OULUTION LEGAL

OULUTION PRIVACY POLICY

Oulution Holdings Limited · Business Registration Number 72443593

Registered office: Room D07, 8/F, Kai Tak Fty Building, No. 99 King Fuk Street, Sanpokong, Kowloon, Hong Kong · Contact: info@oulution.ai

Last updated: 1 May 2026 Effective date: 1 May 2026

ON THIS PAGE

1. Introduction

1.1 This Privacy Policy explains how Oulution Holdings Limited (“Oulution”, “we”, “us”, “our”) collects, uses, discloses, transfers, retains, and safeguards personal data when you use the Oulution website (oulution.ai), the Oulution mobile applications, and related services (together, the “Services”).

1.2 Oulution is the data controller (or “data user” under the Hong Kong Personal Data (Privacy) Ordinance (Cap 486) (“PDPO”)) for personal data processed in connection with the Services, except where we act as processor on behalf of an enterprise customer (in which case the enterprise customer is controller and its own privacy notice governs).

1.3 Our registered office is Room D07, 8/F, Kai Tak Fty Building, No. 99 King Fuk Street, Sanpokong, Kowloon, Hong Kong. Our Business Registration Number is 72443593. All privacy-related contact is via info@oulution.ai. Where we appoint a Data Protection Officer, an EU Article 27 representative, or a UK GDPR representative, their details will be published in the Annexes to this Policy.

1.4 This Policy is drafted to satisfy the Hong Kong PDPO as our home regime and, where they apply to you because we offer the Services in your jurisdiction, the EU General Data Protection Regulation (“GDPR”), the UK GDPR and Data Protection Act 2018 (“UK GDPR”), the California Consumer Privacy Act as amended by the CPRA (“CCPA/CPRA”), the Personal Information Protection Law of the People’s Republic of China (“PIPL”), the Brazilian Lei Geral de Proteção de Dados (“LGPD”), and other applicable data-protection laws. Jurisdiction-specific rights are set out in the Annexes.

2. Personal data we collect

We collect the following categories of personal data:

(a) Account data — name, email, password (hashed), country, and, for paid users, billing details processed by our payment processor.

(b) Profile data — role, sector, professional information you choose to add.

(c) Inputs — the prompts, questions, documents, files, and other content you submit (“Inputs”). Inputs may contain personal data (yours or third parties’) and may contain sensitive information; see clause 5.

(d) Outputs — the AI-generated responses produced from your Inputs.

(e) Usage data — pages visited, features used, timestamps, referrer, session identifiers.

(f) Device data — device type, operating system, browser, IP address, unique app installation identifier, crash logs, diagnostic information.

(g) Location data — approximate location derived from IP; precise location only where your mobile-device permissions allow it and where necessary for a Service you have requested.

(h) Communications — support tickets, correspondence, feedback, survey responses.

(i) Cookie and similar-technology data — see the Cookie Policy at oulution.ai/cookies.

We do not intentionally collect special-category personal data (GDPR Art. 9), sensitive personal information (CCPA/CPRA), or sensitive personal information (PIPL Art. 28). If your Inputs contain such data, clause 5 applies.

The following table sets out each purpose, the categories of personal data used, and the legal basis under GDPR / UK GDPR. Equivalent grounds are relied on under PDPO (DPP 1 and DPP 3), PIPL Art. 13, LGPD Art. 7, and CCPA/CPRA business purposes.

Purpose

Categories used

Legal basis (GDPR / UK GDPR)

Provide the Services (account creation, generating Outputs, storing your work)

Account, Profile, Inputs, Outputs, Usage, Device

Performance of contract (Art. 6(1)(b))

Process payments, subscriptions, trials, and pay-per-matter charges

Account, billing

Performance of contract (Art. 6(1)(b)); legal obligation for tax and accounting records (Art. 6(1)(c))

Secure the Services, prevent fraud and abuse

Account, Usage, Device, IP

Legitimate interests (Art. 6(1)(f)); legal obligation (Art. 6(1)(c))

Communicate with you about the Services (transactional messages, service updates)

Account, Communications

Performance of contract (Art. 6(1)(b))

Marketing to prospective and existing users

Account, Profile

Consent (Art. 6(1)(a)); legitimate interests (Art. 6(1)(f)) for existing-customer marketing where permitted

