We value your continued trust in us and we are dedicated to observing and complying with the core principles and fundamental values of transparency, security and integrity when dealing with your personal data. We pledge to uphold the Data Protection Principles as set out in the PDPO when collecting and using your personal data in the following manner:

Purpose and Manner of Collection:
We will only collect personal data through lawful and fair means for a lawful purpose directly related to a function or activity of Airport Authority and will only collect data that is necessary and adequate but not excessive for such purpose.

Accuracy and Duration of Retention:
We will take all practicable steps to ensure your personal data is accurate and is not kept longer than is necessary for the fulfilment of the purpose for which the data is used.

Use of Data:
We will not use your personal data for any new purpose which is not or is unrelated to the original purpose when we collect your personal data, unless we have obtained your express consent.

Data Security:
We will take all practicable steps to protect your personal data which we hold against unauthorised or accidental access, processing, erasure, loss or use.

Openness and Transparency:
We will take all practicable steps to ensure openness of our personal data policies and practices, the kind of personal data held by us and the main purposes for holding it.

Access and Correction:
We respect your right to request access to and correction of your own personal data held by us, and we will comply with such requests to the extent that we are able to.

Throughout this Privacy Policy, the term "personal data" means any data relating directly or indirectly to you, from which it is practicable for your identity to be directly or indirectly ascertained, and in a form in which access to or processing of the data is practicable.

This section “To whom may we transfer your personal data generally?” of General Terms is not applicable to the service of “Flight Token”.

Your personal data will be kept confidential and will not be disclosed to any third party except as set out in this Privacy Policy or such disclosure as permitted or required under the applicable laws or as allowed under the PDPO.

We may engage third party service providers including third party system maintenance service providers (who may be located outside Hong Kong) who are acting for, on behalf of or jointly with us, to achieve the purposes for each of the specific services, and in this connection we will provide your personal data to such service providers provided that they shall use and handle your personal data in accordance with this Privacy Policy. Please refer to the Specific Terms for individual services which may have additional information.

In general, we may transfer your personal data with the following classes of transferees:

(a) Any person or company (including third party agent or sub-contractor) who is acting for, on behalf of or jointly with us, or any of our service providers including third party system maintenance service providers; in all such cases, disclosure may take place to fulfil any of the purposes, provided that such third parties to whom your personal data is communicated are subject to confidentiality and privacy obligations that are materially equivalent to those set out in this Privacy Policy;
(b) Any financial institutions, charge or credit card issuing companies, credit information or reference bureaus, or collection agencies where necessary to establish and support the payment of any products and services being requested by you; and
(c) Any other third party where such disclosure is mandated by statutory or contractual obligations or as required by law or court of law, or where such disclosure is necessary to protect our interests (as permitted by law).

We will not retain your personal data, including any tokenised personal data, for a period longer than it is necessary for us to achieve the purposes for each service set out in this Privacy Policy, including to prepare statistics and conduct analytics and research for the continuous improvement of our operation of as well as our facilities and services. Due to the different purposes for which we collect and use the personal data, we may apply different retention periods for the personal data we hold. Please refer to the Specific Terms for individual services which may have additional information.

Notwithstanding the aforesaid, if any personal data is required as specified under applicable laws or in connection with any legal proceedings to be kept for a period of time which may be longer than is expressly provided in this Privacy Policy, the same will be retained but we will take all practical steps to ensure that such data will not be kept longer than is necessary for the fulfilment of such purposes.

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

When you provide personal data of a third party to us, you agree that you have secured the relevant third party’s consent to provide us with their personal data (to be collected, used and stored in accordance with this Privacy Policy) prior to such provision by you.

Where applicable, we may feature embedded links, "share" buttons or widgets on our websites or app(s) which enable you to connect to third party sites, including social media sites. These third-party sites may set cookies which can identify you as an individual when you are logged in to their services. We do not control these cookies or how these sites collect and handle your personal data.

If the services you use require payment of money, you will be redirected to a secure third-party website belonging to our payment gateway service provider to complete payment of any purchase. Payment-related personal data (including but not limited to the cardholder’s full name, card number prefix, cardholder’s billing address, card verification value (CVV) and card expiry date) will be collected by the payment gateway service provider for processing your order's payment as well as other incidental purposes. We will not be able to provide the services to you if you do not provide the data.

When you visit Hong Kong International Airport ("HKIA"), certain third parties within HKIA which are unrelated to us may also collect and use your personal data when you use their services or where they are authorised by law to do so. This includes (but is not limited to) third party airline companies, the Immigration Department of the Government of Hong Kong Special Administrative Region ("HKSAR") and other third-party service providers within HKIA. The collection and use of your personal data by such third parties are subject to the privacy policies and terms and conditions of such third parties. We do not control such collection and use of your personal data by such third parties and we will not be responsible for the same.

