Effective date of Policy: November 1, 2021
Last updated: June 13, 2024
China Everbright Securities International Company Limited and its subsidiaries and its associated companies (collectively referred to as “Everbright Securities International” or “We”) respect the privacy rights of our clients and focus on the protection of our clients’ personal information. This “Everbright Securities International Personal Information Protection Policy for Mainland PRC Clients” (also known as “PRC Personal Information Protection Policy” or “Policy”) aims at introducing how we collect and process your personal information while you accept the provision of services from us or through other kinds of interactions with us; how we protect your personal information; and how you may exercise the rights to your personal information.

This PRC Personal Information Protection Policy is formulated based on the Personal Information Protection Law of China (“PIPL”). Personal information under this Policy refers to all kinds of information, recorded electronically or in other forms, that relates to identified or identifiable natural persons, excluding anonymized information. Personal information also includes Sensitive Personal Information as defined under PIPL, which refers to personal information that, if leaked or used illegally, may easily violate the dignity of natural persons, or cause serious harm to the safety of individuals and properties, including information relating to biometric identification, religious beliefs, specific identities, healthcare, financial account, individual location tracking, etc., as well as personal information of minors under the age of 14.

If you have any enquiries or concerns on how we process your personal information, please feel free to contact us via the contact information listed at the bottom of this Policy.

This PRC Personal Information Protection Policy will help you understand the followings
1. Types of personal information we collect and the purposes of processing
2. How we handle personal information of minors under the age of 18
3. How we entrust third parties to process your personal information and how we share your personal information with them
4. How we protect your personal information
5. How we store your personal information
6. Your rights as data subject
7. Updating of this Policy
8. How to contact us

1. Types of personal information we collect and the purposes of processing

We may collect the followings types of personal information based on the following purposes, which include but not limited to:

• When you open trading account, wealth management account or obtain insurance services; or when products or services are provided to you, we may collect personal information including your name, contact phone number, date of birth, passport or identification number and identification proof, address and its corresponding proof, email address, marital status, education level, employment status, as well as information to ascertain your financial profile, investment experiences, risk tolerance level, insurance needs, ability to make payments, sharing preference, income (including source of income) and net assets, IP address, and other information as requested by the exchanges and regulatory bodies from time to time; we may also collect your facial image, fingerprint for identification and verification purposes, and verify your identify, perform credit check and conflict check with relevant organizations (including but not limited to e-certificate certification authority). When you designate an authorized person or authorized third party to operate your account, we may collect personal information of such authorized person including his name, address and contact information. Please make sure that such authorized person has authorized you to provide these information to us.
• If you receive our services through our brokers or other business partners, we may collect your above information through them.
• If you are the connected person, beneficial owner, directors or other relevant persons of our corporate or institutional client, when they open a trading account with us, we may collect personal information including your name, job title, contact information, and during independence check, collect your name and passport or identification number. When we conduct due diligence or company search on them, we may collect personal information including your name, job title and compliance status.
• When fulfilling legal and regulatory requirements such as the relevant laws and regulations on anti-money laundering and taxation, we may collect personal information including your name, address, job title and contact information.
• When you participate in activities of our private placement of shares, we may collect personal information including your name, passport or identification number and the corresponding identification proof to verify your identity and nationality.
• When you participate in our events, we may conduct live filming and recording and during such filming and recording, we may collect information including your facial image. Your facial image will only be used for internal record and external promotion, but not for other commercial purposes.
• When you are the major shareholders, beneficial owners, directors, authorized persons or authorized traders of our counterparty or the seller, we may collect information including your name, job title, passport or identification number, your identification proof and contact information.
• When you try to reach us through our wealth managers, customer servicing hotlines or any other means, we may collect information your name, contact information and any other information you provide to us.

Apart from the aforementioned purposes, we will also process your personal information to serve the following purposes:

