Privacy Policy

as of December 1, 2021

Basic Policy

OCS is committed to maintaining a secure information environment for its customers.

 

Customers’ personal information is essential in order for us to provide fully satisfactory services. We recognize the importance of the information received from our customers, and make efforts to take the utmost care in handling such information.
In order to have our customers utilize OCS with a sense of safety and trust, we educate our executives and employees thoroughly about laws and company regulations related to personal information, and have established our company’s structure to include measures for safety, thereby doing our utmost for appropriate management and use of each customer’s personal information.

Chapter 1. Handling of Personal Information by OCS

1. Introduction

This Privacy Policy explains how and why the personal information of customers and other individuals obtained by OCS Hong Kong Co.,Ltd. (“OCS”, “we”, “our” or “us”) is used. Please read this Privacy Policy carefully before providing personal information to OCS or using our products or services.

Chapter 1 of this Privacy Policy provides an overview of how we use your personal information. Chapters 2, 3 and 4 provide territory-specific information for customers in the European Economic Area /United Kingdom, the　People’s Republic of China and the State of California (U.S.A), respectively.

Additional policies may apply to certain OCS products or services, details of which will be provided alongside the terms of such service.

2. Scope of application

The Privacy Policy will apply when customers and other individuals provide personal information to OCS or use OCS’s services and products.

3. Purpose of using personal information

OCS utilizes personal information obtained from its customers for the following purposes:

（１）
Acceptance of offer, provision and communication with respect to OCS’s services and products
（２）
Guidance, provision, and management of other services and products offered by OCS
（３）
All operations incidental or related to purposes (1) and (2) above
（４）
Implementation of questionnaires concerning services and products, etc., offered by OCS
（５）
Development of new services and products
（６）
Guidance, operation, management and information provision for various events and campaigns
（７）
Notification of services and products offered by OCS
（８）
Guidance, operation, management and notification of services, products, events and campaigns of ANA and ANA Group companies and partner companies
（９）
Response to inquiries and requests

*In addition to the above-mentioned purposes, personal information will be utilized for the purposes described in Chapter 1 Article 7 (Data sharing) below.

4. Acquisition of personal information

OCS will obtain the following personal information by fair and appropriate means for the purpose of achieving the previously mentioned purposes.

（１）
Identity, contact and payment information, etc.

The customer’s name, address, telephone number, fax number, email address, employment information (company name, division/department the customer belongs to, title, address, telephone number, fax number), mailing address, payment information including details of credit/debit card and other payment methods, etc.

（２）
Details of enquiries and complaints to OCS

Details of enquiries, requests and complaints contained in correspondence with customers, (including their cause and resolution), etc.

*We may monitor, record, store and use any telephone, email or other communication with you in order to check any instructions given to us, for training purposes, for crime prevention and to improve the quality of our customer service.

（３）
IT and system data, including about the usage of the OCS website and mobile application

Information on the use of OCS website and mobile application including cookie and action log on the website, etc.


OCS will never obtain and use information of a sensitive nature to the customer (hereinafter, “sensitive information”), such as information on race, beliefs, social standing, history of illness, crime records, and history of having been afflicted by crime, unless required by laws and regulations or by the consent of the customer.

5. Choice by the customer

As a rule, OCS obtains personal information by the volition of the customer. Customers may experience disadvantages if they refuse to provide their personal information, such as being unable to make use of the various services provided by OCS, or being unable to receive campaign notices and other OCS information because a part of the functions of OCS’s system become inoperable and thereby unavailable. Please note that customers may change their contact information as well as their decision on whether or not they wish to receive email magazines at any time they wish, in a manner designated separately by OCS.

6. Disclosure and provision of information to a third party

OCS will not disclose or provide personal customer information to any third parties except under the following circumstances. Also, customers’ personal information including sensitive information will not be disclosed or provided to third parties under any circumstances, unless allowed by laws and regulations or by consent of the customer. Note that provision of information to data sharing partners and business entrusted companies are not deemed to constitute disclosure or provision to third parties.

