16","textAlign":"left","bold":true,"underline":false,"marginBottom":"10","cflou":false,"active":true,"marginTop":"10","displayConditions":[{"field":"06ad2368-24a0-4f9e-8923-5dffddd4f0a9","value":"Yes","type":"add","operator":"="}],"sectionNum":"S14"},{"id":"bd74059b-3157-4bfd-bf9e-ae3f3cafabf8","order":98,"text":"Locations and service arrangements: [Locations and service arrangements]","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[{"field":"06ad2368-24a0-4f9e-8923-5dffddd4f0a9","value":"Yes","type":"add","operator":"="}]},{"id":"bbd2c42d-71ea-4ecf-bedc-08abf103d7a5","order":99,"text":"Additional safeguards: [Additional transfer safeguards]","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[{"field":"06ad2368-24a0-4f9e-8923-5dffddd4f0a9","value":"Yes","type":"add","operator":"="}]},{"id":"482308ff-c889-4a81-b675-98a6eb2d4121","order":100,"text":"The Privacy Contact must maintain a register of these arrangements, review them at least annually and reassess them before any material change in destination, provider, sub-processor, data category or purpose.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[{"field":"06ad2368-24a0-4f9e-8923-5dffddd4f0a9","value":"Yes","type":"add","operator":"="}]},{"id":"4d393a14-dfc1-44f8-beae-8a69c8d21ee5","order":101,"text":"15. DATA BREACH RESPONSE","fontSize":"16","textAlign":"left","bold":true,"underline":false,"marginBottom":"10","cflou":false,"active":true,"marginTop":"10","sectionNum":"S15"},{"id":"91afb871-de19-4f00-896c-d1f0f287488c","order":102,"text":"A suspected or actual loss, unauthorised disclosure, unauthorised access, mistaken transmission, cyberattack, unavailable data, improper disposal or other security incident involving Personal Data must be reported immediately to the Privacy Contact through the Organisation's incident channel. No person may conceal an incident or attempt an uncoordinated external response.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"f5093795-0b25-4cf3-b8ec-63c13b422e6f","order":103,"text":"The response team must promptly gather essential facts, contain the incident, preserve evidence, assess the affected data and individuals, evaluate the risk of harm, implement remedial measures, consider notifications and document decisions. The assessment must consider identity theft, financial loss, physical or psychological harm, discrimination, humiliation, loss of confidentiality and harm to vulnerable persons.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"bf172456-7a87-4137-a3e2-398e4e964994","order":104,"text":"Although the PDPO does not currently impose a general mandatory data breach notification duty, the Organisation will consider notifying the Privacy Commissioner for Personal Data and affected individuals as soon as practicable, particularly where the incident is likely to result in a real risk of harm. Notifications must be accurate, useful and coordinated with law enforcement or other authorities where necessary.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"65e96ad9-5f57-452a-9709-02945696d7fd","order":105,"text":"The Privacy Contact must keep a breach register recording the facts, effects, containment, risk assessment, notification decision, remedial action, lessons learned and closure approval. Material incidents must be reported to the Board.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"01ce4a8b-9cd6-438d-90fa-3fcf9de3767d","order":106,"text":"16. DPP5: OPENNESS AND TRANSPARENCY","fontSize":"16","textAlign":"left","bold":true,"underline":false,"marginBottom":"10","cflou":false,"active":true,"marginTop":"10","sectionNum":"S16"},{"id":"5e5cc075-67ea-49ff-8e35-ec7c9d640556","order":107,"text":"The Organisation must make this Policy, or a public-facing privacy policy containing the relevant information, readily available. An individual must be able to ascertain the Organisation's privacy policies and practices, the kinds of Personal Data it holds and the main purposes for which the data is used.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"26664406-8542-4fd1-92ae-14e777feba3d","order":108,"text":"Each collection channel must display or link to the relevant PICS before submission. A link labelled \"Privacy Policy\" must be easy to find on [Website] and on pages that collect Personal Data. Printed and online versions must be materially consistent.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"4807b8ae-5e09-424f-ae8c-1ea825d28137","order":109,"text":"The Organisation must record the effective date and version of privacy notices and retain evidence of the notice and consent wording presented through material collection channels.