| This PICS is available in English and Chinese. In case of discrepancies among the versions, the Chinese version shall always prevail. |
HKUST(GZ) Personal Information Collection StatementThe Hong Kong University of Science and Technology (Guangzhou) (the “
University”) respects the personal data privacy of all individuals and pledges to be in compliance with the requirements of the Personal Information Protection Law (“
PIPL”) of the People’s Republic of China (“
PRC”) so that the privacy of your personal data is protected in accordance with the standard required by law. In doing so, we require all our staff and agents to comply with the PIPL in the same manner as the PIPL applies to the University as a whole and adhere to the strictest standards of security and confidentiality.
Before providing your personal information (“
PI”), please ensure that you have carefully read this Personal Information Collection Statement.
I.
Collection of PIThe University collects your PI directly from you when you apply for admission with the University and register to commence study with the University. You will also be required to supply the University with PI from time to time throughout your study. Please also ensure that the information you provided are accurate and complete. The University may collect your PI indirectly from publicly available sources, or from third parties to the extent permitted by the applicable law. Unless otherwise indicated, it is obligatory to supply the requested PI. Failure to provide the requested PI may result in the University not being able to process your admission application or provide you with the necessary support or assistance during your studies with the University, as the case may be, or even result in your inability to continue or complete study at the University, or failure to enjoy the services, benefits and facilities provided by the University. The University will only collect, hold, use and disclose PI to enable the University to meet legal obligations and where it is reasonably necessary or related to one or more of the University’s functions or activities.
(1) Types of PI to be collected
The types of PI collected or held by the University may typically include:
- Identification and personal information, such as name, age, gender, photo image, address, contact details, ID card or passport/entry permit numbers, nationality, racial or ethnic origin, religious or similar belief, family data.
- Contact details, such as address, telephone number, email address, social media account, emergency contact.
- Evaluative data created by the University or third parties, such as education background, academic, assessment and performance records, study data, test results, professional body associations, qualifications, scholarships, awards, work experience, and co-curricular data, and other activity records.
- Information provided by you or third parties to the University, such as bank account information, financial aid records, medical or health-related information, criminal records.
- Information collected by means of cookies, such as webpages visited, option chosen, and/or links clicked to access.
- Other information about you provided to the University with your consent.
(2) Collection of Sensitive PI
PI collected may also include your sensitive PI. Sensitive PI refers to PI that are likely to result in damage to the personal dignity of any natural person or damage to his or her personal or property safety once disclosed or illegally used, including such information as biometric identification, religious belief, specific identity, medical health, financial account and whereabouts and tracks, as well as the PI of minors under the age of 14. Such sensitive PI as may be collected from you is necessary for the University to provide you with its various services, including assistance to your academic studies, and for compliance with its various legal and regulatory obligations. When it becomes necessary to collect any sensitive PI from you, the University will solicit your consent in advance.
II.
Purposes for which and how your PI will be usedYour PI may be used by the University as follows:
- As basis for admission and related decisions as stipulated in the application processes, and evidence for verification of your identity and academic qualifications.
- Upon acceptance to the University, your PI will be transferred to the student information system. Together with additional PI such as your photo image and emergency contacts collected at the time of registration or at any time throughout your study, they become part of your student records which will be used by departments and offices of the University for all purposes and activities related to your studies and activities at the University, including but not limited to: -
- academic advising and assessment, student development, program planning and evaluation, verification of qualifications, communication, provision of student services and benefits,
- handling complaints, investigations, enforcing internal rules, regulations and policies, managing disciplinary issues,
- managing legal matters and litigation, or matters in connection with compliance with the law, regulation, court order or government directions,
- protecting the University’s and/or any affiliate of the University’s rights or properties,
- handling checks for concurrent registration at other institutions, as governed by the policies and regulations of the University, and/or
- other circumstances which the University considers to be related to any of the purposes for which the PI is collected.
- Upon graduation, part of your PI will be passed to the office responsible for alumni matters for communication, organizing alumni events and activities, provision of facilities and services, and related alumni administration.
- It is expected that your PI will also be used for research or statistical/analytical purposes to further the University’s mission;
- The University may from time to time use your PI collected through the University’s various systems/platforms and other interactions with you in marketing; and
- For all other purposes ancillary to the above purposes.
III.
Entrustment of processing, Sharing, Transfer and Public Disclosure of PIExcept otherwise provided for in any applicable law or regulation or required by any competent regulatory authority, the University will only disclose to any third party your PI, as necessary for the related service, in the following circumstances. Some of these parties may be located outside of the Mainland or the PRC.
(1) Entrustment of Processing
The University may engage external service providers and/or permit The Hong Kong University of Science and Technology (“HKUST”) to assist it in providing support or processing your PI on its behalf for the purposes set out in Clause II above.
The University will enter into non-disclosure agreements with the companies, organizations and individuals to whom the University entrusts the processing of PI, which will bind them to processing the PI in accordance with the University’s requirements, the Personal Information Collection Statement, and other relevant confidentiality and security measures.