（１）
Customer consent has been obtained.
（２）
Disclosure or provision is required within the scope allowed by laws or regulations.
（３）
Disclosure is required to protect human life, health, or property in cases where obtaining customer consent is difficult.
（４）
Disclosure is required to cooperate with the public affairs of national or local governments, and when obtaining customer consent is likely to hinder the administration of public affairs.
（５）
Disclosure or provision of information as statistical data (in a format that does not disclose the customer’s identity).
（６）
Provision of information as a result of the succession of business due to a merger, company split, transfer of business or otherwise.
（７）
Provision of information in accordance to procedures based on laws and regulations, under the condition that the following information can be easily checked by the customers themselves through the OCS website, etc., and that the customers have not declared their wish to refuse provision of their information.
  • １) The purpose of obtaining information is to provide such information to a third party
  • ２) Specific personal data items to be provided to a third party
  • ３) The means by which such personal information is provided to a third party
  • ４) Provisions of information will be suspended upon the customers’ request
  • ５) Methods for accepting requests from customers

7. Data sharing

OCS may share customer information as follows.

Scope of entities that data can be shared

ANA Group companies

Purpose of using data by the user

（１）
For provision of air transportation services, travel services including tours and hotels, and other products/services handled by OCS or companies that share data
（２）
For sending of direct mail and information on products/services, and distribution of questionnaire(s) to customers, etc. by OCS or companies that share data
（３）
For sales Analysis, other research/studies, and development of new products/services, etc. by OCS or companies that share data
（４）
For delivery and transfer of data when we receive inquiries, application for use or other offers from customers regarding products/services provided by OCS or companies that share data
（５）
For appropriate and smooth fulfillment of other transactions with customers by OCS or companies that share data
（６）
For business management/internal management by the ANA Group

Items of personal information to be shared

The customer’s Customer number, the customer’s name, address, telephone number, fax number, email address, employment information (company name, division/department the customer belongs to, title, address, telephone number, fax number), mailing address, content of transactions, ANA Mileage Club membership number, payment information including details of credit/debit card and other payment methods, details of enquiries, requests and complaints contained in correspondence with customers, information on the use of OCS website and mobile application, including cookie and and action log on the website, etc.


Party responsible for management of personal information

ANA Holdings Inc.

8. Business entrustment

In providing products and services to customers, OCS may entrust a part of its business operations to third parties to which personal information may also be disclosed to the extent required to achieve the purpose of the entrustment. In these cases, OCS will implement appropriate measures in managing and supervising such third parties to safeguard the handling of customers’ personal information, including establishing agreements on the handling of such personal information.

9. Transfer to outside of Hong Kong

If OCS provides customers’ personal information to third-party business operators outside of Hong Kong, including business entrusted companies and data sharing partners, OCS will take necessary and appropriate measures to comply with laws and regulations.

10. Management of personal information

In receiving customers’ personal information, OCS will manage such information according to the strictest standards and take the utmost care to prevent leaks, loss, or alterations. OCS ensures that the board members and employees are properly trained regarding appropriate handling to safeguard the security of information identifying individual customers. An appropriate retention period for personal information will be established in accordance with the purpose for which such information is used. After the purpose of the information has been achieved, OCS will dispose of the information in question by appropriate methods.

11. Request about handling of Personal Information

If OCS receives a request from a customer, submitted in the manner specified, for the disclosure, correction, deletion, addition, discontinuance, or erasure (“disclosure, etc.”) of the customer’s personal information stored in a database held by OCS, the request will be handled according to the laws and regulations as follows, within a reasonable timeframe and scope, after confirming that the request was submitted by the customer themselves.

（１）
Request for disclosure
Personal information items or purpose of usage will be disclosed in accordance with the customers’ request.
（２）
Request for correction, deletion, or addition
Correction, deletion, or addition of personal information will be undertaken wherever possible after due review of the request.
（３）
Request for discontinuance or erasure
The use of personal information items designated by the customer will be discontinued, and the relevant information erased if so desired, in accordance with the submitted request. 
However, please note that such requests may prevent customers from being provided with services that they had utilized, or may impede the provision of services in accordance to their wishes.