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"2a39cf4e-108c-43a6-b0e8-47b3eb13e1d0","order":110,"text":"17. DPP6: ACCESS AND CORRECTION","fontSize":"16","textAlign":"left","bold":true,"underline":false,"marginBottom":"10","cflou":false,"active":true,"marginTop":"10","sectionNum":"S17"},{"id":"50990e8a-4482-4381-9177-b93a197b51d7","order":111,"text":"A Data Subject may ask whether the Organisation holds Personal Data about that individual and may request access to a copy. A data access request should be made in writing using the form specified by the Privacy Commissioner where applicable and sent to [Name or job title of the privacy contact] or [Privacy contact email].","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"98704fd1-ac07-48be-8eaf-558df52f3e69","order":112,"text":"Postal address for data access requests: [Postal address for privacy requests]","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"4979dcea-cc20-47b9-9716-8851914fea04","order":113,"text":"The Organisation must verify the requester's identity and authority without collecting excessive identification data. It must respond within 40 calendar days after receiving a valid data access request, unless an applicable provision permits or requires refusal. If it cannot comply within that period, it must give the requester written notice of the reason and comply as soon as practicable. Any fee must not be excessive and must relate to the cost of compliance.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"3f292657-2949-4a5a-8bd6-d0a7bb441f74","order":114,"text":"A Data Subject may request correction of inaccurate Personal Data after access or by providing sufficient particulars. If the Organisation is satisfied that data is inaccurate, it must make the necessary correction and supply a copy of the corrected data within 40 calendar days, subject to the PDPO. No fee may be charged for complying with a data correction request. If access or correction is refused, the Organisation must give reasons unless the PDPO permits those reasons to be withheld and must record the decision.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"206d6c08-c22a-47e6-9f62-b220c0bcd635","order":115,"text":"Personnel must forward any request that may be an access or correction request to the Privacy Contact immediately. They must not promise disclosure, alter the relevant record outside the controlled process, or delete data after a request has been received.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"70d0e364-fc23-49fe-bbd7-64603aefdeb5","order":116,"text":"18. CHILDREN AND VULNERABLE PERSONS","fontSize":"16","textAlign":"left","bold":true,"underline":false,"marginBottom":"10","cflou":false,"active":true,"marginTop":"10","sectionNum":"S18"},{"id":"9fc78ba9-7f37-40a7-8c6b-44c6b2dc3114","order":117,"text":"Where the Organisation accepts volunteers under 18 or otherwise collects Personal Data from children, it must use age-appropriate language, collect only what is necessary, explain the collection to the child where practicable, and involve a parent or guardian where required or appropriate. Consent from a relevant person must be obtained where the PDPO requires it or the child cannot validly understand the proposed use. Safeguarding information must be restricted to personnel with a genuine need to know.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[{"field":"3097394a-d088-4d66-8538-c9e205bee7c0","value":"Yes","type":"add","operator":"="}]},{"id":"5270708e-c4a1-4e35-a481-567863bd66fe","order":118,"text":"The Organisation does not accept volunteer applications from persons under 18. Volunteer forms must state this eligibility rule and should not invite applicants to provide Personal Data about children. If such data is received inadvertently, it must be isolated, assessed and erased unless a lawful safeguarding or record-keeping reason requires retention.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[{"field":"3097394a-d088-4d66-8538-c9e205bee7c0","value":"No","type":"add","operator":"="}]},{"id":"99903043-1d88-4013-9911-957428bc9f30","order":119,"text":"For any vulnerable person, the Organisation must consider capacity, communication needs, confidentiality, the risk of coercion and the possible consequences of disclosure. A family member, carer or referrer does not automatically have authority to access or consent to use of another person's Personal Data.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"5fff409c-f60f-4771-8231-c79215a2d66d","order":120,"text":"19. WEBSITE, COOKIES, PHOTOGRAPHS AND RECORDINGS","fontSize":"16","textAlign":"left","bold":true,"underline":false,"marginBottom":"10","cflou":false,"active":true,"marginTop":"10","sectionNum":"S19"},{"id":"e2d82d17-d6b6-43e7-be20-5a3088a93b36","order":121,"text":"The Organisation must identify the cookies and similar technologies used on its website, distinguish essential from optional technologies, state the information collected, purpose, duration and any third-party recipients, and provide choices where required or adopted. Cookie data that can identify an individual is Personal Data.