Company: GLXG
Filing Date: 2025-10-24
Form Type: 20-F
Source: 0001213900-25-102144
Chunk: 125

Company: Galaxy Payroll Group Ltd
Filing Date: 2025-10-24
Form: 20-F
Item: Item 4
Chunk 125
---
 a contractual or quasi-contractual relationship between the
non-government agency and the data subject, and proper security measures have been adopted to ensure the security of the personal data;
3. where the personal data has been disclosed to the public by the data subject or has been made public lawfully; 4. where it is necessary
for statistics gathering or academic research by an academic institution in pursuit of public interests, provided that such data, as processed
by the data provider or as disclosed by the data collector, may not lead to the identification of a specific data subject; 5. where consent
has been given by the data subject; 6. where it is necessary for furthering public interest; 7. where the personal data is obtained from
publicly available sources unless the data subject has an overriding interest in prohibiting the processing or use of such personal data;
or 8. where the rights and interests of the data subject will not be infringed upon. A data collector or processor shall, on its own initiative
or upon the request of the data subject, erase or cease processing or using the personal data when it becomes aware of, or upon being
notified by the data subject, that the processing or use of the personal data should be prohibited pursuant to the proviso to Subparagraph
7 of the preceding paragraph.”

Article 20 of the PDPA further
stipulates: “ Except for the personal data specified in Paragraph 1, Article 6, a non-government agency shall use personal data only
within the necessary scope of the specific purpose of collection; the use of personal data for another purpose shall be only on any of
the following bases: 1. where it is expressly required by law; 2. where it is necessary for furthering public interests; 3. where it is
to prevent harm on life, body, freedom, or property of the data subject; 4. where it is to prevent material harm on the rights and interests
of others; 5. where it is necessary for statistics gathering or academic research by a government agency or an academic institution for
public interests; provided that such data, as provided by the data provider or disclosed by the data collector, may not lead to the identification
of a specific data subject; 6. where consent has been given by the data subject; or 7. where it is for the data subject’s rights
and interests. When a non-government agency uses personal data for marketing purpose pursuant to the preceding paragraph, upon the