隱私權政策

關於個人資料（私隱）條例（「條例」）致客戶的通知

本私隱政策聲明（「本聲明」）說明美國萬利資產管理有限公司（「萬利資產管理」）及其關聯公司（以下統稱爲「萬利資產管理」、「本公司」或「我們」）如何收集和處理從客戶、擔保人、抵押品提供者和其他人士（ 以下統稱為「您」，如果您是個人，則稱為「資料當事人」）收集到的個人資料/個人信息。如果您不是自然人，在適用的情況下，提及「您」可能指資料當事人是其個人資料所涉及的自然人。

我們致力於按照要求的標準處理您的資料。這包括根據適用的隱私保護法律保護您的隱私並確保您的資料安全，其中包括，《個人資料（私隱）條例》（香港法例第 486 章）（「個人資料（私隱）條例」）、中國的《中華人民共和國個人信息保護法》（「個人信息保護法」）和歐盟的《壹般資料保護規範》（「壹般資料保護規範」）（統稱為「資料保護法」）。

1. 我們收集的資料

就本聲明的目的，「資料」是指任何指以電子或其他方式記錄並已識別或可識別的自然人有關的各種個人信息，從中可以直接或間接確定個人身份， 但不包括已匿名化的信息。

萬利資產管理會收集、保存、處理、披露、轉移及刪除各種類型的個人資料。從廣義上來說，資料會包括（但不限於）以下各項：

本公司僅在相關資料當事人同意我們處理此類信息或自願向我們提供此類信息或資料保護法要求或允許收集 的情況下收集特殊類別的個人資料或敏感個人信息（其定義請參考相關司法管轄區適用的個人資料法律或資 料保護法）。此類信息包括（但不限於）關於個人生物識別資料、基因資料、宗教或哲學信仰、政治觀點、特定身份、醫療保健、財務賬戶、個人行蹤、未滿拾肆歲的未成年人的個人信息、工會的個人信息會員資格、有關健康的資料或有關自然人性生活或性取向的資料（「敏感信息」）。

向本公司提供敏感信息時，請酌情決定，在任何情況下都不要向本公司提供敏感信息，除非您因此同意本公司出於其合法業務目的處理敏感信息，或者除非適用法律法規或法庭命令允許。透過接受本聲明，即表示您自願並明確同意本公司及/或向本公司確認資料當事人的同意其敏感信息將用於本聲明中所述的目的。如果您對向本公司提供 的敏感信息是否或可能是必要以適合特定目的有任何疑問，請通過 info@.moneyconcepts.com.hk 聯繫本公司。

2. 我們如何收集資料

本公司可以在與您接觸/建立關係的過程中收集資料；例如，當您向本公司提供其名片或聯繫方式、存入資金或證券、通過本公司進行交易、轉移資金或證券、操作證券戶口、與本公司的員工或客戶經理討論事務或聯繫本公司以安排孖展貸款或其他服務、洽談業務、更改/更新/改正資料當事人的資料或其他戶口資料。

我們也可以透過各種方式從您收集資料，例如：

3. 收集資料的目的

萬利資產管理可因以下壹種或多種目的不時收集、保存、處理、披露、轉移及刪除資料：

a) 開立和維持證券戶口和其他賬戶；

b) 賬戶日常運作、提供服務、審批孖展貸款予您或借款人（當您是該項授信的擔保人或抵押品提供者時）；

c) 進行交易或執行其他指示；

d) 遵守法規或內部對客戶盡職調查、核查和持續審查、防止和發現洗錢、恐怖分子籌資或其他非法或不正當活動、欺詐檢測、制裁監控等相關的要求；

e) 遵守法院諭令和約束萬利資產管理、其關聯公司或他們所屬集團公司或任何其他人士之任何法律規定、監管、要求或安排，包括但不限於香港政府與其他外國政府之間的條約、協議、對等原則和其他安排（包括與稅收報告和自動交換財務賬戶資料的相關安排）；

f) 回應公共或政府機構（可能包括但不限於監管機構、執法機關、證券交易所或其他類似機構或機關、稅務局、醫院管理局、社會福利部門以及香港及其他地區的其他機構）以配合其查詢或調查要求；

g) 對您進行信貸查詢、監控、檢討、查明您之財政狀況及進行法律所允許之核對程序（定義見個人資料（私隱）條例）及容許或協助任何其他人士進行上述事項；

h) 制訂和維護您的信用歷史記錄、信用評分模型和其他分析（無論他們與任何萬利資產管理之間是否存在任何關係），以供現在和將來參考；

i) 進行合規審查、風險管理、內部監控和審計（包括審查和監控賬戶活動、交易、孖展和其他頭寸和資料以及進行審計（內部和外部））；

j) 客戶關係管理和相關資料處理；

k) 查明和了解客戶的投資經驗、投資目標、財務狀況、投資年期、風險承受水平、流動性需求、分散投資的需求和其他相關情況；

l) 爲客戶設計金融産品或服務供客戶使用；

m) 回答對手方、産品發行人/擔保人、代理商、分銷商、集體投資計劃或其經理、管理人、投資經理、信托人、托管行、保管代理人、其他托管行或代理人或上述各機構的代名人或關聯公司的提問，並提供給他們資料以便他們追討欠款和損失、維護其他權利或回答監管機構、證券交易所或政府/司法機關的查詢;

n) 為萬利資產管理、其關聯公司或他們所屬集團公司之現有及日後之服務或産品（例如，金融服務、産品）進行直接營銷及市場推廣，無論萬利資產管理會否從中獲得報酬（請參考下面有關“直接營銷”的部分）；