Comply with law, respond to lawful requests, defend legal claims

Any category as required

Legal obligation (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f))

Train, evaluate, and improve our AI models (consumer users only, opt-out available)

Inputs, Outputs, Usage

Legitimate interests (Art. 6(1)(f)); see clause 5

Corporate transactions (M&A, restructuring)

As relevant

Legitimate interests (Art. 6(1)(f))

4. Sources of personal data

We collect personal data from:

(a) you directly when you register, use, or communicate with the Services;

(b) your device and browser through cookies and similar technologies;

(c) third parties — payment processors, authentication providers, and, where applicable, enterprise customers who provision Authorised Users;

(d) public sources — professional profiles you have chosen to make public, only where relevant to the Services.

5. AI model training — how it works and how to opt out

5.1 To operate and improve the Services, we may use Inputs and Outputs to train, evaluate, test, and improve our AI models and the Services. Compounding data value is core to our ability to provide better products over time to all users.

5.2 Consumer default (opt-out). For individual users of the Services, your Inputs and Outputs may be used for training by default. You may opt out at any time via account settings (“Training Opt-Out”). Once you exercise the Training Opt-Out:

(a) we will exclude your future Inputs and Outputs from training datasets;

(b) we will, where technically feasible, exclude your prior Inputs and Outputs from datasets used to train new models after your opt-out; and

(c) we will not delete or retrain models already trained on your prior Inputs before your opt-out — full retraining of a large model on request is not technically possible, and this limitation is recognised by leading data-protection regulators (see EDPB Opinion 28/2024 on AI models).

5.3 Enterprise default (opt-in). Where you use the Services under an enterprise agreement (Enterprise Terms of Service or Master Subscription Agreement), your Inputs and Outputs are not used for training unless your organisation expressly opts in.

5.4 Never used for training — regardless of tier:

(a) content marked or reasonably identifiable as subject to legal professional privilege;

(b) special-category personal data within the meaning of GDPR Art. 9 or CCPA-sensitive / PIPL-sensitive personal information;

(c) the personal data of children;

(d) content you have flagged as confidential and excluded from training.

5.5 Legal basis. Where GDPR, UK GDPR, or an equivalent regime applies, our legal basis for training on personal data is legitimate interests (GDPR Art. 6(1)(f)) in operating and improving an AI legal-information platform. We have conducted and documented a Legitimate Interests Assessment; a summary is available on request via info@oulution.ai. Where consent is required by applicable law (for example, PIPL Art. 13 for certain uses, or where special-category data is inadvertently in scope), we will seek opt-in consent instead.

6. Who we share personal data with

We share personal data only as follows:

(a) Service providers and subprocessors — cloud infrastructure providers, AI model providers (under no-training terms), analytics and error-monitoring providers, payment processors, customer-support tooling, email and communications providers, security-operations providers. A current list is at oulution.ai/subprocessors.

(b) Enterprise administrators — where you use the Services as an Authorised User of an enterprise customer, we share account and usage data with that customer’s administrators as required to operate the enterprise account.

(c) Independent lawyers — where you request an introduction to a qualified lawyer through the platform, we share the information necessary for the introduction. Any engagement is directly between you and the lawyer; Oulution is not a party to it.

(d) Corporate transactions — in the event of a merger, acquisition, financing, or sale of assets, personal data may be transferred to the counterparty subject to equivalent protections.

(e) Legal and regulatory — where required by law, court order, regulator direction, or to protect rights, safety, or property. See clause 12 on government access.

(f) With your consent — for any other purpose disclosed at the time of collection.

We do not “sell” personal data as defined under CCPA/CPRA. We may “share” personal data for cross-context behavioural advertising only where you have not exercised the opt-out via the Global Privacy Control signal or the equivalent website mechanism; details in the California Annex.

7. International transfers

7.1 Oulution is established in Hong Kong. Because the Services are offered globally and processed via cloud infrastructure and subprocessors in multiple countries, personal data will be transferred across borders as a routine part of providing the Services.

7.2 Transfer mechanisms. We rely on the following mechanisms, applied to the relevant flow:

(a) EEA transfers — the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), executed with each subprocessor and with Oulution where the customer is EEA-based, supplemented by the transfer impact assessment and safeguards identified by the EDPB Recommendations 01/2020 following Schrems II (C-311/18).

