Privacy Policy

Introduction

This Privacy Policy and Personal Data Collection Statement (hereinafter referred to as “this Policy Statement”) applies to Tung Yat Securities Limited and its affiliates (if applicable) (hereinafter referred to as “we”) and the services provided to users (hereinafter referred to as “you”) through our operated platform, Tung Yat Securities (including but not limited to the mobile client app named Tung Yat Securities and any software, application, webpage we subsequently operate or launch) (hereinafter referred to as “this Platform”). If a specific service we provide has its own privacy policy or terms, that service's privacy policy or terms will take precedence. Any content not covered by that service's privacy policy or terms will be governed by the content of this Policy Statement.

We are committed to protecting your personal information (including personal data defined below) in accordance with the Personal Data (Privacy) Ordinance of Hong Kong (hereinafter referred to as “the Privacy Ordinance”) and other applicable laws and regulations (collectively referred to as “Legal Regulations”). We only collect your personal information for legitimate and relevant purposes and will take all practical measures to ensure that the personal information we hold is accurate. We will use or disclose the personal information we collect from time to time in accordance with the Privacy Ordinance and this Policy Statement. We will explain to you how we process (including but not limited to collecting, storing, using, providing, etc.) your personal information and how you can exercise your rights regarding personal information processing activities. We recommend that you read this Policy Statement carefully and ensure that you fully understand it (especially the content highlighted in bold or italicized) before using this Platform's services, and make choices that you consider appropriate.

In this Policy Statement, "Personal Data" refers to any personal information that meets the following descriptions:
(a) relates directly or indirectly to a living individual;
(b) can reasonably ascertain the identity of the individual concerned directly or indirectly from the data; and
(c) the form of the data allows for its access and processing to be feasible.

This Policy Statement will help you understand the following content:
1. Scope of Application
2. Personal Data We Collect
3. How We Collect Your Personal Data
4. How We Store and Protect Your Personal Data
5. How We Use Your Personal Data
6. How We Use Cookies and Similar Technologies
7. How We Delegate Processing, Share, Provide, and Disclose Your Personal Data
8. How We Use Your Personal Data for Direct Marketing
9. How You Can Exercise Your Rights
10. How This Policy Statement Is Updated
11. Contact Us
12. Others
『Appendix 1: Special Policy Statement Applicable Only to Users in Mainland China』

1. Scope of Application
1 Scope of Application: This Policy Statement applies to the services we provide to you through this Platform.
2 Exclusions: It should be specifically noted that unless expressly stated or agreed under this Policy Statement, it does not apply to our affiliates, partners, or other third parties providing services to you. This Platform may also contain links to other websites; we will take necessary measures to review those websites as required by Legal Regulations, but we cannot guarantee that the operators of those linked websites will take protective measures as per our requirements. If you use any third-party products or services during your use of this Platform’s services, we recommend that you review and comply with the privacy policies of those service providers to understand how they process your information for prudent decision-making.
3 Special Statement
(1) Special Policy Statement Applicable to Users in Mainland China Only
Please be advised that if you are a user in Mainland China, unless otherwise provided by law, in addition to all content under this Policy Statement, you must also confirm and agree to the special policy statement specifically for users in Mainland China, as detailed in Attachment 1 of this Policy Statement.

2. Personal Data We Collect
You can click on the “Personal Information Collection List” to understand in detail how we collect and use your personal information.

3. How We Collect Your Personal Data
We follow the six data protection principles outlined in the Personal Data (Privacy) Ordinance to collect and use your personal information within the purposes, methods, and scope described in this Policy Statement, including but not limited to personal information you actively provide to us, personal information generated or retained during your use of this Platform’s services, and personal information collected from third parties with your authorization or as permitted by Legal Regulations. If we need to collect any other personal information not stated in this Policy Statement or use your personal information for purposes not specified in this Policy Statement, or use information collected for specific purposes for other purposes, we will notify you reasonably and obtain your consent before collecting and using it, or ensure that it falls under other circumstances that do not require consent as stipulated by Legal Regulations.

1. *Circumstances Under Which We Collect Personal Data*
1.1 *Account Registration, Login, and Verification*
You need to register an account on this Platform to log in and use the services (as defined in the Service Agreement), which refers to the comprehensive platform services we provide to you based on this Platform, including but not limited to account management and information services. The specific service content and matters will depend on the actual providing situation at that time.
During your registration process, to complete the account creation, you need to provide us with your mobile phone number. If you do not provide this information, you will not be able to receive the SMS verification code and complete the account creation process.
After completing the account registration, you can improve your personal data based on the page prompts, including but not limited to providing your nickname, profile, and avatar information.
(If applicable) When you use a third-party account (e.g., Facebook, Twitter) to register and log in, we will obtain the avatar and nickname of the third-party account you used for login through the third-party authorized service provider. If you do not agree to provide that information, you will not be able to register or log in using the third-party account, but it will not affect your use of our services through other channels. This information will be used to manage your account on this Platform; unless you choose otherwise or comply with relevant legal requirements, we will not disclose this information externally nor use it for purposes other than that function.
When you choose to log in using a verification code, we will request the SMS sending function of the device, which may incur SMS fees charged by your mobile network operator; we do not charge any SMS fees. If you refuse to send the SMS, you will not be able to use the verification code login function, but you can still choose other login methods.
To provide you with message push services, we may obtain relevant information about the device you are using (IP address, mobile serial number, Android ID) in the background status/silent state.