o) 確定您或您所欠的債務金額、維護有關權利，包括但不限於向您追收債務、追索損失和其他未償還金額、爲惠及任何萬利資產管理、其關聯公司或所屬的集團公司行使抵押品、押記權或其他權利及權益、提起法律訴訟、執行程序和在催收函、索賠和法院文件中進行披露；

p) 讓萬利資產管理於您及/或您的戶口項下的權利或業務的實質或潛在承讓人、受讓人、參與人或分參與人評估該項讓與、轉讓、參與或分參與涉及的事項；

q) 資料處理、備份和存檔；

r) 爲了維護本公司、本公司的客戶或其他第叁方的任何其他合法利益； 及

s) 壹切與上述有聯繫、有附帶性及有關的用途或其他經資料當事人同意的用途。

如果本公司因與上述無關的目的需要使用任何資料，本公司會通知您並徵得同意，以允許本公司這樣做。如果您不是本公司的客戶，本公司可能需要處理該您的個人資料，以便爲本公司的客戶提供客戶服務或便利，包括提供孖展貸款。此個人資料可能會在有關過程中提供給本公司，例如，在信用審核過程中提供給本公司，或由其他第叁方（信貸諮詢機構）提供。資料甚至可能會在本公司或其他交易對手（例如，結構性票據之發行人）提起的法律訴訟中被轉移或使用，以向您（例如，作爲結構性票據的持有人或（視情況而定）作爲孖展貸款的擔保人）追討未償債務和損失。

4. 處理資料的法律依據

我們可能將您的資料用於上述第 3 條中規定的目的，每個目的皆是依據於以下法律依據，其中包括：

a) 履行合同 - 這是為了履行我們在合同項下的義務而需要處理您的資料；

b) 法律義務 - 這是指我們需要處理您的資料以履行法律義務、法定職能或法定義務，例如為稅務目的保存記錄或向公共機構或執法機構提供資料；

c) 公共利益 - 我們可能會處理有關您的資料，以執行為公共利益或在緊急情況下保護自然人的生命、健康或資產的任務；

d) 您的同意 - 我們在您同意的情況下處理您的資料，並且只有在您同意的情況下，我們才會處理您的資料；或

e) 披露信息 - 我們可能會處理由您或以其他方式合法披露的資料。

5. 同意

通過與我們互動並向我們提供信息，或登記由我們提供產品或服務，您表示並同意：

a) 我們將出於本聲明中所述的目的收集、使用、披露和共享資料；

b) 我們將被授權以本聲明中規定的方式向我們的關聯公司、授權服務提供商和相關第叁方披露此類資料；

c) 我們將被授權出於本聲明中所述的目的處理您的敏感信息（定義見個人信息保護法）；

d) 我們將被授權在相關司法管轄區跨境傳輸您的資料；和

e) 我們將被允許向我們的關聯公司和其他第叁方披露和/或傳輸您的資料，如下所述。

如果您不希望我們在未來的任何時間繼續使用您的資料或您提供給我們的資料用於任何目的，您必須通知我們撤回您的同意（見下文）。根據情況，您撤回同意可能會導致我們無法向您提供我們壹直向您提供的某些服務和/或產品，因此在法律允許的情況下， 可能會導致您與我們的關係和/或賬戶終止。撤回同意不會影響在撤回前基於您的同意收集、使用和披露您的資料的合法性。

如果相關司法管轄區的資料保護法允許我們在未經您同意的情況下收集、使用或披露資料，則法律下的授權將繼續適用。

6. 資料披露

萬利資產管理可因第 3 所述壹個或多個目的向下列類別的人士提供資料：

a) 萬利資產管理及其任何集團公司；

b) 萬利資產管理關聯公司及其任何集團公司；

c) 以其名義登記您的證券或其他資産之代名人；

d) 姓名篩查服務/盡職調查服務/資料庫的供應商、電子認證機構和其註冊機構、輕型目錄存取協定服務提供者和身份認證機構；

e) 向萬利資產管理、其關聯公司或他們所屬集團公司提供營運行政、資料處理、財務、計算機、電訊、資訊科技、付款、證券結算、清付、專業或其他服務之任何承辦商、代理、服務供應商、銀行、基金公司、保險公司，無論是香港或香港以外的；

f) 萬利資產管理代表您進行交易所涉及的對手方、産品發行人/擔保人、代理商、分銷商、集體投資計劃 和其經理、管理人、投資經理、信托人和托管行、保管代理人、其他托管行、代理人和上述各機構的代名人、關聯公司；

g) 信貸諮詢機構，及收數公司(於違約時)；

h) 任何就您的義務而提供或擬提供擔保或第叁方抵押品的人士；

i) 任何萬利資產管理權利或業務的實質或潛在之承讓人、受讓人、參與人、分參與人、代表或繼承人；

j) 位於香港或香港以外的公共或政府機構（可能包括監管機構、證券交易所或其他類似機構或機關、稅務局，醫院管理局、社會福利部門以及其他機構）;

k) 由萬利資產管理或其關聯公司聘用的法律或其他專業顧問和代理人；

l) 香港、其他司法管轄區的執法機構（包括但不限於香港警察和廉政公署）；及

m) 您要求和/或同意披露的任何人士/機構。

其他實體和第叁方服務供應商也會處理資料。如果資料是由任何第叁方服務供應商處理資料，本公司將取得您同意披露資料並將確保有關保密協議，其中包含維護保密性的條款和政策/程序，以遵守資料保護法。根據您的要求，我們還將通知您接收方的姓名和聯繫信息、處理目的和方法以及資料類型。外包安排須經過盡職調查和合理可行的監控，以確保資料的整個生命週期達到隱私保護標準。