(b) UK transfers — the UK International Data Transfer Addendum to the EU SCCs (Version B1.0, in force 21 March 2022), or the UK IDTA as a stand-alone instrument.

(c) Swiss transfers — the EU SCCs with the amendments required by the Swiss FDPIC.

(d) PRC transfers — the PIPL Standard Contract for Outbound Cross-Border Transfer of Personal Information (CAC, February 2023). Where a CAC Security Assessment is required based on data volume or nature (Measures for the Security Assessment of Outbound Data Transfers), we cooperate with the relevant data handler / controller.

(e) Other jurisdictions — Brazil (LGPD Art. 33), Singapore (PDPA Section 26), Japan (APPI Art. 28), South Korea (PIPA Art. 28), Australia (APP 8), and other regimes with cross-border-transfer requirements are addressed using standard contractual clauses, consent, or other lawful mechanisms as applicable.

7.3 Hong Kong. Under the PDPO, Section 33 (which regulates cross-border transfers) is not yet in force. Where it comes into force, we will comply with any prescribed conditions and update this Policy accordingly.

7.4 Copy of safeguards. You may request a copy of the safeguards we apply to transfers of your personal data by contacting info@oulution.ai. We may redact commercially sensitive terms.

8. Retention

8.1 We retain personal data only for as long as necessary for the purposes for which it was collected, subject to the following retention periods (which may be extended where required by law or to defend legal claims):

Category

Retention period

Account data

For the duration of your account, plus 12 months after closure for legal, tax, and audit purposes

Inputs and Outputs (consumer)

Until you delete them, or 24 months after your last account activity, whichever is earlier — unless you have opted into extended retention

Inputs and Outputs (enterprise)

As specified in the applicable Order Form or Master Subscription Agreement, defaulting to the duration of the agreement plus 30 days for export

Billing and tax records

7 years after the end of the relevant tax period, as required by the Inland Revenue Ordinance (Cap 112) and equivalent laws

Support communications

3 years after resolution

Marketing preferences and consent records

For as long as we send you marketing, plus 3 years after opt-out for evidencing compliance

Security logs and audit trails

12 to 24 months, depending on system, for security-operations purposes

Data used in AI training

Retained within training datasets subject to the safeguards in clause 5; opt-out flows described in clause 5.2 apply

Data subject to a legal hold

Retained for the duration of the hold

8.2 At the end of the applicable retention period, personal data is deleted or irreversibly anonymised.

9. Security

9.1 We implement technical and organisational measures appropriate to the risk, taking into account the state of the art, the nature of the data, and the purposes of processing. Our security programme is aligned to international standards and is described in more detail in the Data Processing Addendum available at oulution.ai/dpa. Measures include:

(a) Encryption — TLS 1.2 or higher in transit; AES-256 at rest; encrypted backups and encrypted key management via an industry-standard key management service.

(b) Access control — role-based access; least-privilege; multi-factor authentication for all administrative access; unique credentials; quarterly access reviews.

(c) Segregation — logical separation of environments; separation of production and non-production; no use of production personal data in non-production environments except where masked or synthetic.

(d) Logging and monitoring — centralised logging; anomaly detection; alerting on privileged actions; security logs retained per the retention schedule in clause 8.1.

(e) Personnel — background checks where lawful; written confidentiality obligations; onboarding and offboarding procedures with prompt credential revocation; annual security and privacy training.

(f) Secure development — secure software-development lifecycle; code review; static and dynamic application security testing; dependency scanning; secrets management.

(g) Vulnerability and patch management — vulnerability scanning; patching within severity-based SLAs; annual third-party penetration test.

(h) Business continuity and disaster recovery — documented BCP and DRP; regular backup and restore testing; defined recovery-time and recovery-point objectives.

(i) AI-specific safeguards — input filtering for sensitive data; exclusion of flagged content from training datasets; model-output evaluation; prompt-injection defences.

(j) Vendor management — subprocessor risk assessment; contractual data-protection flow-downs; ongoing monitoring.

9.2 Personal data breach notification. In the event of a personal data breach affecting your personal data, we will notify you and, where required, the competent supervisory authority in accordance with GDPR Art. 33 and 34, UK GDPR, PDPO breach-notification guidance (voluntary notification is expected in practice), PIPL Art. 57, and equivalent regimes. Notifications will contain the information required by applicable law.

