Australia Data Privacy Notice
Candidate Registration Privacy Notice
Before we begin
This notice (Privacy Notice) applies to personal information relating to your registration on our job applicant registration site at https://mycareer.hsbc.com/talentcommunity . By personal information, we mean information or an opinion from which you can be identified or are reasonably identifiable. Your personal information will be held by HSBC Group and members of the HSBC Group, as described below. It explains what personal information we collect about you, how we’ll use that personal information, who we’ll share it with, the circumstances when we’ll share it and what steps we’ll take to make sure it stays private and secure. This Privacy Notice covers all aspects of your interaction with HSBC in your capacity as a registrant.
Some of the links on our websites lead to other HSBC or non-HSBC websites with their own privacy notices or policies, which may be different to this notice. You’ll need to make sure you’re happy with their privacy notices or policies when using those other sites.
Wherever we’ve said ‘you’ or ‘your’, this means you or any authorised person who engages with us on your behalf (e.g. recruitment agencies you have authorised to liaise with us on your behalf).
When we say ‘we’, we means HSBC Bank Australia Limited ABN 48 006 434 162.
By providing your personal information to us, you consent to our collection, use and disclosure of your personal information in accordance with this notice and any other arrangements that apply between us. We may modify or update this notice from time to time by publishing it on the website.
What personal information we collect
We’ll only collect your personal information in line with relevant regulations and law. We may collect it from a range of sources and it may relate to any of the roles you may apply for, or have held in the past both within and outside of the HSBC Group. We may also collect personal information about you when you interact with us, e.g. call us, visit our websites or mobile channels, or use services we make available to you.
Most of it will come directly from you because you have volunteered to provide that personal information to us. It can also come from your previous employers, other HSBC companies, or other sources you’ve asked us to obtain personal information from or you have provided us with the details of. We might also get some of it from publicly available sources.
If you do not provide your personal information to us, you will not be able to register on our job applicant registration site.
Personal information that you provide to us, e.g.:
The personal information we collect may include:
• Personal details, e.g. name, previous names, date and place of birth and employment history;
• Contact details, e.g. address, email address, telephone numbers;
• Information concerning your identity e.g. photo ID, passport information, birth number (or equivalent) and nationality;
• Information concerning any qualifications you hold e.g., university education, professional certifications;
• Curriculum vitae or resumes you have provided including any other documents which provide details of your qualifications and work experience,
• Market research, and information and opinions expressed when participating in surveys; and
• Other information about you that you give us by filling in forms or by communicating with us (e.g. interviews or assessments), whether face-to-face, by phone, email, online, or otherwise.
You may also be invited to supply some diversity information as part of your profile, including but not limited to your age range, gender, physical needs, sexual orientation or racial/ethnic origin which is your choice to provide if you wish. This information, if you decide to provide it, will be used only for reporting on the diversity of our candidate base across the organisation, or to assist if you have any special requirements or needs as part of the recruitment process or your ongoing employment.
Personal information we collect or generate about you, e.g.:
• Information we use to identify and authenticate you, e.g. your signature, or additional information that we receive from external sources that we need for compliance purposes;
• Cookies and similar technologies we use to recognise you, remember your preferences and tailor the content we provide to you – our cookie policy contains more details about how we use cookies and can be found on our website www.hsbc.com.au;
• Investigations data, e.g. due diligence checks, fraud, sanctions and anti-money laundering checks, external intelligence reports, content and metadata related to relevant exchanges of information between and among individuals, organisations, including emails, voicemail, live chat;
• Application data including information about your individual performance in assessments or online tests;
• Records of correspondence and other communications between us, including email, live chat, instant messages and social media communications;
Personal information we collect from other sources, e.g.:
• Personal information you’ve asked us to collect for you or we collect as part of our vetting process, e.g. work references from previous employers.
Why we collect, hold, use and disclose your personal information
We collect, hold, use and disclose your personal information for the following purposes:
• To match you to job vacancies, to send you job advertisements and information on our vacancies using the methods of communication you have specified, to notify you of decisions and to schedule interviews with you.;
• To contact you using your contact details about job vacancies and company matters that may be of interest to you;
• To contact you to invite you to assessment days, open days and company events that may be of interest to you;
• To carry out your instructions, e.g. send you details of online tests or assessments;
• To manage our relationship with you, including (unless you tell us otherwise) telling you about other roles, information regarding our company and services we think may be relevant for you;
• To prevent or detect crime including fraud and financial crime, e.g. financing for terrorism and human trafficking;
• To conduct surveys and data analytics, to better understand our workforce and assist us with succession planning;
• To protect our legal rights and comply with our legal obligations;
• For service, system or product development and planning, insurance, audit and administrative purposes
• For the purpose of converting a registrant to an applicant.