OCS may not be able to fulfill the customers’ requests if compliance with such requests would seriously impact OCS’s business operations, or result in a violation of laws and regulations.

12. Submission of request for disclosure, etc.

The method for submitting requests for disclosure, etc. or notification of purpose of use of personal information (“requests for disclosure, etc.”) received by OCS from customers, and contact information are as follows.

- Request for disclosure, etc.

（１）
Method for submitting request
Please send the required documents by postal mail to the address below.

Address:
OCS Hong Kong Company Limited
HR & Administration　Division
Shop 1 & 2, G/F., Freder Centre, 3 Mok Cheong Street, Tokwawan,
Kowloon, Hong Kong SAR
（２）
Required documents
Please describe your request and details.

Customer requests for disclosure, etc., may not be acknowledged if any of the required information is missing.

•Documents required for confirmation of identification of individual, etc.

< For individuals >

（１）
Copy of one from the following: Hong Kong ID Card, passport.

< For representatives >

In addition to “ <For individuals>,” the following documents described in (1) and (2) are required.
（１）
Power of Attorney (legal representatives must provide a certifying document)
（２）
Documents to identify the representative (copy of one from the following: Hong Kong ID Card, passport.

13. Modification of the Privacy Policy

OCS may make modifications to this Privacy Policy. If modifications are made, details will be posted on the OCS website (www.ocs.com.hk) .

Chapter 2. Handling of personal information of EEA and UK residents by OCS

1. Introduction

This Chapter 2 provides additional information about the handling of personal information of customers and other individuals in the European Economic Area (“EEA”) and/or the United Kingdom (“UK”) in accordance with EU General Data Protection Regulation 2016/679 (“GDPR”) and the UK Data Protection Act 2018 (“DPA 2018”) and other national and international data protection and privacy laws (together, “Data Protection Laws”).

Please note that the UK’s laws are similar to those in the EEA, and customers from both jurisdictions have very similar rights.  Accordingly, references to the GDPR in this Chapter should also be read as references to corresponding UK law.


A guardian’s consent or permission must be obtained in the event that a customer under the age of 16 uses OCS’s service and consents to this Privacy Policy. The data subject’s consent to this Privacy Policy must be obtained in the event that a person such as family member apply for OCS’s service on behalf of the data subject.

In the event that any provisions of this Chapter 2 contradict those of Chapter 1, the provisions of this Chapter 2 shall prevail.

2. The controller of personal information

The controller of your personal information is OCS.

OCS protects personal information which is collected and used by controllers (who make decisions about how and why your personal information is used) and processors (who act on the controller’s written instructions) on the basis of Data Protection Laws.

3. Our lawful basis for processing personal information

OCS protects your personal information by ensuring that it can only be used to the extent necessary for specific purposes (as set out in Part 3 of Chapter 1 of this Privacy Policy) and by requiring that there is a lawful basis for each processing activity on the basis of Data Protection Laws.

OCS may process customer personal data on one or more of the following lawful bases:

（１）
When your consent is obtained to the processing (Article 6(1)(a) GDPR)
Consent will usually only be relied upon for promotional and marketing related processing, or in some cases, in relation to sensitive personal data.
（２）
When processing is necessary in order to perform or take steps to enter into a contract (Article 6(1)(b) GDPR).
This is typically why we process customer information which is essential to providing our services, including a customer’s identity, contact, payment and travel details, etc.
（３）
OCS needs to process the information to comply with a lawful obligation (Article 6(1)(c)). This includes the requirement to share personal information with customs and immigration authorities or law enforcement, as well OCS’s legal duties towards its staff and customers.
（４）
The information is required to protect your, or a third party’s, vital interests (Article 6(1)(d)), for example in the event of a medical emergency.
（５）
It is in OCS’s or a third party’s legitimate interests to process the personal data, and these interests are not overridden by your rights under Data Protection Laws (Article 6(1)(f) GDPR). This includes the use of personal information necessary to operate OCS’s business and also to maintain, develop and improve its products and services and provide the best possible customer experience.

