Privacy

1.1 Personal Data means any data relating to a living individual from which it is practicable for the identity of the individual to be directly or indirectly ascertained, and in a form in which access to or processing of the data is practicable.

1.2 Data Subject means the living individual who is the subject of the personal data. Deceased persons are not data subjects under the PDPO.

1.3 Data User means a person who, either alone or jointly with others, controls the collection, holding, processing or use of personal data, including the Company.

1.4 Data Processor means a person who processes personal data on behalf of another person and does not process the data for the person’s own purposes. A data user is responsible for the acts of its employees and agents.

1.5 Data Protection Principles (“DPPs”) means the six principles set out in Schedule 1 to the PDPO, which form the core compliance framework under the Ordinance.

1.6 Prescribed Consent means express consent given voluntarily and not withdrawn in writing, as defined in the PDPO.

2.1 We collect personal data only in a lawful and fair manner, and only for purposes directly related to our functions or activities.

2.2 The personal data collected must be necessary for the relevant purpose and not excessive in relation to that purpose.

2.3 At or before the time we collect personal data, we will provide a Personal Information Collection Statement (“PICS”) informing the data subject, in a practicable manner, of: the purpose of collection; the classes of transferees to whom the data may be transferred; whether provision of the data is obligatory or voluntary; the consequences of failure to provide the data; the retention period; and the right of access and correction.

2.4 Depending on the service, the classes of personal data we may collect include: name, contact telephone number, email address, identity document information, address, date of birth, payment information, IP address, browser and device information, cookie data, and transaction records relating to our services.

3.1 We take practicable steps to ensure that personal data we hold is accurate, having regard to the purpose for which it is used, and we do not keep personal data longer than is necessary for the purpose for which it is used.

3.2 Different categories of personal data are subject to different retention periods. In general, data required to provide services is retained during the service relationship; data used for marketing is no longer used after the data subject opts out; and records required by law or regulation are retained for the statutory period.

4.1 Personal data will be used only for the purpose stated at the time of collection, or for a purpose directly related to that purpose.

4.2 If we intend to use personal data for a new purpose, including disclosure or transfer to a third party, we will obtain the data subject’s prescribed consent in accordance with the PDPO, unless an exemption applies.

4.3 We may use personal data for the following purposes:

• providing and administering our products and services;
• processing applications, transactions and customer enquiries;
• conducting identity verification and compliance checks;
• improving our website, applications and service quality;
• sending marketing communications where consent has been obtained (and the data subject may opt out at any time free of charge);
• complying with applicable laws, regulations or regulatory requirements.

5.1 We take practicable steps to protect personal data against unauthorised or accidental access, processing, erasure, loss or use.

5.2 These measures include, where appropriate: access controls, encryption in transmission, secure storage, staff training, and regular review of our security policies and procedures.

6.1 We make publicly available our policies and practices in relation to personal data, so that the public can ascertain the policies and practices we apply.

6.2 This Privacy Policy Statement is available on our website and may be provided on request.

7.1 A data subject has the right to make a Data Access Request (“DAR”) to ascertain whether we hold his or her personal data and to request a copy of that data.

7.2 A data subject who considers that personal data held by us is inaccurate has the right to make a Data Correction Request (“DCR”) requiring correction.

7.3 Requests should be made in writing to our Data Protection Officer (“DPO”) at: Room 5003, 5th Floor, Yu Lee Centre, 45 Hoi Yuen Road, Kwun Tong, Hong Kong. We will handle requests within the time limits required by the PDPO, generally within 40 days, and may charge a fee for a data access request that is not excessive. We will not charge a fee for correcting personal data.

7.4 A data subject may also complain to the Office of the Privacy Commissioner for Personal Data (“PCPD”) if he or she considers that his or her rights under the PDPO have been infringed.

8.1 We will not transfer personal data to a third party for the third party’s own purposes unless the data subject has given prescribed consent or a statutory exemption applies.

8.2 We may transfer personal data to the following classes of transferees, subject to contractual confidentiality obligations: IT service providers, payment processors, identity verification service providers, auditors and legal advisers, and regulators where required by law.

8.3 Cross-border transfer: Section 33 of the PDPO, which restricts cross-border transfer of personal data, is not yet in operation. Nevertheless, when transferring personal data outside Hong Kong, we will have regard to the recommended practices issued by the PCPD and take reasonable steps to ensure that the data receives a level of protection substantially similar to that under the PDPO, including through standard contractual clauses or due diligence.

9.1 Our website may use cookies and similar technologies to improve user experience, analyse usage and support website functionality. Cookies may collect data such as browsing behaviour and device information.

9.2 Users may refuse or delete cookies through browser settings; however, some website functions may not operate properly as a result. Where cookies involve the collection of personal data, we will provide an appropriate PICS.

10.1 If we intend to use personal data for direct marketing, we will first obtain the data subject’s consent, including express consent given in writing or by ticking an opt-in box, and will inform the data subject of the classes of products or services to be marketed.

10.2 A data subject may at any time require us to cease using his or her personal data for direct marketing. We will not charge a fee for handling such a request.

11.1 If a personal data breach occurs, we will take reasonable steps to contain the incident, assess its impact and, where appropriate, notify affected data subjects and the PCPD.

12.1 We may update this Privacy Policy from time to time to reflect changes in legal requirements or operational practices. The latest version will be posted on our website.

12.2 For enquiries, data access requests or correction requests, please contact:

Data Protection Officer Email: [email address] Address: [company address]

12.3 This Privacy Policy is governed by the laws of the Hong Kong Special Administrative Region. If this Policy is translated into another language, the English version shall prevail.