Privacy and Security Policy
Welcome to the Overseas Compatriot Affairs Registration System (register.ocac.gov.tw, this “Website”)! The Overseas Community Affairs Council, Republic of China (Taiwan) (the “OCAC”) accepts online registration for OCAC-organized events, seminars, workshops, webinars, trainings and other activities via this Website, and provide relevant services (collectively, the “Service”).
Protecting your privacy is important to the OCAC. This Privacy Notice informs you of the OCAC’s policies regarding the collection, processing, use, protection and sharing (collectively, “processing”) of your personal data (i.e., information that directly or indirectly identifies, relates to, describes or is reasonably capable of being associated with you, also referred to as “data”) when you use the Service, and the rights and choices you have about your personal data. The OCAC suggests that you read this Privacy Notice carefully.
When you use the Service, the collection, processing, use, protection and disclosure of your personal data by the OCAC are bound by this Privacy Notice. Where the OCAC relies on your consent for processing of your personal data, it will ask for your consent separately, in an appropriate manner. IF YOU DO NOT ACCEPT THIS PRIVACY NOTICE, PLEASE DO NOT USE THE SERVICE OR PROVIDE YOUR PERSONAL DATA TO THE OCAC.
1. DATA THE OCAC COLLECTS
The categories of personal data the OCAC collects depend on the Service you use, and the requirements of applicable law.
1.1 Data You Provide Directly
- Account and profile information: When you create an account via this Website, you provide information such as your Chinese name, English name, gender, date of birth, the continent and country you live in, your applicable OCAC local office, your ROC national status, your email address and password. If you register with an i-Compatriot Card (iCC) Open ID, the OCAC will verify the iCC Open ID and link the iCC number with your account.
- Event registration information: when you sign up for an event via this Website, you provide information that demonstrates your eligibility, suitability and/or preference, which may include:
- Basic information, such as your place of birth, highest education degree, etc.
- Identification information and document, such as ID/passport number, and a copy of the identification (document local passport, local residence permit or proof, ROC passport, ROC identity card, etc.).
- Event-specific information, as detailed in the application form displayed during the registration process. For example, when signing up for a learning program for mandarin teachers, you may need to provide information on your affiliation, position, teaching experience, etc.
- Event participation information: Your participation in an event may be recorded, such as when you engage in discussions with the OCAC at a webinar.
- Other information you choose to give the OCAC, such as when you provide your detailed contact information or Taiwanese family member information in the event application form, or submit your inquiry, comment or request, or otherwise communicate with the OCAC via the Service.
1.2 Data the OCAC Collects Automatically
- Information about your account, such as your account settings. When you apply for an iCC while signing up for an event, the OCAC’s system will automatically link your iCC number with your account.
- Information about your use of the Service, such as signing in and out, registration of a specific event via the Website, event participation history, and visits and clicks on a certain page.
- Information about your device and network connection, such as your device name and operating system, browser type and language, and mobile device identifiers, IP address, mobile carrier, and internet service provider.
- Log information, such as log files, timestamps, website performance logs and error messages or reports.
- Approximate location information (e.g., country), as derived from IP address.
- Information that the OCAC collects with cookies or similar technologies (see Section 6 “Cookies and Similar Technologies” below).
The OCAC may also cooperate with third parties to provide the Service, such as its local offices, business chambers, industry associations, social networking sites, and data analytics providers, which may involve collecting supplementary information about you, such as:
- Information the OCAC receives if you link a third-party tool (such as Facebook or Line) with the Service.
- Demographic data, such as those used to determine the continent or country you are in.
- Information for analytics purposes, such as cookie ID or mobile device ID, so that the OCAC could improve its Service’s functionality and provide you a better Service.
2. WHY AND HOW THE OCAC PROCESSES YOUR DATA, LEGAL BASES
When you use the Service, the OCAC processes your data for a variety of public service and policy purposes, as further detailed below.
2.1 To Enable and Improve the Service
On basis of necessity for the performance of a task carried out in the public interest or in the exercise of official authority vested in the OCAC (or, to the extent the General Data Protection Regulation (GDPR) applies, on basis of your consent, the necessity to perform the OCAC’s contract with you on OCAC events participation and the OCAC’s legitimate interest to provide OCAC services), the OCAC collects, processes and uses necessary data for the purposes described below. If the data the OCAC collects, processes or uses are special category data (such as when you inform the OCAC of special dietary requirements due to allergies), the OCAC relies alternatively/concurrently on your consent.
