Privacy Policy

1. Purpose 

The Hop Lun group of companies including its affiliated or related companies (“Hop Lun”, “we”, “us”, or “our” the “Company”) as the case may be, is the controller, user, and processor of your personal data. You may reach us via email at legal@hoplun.com or contact us at our physical / postal address listed in the “Enquiries” section below. 

We are committed to conducting business in accordance with global and local best practices and standards. We also recognize and understand that our various stakeholders including employment candidates, employees, suppliers, business partners, customers, website visitors, and mobile application users are concerned about the privacy of personal data. 

The Company pledges to comply with the requirements of the Personal Data (Privacy) Ordinance (Cap. 486) (the “PDPO”) of the Laws of the Hong Kong Special Administrative Region of the People’s Republic of China (“Hong Kong”), the EU General Data Protection Regulation (GDPR) and/or China Mainland's Personal Information Protection Law (PIPL) ( See: “Privacy Addendum for mainland China”). 

This Privacy Policy Statement outlines our Company’s practices and the choices you have concerning the collection and use of your personal data. This Privacy Policy Statement should be read together with the applicable Terms and Conditions of the relevant administration, service, website, and/or mobile application provided by our Company (the “Terms and Conditions”), provided that, in the event of any inconsistency between this Privacy Policy Statement and the Terms and Conditions concerning matters relating to personal data, this Privacy Policy Statement shall prevail. This Privacy Policy Statement should be also read together with the applicable personal information collection statement of the relevant service, website, and/or mobile application provided by our Company (the “PICS”), provided that, in the event of any inconsistency between this Privacy Policy Statement and the PICS concerning matters relating to personal data, the PICS shall prevail. 

2. Collection of Information 

You may be invited to provide the Company with your personal data on the Company's relevant website(s) or mobile application(s), or through other media on a voluntary basis for different purposes at different times. If you are under the age of eighteen (18), you should obtain consent from your parents or guardian before you provide our Company with your personal data. Regardless, the Company will ensure full transparency and communication with the Data Subject on the collection of the Data Subject’s personal data and processing activities relating to related to its personal data in the following manner: 

  • Concise 
  • Transparent 
  • Intelligible 
  • Easily accessible 
  • In clear and plain language 
  • In writing, including by electronic means if appropriate, or even orally in some cases 

3. Log Files 

When you visit the Company’s website(s) and/or use the Company’s mobile application(s), the servers of the Company will collect only data relating to your visits to/use of such website(s) and/or use such mobile application(s), including but not limited to your IP address, domain name, browser type and access time (“Log Files”) but will not collect your personal data. However, if you register on our website and log in to your account, we may combine your Log Files with other personal data we collect from you, in which case such Log Files shall be considered your personal data for the purposes of, and will be used in accordance with, this Privacy Policy Statement and the PICS. 

4. Use of Cookies and Other Tracking Mechanisms 

When you browse the website(s) of the Company and/or use the mobile application(s) of the Company, cookies will be stored on your computers, mobile phones or other devices for internal navigation and programming only. We may use cookies and other tracking mechanisms described below to track information about your use of our Company’s website(s) and/or mobile application(s) (“Tracking Data”). We may combine this Tracking Data with other personal data we collect from you, in which case such Tracking Data shall be considered your personal data for the purpose of, and will be used in accordance with, this Privacy Policy Statement and the PICS. 

Cookies are alphanumeric identifiers that we transfer to your computers, mobile phones or other devices through your web browser for record-keeping purposes. Some cookies allow us to make it easier for you to navigate the Company’s website(s) and/or mobile application(s), while others are used to enable a faster log-in process, or to allow us to store and track information about your interests and preferences at our Company’s website(s) and/or the Company’s mobile application(s). 

We may also engage third parties to track and analyze non-personally identifiable data from the website(s) or mobile application(s). We use the data collected by such third parties to help us administer and improve the quality of the Company’s website(s) (e.g., www.hoplun.com) or mobile application(s) and to analyze usage of the same. This is unrelated to and separate from your personal data. Such third parties may combine the non-personally identifiable data that we provide about you with other information that they have collected. You can edit your browser settings to disable cookies but to do so you may not be able to utilize certain functionality of the website(s) and/or mobile application(s) (where applicable) of the Company. For further information, visit www.allaboutcookies.org . 

