Privacy and Security Notice

This is our website notice.

We have other notices. Some of these may apply to you as well. It depends on how you choose to interact with us.

• Public website notice (you are here): This notice covers parts of this website where you don't need a password (like this page).
• Full privacy notice: Our full privacy notice contains more information to read alongside this notice. It will tell you more details on how HSBC uses your personal information in general. You can read here
• Cookie notice: This notice covers how we collect information from your web browser or mobile device. You can find out more at here
• Other notices: Some of our apps or parts of our websites have their own privacy notices. For example, mobile apps have privacy notices. So does our careers section of our website at hsbc.com/careers.

You can usually find our notices in the footer of the webpage. If you're using an app, it will usually be in the menu. Our full privacy notice is our main one and can be found at here

We collect information when you use our website. We also do this when you visit one of our social media sites.

When you view our website or social media sites, we can see:

• What you click
• What you view
• How long you spend on pages
• Your device & internet connection details such as: type of device you're using, IP address and details about your internet connection, technical details such as your screen size and the software you're using, such as your web browser.
• Your country or region (not exactly where you are unless we ask permission)
• Your unique advertising or other identification numbers allocated to your browser or device.

If you follow a link to this website, we know the last site you visited. You may have reached this website by following a link from an email. When you open an email from us, we may be able to tell:

• that you've opened it.
• what links in the email you click on.

When you fill in a form on our website, we can see what you type.

If you send us a message, we may collect information you tell us.

Some of this data is collected by:

Our partners: These may be website hosts or social media sites.

Cyber-security filtering technology: This keeps our website safe from fraud and crime.

Cookies and similar technology: These are set on your device by us and our trusted partners.

We don't often know exactly who you are from this data. But sometimes we may connect this data with other information we hold about you.

For example:

• If you browse our website and then access online banking, we may connect this data to you. The next time you visit, we may still link that data to you.
• If you browse our website while logged into social media accounts, then our partners may be able to connect this data to those accounts.

It might be possible to connect your browsing data to personal data held by third parties.

We use your data when it is in our legitimate interests.

This means we need to have a valid and lawful reason to use your data and balance this with your interests.

HSBC Bank Malaysia Berhad ('HSBC Bank') and HSBC Amanah Malaysia Berhad ("HSBC Amanah") collectively known as "HSBC", collect, use and share information about you so that it can provide you with a bank account and related services. This App Privacy Notice explains how HSBC collects, uses and shares your information when you use this app, including information about the device that the app is installed on e.g. your mobile phone or tablet.

This app is provided by HSBC Global Services (UK) Limited for and on behalf of HSBC, and all products and services accessed via this app are provided by HSBC.

We use a range of measures to keep your information safe and secure which may include encryption and other forms of security. We require our staff and any third parties who carry out any work on our behalf to comply with appropriate compliance standards including obligations to protect any information and applying appropriate measures for the use and transfer of information.

We'll keep your information in line with our data retention policy. For example, we'll normally keep your main banking information for a period of seven years from when our relationship with you ends. This allows us to comply with legal and regulatory requirements or use it where we need to for our legitimate purposes such as managing your account and dealing with any disputes or concerns that may arise. We may need to keep your information for longer where we need the information to comply with regulatory or legal requirements, help detect or prevent fraud and financial crime, answer requests from regulators etc. If we don't need to keep information for this length of time, we may destroy, delete or anonymise it sooner.

This section explains what information HSBC collects from your device, how it uses it, and whether it shares it. In some cases, e.g. when accessing the contacts stored on your device, or photos that you take with your device, HSBC will first ask your permission. HSBC may share your information with other HSBC group companies and any sub-contractors, agents or service providers who work for us or other HSBC group companies (including their employees, sub-contractors, service providers, directors and officers) to provide you with products or services that you ask for (such as bank accounts and payments) and as explained in our main privacy notice - this type of data sharing is not included here. For more details on how we process your personal data, you can read our Notice to Customer Relating to Personal Data Protection Act.

