Hysan's Group Privacy Policy Statement

This is the Privacy Policy of the Hysan Group. The Hysan Group comprises Hysan Development Company Limited and each of its subsidiaries including Hysan Leasing Company Limited, Hysan Marketing Services Limited, Hysan Property Management Limited, Stangard Limited, Hysan Corporate Services Limited, Bamboo Grove Recreational Services Limited, as well as their holdings companies, branches, representative offices and affiliates (collectively the "Group", "Hysan", "we", "us" or "our").

As a responsible business Hysan respects personal data privacy and is committed to fully implementing and complying with the data protection principles under the Personal Data (Privacy) Ordinance (Cap. 486 of the Laws of Hong Kong) (the "Ordinance").

Our privacy principles are:

• Hysan only collects personal data which we believe to be relevant and required to conduct our business.
• Hysan will use your personal data only for the purpose for which the data is collected or for a directly related purpose, unless consent for a new purpose is obtained from you.
• Hysan will keep your personal data accurate and up-to-date.
• Hysan will not transfer or disclose your personal data to any entity that is not a Group entity or not a party as detailed in this Privacy Policy without your consent unless it is required by law or it was previously notified to you.
• Hysan has implemented various physical, electronic and management measures to safeguard and secure the personal data we collect.

Please read the following Privacy Policy to understand how Hysan handles your personal data collected through various means, including its websites, mobile applications, social media platforms, application forms and other collection channels. By providing your personal data to us, you are consenting to this Privacy Policy and the collection, use, access, transfer, storage and processing of your personal data as described in this Privacy Policy.

