Company: FEBO
Filing Date: 2025-05-14
Form Type: 20-F
Source: 0001641172-25-010075
Chunk: 15

Company: Fenbo Holdings Ltd
Filing Date: 2025-05-14
Form: 20-F
Item: Item 3
Chunk 15
---
, processing, erasure, loss or use. Once collected, such personal data should
not be kept longer than necessary for the fulfilment of the purpose for which it is or is to be used and shall be erased if it is no longer
required, unless erasure is prohibited by law or is not in the public interest.

The PDPO also confers on the Privacy
Commissioner for Personal Data (“ Privacy Commissioner”) power to conduct investigations and institute prosecutions. The data
protection principles (collectively, the “ DPP”), which are contained in Schedule 1 to the PDPO, outline how data users should
collect, handle and use personal data, complemented by other provisions imposing further compliance requirements. The collective objective
of DPPs is to ensure that personal data is collected on a fully informed basis and in a fair manner, with due consideration towards minimizing
the amount of personal data collected. Once collected, the personal data should be processed in a secure manner and should only be kept
for as long as necessary for the fulfillment of the purposes of using the data. Use of the data should be limited to or related to the
original collection purpose. Data subjects are given certain rights, inter alia: (a) the right to be informed by a data user whether the
data user holds personal data of which the individual is the data subject; (b) if the data user holds such data, to be supplied with a
copy of such data; and (c) the right to request correction of any data they consider to be inaccurate. The Commissioner may carry out
criminal investigations and institute prosecution for certain offenses. Depending on the severity of the cases, the Privacy Commissioner
will decide whether to prosecute or refer cases involving suspected commission to the Department of Justice of Hong Kong. Victims may
also seek compensation by civil action from data users for damage caused by a contravention of the PDPO. The Commissioner may provide
legal assistance to the aggrieved data subjects if the Commissioner deems it fit to do so.

  12  

If our Operating Subsidiaries
conducting business operations in Hong Kong have violated certain provisions of the PDPO, we could face significant civil penalties and/or
criminal prosecution. Based on advice of counsel, we believe we have established the necessary protocols and data collection standards
to ensure compliance with the PDPO.

Moreover, the increase in attention
to and regulation of data protection, data privacy and cybersecurity across the globe in recent years will require us to further devote
resources