隐私权保护声明

SHENWAN HONGYUAN

Circular to Clientsrelating to the Personal Data (Privacy) Ordinance

This circular is binding on you as a client of the Group. The following information is brought to your attention in accordance with the Personal Data (Privacy) Ordinance (Cap.486 of the Laws of Hong Kong) (the “Ordinance”). Unless the context otherwise requires, words and phrases in this circular shall have the meaning given to them by the Ordinance. For the purposes of this circular, (1) the term “client” includes, where applicable, sureties, guarantors and parties providing security, guarantee or any form of support for obligations owed to the Group, and suppliers, contractors, service providers, agents and other contractual counterparties of the Group; (2) the term “personal data” means all information recorded electronically or by other means, that is related to identified or identifiable natural persons, and (i) in the case of an individual, means personal data relating to the relevantindividual concerned; (ii) in the case of a partnership, means personal data relating to each partner of the partnership; and (iii) in the case of a corporate entity, means personal data relating to any individual director, shareholder, officer or manager which have been provided to the Group; and (3) the term “Group” means all and/or any of Shenwan Hongyuan (H.K.) Limited (“SWHYHK”), SWHYHK’s subsidiaries (including but not limited to Shenwan Hongyuan Securities (H.K.) Limited, Shenwan Hongyuan Futures (H.K.) Limited, Shenwan Hongyuan Asset Management (Asia) Limited, Shenwan Hongyuan Capital (H.K.) Limited, Shenwan Hongyuan Research (H.K.) Limited) and/or holding companies and/or subsidiaries of such holding companies, within and/or outside Hong Kong.

Collection of Personal Data

  1. From time to time, it is necessary for clients to supplythe Group with personal data in connection with
    1. the opening, operation and continuation of accounts; (ii) the application, obtaining and continuation of credit facilities; and (iii) the provision of securities brokerage, nominee, futures trading, investment advisory, corporate finance, asset management, wealth management and other financialservices.
  2. Personal data may also be collected from clients in the ordinary course of continuation of business relationship with the clients.
  3. At the same time, personal data may be collected from clients pursuant to laws, regulations, rules or codes binding on the Group, the Group’s associated or related companies, any directors, officers, employees, authorised representatives or advisers of the Group or its associated or related companies, and any such person as specified in paragraph 7 of this circular below (each, a “User”). The User may or may not reside inHong Kong.
  4. Failure of clients to supply personal data may result in the Group or the User being unable to provide servicesto the clients, to maintain business relationship with the clients and to meet its respective legal or regulatory requirements.
  5. The Group and/or the User will keep the personal data relating to and/or collected from the clients confidential and will comply with all applicable data privacy laws, including, where applicable, the Ordinance. The Group will only keep the personaldata of the client for as long as the Group reasonably needs it for the purposesset out in paragraph 6 of this circular below or on a longer term basis in accordance with applicable laws and regulations and the Group’s policies and procedures, or until receiptof the clients’ request to delete such personal data,subject to limitations on technical feasibility and applicable laws and regulations. The client acknowledges and understands that certain personaldata provided to the Group may constitute sensitive personal data, namely, personalinformation that, once leaked or illegally used, may easily cause harm to the dignity of natural persons,or grave harm to personalor property security, and include for instance, information on biometric characteristics, religious beliefs, specially-designated status,medical health, financialaccounts, individual location tracking, as well as the personal information of minors under the age of 14. TheGroup collects and processes such data, if any, solely for the purposes set out in paragraph 6 of this circular. The Group commits to protect the client’s personal data and has taken steps in this regard. In order to prevent unauthorised people or parties from being able to access the client’s personal data, the Group has put in place a range of technical and organizational measures to safeguard and secure the client’spersonal data in accordance with applicable laws and regulations.