(2) Sharing of PI
The University solicits your consent, pursuant to any applicable law or regulation or standard, and with your explicit consent, will share with the third party your PI. Such third party will include:
- HKUST and any other entity in which the University holds shares directly or indirectly or which the University engages for joint operation or cooperation, or any successor or transferee of the above, in the event that you apply or register for, or participate in programs, courses, activities, schemes, collaboration or other arrangements organized or offered by such entity or jointly organized or offered by the University and such entity;
- Any agent, contractor, advisor, or third-party service provider engaged by the University to provide services to or on behalf of the University, in order to fulfill any contract between us and you or between us and such service provider, including bankers, insurance companies, overseas institutions in the case of exchange programs or other academic collaboration, service suppliers, professional advisors (such as accountants, auditors and lawyers); and
- Partner institutions with which the University in collaboration jointly offers programs or other opportunities for use in marketing. The PI the University may use and/or provide to partner institutions for use in marketing includes your name, student/alumni number, year of graduation (actual or expected), program of study, employer name, contact details (home/office address, personal/business email address, phone number), enrolment records and demographic data as held by the University and updated from time to time. The types of marketing activities the University and/or partner institutions may conduct using your PI include (a) providing you with job posting information, academic program details, and information on fundraising initiatives, latest academic or other programs and events at the University and/or partner institutions and (b) conducting marketing or promotion for the University and/or partner institutions, including specific programs and initiatives of the University and/or partner institutions.
Your PI will be used by such third parties in accordance with their privacy policies. Please visit the third parties’ website for more details.
If you need to know any entity or individual who is involved in the circumstances (i) to (iii) under this Clause III(2), you may contact us at the information stated in Clause VIII below, noting “Third-Party Data Inquiry” in the subject line, to which the University will respond within a reasonable time from receiving the email.
If you wish to exercise your rights or need more information or clarification on specific PI processing by any of the above third parties you may also contact us at the information stated in Clause VIII below.
To facilitate your requests, we may liaise with any third parties located within or outside the PRC on your behalf.
The University may share your PI pursuant to any obligation under any applicable law or regulation or the need to enforce any legal proceeding, or the requirement raised by any competent government authority according to law.
(3) Transfer
The University will not transfer your PI to any third party, unless:
- Your prior explicit consent or authorization has been obtained;
- It involves any merger, acquisition, or insolvency and liquidation proceedings, where, if the transfer of your PI is involved, the University will require that any succeeding third party that comes to hold your PI continue to be bound by the Personal Information Collection Statement; otherwise, such third party shall re-solicit your consent.
(4) Public Disclosure
The University will not disclose your PI to the public, unless:
- Your prior explicit consent has been obtained.
- The University does so pursuant to any mandatory requirement of any applicable law or regulation, legal proceeding or competent government authority.
IV.
Security and Retention of PI (1) Security of PI
- Your PI is created, stored and transmitted securely in a variety of paper and electronic formats. This includes databases that are shared across the University, or provided by externally hosted and supported systems. The University will take appropriate steps to protect the PI held by it against unauthorized or accidental access, use, loss, processing, erasure, transmission, modification or disclosure. When the University needs to disclose, transfer or assign PI to outside third-parties, the University will take appropriate steps to protect the privacy of the PI to be disclosed, transferred or assigned (for example, requiring third-party service providers to keep confidential any PI with which it comes into contact).
- The University will take any and all reasonable and feasible measures to protect your PI and the University ensures that the University will not collect any PI that is irrelevant to achieving the purpose for processing your PI as stated in the Personal Information Collection Statement.
- The Internet is not 100% safe and secure, and the University will do its best to ensure the safety of the PI that you provide us through the Internet. In the event of any PI leakage, the University will promptly inform you of the leakage and its possible consequence, the action the University has taken or will take, and any action you may take, pursuant to the applicable law or regulation. The University will promptly notify you by email, regular mail, telephone or push notification and if it is too difficult to reach all the owners of the PI, the University will make a public announcement in a reasonable and effective manner.
(2) Retention of PI
In principle, the University will only store your PI within the time limit that is necessary for us to perform the service for you, which is the longer of the following:
- the period that is necessary to deliver the purposes stated in the Personal Information Collection Statement, unless the extended retention is required or allowed by laws;
- the period that the University can ensure the safety and quality of the service for you; or
- the period specified in any applicable law or regulation;
Our retention periods are based on operation needs and your PI that is no longer needed is either irreversibly anonymized (and the anonymized information will be retained) or securely destroyed. For instance, after you leave the University and in meeting the University’s public task and legal obligations, the PI relating to your degree award may be retained.
V.
Your Rights Pursuant to applicable laws, regulations and standards of the PRC and any other national or regional practice, you may exercise the following rights to your PI:
(1) Access your PI
You have the right to access your PI, unless laws and regulations specify otherwise. If you wish to access your data, you can do so by sending an email to us at the contact details stated in Clause VIII noting “Personal Information Inquiry” in the subject line. The University will respond to your access request within a reasonable time.
