Statement on General Data Protection Regulation of European Union

For individuals who are in the European Union (“EU”) and are subject to the EU’s General Data Protection Regulation (“GDPR”), in addition to the information provided to you under our Notice to Customers relating to the Personal Data (Privacy) Ordinance (Hong Kong) and Manulife Personal Information Collection Statement (Macao) (hereinafter collectively referred to as “Notice”), we set out below further information about our processing of your personal data, including what rights you have, and how to obtain further information.

The purposes set out in our Notice are necessary to allow us to perform our contractual obligations to you and to enable us to comply with applicable laws and regulations. We may also rely on legitimate interest in using and sharing your personal data for the purposes set out in our Notice to improve our products and services, except where by doing so would override your interests and fundamental rights and freedoms. If we need your consent to use your personal data for the purposes described in our Notice, we will only process your personal data if you have provided your consent.

1. Transfer of your personal data: Your personal data held by us will be kept confidential but we may transfer such data to the persons and/or entities as stated under our Notice and hence, we may transfer your personal data to a place outside Hong Kong. In the event where there is such transfer, we will use appropriate safeguards and comply with the relevant laws and regulations.
2. Keeping of your personal data: We will keep your personal data only for as long as we need to in order to fulfill the purposes we have collected it for and as required under applicable laws and regulations or as is otherwise necessary.
3. Automated decision making and profiling: If we are to use your personal data to conduct automated decision-making, including profiling, we will provide you with further information about the logic involved.
4. Your rights under the GDPR include:
   • requesting for a copy of your personal data;
   • requesting that we correct your personal data if it is incorrect, or complete any incomplete information;
   • asking us to delete your personal data if it is no longer required for the purposes set out in our Notice provided that such data is not necessary for compliance with a legal obligation or defense of any legal claims;
   • right to data portability by requesting to receive your personal data in a commonly used and machine-readable format;
   • restrict how your personal data is to be used if (i) you contest the accuracy of your personal data, (ii) processing is unlawful and you oppose to the erasure of the personal data, or (iii) we no longer need the personal data for the purposes set out in our Notice but you oppose to the erasure of your personal data for the establishment, exercise or defence of legal claims;
   • object to our use of your personal data for direct marketing, including any related profiling to the extent that it is related to such direct marketing;
   • making a complaint to a data protection authority or another independent regulator about how we may be using your personal data.