10. Your rights

10.1 Depending on where you are located and the law that applies, you may have the following rights in respect of your personal data:

(a) Access — to obtain confirmation of processing and a copy of your personal data;

(b) Rectification / correction — to correct inaccurate or incomplete data;

(c) Erasure / deletion — subject to legal exceptions;

(d) Restriction — to limit processing in certain circumstances;

(e) Objection — to processing based on legitimate interests, including the Training Opt-Out under clause 5;

(f) Portability — to receive your personal data in a structured, machine-readable format and to transmit it to another controller;

(g) Withdraw consent — where processing is based on consent, without affecting the lawfulness of prior processing;

(h) Not to be subject to solely automated decisions producing legal or similarly significant effects — we do not make such decisions (see clause 11);

(i) Complain to a supervisory authority (see clause 14).

10.2 To exercise any right, contact us at info@oulution.ai. We may need to verify your identity. We respond within the time limits required by applicable law (typically one month under GDPR, extendable by two months for complex requests; 45 days under CCPA/CPRA, extendable by 45 days; 40 days under PDPO for data access requests).

10.3 Jurisdiction-specific rights (including CCPA/CPRA rights to know, delete, correct, limit use of sensitive personal information, opt out of sale/sharing, and non-discrimination; PIPL rights to consult, copy, correct, and delete; and LGPD rights) are set out in the Annexes.

11. Automated decisions and profiling

We do not make decisions producing legal or similarly significant effects on you based solely on automated processing within the meaning of GDPR Art. 22. Outputs are AI-generated and advisory; they require your review and, where material, review by a qualified lawyer.

12. Government access to data

If we receive a legally binding request from a public authority for disclosure of personal data, we will, unless legally prohibited:

(a) promptly notify the affected user;

(b) inform the requesting authority of our contractual and legal obligations;

(c) use reasonable efforts to challenge requests that are manifestly unlawful, disproportionate, or excessive;

(d) disclose only the minimum data reasonably necessary to comply.

Where notification to the user is prohibited, we will use best efforts to seek a waiver and will publish transparency information at least annually, to the extent lawful.

13. Children

The Services are not directed to children under 18. We do not knowingly collect personal data from children. If you believe a child has provided personal data, contact info@oulution.ai and we will delete it.

14. Complaints, contact, and supervisory authorities

14.1 If you have a concern about how we process your personal data, please contact us first at info@oulution.ai so we can address it.

14.2 You may also complain to a supervisory authority:

(a) Hong Kong — Office of the Privacy Commissioner for Personal Data (PCPD), www.pcpd.org.hk;

(b) European Union — the supervisory authority in your Member State (list at edpb.europa.eu);

(c) United Kingdom — Information Commissioner’s Office (ICO), www.ico.org.uk;

(d) California — California Privacy Protection Agency (CPPA), cppa.ca.gov;

(e) People’s Republic of China — Cyberspace Administration of China (CAC) and provincial-level counterparts;

(f) Brazil — Autoridade Nacional de Proteção de Dados (ANPD), www.gov.br/anpd;

(g) Other jurisdictions — the competent authority in your country of residence.

15. Changes to this Policy

We may update this Policy from time to time. Where changes are material, we will notify you before they take effect (by email, in-app notice, or a prominent notice on the Services). Continued use of the Services after the effective date is acceptance of the updated Policy.

16. Language

This Policy is issued in English. Where we provide a translation, the English version prevails in the event of conflict.

ANNEX A — EEA, UNITED KINGDOM AND SWITZERLAND (GDPR / UK GDPR / SWISS FADP)

Additional information for individuals in the European Economic Area, the United Kingdom and Switzerland.

Controller: Oulution Holdings Limited (Business Registration Number 72443593), Room D07, 8/F, Kai Tak Fty Building, No. 99 King Fuk Street, Sanpokong, Kowloon, Hong Kong. Contact: info@oulution.ai.

EU Article 27 Representative: [To be appointed prior to go-live. Details will be published here and communicated to the competent supervisory authority. Placeholder pending appointment.]

UK GDPR Representative (Article 27 UK GDPR): [To be appointed prior to go-live. Details will be published here. Placeholder pending appointment.]

Data Protection Officer: Oulution has assessed the requirement to appoint a DPO under GDPR Art. 37 and has determined that appointment is [required / not required]. Where a DPO is appointed, contact details will be published here and communicated to the competent supervisory authority.