1.2 *Protecting Your Account Security*
To enhance the security of your use of this Platform's services, we will collect and record the relevant information about the device you are using (including but not limited to device name, device model, unique device identifier (e.g., IMEI, IDFA, IDFV, OAID, Android ID), operating system, IP address, mobile device network card address (MAC address), software installation list, resolution, mobile application download channel, current mobile application version number, mobile application language settings, software version information, system version information, mobile network information) based on the specific permissions granted during software installation and use to assess the security of your account. To enable you to use this Platform's services normally, we will collect the information you need to provide or generate while using this Platform's services, such as standard network log data, network usage habits, operation logs, service records, etc. If you do not agree to provide this information, it may affect the security verification of the transaction environment or prevent verification from being completed.
To improve your service experience and service quality or to recommend better services, we may collect the operation records of your use of this Platform’s services, the information you provide when contacting the customer service team, and the information you send us during participation in surveys. If you do not agree to our collection of this information, it will not affect your use of our other provided functions.

1.3 *Providing Securities Services to You*
When you open an account (including but not limited to securities accounts) through Tung Yat Securities Limited or use related products and services on this Platform, in accordance with the relevant securities laws and regulations and the account opening rules of Tung Yat Securities Limited, you may need to submit (1) document information: such as photos of your passport or ID card; (2) your residential address information, correspondence address information, and corresponding proof documents; (3) your educational background and job position information; (4) your tax information; (5) email address; (6) your bank account information; and (7) other information required by regulatory provisions, with specifics subject to the rules and guidelines on the account opening page at that time. If you fail to provide the above information, you may be unable to open an account or enjoy related products and services. At the same time, to verify the authenticity, accuracy, and completeness of such information, we will verify and compare the information you provide with the information legally retained by relevant agencies (including government departments, enterprises, commercial institutions, etc.).
If you are found to be in violation of relevant laws and regulations or regulatory provisions, you will need to provide us with a color scan of a valid ID and cooperate with our investigation; otherwise, we will cease to provide services to you.

1.4 *Personalized Recommendation Services*
1.4.1 *About Personalized Recommendation Services*
(1) We will inform you of the user information collected for personalized recommendations, feedback channels, and management entry of personalized recommendation functions through this policy, instant notifications, etc.
(2) To provide you with personalized recommendation services, we will collect and use your device information, location information, and behavioral information when you use this Platform (including your click, follow, favorite, search, browse, download, share, and transaction operation records when accessing/using this Platform) to achieve analysis and calculation for personalized recommendations and select content deemed more valuable or of greater interest to you based on the calculation results. We will provide real-time feedback on the recommendation model based on your browsing behavior during the product use process and continuously adjust and optimize the recommendation results.
(3) The personalized recommendation services we provide mainly include information recommendations, advertisement recommendations, and marketing activity recommendations, which we will provide to you through push notifications and the “Market” - “You May Like” and “Dynamics” - “Recommendations” pages on this Platform.

1.4.2 *Control and Management of Personalized Recommendation Functions*
(1) *Independently Decide to Receive Personalized Recommendation Content*: You can enable or disable the personalized recommendation function through “My” - “Settings” - “Privacy” - “Personalized Recommendation.” If you choose to disable the personalized recommendation function, you will not be able to enjoy the corresponding personalized recommendation services.
(2) If you are not interested in the recommended advertisements, you can click “Skip”; if you are not interested in the recommended content or wish to reduce recommendations for certain types of content, you can click “Not Interested” or mask relevant users in your personal homepage; we will adjust our strategy based on your feedback. We also provide an “Feedback”

channel to listen to your opinions and suggestions.
(3) *Independently Subscribe to Required Content*: The channels followed will display based on the accounts you actively choose to follow; you can independently choose to follow or unfollow.
(4) When there is no content of interest to you, you can also enter interested keywords in the search bar and click to read the search results.