4. Request about processing of personal information

(1) Data Protection Laws provide you with the following legal rights:


（１）
Request for disclosure: You can request copies of your personal information and details of how we process it.
（２）
Request for correction or updating: Corrections or updates to personal information will be undertaken wherever possible after due review of the request.
（３）
Request for erasure: You may request that we delete all or part of the personal information we hold about you. We will consider your request and, where the information is no longer required or the law does not permit us to continue to retain it, we will delete it.
（４）
Transferring your personal information: You can request a copy of your personal information in a structured, common, machine-readable format. This only applies to personal information which we obtain from you and process on the basis of your consent or in order to perform a contract, and which is processed by automated means.
（５）
Objecting to processing: You can object to processing which is carried out on the basis of our or a third party’s legitimate interests or for the purpose of direct marketing. We will stop processing your information unless we have a strong reason to continue which overrides your objection. If your objection is to direct marketing, we will always stop.
（６）
Restricting how your personal information is processed. You can limit how we process your personal information in certain circumstances. Where this applies, any processing of your personal information (other than storing it) will only be lawful with your consent or where required for legal claims, protecting certain rights or important public interest reasons.
（７）
The right to withdraw consent. If we are relying on consent to process your personal information, you have the right to withdraw that consent at any time.

Please note, the rights set out above are not absolute and do not apply in every situation. There are also legal exemptions which apply in some situations and mean a request may be refused. Of course, if a request is refused we will inform you of the reasons for this when we respond.

Records of requests made to us will be retained so that we can ensure we have complied with our legal obligations.


(2) Method for submitting request

You can exercise your rights free of charge (except in the case of unreasonable, excessive or repeated requests in which case we may charge a fee or refuse the request). The method for submitting request and contact information are as follows.

Please send the required documents by postal mail to the address below.

Address:
OCS Hong Kong Company Limited
HR & Administration　Division
Shop 1 & 2, G/F., Freder Centre, 3 Mok Cheong Street, Tokwawan,

Kowloon, Hong Kong SAR

(Required documents)
Please describe your request and details.

 

(3) Responding to a request

We will respond without delay and usually within one month.  We may, in some cases, ask for identification or (if you are making the request on behalf of a third party) proof of your authority to submit a request.  If your request is particularly complex or you have made a number of requests, it may take longer to provide a detailed response.  Please also bear in mind that there are exceptions to the rights above and some situations where they do not apply.

If you are not satisfied with our response to a data protection request or if you think your personal information has been mishandled, then you have the right to complain to a supervisory authority. Please see Part 9 of this Chapter 2 (“Lodging a complaint with an authority”) for further details.

5. Data sharing which is necessary to provide products or services

OCS’s products and services are provided with the assistance of other companies and organizations and often OCS will need to share personal information with third parties in order to run its business. These third parties include:

（１）
Other companies in the ANA Group
（２）
Organizations with which OCS is legally required to share personal information
including: government organizations, regulatory and law enforcement authorities, judicial, customs and immigration authorities, third-party organization, etc.
（３）
Service providers
including: subcontractor handling cargo, airlines, various service providers, providers with whom we have a marketing partnership, etc.
Where OCS instructs companies, contractors or service providers to process data on its behalf, then it will ensure that it does so pursuant to a contract which meets the requirements of applicable Data Protection Laws.

6. Marketing communications

OCS sends out marketing communications from time to time to notify interested persons of news and provide details of products and services which may be of interest to them. OCS will only do this if the recipient has consented to receive marketing or if they are an existing customer who purchased products or services from OCS and were given the opportunity to opt-out from marketing at the time but chose not to do so.

7. Where your personal information is stored and transferred

OCS is located in United States of America and many of the service providers and other organizations with whom we share your personal information will be located in jurisdictions outside the EEA and UK.

When transferring personal information to third parties OCS will ensure that it complies with the requirements of Data Protection Laws. However, you should be aware that recipients outside the EEA and UK may be subject to national laws which do not necessarily provide equivalent protection for your personal data. If you would like more information regarding where your personal information is stored and transferred please contact OCS using the details set out in Part 12 of this Chapter 1 (“Submission of request for disclosure, etc.”).

