Privacy Policy and Personal Information Collection Statement

1. Purpose of Collection

The personal information collected is used and held by Cregis (referred to as Company”, “our”, “we”, or “us” in this part entitled “Privacy”) may be used for the following purposes: (a) to process your service request, payment instructions and the payment made by a third party payor; (b) to process the related services (c) to communicate with you; and (d) to meet disclosure requirements imposed by relevant law or regulatory authorities.

1. Classes of Transferees

We may disclose all or part of your personal information to third parties (within or outside your location) for the purposes outlined above, including without limitation the following third parties: (a) third party service providers (including without limitation insurers, banks, lawyers, auditors/accountants, and other third party service providers or payment agencies who provide administrative, computer, payment, or other services to us to enable us to operate our business); (b) professional advisors; (c) regulators and government agencies; (d) law enforcement agencies; (e) the tribunals/Courts.We may transfer your personal information in connection with a transaction with another company that affects the control, governance, structure and/or management of all or a substantial part of our business, or if required to satisfy applicable legal or regulatory requirements. However, we will not disclose your Personal Information to any other third parties for direct marketing purposes without your consent.

1. Consequence of failing to provide Personal Information

Unless otherwise specified by us, it is mandatory for you to provide the Personal Information requested by us. In the event that any such Personal Information is not provided, we may be unable to provide you with the services or carry out the purposes outlined at Section 1 above.

1. Access and Correction Rights

Under the Personal Data (Privacy) Ordinance (the “Ordinance”) of Hong Kong, you have the right to request access to and correction of any Personal Information that you provided to us. You may make such a request by writing to our Chief Information Security Officer at [email protected]. In accordance with the Ordinance, we have the right to charge a reasonable fee for the processing of any Personal Information access request.

1. Deletion and Erasure Rights

You may request the deletion or erasure of your Personal Information held by us where such information is no longer necessary for the purposes for which it was collected, or where you withdraw your consent and there is no overriding legal basis for retention. We will assess your request in accordance with the Personal Data (Privacy) Ordinance (the “Ordinance”) and applicable laws. We may decline or limit deletion where retention is required or permitted by law, regulation, regulatory requirement, or for the establishment, exercise or defence of legal claims. You may make such a request by writing to our Chief Information Security Officer at [email protected].