Company: GLXG
Filing Date: 2025-10-24
Form Type: 20-F
Source: 0001213900-25-102144
Chunk: 123

Company: Galaxy Payroll Group Ltd
Filing Date: 2025-10-24
Form: 20-F
Item: Item 4
Chunk 123
---
 notification to the Office for Personal
Data Protection of Macau (“ GPDP”), which must be made in writing and within 8 days.

However, if the processing
of personal data is made in the context of a labor agreement or a services agreement (e. g. if the employer transfers personal data of
the employee to the bank for payroll purposes), then there is no need to notify the GPDP.

The GPDP is the public authority
established to exercise the legal competences to supervise and coordinate the public implementation of and compliance with the PDPA.

The transfer of personal
data to a destination outside Macau may only take place subject to compliance with the PDPA and provided the legal system in the destination
to which they are transferred ensures an adequate level of protection.

GPDP must ascertain whether
the destination jurisdiction ensures the referred adequate level of protection. In this context, authorization or, at least, notification
shall be sought before such transfer is made.

LAWS AND REGULATIONS RELATING TO OUR BUSINESS
IN TAIWAN

Personal Data Protection
Act

Article 6 of the Personal
Data Protection Act (“ PDPA”) prescribes: “ Data pertaining to a natural person’s medical records, healthcare, genetics,
sex life, physical examination and criminal records shall not be collected, processed or used unless on any of the following bases: 1.
where it is expressly required by law; 2. where it is within the necessary scope for a government agency to perform its statutory duties
or for a non-government agency to fulfill its statutory obligation, provided that proper security and maintenance measures are adopted
prior or subsequent to such collection, processing or use of personal data; 3. where the personal data has been disclosed to the public
by the data subject or has been made public lawfully; 4. where it is necessary for statistics gathering or academic research by a government
agency or an academic institution for the purpose of healthcare, public health, or crime prevention, provided that such data, as processed
by the data provider or as disclosed by the data collector, may not lead to the identification of a specific data subject; 5. where it
is necessary to assist a government agency in performing its statutory duties or a non-government agency in fulfilling its statutory obligations,
provided that proper security and maintenance measures are adopted prior or subsequent to such collection, processing, or use of personal
data; or 6. where the data subject has consented to the collection, processing and use of his/ her