7. 直接營銷

萬利資產管理可能將資料用於直接營銷，為此須事先獲得您的同意(包括表示不反對)。本公司可以不時使用您的姓名、聯絡資料、産品及服務組合資料、交易模式及行爲、財務背景、投資經驗和背景、風險承受能力、人口統計資料用於直接營銷。 向您促銷的産品、服務及項目可包括：

a) 金融産品和服務；

b) 保險、信用卡、銀行及相關服務及産品；

c) 股份獎勵計劃；

d) 獎賞、忠誠或優惠計劃和相關服務及産品；

e) 萬利資產管理、其關聯公司或合作品牌夥伴提供之産品和服務；及

f) 爲慈善及/或非牟利用途的捐款及捐贈。

以上産品、服務及項目可由以下機構提供或徵求：

a) 萬利資產管理或其（香港或香港以外的）關聯公司；

b) 中信証券、中信証券國際或其任何集團成員公司；

c) 第叁方金融機構、承保人、信用卡公司、證券及投資服務供應商；

d) 第叁方獎賞、忠誠、合作品牌或優惠計劃供應商；

e) 萬利資產管理或其關聯公司的合作品牌夥伴；及

f) 慈善或非牟利機構。

本公司擬將上述資料提供給上述壹個或多個機構用於直接營銷有關産品、服務及項目，而爲此本公司須獲得您的書面同意(包括表示不反對)。本公司可能因將資料提供予上段所述機構而獲得金錢或其他利益作爲回報。

如本公司會因提供資料予其他機構而獲得金錢報酬或其他利益，本公司會於徵求資料當事人同意或不反對時通知資料當事人。

如果您不希望資料被用於直接營銷，您可以在《客戶開戶表格》中的相應方框中打勾或以書面形式通知我們，以行使其拒絕促銷的權利。行使其拒絕促銷權利的請求也可以發送給本公司的資料保護主任（聯繫方式見下面）。但是，如果直接營銷是以其代表公司或企業的身份發給您的，而不是以您的個人或個人身份發送給您的，則提出此類請求的權利不適用於您。

8. 轉移資料到香港以外

萬利資產管理連同其關聯公司是壹家全球金融機構，由位於不同司法管轄區的多個辦事處和附屬實體組成。

為履行我們在世界各地的法律和監管義務，並出於上文第 3 條規定的目的，您的資料可能會傳輸到我們的集成計算機網絡，或與壹個或多個附屬辦公室和其他可能不受資料保護法約束的國家/地區共享，而該等國家不同於向我們披露或接受資料的國家/地區。

跨境傳輸到另壹個司法管轄區的資料可能會根據該司法管轄區適用的法律、規則、法規、指南、指令、命令和慣例進行披露、處理、存儲或維護。例如，就客戶關係管理、貿易、信用評估、風險管理、審計和資料處理或其他目的向內地服務供應商傳輸資料時，請註意資料將存儲在中國內地；因此存儲的資料受中華人民共和國（“中國”）的法律、法規、命令和慣例的約束，並受制於中國執法機構和監管機構。 我們與其他實體或服務提供商之間的合同中規定的資料訪問限制不能淩駕於中國法律或監管要求或其他司法管轄區的法律或監管要求之上。

就您的資料，我們所有的辦公室都遵守內部政策和程序，及適用的資料保護法。

9. 網站

我們可以收集、處理和使用其網站瀏覽者的資料，以便爲瀏覽者提供改進的産品和服務，使業務流程適應客戶的需求，並引導瀏覽者使用相關的産品信息和在綫交易平臺。Cookies 是網絡伺服器放置在電腦或其他設備上的獨有標記，它包含可供發布 Cookie 的伺服器以後讀取的信息。我們可以在本公司的網頁使用 Cookies。

經這個途徑收集的信息（包括但不限於瀏覽者的登錄 ID、MAC 地址、IP 地址（和域名）、設備的技術、瀏覽器軟件、其瀏覽器的類型和配置、語言設定、地理位置、操作系統、外圍相關信息、引薦網站、瀏覽的頁面和內容，以及瀏覽時間）會作以下用途：

a) 分析本公司網站的流量；

b) 匯總有關瀏覽者如何到達和瀏覽本公司網站的統計資料；

c) 改善用戶體驗；

d) 客戶和用戶管理和營銷;

e) 向訪客介紹本公司的服務和産品； 及

f) 評估本公司營銷計劃的有效性。

此類信息是匿名收集的，除非瀏覽者以客戶/用戶身份登錄，否則本公司無法識別他/她的身份。 階段作業

Cookies 讓本公司的網站能夠跟蹤瀏覽者在頁面之間的移動，因此不會要求他/她提供已經提供給網站的相同信息。功能 Cookies 使瀏覽者可以快速地、輕鬆地瀏覽網站的多個頁面，而不必驗證或重新處理每個瀏覽的新區域。廣告 Cookies 讓萬利資產管理可以在本公司的網站上提供與瀏覽者盡可能相關的廣告，例如通過挑選瀏覽者感興趣的廣告，或防止相同的廣告重複出現。

大多數網絡瀏覽器最初都設置爲接受 Cookies的。如果您不想接收Cookies，則可以在瀏覽器設置中禁用此功能。但是，這樣做的話可能無法完全享受本公司網站的好處，並且某些功能可能無法正常使用。