- Assist you to create and manage your account, including by verifying your email, and recording your account settings.
- Accept, examine and record your event registration, including by verifying your eligibility and determining on your suitability.
- Manage your participation in the event, including by verifying your registration, passing the necessary information on to an OCAC event-organizing partner, and recording certain events.
- Provide and deliver portions of the Service you request, including by processing your search requests for event-related information, and allowing you to modify your profile information.
- Respond to your requests and provide customer support, including by forwarding your request to an appropriate team within the OCAC, and keeping an internal record of the processing of your request.
- Ensure the safety, security, and integrity of the Service, including by investigating and addressing any abuse of the Service.
- Collect and aggregate metrics (such as registration for each category of events) to understand service performance and efficiency, so the OCAC can ensure and optimize service quality.
- Send you Service-related communications (such as notification of successful registration and security alerts), including by identifying relevant Service-related notifications for you, and keeping an internal record on the OCAC’s communication with you.
- Develop and test out new features of the Service, and undertake experimentation to evaluate new service components.
- Transfer, store or process your data in a third country where an OCAC facility, or a local office, supplier or partner is located. For more information, see Section 7 “International Transfers” below.
On basis of your consent, the OCAC collects, processes and uses necessary data to:
- Aggregate, cross-reference and analyze event participant data with other data in the overseas affairs information system , for deepened understanding of the overseas community, provision of better public service, and contribution to the research and formulation of relevant public policy.
On basis of your consent, the OCAC collects, processes and uses necessary data to:
- Provide customized Service experience per your request made by enabling certain feature or device-based settings, such as accepting cookies for recording your language preference.
- Manage the relationship with you and seek your feedback on the Service.
- Publish, on a website/service operated by the OCAC or a third-party, news releases or featured reports about the event you participate in.
- Provide related information, such as featured events, new events and other messages of interest via the Service as well as through other means (including by email).
- Track the content you access in connection with the Service and your online behavior, so that the OCAC can better understand your preferences, habits and needs.
- Deliver, target and improve the OCAC’s promotional practice.
2.4 To Comply with Applicable Law
In accordance with the applicable law, and/or the necessity to protect the vital interests of you or of another natural person, the OCAC collects, processes and uses necessary data to:
- Comply with a request by a competent court or other law enforcement authority.
- Establish, exercise or defend a legal claim, including by seeking the necessary legal advice.
With your consent, the OCAC may collect, process or use your data for additional purposes, such as to conduct stakeholder consultation for a proposed overseas community policy, or to use other smart services or value-added services. When the OCAC does so, it will always seek your prior consent.
3. RETENTION OF YOUR DATA
The OCAC will retain your data as needed for the purpose for which your data are collected, as required for the applicable law, or for other legitimate purposes, such as for public policy research. The OCAC will not retain your personal data for longer than is necessary for its public service purposes or for legal requirements. The retention periods of your data are determined on a case-by-case basis that depends on the following factors:
- The length of time the OCAC will retain your data will generally be determined by how long it needs that data to provide you with the Service. For example, once the event you participate in is finalized, the OCAC will remove copies of your identification document from its server. By contrast, the OCAC keeps your account information (such as name, gender, date of birth, etc.) for the lifetime of your account.
- Legal reasons. In certain cases, the OCAC keeps your data for legal reasons, including when you request deletion of such data. For example, there may be instances where the OCAC is legally required to retain your data for a certain period of time.
4. SHARING OF YOUR DATA
The OCAC will not rent, loan, exchange or sell your data to any third party. Your data may only be accessed by a third party in the following situations.
4.1 Service Providers
The OCAC may employ third-party services to facilitate its operation of the Service and organization of the events. These third-party service providers may process your data, only at and according to the OCAC’s instructions, for purposes of Service-related tasks, such as event participant signing-in and communication, website maintenance, user support, service promotion, analytics and fraud prevention. The OCAC also ensures that these service providers are contractually obligated to take appropriate organizational and technical measures to ensure safety of your data. Such third-party services include:
- The OCAC works with its local offices that may assist with the operation of the Service.
- The OCAC uses services of external suppliers to assist with event-organization.
- The OCAC uses services of external suppliers to assist with the operation and maintenance of the Website.
