IMPORTANT: Stan Group (Holdings) Limited and its group and affiliated companies, which own, manage and operate a variety of businesses including property development, hospitality, food and beverage, communication services, and financial services are committed to protecting and respecting the privacy of our customers.

This Privacy Policy (as defined below) sets out the policies and practices of which any information including Personal Data (as defined below) collected, processed, used and retained by us for the purposes of our operation of businesses, provision of our services to our customers and offering other services or products of Stan Group that may be of interest to our customers.

You should read the following carefully to understand our views and practices regarding Personal Data and how we will treat and protect it in accordance with the provisions of the Personal Data (Privacy) Ordinance (Cap.486) (the “Ordinance”) and in respect of Personal Data collected from individuals in the European Union ("EU"), to whom we offer our goods or services, the General Data Protection Regulation (GDPR) (EU) 2016/679 ("GDPR") together ("Data Protection Legislation").

For the purposes of the GDPR, entities within the Stan Group are controllers of relevant Personal Data.

In this Privacy Policy ("Privacy Policy"):

• “Communication Services” refers to comprehensive marketing consultancy services provided by Stan Group to customers.

• “Facilities” refers to hotels, food and beverage outlets, and any other properties and services owned, managed, and/or operated by Stan Group including these facilities.

• “Financial Services” refers to financial services provided by Stan Group to customers.

• “Personal Data” refers to any information (a) which relates to an identifiable individual; (b) from which it is practicable for the identity of the individual to be directly or indirectly (together with other information) ascertained; and (c) in forms which access or processing of the data is practicable.

• “Properties” refers to any industrial, commercial, residential properties developed, owned, managed and leased out by Stan Group.

• “Stan Group” means Stan Group (Holdings) Limited and its group companies (also referred to as "we", "our" and "us");

• “Stan Group Website”, “our website” refers to www.stangroup.com.hk and any other domains as may be adopted by Stan Group to provide services such as Communication Services, Facilities and Financial Services from time to time; and

• “Supplier” refers to any individual, business entity or professional body for which Stan Group has no direct ownership in, which provides relevant products and services, with or without fees, to support the operation, legal, marketing, communication and other essential business functions of Stan Group.

We may also sometimes collectively refer to handling, collecting, protecting and storing your Personal Data as "processing" such Personal Data.

In this Privacy Policy:

a) words denoting one gender shall include the other gender and the neuter and vice versa, and words denoting the singular number shall include the plural number and vice versa; and

b) the headings used herein are inserted for convenience of reference only and shall not affect its interpretation.

All non-English versions of this Privacy Policy are translations of the original version in English for information purpose only. In the event of any discrepancy, the English version shall prevail.

Please update your own Personal Data held by us from time to time so that it remains accurate.

Contents

1 What Personal Data we collect and how we collect it

2 Cookies

3 Retention of Personal Data

4 Storing and transferring your Personal Data

5 Purposes for collection and use of Personal Data

6 Security of Personal Data

7 Consent (excluding individuals located in the EU)

8 Legal basis for processing your Personal Data (individuals located in the EU only)

9 Your Rights

10 Changes to Privacy Policy

11 Contact and complaints

1 What Personal Data we collect and how we collect it

1.1 We will request you to provide, or we will otherwise collect various types of your Personal Data including (without limitation) personal identification information (i.e. names), gender and date of birth; contact information (such as telephone numbers, mailing addresses, email addresses and fax numbers; business information such as company name, business title and associated contact information; interests, personal reference or comments. Such information will be collected through the following categories in particular:

(a) Leasing details: When you lease any of our Properties, you will need to provide your name, date of birth, address, telephone number, passport number, identity card number, your credit or debit card information and billing information, including name of cardholder, card number, billing address and expiry date and any other Personal Data voluntarily provided when you make a reservation;

(b) Reservation details: When you make a reservation with any of our Facilities, you will need to provide your Personal Data by filling out our reservation paper forms, completing an online reservation, or when you make a reservation by calling one of our Facilities, including your name, address, email address, telephone number, method of payment, credit card details, date and time of arrival and special requests and any other Personal Data voluntarily provided by you when you make a reservation;

(c) Check in information: When you check into one of our Facilities, we need to collect your Personal Data, for the purpose of verifying your identity, including but not limited to your identity card number and contact numbers;

(d) Information relating to your use of Facilities and stay in our Properties: During your use of any Facility or stay in our Properties, for the purpose of complying with our financial reporting requirements and providing more comfortable services to you in the future, we collect certain categories of your Personal Data including but not limited to your food and beverage preferences, special requests, and your spending record during your stay;

(e) Account holder information: When you set up an account with us we need to collect certain categories of your personal information to administer your account, including but not limited to your name, email address, your registration status with other service brands owned or managed by Stan Group, loyalty programme registration number, correspondence address, food and beverage preferences and service requests;