Purposes of Use

6. User may use personaldata relating to and/or collectedfrom clients for the following purposes:-

  1. the daily operation of the services and credit facilities providedto clients;
  2. verifying the identity of the client;
  3. executing or givingeffect to the client’s ordersrelating to transactions or otherwise, and carrying out the client’sother instructions;
  4. conducting credit inquiries or background checkson the client and ascertaining the client’s financial situation and investment objectives;
  5. assisting other financial institutions to conduct credit checks;
  6. ensuring ongoing creditworthiness of clients;
  7. providing personalized financialanalysis and planningor designing financialservices, advice or related productsfor clients’ use;
  8. marketing financial services or relatedproducts;
  9. determining the amount ofindebtedness owed to or by clients;
  10. collection of amount outstanding from clients and those providingsecurity for clients’obligations;
  11. complying with and/or enabling any member, affiliated or related company in the Group to comply with any foreign or local laws, regulations (including Foreign Account Tax Compliance Act, Automatic Exchange of Financial Account Information, Common Reporting Standards and similar regulations), notifications, directives, guidelines or guidance given or issued by or in agreement with any legal, regulatory, governmental, tax, law enforcement or other authorities, exchanges, or self-regulatory or industry bodies or associations of financial services providers, within or outside Hong Kong, existingcurrently and in the future;
  12. complying with obligations, requirements, policies, procedures, measures and arrangements for sharingpersonal data and information within the Group and/or any other use of personaldata in accordance with the Group wide programmes for compliance with sanctions or prevention or detection of money laundering, terrorist financing or other unlawful activities;
  13. meeting the requirements to make disclosure under the requirements of any laws, regulations, rules, codes bindingon the User; and
  14. other purposes ancillary or relating thereto.

7. Personal data held by the Group relating to and/or collected from clients will be kept confidential but the Group may provide and disclose such data to the following persons within or outside Hong Kong to the extent permitted by law:-

  1. any agent, contractor or third party service provider who provides sales, distribution, advisory, administrative, background checking, data processing, financial, telecommunication, computer, payment or clearing, printing, professional or other services to the Group in connection with the operation of its businessor provision of financial servicesor products to the client;
  2. any nominees in whosename securities or other assets may be registered;
  3. any certification authorities within or outside Hong Kong;
  4. any other person under a duty of confidentiality to the Group;
  5. any member or affiliated or related companyin the Group;
  6. any financial institution with which the client has or proposesto have dealings;
  7. any actual or proposed assignee of the Group or participant or sub-participant or transferee of the Group’s rights in respect of the client;
  8. any other person when the Group is compelled to make disclosure to such person under the requirements of any laws or regulations bindingon the Group;
  9. any person with the client’sexpress or implied consent;
  10. any person who provides financialservices or issues,distributes or providesfinancial products to the clientthrough or with the Group;
  11. credit reference agencies,and, in the event of default,to debt collection agencies;
  12. any foreign or local exchanges (or their associated clearing houses or operators) of securities, futures and/or other financial products where the client’s orders to buy or sell such securities, futuresand/or other financialproducts are placedor transacted;
  13. any foreign or local governmental, regulatory, supervisory, tax, law enforcement or other authorities, bodies or institutions;
  14. any person where in the Group’s interest requires disclosure; and
  15. any person where in the public interestrequires disclosure.

8. The Group may from time to time transfer personal data of the client outside Hong Kong to any of the persons referred to in paragraph 7 of this circular above and for any of the purposes referred to in paragraph 6 of this circular above. It should be noted that Users located outside Hong Kong may not have in place data protection laws which are substantially similar to, or serve the same purpose as the Ordinance. This means that data disclosed to such parties may not be protected to the same or similar level as in Hong Kong.

Use of Data in DirectMarketing

9. The Group intends to use personal data collected from clients for direct marketing carried out by the Group. The Group also intends to transfer such personal data to Users for their use in such direct marketing of financial services and products. The intended kinds of personal data to be used and the intended classes of marketing subjects are specified below. However, the Group may not use the personal data collected from the clients unless permitted by the Ordinance or the Group has received the clients’ consent.