10. 在綫/流動交易平臺

萬利資產管理也有爲客戶提供在綫和流動交易平臺供他們使用。萬利資產管理可以在這個過程中收集、轉移、存儲和使用有關客戶設備的技術、位置和登錄信息以及其他個人資料和相關信息（例如：MAC 地址和 IP 地址）、系統和應用軟件以及外圍設備。

當客戶使用任何此類交易平臺時，萬利資產管理和第叁方供應商/許可方可以使用審核日誌、緩存、Cookies 和/或像素標記來收集此類信息並存儲客戶的偏好。萬利資產管理可以使用有關信息作各樣用途

例如：安全監察、提供導航、提供軟件更新或産品支持、加強顯示信息的效率、使用平臺時個性化客戶的體驗，以及進行在綫跟蹤、客戶關係管理、合規監察和審查、風險管理等）。萬利資產管理也可以識別客戶使用的設備，以協助其使用服務或流動應用程式。本公司還可以收集有關服務或流動應用程式使用情況的統計信息，以改善設計和功能，了解其使用方式並協助本公司解決有關服務或流動應用程序的問題。Cookies 可以進壹步允許萬利資產管理選擇客戶最可能感興趣的廣告或優惠，並在客戶使用服務或流動應用程式時顯示它們。本公司也可以於在綫和流動平臺廣告中使用 Cookies，以跟蹤對本公司廣告的反應並評估本公司的營銷活動的有效性。本公司建議客戶在使用前，仔細閱讀相關交易平臺或（視情況而定）流動應用程式的《使用條款》。

11. 外部鏈接

如果萬利資產管理的網站或平臺裏有指向其他網站的鏈接，則這些網站不會根據本聲明運作。本公司建議瀏覽者先審查這些網站的私隱聲明，以瞭解其關於收集、使用、轉移和披露個人資料的政策。對於鏈接到我們網站的任何其他網站或頁面的內容以及任何此類鏈接網站或頁面的使用，我們概不負責。提供此類鏈接僅是為了您的方便和信息。以下鏈接到任何其他網站或頁面的風險由您自行承擔。

12. 保存

萬利資產管理遵循保存政策，以確保資料被保存的時間不會長於收集它目的所需的時間及符合適用法律和法規要求。

13. 您的權利

根據適用的資料保護法，您有權享有以下權利：

a) 被告知 - 如本聲明中所述您有權被告知您的資料的收集和使用情況。根據您的要求，我們將向您提供本公司關於資料的政策和做法，其中包括處理您的資料的目的、處理方法、保留政策以及將與誰共享；

b) 決定 - 您有權決定處理您的資料；

c) 訪問 - 您有權索取我們正在處理有關您的資料的副本。如果您需要額外的副本，我們可能需要收取合理的費用；

d) 更正 - 您有權要求我們更正您的資料中的任何錯誤，無論是不完整的還是不準確的；

e) 消除 - 您有權要求消除與您有關的資料。如果出現以下情況，我們可能會刪除您的資料；

i) 處理目的已經實現、無法實現或不再需要實現的；

ii) 我們停止提供產品或服務，或約定的保留期限已過；

iii) 您的同意已被撤回；

iv) 處理您的資料違反法律、行政法規或協議的；或者

v) 法律、行政法規規定的其他情形。

除非適用法律和法規要求我們維護資料，或者在技術上不可行，在這種情況下，我們將採取必要的安全措施。

f) 可攜帶性 - 您有權以結構化、常用可讀的格式接收您提供給我們的資料，並有權在某些情況下將該資料

傳輸給第叁方；

g) 反對 - 您有權 (i) 隨時反對出於直接營銷目的處理您的資料，以及 (ii) 反對我們處理您的資料，即便此類處理的法律依據是出自我們或第叁方追求合法利益，我們也將遵循您的要求，除非我們提供令人信服的法律依據；

h) 處理限制 - 您有權在某些情況下要求限制我們處理您的資料，但法律或行政法規另有規定的除外；

i) 撤銷同意 - 如果我們依賴您的同意（或明確同意）作為我們處理您資料的法律依據，您有權隨時撤銷該同意。

在處理查閱或更正資料要求時，我們將核對請求人的身份，以確保他/她是合法有權提出查閱或更正資料要求的人。請將訪問和/或更正個人資料的請提交給資料保護主任（聯繫方式如下）。 我們可能會就遵守資料存取要求收取合理費用。

資料當事人或其他第叁方向我們提供（或授權提供） 資料並保證該等資料真實、準確和完整，並同意若資料更改將以書面形式通知我們。

14. 資料安全保護措施

萬利資產管理已采取合理的安全措施來保護資料免受非法處理、破壞或意外。本公司使用電子安全措施來控制資料的接觸，包括使用密碼、防火牆、加密措施，以便在使用前對信息系統進行身份驗證和授權。本公司也採用了記錄保存機制來維護處理或使用資料時涉及的相關記錄，例如記錄處理目的、資料當事人的類型和資料接收者。本公司會對資料轉移進行內部審查，並定期對資料傳輸、整理、信息系統和網絡安全結構進行隨機審查。萬利資產管理也採用了合理的措施來保護和控制資料和其他保密信息，包括但不限於：防火、防止煙霧和水的損害、火災和緊急警報系統、密碼鎖定的文件、使用保護裝置或其他設備以防止丟失或未經授權刪除手動保存的資料、限制接觸以防止未經授權讀取資料和文檔。