(f) Information about your visit to the Stan Group Website: For Stan Group's research purposes, we collect certain categories of Personal Data when you use the Stan Group Website including your IP address, the full Uniform Resource Locators (URL), clickstream to, through and from our site (including date and time), length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs) and methods used to browse away from the page (including browser type);

(g) Survey and research information: Collected from you by online or offline channels for market research;

(h) Information we collect from your interaction with social media platforms: If you interact with Stan Group on social media platforms (for example if you "Like" Stan Group's Facebook page), depending on your settings or the privacy policies for social media and messaging services such as Facebook, LinkedIn and Instagram, we may collect your Personal Data from your social media accounts; and

(i) Information we collect from other sources: We also collect Personal Data from other sources, third party data providers, and/or public sources, such as social networks, company websites, and other online sources. However, no sensitive data or special category data from the aforesaid third-party sources which would include personal information about your health, race, ethnic origin or political beliefs will be collected from the aforesaid sources.

(j) Payment information: When you complete a booking with us we need to collect, process and store certain information relating to the payment including the last four digits of your credit card number and in certain limited scenarios your full credit card number. This information will be used exclusively to process your payment and to enable us to comply with our legal obligations in respect of accounting.

1.2 Supply of Personal Data to us is non-obligatory but certain Personal Data is required to be provided by local laws and failure to do so may result in us being unable to process your reservation, check in, account holding and provision of relevant services to you.

2 Cookies

2.1 Cookies are text files containing small amount of information which are downloaded to your device when you visit a website or use an online application.

2.2 Cookies are used on all online tools available to you including, without limitation, the Stan Group Website to distinguish you from other online users, to analyse how viewers navigate the Stan Group Website with a view to optimize its design, to establish and maintain your information across multiple pages within or across one or more sessions of the Stan Group Website.

2.3 The cookies we set do lots of different jobs, like help us to improve the Stan Group Website and deliver a better and more personalised service, remember your preferences, and generally improve the user experience. You can find more information about cookies at http://www.allaboutcookies.org.

2.4 You should understand that while cookies in general do not tell us your email address or other Personal Data, however, if you voluntarily provide such information or Personal Data to us by, for example, registering an account with us or subscribing for any of our services, such information may be linked to the data in the cookie.

2.5 In addition to the information we collect through cookies, we also collect behavioural Personal Data and store such Personal Data for analytical purposes so as to conduct marketing research and improve the quality of the Stan Group Website. Such Personal Data includes information about your visit such as your server address, the date and time of your visit, the page you accessed, the information you downloaded and the type of internet browser you used.

2.6 The use of any information we collected either through the use of cookies or otherwise shall be subject to this Privacy Policy.

2.7 Most web browsers are initially set up to accept cookies. You may choose to edit your browser options to block cookies. If you block cookies, certain features on the Stan Group Website may not work properly.

2.8 Please take note that cookies from third parties unaffiliated with Stan Group or our business partners may be set before, during or after browsing our website. We do not and cannot control those cookies set by third parties and you should check with those third-party websites for more information about their cookies.

3 Retention of Personal Data

Personal Data provided by you will be retained for such a period as may be necessary for carrying out the purposes stated in this Privacy Policy or as required to comply with any legal obligations to which we are subject.

4 Storing and transferring your Personal Data

4.1 Personal Data collected by us in order to carry out the purposes or directly related purposes stated in this Privacy Policy will be stored on our databases. The databases owned and managed by Stan Group or Suppliers store Personal Data including customers' names, address, email address, and/or phone numbers.

4.2 The databases managed by us may also include guests’ passport or identity card numbers if such is required by applicable laws or you voluntarily choose to save such information in your account with us for facilitating your future bookings.

4.3 We may also store other information such as your special requests, food and beverage preferences and transaction history in our databases and this information may be shared and/or used by Stan Group and/or affiliated business units for the purposes of marketing and/or analysis to enhance customers’ experience.

4.4 As we have a variety of business partners located in various countries, the nature of our business (providing you with quality services and facilities owned, managed and/or operated by us or our affiliated businesses)requires us to transfer Personal Data to Suppliers, operation units or service providers that may be located outside of your own country for the purposes mentioned in this Privacy Policy. We shall take all steps reasonably necessary to ensure that your Personal Data is treated securely and in accordance with this Privacy Policy and Data Protection Legislation (as appropriate). Where such a transfer is performed, it will be done in compliance with the requirements of the Ordinance and to the extent applicable the GDPR.