Permissions for devices:

• Location: Your approximate location can be used to prevent fraud when you're using the HSBC app.
• Device information and internet access: This allows us check if you have a working internet connection.
• Biometric information: This allows you to use biometrics authentication (like fingerprints or facial recognition) to logon to our app. If you do so, we rely on your device's technology to authenticate you and we do not collect or store your underlying biometric data.
• Device camera and photo library: This allows you to take a photo or video and immediately share it with us or access the content from the photo library in order to allow us to provide you with a bank account or related services.
  Non-exhaustive examples of when we may ask you to do this include to scan a QR code to make a payment.
• Push messages: This allows you to receive instant notifications from our app about activity on your account or to inform that you've received a chat message from HSBC.
• Contact details: This allows our app to access your contacts so that you can transfer money to people in your address book using their phone number or email.

Permission specific to iOS devices:

• App tracking transparency: This allows you to grant us the permission to track your activities across other companies' apps and websites (versions iOS 14.0 and above only).

Permission specific to Android devices:

• External storage device (eg, a memory card): This allows the app to save files onto your device's external storage. This allows you to store and send documents such as loan agreements or eStatements.
• Application permission: This allows Google Play Store to record where you downloaded the HSBC app from.
• Application information: This allows us to collect information about applications installed on your device, and lets us check whether you might have risky applications installed. This helps us protect you and us from financial crime.

Tools:

Our app includes tools that collect information about your device and the way you use it online to:

• allow you to log on to our app,
• provide our app's core services and features, and measure their performance,
• protect the security of our app, for example, to make sure the app is only accessed by genuine users,
• help us to identify suspicious behaviour on our app so we can protect both you and us from fraud,
• ensure our app's optional features and services work, which may include both allowing us to customise what you see on our app and where based on what we know about you, and also helping to prevent fraud and maintain security on other apps, websites or services that you haven't asked to use when you're on our app,
• enable us to understand how you use our app, so that we can improve how our app works, e.g. by using analytics providers to identify and count uses of our app and to see which pages people go to and what they do there, and
• understand what you're interested in on our app and on social media, and potentially identify what directed you to our app, so that so we or our partners can personalise our marketing to you.

Some of these tools are provided to us by external service providers and third parties.

To deliver the website

We use your information to operate the website and monitor how well it is working. Most websites do this.

To improve our business

We use your information to:

• Understand how you use our services.
• View trends in product offerings.
• Develop well targeted offers and products.
• Find offers and products that may be of interest to you.
• Make our services better for you.
• Learn how useful our marketing is and make it better.

Security & protection

We use your information to help protect you and ourselves against fraud or crime. For example, our service providers look at all use of our website to help block malicious activity. This helps keep you and us safe.

One of our security providers is Google ReCaptcha. Google asks us to tell you that this is subject to the Google Privacy Policy and Terms of Use.

Personalising our website

When you visit our website, we may use data we collect to make the site reflect you. This could include:

• Tailoring our website content and services for you.
• Showing your information or updates that might be useful for you.
• Showing products or services that we think will be of interest to you.

Online advertising

When we advertise online, we may share your information with our advertising partners. 

We may ask our advertising partner to use that information to:

• Check if you hold an account with them.
• Choose which adverts to send to you.
• Send our adverts to you.
• Exclude you from adverts, e.g. if the advert is for a service you already use.
• Advertise to people who have a similar profile to you or share your interests.
• Identify what other marketing may be of interest to you.
• Understand how useful our marketing is and make it better.

Social Media

HSBC uses social media to:

• Help connect with you.
• Share information about our products and services.
• Sometimes these involve using your data.
• Social media platforms may let you choose what advertising you receive. You should contact them for more information

Facebook

When you use an HSBC Page on Facebook, Facebook Malaysia and HSBC collect information about you. This includes: 

• What you click on: if you start a messenger conversation. 
• What you view: when you hover over a link or have an event page on screen.
• What you say: like comments or reactions.
• Your actions: like sharing or recommending.
• Your activity: how long you spend on pages, date and time of actions or websites you visited before you took the action.
• Your location: Country or region. This is not your precise location unless you have provided this in your user profile and you are logged-in.
• Your device and internet connection.
• Your Facebook profile details and user ID.

HSBC has access to this information to use for reporting, insights and marketing purposes and so does Facebook. 