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"446d5649-2ce0-461b-89a6-219f369b4867","order":122,"text":"Online forms must use secure transmission, collect no more data than the equivalent offline process without justification, mark mandatory fields and display the PICS conspicuously. Test or analytics environments must not use live Personal Data unless authorised and protected.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"bb2aca32-cacd-4099-baf9-12d579815045","order":123,"text":"Before taking or publishing identifiable photographs, audio or video for publicity or fundraising, the Organisation must provide clear notice of the intended use and audience and obtain any consent required by DPP3. Event signage alone may not be sufficient for close-up images, interviews, children, beneficiaries or sensitive settings.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"69b3c8e1-dd18-4fd3-950e-980ff08df19d","order":124,"text":"20. TRAINING, MONITORING AND AUDIT","fontSize":"16","textAlign":"left","bold":true,"underline":false,"marginBottom":"10","cflou":false,"active":true,"marginTop":"10","sectionNum":"S20"},{"id":"1e376084-7f83-40eb-b1f4-60589623d104","order":125,"text":"All persons with access to Personal Data must receive privacy and security training appropriate to their role before or promptly after access is granted, and refresher training at reasonable intervals. Personnel handling donor payments, beneficiary files, safeguarding information, volunteer screening, access requests or system administration require role-specific instruction.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"d992cf57-c949-453e-b7b4-8f1c03cc0269","order":126,"text":"The Privacy Contact must monitor compliance through access reviews, processor reviews, retention checks, incident trends, PICS sampling and periodic audits. Findings must have an owner and target date. Serious or repeated failures must be escalated.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"1dd1f72c-0fa6-47d2-b250-636e04dbfbb3","order":127,"text":"The Organisation must protect a person who raises a privacy concern in good faith from retaliation, subject to procedures for knowingly false or abusive allegations.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"0cd414ce-bc8b-46ac-b59c-4271923ad066","order":128,"text":"21. COMPLAINTS AND COOPERATION WITH AUTHORITIES","fontSize":"16","textAlign":"left","bold":true,"underline":false,"marginBottom":"10","cflou":false,"active":true,"marginTop":"10","sectionNum":"S21"},{"id":"58d3a59f-2128-4cee-90f5-30a4f02a3a49","order":129,"text":"Privacy questions and complaints may be sent to [Name or job title of the privacy contact] at [Privacy contact email] or [Privacy contact telephone]. The Organisation must acknowledge a complaint, investigate it fairly, preserve relevant records, communicate the outcome and record remedial action.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"adb4ac3f-f88a-4157-b571-1760f70c26fb","order":130,"text":"Postal address for privacy questions and complaints: [Postal address for privacy requests]","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"c09d6b9b-de74-439e-8748-144cf70e080e","order":131,"text":"Nothing in this Policy prevents an individual from contacting the Office of the Privacy Commissioner for Personal Data, Hong Kong. The Organisation must cooperate lawfully with the Commissioner, courts and other competent authorities while protecting Personal Data from excessive disclosure.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"173b0623-3c2a-4545-89a3-2799f89a72d2","order":132,"text":"22. REVIEW, EXCEPTIONS AND APPROVAL","fontSize":"16","textAlign":"left","bold":true,"underline":false,"marginBottom":"10","cflou":false,"active":true,"marginTop":"10","sectionNum":"S22"},{"id":"57947b62-626b-4451-b055-2bbb31e9f2ee","order":133,"text":"The Privacy Contact must review this Policy at least annually and after a material legal change, new programme, significant technology change, high-risk processor appointment, overseas transfer, serious incident or audit finding. Changes require approval under the Organisation's governance rules and must be communicated before they affect a Data Subject's rights or expected use of data.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"ba55021d-7b6d-4e8c-b40a-ec6f63dff70d","order":134,"text":"An exception may be granted only where it is lawful, necessary, documented, time-limited, approved by the Privacy Contact and an authorised senior officer, and supported by compensating controls. No exception may waive a Data Subject's statutory rights or authorise a contravention of the PDPO.