If you interact with the Company on social media platforms (for example if you “Like” the Company’s LinkedIn or Facebook page), the Company can interact with you and send you messages via these platforms. The Company will interact with you in accordance with the social media platform’s rules, but we are not responsible for how the platform operators collect and handle your personal data. We are not responsible for what third parties post on our social media accounts. 

5. Kinds of Information Collected 

For the different purposes in the course of conducting our Company's business, you may be required to provide to our Company your personal data, which may include your name, gender, age (or age range), month of birth, contact details, e-mail address, mailing/residential/correspondence address, contact number, relevant account or membership number, marital status, family status, educational level, occupation, username and password, Log Files, Tracking Data, interests and favorite activities, transaction information (including your characteristics and transaction behavior), social media account information, etc. Details of personal data to be collected will also be set out in the relevant PICS provided to you on or before collection of such personal data. 

6. Purposes and Uses of Personal Data Collected 

The Company will use your personal data for specific purposes identified in the PICS provided to you on or before the time your personal data is collected. This includes sharing your personal data with, and your personal data being used by, third parties as set out in the PICS for those purposes. 

We collect the Sensitive Personal Data only for specific purposes, such as administering of employment related matters such as remuneration, expense reimbursement, medical insurance claims or pension / mandatory provident fund (MPF) administration and to ensure proper notification in the event of an emergency. 

7. Accuracy of Information 

You may be requested to provide the Company with certain personal data for specific services. If you fail to provide accurate or current information as requested for each specific service, the provision of such services by the Company may be affected. 

8. Retention of Information 

The Company will retain your personal data for a period no longer than necessary for the fulfillment of the purposes for which it is to be used. If you are a candidate, employee or subscriber of the Company services, your personal data will be retained for a reasonable period after separation or termination of your subscription for verification and audit purposes. The above is subject to any legal, statutory, regulatory, or accounting 

9. Third Party Merchants 

The Company may be affiliated with third-party on-line stores or some services and/or products which are hosted on such affiliated the website(s) and/or mobile application(s) of the Company but are operated by third party merchants. If you provide your personal data to the third-party merchants in order to use, order or receive any services and/or products from the third-party merchants, please note that your personal data is beyond the control of the Company and thus is outside the scope of protection afforded by the Company. 

10. Third Party Websites and/or Mobile Applications 

The website(s) and/or mobile application(s) of the Company may from time to time contain links to other third-party websites and/or mobile applications. These other third-party websites and/or mobile applications are independent from the website(s) or mobile application(s) of the Company. The Company has no control or management over the contents of such other websites, mobile applications or their privacy policies or compliance with law. You should be fully aware that the provisions of such links do not constitute an endorsement, approval, or any form of association by or with the Company. The Company has no control over your personal data submitted by you, if any, to other websites and/or mobile applications. This Privacy Policy Statement only applies to the website(s) and/or mobile application(s) of the Company. You should read the respective privacy policies of other websites or mobile applications. 

11. Service Providers 

The Company may provide your personal data to the people and/or companies providing services (whether within or outside the Hong Kong Special Administrative Region (HKSAR) or European Economic Area (“EEA”) as the case may be, in connection with the specific purposes set out in the PICS and paragraph 6 above (the "Company Service Providers"). In these cases, the Company Service Providers are required to use your personal data consistent with the agreements the Company enters into with them as well as this Privacy Policy Statement and the PICS. 