You have the right to access, verify or update any of your personal data that we hold. An access request form can be downloaded from the website of the Office of the Privacy Commissioner for Personal Data, Hong Kong.

You may also request the Authority to correct the personal data that you have accessed if such data is inaccurate. We will handle your request as soon as possible.

Please note that under PDPO, the Authority has the right to charge a reasonable fee for complying with a data access request. Data access and correction requests can be addressed to our General Personal Data Officer (see "How can you contact us" section below).

If you wish to contact us regarding this Privacy Policy (including in relation to any of your rights under this Privacy Policy or any other questions you may have), please contact our General Personal Data Officer via the below address:

General Personal Data Officer
Airport Authority Hong Kong
HKIA Tower
1 Sky Plaza Road
Hong Kong International Airport
Lantau Island
Hong Kong

We do not use our website(s) or app(s) or service(s) to knowingly solicit any personal data or other information from any persons under the age of 18. If you are under 18, by providing us with your personal data, you agree that you have informed your parents and guardians about the Privacy Policy prior to such provision, and they have approved of such provision by you based on the terms of the Privacy Policy.

When you browse this website (or application), cookies will be stored in your computer or device's hard drive. Such cookies can be retrieved by this website (or application) to show the state of your web browser's previous visits to this website (or application). We will not collect any personal data from you under this circumstance. You have a choice not to accept the cookies, but if you do so, certain functionality of this website (or application) may not be available.

We regularly review this Privacy Policy, and the most up-to-date version of this Privacy Policy will be shown on this page.

Where terms of this Privacy Policy are available in other languages, the English version shall be the governing version and shall prevail whenever there is a discrepancy amongst versions.

We are proud to provide a variety of services for our visitors. As each service is unique, we have included privacy policy terms which are specific to the service you are interested in.

Please click on the Specific Terms for each service below.

When you use the Hong Kong International Airport (“HKIA”) official mobile application – My HKG App (“Application”), we will automatically collect information about your mobile device and Application usage, including: 

(a) device type; 
(b) version of underlying operating system; 
(c) version of the software being used; 
(d) type and version of browser(s); 
(e) how you use the Application including user browsing history, unique online device identifiers such as IP address, device ID, and domain name;
(f) if you register for a new, or sign in to an existing HKairport Rewards member account by accessing the HKairport Rewards webpage through a link on the Application (see more on Associated Services below), this fact; and
(g) device location, if you have allowed the Application to use location services on your bluetooth-enabled device (which can be disabled on the Application via settings) to enjoy map and wayfinding experience such as location-based boarding alerts and directions, as well as the latest information and updates about HKIA, and what is available in HKIA near your location.

In order to enjoy certain services (such as quick flight search without typing flight details and initiating an application for Flight Delay Insurance) on the Application, you will be required to scan your boarding pass, in which case we will collect an image of the bar/QR code on your boarding pass, including all information that may be retrieved from the bar code/QR code (if any) on the boarding pass, such as:

(a) your name;
(b) flight number;
(c) flight date;
(d) flight time; and
(e) flight destination. 

Our menu and rule-based enquiry chat function will not proactively collect, require, request and/or prompt you to provide any personal data or any personal identifiable information. If you use this function, do not enter any such data or information.

We may use information about your device and Application usage collected for the following purposes: 

(a) to enable us to better understand and analyse how the Application will be used and usage volume;
(b) to improve the contents of the Application; 
(c) to provide in-app services to enhance your travel or related experience;
(d) to prepare statistics and conduct analytics and research for the continuous improvement of the operation of as well as the facilities and services at HKIA;
(e) to send you notifications and communications including push notifications (which you can disable for the Application via settings on your device) and other service messaging about your flight and updates about HKIA; 
(f) (if you choose to enjoy automatic Wi-Fi connection at HKIA) to enable you to use StayConnected @ HKIA on your device;
(g) (if you register or signed into your HKairport Rewards member account during your use of Application) to display greeting messages tailored to HKairport Rewards members. 

We may use the following personal data retrieved from the bar/QR code on your boarding pass:

(h) (if you use flight search and tracking with your boarding pass) flight date, time and destination or origin to enable you to search for and/or track flight(s); and 
(i) (for Flight Delay Protection Programme only) flight number, departure destination and name to verify your eligibility in applying Flight Delay Insurance before you proceed to access this service from the relevant third party provider through a link in the Application (see below regarding websites, applications or platforms of independent third parties). 