• Assessing your suitability for a role by reviewing your background, qualifications and any other information you have provided to us
• The pursuit of complaints; and
• Equal opportunities monitoring including the operation of an equal opportunities policy, identifying or keeping under review the existence or absence of the quality of opportunity, or treatment between persons of different protected characteristics, with a view to enabling such quality to be promoted, or maintained.
Tracking or recording what you say or do
We may record details of your interactions with us. We may record and keep track of conversations you have with us including phone calls, face-to-face meetings, letters, emails, live chats, video chats and any other kinds of communication. We may use these recordings to check your instructions to us, assess, analyse and improve our service, train our people, manage risk or to prevent and detect fraud and other crimes. We may also use these recordings to make decisions about you. We may capture additional information about these interactions, e.g. telephone numbers that you call us from and information about the devices or software that you use. We use closed circuit television (CCTV) in and around our sites and these may collect photos or videos of you, or record your voice.
Vetting
Should you apply for a job with us, we will request, collect and process your personal information as part of our vetting procedures which will include criminal convictions checks and credit reference checks. This will be in order to confirm your identity, employment history and relevant qualifications with respect to a role, to comply with the law and for our legitimate interests to be able to assess and manage our risk.
Please note we collect personal information for vetting through the application and recruitment process and throughout your employment directly from candidates by teams within HSBC (either based in our offshore Global Service Centres or onshore Security Risk Teams and/or HR Teams). Global vendors or other carefully selected local third parties in country may also collect personal information for vetting purposes for us.
We have in place an appropriate policy and safeguards which we are required by law to maintain when processing such data.
If you apply for a job with us, we will provide you will full details of all vetting checks that we will carry out on you and the reasons why we carry out such checks.
Service improvement
We’ll analyse your personal information to identify possible service and improvements in our recruitment process. The lawful basis for processing your information for this purpose is our legitimate interest. We do this to improve our products and services to best meet the need of our workers.
Data analytics
We’ll analyse your personal information to identify relevant job opportunities and to better manage our workforce. The lawful basis for using your information in this way is our legitimate interest;
Protecting our legal rights
We may need to use your personal information to protect our legal rights, e.g. in the case of defending or the protection of legal rights and interests (e.g. labour law disputes); court action; managing complaints or disputes; in the event of a restructuring of companies or other mergers or acquisition. This may be in connection with action taken against you or other persons. We’d do this on the basis that it’s in our legitimate interest;
Compliance with laws and regulatory compliance obligations
We’ll use your personal information to meet our compliance obligations, to comply with other laws and regulations and to share with regulators and other authorities that HSBC Group companies are subject to. This may include using it to help detect or prevent crime (including terrorism financing, money laundering and other financial crimes). We’ll only do this on the basis that it’s needed to comply with a legal obligation or it’s in our legitimate interests and that of others.
Who we might share your information with
We may share your information with others where lawful to do so including where we or they:
• Have a public or legal duty to do so, e.g. to assist with detecting and preventing fraud, tax evasion and financial crime;
• Need to in connection with regulatory, reporting, litigation or asserting or defending legal rights and interests;
• Have a legitimate business reason for doing so, e.g. to manage risk, verify your identity or assess your suitability for roles;
• Have asked you for your permission to share it, and you’ve agreed.
We may share your information for these purposes with others including:
• Other HSBC group companies and any sub-contractors, agents or service providers who work for us or provide services to us or other HSBC Group companies (including their employees, sub-contractors, service providers, directors and officers);
• Your intermediaries,
• Tax authorities, trade associations, credit reference agencies;
• Any people or companies where required in connection with potential or actual corporate restructuring, merger, acquisition or takeover, including any transfer or potential transfer of any of our rights or duties under our agreement with you;
• Law enforcement, government, courts, dispute resolution bodies, our regulators, auditors and any party appointed or requested by our regulators to carry out investigations or audits of our activities;
• Other parties involved in any disputes, grievances and investigations;
• Fraud prevention agencies who’ll also use it to detect and prevent fraud and other financial crime and to verify your identity;
• Anybody else that we’ve been instructed to share your information with by you.