8. Retention of personal information

OCS retains customers’ personal information until the purpose of use is achieved. Particularly, OCS has set the retention period for personal information as follows.

（１）
Customer’s　Personal information
Until completion of transportation and related services stipulated in Conditions of Carriage for International Baggage
（２）
Other personal information
Required period for the purpose which customers have consented

9. Lodging a complaint with an authority

Customers have the right to lodge a complaint on the processing of their personal information with the data protection authority having jurisdiction over their residence.　

（１）
EEA residents: Please contact your national supervisory authority, details of which can be found on the European Data Protection Board’s website (https://edpb.europa.eu/about-edpb/board/members_en).
（２）
UK residents: Please contact the Information Commissioner’s Office (www.ico.org.uk).

10. The contact information of the controller and OCS’s Data Protection Officer.

Controller:  
OCS Hong Kong Company Limited
Address:  
Shop 1 & 2, G/F., Freder Centre, 3 Mok Cheong Street, Tokwawan, Kowloon, Hong Kong SAR

Chapter 3. Handling of personal information of China residents by OCS

Besides Chapter 1, Chapter 3 also shall be applied to the handling of personal information of persons residing in the People's Republic of China (hereinafter, "China") based on China Cyber Security Law and related regulations. In the event that any provisions of this chapter contradict those of chapter 1, the provisions of this chapter shall prevail.

1. Introduction

A guardian's consent or permission must be obtained in the event that a customer under the age of 18 uses OCS's service and consents to this Privacy Policy. The data subject's consent to this Privacy Policy must be obtained in the event that a person such as a family member applies for OCS's service on behalf of the data subject.

2. Retention period for personal information

OCS will retain the customer's personal information until the purpose of use is achieved. In particular, OCS sets the retention period for personal information as follows.　

（１）
Customer’ personal information
Until the completion of transportation and related work stipulated in the Conditions of Carriage for International Baggage.
（２）
Other personal information
Required period for the purpose which customers have consented.

3. Technology and measure to protect customers’ personal information

（１）
OCS takes security measures to protect customers' personal information from leakage, loss or damage. Specifically, OCS takes the following measures to protect customers' personal information.

（２）
OCS will take all reasonable and practicable steps to ensure that no irrelevant personal information is collected. OCS will only retain customers' personal information for the period of time required to achieve the purposes stated in this Privacy Policy, unless an extension of the retention period is required or permitted by law.
（３）
In the event of personal information being at risk, OCS will promptly inform customers of the relevant circumstances of the incident in accordance with the requirements of laws and regulations and report to the regulatory authorities.

4. Request about handling of Personal Information

In the event that OCS receives a request of the customer's personal information held by OCS from a resident of China, the request will be handled according to the related laws and regulations within a reasonable timeframe and manners besides Chapter 1 Article 11 (Request about handling of Personal Information), after confirming that the request was submitted by the customer himself/herself.　

（１）
Request for withdrawal
Personal information will be deleted or suspended in accordance with the customer's request, wherever possible and appropriate, after due review of the request.

However, please note that such requests may prevent customers from being provided with services that they had utilized, or may impede the provision of services in accordance with their wishes.
（２）

Methods for submission of requests
Customers may submit requests by following methods.

1) Submission of requests
Please send the required documents by postal mail to the address below.
Address:
OCS Hong Kong Company Limited
HR & Administration　Division
Shop 1 & 2, G/F., Freder Centre, 3 Mok Cheong Street, Tokwawan,
Kowloon, Hong Kong SAR

2) Required documents
Please describe your request and details.
Customer requests for disclosure, etc., may not be acknowledged if any of the required information is missing.

•Documents required for confirmation of identification of individual, etc.

< For individuals >
(1) Copy of any one of the following: Hong Kong ID Card, passport

<For representatives>
In addition to “<For individuals>,” the following documents described in (1) and (2) below are required.