10. For the above direct marketing use, the Group intends to:

  1. use the client’s name, contact information and demographic information; and
  2. market or promote the investment products or financial servicesof the Group or the User.

11. The client can always opt-out free-of-charge by contacting the Group’s Data Protection Officer if the client no longer wishes any of the client’s personal data to be used in any of the described direct marketingpurposes.

12. In the course of performing its duties, the Group or the User may, as permittedby law, match, compare, transfer or exchange any personal data provided by the client, or hereafter obtained from the client, for these or any other purposes of the Group or the User, with data held by government bodies, other regulatory authorities, corporations, organisations or individuals in Hong Kong or overseas for thepurpose of verifyingthose data.

13. The Group may receive remuneration and/or other benefits or compensation in return for transferring or making available personal data of the clients to the User. Such remuneration, compensation or benefits may be calculated based in whole or in part on the nature and extent of the services or facilities that the Group may provideto the clients from time to time or the size, nature or frequencyof transactions that the clients may enter into, or such other factors as the Group may agree with such party.

Hong Kong Investor Identification Regime and Over-the-counter Securities Transactions Reporting Regime

14. The client acknowledges and agrees that the Group may collect,store, process, use, disclose and transfer personaldata relating to the client (including your CID and/or BCAN(s) (HK)) as requiredforthe Group to provide services to the client in relation to securities listed or traded on the Stock Exchange of Hong Kong (the “Exchange”) and for complying with the rules and requirements of the Exchange and the Securities and Futures Commission of Hong Kong (“SFC”) in effect from time to time. Without limiting the foregoing, this includes –

  1. disclosing and transferring the client’s personal data (including your CID and BCAN(s) (HK)) to the Exchange and/or the SFC in accordance with the rules and requirements of the Exchange and the SFC in effect from time to time;
  2. allowing the Exchange to: (i) collect, store, process and use the client’s personal data (including your CID and BCAN(s) (HK)) for market surveillance and monitoring purposes and enforcement of the Rules of the Exchange; and (ii) disclose and transfer such information to the relevant regulators and law enforcement agencies in Hong Kong (including, but not limited to, the SFC) so as to facilitate the performance of their statutoryfunctions with respectto the Hong Kong financial markets; and (iii) use such information for conducting analysis for the purposes of market oversight; and
  3. allowing the SFC to: (i) collect, store, process and use the client’s personal data (including your CID and BCAN(s)(HK)) for the performance of its statutory functions including monitoring, surveillance and enforcement functions with respect to the Hong Kong financial markets; and (ii) disclose and transfer such information to relevant regulators and law enforcement agencies in Hong Kong in accordance with applicable laws or regulatoryrequirements.

The client also agrees that despite any subsequent purported withdrawal of consent by the client, the client’s personal data may continue to be stored, processed, used, disclosed or transferred for the above purposesafter such purported withdrawal of consent.

15. The Group is required to obtain the updated CID from the client accordingto the order of priority on the identity documenttype (i.e., waterfallrequirements) as requiredby the SFC as below:

(a) Individual client:

(1) HKID Card; (2) NationalIdentification Document; or (3) Passport

(b) Client that is a corporation

(1) Legal Entity Identifier (“LEI”) registration document;(2) Certificate of Incorporation; (3)

Business Registration Certificate; or (4) other equivalent identity documents

(c) Client that is a trust:

（i）the information of trustee who isa natural person:

(1) HKID Card; (2) NationalIdentification Document; or (3) Passport

（ii）the information of trustee who isa corporation:

(1) LEI registration document; (2) Certificate of Incorporation; (3) Business Registration Certificate; or (4) other equivalent identity documents

However, in the case of a trust which is an investment fund, the CID of the asset management company or the individual fund should be provided.

(d) Clients of a joint account:

The CID for all clients (in line with the above requirements, depending on the nature of t he client) named for a joint account should be providedaccording to the above CID wate rfall.