雖然我們努力保護您的資料，但我們無法確保您可能通過使用不安全瀏覽器的方法傳輸給我們的任何資料的安全性，我們敦促您採取壹切預防措施保護您的資料並使用安全瀏覽器。

15. 其他

萬利資產管理可以在任何時候未經事先通知的情況下修改、更新或修訂本聲明。如果萬利資產管理決定這樣做，只需將這些修改、更新或修訂通知資料當事人即可。本公司會將修訂版本發布在本公司的網站上。任何此類更改、更新或修訂將在發布後立即生效。

本聲明將成爲您與任何萬利資產管理訂定之所有條款、協議及其他具約束力的安排組成之壹部份。

如本聲明中、英文版本有任何歧異，則以英文版本為準。

This Privacy Policy Statement (the “Statement”) explains how Money Concepts Asset Management Limited (“MCAM”) and its Affiliates (collectively referred to as “MCAM” or “we” or “us”) collect and process personal data/personal information collected from Customers, guarantors, security providers and other individuals from time to time (collectively referred to as “you” or if you are an individual, "Data Subject"). Where you are not a natural person, where applicable, a reference to “you” may refer to the Data Subject being the natural person whose personal data are involved.

We are committed to processing your Data in accordance with the required standards. This includes protecting your privacy and ensuring the security of your Data in compliance with applicable privacy protection laws, in particular and where applicable, the requirements of the Personal Data (Privacy) Ordinance (Chapter 486 of the Laws of Hong Kong) (“PDPO”), the Personal Information Protection Law of the People’s Republic of China in China (“PIPL”) and the General Data Protection Regulation in Europe (“GDPR”) (collectively referred as the “Date Protection Laws”).

1. Personal Data We Collect

For the purpose of this Statement, “Data” means all kinds of personal information which relates to identified or identifiable natural persons that are electronically or otherwise recorded, and from which it is practicable for the identity of the individual to be directly or indirectly ascertained. It does not include information that has been anonymized.

At MCAM, we collect, save, use, process, disclose, transfer and delete different kinds of Data. Broadly speaking, the Data will include (without limitation) the following:

MCAM only collects special categories of personal data or sensitive personal information (as provided by any applicable Data Protection Laws in the relevant jurisdiction(s) when the relevant Data Subject agrees to our process such personal

information or voluntarily provide us with this information or it is required or permitted to be collected by Data Protection Laws. Such information includes (without limitation) personal information regarding a person’s biometric data, genetic data, religious or philosophical beliefs, political opinions, specific identity, health care, financial accounts, personal whereabouts, personal information of minors under the age of fourteen, trade union membership, data concerning health or data concerning a natural person’s sex life or sexual orientation (the “Sensitive Information”).

Please use your discretion when providing Sensitive Information to MCAM, and under any circumstances, do not provide Sensitive Information to MCAM, unless you thereby consent to MCAM’s process of Sensitive Information for its legitimate business purposes or unless it’s permitted by applicable laws and regulations or court orders. By accepting to this Statement, you are voluntarily and explicitly provide consent to MCAM and/or confirm to MCAM that consent of the Data Subject whose Sensitive Information are received and provided to MCAM for processing has been obtained for purposes described in this Statement. If you have any questions about whether the provision of Sensitive Information to MCAM is, or may be, necessary or appropriate for particular purposes, please contact MCAM at info@moneyconcepts.com.hk.

2. How We Collect Data

We may collect the Data from you during contact or in the ordinary course of your relationship with us, for example, when you give us your name card or contact details, deposit funds or securities, effect transactions through MCAM, transfer funds or securities, operate the Securities Account, discuss matters with MCAM’s staff or account executives or contact MCAM to arrange margin facilities or other services, negotiate business with MCAM, or amend /update/correct your Data or other account information.

We may also use various methods to collect Data from you, such as:

3. Purposes for Collecting Data

MCAM may use, store, process, disclose, transfer and delete Data for one or more of the following purposes from time to time:

a) opening and maintaining of Securities Accounts and other accounts;

b) the daily operation of account(s), services and margin facilities provided to you or to the borrower when you are a guarantor or security provider for the relevant facilities;

c) effecting transactions or carrying out other Instructions;

d) complying with regulatory and internal requirements relating to client onboarding due diligence, verification and ongoing reviews, prevention and detection of money laundering, terrorist financing or other unlawful or improper activities, fraud detection, sanctions monitoring;

e) complying with court orders and legal requirements, obligations, requirements or arrangements which apply to MCAM and its Affiliates or their group companies, including but not limited to treaties, agreements, reciprocal principles and other arrangements between Hong Kong Government and other foreign governments (including those relating to tax reporting and automatic exchange of financial account information);

f) responding to requests from public or government authorities (which may include without limitation, regulators, law enforcement agencies, securities exchange or other similar agencies or authorities, tax authorities, hospital authority, social welfare department and other authorities in and outside Hong Kong) to cooperate with any enquiry or investigation;

g) conducting credit checks, monitoring and review, ascertaining financial situation and carrying out matching procedures (as defined in the PDPO) in respect of you, and enabling or assisting any other person to do so;

h) creating and maintaining your credit history, credit scoring models and other analysis (whether or not there exists any relationship between them and any MCAM company) for present and future reference;

i) compliance checking, risk management, internal control and audit purposes (including review and monitoring of account activities, transactions, margin and other positions and data and conducting audits (both external and

internal));

j) customer relationship management and processing of relevant data;

k) ascertaining and understanding the investment experience, investment objectives, financial position, investment time horizon, risk tolerance level, liquidity needs, diversification needs and other circumstances of Customers;

l) designing financial products or services for use of Customers;

m) answering enquiries from (as the case may be) counterparties, product issuers/guarantors, dealers, distributors, collective investment schemes or their managers, administrators, investment managers, trustees or custodians,

