Last update: December 30th, 2021
PREAMBLE
Sodexo is committed to handling Personal Data in compliance with the Data Protection Law and any other applicable laws and aims to deal promptly and efficiently with any queries relating to the Sodexo entities’ processing of Personal Data.
In some cases, Sodexo entities may act as a Data Processor on behalf of a Client. In this instances the Client is responsible for handling Data subject Requests relating to compliance with the Data Protection Law and the Data subject’s Personal Data.
DEFINITIONS
- Client means organizations or corporations that ask Sodexo to perform services on their behalf for their employees/On-site personnel that are the end-users of these services.
- Commissioner means the Privacy Commissioner for Personal Data established under section 5(1) of the Data Protection Law.
- Complaint means the complaint lodged by a Data subject under section 37 of the Data Protection Law.
- Data Processor means a person who— (a) processes personal data on behalf of another person; and (b) does not process the data for any of the person’s own purposes.
- Data Protection Law means the Personal Data (Privacy) Ordinance (Chapter 486 of the Laws of Hong Kong) and other applicable data protection laws and regulations in Hong Kong.
- Data Subject in relation to Personal Data, means the individual who is the subject of the data. In this policy, a data subject may include, but is not limited to, Sodexo’s current, past or prospective job applicants, employees, Clients, consumers, suppliers/vendors, contractors/subcontractors, shareholders or any third parties.
- Data User in relation to personal data, means a person who, either alone or jointly or in common with other persons, controls the collection, holding, processing or use of the data.
- Hong Kong or HK means the Hong Kong Special Administrative Region.
- Local Single Data Protection Point of Contact means the individual appointed by Sodexo, in charge of handling local data protection issues.
- Personal Data means any data(a) relating directly or indirectly to a living individual; (b) from which it is practicable for the identity of the individual to be directly or indirectly ascertained; and (c) in a form in which access to or processing of the data is practicable.
- Processing or Personal Data Processing meansin relation to Personal Data, includes amending, augmenting, deleting or rearranging the data, whether by automated means or otherwise.
- Request means one of the mechanisms provided by the Data Protection Law to individuals to allow them to exercise their rights (such as the right of access, to correct or to lodge a complaint etc.). An individual may make a Request against any entity which processes its Personal Data.
SCOPE
This policy applies to all Sodexo entities in Hong Kong.
This policy applies to the Processing of Personal Data collected by Sodexo, directly or indirectly, from all individuals including, but not limited to Sodexo’s current, past or prospective job applicants, employees, clients, consumers, children, suppliers/vendors, contractors/subcontractors, shareholders or any third parties, with “Personal Data” being defined as any data-(a) relating directly or indirectly to a living individual; (b) from which it is practicable for the identity of the individual to be directly or indirectly ascertained; and (c) in a form in which access to or processing of the data is practicable.
In this policy, “you” and “your” means any covered individual. “We”, “us”, “our” and “Sodexo” means Sodexo entities in Hong Kong.
YOUR RIGHTS UNDER DATA PROTECTION LAW
Where Sodexo processes your Personal Data for its own purposes, please consult the Section “Your Rights” of our Sodexo Data Protection Policy (Hong Kong S.A.R.).
Where Sodexo processes Personal Data on behalf of a Client, Sodexo will notify the Client of any Data subject’s Request received. Sodexo will cooperate and provide the Client with assistance in relation to the Request, to the extent legally permitted.
WHAT OUR TEAMS WILL DO IF THEY RECEIVE A REQUEST?
Our approach is to engage positively and resolve your Request in a satisfactory manner without you having to file a complaint to the local court or the Commissioner.
If you have any queries with the Processing of your Personal Data, you should not hesitate to raise your query to Sodexo. To help us to deal with your Request, please provide a full written explanation of your query by completing the Request Form below or by completing the Request webform.
Sodexo shall inform its Client acting as Data User of any Request made by a Data Subject as soon as possible. The Client will be in charge of handling such Request and Sodexo will assist the Client in responding to Data Subject Requests. Sodexo will directly handle Requests only when it is agreed with the Client or if the Client disappeared or cease to exist in law or became insolvent. In all other cases, Sodexo will assist the Client in responding to Data Subject Requests.
HANDLING REQUESTS
At the time of drafting your Request and to allow Sodexo to deal promptly with your Request in the most efficient manner, you are invited to follow these steps:
STEP 1: Complete and submit the Request webform or the Request Form by email to the generic email address as indicated in the information notices and/or the privacy policies provided to you at the time of the collection of your Personal Data.
STEP 2: Your Request will be treated confidentially and fully investigated where necessary. During this process, you may receive additional communication from the relevant Sodexo’s Local Single Data Protection Point of Contact to investigate your concern. If you have not provided sufficient information in your Request, we will let you know what further information is needed to process your Request.
STEP 3: Once the information related to your Request is complete, we will contact you within forty (40) calendar days to provide you with an answer. In case we cannot respond to your request in a timely manner or where there are valid grounds for refusal in accordance with the Data Protection Law, we will notify you in writing of the reasons for the delay.
STEP 4: Please note that you can choose to lodge a complaint with the Commissioner in accordance with the Data Protection Law.
You have also the right to lodge your Complaint before the courts where Sodexo has an establishment or where you have your habitual residence.
REQUEST FORM