12. Security and Transfer of Information 

The physical records of your personal data will be stored in secured places (whether within or outside the HKSAR or EEA as the case may be) with restricted access by us or those who we share your personal data in accordance with this Privacy Policy Statement and the PICS. The electronic records of your personal data will be stored in the servers of the Company and/or relevant Company Service Providers as our data processors (regardless of jurisdiction) located in secured places and protected by adequate IT security measures (e.g. encryption for transmission of sensitive data through the internet in appropriate cases), or where relevant, we will procure by contract (e.g., Standard Contractual Clauses (SCC)) or use reasonable endeavors to ensure that those who we share your personal data with (whether within or outside the HKSAR or EEA) in accordance with this Privacy Policy Statement and the PICS do the same. Only authorized personnel of the Company (who have been trained to handle your personal data properly and bound by a duty of confidentiality) will have access to these records and servers on a "need-to-know" and "need-to-use" basis, or we will procure by contract or use our reasonable endeavors to ensure that those who we share your personal data with (whether within or outside HKSAR or EEA) in accordance with this Privacy Policy Statement and the relevant PICS do the same. 

Your personal data may be stored by us in physical locations and/or servers located within or outside the HKSAR (or EEA as the case may be) and/or shared with third parties with physical locations and/or servers located within or outside the original jurisdiction, in each case in accordance with the relevant PICS. However, we will take all reasonable measures to ensure that your personal data is stored and processed securely, regardless of the place or country in which it is stored, and we will procure by contract or use reasonable endeavors to ensure that any third parties will do the same. Our cross-border transfer of your personal data will be conducted in accordance with the PICS and applicable laws for the protection of your personal data. 

No data transmission over the internet or any other public network can be guaranteed to be completely secure, and privacy cannot be assured in your communications to us. You are encouraged to protect against unauthorized access to your password. You are advised to sign out from your account when finished, particularly when using a shared computer.

13. Exclusion 

The Company may disclose your personal data as required by law, any government departments, regulatory authorities, enforcement agencies and courts of competent jurisdiction. The Company excludes all liability for disclosure of your personal data in this manner.

14. Use in Legal Proceedings etc. 

If it becomes necessary for the Company to take action against you to recover debt you owe to the Company, you agree that your personal data can be used by the Company to identify and take legal action against you. 

 15. Access and Correction of Information and Withdrawal of Consent 

You have the right to request in writing to the Personal Data Privacy Officer of the Company to: 

  1. check whether a/the relevant Company holds any of your personal data. 
  2. access your personal data held by the relevant Company (if any). 
  3. require the relevant Company to correct your personal data that is inaccurate (if any); and 
  4. erase your personal data and/or restrict the processing of your personal data, under certain conditions. 
  5. transfer the data that we have collected to another organization, or directly to you, under certain conditions. 
  6. ascertain our policies and practices (from time to time) in relation to personal data and the types of personal data held by us. 
  7. withdraw your consent to the use of your personal data for direct marketing purposes (see below). 

All such requests will be handled promptly in accordance with the requirements of the relevant Data Privacy Authority (DPA). The Company may charge you a reasonable fee for processing your personal data access request. 

16. Automated Processing 

All processing will be lawful, fair, transparent, and necessary for a specific purpose. You have the right not to be subject to decisions based solely on automated data processing, including profiling, which produces legal effects or similarly affects the person. The Company will ensure relevant opt-in/ opt-out options concerning automated individual decision-making and profiling when a Data Subject visits the Company’s website and/or mobile application(s), its social media platform(s). 

Note that this objection right will not apply to the situation where it is: 

  • necessary for the Company to enter into or perform a contract with the Data Subject. 
  • authorized by an EU, HKSAR, other relevant jurisdiction law, applicable to the Company and law which requires suitable measures to safeguard the Data Subject’s rights and freedoms and legitimate interests; and 
  • based on the Data Subject’s explicit consent. 

17. Breach Notification 

When a personal data breach is likely to result in a high risk to the Data Subject, the Company will notify the Data Subject of the breach as soon as reasonably practicable but not later than 72 hours after becoming aware of such breach. 