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"a1fe6276-ea11-43c4-b2b8-9f9200d2aa31","order":135,"text":"Approved for and on behalf of [Full legal name of the Organisation] by [Approving body] on [Approval date].","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"a5734c1c-9da0-4ec1-961c-490c9f10c8d2","order":136,"text":"Authorised signature: ______________________________","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"69d3a04d-537a-4418-9859-64602a57e6ec","order":137,"text":"Name and capacity: ________________________________","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"f3fdbf48-d6a8-468f-a7b7-bcdf9d7af367","order":138,"text":"Date: _____________________________________________","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"0547997d-7b0d-435d-9643-db9a998bb5f3","order":139,"text":"APPENDIX A: RETENTION SCHEDULE","fontSize":"16","textAlign":"center","bold":true,"underline":false,"marginBottom":"20","cflou":false,"active":true,"marginTop":"30"},{"id":"a16ce8e9-d255-46ed-9d1e-7de1e51ec01e","order":140,"text":"The following periods apply unless a shorter period meets the purpose or a longer period is required by law, a legal hold, an active dispute, safeguarding needs or another documented justification. At expiry, records must be securely erased or irreversibly anonymised.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"82c75670-ce9c-4c56-ba90-470ee19b7952","order":141,"text":"Donation, payment, tax receipt, financial and audit records: [Donation and financial records: years] years after the end of the financial year to which the record relates. Where section 51C of the Inland Revenue Ordinance applies, these records must in any event be kept for at least seven years after completion of the relevant transaction. If the configured period would end earlier, the later statutory date prevails.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"6b6c2867-9692-459d-b313-c1726dd722fa","order":142,"text":"Former member core administration and governance records: [Former member records: years] years after membership ends. Permanent minutes, resolutions or registers may be retained where the Organisation's constitution or applicable law requires them.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"1e422d3d-d63a-441d-8e0a-6b3ca30b418d","order":143,"text":"Unsuccessful volunteer application and screening records: [Unsuccessful volunteer applications: months] months after the application closes, unless a complaint, safeguarding concern or legal claim justifies longer retention.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"3a02a1e5-79fa-462d-bfe6-d8121752663e","order":144,"text":"Former volunteer service, training, expense, incident and safeguarding records: [Former volunteer records: years] years after the engagement ends, subject to a longer period where the nature of the role or a safeguarding need justifies it.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"4d9b8b13-06a7-4673-af48-8bc6fbede11a","order":145,"text":"Direct Marketing suppression records may be kept for as long as reasonably necessary to ensure that an opt-out continues to be honoured. They must contain only the minimum data required for suppression.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"73456d13-ad86-4652-af1a-c77610484f34","order":146,"text":"Data access, correction, complaint and breach records must be kept for a documented period that permits the Organisation to demonstrate how it handled the matter, taking account of applicable limitation periods and regulatory needs.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"ce53ed0d-9d36-4f1c-9118-5380dc9fe298","order":147,"text":"APPENDIX B: DONATION FORM PERSONAL INFORMATION COLLECTION STATEMENT","fontSize":"16","textAlign":"center","bold":true,"underline":false,"marginBottom":"20","cflou":false,"active":true,"marginTop":"30"},{"id":"8ca8e5f2-f158-4c74-b7f5-24bbf90c1feb","order":148,"text":"This PICS must appear on the donation form or through a clear link displayed before the donor submits Personal Data.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"fba6ecc0-6006-4f37-bc8c-3fb80b1f084b","order":149,"text":"The Organisation: [Full legal name of the Organisation]","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"254ee230-a2b9-4d4c-b7fd-848f78388b97","order":150,"text":"Principal address: [Principal address]","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"b7180e5f-a184-4913-837f-d8375b12ab13","order":151,"text":"Supply of data: Fields marked with an asterisk are obligatory for processing the selected payment, issuing a requested receipt, or meeting applicable financial controls. If you do not provide obligatory data, we may be unable to process the donation or issue the receipt. Other fields are voluntary.