1.5 *How We Request Device Permissions*
To enhance the security of your use of this Platform's services, we may request the following permissions from you within necessary limits. Please rest assured that this Platform will not enable these permissions by default, and will only collect your information through these permissions if you actively confirm to enable them. It should be noted that obtaining this permission does not necessarily mean that we will collect your personal information; even if you confirm to enable the permission, we will only collect your personal information within the minimum range necessary to achieve the processing purpose.
(1) *Read and Write Memory (SD Card) Permission*: If you install and use this Platform's app, it will request this permission to ensure stable operation and enhance the convenience of using products and services (to cache some user data and images and provide user avatar updates, images, and QR code recognition services). This Platform's app promises to only read or cache necessary information. If you choose not to enable this permission, you will not be able to use specific functions related to this permission; however, it does not affect your use of other services provided by this Platform's app.
(2) *Read Phone State Permission*: If you install and use this Platform's app, it will request this permission to reduce your security risks by reading your device identification information, device state information, and device environment information. If you choose not to enable this permission, you will not be able to use specific functions related to this permission, but it does not affect your use of other services provided by this Platform's app.
(3) *Camera and Album Permissions*: When you use functions such as scanning or setting avatar images, you will need to enable camera permission and/or album permission (depending on the specific function you are using) to allow you to take photos or upload images/videos in real-time. If you choose not to enable the corresponding permissions, you will not be able to use specific functions related to real-time shooting or uploading images/videos, but it does not affect your use of other services provided by this Platform's app.
(4) *Microphone Permission*: When you send voice information or communicate with customer service via voice, you need to enable this microphone permission and use the microphone device for voice input. If you choose not to enable this permission, you will not be able to use specific functions related to voice input, but it does not affect your use of other services provided by this Platform's app.
(5) *Calendar and Reminder Permissions*: When you use the significant event reminder function, you need to enable calendar and reminder permissions and allow us to read your calendar information and provide recording and reminder functions based on this. If you choose not to enable this permission, you will not be able to use specific functions related to significant event reminders, but it does not affect your use of other services provided by this Platform's app.
(6) *Fingerprint/Face Verification Permissions*: To provide you with a more secure operating environment, if your mobile device and client software version support fingerprint or facial recognition functions, you may choose to enable fingerprint or facial verification permissions. You need to input your fingerprint or facial information on your device; your fingerprint or facial information will only be stored on the device you input it on; we will not obtain it. When you log in using fingerprint recognition or facial recognition, the extraction and verification of fingerprint feature information or facial feature information will be completed on your device terminal, and we will only obtain the verification results completed on the mobile terminal. If you do not wish to enable fingerprint or facial recognition functions, you will not be able to enter your transaction password via fingerprint or facial recognition, but it does not affect your use of other login methods on this Platform's app, nor does it affect your use of other services we provide.
(7) *Location Permission*: To provide you with convenient functions such as quick address input, you need to enable location permission and allow us to read your location information. If you choose not to enable this permission, you will not be able to use specific functions related to address location, but it does not affect your use of other services provided by this Platform's app.
(8) *Device Sensor Permissions*: If you install and use this Platform's app, we will request this permission to ensure stable operation and provide you with a more secure operating environment. We promise to only use this permission to establish an abnormal, virtual device identification model to achieve security risk control technology. If you choose not to enable this permission, you will not be able to use specific functions related to this permission; however, it does not affect your use of other services provided by this Platform.

2. *Circumstances Under Which Personal Information Can Be Processed Without Consent*
According to relevant laws and regulations, we may process your personal information without obtaining your consent under the following circumstances:
(1) Necessary for signing and performing a contract with you;
(2) Necessary for performing statutory duties or legal obligations;
(3) Necessary for responding to public health emergencies or protecting the life, health, or property safety of you or other individuals in emergencies;
(4) Reasonably necessary for news reporting, public opinion supervision, or other public interests;
(5) Reasonably necessary for processing personal information that you have made public or that has been legally disclosed;
(6) Necessary for establishing, exercising, or defending legal rights in Hong Kong;
(7) Other circumstances specified by laws and regulations that do not require obtaining your consent.

3. *Other Parties Collecting Your Information*
You acknowledge and understand that when you use this Platform or navigate to third-party platforms to use services provided by third parties, the collection and use of your information by those third parties are not covered by this Policy Statement, but are governed by the privacy policy of that third party. We recommend that you carefully read and decide whether to be bound by the privacy policy of those third parties before using their services.

4. *Other Circumstances with Your Consent*
Please understand that the functions and services we provide are continuously updated and developed. In addition to the above circumstances, if we provide other functions or services that require the collection of your personal information, and if they exceed the purposes stated in this Policy Statement or the direct or reasonable correlation with the purposes for which we collect your personal information, we will inform you of the relevant processing purposes, methods, and types of personal information in a specific scenario through click confirmation agreements, click confirmation actions, or pop-up prompts before processing your personal information, and seek your consent again.

4. How We Store and Protect Your Personal Data
1. *Storage of Personal Data*
The retention period of personal information (including personal data) varies based on different factors, including:
(1) *Purpose of Use* - We need to retain the data for as long as necessary for that purpose;
(2) *Legal Obligations* - Legal regulations, rules, normative documents, or government policies or orders require the minimum retention period for data;
(3) *Service Duration* - The period during which we provide services or operate.
When your personal information exceeds the necessary and statutory retention period, we will delete or anonymize your personal information. After your personal information has been anonymized, it will form data that can be used and circulated, and we do not need to notify or obtain your consent for the retention and processing of such data. To avoid doubt, when a product/service ceases to operate, our deletion or anonymization of your personal information does not affect our affiliates' continued processing of your personal information based on your consent, and your continued use of the services of those affiliates at that time.