This helps HSBC improve our offering on Facebook and create better marketing. HSBC may also see this information if HSBC has communicated with you on Facebook. HSBC does this because it helps us know who we're speaking to.

If you've allowed us to use cookies that support our marketing, HSBC and Facebook can collect this information when you use HSBC's site too. To learn more, or to switch this off, please visit our Cookies Notice at here. You can control which cookies you allow by selecting "Manage Cookies".

Facebook

Facebook Malaysia is a 'joint controller' with us in law for processing where we collect information about you:

• From your actions on our Facebook page.
• Through the Facebook pixel on our website.

We and Facebook have agreed to share some responsibilities to protect your personal data, by:

• Making sure we each have a legal basis for joint processing.
• Honouring your legal rights in respect of your data.
• Ensuring security of joint processing.

You can contact HSBC about how we do this. You can also contact Facebook about what they do. This includes exercising your legal rights in respect of the data Facebook collects and retains itself.

Further details of how Facebook processes your personal information, the legal basis it relies on, your rights and Facebook's contact details can be found at https://www.facebook.com/about/privacy.

We think carefully about how we use your information. We always aim to use it in a way that's fair to you. You might prefer us not to use it for some purposes.

You have a legal right object to our processing of your information in some circumstances. For example to ask us not to send you direct marketing materials. We may not always be able to stop processing your information, such as if we're using it to help protect you or others or when it is necessary to provide you banking services or to fulfil legal and regulatory obligations.

We have a couple more things to tell you.

• Transfers: We transfer your information outside of Malaysia. For more information, please refer to our privacy notice below
• Security: We'll use a range of measures to keep your information safe and secure, such as encryption.
• Storage: We keep your information in line with our data retention policy. We do this to comply with legal and regulatory requirements, and for our legitimate purposes.

Our full privacy notice contains more information about these topics at here

Thank you for reading this privacy notice. Happy browsing.

We try to protect your personal data against unauthorised or accidental access or processing.

• implementing appropriate physical, electronic and internal processes to safeguard and secure your personal data,
• using 128-bit Transport Layer Security ("TLS") encryption technology, which is an industry standard for encryption over the internet to protect data, in the secure area of this site/app. When you provide sensitive information such as credit card details, it will be automatically converted into codes before being securely dispatched over the internet,
• protecting our web servers behind "firewalls" and our systems are monitored to try to prevent any unauthorised access,
• using the secure email facility if we need to send personal data to you by email. We won't send your personal data by ordinary email,
• taking all practical steps to ensure that personal data will not be kept longer than necessary and we comply with all laws and regulations in Malaysia concerning the retention of personal data.

Keep your account details and security details secure.

This means taking steps like:

• not sharing or allowing anyone else to know your username, password, 6-digit pin and Security Code so don't write them down. We'll never verbally ask you for your password.
• choosing a username and password that are not easily identifiable by others (such as your birthday, telephone number or email address),
• using the secure email facility on this app/website for general enquiries.

This means taking steps like:

• keeping your device locked when not in use, with a PIN, password or biometric authentication,
• not sharing your device. If you do allow someone else to use your device, please supervise their use to ensure that they don't access your accounts,
• not sharing or allowing anyone else to know any access password that you use on your device,
• if you choose to activate the feature that allows you to use your biometric credentials to log onto your device or this app, ensuring that only your biometric credentials are registered on the device to avoid unauthorised access by other people,
• only downloading HSBC apps and its updates from an official app store and not from any unofficial sources,
• installing the latest anti-virus and anti-spyware software on your device that you use to access this site/app, and keeping it updated. When installing protection, always use a reputable brand from a mainstream supplier,
• ensuring the operating system running on your device and the security update is up to date,
• not disclosing your online banking credentials to any third parties (including third party mobile aggregator apps),
• not using HSBC apps and the Mobile Secure Key Feature on any device or operating system that has been modified outside the mobile device or operating system vendor supported or warranted configurations. This includes devices that have been "jail-broken" or "rooted". A jail broken or rooted device means one that has been freed from the limitations imposed on it by your mobile service provider and the phone manufacturer without their approval. The use of HSBC apps and the Mobile Secure Key feature on a jail broken or rooted device may compromise security and lead to fraudulent transactions which we may not be responsible for.