Custodial Agents, other custodians or agents or any such party’s nominees or affiliates and providing them with Data to enable them to recover debts and losses, enforce their other rights or to answer enquiries from regulators,

securities exchanges or other government/judicial authorities;

n) direct marketing and promotion of existing and future services or products (e.g. financial services or products) of MCAM and its Affiliates or their group companies, in respect of which MCAM may or may not be remunerated (please also refer to the section on “Direct Marketing” below);

o) determining the amount of indebtedness owed to or by you and enforcing the same, including without limitation the collection of debts, recovery of losses and other amounts outstanding from you, enforcement of security, charge or other rights and interests in favour of MCAM and its Affiliates or their group companies, commencement and conduct of legal proceedings and enforcement proceedings and making disclosures in demand letters, claims and court documents;

p) enabling MCAM’s actual or potential assignee, transferee, participant or sub-participant of MCAM’s rights or business in respect of you or your account(s) to evaluate the matters intended to be the subject of the assignment, transfer, participation or sub-participation;

q) data processing, back-up and archive;

r) for the protection of any other legitimate interests of ourselves, our customers or those of another third party; and

s) all other incidental and associated purposes relating to the above or to which you may from time to time agree.

If we need to use any Data for a purpose unrelated to the above, we shall notify you and seek your consent to allow us to do so. If you are not our Customer, we may need to process your Data in order to provide client services or facilities to our Customer, including the provision of margin financing. The Data may be provided to us through the course of the matter for example, provided to us as part of a credit review process or provided by another third party (a credit reference agency). Data may even be transferred and used in legal proceedings commenced by us or other counterparties

(such as a structured note issuer) to recover outstanding debts and Losses from you (such as a holder of a structured note or (as the case may be) a guarantor in respect of a margin loan of a Customer).

4. The Legal Grounds for Processing Data

We may use your Data for the purposes as set out in clause 3 above and, for each purpose, based on the following legal grounds, among other things:

a) Performance of a contract - this is when the processing of your Data is necessary in order to perform our obligations under a contract;

b) Legal obligation - this is when we are required to process your Data in order to comply with a legal obligation or statutory functions, or statutory obligations, such as keeping records for tax purposes or providing information to a public body or law enforcement agency;

c) Public interests - we may process your Data where it is for the performance of a task carried out in the public interest or protection of life, health or assets of natural persons under emergency;

d) Your consent - we process your Data with your consent, and we will only process your Data if you agree to us doing so; or

e) Disclosed information – we may process your Data that is disclosed by you or otherwise legally disclosed.

5. Consent

By interacting with us and submitting information to us, or signing up for any products or services offered by us, you represent and agree that:

a) we shall collect, use, disclose and share Data for the purposes stated in this Statement;

b) we shall be authorised to disclose such Data to our Affiliates, authorised service providers and relevant third parties

in the manner set forth in this Statement;

c) we shall be authorized to process your sensitive personal information (as defined in the PIPL) for the purposes stated in this Statement;

d) we shall be authorized to disclose your Data outside of relevant jurisdictions; and

e) we shall be allowed to disclose and/or transfer your Data to our Affiliates and other third parties as provided below;

If you do not wish for us to continue to use your Data or the Data provided by you to us for any of the purposes at any time in the future, you must notify us to withdraw your consent (see the section below). Depending on the circumstances,

your withdrawal of consent may result in our inability to provide you with certain services and/or products that we have been offering to you, and consequently, may result in the termination of your relationship and/or accounts with us if permitted under the applicable laws. The withdrawal of consent will not affect the lawfulness of the collection, use, and disclosure of your Data based on your consent before it was withdrawn.

Where the Data Protection Laws of the relevant jurisdictions permit us to collect, use or disclose the Data without your consent, such permission granted by law will continue to apply.

6. Disclosure of Data

MCAM may provide Data to the following classes of persons for one or more of the purposes set out in clause 3 above:

a) MCAM and any of its group companies;

b) MCAM Affiliates and any of its group companies;

c) any nominees in whose name your securities or other assets may be registered;

d) name-screening services/due diligence/data base service providers, electronic certification bodies and their registration authorities, Lightweight Directory Access Protocol service providers and identification agencies;

e) any contractors, agents, service/solutions providers, software/application developers, banks, fund houses and insurance companies in or outside Hong Kong, which provide administrative, data processing, financial, computer, telecommunications, information technology, payment, clearing, settlement, professional or other services to MCAM and its Affiliates or their group companies;

f) any counterparties, product issuers/guarantors, dealers, distributors, collective investment schemes and their managers, administrators, investment managers, trustees and custodians, Custodial Agents, other custodians and agents and any such party’s nominees and affiliates involved in transactions conducted by MCAM on behalf of you;

g) credit reference agencies, and, in the event of default, debt collection agencies;

h) any party giving/proposing to give/who has given a guarantee or third party security to guarantee or secure your obligations;

i) any actual or potential assignee, transferee, participant, sub-participant, delegate, or successor of the rights or business of MCAM;

j) judicial bodies and public or government authorities (which may include regulators, securities exchange or other similar agencies or authorities, tax authorities, hospital authority, social welfare department and other authorities) in and outside Hong Kong;

k) legal or other professional advisers and agents engaged by MCAM or its Affiliates;

l) law enforcement bodies of Hong Kong (including but not limited to Hong Kong Police and Independent Commission Against Corruption) and those of other jurisdictions; and

m) any party in respect of which such disclosure is requested and/or consented by you.

