China Bridge Group (UK) Limited Privacy Notice

Who we are

Your information will be held by China Bridge Group (UK) Limited, which is a company incorporated in England (company number 6505224) and which has its registered office at 1 Lothbury, London EC2R 7DB. China Bridge Group (UK) Limited is part of the Bank of China Group. When we refer to 'we', 'us' and 'our' in this Privacy Notice, we mean China Bridge Group (UK) Limited. If you are an organisation (or a person or person(s) representing an organisation), references to 'you' and 'your' include the organisation, together with the people representing or connected with the organisation (such as proprietors, officers, beneficial owners, settlors and beneficiaries) where this is appropriate.

More information about the Bank of China Group can be found at www.bankofchina.com

Introduction

We take your privacy seriously and this Privacy Notice tells you how we will look after your personal information.

We recommend you read this Privacy Notice very carefully because it contains important information about:

· the personal information we collect about you and how we process it

· who we might share your personal information with

· your rights in relation to your personal information – for example, how to get a copy of your personal information and how to ask us to correct or remove information

Our promises to you

We promise:

•      To keep your personal information safe and private.
•      Not to sell your personal information.

How the law protects you

Your privacy is also protected by UK law, which says that we are allowed to use your personal information only if we have a proper reason to do so. The law says we must be able to rely on one or more of the following reasons:

•      to perform our contract with you; or
•      to comply with our legal obligations; or
•      when we have your consent to do so (if consent is needed); or

Special categories of personal data
Some categories of personal information are treated as special. These are called 'special categories of personal data'. We will only collect and use these special categories of personal data if the law allows us to do so:

·  information about your religious, political or philosophical beliefs

·  information about your trade union membership

·  genetic data

·  your biometric data, for the purpose of identifying you

·  information about your health

·  information about your sex life or sexual orientation

·  information about any criminal convictions or offences, or alleged criminal activity

If we process a special category of personal data, we will only do it if one of the following conditions is satisfied:

(1)  There is a substantial public interest - for example, if we use information from criminal records to prevent, detect or prosecute fraud or unlawful acts. This also applies in situations where we find out that you have a health issue and we need to use this information in order to provide you with services that are suitable to you, and to ensure that you are treated fairly and equally.
(2)  To protect or enforce our legal rights, or to defend claims.
(3)  With your explicit consent.
(4)  To protect your vital interests, where you are unable to give your consent – for example, if we need to give you urgent medical assistance when you are in one of our Visa Centres.

Type of Personal Information Used

We may obtain and use different kinds of personal information about you, depending on our relationship with you. In this section, we will set out the types of information we may obtain. We have separated these into groups, and for each group we give a brief explanation of what this type of information could include.

Type of personal information	Description
Biographical	Your name and date of birth.
Financial	Your financial position, status and history, including details of your income and expenditure.
Contact	Your postal address, telephone number(s), email address and other contact details, including how to contact you.
Socio-Demographic	Details about your work or profession, nationality, education.
Communications	What we learn about you from letters, emails and telephone conversations between you and us.
Relationships	Your family and other relationships.
Documentary Data	Details about you that are stored in documents in different formats, or copies of them. This could include things like your passport, identity card, driver’s licence or birth certificate.
Consents	Any permissions, consents or preferences that you give us.
National Identifier	A number or code given to you by a government to identify who you are, such as an identity card.

Where we collect personal information from

We may collect personal information from any of these sources:
Information you give to us

· When you apply for our services

· When you talk to us on the phone or in branch (we record calls on some of our telephone lines, and we use CCTV on some of our premises to ensure the safety and security of our staff and customers)

· In emails, letters and faxes

Information we collect when you use our products and services

This includes the amount, frequency, type, location, origin and recipients:

· Payment

Information from third parties

•      People acting on your behalf (for example, your solicitor or accountant)
•      Companies that introduce you to us
•      Companies involved in processing payments
•      Employers (for example, if we ask for evidence of employment and salary)
•      Government and law enforcement agencies

How we will use your personal information

In the table below we explain the various situations in which we will use your personal information. We have separated these into groups, and for each group we give a brief explanation of:

•      how we can use your personal information
•      the reasons we can rely on when using your personal information
•      the legitimate interests we can rely on for doing so