2. *Protection Measures for Personal Data*
To ensure the security of your information, we will use various security protection measures within a reasonable level of security to protect the information's security, taking technical and management measures to reduce the risk of loss, misuse, unauthorized access, disclosure, and alteration. Technical measures include but are not limited to encryption of data in transmission (e.g., TLS, SSL), firewalls, encrypted storage, physical access control, and information access authorization control; we have also established relevant systems, processes, and organizations to ensure information security through management measures:
(1) We will provide authorized employees and agents access to or use personal information in a secure manner based on the principle of “need to know” (encrypting personal information when necessary);
(2) Our affiliates must use your personal information in accordance with strict internal security standards, confidentiality

policies, the Privacy Ordinance, and other applicable laws;
(3) We restrain our employees to fully comply with those standards, policies, and laws;
(4) We will provide relevant training to our employees regarding the proper handling of your personal information.
(5) In the event of a personal information leak or other security incidents, we will initiate emergency plans to prevent the expansion of the security incident and notify you via push notifications, announcements, etc. At the same time, we will report the handling of personal information security incidents in accordance with legal regulations or regulatory requirements.
(6) As we continue to develop new products and services, we will continue to strive to ensure that your personal information is used correctly and adequately protected.
When using this Platform's services, please keep your account and password secure; we will identify your identity through your account and password. Once you leak your account and password for any reason, you may lose your information and may face adverse legal consequences. If you find that your account and password have been leaked or are about to be leaked for any reason, you should immediately contact us so that we can take timely measures to prevent or reduce related losses.

5. How We Use Your Personal Data
We may use the relevant information collected from you for the following purposes:
1. To achieve the purposes described in “Part 3: How We Collect Your Personal Data” of this Policy Statement (including providing you with services on this Platform);
2. To report as required by relevant regulatory authorities;
3. When you use this Platform's services, we will use your information for identity verification, customer service, security prevention, fraud monitoring, preventing or prohibiting illegal activities, archiving, and backup purposes, ensuring the security of the products and services we provide to you;
4. To conduct comprehensive statistics, analysis, or processing (please understand that after anonymization, personal information cannot identify the subject of personal information, thus no longer being classified as personal information) on your personal information in a desensitized, de-identified, or anonymized manner, to provide you with more accurate and convenient services or help us evaluate, improve, and design services and operational activities. If you feel that the aforementioned services or operational activities cause you disturbance, you can contact customer service using the contact method described in “Part 11: Contact Us” of this Policy Statement to assist you in closing or canceling;
5. To enhance the convenience of using products and services and utilize richer services, we may analyze and process the collected information to form user portraits and send marketing activity information, commercial electronic information, or advertisements that may be of interest to users through automated decision-making. If you feel that the aforementioned methods cause you disturbance, you can unsubscribe or close them as prompted on the page or contact customer service using the contact method described in “Part 11: Contact Us” of this Policy Statement to assist you in unsubscribing or closing;
6. To protect your or our rights or to resolve disputes related to you;
7. Other uses that you have authorized and consented to.

If we intend to use your personal information for purposes not stated in this Policy Statement or beyond the direct or reasonable correlation with the purposes for which we collect your personal information, we will request your consent again before reusing your personal information, in accordance with the requirements of laws, regulations, and relevant standards through click confirmation agreements or pop-up prompts. However, according to relevant laws and regulations, we may collect and use your personal information without your consent under circumstances that do not require consent (see “Part 3: How We Collect Your Personal Data” of this Policy Statement).
We may share/use/transfer relevant customer personal information (and other data) to other regions for the purposes described in this Policy Statement, and your personal information (and other data) may not be afforded the same or similar level of protection as that under Hong Kong law.

6. How We Use Cookies and Similar Technologies
By using this Platform, you confirm that you have been informed about our use of Cookies and agree to authorize us to use any data collected through Cookies for the purposes set forth in this Policy Statement.
1. *What are Cookies*
Cookies are a type of plain text data string. When you use the services of this Platform, we assign one or more small data files named Cookies based on your usage, which may include your encrypted login information, previously browsed pages, and browsing times and dates, so that this Platform can recognize your identity, remember your preferences, and provide you with a better user experience when you browse again.
For example: When you access information or services that require you to log in, when you log in, we will encrypt and store your login name in the Cookies file on your computer or device terminal. Because it is stored in an irreversible encrypted format, others cannot identify your login name even if they use your computer or device terminal. You do not need to do any extra work; all collection, storage, and encryption work is done automatically by the system.

2. *Storage and Deletion of Cookies Files*
Cookies files will be stored on your computer hard drive or device terminal's flash memory. They can only be read by the server that set them and cannot execute any code or virus. You can delete them at any time using your browser or operating system software.