（１）
Power of Attorney (legal representatives must provide a certifying document)
（２）
Documents to identify the representative (copy of one from the following: Hong Kong ID Card, passport

3) Contact Desk
Hong Kong +852-2122-9802 (Charged)

5. Transfers

When OCS share personal information of customers or entrust it to third parties within the scope of the purposes of use, OCS may transfer personal information to companies that can share data or entrustee(s) and such third parties will handle it. Third parties to whom OCS will disclose the personal information of the customers include those located outside China, the customers shall be deemed as having consented to the following matters by consenting to the Privacy Policy:　

（１）
In the case that the country which the third party is located outside China does not have the same data protection laws as China, many of the rights provided in China to the data subjects will not necessarily be provided.
（２）
The customers' personal information may be provided for the purposes specified above to the subsidiaries and affiliates of OCS or third parties outside China.

6. Change of purposes of use of personal data

In the case of a change to the purposes of use of personal information, OCS will announce the revised Privacy Policy in advance on OCS website (www.ocs.com.hk) and OCS will use personal information in accordance with the new purposes of use of personal information after obtaining consent from customers.

7. Basic information of Controller of personal information

OCS Hong Kong Company Limited
Address: Shop 1 & 2, G/F., Freder Centre, 3 Mok Cheong Street, Tokwawan, Kowloon, Hong Kong SAR

Chapter 4. Handling of personal information of California residents by OCS

Last updated on December 1, 2021

Besides Chapter 1, Chapter 4 also shall be applied to the handling of personal information of persons residing in California, United States of America based on the California Consumer Privacy Act of 2018 (hereinafter “CCPA”). In the event that any provisions of this chapter contradict those of chapter 1, the provisions of this chapter shall prevail.

The terms used in this chapter are based on the definitions provided in CCPA. For example, the term “sale”, among others, means OCS’s selling, lending, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information to another business or a third party for monetary or other valuable consideration. However, if OCS concludes an appropriate agreement concerning the handling of personal information with another business or a third party, the activities mentioned above are not regarded as “sale” from the perspective of CCPA.

1. Acquisition and use of personal information

Personal information collected by OCS in the preceding 12 months or likely to be collected in the future is classified as defined in the following table. OCS uses such information for the purposes set forth in Chapter 1, Article 3 (Purpose of using personal information). It will acquire such personal information directly from customers.

Type of personal information collected Example of personal information
Identifiers (name or symbol, etc. used to uniquely identify a particular subject) The customer’s name, address, telephone number, fax number, mailing address, email address, passport information, and ANA Mileage Club membership number, etc.
Additional data subject to the California Customer Records statute (personal information categories in Cal. Civ. Code Sec. 1798.80(e)) Credit card number and payment information including details of credit/debit card and other payment methods, etc.
Commercial information Credit card expiration date, usage history of credit card and related information, usage history of OCS services, details of purchase from OCS, details of enquiries, requests and complaints contained in correspondence with customers, etc.
Internet or other electronic network activity information. Information on the use of OCS website and mobile application including cookie and action log on the website, etc.
Professional or employment-related information Employment information (company name, division/department the customer belongs to, title, address, telephone number, fax number) and related information