If you think that your device has been lost, stolen or is being used by another person or if you think your username or password is known by someone else, please tell us straight away. You may be responsible for unauthorised payments made from your accounts if you have not kept your device, account details or security details safe or if you haven't followed the security precautions that we advise you to follow from time to time.

For more tips on staying safe on Online Banking, please read: Safe-internet-banking and on mobile banking, please read: mobile-security

Cookies are small bits of information that are automatically stored on your web browser in your computer, mobile phone or other device for accessing the internet that can be retrieved by this site/app. We will be able to access the information stored on the cookies and record how you use this site/app.

Cookies are useful because they allow us to recognise your device and they store information about your use of this site/app which enables us to provide more useful features to you, to tailor the content of our website and mobile applications to suit your interests and, where permitted by your marketing preferences, provide you with promotional materials or direct marketing based on your usage patterns.

Most browsers are initially set to accept cookies. If you prefer, you can set your browser to disable cookies – you can do this through your browser setting (your browser's 'help' function should tell you how to do this). You cannot manage cookies in the app. 

By disabling cookies, you may not be able to take full advantage of this site, including HSBC Online Banking. 

If you accept cookies during your use of this site or continue to use this app, you will be acknowledging that your information is being collected, stored, accessed and used as outlined above.

We may work with third parties to research certain usage and activities on this site/app on our behalf. These third party agencies include Google, Yahoo!, Meta, Nielsen//NetRatings,Adobe, Tradedesk, MediaMind (BurstingPipe), Eloqua, Tealium (Tag Management, Audience Stream Customer Data Platform), Outbrain, LinkedIn, Liveperson, Qualtrics, Twitter, Brightcove and Dun & Bradstreet, Heap and Optimizely.

They use technologies such as cookies, spotlight monitoring (this manages tagging which is used for example, to track which advertisement users clicked on to take them to a site) and web beacons (these are used to monitor the behaviour of the user, for example whether they scroll down a page) to collect information for this research. They use the information collected through such technologies (i) to find out more about users of this site/app, including user demographics and behaviour and usage patterns, (ii) for more accurate reporting and (iii) to improve the effectiveness of our marketing. They aggregate the information collected and then share it with us.

As part of the information that we share with them, we may share your advertising identifier and "installation event" (which means the data in relation to when you first install or use this site/app). No personally identifiable information about you is collected or shared by third party agencies with us as a result of this research.

Should you wish to disable the cookies associated with such technologies, you may change the setting on your browser. However, you may not be able to enter certain parts of this site, including HSBC Online Banking.

To find out more about the use of cookies and the information-collecting practices and opt-out procedures of third party agencies, including Google, Yahoo!, Meta, Nielsen//NetRatings,Adobe, Tradedesk, MediaMind (BurstingPipe), Eloqua, Tealium (Tag Management, Audience Stream CDP), Outbrain, LinkedIn, Liveperson, Qualtrics, Twitter, Brightcove and Dun & Bradstreet, Heap and Optimizely, please visit:

• Tealium's website at https://tealium.com/privacy, and/or
• Adobe's website at http://www.adobe.com/hk_en/privacy/policy.html and/or
• Meta's website at https://www.facebook.com/legal/FB_Work_Cookies and/or
• Nielsen//NetRatings website at https://www.nielsen.com/us/en/legal/privacy-statement/digital-measurement/ and/or
• The Trade Desk's website at https://www.thetradedesk.com/general/privacy and/or
• Google's website at https://policies.google.com/privacy and/or
• Yahoo!'s website at https://policies.yahoo.com/us/en/yahoo/privacy/index.html and/or
• Eloqua's website at https://www.oracle.com/legal/privacy/marketing-cloud-data-cloud-privacy-policy.html and/or
• LinkedIn's website at https://www.linkedin.com/legal/privacy-policy and/or
• Dun & Bradstreet's website at https://www.dnb.co.uk/products/marketing-sales/dnb-visitor-intelligence.html
• Heap’s website at https://www.heap.io/privacy
• Optimizely’s website at https://www.optimizely.com/legal/privacy-policy/

All of these links are external to HSBC and so we're not responsible for the content of these links, which will open in new windows.