• 1.Kinds of Personal Data Collected and Held
• 1.1We collect and hold the following broad categories of personal data (“Data”) depending on our engagement with you:
  1. Tenant records: including name, contact details, company name, business title and other information supplied by tenants and collected in connection with tenant services and related activities;
  2. Customer records: including salutation, name, gender, marital status, month of birth, company name, business title, education background, telephone number, fax number, email address, correspondence address, membership numbers, photograph, relevant log-in information that customers use to access our products and services, and other information supplied by customers and collected in connection with our loyalty club programmes and surveys;
  3. Personnel records: including Hysan personnel details, job particulars, details of salary, payments, benefits, leave and training records, group medical insurance records, mandatory provident schemes participation, performance appraisals and disciplinary matters;
  4. Consultant and contractor records: including name, contact details and other information of any individual employed or engaged by service providers in the fields of construction, information technology, marketing and other areas providing necessary services required by Hysan;
  5. Records collected on webservers, mobile or digital media: including email addresses, browsing preferences and IP addresses (whereas they constitute personal data under specific circumstances that the addresses can be used to identify an individual) collected for newsletter subscription, online enquiries, membership log-in or otherwise;
  6. Other records: including records of visitors to the premises operated by Hysan, members of the public making enquiries or responding to our surveys, business partners, officers, shareholders, investors and other operational and administrative records that contain personal data, and other information as may be set out in the relevant form or collection channel.
• 2.Purposes for which the Data are Collected and Used
• 2.1We may use the Data for the following main purposes (or any directly related purpose):
  1. Tenant records: for providing tenant and property management services and related activities, maintaining tenant accounts, managing moving in and out of Hysan premises or car parks, processing rental receivables, responding to and follow up enquiries;
  2. Customer records: for communication, providing rewards or benefits for loyalty club programmes, administration of loyalty club membership including verification of identity, accumulating and redeeming reward points, handling requests for services, membership or benefits, providing marketing materials, market research and analysis or any other purposes which the customer has been notified of and consented to;
  3. Personnel records: for recruitment and human resource management purposes, relating to such matters as employees’ appointment, employment benefits, termination, performance appraisal and discipline;
  4. Consultant and contractor records: engaging, monitoring, managing and appraising relationships with consultants and contractors who are and/or engage or employ individuals to provide services to Hysan;
  5. Records collected on webservers, mobile or digital media: for sending newsletters to subscribers registered through websites and providing marketing materials and replies to enquiries, and for market research and data analytics; and
  6. Other records: for various purposes varying according to the nature of the records, including for administration and operation of the Hysan premises, handling enquiries from members of the public and carrying out daily business.
  7. General:
     • for communicating with you;
     • for our daily operation and administration;
     • for market research and data analytics;
     • subject to your consent, for direct marketing (see below paragraph on direct marketing);
     • for identification and verification;
     • for enforcing our legal rights;
     • for complying with legal or regulatory obligations;
     • for handling your enquiries or requests; and
     • for any other purposes to which you may from time to time agree.
  8. If we wish to use your personal data for a new purpose (other than the purposes (if any directly related purpose) outlined above, we will obtain your consent in advance.
  9. We will not sell or rent the Data provided to us, or knowingly or intentionally use or share the Data in ways unrelated to the purposes aforementioned.
• 3.Disclosure and Transfer of Data
• 3.1We may disclose and transfer the Data you provide to the following parties and other persons who we consider appropriate (whether local or overseas) in connection with the purposes set out above (or any directly related purpose):
  1. any member of the Group (including different divisions within each Group entity);
  2. any of our agents, professional advisers, contractors, service providers, or any persons under a duty of confidentiality to us;
  3. our business associates;
  4. our successors or assigns (whether actual or proposed) under an acquisition, sale or restructuring of the business and/or assets of any member of the Group, or any assignee of our rights;
  5. any person to whom we are under an obligation to make disclosure under the requirements of law or a court order of any jurisdiction or to any government or law enforcement authorities or administrative organs as requested;
  6. any person to whom we believe in good faith that disclosure is otherwise necessary or advisable including and without limitation to protect our rights or properties or in circumstances which we consider to be related to any of the purposes for which the Data are collected; and
  7. to any person when we have reason to believe that disclosing the Data to such person is necessary to identify, contact or bring or defend legal action against someone, e.g. anyone who may be causing interference with our rights or properties, whether intentionally or otherwise, or when anyone else could be harmed by such activities.
• 3.2The Data you provide to us may also be sourced from or transferred to other jurisdictions outside Hong Kong for the purposes mentioned above. We will try to ensure, as far as possible and practicable, that Data sourced or transferred outside Hong Kong is protected to standards in line with the requirements of the Ordinance, subject to any other requirements and limitations of the particular jurisdiction.
• 4.Data Security and Retention
• 4.1Subject to any legal and regulatory requirements, the Data you provide to us will be kept by us in the appropriate form only for as long as is necessary to fulfil the purposes mentioned above, after which it will be destroyed.
• 4.2In order to ensure the correct use and to maintain the accuracy of Data collected from you, as well as prevent unauthorised or accidental access, processing, erasure or other use of the Data, we have implemented various physical, electronic and management measures to safeguard and secure the Data we collect and have appropriate security policies in place. However, we cannot guarantee that data transmission over the internet or other media is completely secure.
• 5.Our Commitment to Children's Privacy
• Protecting the privacy of children is our primary concern. If you are under the age of 18, you should obtain consent from your parent or guardian before providing us with your Data.
• 6.Direct Marketing
• 6.1We may only use your personal data for the purposes of direct marketing if you have consented to such use. You may indicate your consent to our use of your personal data for direct marketing by selecting the relevant option in the appropriate online or paper form submitted to us.
• 6.2You can withdraw your consent for use by us of your Data for direct marketing at any time by sending an email to our Data Privacy Officer at data.officer@hysan.com.hk or as indicated in the relevant materials.
• 7.Cookies and Other Tracking Mechanisms
• 7.1We may collect information about your computer or device, including where available your IP address, device ID, MAC address, operating system and browser type. This is statistical data which does not reveal your identity. Similarly, cookies may be left on the hard drive of your computer, mobile phone or other devices.
• 7.2We use cookies and other tracking mechanisms mentioned above for system administration, to track information about your use of our websites or mobile applications and to improve your browsing and user experience. You may choose to accept or refuse cookies by adjusting the settings of your web browser. However, if you select to refuse cookies, you may not be able to fully access certain functions.
• 7.3We use analytics tools to measure how visitors interact with content on our websites and applications. If you log-in to our websites or applications via your social media accounts, we may collect information you have made available on the relevant social media site and link your interaction with us to such information. Where you have consented to direct marketing, we may also engage social media sites to show you advertisements that are customised based on your interaction with us.
• 7.4We may feature embedded links, “share” buttons or widgets on our websites or applications to enable you to connect to third party sites, including social media sites. These third party sites may set cookies which can identify you as an individual when you are logged in to their services. We do not control these cookies or how these sites collect and handle your Data. You should read the relevant third-party sites for their privacy policies before submitting any Data to these sites. We have no control over and are not responsible or liable for the contents of third party sites or third party posts on our social media accounts.
• 7.5We may use analytic technologies at our premises for anonymous demographics and foot traffic analysis. In addition, we may collect your physical location data through your WiFi enabled mobile device. We use these data to determine visitor population and to help us study your activity patterns and preferences in order to improve service experience. We may use your location data to provide you with personalised location-based services and content. Where you have consented to receive direct marketing, we may provide you with targeted advertisements, content, features, deals and offers. You may refer to our WiFi policy for further details of how we may make use of such data.
• 8.How to Access or Correct Your Data or Contact Us
• 8.1You are entitled to access or correct any Data related to you held by us. If you wish to obtain a copy of any of your Data or if you believe that the Data related to you which we collect and maintain is inaccurate, please contact our Data Privacy Officer at data.officer@hysan.com.hk or at the following address:
  Data Privacy Officer
  Hysan Development Company Limited
  50/F, Lee Garden One
  33 Hysan Avenue
  Causeway Bay
  Hong Kong
• 8.2In accordance with the terms of the Ordinance, we have the right to charge a reasonable fee for the processing of any data access request.
• 8.3You may also contact us at the above details for any other data privacy related matters.
• 9.Access to Data Privacy Policy
• 9.1You may access and obtain a copy of our Data Privacy Policy, as amended from time to time, on our website at [www.hysan.com.hk/privacy-policy-statement/] so that you are always informed of the way we collect and use your Data.
• 9.2We amend or update this Privacy Policy from time to time without prior notice. You are advised to visit the above website regularly for the latest version of this Policy.
• 10.Language
• 10.1This Notice is written in the English language and may be translated into other languages. In the event of any inconsistency between the English version and the translated version of this notice, the English version shall prevail.

Last version date: July 2018