2. The sharing of personal information

（１）
Sale of personal information
OCS will not sell customers' personal information (including personal information concerning minors) to any third parties, and has not sold the same in the past 12 months.
（２）
Disclosure of personal information for business purposes
The types of customers’ personal information that OCS has disclosed in the past 12 months for business purposes and the types of third parties to which such personal information has been disclosed are shown below.
Type of personal information collected Example of personal information Third party to which the personal information has been disclosed in the past 12 months
Identifiers (name or symbol, etc. used to uniquely identify a particular subject) The customer’s name, address, telephone number, fax number, mailing address, email address, passport information, and ANA Mileage Club membership number, etc. Other companies in the ANA Group, subcontractor handling ANA flights, airports and airlines who we partner with, various service providers, providers with whom we have a marketing partnership, government organizations, regulatory and law enforcement authorities, judicial, customs and immigration authorities, third-party organization, etc.
Additional data subject to the California Customer Records statute (personal information categories in Cal. Civ. Code Sec. 1798.80(e)) The customer’s physical and medical information relating to flying, credit card number, and payment information including details of credit/debit card and other payment methods, etc. Other companies in the ANA Group, subcontractor handling ANA flights, airports and airlines who we partner with, various service providers, providers with whom we have a marketing partnership, government organizations, regulatory and law enforcement authorities, judicial, customs and immigration authorities, third-party organization, etc.
Characteristics of protected classifications under California or federal law The customer’s dietary restrictions, etc. Other companies in the ANA Group, subcontractor handling ANA flights,
Commercial information The type of customer’s ANA Mileage Club membership card, membership status, membership area, mileage status, credit card expiration date, usage history of credit card and related information, need for wheelchair or other special arrangement, flight reservation and cancellation information, usage history of flights and other services, details of travel plans and arrangements, including flights with ANA and other airlines, accomodations, and other transportation arrangements, details of enquiries, requests and complaints contained in correspondence with customers, etc. Other companies in the ANA Group, subcontractor handling ANA flights, airports and airlines who we partner with, various service providers, providers with whom we have a marketing partnership, government organizations, regulatory and law enforcement authorities, judicial, customs and immigration authorities, third-party organization, etc.
Internet or other electronic network activity information. Information on the use of ANA website and mobile application including cookie and action log on the website, etc. Other companies in the ANA Group, various service providers, providers with whom we have a marketing partnership, government organizations, regulatory and law enforcement authorities, judicial, customs and immigration authorities, third-party organization, etc.
Professional or employment-related information Employment information (company name, division/department the customer belongs to, title, address, telephone number, fax number) and related information Other companies in the ANA Group,
various service providers, providers with whom we have a marketing partnership, government organizations, regulatory and law enforcement authorities, judicial, customs and immigration authorities, third-party organization, etc.

3. Request about handling of Personal Information

Customers living in California have the following rights concerning their personal information:

（１）
Access right
Customers have the right to make a request to OCS for the disclosure of the following information regarding their personal information collected/used/disclosed by OCS within the 12 months before the date of request (hereinafter “Access Right”), up to twice in 12 months.

（２）
Deletion right
Customers have the right to make a request to OCS for the deletion of their certain personal information collected by OCS (hereinafter “Deletion Right”).

When exercising the Access Right or Deletion Right, please contact the following. Once OCS receives such a request, it will be handled according to the related laws and regulations within a reasonable timeframe and manner, after confirming, through the procedures for individual identification described below, that the request was submitted by the customer himself/herself.

1) Submission of requests
OCS Hong Kong Company Limited
HR & Administration　Division
Shop 1 & 2, G/F., Freder Centre, 3 Mok Cheong Street, Tokwawan, Kowloon, Hong Kong SAR

2) Procedures for individual identification
<For individuals>
Upon receiving a request for the exercise of the Access Right or Deletion Right, OCS will ask the customer to submit information sufficient to confirm that such request was submitted by such customer himself/herself, such as his/her name and email address, and compare the submitted information with the information held by OCS.

<For representatives>
In addition to the information required for the identification of individual in “<For individuals>,” a power of attorney (legal representatives must provide a certifying document) needs to be submitted. In addition, OCS may ask the customer to directly contact OCS to confirm that he/she has granted the representative authority to exercise the Access Right or Deletion Right.

As a rule, OCS will not treat customers who have submitted such requests in a discriminatory manner, such as changing their services. Even so, please note that deletion requests may prevent customers from receiving services which they have been provided with, or may impede the provision of services that are in accordance with their needs.

How we deal with your personal information on our website

The following describes how we treat personal information gathered via the OCS website. If you wish to know more about our general policy on privacy protection, please refer to the OCS Privacy Policy document.