The legal bases on which Oulution relies under Article 6(1) GDPR and UK GDPR are:

Special-category personal data (Art. 9) is not processed by design. Where such data appears in your Inputs, we rely on Art. 9(2)(e) (data manifestly made public by the data subject) or Art. 9(2)(f) (establishment, exercise or defence of legal claims) only to the extent the condition is genuinely satisfied; otherwise, we exclude the data from processing and from training and ask you not to submit it. See section 5 of the main Policy.

A.3 Your rights under the GDPR and UK GDPR

Under GDPR Articles 15–22 and equivalent UK GDPR provisions, you have the right to:

To exercise any right, contact info@oulution.ai. We will respond within one month (extendable by up to two further months for complex requests, per Art. 12(3)). We will not charge a fee except where requests are manifestly unfounded or excessive.

A.4 International transfers

Personal data of individuals in the EEA, UK and Switzerland is transferred to Hong Kong and, via our Subprocessors, to other jurisdictions. Hong Kong is not the subject of an adequacy decision under Art. 45 GDPR. Transfers are protected by:

A copy of the transfer mechanism applicable to your data, and of our Transfer Impact Assessment summary, is available on request from info@oulution.ai.

A.5 Retention

Retention periods are as set out in section 8 of the main Policy. On request under Art. 17, we will delete personal data unless a lawful ground for continued retention applies (legal obligation, establishment or defence of legal claims, or exercise of freedom of expression and information).

A.6 Supervisory authorities

ANNEX B — CALIFORNIA RESIDENTS (CCPA / CPRA)

B.1 Scope

This Annex applies where you are a California resident and Oulution is a “business” as defined in Cal. Civ. Code § 1798.140(d) (California Consumer Privacy Act as amended by the California Privacy Rights Act, together the “CCPA”). Oulution meets the CCPA thresholds and complies as a business.

B.2 Categories of personal information collected, sources, purposes, disclosures, and retention

In the 12 months preceding the effective date of this Policy, Oulution has collected the following categories of personal information (Cal. Civ. Code § 1798.130(a)(5); § 1798.140(v)):

CCPA category

Examples

Source

Business purpose

Disclosed to

Retention

Identifiers

name, email, IP, account ID

you, your device

provide Services; security; billing

cloud, payment, analytics, model providers (as service providers)

duration of account + statutory retention

Cal. Civ. Code § 1798.80(e) categories

billing information

you, payment processor

billing

payment processor; tax authority

7 years (tax)

Commercial information

subscription plan, transactions

you

provide Services; billing

payment processor

7 years (tax)

Internet/network activity

usage data, cookies

your device

provide Services; analytics; security

analytics, security providers

12–24 months

Geolocation (approximate)

IP-derived location

your device

localisation; fraud prevention

cloud provider

12 months

Professional information

role, employer, sector

you

provide Services; personalisation

none

duration of account

Inferences

usage patterns, preferences

derived

provide Services; personalisation

none

duration of account

User-generated content

Inputs, Outputs, matters

you

provide Services; (for consumers, subject to opt-out) model training

model providers (under no-training terms except where you opt in)

duration of account + limited backup retention

Sensitive personal information (Cal. Civ. Code § 1798.140(ae)). Oulution does not intentionally collect sensitive personal information. If your Inputs contain such data, we do not use or disclose it for purposes other than those permitted by § 1798.121(a) without offering a right to limit.

B.3 Sale and sharing

Oulution does not sell personal information for monetary consideration and does not share personal information for cross-context behavioural advertising as those terms are defined in Cal. Civ. Code § 1798.140(ad) and § 1798.140(ah). We honour Global Privacy Control (GPC) signals as an opt-out preference signal per 11 CCR § 7025.

B.4 Your rights

As a California resident you have the right to:

To exercise a right, submit a verifiable consumer request to info@oulution.ai or via the in-product “Your Privacy Choices” link. We will respond within 45 days (extendable by a further 45 days on notice). We will verify your identity by matching to account credentials or, for non-account requests, by requesting reasonable verification information.

An authorised agent may submit a request on your behalf with proof of authorisation and identity verification (11 CCR § 7063).

B.5 Financial incentives

Oulution does not offer financial incentives or price differences in exchange for personal information within the meaning of § 1798.125(b).

B.6 Notice at collection

This Annex, together with the main Policy, constitutes our Notice at Collection under § 1798.100(a).