Other entities and third party service providers will also process Data. To the extent that any third party service provider processes the Data, MCAM will obtain your consent on the disclosure and ensure that they execute agreements containing provisions preserving confidentiality and policies/procedures in place to comply with the applicable Data Protection Laws. Upon your request, we will also inform you the recipient’s name and contact information, the purpose and method of handling, and the types of Data. Outsourcing arrangements are subject to due diligence and reasonably practicable monitoring to ensure an adequate standard of data privacy protection throughout the life of the outsourcing.

7. Direct Marketing.

We may use Data for direct marketing purposes and requires your consent (which includes an indication of no objection) before it could do so. We may use your full name, contact details, products and services portfolio information, transaction pattern and behaviour, financial background, investment experience and background, risk profile and demographic data for direct marketing purposes. The following classes of products, services and initiatives may be marketed to you:

a) financial products and services;

b) insurance, credit card and related services and products;

c) share ownership plan services;

d) reward, loyalty or privileges programs and related services and products;

e) products and services offered by MCAM’s Affiliates or co-branding partners; and

f) donations and contributions to charitable and/or non-profit organizations.

The above products, services and initiatives may be provided or solicited by:

a) MCAM or its Affiliates (in Hong Kong or outside Hong Kong);

b) CITICS, CSI or any group companies of CITICS or CSI;

c) third party financial institutions, insurers, securities and investment services providers;

d) third party reward, loyalty, co-branding or privileges program providers;

e) co-branding partners of MCAM or its Affiliates; and

f) charitable or non-profit organizations.

We intends to use and to provide the above-mentioned Data to all or any of the above parties for use by them in marketing those products, services and initiatives, and we requires your written consent (which includes an indication of no objection) for that purpose. We may receive money or other benefits in return for providing the relevant Data to the above parties. When requesting the Data Subject's consent, we will inform him/her if it will receive any money or other benefits in return for providing the Data to any other party.

If you do not wish to have your Data used for direct marketing purposes, you may exercise your opt-out right by ticking the appropriate box in the Account Opening Form, or by notifying us in writing. Please address opt-out requests to MCAM’s Data Protection Officer (contact details below). However, the right to make such a request is not applicable to you if the direct marketing is addressed to you in your capacity as a representative of a company or business and is not sent to you in your individual or personal capacity.

8. Cross-border Transfer of Data

MCAM together with its Affiliates is a global financial institution comprised of multiple offices and affiliated entities in different jurisdictions. In order to meet our legal and regulatory obligations around the world and for the purposes specified in clause 3 above, your Data may be transferred to or shared across our integrated computer networks with one or more of affiliated offices and other countries that may not be subject to Data Protection Laws similar to those prevailing in the jurisdiction in which such information is provided to or received by us.

Data transferred to another jurisdiction may be disclosed, processed, stored or maintained in accordance with the laws, rules, regulations, guidelines, directives, orders and practices applicable in that jurisdiction. For example, in so far as Data is transferred to Mainland service providers for customer relationship management, trade, credit assessment, risk management, audit and data processing or other purposes, please be informed that the Data will be stored in the Mainland China; the Data so stored is subject to the laws, regulations, orders and practices of the People’s Republic of China (“PRC”) and to access by PRC law enforcement agencies and regulators. Restrictions on data access as stated in the contract between MCAM or (as the case may be) other entities or service providers cannot override PRC laws or regulatory requirements or those of other jurisdictions.

All of our offices adhere to the internal policies and procedures with respect to your Data in compliance with applicable Data Protection Laws.

9. Web-site

We may collect, process and use Data of visitors to its website in order to provide improved products and services to visitors, to adapt business processes to customers’ needs, and to direct visitors to the relevant product information and online trading platforms. Cookies are unique identifiers placed on a computer or other device by a web server, which contains information that can later be read by the server that issued the cookie. We may use cookies on its website. The information collected (including but not limited to: visitor’s logon ID, IP addresses (and domain names), browser

software, types and configurations of his/her browser, language settings, geo-locations, operating systems, peripherals, referring website, pages and content viewed, and durations of visit) will be used for:

a) analyzing our web-site’s traffic;

b) compiling aggregate statistics on how visitors reach and browse our websites;

c) improving user experience;

d) customer and user administration and marketing;

e) informing visitors about our services and products; and

f) gauging the effectiveness of our marketing initiatives.

Such information is collected anonymously and the visitor cannot be identified unless he/she has logged on as a customer/user. Session cookies enable our website to keep track of the visitor’s movement from page to page so that he/she is not asked to provide the information already given to the site. Functionality cookies allow visitors to proceed through many pages of a site quickly and easily without having to authenticate or reprocess each new area he/she visits.

Advertising cookies will allow MCAM to provide advertisements on our website which are as relevant to the visitor as possible, e.g. by selecting interest-based advertisements, or preventing the same advisement from constantly reappearing.

Most web browsers are initially set up to accept cookies. If you do not want to receive cookies, you can disable this

function in your browser settings. However, by doing so, you may not be able to enjoy fully the benefits of our websites, and certain features may not work properly.

10. On-line/Mobile Trading Platforms

MCAM also offers on-line and mobile trading platforms to its Customers. MCAM may, during the process, collect, transmit, store and use technical, location and login and other personal data and related information about the Customer’s device (e.g. MAC address and IP address), system and application software, and peripherals.