Please note thatthe SFC strictly requires the provision of identity documenttype according to the above waterfall requirements. The client is also required to follow the above waterfall requirements for the provisionof CID. The client warrants,represents and undertakesthat (1) the client’s personaldata (including CID and BCAN(s) (HK)) providedto the Group are true and accuratein all respects, complete and not misleading; (2) the provision of CID has followed the waterfall requirements; and (3) the clientwill promptly notifythe Group in case of any changein any personal data of the clientincluding CID providedto the Group.

16. Failure to provide the Group with the client’s personal data or updated CID, or withholding or withdrawing consent may mean that the Group will not, or will no longer be able to, as the case may be, carry out the client’s trading instructions or provide the client with securities related services (other than to sell, transferout or withdraw the client’sexisting holdings of securities, if any).

Note:

  1. For the purposes of this part of the circular, the term “BCAN(HK)” means a “Broker-to-Client Assigned Number”, being a unique identification code in the format prescribed by the Exchange, generated by a relevant licensedor registered personin accordance with the Exchange’s requirements;
  2. The term “CID” or “Client Identification Data” shall mean the following information in relation to a client to whom a BCAN(HK) is assigned:
    1. the full name of the client as shown in the client’s identity document;
    2. the issuing countryor jurisdiction of the identitydocument;
    3. the identity document type; and
    4. the identity document number.

China Connect Securities Trading Service

17. The client acknowledges and agreesthat in providing the Group’s China Connect Securities Trading Service to the client,the Group will be requiredto:

  1. Tag each of the client’s orders submitted to the China Stock Connect System (“CSC”) with a Broker-to-Client Assigned Number (“BCAN(PRC)”) that is unique tothe client or the BCAN(PRC) that is assignedto the client’s joint account with the Group, as appropriate; and
  2. Provide to the Exchange the client’s assigned BCAN(PRC) and CID relating to the client as the Exchange may request from time to timeunder the Rules of the Exchange.

Without limitation to any notification the Group has given the client or consent the Group has obtained from the client in respect of the processing of the client’s personal data in connection with the client’s account and the Group’s services to the client, the client acknowledges and agrees that the Group may collect, store, use, disclose and transfer personal data relating to the client as required as part of the Group’s China Connect Securities TradingService, including as follows:

  1. to disclose and transfer the client’s BCAN(PRC) and CID to the Exchange and the relevant Exchange Subsidiaries from time to time, including by indicating the client’s BCAN(PRC) when inputting a China Connect Order into the CSC, which will be further routed to the relevant China Connect Market Operator on a real-timebasis;
  2. to allow each of the Exchange and the relevant Exchange Subsidiaries to: (i) collect, use and store the client’s BCAN(PRC), CID and any consolidated, validated and mapped BCANs(PRC) and CID information provided by the relevant China Connect Clearing House (in the case of storage, by any of them or via Exchange) for market surveillance and monitoring purposes and enforcement of the Rules of the Exchange; (ii) transfer such information to the relevant China Connect Market Operator (directly or through the relevant China Connect Clearing House) from time to time for the purposes set out in (c) and (d) below; and (iii) disclose such information to the relevant regulators and law enforcement agencies in Hong Kong so as to facilitate the performance of their statutoryfunctions with respectto the Hong Kong financial markets;
  3. to allow the relevant China Connect Clearing House to: (i) collect, use and store the client’s BCAN(PRC) and CID to facilitate the consolidationand validation of BCANs(PRC) and CID and the mapping of BCANs(PRC) and CID with its investor identification database, and provide such consolidated, validated and mapped BCANs(PRC) and CID information to the relevantChina Connect Market Operator, the Exchange and the relevant Exchange Subsidiary; (ii) use the client’s BCAN(PRC) and CID for the performance of its regulatory functions of securitiesaccount management; and (iii) disclose such information to the Mainland regulatory authorities and law enforcement agencies having jurisdiction over it so as to facilitate the performance of their regulatory, surveillance and enforcement functions with respect to the Mainland financial markets; and
  4. to allow the relevant China Connect Market Operator to (i) collect, use and store the client’s BCAN(PRC) and CID to facilitate their surveillance and monitoring of securities trading on the relevant China Connect Market through the use of the China Connect Service and enforcement of the rules of the relevant China Connect Market Operator; and (ii) disclose such information to the Mainland regulatory authorities and law enforcement agenciesso as to facilitate the performance of their regulatory, surveillance and enforcement functions with respect to the Mainland financialmarkets.