3. *How We Utilize Cookies and Similar Technologies*
To provide you with more convenient, quick, smooth, and personalized services, we use Cookies and similar technologies to provide you with the following services:
(1) Remembering Your Account: For example, Cookies may help you save the step of repeatedly entering your account to use the services of this Platform.
(2) Analyzing Your Use of This Platform's Services: For example, we can understand your specific usage of this Platform's services through Cookies, web beacons, etc., or which pages or services are most popular with you.
(3) Advertising Optimization: We may display products or advertisement information that you may be interested in based on statistical information regarding your visits to relevant websites. This statistical information does not include any of your personal information and may be used to evaluate the effectiveness of advertisements. Cookies, web beacons, etc., help us provide advertisements related to you rather than general advertising.
(4) We may also use web beacon technology to statistically analyze anonymous access data; similarly, this statistical information does not include your personal information.
(5) Cookies and web beacon technologies may also be used by our third-party partners. The collection and use of such information by these third parties through Cookies and web beacons are not bound by this Policy Statement but are governed by the privacy policy of that third party. We recommend that you carefully read and decide whether to be bound by the privacy policy of those third parties before using services provided by third parties through Cookies and web beacons.

4. *Refusing Our Use of Cookies*
Generally speaking, the default setting for browsing this Platform is to accept Cookies. However, you have various tools for controlling the data collected by Cookies. For example, you can disable Cookies by changing your internet software browsing settings. You may also configure your browser settings to accept specific Cookies or be notified each time new Cookies are about to be stored on your computer/device terminal so that you can decide whether to accept or reject those Cookies.
Since our Cookies allow you to use some services of this Platform, we recommend that you keep the status of Cookies enabled. Once you disable Cookies, the services you can experience may be reduced or may not be able to use this Platform’s services at all.

7. How We Delegate Processing, Share, Provide, and Publicly Disclose Your Personal Data
(1) *Delegated Processing*
To improve the quality and efficiency of information processing, we may, within the scope permitted by laws and regulations, delegate capable partners to process information on our behalf. We solemnly promise to comply with legal regulations concerning delegated processing, fully review and evaluate the ability of such partners to protect personal information, require partners to strictly comply with confidentiality obligations through written agreements, audits, etc., take technical measures to desensitize the information processed on commission, and prohibit them from using this information for purposes not authorized by you. Upon termination of the delegation relationship, we will require the partner to no longer retain the relevant information.

(2) *Sharing*
This Platform contains third-party SDKs or other similar applications. If you use services provided by partners on this Platform, you agree that they will directly collect and process your information (for example, in the form of embedded code, plugins, etc.). The information your partner SDK collects usually includes operator information, MAC address, device information, and Wi-Fi address. We do not collect or store any personal information you fill out and submit on the pages of third-party SDK services. We recommend that you refer to the service agreements and privacy policies of the third-party SDK regarding the specific types of device

permissions called and how they collect and use your personal information. If you wish to learn more about how we share information with third-party SDKs, you can read our “Third-Party SDK Information Sharing Description.”

(3) *Providing to Third Parties*
We strictly keep your personal information confidential, but to enable us to provide you with this Platform’s services and conduct system updates, you acknowledge and agree that under certain conditions, we may provide your information to third parties (hereinafter referred to as “Third Parties”), including our affiliates, cooperating financial institutions, authorized authorities, and our partners. We may provide your personal information to third parties under the following circumstances:
1. Certain services and/or product functions we provide may be offered by our partners or jointly provided with our partners. Only by providing your information to third parties can we offer you the needed services. The aforementioned partners, information fields, and other legally required notifications will be displayed on the page at that time.
2. When you log in to third-party websites through your platform account, to enable you to conveniently and quickly use third-party websites, we will provide your registration and login information to third parties with your consent. These third-party websites are bound by their own privacy protection rules, so we recommend that you carefully review their privacy protection rules before providing personal information to third parties.
3. We may collaborate with partners to hold marketing activities and provide them with some necessary information generated during the activity process, such as prize lists and contact information of winners, enabling our partners to timely contact you and distribute prizes. We will obtain your consent in accordance with legal requirements, on the activity rules page or through other means.
4. To protect your and others’ legal rights, if you have disputes, complaints, or are complained against by other users, partners, or third parties, we will provide your name, valid ID number, contact information, and relevant complaint content to consumer rights protection departments and regulatory authorities to resolve complaints promptly, except where prohibited by law.
5. To comply with laws, enforce or apply our terms of use and other agreements, or to prevent fraud and other illegal activities, we may assist industry organizations or other financial-related institutions in exchanging necessary information.
6. According to legal regulations and requirements from authorized authorities, to fulfill legal obligations or to maintain our legal rights with our clients, or under other circumstances with your consent.
7. To provide information to our affiliates and/or other third parties based on other agreements or arrangements reached with you.
8. In the event of mergers, divisions, dissolutions, acquisitions, business/asset transfers, business/asset restructurings, or bankruptcy liquidations, if it involves transferring your personal information to third parties, we will inform you of the name or contact information of the receiving party and require the new holder of your personal information to continue to be bound by this Policy Statement.
9. To achieve the purpose of providing services on this Platform, you agree and authorize us to share your personal information with our affiliates. Before sharing information, we will conduct a commercial reasonableness review, assess the legality, legitimacy, and necessity of sharing your personal information, and urge the affiliates sharing your personal information to store and process your personal information as stipulated in this Policy Statement. Our affiliates will not have the right to use the shared personal information for any purposes outside the scope stipulated in this Policy Statement without your express consent or authorization.
10. Other circumstances that obtain your consent and comply with legal regulations.