4.5 We may also share your personal information with:

(a) any member of our group, which means our subsidiaries and affiliated companies;

(b) third parties, including data processors, who help us operate and provide our products and services to our customers, such as third party providers that provide payment processing services, customer relationship management software or third parties to help Stan Group administer and improve the quality of Stan Group’s Website or mobile applications and to analyse usage of the same etc. These providers have access to your personal information only for the purpose of performing their services and in compliance with applicable laws and regulations;

(c) companies outside our group for marketing purposes, when you have provided the consent required in accordance with Data Protection Legislation;

(d) law enforcement agencies, other governmental agencies or third parties if we are required by law to do so, or in other limited circumstances (for example if required by a court order or regulatory authority, or if we believe that such action is necessary to prevent fraud or cyber-crime or to protect Stan Group Website, our technology assets or the rights, property or personal safety of any person);

(e) other business entities should we plan to merge with or be acquired by that business entity, or if we undergo a re-organisation with that entity; and

(f) any successor in interest, in the event of a liquidation or administration of a company within the Stan Group.

4.6 Stan Group takes reasonable steps and exercise due diligence to ensure that Personal Data, after being transferred to recipients located in other countries, will not be stored, processed, or used in any manner which would be a contravention of applicable Data Protection Legislation.

5 Purposes for collection and use of Personal Data

5.1 Our primary purpose in collecting user information is to provide you with a safe, smooth, efficient, and customised experience and to provide the goods which you have requested. We may also use the information that you have provided to ensure that the content on our website is presented in the most effective manner for you.

5.2 We use your Personal Data for the following specific purposes, which include:

(a) to process and administer your reservation application;

(b) to fulfil and process requests submitted by you for any services, products, facilities offered by us;

(c) to provide and maintain the Stan Group Website or any of our other services to you;

(d) to improve the Stan Group Website and your account with us, including, without limitation, to address your queries and notify you of any proposed or actual changes to the Stan Group Website;

(e) to compile and produce anonymous statistics about users of the Stan Group Website, and provide related usage information to relevant third parties, which will not in any event enable any third party to identify individuals;

(f) to provide and/or market the goods and/or services provided by us and/or our affiliated business partners (e.g. sending you updates on our latest offers and promotions in relation to our services from time to time);

(g) to manage the relationship between you and Stan Group (including for communication with you by email, mail, fax, phone or other means regarding your enquiries);

(h) to facilitate and process the payment of services and products offered to you by us. For this purpose, you hereby authorize us to furnish, transfer and disclose any necessary data, including but not limited to, verification of credit card details to any party to collect overdue payment and/or to conduct matching procedures against databases of known fraudulent transactions (maintained by Stan Group, any of Stan Group’s subsidiaries, associated companies and/or business partners or third parties);

(i) to facilitate our business operations across our group of companies including the fulfilment of any legal requirements;

(j) to evaluate, develop, offer and promote goods and/or services provided by us and/or our affiliated business partners; and

(k) for promoting and soliciting donations or contributions for charitable or non-profit making causes.

5.3 We will not use your Personal Data to conduct direct marketing via email, push message, mail, telephone, fax and/or other form of communication, or to provide you with information about goods and/or services which are part of services offered to you by Stan Group unless you have agreed to receiving marketing materials in such a manner when providing your Personal Data to us.

5.4 The intended categories of Personal Data to be used are all kinds of your Personal Data which will necessarily enable us to establish contact with you; and to market or promote a variety of our services, facilities and related goods and/or services offered by us and/or affiliated businesses. However, we shall not process your Personal Data otherwise than in accordance with Data Protection Legislation.

5.5 Your consent to the use of your Personal Data for the specific direct marketing use as indicated in paragraph 5.3above can be given in the following ways:

(a) By clicking “Okay, I agree” with our updated Privacy Policy, it indicates your consent when providing us with your Personal Data through the Stan Group Website, or forms; or your consent to our customer representative when providing us with your Personal Data through telephone; or your consent when checking in or staying at any of our Facilities.

(b) you may opt-out from receiving marketing communications at any time, free of charge, by the following ways: following the “opt-out” instructions contained in the marketing communications indicating your withdrawal; or writing to us at the address listed below under section 11 – “Contact and complaints”.

6 Security of Personal Data

6.1 If you have registered a member account with us, you hold the sole responsibility of safeguarding your own login and password information for such account and such information should not be disclosed to any third parties. We shall not ask you for your password under any circumstances. The risks of leakage of your Personal Data resulting from your loss of the login and password information lie solely with you.

6.2 You acknowledge and understand that the transmission of information via the Internet is not completely secure. Although we have taken practical steps (including implementing appropriate technical and organisational measures) to safeguard your Personal Data, to prevent unauthorized access, and have implemented high standard security measures to protect any information received, we do not guarantee the security of your Personal Data transmitted via Internet, and you acknowledge and accept that any transmission is at your own risk.

6.3 You may also want to be cautious about providing any information or Personal Data through WiFi or any other wireless Internet connection. You should understand and accept that the risks associated with such connection methods are out of Stan Group’s responsibility and no security system or system of transmitting information over the Internet is guaranteed to be secure.