HOW WE CAN USE YOUR INFORMATION	OUR REASONS FOR DOING THIS	OUR LEGITIMATE INTERESTS IN DOING THIS
To process your visa applications to you
· To provide the services you have applied for · To process your instructions · To manage complaints and seek to resolve them · To fix mistakes	·  performing our contract ·  our legal obligations ·  your consent ·  our legitimate interests	·  protecting and enforcing our legal rights ·  obtaining your consent to do something, when we need this
To advise you as to whether a service is suitable for you
· to advise you on the suitability of a service, where we offer an advice service	·  performing our contract ·  our legal obligations ·  your consent ·  our legitimate interests	·  protecting and enforcing our legal rights
To manage, develop and improve our business
· To run our business in an efficient and proper way, and in accordance with the laws and regulations that apply to us · To study how customers use our services · To develop new ways to meet our customers' needs and provide our services · To improve and update our brands, services, or develop and test new ones · To update and improve our business processes, and the way we work with other Visa Agencies who provide services to us or to our customers · To respond to changes in law or regulation	·  our legal obligations ·  your consent ·  our legitimate interests	·  developing our business and making it stronger ·  improving the efficiency of our business and reducing costs
To exercise our legal rights
· To exercise our rights under law or regulations · To exercise our rights under our contracts with you or with third parties	·  performing our contract ·  our legitimate interests	·  protecting and enforcing our legal rights

Who we share your personal information with

We may share your personal information with other companies within the Bank of China Group and with these organisations:

•      ChineseEmbassy/ConsulatesGeneralin UK
•      The police and other law enforcement agencies
•      Organisations that introduce you to us 
•      Any person you have appointed to act as your contact with us (for example, a person acting as your representative under a power of attorney)

Mergers and takeovers

We may share your personal information if the structure of our company or the Bank of China Group changes in the future. We may choose to sell, transfer, or merge parts of our business, or our assets. Or we may seek to acquire other businesses or merge with them. 

During any such process, we may share your personal information with organisations involved in the process (such as the company we are looking to sell, transfer or merge part of our business or assets with, and any funders), as well as their advisers. We will only do this if they agree to keep your personal information safe and private.

If the change to our Group happens, then other parties may use your personal information in the same way as set out in this notice.

Automated decision making

Automated decision making is when a decision is made about you based only on automated means, without any human involvement. Some organisations use automated decision making when deciding whether you are able to afford credit, or whether to accept your application for a product or service. We do not currently use automated decision making technology. Any decisions which we make are made by our personnel and are subject to internal reviews and approvals.

Sending your personal information outside of the EEA

We will transfer your personal information to locations outside of the European Economic Area ('EEA'). Inparticular, your personal information will be transferred to andstored by the Chinese Ministry Of Foreign Affairs,who are located in the People’s Republic of China and who provide services to us.Where we transfer your personal information to such recipients, we use specific contracts approved by the European Commission which give your personal information the same protection as it has in the EEA. 

When we transfer personal informationoutside of the EEA, we will make sure that it is protected in the same way as if it were being used in the EEA. This means that either the European Commission has decided that the country concerned has an adequate level of protection for your personal information, or that we have put in place our own measures to ensure your personal information is protected to an adequate level. These measures include ensuring that your personal information is kept safe, by carrying out strict security checks on our overseas providers, and by entering into contractual arrangements.

If you would like further information about the specific mechanisms we use to when transferring your personal information out of the EEA, please email your query to datapro.uk@mail.notes.bank-of-china.com or write to us at this address: 
Data Protection Officer, China Bridge Group (UK) Limited, 1 Lothbury, London, EC2R 7DB

If you choose not to give personal information

We may need to collect personal information to comply with our legal obligations, or under the terms of a contract we have with you.

If you choose not to give us this personal information, it may delay or prevent us from meeting our obligations. It may also mean that we cannot perform services needed to process your visa application. It could mean that we cancel a service you have with us.

If it is optional for you to give us certain information, we will tell you at the time we ask for that information.

