1. Purpose of this Notice

This notice is made in compliance with the PDPO. It is our policy to observe the data protection and privacy provisions of the laws of the Hong Kong in the collection, maintenance and use of Personal Information and the purpose of this notice is to inform you of our data privacy policies. This notice applies to you and includes any borrower, guarantor, third party security provider, depositor, directors, shareholders, officers and managers of any corporate applicants/customers or other similar data subject. Nothing in this notice shall limit your rights under the PDPO.

2. Statement of Our Policy

Our principles on personal data collection and use are：

The above principles shall apply unless otherwise agreed to in writing by you.

Your personal data are confidential and are subject to procedural controls designed to safeguard such personal data. Personal data will only be disclosed where permitted by the provisions in the Customer Agreement or the PDPO or when we are legally compelled to do so by Applicable Laws and Regulations or pursuant to a court order. However, your personal data may be transferred to third parties who provide services to the Group Companies in connection with the operation of their business.

3.Definitions Unless defined herein, capitalized terms in this Appendix I shall have the same meanings as defined in the Customer Agreement.

“Agents” means all agents, associates, affiliates, nominees, dealers, brokers, counterparties, contractors, third party providers, custodians, information service providers, providers of execution facilities and providers of other financial products (including their respective delegates) (whether in Hong Kong or elsewhere) who provides administrative, telecommunication, computer, payment or securities clearing or other services to us in connection with the operation of its business as may from time to time be engaged by us in maintaining the Accounts or providing the Services;

“PDPO” means the Personal Data (Privacy) Ordinance (Cap. 486 of the Laws of Hong Kong); and

“Personal Information” means personal information and data relating to you including, without limitation, your name and address, details of employment, details of properties or other assets, information regarding credit standing, information obtained during the course of business and any other information in the public domain.

4.Purpose of Data Collection

(a)We are authorized to collect, use, transfer (within or outside Hong Kong, in accordance with the PDPO), store, process or otherwise handle personal information and data relating to you including Personal Information from time to time to administer the Accounts and provide the Services under the Customer Agreement.

(b)From time to time, it is necessary for you to supply us with Personal Information in connection with the opening or continuation of Accounts and the establishment or continuation of facilities or the provision of Accounts and Services and/or other financial services.

(c)Failure to supply any Personal Information may result in us being unable to open or continue Accounts or establish or continue facilities or the provision of Accounts and Services and/or other financial services.

(d)It is also the case that Personal Information is collected from you in the ordinary course of the continuation of the relationship; for example, when you provide funding, apply for credit or when we obtain information from credit reference agencies.

5.Use of Data Collected

Personal Information may be used for the following purposes:

(a)the provision and daily operation (including without limitation, maintenance and administration) of the Accounts and Services and credit facilities and/or other financial services provided to you;

(b)conducting credit checks (including without limitation, upon an application for consumer credit and upon periodic review of the credit);

(c)the comparison of your data with any other data, and use of the results for taking actions which may or may not be adverse to your interests;

(d)assisting other financial institutions to conduct credit checks and collect debts;

(e)ensuring your ongoing credit worthiness;

(f)evaluating your potential financial needs, conducting market research, and with your express consent, direct marketing of other financial, insurance or telecommunications services or products, such direct marketing activities may or may not directly relate to your Accounts, the Services and/or other financial services and may be conducted by us, any Group Company or other carefully selected insurance, financial services or telecommunications service providers;

(g)determining the amount of indebtedness owed to or by you;

(h)collection of amounts outstanding from you and those providing security for your obligations;

(i)internal data processing, preparation of internal statistical reports, sales revenue reports and rebates/soft dollar arrangement analysis and any other reports;

(j)commencing, defending or otherwise participating in any legal or administrative proceedings or inquiry before any court or competent authority;

(k)enabling an actual or proposed assignee of us, or participant or sub-participant of our rights in respect of you to evaluate the transaction intended to be the subject of the assignment, participation or sub-participation;

(l)facilitating us in complying with our anti-money laundering obligations;

(m)ensuring ongoing accuracy and relevance of Personal Information;

(n)making disclosures as required by all applicable laws, rules, regulations, codes or guidelines and enabling us to discharge our obligation to regulators or other authorities; and

(o)any other purpose to which you may from time to time agree.

6. Disclosure of and Request for Personal Information

(a)Personal Information relating to you held by us will be kept confidential and are subject to procedural controls designed to safeguard such Personal Information. However, we may provide such Personal Information to the following parties for the purposes set out in paragraph 5:

(i) any Group Company and their respective related and affiliated companies (within or outside Hong Kong, in accordance with the PDPO);

(ii) any agent, contractor or third party service provider who provides administrative, telecommunications, computer, payment or securities clearing or other services to us in connection with the operation of our business;

(iii) any financial institution with which you have or propose to have dealings;

(iv) credit reference agencies (“CRA”), and, in the event of default, to debt collection agencies (“DCA”);

(v) any person or regulatory or other authority to whom we are under an obligation or duty to make disclosure pursuant to any relevant laws, rules, regulations, codes or guidelines binding on us or any Group Company;

(vi) carefully selected insurance, financial services and telecommunications service providers;

(vii) any actual or proposed assignee of us or participant or sub-participant or transferee of our rights in respect of you; and

(viii) any person providing or proposing to provide security for your obligations.