6.4 We take your online security seriously and have implemented appropriate technical and organisational measures including adopting accepted industry standards of technology and operational security to protect your personal information from loss, misuse, alteration or destruction. Once we have received your information, we will ensure that the collection and use of your information is in accordance with the Data Protection Legislation. All Personal Data stored in our databases are encrypted and treated as confidential information and is protected.

7 Consent (excluding individuals located in the EU)

By using services provided by us and/or the Stan Group Website or by providing any Personal Data to us via registering an account with us, you consent to the collection and/or use of your Personal Data as stated in this Privacy Policy and as set out elsewhere in any legal notices. You should not provide us with any Personal Data if you do not consent to such collection and/or use.

8 Legal basis for processing your Personal Data (individuals located in the EU only)

8.1 The GDPR permits us to process your Personal Data because such processing is necessary for:

(a) the performance of contracts to which you will be a party to and in order to take steps at your request prior to you entering into those contracts;

(b) for the purposes of legitimate interests pursued by us; and/or

(c) in order to comply with a legal obligation to which we are subject.

8.2 Where our processing is based on the legitimate interest grounds described above, those legitimate interests are: (a) collecting personal information to provide you with a smooth and efficient customer experience; (b) for the running our business; (c) to provide the services you have requested; (d) to prevent fraud; (e) for the purposes described above in this Privacy Policy; and (f) for our own marketing, research and product development.

9 Your Rights

9.1 You may request to access and to correct your Personal Data held by us. If you wish to obtain a copy of any such Personal Data, if you believe that such Personal Data is incorrect, or if you believe that such Personal Data was used beyond the scope of the purposes or directly related purposes as stated in this Privacy Policy or was acquired by fraudulent or unlawful means, please write to us at the address listed below under section 11 – “Contact and complaints”.

9.2 In order to process your request efficiently, we ask that a request for access or correction to, or deletion of Personal Data, or to obtain a copy of the Privacy Policy must be in writing and send to us at the address listed below under section 11 – “Contact and Complaints”.

9.3 We may require sufficient identification information from you before we will process your request under 9.1 so as to ensure that your Personal Data is only disclosed to you.

9.4 We will process such request in accordance with Data Protection Legislation including responding within statutory time limits and where permitted to do so by Data Protection Legislation, we may charge a reasonable fee for complying with a request.

9.5 If at any time you wish to withdraw your consent for us to process your personal data, in the manner described above, as far as consent is the applicable basis for processing your personal data or do not wish to remain a subscriber to our mailing list, you are able to unsubscribe from our mailing list by clicking on the "Unsubscribe" link on the email from us, or contact us either by emailing SGDPC@stangroup.com.hk with the subject "Unsubscribe", or mail to "Privacy Data Officer – Stan Group (Holdings) Limited, 1163 Canton Road, Kowloon, Hong Kong". We will process your request within 10 business days or such other period prescribed by the Data Protection Legislation.

9.6 All Personal Data is handled in accordance with the applicable Data Protection Legislation. Should any provision of this Privacy Policy be found by any court or administrative body of competent jurisdiction to be invalid or unenforceable, the invalidity or unenforceability of such provision shall not affect the other provisions of this Privacy Policy. All provisions not affected by such invalidity or unenforceability shall remain in full force and effect.

9.7 If you are an individual located in the EU, you have the following additional rights: (i) to ask us to delete your information, if you consider that we do not have the right to hold it; (ii) to restrict processing of your information where appropriate; (iii) to limit data portability (moving some of your information elsewhere within an IT environment) in certain circumstances; (iv) object to your information being processed in certain circumstances; (v) to not to be subject to a decision based on automated processing and to have safeguards put in place if you are being profiled based on your information.

9.8 If you wish to exercise any of your rights in relation to your Personal Data please send an email to us at SGDPC@stangroup.com.hk marked with the subject "Data Subjects Rights". We will process such a request in accordance with the Data Protection Legislation.

10 Changes to Privacy Policy

10.1 Any changes we make to our Privacy Policy in the future will be posted on this page and if appropriate will be notified to you.

10.2 Any revised version of this Privacy Policy shall be effective as at the date of publication on the Stan Group Website.

11 Contact and complaints

11.1 You may visit us at www.stangroup.com.hk or contact us in writing attention to: “Privacy Data Officer – Stan Group (Holdings) Limited, 1163 Canton Road, Kowloon], Hong Kong” if you have any concerns, complaints or requests about this Privacy Policy or how we have been using your Personal Data.

11.2 If you are located in the EU and you have any concerns about our use of your information, you also have the right to make a complaint to the data protection regulator in your country. It would be useful if you raise your concerns with the Stan Group, in the first instance, in order to provide Stan Group the opportunity to address your concerns.