How long we keep your personal information

We will keep your personal information for as long as you are a customer of China Bridge Group (UK) Limited. After you stop being a customer, we will typically keep your personal information for up to 7 years for one of these reasons: 

· To respond to any questions or complaints

· To show that we treated you fairly

· To maintain records according to rules that apply to us

We may keep your personal information for longer than 7 years if we cannot delete it for legal, regulatory or technical reasons. We may also keep it for research or statistical purposes. If we do, we will make sure that your privacy is protected and only use it for those purposes.

How to get a copy of your personal information

You can access the personal information we hold about you, along with information on how we use it and why, who we share it with and how long we keep it. You can do this by calling into your local branch, by speaking to your relationship manager, by emailing us at datapro.uk@mail.notes.bank-of-china.com or by writing to us at this address: 
Data Protection Officer, China Bridge Group (UK) Limited, 1 Lothbury, London, EC2R 7DB

Letting us know if your personal information is incorrect

You have the right to question any information we have about you that you think is wrong or incomplete. You can do this by calling into your local branch, by speaking to your relationship manager, by emailing us at datapro.uk@mail.notes.bank-of-china.com or by writing to us at this address: 
Data Protection Officer, China Bridge Group (UK) Limited, 1 Lothbury, London, EC2R 7DB
If you do, we will take all reasonable steps to check its accuracy and correct it.

What if you want us to stop using your personal information?

You have the right to object to our use of your personal information, or to ask us to delete, remove, or stop using your personal information if there is no need for us to keep it. These rights are known as the ‘right to object’ and the ‘right to erasure’, or the ‘right to be forgotten’.

There may be legal or other official reasons why we need to keep or use your personal information. If you think that we should not be using it, however, you should tell us.

We may sometimes be able to restrict the use of your personal information. This means that it can only be used for certain things, such as legal claims or to exercise legal rights. In this situation, we would not use or share your information in other ways while it is restricted.

You can ask us to restrict the use of your personal information if:

· It is not accurate

· It has been used unlawfully but you do not want us to delete it

· It not relevant any more, but you want us to keep it for use in legal claims

· You have already asked us to stop using your personal information but you are waiting for us to tell you if we are allowed to keep on using it

If you want to object to how we use your personal information, or ask us to delete it or restrict how we use it or, you can do this by emailing us at datapro.uk@mail.notes.bank-of-china.com or by writing to us at this address: 
Data Protection Officer, China Bridge Group (UK) Limited, 1 Lothbury, London, EC2R 7DB

Your right of 'data portability'

You can ask us to give you or a third party some of the information that we hold about you. This is called your right of 'data portability'. If you exercise this right we will provide the information in a structured, commonly used electronic form.

You can contact us to exercise your right of data portabilityby calling into your local branch, by speaking to your relationship manager, by emailing us at datapro.uk@mail.notes.bank-of-china.com or by writing to us at this address: 
Data Protection Officer, China Bridge Group (UK) Limited, 1 Lothbury, London, EC2R 7DB

How to withdraw your consent

If the reason we are relying on to hold and use your personal information is based on your consent, you can withdraw your consent. You can do this by calling into your local branch, by speaking to your relationship manager, by emailing us at datapro.uk@mail.notes.bank-of-china.com or by writing to us at this address: 
Data Protection Officer, China Bridge Group (UK) Limited, 1 Lothbury, London, EC2R 7DB
If you withdraw your consent, we may not be able to provide certain products or services to you. If this is the case, we will tell you.

How to complain

Please let us know if you are unhappy with how we have used your personal information. You can contact us by calling into your local branch, by speaking to your relationship manager, by emailing us at datapro.uk@mail.notes.bank-of-china.com or by writing to us at this address: 
Data Protection Officer, China Bridge Group (UK) Limited, 1 Lothbury, London, EC2R 7DB

You also have the right to complain to the Information Commissioner’s Office. Find out on their website how to report a concern. (https://ico.org.uk/concerns/)

We will not charge you where you exercise any of your rights under data protection law in most circumstances. We may however charge a fee for responding to subject access requests which are manifestly unfounded or excessive. We will respond to your requests in accordance with our legal and regulatory obligations.

Changes to this Privacy Notice

We may change this Notice from time to time. You should check this Notice occasionally to ensure that you are aware of the most recent version that will apply each time you access the website.