ANNEX C — PEOPLE’S REPUBLIC OF CHINA (PIPL)

This Annex applies where you are located in the People’s Republic of China (excluding Hong Kong SAR, Macau SAR, and Taiwan) and the Personal Information Protection Law of the PRC (“PIPL”) applies to Oulution’s processing of your personal information under Art. 3 PIPL.

Personal information handler (个人信息处理者): Oulution Holdings Limited (Business Registration Number 72443593), Room D07, 8/F, Kai Tak Fty Building, No. 99 King Fuk Street, Sanpokong, Kowloon, Hong Kong. Contact: info@oulution.ai.

PRC domestic representative (Art. 53 PIPL): [To be appointed prior to acceptance of PRC-resident users. Name, address, and contact will be published here and filed with the Cyberspace Administration of China. Placeholder pending appointment.]

Oulution processes personal information on the following bases under Art. 13 PIPL:

For automated decision-making, Oulution does not make automated decisions producing significant effects on you within Art. 24 PIPL. Outputs are advisory.

C.3 Sensitive personal information

Sensitive personal information (Art. 28 PIPL) — including biometric data, religious beliefs, specific identities, medical health, financial accounts, whereabouts, and personal information of minors under 14 — is not processed by design. Where such data appears in your Inputs, it is excluded from training and processed only to the minimum extent necessary. Please do not submit sensitive personal information through the Services.

C.4 Cross-border transfer

Provision of your personal information from the PRC to Oulution in Hong Kong is a cross-border transfer under PIPL Chapter III. Oulution relies on one or more of the following mechanisms depending on the volume and nature of transfers:

Before transfer, Oulution has taken necessary measures to ensure that the recipient’s processing meets PIPL standards, including contractual protections and the technical and organisational measures set out in the DPA.

C.5 Your rights

Under Chapter IV PIPL you have the right to:

To exercise a right, contact info@oulution.ai. We will respond within a reasonable period.

C.6 Complaints

You may complain to the Cyberspace Administration of China or another competent PRC authority.

ANNEX D — BRAZIL (LGPD)

This Annex applies where you are located in Brazil and the Lei Geral de Proteção de Dados Pessoais (Law No. 13,709/2018, “LGPD”) applies to Oulution’s processing under Art. 3.

Controller (controlador): Oulution Holdings Limited (Business Registration Number 72443593), Room D07, 8/F, Kai Tak Fty Building, No. 99 King Fuk Street, Sanpokong, Kowloon, Hong Kong. Contact: info@oulution.ai.

Data Protection Officer (Encarregado): [To be appointed prior to acceptance of Brazil-resident users. Contact will be published here.]

Oulution processes personal data on the following bases under Art. 7 LGPD:

Sensitive personal data (Art. 5(II) LGPD) is not processed by design; where relied on, we rely on the conditions in Art. 11 (typically specific and highlighted consent).

D.3 Your rights

Under Art. 18 LGPD you have the right to:

To exercise a right, contact info@oulution.ai.

D.4 International transfer

Transfers to Hong Kong and other jurisdictions rely on the mechanisms in Art. 33 LGPD, including specific consent of the data subject or standard contractual clauses adopted or approved by the Autoridade Nacional de Proteção de Dados (ANPD) as they come into force.

D.5 Complaints

You may complain to the Autoridade Nacional de Proteção de Dados (ANPD) — gov.br/anpd.

ANNEX E — OTHER JURISDICTIONS

Where you are located in a jurisdiction with data-protection law imposing rights or obligations additional to those set out in the main Policy — including without limitation Singapore (PDPA), Japan (APPI), South Korea (PIPA), Australia (Privacy Act 1988), Canada (PIPEDA), South Africa (POPIA), and India (DPDP Act 2023) — Oulution will comply with the applicable requirements, including honouring data-subject rights, using lawful cross-border transfer mechanisms, and appointing local representatives where required. You may exercise rights available under your local law by contacting info@oulution.ai.

Where Hong Kong PDPO applies as your home regime (residents of Hong Kong), Data Protection Principles 1–6 under Schedule 1 PDPO apply directly to our processing, and you have the rights set out in the main Policy including access and correction rights under sections 18 and 22 PDPO. Complaints may be directed to the Office of the Privacy Commissioner for Personal Data, Hong Kong (pcpd.org.hk).