Associated Services
These terms only apply to how data is collected and processed in relation to this Application and do not cover data processing activities of other websites, applications or platforms of the Authority. If we invite you to provide personal data for the purpose of signing in, registering with or making use of HKairport Rewards – HKIA Loyalty Programme, Baggage Arrival Notice Service, Valet Parking, Food Ordering System and other HKIA services of the Authority (collectively, “Associated Services”) which is associated with and/or accessible through the Application, please refer to separate Specific Terms for the applicable Associated Services.

Where on the Application we provide link(s) to the websites, applications or platforms of independent third parties, we strongly encourage you to read the privacy policies thereon as we cannot control nor are responsible for how they handle your information or personal data.

It is voluntary for you to use the Application and provide the personal data as described above. 

If you opt out of installing and using the Application, this means that you will not be able to enjoy the use of the Application. If you do not provide the personal data requested, we may not be able to provide you with certain services including Associated Services, and your personal data will not be collected or retained by the Authority.

Other than the classes of transferees to whom we may transfer your personal data, mentioned elsewhere in this Privacy Policy, for this Application and with your prior consent and/or your instruction, we may also share your personal data with third party providers of Associated Services before you access their website(s), apps(s) or platform(s) through a link on the Application.

We may use your personal data for direct marketing purposes, but we will not do so unless we have separately obtained your express consent. 

With your consent at the time we collect your personal data, we may use your personal data to send you the latest information about HKIA and invitations to surveys and programmes. We will contact you via your email. 

You may withdraw your consent to receive direct marketing materials from us by contacting us through the My HKG app (see “How can you contact us?” section above), or such other channels as we may announce from time to time at no cost to you.

Please note that if you choose to withdraw your consent to receive marketing communications, we will still send you administrative communications and updates about the Application.

Our general data retention policy is set out under “How long do we retain your personal data?” section below.

All personal data which directly identifies you (including but not limited to the personal data collected from the bar/QR code of any boarding pass that you scan) will be deleted after the purpose for which it is collected.

Personal data collected for flight search and track is deleted after you have searched and/or tracked your searched flight, while personal data collected for verifying eligibility for Flight Delay Insurance is deleted when it is transferred to the relevant provider of this Associated Service with your consent and left the Application page.

This Addendum to the Specific Terms for My HKG App applies to you if you are an individual in Mainland China. The terms set out in this Addendum are in addition to the terms set out in the Specific Terms for My HKG App and the General Terms and Pledge Statement (collectively the “Service Privacy Policy”), and therefore form an integral part of the Service Privacy Policy. In the event of any conflict or inconsistency between the Service Privacy Policy and the terms of this Addendum, this Addendum shall govern and prevail.

Your rights
Apart from the rights specified in the Service Privacy Policy, you are conferred by the applicable data protection laws and regulations in Mainland China with additional data subject rights as follows.

(a) Right to deletion. You have the right to request us to delete your personal data. However, this will need to be balanced against other factors such as statutory data retention.
(b) Right to restriction of processing. You have the right to request us to restrict the processing of your personal data. Please note that we may not be able to provide the Services if you do not allow us to process necessary personal data.
(c) Right to data portability. You have the right to request us to transfer your personal data that you have provided to us to a third party of your choice. This right can only be exercised in certain circumstances where applicable.
(d) Rights relating to automated decision-making. You have the right not to be subject to automated decision-making including profiling.
(e) Right to withdraw consent. We may ask for your consent to process your personal data where consent is necessary to be adopted as the lawful basis for processing the personal data. Where this is the case, you have the right to withdraw your consent.

If you want to exercise any of these rights, you can contact us using the contact details provided in the “Contact Us” section below.

We will respond to your requests of exercising your data subject rights in accordance with the applicable data protection laws and regulations in Mainland China. To the extent as permitted by applicable laws and regulations, we may not be able to respond to your request of exercising your rights in the following circumstances:

(a) If your request is contrary to our obligations under such laws and regulations;
(b) If the requested data is directly related to national security or national defence security;
(c) If the requested data is directly related to public safety, public health, or significant public interest;
(d) If the requested data is directly related to criminal investigations, prosecutions, trials and enforcement of judgments, etc.;
(e) If we have sufficient evidence of your subjective malice or abuse of rights;
(f) If it is in the interest of safeguarding your or other individuals’ significant legitimate rights and interests, such as life and property, but it is difficult to obtain your authorisation or consent;
(g) If responding to your request to exercise your rights would result in serious harm to your or other individuals’ or organisations’ legitimate interests;
(h) If the requested data involves trade secrets.

Contact us
Personal Data Handler: Airport Authority Hong Kong
Address: HKIA Tower, 1 Sky Plaza Road, Hong Kong International Airport, Lantau, Island, Hong Kong
Contact person: General Personal Data Officer
Email: prcdataprivacy@hkairport.com