Circular relating to the Personal Data (Privacy) Ordinance of Hong Kong
CITIC Securities International Global Markets Limited
Application and Interpretation(a)This Annex shall apply to you if: (a) you are a natural person or you provide us with any personal data of a natural person; and(b) your personal data will be collected, processed, stored or otherwise used in Hong Kong, or transferred to or from Hong
Kong, or dealt with in any way that may be regulated by the Personal Data (Privacy) Ordinance of Hong Kong (“PDPO”).

(b)

In this Annex,“Affiliates” means legal entities at any time directly or indirectly controlling, controlled by or under common control with thesubject entity;“Data User” means each of CITIC Securities International Global Markets Limited and/or its Affiliates; and “we”,“us” and “our” mean, unless the context otherwise requires, CITIC Securities International Global Markets
Limited and its Affiliates.

Collection of Personal Data(c)You may or may in the future be requested to supply your personal data or information from time to time to one or more of theData User(s). In the carrying out of transactions contemplated under any service provided to you by a Data User and its Affiliates,
further personal data or information shall or may be collected by the Data User (all such personal data or information is referred
to as “Data” in this Circular).

(d)A request for Data in the Application Form or otherwise shall ask you to provide the Data to a Data User, and any failure to doso may result in the Data User being unable to provide any services to you, or unable to effect transactions under any accountopened by you.

(e)

The Data User who collects your Data may provide your Data to the following classes of persons:
1.
2.
3.

4.
5.
6.
7.
8.

(f)

Your Data may be used for the following purposes from time to time:

8.

operating and opening your account(s), giving effect to your orders relating to transactions or otherwise, and carrying
out your other instructions;providing services in connection with your account(s);conducting credit enquiries or other type of enquiries or checks on you and ascertaining your financial situation andinvestment objectives, and enabling or assisting any other person to do so;
determining the amount of indebtedness owed to or by you, or collecting such indebtedness, or, enforcement of security,charges or other rights and interests in favour of the Data User and/or its Affiliates;
direct marketing and promotion of existing and future services or products (e.g. banking and financial services orproducts) of the Data User and/or its Affiliates (subject to your indication of consent as described in paragraph (j) below);enabling the actual or potential assignee, transferee, participant or sub-participant of the Data User’s rights or businessin respect of you or your account(s) to evaluate the transaction intended to be the subject of the assignment, transfer,participation or sub-participation;observing the Data User’s or its Affiliates’ requirements to make disclosure under any law, regulation or court order, or
under and for the purposes of any guidelines issued by regulatory or other authorities;
conducting matching procedures (as defined in PDPO) as permitted by law; and9.

all other incidental and associated purposes relating to the above.

1.
2.
3.
4.
5.
6.

7.

(g)

the Affiliates of the Data User;
any nominees in whose name your securities or other assets may be registered;any contractors, agents, service providers, banks, fund houses or insurance companies, which provide administrative,
data processing, financial, computer, telecommunication, payment, clearing, settlement, professional or other services
to the Data User or its Affiliates;
any person with whom the Data User enters into or proposes to enter into transactions for your account or in connection
with your account, or persons representing the same;the Data User’s credit reference agencies, and, in the event of default, debt collection agencies;any actual or potential assignee, transferee, participant, sub-participant, delegate, or successor of the rights or businessof the Data User;
any legal, governmental, tax, regulatory or other law enforcement bodies or authorities as required pursuant toparagraph (f)(7) below; andlaw enforcement bodies (including but not limited to Hong Kong Police and Independent Commission Against
Corruption).

In the course of providing Data to these classes of persons, your Data may be transferred outside of Hong Kong. In addition
and without limiting the purposes set out in paragraph (f) above, Data may be transferred outside of Hong Kong for the purpos esof sharing information between Affiliates located in different countries.
Version January 2024-1-

Request for Personal Data(h)You may request a copy of your Data maintained by the Data User and/or the correction of any Data which is inaccurate. Anysuch request, or any question in relation to this Annex or our privacy policy, shall be addressed to the Personal Data Officer at18/F One Pacific Place, 88 Queensway, Hong Kong.

(i)

The Data User may charge a reasonable fee for handling any such request. You may ascertain the Data User’s policies andpractices in relation to the Data and request to be informed of the type of personal data held by the Data User. You may also
request to be informed which items of the Data are routinely disclosed to credit reference agencies or debt collection agenci es,
and be provided with further information to enable the making of an access and correction request to the relevant credit
reference agency or debt collection agency. In relation to Data which has been provided by the Data User to a credit referenc e
agency, you may instruct that Data User upon termination of an account by full repayment of all outstanding liabilities therein
to make a request to the credit reference agency to delete such Data from its database, as long as the instruction is given within
five years of termination and at no time did the account have a default of payment lasting in excess of 60 days within 5 years
immediately before account termination. In the event the account has had a default of payment lasting in excess of 60 days th e
Data may be retained by the credit reference agency until the expiry of five years from the date of final settlement of the amou nt
in default or five years from the date of discharge from a bankruptcy as notified to the Data User, whichever is earlier.

General(j)The Data User will not use your Data for direct marketing purposes unless it has received your consent. By ticking the relevant
box in the Application Form (or any other privacy documents of the Data User), you are deemed to have given the Data User
your consent for the uses and purposes described below. That Data User shall cease using your Data in direct marketing if sorequested by you at any time without any charge. Any such request can be sent to our Personal Data Officer at the addressstated in paragraph (h).It is intended that your Data will be used by the Data User and/or its Affiliates for direct marketing andpromotion of existing and future banking, trading, financial and related services or products.

(k)Nothing in this Circular shall limit your rights under the PDPO.

(l)This Circular shall become an integral part of all contracts, agreements and other binding arrangements which you enter intowith the Data User.

Version January 2024-2-