(4) *Public Disclosure*
We will not publicly disclose your personal information except with your separate consent or as otherwise provided by laws and regulations.

8. How We Use Your Personal Data for Direct Marketing
We may use some of the collected personal data for sending you information or other promotional information through telephone marketing, electronic formats (such as emails), direct mail, or other appropriate means. However, we will only use your personal data for direct marketing in compliance with the rules related to direct marketing as stipulated in the Privacy Ordinance. We may also invite you to participate in surveys and other similar activities.
If we intend to use your personal data for direct marketing or provide your personal data to third parties for direct marketing, we will inform you at the time of collecting your personal data or beforehand in the “Personal Information Collection List” or through other appropriate means. At that time, you can choose whether to agree to receive direct marketing information.
If you initially choose to agree to receive direct marketing information but later decide that you do not wish to receive further direct marketing information, you can contact the information protection officer and request that we stop sending you any further direct marketing information.

9. How You Can Exercise Your Rights
We highly value your attention to personal information and strive to protect your rights to be informed, decide, and other rights regarding your personal information. During your use of our services, we have provided corresponding operational settings in our product design for you to conveniently exercise those rights. You can refer to the following guidelines for operation.
You can view your personal information through this Platform's app or other means displayed by this Platform; if you need to correct or supplement your personal information, you can also contact customer service using the contact method described in “Part 11: Contact Us” of this Policy Statement to assist you in completing the relevant operations. We do not bear any responsibility if your privacy is infringed due to your failure to notify us of such changes.
According to the provisions of the Personal Data (Privacy) Ordinance, we may require individuals requesting to access or correct information to provide appropriate identification and may charge reasonable administrative fees before approving the request to access the information.
If you wish to take the following actions:
(1) Access, correct, inquire about, or delete the personal information we hold;
(2) Withdraw your consent for us to collect your personal information;
(3) Request us to transfer the information you provided to a third party, where technically feasible;
(4) Have any questions regarding this Policy Statement; or
(5) Make any complaints or suggestions regarding how we handle your personal information.
Please contact us using the contact method described in “Part 11: Contact Us” of this Policy Statement. We will respond within 30 working days upon receiving your request and verifying your identity.
Please note that if you withdraw our authorization to use some or all of your personal information, depending on the nature of your request, we may not be able to continue providing any products or services to you or manage any existing contractual relationships. This may lead to the termination of any agreement you have made with us and your breach of contractual obligations or commitments. We explicitly reserve our legal rights and remedies in such circumstances.

10. How This Policy Statement Is Updated
You can view this Policy Statement at any time on the relevant page of this Platform's app. We encourage you to read our privacy policy each time you use this Platform’s services.
1. When this Policy Statement undergoes significant changes, we will promptly update the Policy Statement and notify you in any of the following ways:
(1) Popup or announcement reminders when you log into this Platform's app or use this Platform's services;
(2) Popup or announcement reminders when you update this Platform's app version;
(3) Sending SMS notifications or emails (if you provide them) when you use this Platform's services;
(4) Announcements on this Platform's official website, etc.
Please read the changed contents of this Policy Statement carefully. If you do not agree with the changed Policy Statement or have objections to the modifications or updates, you can choose to stop using the services or cancel your account. However, please be aware that your actions and activities prior to canceling your account or stopping using this service are still subject to this Policy Statement.

11. Contact Us
We have established a personal information protection working agency and a personal information protection officer. If you have any questions about this Policy Statement or any related complaints or suggestions, you can call the service phone at (852) 2881 1148 or send your inquiries to this Platform (customer service email admin@tungyatsec.com) to contact us or our personal information protection officer.
We will review your inquiries as soon as possible and respond within fifteen days upon verifying your user identity or within the time limit stipulated by laws and regulations.

12. Others
1. *Applicable Law and Dispute Resolution*
This policy statement and all rights, obligations, and responsibilities of the parties shall be governed by and interpreted in accordance with the laws of Hong Kong. The courts of Hong Kong shall have exclusive jurisdiction over any disputes arising from or related to this policy statement (including any disputes regarding the existence, validity, or termination of this policy statement) ("Disputes"). The parties agree that the courts of Hong Kong are the most appropriate and suitable forums for resolving disputes, and therefore, no party shall make any contrary claims. Notwithstanding the above provisions, this platform shall not be prevented from bringing lawsuits regarding disputes in any other court of competent jurisdiction. To the extent permitted by applicable laws, we may initiate legal proceedings simultaneously in any number of jurisdictions.

