Privacy Policy

 

Statement of Policy

eMPF Platform Company Limited (“we” or “us”) is mandated under the Mandatory Provident Fund Schemes Ordinance (Chapter 485 of the Laws of Hong Kong) (the “MPFSO”) to, inter alia, provide Mandatory Provident Fund (“MPF”) scheme administration services to facilitate approved trustees of registered schemes in performing their scheme administration functions and, for this purpose, operates the “electronic MPF system” (as defined in the MPFSO) and other offline facilities including the service centres, administrative centres and call centres (collectively the “eMPF Platform”).

We are committed to protecting the privacy, confidentiality and security of your personal data in the eMPF Platform by complying with the requirements of the Personal Data (Privacy) Ordinance (Chapter 486 of the Laws of Hong Kong) (the “PDPO”). We are equally committed to ensuring that all our employees, contractors and authorized service providers and agents uphold these obligations.

Privacy Practices

Purposes of collection

When we collect personal data from you, a Personal Information Collection Statement (“PICS”) which states, amongst other things, the purpose(s) for which the personal data will be used will be provided to you on or before the collection in an appropriate format and manner. The most recent version of the PICS is available at www.empf.org.hk/pics. The personal data provided by or in respect of you (including personal data disclosed to us by your employers or approved trustees of your MPF schemes) will only be used for the purposes specified in the PICS or otherwise applicable at the time of collection by, or disclosure to, us. The main purposes include performing MPF scheme administration work, handling your enquiries or requests, and providing other services and functions in connection with the eMPF Platform or otherwise under the MPFSO.

Your personal data

The types of personal data we may retain in respect of you include, but are not limited to:

  • Information shown on your Hong Kong Identity Card (“HKID Card”) including your HKID Card number, English name, Chinese name (if available), gender, and date of birth, and similar information appearing on your other identity documents;
  • a copy of your HKID Card or other identity documents;
  • your contact details including contact phone number, email address and/or address;
  • financial or account information under your MPF schemes;
  • payment details such as electronic banking information; and
  • details of any transaction relating to your MPF accounts or generally your dealings with the eMPF Platform.

Video surveillance at service facilities

When you visit our service centres or other offline facilities, static or moving images and footages of you may be collected through our video surveillance systems (collectively, “surveillance records”).  These surveillance records are used for the security of our premises and the protection of our staff and visitors, and for the prevention, detection and investigation of crime, incidents and unlawful behaviour.  Access to such surveillance records is restricted to authorized personnel and, where required, may be provided to law enforcement agencies or other competent authorities.  Such surveillance records will be retained for a reasonable period consistent with the purposes for which it is collected and in accordance with applicable laws and regulations, after which it will be securely deleted.

Information collected on electronic devices

  • Use of cookies – When you use our website and its webpages (the “eMPF Website”), cookies (i.e. text data files containing users’ preference, etc.) will be stored on your electronic device. The purpose of our cookies is to improve user experience. No personal data will be collected in these circumstances. You may choose to block certain cookies by managing the cookie settings within your browser. However, if you do so, you may not be able to access certain functions on the eMPF Website. You can find out more about the types of cookies we collect, how these cookies are used and how to manage your cookie settings in our Cookie Policy available at www.empf.org.hk/page/cookie-policy.
  • Statistics – We record the number of visits to the eMPF Website, the webpages visited and the visitors’ Internet Protocol (IP) addresses for compiling aggregated, anonymous, statistical data so that we may better cater to the behaviour of users of the eMPF Website. No personal data will be collected in these circumstances.
  • Information about mobile application – We access information about the mobile applications from time to time installed on your mobile device, including the permissions you have allowed for each of these mobile applications, in order to check whether there is any malware or suspicious applications installed on your mobile device. No personal data will be collected in these circumstances.

Retention

We maintain and implement retention policies for records containing personal data to ensure that such personal data is not kept longer than necessary for the fulfilment of the purposes for which it is to be used in compliance with applicable laws and regulations. The retention period applicable to each category of personal data is determined by reference to the nature of the data, the purpose for which it was collected, the specific legal or regulatory retention obligations applicable to that category of data.  Your personal data may be retained for a longer period where it is necessary to comply with legal or regulatory requirements, including but not limited to responding to pending or anticipated complaints, conducting any investigations or (potential) legal proceedings.  Personal data collected for identity verification purposes will be securely deleted after those purposes have been fulfilled, unless a specific legal or regulatory retention obligation requires its continued retention.

Outsourcing Arrangements

The eMPF Platform is maintained and operated by our contractor and a number of third-party service providers. Our contractor and these third-party service providers may have access to your personal data in the eMPF Platform as data processor (defined under the PDPO). Our contractor and these third-party service providers are under contractual obligations to:

  • take appropriate security measures to protect the personal data;
  • prevent unauthorized or accidental access, processing, erasure, loss or use of the personal data they may come into contact with;
  • prevent personal data from being kept longer than necessary for the fulfilment of the purposes for which the data is collected; and
  • have in place personal data protection policies and procedures and provide adequate training to relevant staff to ensure that its relevant staff will carry out the security measures and comply with the contractual obligations regarding the handling of personal data.

Direct marketing

With your consent, we may use your personal data to promote and market products and services relating to the eMPF Platform to you, and to offer you or advertise the availability of any facilities or services relating to the publicity, promotional, educational and other similar activities of the Mandatory Provident Fund Schemes Authority.

With your written consent, we may provide your personal data to the approved trustees of MPF schemes in which you participate or have participated in and such approved trustees may transfer your personal data to the MPF scheme provider of such MPF schemes, each for their direct marketing of products and services to you.

Protection measures

We will take practicable steps to ensure that your personal data in the eMPF Platform is stored in a secure location and is accessible only by authorized personnel on a “need-to-know” basis. We use encryption to protect personal data transmitted electronically.

Identity authentication

To authenticate your identity when you access the eMPF Platform online, we may use the “iAM Smart” system. You may also authenticate your identity in person at our service centres using the “iAM Smart” kiosks. Where the biometric authentication function built into your mobile device is used as part of the authentication process, we will not have access to any of your biometric data.

Use of technology in data processing

We may use artificial intelligence and other technology tools to process and analyze personal data for the purposes described in this Privacy Policy and in the PICS. Any such use will be subject to appropriate safeguards consistent with the requirements of the PDPO and our data protection practices described in this Privacy Policy.

Accuracy of personal data and data access request

We will make reasonable efforts to ensure that your personal data on the eMPF Platform is accurate and up-to-date. However, this means that you must also inform us of any changes in your personal data, and failure to do so may result in delays in processing, or our inability to process, any request or transaction relating to you or your MPF scheme.

You are also entitled to request access to, and to request the correction of, your personal data being held by us. You may also submit an enquiry or complaint in relation to your personal data. For any such request, please contact our Data Protection Officer:

Mail: PO Box 98929 Tsim Sha Tsui Post Office
Email: dpo@support.empf.org.hk

For more information, please refer to the PICS which is available at www.empf.org.hk/pics.

Miscellaneous

This Privacy Policy may be amended from time to time. You may access the latest version of this Privacy Policy at https://www.empf.org.hk/page/privacy-policy to stay informed of how we collect and use your personal data.

If there is any inconsistency or ambiguity between the English and Chinese versions of this Privacy Policy, the English version shall prevail.

Last Revision Date: 12/08/2026

Back To Top