We can disclose Personal Information to any or all of the parties stated above. If the recipient’s place of business is outside Hong Kong or if such information following disclosure will be collected, held, processed or used by such recipient in whole or in part outside Hong Kong, such disclosure will only be made in accordance with the PDPO.

(b)You agree that we can conduct credit enquiries at any time with banks, financial institutions and credit agencies for the purpose of the verification and confirmation of information provided by you.

(c)Under and in accordance with the terms of the PDPO and the Code of Practice on Consumer Credit Data (the “Code”) approved and issued under the PDPO, any individual has the right:

(i)to check whether we hold Personal Information relating to him and access such Personal Information;

(ii)to access the Personal Information of the individual held by us;

(iii)to require us to correct any Personal Information relating to him which is inaccurate;

(iv)to ascertain our policies and practices in relation to data privacy and to be informed of the kind of personal data held by us; and

(v)in relation to consumer credit, (A) be informed, upon request, about which items of data are routinely disclosed to CRA or DCA; (B) be provided with further information to enable the making of an access and correction request to the relevant CRA or DCA; and (C) to instruct us to request the relevant CRA to delete the relevant Personal Information upon the termination of the account by full payment, if there is no payment default in excess of sixty (60) days in the past five (5) years, as long as the instruction is given within five (5) years of the termination of the account.

Requests for access to Personal Information or correction of Personal Information or for particulars regarding policies and practices and the kind of Personal Information held should be addressed to the Data Protection Officer of:

BOCI Securities Limited

20th Floor, Bank of China Tower

1 Garden Road

Central

Hong Kong

Telephone: (852) 3988 6000

Fax: (852) 2147 9059

If you have any questions about your personal or account information, you shall contact the Data Protection Officer. We reserve the right to charge a reasonable fee for the processing of any Personal Information access request

7.Consumer Credit Data

In accordance with the Code, our policies in relation to the sharing and use of your credit data by us through CRA or DCA are as follows.

(a)we may provide your consumer credit data to CRA or, in the event of default, to DCA.

(b)you have the right to:

(i)be informed, upon request, about which items of data are routinely disclosed to CRA or DCA;

(ii)be provided with further information to enable the making of a data access and correction request to the relevant CRA or DCA, as the case maybe; and

(iii) to instruct us to request the relevant CRA to delete the relevant consumer credit data from its database upon the termination of the account by full payment, if there is no payment default in excess of sixty (60) days in the past five (5) years as long as the instruction is given within five (5) years of termination. If an individual has any such payment default, the individual is liable to have his consumer credit data retained by the relevant CRA until five (5) years from the final settlement date of the default amount or five (5) years from the date of discharge of the individual's bankruptcy as notified to us, whichever is earlier.

(c)When considering an application for consumer credit, we may have obtained and considered a credit report on you from a CRA. In the event that you wish to access such credit report, we will advise you of the contact details of the relevant CRA.

(d)In the course of reviewing the existing consumer credit facilities granted to a customer, we may access a credit report from a CRA to determine the following matters:

(i)an increase in the credit amount; or

(ii)the curtailing of credit (including the cancellation of credit or a decrease in the credit amount); or

(iii)the putting in place or the implementation of a scheme of arrangement with the individual.

(e)When engaging a DCA for collection against an individual in default, the following information will be given to the DCA:

(i) particulars to enable identification and location of the individual, including address and contact information;

(ii)the nature of the credit; and

(iii)the amount to be recovered and details of any goods subject to repossession.

8.Matching

We use computer programs to automatically match Personal Information against databases, including but not limited to bankruptcy databases, connected parties databases, CRA databases and government agency databases. In certain circumstances, adverse actions may be taken by us as a result of these matching procedures. You agree that we may, whether in whole or in part, carry out a matching procedure.

We will not take adverse actions against an individual in consequence (whether in whole or in part) of the matching procedure, unless:

(i)we have served notice in writing to the individual specifying the adverse action we propose to take and the reasons therefor, and stating that the individual has seven (7) days after the receipt of the notice to show cause why the adverse action should not be taken; and

(ii)until the expiration of those seven (7) days,

except in circumstances where not taking adverse action would prejudice any investigation into the commission of an offence or the possible commission of an offence.

9.Audit Confirmation

You agree that when we are approached by auditors for the purpose of audit confirmation, we are authorized to provide (or at our discretion, to decline to provide) such information, confirmation or references as requested by the auditors, but without any obligations or liability arising as a result thereof to you nor to any third party including, but not limited to, the auditors.

10.Prevailing Language

In case of discrepancies between the English and Chinese versions, the English version shall apply and prevail.