By instructing the Group in respect of any transaction relating to China Connect Securities, the client acknowledges and agrees that the Group may use the client’s personal data for the purposes of complying with the requirements of the Exchange and its rules as in force from time to time in connection with China Connect Securities trading. The client also acknowledges that despite any subsequent purportedwithdrawal of consent by the client, the client’s personal data may continue to be stored, used, disclosed, transferred and otherwise processed for the above purposes, whether before or after such purportedwithdrawal of consent.

18. Failure to provide the Group with the client’s personal data, or withholding or withdrawing consent may mean that the Group will not or no longer be able, as the case may be, to carry out the client’s tradinginstructions or providethe client with the Group’s China Connect Securities trading service.

19. Unless otherwise stated or the context otherwise requires, capitalised terms used in this part of the circular shall have the same meanings as defined in the Rules of the Exchange.

Rights of Access, Correction and Withdrawal

20. Under and in accordance with the terms of the Ordinance, any individual:-

  1. has the right to check whether the Group holds data about him/her and the right of access to such data;
  2. has the right to requirethe Group to correctany data relating to him/her which is inaccurate;
  3. has the right to ascertain the Group’s policies and practices in relation to data and to be informed of the kind of personal data held by the Group;
  4. has the right to request the Group to cease using the data for direct marketing purposes or transferring the data to other persons for such purposes and to notify any persons to whom the Group has transferred such data to cease any such use.

21. In accordance with the terms of the Ordinance, the Group has the right to charge a reasonable fee for the processing of any data access or correction request.

22. The client further has the right to withdraw the consent to the Group’s processing of the data at any time, PROVIDED always that the client’s withdrawal does not affect the processing of personal data based on the client's consent before the withdrawal and the Group may still be entitled to process the personaldata if the Group has another legitimatereason (other than consent) for doing so.

23. The client acknowledges that if there is any leakage or loss of any personal data of the client, or any other personal data breach event, while the Group will take remedial measures in accordance with applicable laws and regulations, it may notify or may not notify the client in accordance with applicable laws and regulations. The client acknowledges and agrees that should the Group decide to notify the client of such event, the Group may use one or more methods, including without limitation, popping-up window notification on the Group’s website,sending text message/emails or making calls.The clientacknowledges that the Group is deemed as satisfying its notification obligation under applicable laws and regulations upon taking one ofthe above notification actions.

24. The person to whom requests for access to data, correction of data, withdrawal of content or for information regarding policies and practices and kinds of data held are to be addressed is as follows:-

The Group Data Protection Officer

Shenwan Hongyuan (H.K.) Limited

Level 6, Three Pacific Place, 1 Queen’s Road East, Hong Kong

25. Nothing in this circular shall limit the rights of clients under the Ordinance.

26. In case of discrepancies between the English and Chinese versions of this circular,the English version shallapply and prevail.

27. The client acknowledges and agrees that with regard to the Longbridge Technology Service provided to the client by Longbridge Technology, the client hereby accepts all the terms and conditions stated in Longbridge Technology Privacy Policy. The client further acknowledges that the Longbridge Technology Privacy Policy is not directly or indirectly associated with SWHYHK in any form, and SWHYHK bears no responsibility for the accuracy or completeness of the aforementioned services in any aspects. The link to the Longbridge Technology Privacy Policy is as follows: https://swhyhk.support.longbridgewhale.com/topics/misc/lbthk_Service_Privacy_Policy?locale=zh-CN