2. *Protection of Minors*
We value the protection of personal data for minors. If you are not of legal adult age, we will not provide services to you; if we discover that we have collected your personal data, we will actively delete the relevant information.

3. *Definitions*
Unless otherwise specified in the text or stipulated otherwise, the terms used in this policy statement shall carry the same meanings as defined in the "Tung Yat Securities Limited" service agreement.

4. *Priority of Traditional Chinese Version*
In the event of any inconsistencies among different language versions of this agreement, the Traditional Chinese version shall prevail. This policy statement shall become effective on the date the platform is launched or the date you sign this policy statement (whichever is later).

Tung Yat Securities Limited

Attachment 1: Special Policy Statement Applicable Only to Users in Mainland China

For our users in Mainland China and website visitors, in addition to complying with the privacy regulations of Hong Kong, we (including our relevant affiliates) will also process and protect your personal information in accordance with the Personal Information Protection Law of the People's Republic of China ("PIPL") and other applicable laws regarding privacy and data protection in Mainland China (for the purposes of this policy statement, excluding Hong Kong, Macau, and Taiwan), collectively referred to as "Mainland China Data Regulations," as specified in this attachment.

To avoid doubt, the special policy statement described in this attachment applies only to our users in Mainland China and website visitors. This Attachment 1 is a component of the "Privacy Policy and Personal Data Collection Statement," which should be read in conjunction with the general terms of this policy statement and any other terms and conditions applicable to the services we provide, as well as any amendments that may occur from time to time. The provisions in this Attachment 1 do not exclude the lawful application of the main body of this policy statement. In case of any inconsistencies between the contents of this Attachment 1 and this policy statement, the terms that are more favorable to you shall prevail.

1. Legal Basis for Processing Your Personal Information

We process your personal information in accordance with the legal regulations (including Mainland China Data Regulations) as follows:
(1) You have consented to our processing of your personal information (including, in certain circumstances, separate or written consent required by Mainland China Data Regulations);
(2) The processing is necessary for the conclusion or performance of a contract with you;
(3) The processing is necessary for responding to public health emergencies or protecting an individual’s life, health, or property safety;
(4) Within a reasonable scope, processing for public interest news reporting, public opinion supervision, or for the protection of an individual’s life or property safety;
(5) Within a reasonable scope, processing personal information you have publicly disclosed or that has been legally disclosed by others;
(6) Any other circumstances prescribed by laws or administrative regulations.

2. How We Collect Your Personal Information

1. *How We Collect Sensitive Personal Information*
If any sensitive personal information is included in the information we collect, we will obtain your separate consent or meet other legal bases required by Mainland China Data Regulations. For the purposes of this special policy statement, sensitive personal information refers to information that, if disclosed or used illegally, may harm your dignity or endanger your personal or property safety, including biometric data, religious beliefs, specific identities, health, financial accounts, and tracking information. Please note that if you provide personal information that does not belong to you, you must ensure that you have obtained the relevant subject's authorization and consent.

2. *Entrusted Processing*
You acknowledge and agree that in order to provide you with platform services, we will, in accordance with Mainland China Data Regulations, entrust Hangzhou Longbu Technology Co., Ltd. ("Data Processor" or "Hangzhou Longbu") to collect and transmit your personal information as specified in the "Personal Information Collection List" to us, and we will ensure that our Data Processor processes and protects your personal information in accordance with Mainland China Data Regulations. This includes, but is not limited to, defining the obligations and responsibilities of all parties through agreements, supervision, audits, and other measures, and taking necessary measures to ensure that we and our Data Processor meet the personal information protection standards set forth by the relevant laws and regulations of the People's Republic of China.

3. *How We Store Your Personal Information*
You acknowledge and agree that in order to provide you with platform services, we will strictly adhere to the legal procedures stipulated by Mainland China Data Regulations to receive your personal information, and we will keep this information strictly confidential. Unless you provide explicit consent otherwise, our Data Processor will not store your personal information separately.

4. *How We Provide Your Personal Information*
Before providing information to third parties, we will assess the situation in accordance with legal regulations (including Mainland China Data Regulations) and inform you of the recipient's name, contact information, processing purpose, processing method, and types of personal information, and will seek your separate consent as appropriate (unless consent is not required by law). Additionally, we will enter into relevant legal documents with third parties and require them to comply with laws and regulations when using your personal information, processing personal information within the scope of the processing purpose, method, and types of personal information that we have informed you about, and requiring third parties to take management measures and technical means to protect your personal information.

5. *How to Exercise Your Rights Under the Personal Information Protection Law*
The Personal Information Protection Law in Mainland China grants you various rights such as accessing, copying, correcting, transferring, supplementing, and deleting your personal information, as well as withdrawing your consent for personal information processing. During your use of our services, we provide corresponding operational settings in our product design for you to exercise these rights more conveniently. Please note that when exercising these rights, you may need to prove your identity to us.