- The OCAC uses third-party analytics services to understand how the Service is used, to optimize user experience, to facilitate the continuous development of the Service, and to help with its promotional activities.
Other users of the Service may be able to receive your event-participation data via a website/service operated by the OCAC or a third-party, as a part of a news release or featured report about the event you participate in.
4.3 Public Authorities, Other Organizations
In accordance with the applicable law and/or per a legally made request, the OCAC may provide your data to other public authorities. The OCAC may also disclose your data based on your consent, or to protect the rights, property or safety of the OCAC, the Service users or others. For example, where the OCAC reasonably suspects that your account has engaged in activities that may undermine the proper operation of the Service, the OCAC may provide your data to an external body for investigation purposes.
5. DATA SECURITY
The security of your personal data is important to the OCAC. Though no method of transmission or storage is 100% secure, the OCAC is continuously developing and implementing organizational and technical security measures, including pseudonymization and/or encryption of your data, and access control to OCAC-controlled servers, to safeguard the confidentiality, integrity and availability of your data, and to protect your data from unauthorized access or disclosure, destruction, loss, misuse or alteration.
Despite the OCAC’s endeavor to protect your personal data, there is an inherent risk of encountering an unexpected security breach. The OCAC has put in place procedures to deal with any suspected breach and will notify you and any applicable regulator of a breach where it is legally required to do so.
6. COOKIES AND SIMILAR TECHNOLOGIES
Cookies are files with small amount of data, which may include a unique identifier. Cookies are sent to your browser from a website and stored on your device. The OCAC uses cookies and similar technologies to enable certain functionality, to personalize the Service, to collect information, to analyze use, and to target promotional communications.
You may use your web browser settings to accept, refuse and delete cookies. You can instruct your browser to refuse all or a specific type of cookies. However, certain cookies are essential for the proper functioning of the Service. If you do not accept these essential cookies, you may not be able to use some portions of the Service. For information on how to manage unnecessary cookies and other similar technologies, see Section 9 “Your Rights and Options” below.
7. INTERNATIONAL TRANSFERS
The OCAC operates the Service across the globe. Your data will generally be stored on servers controlled by the OCAC or its hosting service provider located in Taiwan. In exceptional cases, the OCAC may need to transfer your data to a different jurisdiction (a “third country”), which may be of a different level of privacy protection than that are applicable in yours. Where the OCAC does so, it relies separately, alternatively, and independently on the applicable legal bases. The OCAC takes steps to ensure that adequate safeguards and mechanisms are in place for the protection of your data.
If the OCAC transfers your personal data from the European Economic Area (EEA) to Taiwan or a third country, it ensures that an adequate degree of protection for your personal data as within the EEA, by implementing appropriate safeguards, which may include:
- The third country that your personal data are transferred to is one that recognized by the European Commission with an adequacy decision as offering an adequate level of protection.
- The OCAC uses standard contract clauses (SCC) adopted by the European Commission, to ensure that the recipient of your personal data in the third country is contractually obligated to provide an adequate level of protection.
- For transfers between the OCAC and another public authority, a legally binding and enforceable instrument with the public authority in question.
- You have explicitly consented to the proposed transfer, after having been informed of the possible risks of such transfers due to the absence of an adequate degree of protection.
- The transfer is necessary for the performance of a contract or the implementation of precontractual measures taken at your request.
- The transfer is necessary for important reasons of public interest.
- The transfer is necessary for the establishment, exercise or defense.
8. CHILDREN’S PRIVACY
If you are a child younger than the age limit under the applicable law for independently giving valid consent to data collection (the “Restricted Age”, which under the current Taiwanese law is 20, and will be 18 from January 1, 2023), your creation of an account or signing up for an event via the Website, and provision of personal data to the OCAC shall be subject to authorization by your parent/guardian.
If you are a parent or guardian and you are aware that your children have provided the OCAC with personal data without your authorization, please contact the OCAC. If the OCAC becomes aware that it has collected personal data from a child under the Restricted Age without parental authorization, the OCAC takes steps to remove that data from its servers, unless it has a legal obligation to keep such data.
9. YOUR RIGHTS AND OPTIONS
9.1 Your Rights
You have rights under privacy/data protection law. The rights available to you depend on the OCAC’s reason for processing your data, and the applicable law, which may include:
- Right of access: the right to access and ask the OCAC for a copy of your personal data that the OCAC processes, and information on how the OCAC processes your data (such as purposes of processing, sources of the data, your rights, etc.).