Sharing aggregated or anonymised information
We may share aggregated or anonymised information within and outside of the HSBC Group with partners such as research groups, universities or advertisers. You won’t be able to be identified from this information, e.g. we may share information about general employment trends to assist in research.
How long we’ll keep your information
We keep your information in line with our data retention policy. We may need to retain your information for a longer period where we need the information to comply with regulatory or legal requirements or where we may need it for our legitimate purposes, e.g. to help us respond to queries or complaints, fighting fraud and financial crime, responding to requests from regulators, etc. If we don’t need to retain information for this period of time, we may destroy, delete or anonymise it more promptly.
Transferring your information overseas
We may share or transfer your personal information, to locations outside Australia. For a list of these overseas countries, please visit www.hsbc.com.au. Where we believe that the laws of an overseas country does not protect personal information in a way that is at least substantially similar to the protection under the Australian Privacy Principles, we will take steps which are reasonable to ensure that overseas recipients in that country do not breach the Australian Privacy Principles in relation to the personal information we provide to them. In some circumstances, overseas recipients may be required to disclose information which we share with them under a foreign law. Where this occurs, we will not be responsible for such disclosure.
How we keep your information secure
Your personal information may be held in physical or electronic form on our systems or the systems of our service providers, and is protected by physical, electronic and procedural safeguards. We may also store your personal information on a third party cloud in Australia or overseas. Only people who need to know your personal information in order to perform their duties will be given access to the information. However, if your personal information is stored or processed overseas, it may also be accessed by law enforcement and other authorities in that country.
Your rights
You have a number of rights relating to your personal information, such as to see what information we hold about you, ask us to correct or update details, or to understand our policies and practices regarding data held by us.
If you wish to request a copy of this policy, access to your personal information or wish to correct personal information we have stored about you, you can visit one of our branches or call 1300 308 008 (or +61 2 9005 8181 if calling from overseas), or contact our Privacy Officer by writing to HSBC Bank Australia Limited, GPO Box 5302, Sydney NSW 2001 or privacy@hsbc.com.au.
In some circumstances, it may not be possible to provide you with access to all of your personal information. Where this is the case, we will tell you why. We will only release information once you we have verified your identity.
If you think that any personal information that we hold about you is inaccurate and would like to request that we correct it, please contact us using the details above. We will take reasonable steps to correct your personal information if we agree it is incorrect. If we don't correct your personal information, we will tell you why. We will let you know if we need to charge you a fee for processing a request to access data.
Making a complaint
If you wish to make a complaint because you believe we have not complied with the Privacy Act or about the way we have handled your personal information, you can contact our Privacy Officer at privacy@hsbc.com.au.
You may also lodge a complaint with the HSBC Customer Relations Department, whose details are as follows:
Phone (within Australia, toll free, 8am to 7pm AEST): 1300 308 188
Phone (overseas): +61 2 9005 8181
Post: Customer Relations Team - HSBC Bank Australia Limited, Tower 1 - International Towers Sydney, 100 Barangaroo Avenue, Barangaroo NSW 2000, Australia.
We will attempt to respond to any complaints, access or correction requests as soon as possible, and no later than 30 days once we’ve verified your identity. However, where a matter is complex, we may need to ask you for an extension to this period and give you the reasons why we need to have the period extended. If you do not consent to the extension sought by us, we may not be able to resolve your complaint, access or correction request.
If you are not satisfied with the outcome of your complaint to us, you can contact the Australian Financial Complaints Authority at:
Make a complaint in writing using the complaint form to:
Post: GPO Box 3, Melbourne, VIC 3001
Phone: 1800 931 678
Email: info@afca.org.au
Web: www.afca.org.au
The Australian Financial Complaints Authority is a free service established to provide you with an independent mechanism to resolve specific complaints.
Alternatively, you can contact the Office of the Australian Information Commissioner at:
Make a complaint in writing using the complaint form to:
Post: GPO Box 5218, Sydney, NSW 2001 or GPO Box 2999 Canberra ACT 2601
Fax: +61 2 9284 9666
Email: enquiries@oaic.gov.au
Please note the OAIC requires any complaint must first be made to the respondent organisation. The law also allows 30 days for the respondent organisation to deal with the complaint before a person may make a complaint to the OAIC.
For general enquires call: 1300 363 992
This notice is dated [insert date].