1. *Accessing, Correcting, and Supplementing Your Personal Information*
You can access your personal information through the "My" - "Homepage" section in the platform App or other means presented by the platform. If you need to correct or supplement your personal information, you can contact customer service through the contact information provided in “Part 11: Contact Us” of this policy statement for assistance. We are not responsible for any infringement of your privacy due to your failure to notify us of such changes.

2. *Deleting Your Personal Information*
Except as otherwise provided by law, we will actively delete your personal information in the following circumstances, and you may also contact customer service through the contact information provided in “Part 11: Contact Us” to request deletion of your personal information:
(1) The processing purpose of your personal information has been achieved, cannot be achieved, or is no longer necessary to achieve the processing purpose;
(2) We have stopped providing services, or the retention period has expired;
(3) You have withdrawn the consent previously given to us;
(4) We have violated laws, administrative regulations, or our agreements regarding the processing of your personal information;
(5) Other circumstances prescribed by laws and administrative regulations that require deletion of personal information.

Please note that if we have other legitimate reasons (reasons other than consent), we still have the right to process your personal information if the legal or administrative regulation-prescribed retention period has not expired, or if the deletion of personal information is technically difficult. We will cease processing your personal information except for storage and necessary safety protection measures.

3. *Changing Your Consent Scope*
(1) Device Permissions: Unless otherwise specified in this policy statement, you can typically change the scope of your consent regarding our continued collection and use of personal information or withdraw your consent by disabling device functions or adjusting "Privacy Settings" on your device.
(2) Notification Permissions: You can choose to enable or disable notification permissions such as messages in the "My - Settings" section of the platform App.
(3) Opting out of Advertisements: If you do not wish to receive advertisements or marketing messages we send to you, you can "unsubscribe" or "opt-out" using the methods provided in the advertisement or marketing message notifications.
(4) Turning off Specific Advertisements: If you do not wish to receive specific advertisements or personalized displays directly related to you in the platform App, you can turn off the related advertisement push options in the "My - Settings" section of the platform App. After you disable this feature, you may still receive promotional and display information, but its relevance to you will be reduced.

Please understand that each business function requires some basic personal information to be fulfilled. When you withdraw your consent, we will not be able to continue providing you with the corresponding services related to the withdrawn personal information, but this does not affect the provision of other services based on your consent that has not been withdrawn. Additionally, your decision to withdraw consent will not affect the personal information processing carried out prior based on your consent.

4. *Account Cancellation*
If you need to cancel your platform account, you can contact customer service through the contact information provided in “Part 11: Contact Us” for assistance with the cancellation process. You can also log into the platform App, go to "Settings - Account Management," find "Account Cancellation," and follow the relevant instructions to cancel your platform account.

After cancellation, we will no longer collect, use, or share personal information related to your account. The personal information within that account will be deleted or anonymized, except as required by laws, regulations, or regulatory authorities.

5. *Copying or Transferring Your Personal Information*
You can contact customer service through the contact information provided in “Part 11: Contact Us” to request copies of your personal information, and we will provide it in a timely manner.

You may also contact customer service through the contact information provided in “Part 11: Contact Us” to request that we transfer your personal information to a third party you designate. We will provide transfer pathways if conditions set by competent authorities are met.

6. *Rights of Relatives of Deceased Users*
Unless otherwise arranged by the deceased user, we ensure that close relatives of the deceased user have the right to access, copy, correct, or delete the relevant personal information of the deceased user for their own legitimate interests, and the specific response methods shall follow the aforementioned rules.

7. *Responding to Your Requests*
If you are unable to access, copy, correct, supplement, transfer, or delete your personal information through the above methods, or if you believe we have violated any laws or agreements regarding the collection or use of your personal information, or if you wish for us to explain our personal information processing rules, you can:
(1) Contact online customer service through the platform App, or
(2) Contact us using the methods provided in this policy statement.

To ensure security, we may require you to provide a written request or otherwise prove your identity. Typically, we will respond to your request within fifteen days of receiving your feedback and verifying your identity, or within the time limit prescribed by laws and regulations. We generally do not charge fees for reasonable requests, but we may charge certain costs for repeated requests that exceed reasonable limits. We reserve the right to refuse requests that are groundless, require excessive technical means, pose risks to the legal rights of others, or are impractical.

Notwithstanding the above provisions, according to relevant laws and regulations, we may not be able to respond to your requests under the following circumstances:
(1) Related to our obligations under laws and regulations;
(2) Related to national security or defense security;
(3) Directly related to public safety, public health, or significant public interest;
(4) Directly related to criminal investigations, prosecutions, trials, or enforcement of judgments;
(5) There is sufficient evidence indicating that you have subjective malice or are abusing your rights;
(6) For the protection of significant legitimate rights and interests of you or other individuals that are difficult to obtain consent for;
(7) Responding to your request will result in serious damage to your or other individuals’ or organizations’ legitimate rights and interests;
(8) Involving trade secrets.