- Right to rectification: the right to ask the OCAC to rectify or update your personal data that you think is inaccurate or incomplete.
- Right to erasure: the right to ask the OCAC to erase/delete your personal data, under conditions prescribed by the law.
- Right to restriction of processing: the right to ask the OCAC to restrict temporarily or permanently the processing of your personal data, under certain conditions prescribed by the law.
- Right to object to processing: the right to object to the OCAC’s processing of your personal data, under conditions prescribed by the law.
- Right to data portability: the right to request the OCAC to transfer the personal data you have provided it in a structured, commonly used and machine-readable format directly to you, or to another party to the extent technically feasible, under conditions prescribed by the law.
- Right not to be subject to automated decision-making: the right to not be subject to a decision based solely on automated decision making (including profiling) with your personal data, where the decision would have a legal effect on you or produce a similarly significant effect.
If you wish to exercise any of your data subject rights described above, you can make a request by contacting the OCAC with the details listed in Section 12 below. The OCAC will respond to all requests in accordance with applicable laws and within a reasonable timeframe. To protect your privacy, the OCAC may also take additional steps to verify your identity before fulfilling your request.
If you have an unresolved privacy or data use concern that the OCAC has not addressed satisfactorily, the OCAC hopes that you will continue to work with the OCAC to resolve them. However, you also have the right to lodge a complaint with your local data protection authority (if applicable).
9.2 Promotional Communications
With your consent, the OCAC may use your personal data to contact you with newsletters, promotional materials and other information that may be of interest to you. You may object to data processing for such purposes at any time. You may opt out of receiving any, or all, of these communications from the OCAC by following the instructions provided in such communications. The updated settings may not be effective immediately, but the OCAC will follow your instructions as soon as reasonably feasible. Please note that you may still continue to receive non-promotional emails from the OCAC, such as important changes regarding the Service or updates to this Privacy Notice.
9.3 Unnecessary Cookies and Similar Technologies
You may opt out of unnecessary cookies and similar technologies by disabling them in your browser, or by refusing them in your device’s privacy settings. You may consult official support information pages (usually entitled “Privacy”) to learn how to disable cookies on a particular browser/device. The following links may also contain useful information.
- For Google Chrome: https://support.google.com/chrome/answer/95647?hl=en.
- For Internet Explorer: https://support.microsoft.com/en-us/topic/delete-and-manage-cookies-168dab11-0753-043d-7c16-ede5947fc64d.
- For Firefox: https://support.mozilla.org/en-US/kb/enhanced-tracking-protection-firefox-desktop.
- For Safari: https://support.apple.com/en-ie/guide/safari/sfri11471/mac.
- For iOS devices: https://support.apple.com/en-us/HT205223.
- For Android devices: https://support.google.com/ads/answer/2662856?co=GENIE.Platform%3DAndroid&hl=en.
10. LINKS TO OTHER SITES
The Service may contain links to other sites or services that are not operated by the OCAC, such as websites of the event-organizing partners. If you click on a third-party link, please understand that you are leaving the Service and any personal data you provide will not be covered by this Privacy Notice. The OCAC cannot control or be held responsible for third parties’ privacy practices and content that such links direct to. The OCAC strongly advises that you review their privacy policies.
11. CHANGES TO THIS PRIVACY NOTICE
The OCAC may update this Privacy Notice from time to time. The OCAC will notify you of any changes by posting the new Privacy Notice on this page, and by other means as appropriate under the circumstances. If the OCAC makes any material changes, it will notify you as required under applicable law, including by posting a notice in the Service prior to the change becoming effective. Your continued use of the Service after the effective date will be subject to the new Privacy Notice.
12. CONTACT THE OCAC
If you have any questions about this Privacy Notice, please contact the OCAC at:
Overseas Community Affairs Council, Republic of China (Taiwan)
Tel: +886-2-2327-2600
Fax: +886-2-2356-6354
3, 15-17 F., No.5, Xuzhou Rd., Zhongzheng Dist., Taipei City 10055, Taiwan (R.O.C.)
For contact details of the OCAC’s global offices in Europe, North, Central & South America, Africa, Australasia and Asia, please see here.
The OCAC has appointed a Data Protection Officer (DPO). You can reach the DPO at vice-minister@ocac.gov.tw or via the postal address indicated above. Please mark the envelope ‘Data Protection Officer’.