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"b146ae6f-ba45-469f-9dda-9b0b01f00eeb","order":152,"text":"Purposes: We will use your Personal Data to process and acknowledge your donation, issue receipts, maintain financial and audit records, prevent and investigate fraud, respond to your enquiries, comply with legal obligations and manage our relationship with you.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"a840a7cf-c2d1-4633-a111-0ff0075652cf","order":153,"text":"Classes of transferees: We may disclose relevant data to banks and payment processors, receipt and mailing providers, information technology and cloud service providers acting for us, auditors, insurers, professional advisers, regulators, law enforcement bodies and other persons where disclosure is required or permitted by law. We will disclose only the data reasonably necessary for the relevant purpose.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"f99f1e28-b839-4c4d-a9cd-55ab667f4308","order":154,"text":"Direct Marketing notice: We intend to use your name, email address, postal address, telephone number and communication preferences for Direct Marketing of our charitable appeals, fundraising campaigns, events, membership opportunities, volunteer opportunities and non-profit programmes. We may not use your Personal Data for this purpose without your consent. We will not provide it to another person for that person's Direct Marketing.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[{"field":"dfc4dced-b56c-4ecc-97fd-51a2e004570a","value":"Yes","type":"add","operator":"="}]},{"id":"a8749f5d-a883-4447-9c1f-672047f68483","order":155,"text":"Place an unticked consent box next to this optional statement: \"I consent to [Full legal name of the Organisation] using my name, email address, postal address, telephone number and communication preferences for Direct Marketing of the subjects described above. I understand that I may opt out at any time, without charge, by contacting [Privacy contact email].\"","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[{"field":"dfc4dced-b56c-4ecc-97fd-51a2e004570a","value":"Yes","type":"add","operator":"="}]},{"id":"106bcdc6-934d-49f3-b7b4-3df4eec83d74","order":156,"text":"We will not use the Personal Data collected through this form for Direct Marketing. Communications needed to process or administer your donation are not affected.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[{"field":"dfc4dced-b56c-4ecc-97fd-51a2e004570a","value":"No","type":"add","operator":"="}]},{"id":"3e0ebe60-6a3a-40e9-9f64-74c45ec3bfa4","order":157,"text":"Access and correction: You have the right to request access to and correction of your Personal Data held by us. Send requests to [Name or job title of the privacy contact] or [Privacy contact email]. A data access request may need to be made on the form specified by the Privacy Commissioner.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"57adf423-6f7a-4a80-ab36-378a0a5cca63","order":158,"text":"Postal address for access and correction requests: [Postal address for privacy requests]","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"7be71c5f-8c61-4ad9-a5c3-9c83baf5dfe5","order":159,"text":"Privacy enquiries: [Privacy contact telephone] | [Privacy contact email] | [Website]","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"59c77288-14df-48e3-b57f-a63fcf728899","order":160,"text":"APPENDIX C: MEMBERSHIP FORM PERSONAL INFORMATION COLLECTION STATEMENT","fontSize":"16","textAlign":"center","bold":true,"underline":false,"marginBottom":"20","cflou":false,"active":true,"marginTop":"30"},{"id":"a87a1913-0bd4-4930-b759-9e0f2295117c","order":161,"text":"This PICS must appear on the membership application or renewal form, or through a clear link displayed before submission.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"83e91a55-b415-4af8-9439-104c4dbcf916","order":162,"text":"The Organisation: [Full legal name of the Organisation]","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"0a847d33-b305-4066-996c-8271fe4fad1a","order":163,"text":"Principal address: [Principal address]","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"3d75c67d-f5a6-49aa-bde5-3785db452bab","order":164,"text":"Supply of data: Fields marked with an asterisk are obligatory for assessing eligibility, processing the application and administering membership. If you do not provide obligatory data, we may be unable to consider the application or provide membership rights and services. Other fields are voluntary.