• the processing of applications for, and daily operation of services provided to Client or to other persons for whom Client acts as guarantor or for whom Client provides third-party security;
• customer relationship management (including but not limited to loyalty programs or privileges and rewards schemes) and to notify you of the relevant offers and redemption of corresponding privileges/benefits;
• conducting, seeking or obtaining credit checks, matching procedures, data verification, due diligence and risk management;
• assisting other financial institutions to conduct credit checks and collect debts;
• ensuring Client’s or any surety’s ongoing creditworthiness
• maintaining Client’s or any surety’s credit history for present and future reference;
• improving, enhancing, designing or launching existing or new financial services or related products for Client’s use (including, where appropriate, providing Client with financial advice)
• if Client has consented (including an indication of no objection) to the use of Client’s personal information for direct marketing purposes by members of the Group and/or entities outside the Group in the Account Application or otherwise, marketing the following goods, products, services and facilities:
• Financial services;
• Related investment products;
• Financial and investment advice;
• Client relationship management services;
• Client credit protection and maintenance services; or
• Any other related goods, products or services that EBSI or a member of the Group may develop, unless Client instructs EBSI otherwise, and seeking or obtaining the same;
• determining the amount of indebtedness owed to or by Client or any surety;
• collecting of amounts outstanding from Client or any surety
• meeting any requests or requirements to make disclosure under the Laws;
• enabling an actual or proposed assignee of Everbright Securities International in connection with merger, amalgamation, reconstruction or otherwise to evaluate the transaction intended to be the subject of the assignment;
• to the extent permitted by Laws, any other purpose disclosed in the website(s) of EBSI or a member of the Group from time to time;
• commencing, defending or otherwise participating in any legal or administrative proceedings or inquiry before any court or competent authority
• satisfying any requirements under the codes on takeovers and mergers and share repurchases issued by the SFC (as amended from time to time) and/or any other applicable Laws and/or Regulatory Rules in relation to takeovers in Hong Kong and/or any part of the world;
• seeking or obtaining administrative, telecommunications, computer, payment, debt collection or securities clearing, custodian, provision of market data, audit, banking, financing, insurance, business consulting, outsourcing, or other services to Everbright Securities International in connection with the operation of its business; and
• Companies with registered offices in Europe ("European Companies") have the right to identify their shareholders across borders. For this reason, we are obliged to disclose shareholder information such as the name and address of shareholders, to EU Companies upon request in accordance with applicable EU directives, regulations and/or the laws of its member countries and/or other implementation measures;
• to the extent permitted by Laws, any other lawful purpose directly or indirectly relating or incidental to any of the above;
• Fulfilling our statutory obligations or resolving conflicts that might have happened between us etc.

We will collect and process your personal information based on the purposes and means of collection stated under this Policy. When we process your personal information for any other purposes which are not listed in this Policy, we will notify you in advance and seek consent from you when required under the applicable data protection laws.

2. How we handle personal information of minors under the age of 18

Please note that we normally do not open trading account, wealth management accounts or provide insurance services to minor under the age of 18, and we do not proactively collect and process personal information of minor under the age of 18. In case of collection of the personal information of a minor under the age of 18 with the consent from the minor’s parent or guardian, we will only process the personal information of a minor within the scope of what the Laws permit and of the express consent of the minor’s parent and guardian or only process the personal information when necessary to protect the minor.

If you are the parent or guardian of a minor under the age of 18, please contact us via the contact information under “How to contact us” when you have concerns on how we handle the personal information of a minor under the age of 18.

3. How we entrust third parties to process your personal information and how we share your personal information with them

In order to enhance the efficiency of information processing, we might entrust third parties (such as our agents, contractors, third party service vendors and debt collection agencies) to process your personal information on behalf of us. When we entrust a third party to process the personal information, we will enter into stringent confidentiality agreement with them and require the third party to process the personal information based on our requirements and this Privacy Policy and the confidentiality and securities measures as required by laws and regulations.

We may share your personal information to third parties under the following scenarios:

• If you have agreed at the time of account application or under other circumstances to share your personal information (such as contact information) with our group members and/or entities outside the Group for direct marketing, that is, to promote the following goods and products, services and facilities to you: financial services, related investment products, financial and investment advice, customer relationship management services, protection of client credit and maintenance services.
• According to your instructions or authorization, we may share necessary information with your guarantor or any person who intends to act as your guarantor, any financial institution with which you are transacting or intending to transact, or other transaction counterparties (such as the cheque drawer).
• When we change control or involve merger, acquisition, reorganization, liquidation and other procedures, if it involves the transfer of personal information, we will request the new company or organization that holds your personal information to continue to process your personal information in accordance with the content disclosed in this Policy. If the new company or organization that holds your personal information needs to use your personal information for purposes not specified in this Privacy Policy, the new company or organization will obtain your consent in accordance with the requirements of applicable laws and regulations.
• Disclosure to be made to relevant law enforcement agencies, regulatory agencies, governments, courts, or other third parties (such as credit information service providers and custodians), and such disclosures are deemed necessary for (1) compliance with a certain applicable law or regulation; (2) exercise, establish or defend our legitimate rights; or (3) protect the important legitimate interest of you or any other person.

Before sharing of any specific data, we will, when required under the applicable data protection law, disclose the name and contact information of the recipient of the data, purposes and means of processing, the types of personal information to be processed, and seek your separate consent (unless otherwise stipulated or exempted under relevant laws and regulations).

