FAQ

No personal information is stored in any anonymous Octopus which accounts for about 80% of our current customer base.

As a standing practice, the user's name, date of birth and ID card number are stored in a Personalised Octopus. This is to enable the elderly and students to enjoy the concessionary fares offered by different public transport service providers. To enhance the level of privacy protection to consumers, from the fourth quarter in 2010, ID card numbers will no longer be stored in Personalised Octopus cards or products.

As a responsible organisation, Octopus Cards Limited (OCL) values the importance of customer data privacy and protection, and is in full compliance with the related ordinances in handling customer data.

Internal users are authorised to access the personal data on a need-to-know basis (eg hotline staff) and authentication is required before they are granted access to the data.

We issue internal guidelines and conduct training for staff on the proper way to handle Octopus holders' personal information. We also have audit trails to monitor the use of such data and have regular internal audits and reviews to ensure strict compliance.

​We also issue policies on Personal and Customer Data Protection and Code of Practice to all employees on commencement of employment regarding the handling of data confidentiality and appropriate conduct in carrying out business. Employees are required to acknowledge receipt of and comply with these policies.

Some residential and commercial buildings as well as schools in Hong Kong use the Octopus platform as an access/registration system for their users. The personal data captured by these systems is owned and managed by the respective service providers. OCL does not receive, own, manage or keep records of such data.

As a law-abiding company, OCL will provide customer data to law enforcement authorities such as the police upon the provision of an original copy of a search warrant or court order as well as a valid staff identity card. In general, law enforcement authorities may still require the assistance of other merchants and additional information to get the full picture for their investigation.

Anonymous Octopus with AAVS does not have personal data stored on the cards or products. A Personalised Octopus with AAVS contains the user's name, date of birth and ID card number, just like any other Personalised Octopus cards. From the fourth quarter in 2010, the holder's ID card number will no longer be recorded.

Please complete the Data Access Request Form and return it to Octopus Cards Limited or Octopus Rewards Limited by mail (46/F Manhattan Place, 23 Wang Tai Road, Kowloon Bay, Kowloon, Hong Kong). We will follow up your request as soon as we receive your form and will advise you in advance the fee required (if applicable).