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"476b27a4-2ba4-4e99-801e-ce515808c0dd","order":165,"text":"Purposes: We will use your Personal Data to assess and process your application, verify eligibility, maintain the membership register, collect subscriptions or fees, provide member services, convene meetings, administer voting and governance, communicate notices and activities, keep financial and audit records, handle complaints and comply with legal and constitutional duties.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"76431cd5-ba6f-4dee-b85c-f996a3fae9b6","order":166,"text":"Classes of transferees: We may disclose relevant data to payment processors and banks, meeting and election service providers, information technology and cloud service providers acting for us, auditors, insurers, professional advisers, regulators and other persons where disclosure is required or permitted by law. Membership details will not be published in a directory or on a website unless the intended publication and audience have been stated and any required consent has been obtained.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"f125e5a1-b741-4b75-b612-6985e4a4fafa","order":167,"text":"Direct Marketing notice: We intend to use your name, email address, postal address, telephone number and communication preferences for Direct Marketing of our events, membership opportunities, charitable appeals, fundraising campaigns, volunteer opportunities and non-profit programmes. We may not use your Personal Data for this purpose without your consent. We will not provide it to another person for that person's Direct Marketing.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[{"field":"dfc4dced-b56c-4ecc-97fd-51a2e004570a","value":"Yes","type":"add","operator":"="}]},{"id":"5e63724f-7511-43a0-a001-df7479632fee","order":168,"text":"Place an unticked consent box next to this optional statement: \"I consent to [Full legal name of the Organisation] using my name, email address, postal address, telephone number and communication preferences for Direct Marketing of the subjects described above. I understand that I may opt out at any time, without charge, by contacting [Privacy contact email].\"","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[{"field":"dfc4dced-b56c-4ecc-97fd-51a2e004570a","value":"Yes","type":"add","operator":"="}]},{"id":"6e6947d5-963e-4e6f-a244-7bd27eddd926","order":169,"text":"We will not use the Personal Data collected through this form for Direct Marketing. Communications required to administer membership, meetings, voting, fees and governance are not affected.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[{"field":"dfc4dced-b56c-4ecc-97fd-51a2e004570a","value":"No","type":"add","operator":"="}]},{"id":"f3876980-e634-45e4-80ae-f0623abb8d02","order":170,"text":"Access and correction: You have the right to request access to and correction of your Personal Data held by us. Send requests to [Name or job title of the privacy contact] or [Privacy contact email]. A data access request may need to be made on the form specified by the Privacy Commissioner.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"04e09592-92d4-412e-8617-2bc3b579dcca","order":171,"text":"Postal address for access and correction requests: [Postal address for privacy requests]","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"4b008cfc-5866-4e0b-a134-b783f037fb88","order":172,"text":"Privacy enquiries: [Privacy contact telephone] | [Privacy contact email] | [Website]","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"e2fc1532-0f0c-486d-a351-6fef161d8fcf","order":173,"text":"APPENDIX D: VOLUNTEER FORM PERSONAL INFORMATION COLLECTION STATEMENT","fontSize":"16","textAlign":"center","bold":true,"underline":false,"marginBottom":"20","cflou":false,"active":true,"marginTop":"30"},{"id":"c23545a1-3acd-4a29-8ab6-001b789eac01","order":174,"text":"This PICS must appear on the volunteer application, onboarding or placement form, or through a clear link displayed before submission.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"248bb694-61b5-4f96-9f32-fbd1c24abb11","order":175,"text":"The Organisation: [Full legal name of the Organisation]","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"982fc8ce-a2fa-45d0-b41f-ab7b1ec4dab3","order":176,"text":"Principal address: [Principal address]","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"32f44dbd-9166-4ff7-b44e-e05fe6d6f60f","order":177,"text":"Supply of data: Fields marked with an asterisk are obligatory for assessing suitability, arranging a placement and meeting safety or safeguarding requirements. If you do not provide obligatory data, we may be unable to assess the application or offer a volunteer role. Other fields are voluntary. Health, adjustment, emergency contact and safeguarding information should be requested only where relevant to the role.