4. How we protect your personal information

We will adopt appropriate technical and management methods to protect your personal information that we collect and process. These methods will be applied according to the level of risk associated with your personal information. Please be aware and understand that the Internet is not an absolutely secure environment. If you find that your personal information has been leaked, please contact us immediately through the contact information in the "How to Contact Us" section of this Privacy so that we can take corresponding actions accordingly.

If your personal information is leaked in situations such as accidents and force majeure, we will try our best to control the situation; inform you in a timely manner of the relevant information such as cause of the incident, the safety measures we have taken and the safety measures you can take proactively. In the event of a security incident relating to personal information, we will report to the relevant competent authority, conduct timely troubleshooting and take contingent measures in accordance with the requirements of relevant laws and regulations.

5. How we store your personal information

Storage location: Everbright Securities International is a group of companies located in Hong Kong, China, and provides securities trading, wealth management, insurance and other related services in Hong Kong China. In order to achieve the purposes stated in this Policy which include provision of our products or services to you, better communication and interaction with you in a timely manner, handling of your inquiries and complaints, and meeting our requirements for business management and compliance records of these interactions, we will store your personal information in Hong Kong China. However, the account(s) and/or services/products are held or provided or issued in Hong Kong or other foreign jurisdictions, it may hence be necessary to transfer your personal information from Mainland China to Hong Kong, China and/or Hong Kong, China to other foreign jurisdictions from time to time.

Storage period: Unless otherwise required by laws and regulations, we will store your information in accordance with the following retention periods:

1)	We will store your personal information we collect to meet our legitimate business needs (such as provision of services to you or meeting applicable legal, tax and financial requirements).
2)	When we do not have these legitimate business needs to use your personal information or when the retention period required under applicable laws and regulations in China expires, we will delete your personal information or anonymize it.

6. Your rights as data subject

With regard to your personal information, unless stipulated otherwise by applicable laws and regulations, you are entitled the following rights:

• You have the right to know and make decisions about the processing of your personal information, and you have the right to restrict or refuse our processing of your personal information;
• You have the right to access and copy your personal information;
• If you find that your personal information is inaccurate or incomplete, you have the right to request us to correct or supplement;
• For personal information processing activities based on your consent, you have the right to withdraw your consent. If you withdraw your consent, it will not affect the validity of the personal information processing activities that have been carried out based on your consent before the withdrawal;
• You have the right to request the transfer of personal information to other personal information processors designated by you;
• You have the right to request us to explain the relevant personal information processing rules;
• You have the right to request us to delete your personal information under certain circumstances;
• If you have any objections to our personal information processing activities and this notice, you have the right to resolve them through other channels.

You can contact us anytime through the contact information stated under "How to Contact Us" section below. Under normal circumstances, we will respond to your requests and enquiries within the time frame required by applicable laws and regulations. If you are not satisfied with our response, especially if you have reasonable grounds to believe that our personal information processing behavior has harmed your legitimate rights and interests, you can also seek solutions through other channels.

To the extent permitted under laws and regulations, we may not be able to respond to your requests under the following circumstances:

• If your request is contrary to our fulfillment of the obligations as required under laws and regulations;
• If the requested information is directly related to national security and national defense security;
• If the requested information is directly related to public safety, public health, and major public interests;
• If the requested information is directly related to criminal investigation, prosecution, trial, and execution of judgments;
• If we have sufficient evidence to show that you have malice or are abusing your rights;
• To protect life, property and other important legitimate interests of yourself or other individuals while difficult to obtain your authorization and consent;
• If responding to your request will cause serious harm to the legitimate interests of you or other individuals and organizations;
• If the requested information involves trade secrets.

7. Updating of this Policy

In order to fulfil legal, technical and commercial changes, we will update this Policy from time. When we update this Policy, we will take appropriate measures to notify you based on the significance of these changes. We will also obtain your consent when making any major changes to this Privacy Policy in accordance with the requirements of applicable data protection law.

The last update time of this Policy was stated in "Last updated" in the first part of this Policy.

8. How to contact us

If you have any enquiries or concerns on how we process your personal data or about this Policy, particularly when you consider our processing of your personal information harms your legal rights, please contact us through the contact information stated below. We will review the issues involved as soon as practicable and respond in a timely manner in accordance with the requirements and the time limit of the applicable data protection law.

	Contact Information:
	Customer Service Hotline: +852 2822 5001 (Hong Kong) / +853 6262 5028 (Macau) / +86 40011 95525 (Mainland)
	Fax: +852 3920 2789
	Email: cs@ebshk.com
	Address: 33/F, Everbright Centre, 108 Gloucester Road, Wan Chai, Hong Kong

Note: If there is any conflict or inconsistency between the English and Chinese versions of this Policy, the Chinese version shall prevail.