18. Direct Marketing 

We cannot use or provide to third parties (whether intra-group and/or external parties) your personal data for direct marketing purposes without your consent. Subject to your consent, we may use or provide to third parties (whether intra-group and/or external parties) your personal data for direct marketing purposes in accordance with the PICS provided to you on or before collection of your personal data. You may withdraw your consent any time by writing to the Data Protection Officer of the Company at 32/F, 9 Wing Hong Street, Cheung Sha Wan, Kowloon, HONG KONG or by email at: legal@hoplun.com 

19. Lawful Grounds for Processing 

The Company will process the Data Subject’s personal data based on the following lawful grounds: 

  • Consent – the Company will receive written consent of the Data Subject in order to collect its personal data (e.g., via Personal Information Collection Statement) 
  • Performance of Contract – when the Company is performing a contract with the Data Subject (e.g., contract between the Company and candidates/employees, or between the Company and its business partners, billing information to suppliers etc.) 
  • Legal Obligations – when the Company is required to process the Data Subject’s personal data in order to comply with statutory obligations (e.g., Tax filing or providing such related information to government agencies). 
  • Vital Interests – the Company will process the Data Subject’s personal data in a vital situation (i.e., when a life-threatening accident occurs at work to a Data Subject who is also an employee of the Company. The Company may disclose the Data Subject’s personal data such as its medical information to the hospital for the Company to protect the Data Subject’s vital interests). 
  • Public Interest – when the Company is obliged to perform a task carried out in the public interest (i.e., law enforcement may need to access data in order to prevent criminal activity) 
  • Legitimate Interest – when and where applicable, the Company may be able to demonstrate its compelling legitimate interest is deemed reasonable and within balance against the interests or the fundamental rights and freedoms of the Data Subject, (e.g., CCTV to prevent theft, or other data to prevent fraud, processing client data to provide customer service, processing employee data to provide health insurance or other benefits). If the purpose is for marketing, the data subject’s right to object always supersedes

20. Change of Privacy Policy Statement 

This Privacy Policy Statement may from time to time be updated, revised, and amended. Any update, revision or amendment will be effective immediately upon being posted on the website(s) and/or mobile application(s) of the Company. Where legally required, we shall notify you and/or obtain your consent for specific material updates, revision, or amendment. If you do not accept the updates, revision, or amendment, and/or provide your consent, then we may not be able to provide goods or services to you. You are advised to check the website(s) and/or mobile application(s) of the Company for updates to this Privacy Policy Statement on a regular basis. 

21. Change of Control 

In the event of any actual or proposed transfer of business, transfer of shares, re-structuring, amalgamation, merger, sale, transfer, or purchase of us or our business or our affiliates or our affiliates’ businesses, the Company may need to transfer your 

personal data to the new entity in accordance with the PICS. You will be notified of such an event, and you may decide to withdraw your consent to the use of your personal data. 

22. Enquiries 

If you have any questions, concerns or wish to access or correct your personal data or withdraw your consent to the use of your personal data held by the relevant Company for direct marketing purposes, please contact the Personal Data Privacy Officer of the Company at: 32/F, 9 Wing Hong St., Cheung Sha Wan, Hong Kong Attention: Personal Data Privacy Officer (Legal Department) (Marked Confidential, and with the name of the relevant Company) or by email at: legal@hoplun.com 

23. Inconsistency or Conflict 

If there is any inconsistency or conflict between the English and Chinese versions of this Privacy Policy Statement, the English version shall prevail. 

24. PRC Addendum 

If you are: 

  • an individual located in Mainland China who visits the Company’s relevant website(s) or uses relevant mobile application(s) of the Company, or otherwise uses the Company’s products and/or services by phone or any other means from Mainland China and/or; 
  • an individual holding a Mainland China passport who visits any physical location affiliated with the Company in Hong Kong or otherwise using the Company’s products and/or services by phone or any other means in Hong Kong,

your personal data will be processed by the Company in accordance with The Company Privacy Addendum for mainland China and the relevant PICS, as well as the applicable data protection laws and regulations in Mainland China. 

The Company Privacy Addendum for mainland China

This section only applies to you if you are located in mainland China or the holder of a Mainland China passport, as also stated in Section 24 of The Company Privacy Policy Statement. 

The Hop Lun Group of companies, (hereinafter also referred to as “we”, “us”, “our” or the “Company”), as the case may be, is the controller and processor of your personal data and you may reach us via legal@hoplun.com. This Privacy Addendum forms part and parcel of the Company’s Personal Information Collection Statement and specific to any individual (including individual directors and employees of a corporate customer) who are located in mainland China and receiving our products and/or services from outside of mainland (including, but not limited to Hong Kong/Macau). 