1. Introduction

This document defines how we deal with information gathered via the OCS website and is based on the OCS Privacy Policy. OCS makes every effort to protect your privacy so that you can use the ANA website with confidence and peace of mind.
By using the OCS website you are deemed to have understood and agreed to the following content:

[Scope]

This processing shall be applied when customers use this website (ocs.com.hk domain) and shall not be applied to sites operated by other companies. This website provides links to other websites in order to provide useful information and services for customers. The privacy policy shall not be applied to linked sites. When browsing a site, we recommend that customers check the content of its statement on privacy protection.

2. Security

[Security technology which protects personal information]

Protection of personal information is secured using SSL (Secure Sockets Layer) encryption technology. This means that any information you provided when using this site cannot be accessed by an unauthorised third person. Furthermore, a firewall and anti-virus measures have been installed to prevent disclosure, appropriation, alteration, etc, of personal information.

* Secure sockets layer (SSL) mechanism

Before customers send their personal information, SSL performs electronic communication concerning security (digital authentication and digital signature) between OCS and customers, and transmits data after mutual authentication. At that time, communication between OCS and a customer is disturbed by random numbers and erroneous transmissions, which are sent to a third party, preventing attempts to steal data by impersonating the customer.

In addition, information transmitted by SSL is encrypted concurrently using two types of cryptographic scheme: public key cryptosystem (RSA) and common key cryptosystem (secret key cryptosystem). An electronic "key" is required to decrypt this information. Even if the information is intercepted by a third party, it is impossible to decrypt the encrypted information without the correct key. Types of key are limited, however, it is extremely difficult for a third party to decipher the information because it takes an unrealistically long time to try all keys in order and reach the correct key, even if the third party uses electronic means with a personal computer, etc.

3. Collection of data

[Site access]
We collect the following information to help customers use our services with confidence when they browse our website. In addition, we may analyze customers’ browsing histories, etc. on our website and use the same to improve the website, enhance information, and offer services and promotions.

（１）
Use of Cookies*1/Individual Identification Number*2 of Mobile Device
We use cookies/individual identification number of mobile device for the purpose of collecting the following information in order to have customers use services with confidence when they browse our website. The use of cookies may be changed at any time through the settings of Internet browsing software (browser). Customers are free to decide, however, please note that customers may become unable to enjoy some functions of the website.

  • Log-in data for OCS web services
  • Data from personalised pages
  • Page settings
  • Registration data from special campaigns, etc
  • Site access history (using Web beacons*3)
（２）
Use of IP address*4
We collect IP addresses for the purpose of providing information tailored to a customer’s area. When a customer browses our website, we determine the region from which the customer is accessing it through the customer’s IP address, which, however, does not identify the customer.

[E-mail]

When we send mail to our customers, the following data may be collected:
  • The status of HTML e-mails, ie, whether they have been opened or previewed (using Web beacons*3)
  • Whether our site has been accessed via a link in a text e-mail or HTML mail.

*1Cookies

  1. A cookie is a function for storing information that a user has used this website through that user's computer. Information collected through cookies does not include any information that can identify individuals such as e-mail addresses and names.The Help button on the tool-bar of almost all browsers explains how to refuse the registration of new Cookies, how to switch off the Cookie function, and can also be used to alert you to a new Cookie.
  2. We shall be able to provide information collected through cookies to a third party to the extent necessary for achieving the purpose set forth in "(1) Use of Cookies/Individual Identification Number of Mobile Device" through this processing.
  3. The user shall be able to select whether or not to use cookies specified for each purpose himself/herself, and shall set cookies according to the setting method of the web browser he/she uses. If the user uses this website using cookies, he/she is deemed to have agreed that we use, etc. the information that he/she had used this website.

*2Individual identification number
Based on the mobile phone calling in.


*3Web beacon
Minute pictures invisible to the naked eye (1x1 pixel GIF) that are embedded into webpages or HTML e-mails and used to record the following data: opening/ previewing of e-mails, and access to websites using links in e-mails. OCS uses Web beacons when distributing HTML e-mail (except reservation related e-mails).


*4IP address
This comprises numbers automatically assigned to a customer’s computer when the customer browses various websites. The web server (the computer that provides the homepage) automatically recognizes the customer’s computer from the IP address and communicates.