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"b0dae2b1-3cbb-41c1-8f58-6f17c4e8f981","order":178,"text":"Purposes: We will use your Personal Data to assess your application, contact referees where notified, verify role requirements, allocate and supervise work, arrange training and access, support health and safety, make reasonable adjustments, protect beneficiaries and volunteers, administer expenses and insurance, investigate incidents or complaints, maintain service records and comply with legal obligations.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"f9c01c18-0aaf-4d97-a7e4-dced5b9a61bd","order":179,"text":"Classes of transferees: We may disclose relevant data to referees contacted with notice, screening or safeguarding bodies where lawful and necessary, insurers, training and placement partners, information technology and cloud service providers acting for us, professional advisers, regulators, law enforcement bodies and other persons where disclosure is required or permitted by law. We will not disclose health or safeguarding information to a placement partner unless it is necessary and proportionate for safety, support or a legal duty.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"66bfa262-ce3a-4222-aa19-5a74772725b7","order":180,"text":"Direct Marketing notice: We intend to use your name, email address, postal address, telephone number and communication preferences for Direct Marketing of our volunteer opportunities, events, charitable appeals, fundraising campaigns, membership opportunities and non-profit programmes. We may not use your Personal Data for this purpose without your consent. We will not provide it to another person for that person's Direct Marketing.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[{"field":"dfc4dced-b56c-4ecc-97fd-51a2e004570a","value":"Yes","type":"add","operator":"="}]},{"id":"166d5654-b54b-4d27-84ea-404ca1e4f36f","order":181,"text":"Place an unticked consent box next to this optional statement: \"I consent to [Full legal name of the Organisation] using my name, email address, postal address, telephone number and communication preferences for Direct Marketing of the subjects described above. I understand that I may opt out at any time, without charge, by contacting [Privacy contact email].\"","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[{"field":"dfc4dced-b56c-4ecc-97fd-51a2e004570a","value":"Yes","type":"add","operator":"="}]},{"id":"0d3a868d-9606-4115-bb67-f4281a73488f","order":182,"text":"We will not use the Personal Data collected through this form for Direct Marketing. Communications required to assess or administer your volunteer relationship are not affected.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[{"field":"dfc4dced-b56c-4ecc-97fd-51a2e004570a","value":"No","type":"add","operator":"="}]},{"id":"da9cc85c-e829-40ca-88da-d175d4fca31d","order":183,"text":"Access and correction: You have the right to request access to and correction of your Personal Data held by us. Send requests to [Name or job title of the privacy contact] or [Privacy contact email]. A data access request may need to be made on the form specified by the Privacy Commissioner.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"2c5a8e17-5640-4939-ab99-a423caff645a","order":184,"text":"Postal address for access and correction requests: [Postal address for privacy requests]","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"62b788bd-c013-4fea-ab3c-6d7713c05cbf","order":185,"text":"Privacy enquiries: [Privacy contact telephone] | [Privacy contact email] | [Website]","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"069df58a-faef-4b04-b56f-f569c10dfaa6","order":186,"text":"APPENDIX E: FORM DEPLOYMENT CHECKLIST","fontSize":"16","textAlign":"center","bold":true,"underline":false,"marginBottom":"20","cflou":false,"active":true,"marginTop":"30"},{"id":"aa7f3443-4848-49ea-9ca6-18362b9e2db0","order":187,"text":"Before publishing a donation, membership or volunteer form, the responsible owner must confirm that the PICS is displayed on or before collection, mandatory fields and consequences are accurate, purposes and transferee classes match the actual process, optional fields are genuinely optional, Direct Marketing consent is separate and unbundled, the response channel works, the privacy contact details are current, online transmission is secure, the retention period is assigned, and processors and overseas access have been reviewed.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"87fdf992-a20e-45ad-8ece-9fa787880f60","order":188,"text":"The form owner must retain the approved version of the form and PICS, the date it went live, and evidence of the consent wording used. Material changes to purpose, recipients, Direct Marketing, technology or overseas access require privacy review before deployment.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true}]