When Customers use any such trading platforms, MCAM and third party vendors/licensors may use audit logs, cache, cookies and/or pixel tags to collect such information and store the Customer’s preferences. MCAM may use the information for various purposes (for instance, security purpose, to facilitate navigation or provision of software updates or product support, to display information more effectively, and to personalize the Customer’s experience while using the platform, as well as for on-line tracking, customer relationship management, compliance monitoring and checking and risk management). MCAM may recognize the device used by the Customer in order to assist his/her use of the service or the mobile application. We may also gather statistical information about the usage of the service or mobile application in order to improve the design and functionality, understand how it is used and to assist MCAM with resolving issues regarding it. Cookies may further allow MCAM to select which of its advertisements or offers are most likely to be of interest to the Customer and display them while he/she is using the service or the mobile application. We may also use cookies in on-line and mobile advertising to track responses to our advertisements and to gauge the effectiveness of our marketing campaigns. Customers are advised to review the Terms of Use of the relevant trading platform or (as the case may be) the mobile application carefully before using it.

11. External Links

If any part of the MCAM’s website or platform contains links to other websites, those sites do not operate under this Statement. Visitors are advised to check the privacy statements of those websites to understand their policies on the collection, usage, transfer and disclosure of personal data. We will be not responsible for the content of any other websites or pages linked to or linking to our website and usage of any of such linked websites or pages. Such links are provided solely for your convenience and information. Following links to any other websites or pages shall be at your own risk.

12. Retention

MCAM follows retention policies to ensure that Data is retained only so long as required for the purposes for which it was collected, and as necessary to comply with applicable legal and regulatory requirements.

13. Your Rights

Subject to applicable Data Protection Laws, you are entitled to the following rights:

a) Being informed - You have the right to be informed about the collection and use of your Data as stated in this Statement. Upon your request, we will provide you with the MCAM’s policies and practices in relation to the Data which includes the purposes for processing your Data, processing method, our retention policy, and who it will be

shared with;

b) Deciding - You have right to decide on the processing of your Data;

c) Access - You have the right to request a copy of the Data that we are processing about you. If you require additional

copies, we may need to charge a reasonable fee;

d) Rectification - You have the right to require the correction of any mistake in the Data, whether incomplete or

inaccurate, that we hold about you;

e) Erasure - You have the right to require the erasure of Data concerning you. We may delete your Data if:

i) where the purpose of processing has been achieved, unable to achieve, or is no longer necessary to achieve;

ii) where we stop providing products or services, or the agreed storage period has expired;

iii) where your consent has been withdrawn;

iv) where the processes of your Data is in violation of laws, administrative regulations, or the agreement; or

v) any other circumstance as prescribed by laws and administrative regulations.

except that we are required to maintain the Data by applicable laws and regulations or it’s not technically

doable in which case we will take necessary safety measures.

f) Portability - You have the right to receive the Data concerning you that you have provided to us, in a structured, commonly used, and machine-readable format and have the right to transmit that Data to a third party in certain situations;

g) Objection - You have the right to (i) object at any time to the processing of your Data for direct marketing purposes and (ii) object to our processing of your Data where the legal ground of such processing is necessary for legitimate interests pursued by us or by a third party. We will then abide by your request unless we can demonstrate compelling legal grounds for the processing;

h) Restriction of processing - You have the right to request that we restrict our processing of your Data in certain circumstances, except as otherwise provided by any laws or administrative regulation;

i) Withdrawal of consent - If we rely on your consent (or explicit consent) as our legal basis for processing your Data, you have the right to withdraw that consent at any time.

When handling a data access or correction request, we will check the identity of the requestor to ensure that he/she is the person legally entitled to make the data access or correction request. Please address requests for access and/or correction of personal data to the Data Protection Officer (contact details below). MCAM may charge a reasonable fee for complying with a data access request.

Data Subjects and other third parties who provide (or authorize the provision of) Data to us represent and warrant that such Data is true, accurate and complete and shall notify us in writing immediately upon any changes in Data previously provided to us.

14. Data Security Protection Measures

MCAM has implemented reasonable security measures to protect Data from risks such as illegal processing, destruction or accidental loss. We use electronic security measures to control access to Data, including the use of passwords, firewalls and mechanisms to encrypt Data, such that the information systems are authenticated and authorized prior to usage. MCAM has applied a record-keeping mechanism to maintain relevant records when processing or using Data, such as recording the purpose of processing, the type of Data Subject and the data recipient. We shall implement internal reviews on Data transfer and conduct regular random checks on Data transmission, organization, information systems and network security structures. MCAM has also taken reasonable measures to secure and control the physical security of Data or other confidential information, including but not limited to: fire prevention; prevention of smoke and water damage, fire and emergency alarm systems, password-locked files, protective devices or other equipment to prevent loss or unauthorized deletion of manually saved data, restricted access to prevent unauthorized access to Data and documents.

While we strive to protect your Data, we cannot ensure the security of any Data which you may have transmitted to us via methods using an unsecure browser, and we urge you to take every precaution to protect your Data and use a secure browser.

15. Miscellaneous

MCAM may, at any time and without prior notice, amend, update or modify this Statement, simply by notifying Data Subjects of such amendment, update or modification. If MCAM decides to do so, we shall post the revised version on our website. Any such change, update or modification will be effective immediately upon posting.

This Statement shall form an integral part of the Terms and Conditions and/or other contracts, agreements and other binding arrangements, which you enter into with MCAM. This Statement applies to all transactions entered into by you with or through MCAM, whether before or after the date of this Statement.

In the event of discrepancy between the Chinese version and the English version of the Statement, the English version shall prevail.