As for other PI generated during your course of study with the University, the University will provide you with access to such information as long as no excessive input is required. If you wish to access such data, please send an email to the contact details stated in Clause VIII noting “Personal Information Inquiry” in the subject line.
(2) Rectify your PI.
When you find a mistake in your information that the University is processing, you have the right to ask us to rectify it. You can send an email to us at the contact details stated in Clause VIII noting“Personal Information Correction Request” in the subject line. The University will respond to your rectification request within a reasonable time.
(3) Delete your PI
You can submit a request to delete your PI to us under the following circumstances:
1. If our processing of PI violates laws or regulations;
2. If the University collected and used your PI without your consent;
3. If our processing of PI breaches our agreement with you;
4. If you no longer use our services or you have cancelled your account with us (if applicable); or
5. If the University no longer provides you with services.
When your PI is removed from our service system, the University may not immediately delete the same from our backup system until the related backup is updated.
(4) Change the scope of or withdraw your consent
Different PI may be required in order for us to perform any single service. You may change the scope of PI you have agreed for us to process, or withdraw your consent, with respect to any single service, by sending an email to the contact details at Clause VIII. The University will respond within a reasonable time to confirm your request. When you withdraw your consent, the University will cease processing your PI concerned and become unable to continue to perform the related service for you, which, however, will not affect any previous processing of your PI on the basis of your consent.
(5) To obtain a copy of your PI
You have the right to obtain a copy of your PI by sending us an email at the contact details stated in Clause VIII, to which we will respond within a reasonable time.
(6) To restrict the Information System in automated decision-making
For certain services, the University may make decisions solely on the basis of nonhuman automatic decision-making mechanisms, including the Information System or algorithms. If any of your legal rights or interests is significantly affected, you may require an explanation or refuse to accept our decisions made by the automated decision-making system, by contacting us by the contact details stated in Clause VIII, to which we will respond within a reasonable time.
(7) To respond to your requests hereinabove
For security reasons, the University may require that you should provide a written request or identify yourself in any other way. The University may also require that your identification be verified before your request may be processed. The University will respond to you within a reasonable time of receiving your request.
The University will not charge you, in principle, if you have raised a reasonable request, but may ask you to pay for the cost, depending on the situation, if the same request has been raised for multiple times or the reasonable extent is exceeded. The University may reject any request that is unreasonable and filed repeatedly, that require us to offer any technical means that we cannot reasonably offer (for example, to develop a new system or fundamentally change the existing practice), or that brings any risk to any legal right or interest of any other person, or that is too hard to be feasible (for example, to create a backup copy for the information stored on the magnetic tape).
Also, if it is so required under any special provision of any applicable law or regulation, or pursuant to any legitimate requirement of any administrative, judicial or other competent authority, the University may not be able to respond to your request.
VI.
PI of Minors If you are under the age of 14, please consult your parents or guardian(s) on the contents of the Personal Information Collection Statement, and ensure that you understand the matters set out therein. You should obtain the written consent of your parent or guardian before providing your PI to the University.
The PI of a minor that the University has collected with the consent of the parent or guardian will not be shared, transferred or disclosed publicly, unless it is allowed under the applicable law, the explicit consent of the parent or guardian is obtained or it is necessary to do so in order to protect the minor.
If the University discovers that it has collected the PI of any minor without first obtaining the verifiable consent of the parent or guardian, the University will delete such PI as soon as practicable pursuant to the applicable law.
If you are the guardian of a minor and you have any question regarding the PI of the minor, please contact us by the contact details stated in Clause VIII.
VII.
How your PI is transmitted worldwide In principle, the PI that the University collects and generates within the PRC will be stored within the PRC.
The University provides services based on its resources and servers worldwide, that is to say, with your consent, your PI might be transmitted to or accessed from a jurisdiction outside of the country/region where you are located.
Such jurisdiction might have a different data protection law, or even no relevant laws. Under such circumstances, we will ensure that your PI will enjoy the same level of protection as it does in the PRC. For instance, we will ask you for your consent to the cross-border transmission of your PI, or employ data de-identification and other security measures before the cross-border transmission of data.
VIII.
Enquiries For matters relating to this Personal Information Collection Statement, you may contact the departments as follows:-
Department of Postgraduate Outreach and Admissions, Fok Ying Tung Graduate School
Email: pgadmitgz@hkust-gz.edu.cn
Department of Academic Registry Services
Email: gzars@hkust-gz.edu.cn
Please mark all communications “Confidential”.
IX.
Update of This Personal Information Collection Statement The University reserves the right of interpretation for all terms as stated in this Personal Information Collection Statement. This Personal Information Collection Statement may from time to time be revised, or otherwise changed as the University deems necessary but the University will endeavor to give you advance notice of any such revision or change where practicable.