As required by the laws of mainland China, we may need to seek your consent on how we use your personal data and, in relation to certain personal data which is considered sensitive based on the laws in mainland China, we may need your separate consent. Your personal data will be collected, accessed, processed, used, stored, and/or transferred outside of, mainland China. If you do not consent to this Privacy Addendum (or relevant 

Personal Information Collection Statement) we may not be able to provide certain administration or other, such as providing product(s) you wish to acquire from us along with related customer support. Under the applicable data protection laws in mainland China, we will process your personal data based on your consent, unless your personal data are: 

  • necessary to conclude or fulfil a contract to which you are a party. 
  • necessary for us to comply with legal obligations. 
  • necessary to respond to public health emergencies. 
  • necessary to protect individuals’ life, health, and property safety. 
  • reasonably processed in news reporting and public opinion oversight for public interests; and 
  • publicly available, because of your voluntary disclosure or a legal requirement, and reasonably processed. 

Certain personal data that we collect about you is sensitive personal data as defined in the applicable data protection laws in mainland China (“Sensitive Personal Data”), which is personal data that may materially impact your rights and interests, if breached or unlawfully used, including but not limited to financial accounts, national identification number, health-related information, or any personal data of minors under the age of fourteen (14). We collect the Sensitive Personal Data only for specific purposes, such as administering of employment related matters such as remuneration, expense reimbursement, medical insurance claims or pension / mandatory provident fund (MPF) administration and to ensure proper notification in the event of an emergency. 

We will retain your personal data for the period necessary to fulfill the purposes outlined in the Company’s relevant Personal Information Collection Statement and this Privacy Addendum. The criteria used to determine our retention periods may include one or more of the following: as long as we have an ongoing relationship with you; as required by a legal obligation to which we are subject; and as advisable in light of our legal position (such as in regard of the applicable statute of limitation, litigation, audits, or regulatory investigation). 

We may also provide your personal data with our insurers, third party service providers, medical institutions, parent companies, subsidiaries and affiliated companies, auditors, legal advisors, regulators, banks, (each, a “recipient”, collectively, “recipients”) for the purpose of employment or customer service fulfillment administration. 

The recipient(s) of your personal data may collect and process your personal data and return it to us for the purpose of employment administration or customer service fulfillment. The types of personal data that we may provide to the recipients include without limitation personal identifiable information and others (as listed above). We may deliver your personal data through electronic means or other mode of dispatch to the recipients. In compliance with the applicable rules and regulations of mainland China, we implement maximum security in controlling, processing, and transferring of your personal data and Sensitive Personal Data. We also adopt our own security policies to safeguard your personal data and Sensitive Personal Data. 

In addition to the access rights set forth in the Company’s Personal Information Collection Statement, you have the right to obtain a copy of your personal data held by us 

and the right to request us to delete such personal data under any of the following circumstances: 

  • where the purposes of processing your personal data have been achieved or have failed to be achieved, or the personal data is no longer necessary for achieving the purposes. 
  • where we have ceased to provide the products or services, or the retention period has expired. 
  • where you have withdrawn your consent; and 
  • where we have violated the applicable data protection laws and regulations. 


To the extent inconsistent with the provisions of this Privacy Addendum, including but not limited to definitions (e.g., sensitive personal information), China’s Cybersecurity Law, Personal Information Protection Law, Data Security Law, their implementing measures and other Chinese laws and regulations in relation to cybersecurity and data protection will prevail. 

We have the right to update this Privacy Addendum from time to time and we will notify you of our updates to this Privacy Addendum by posting it on our website or application platforms (as the case may be). You may withdraw your consent to our use of your personal data by contacting us through the contact details set out in this Privacy Addendum. If you withdraw your consent to our processing of your personal data, we may not be able to provide the relevant products and/or services to you. 

25. Acknowledgement 

I have read and understood this Privacy Policy Statement and / or Mainland China Privacy Addendum and agree that the Company can process my personal data and Sensitive Personal Data as set out within this policy. F