Company: GLXG
Filing Date: 2025-10-24
Form Type: 20-F
Source: 0001213900-25-102144
Chunk: 124

Company: Galaxy Payroll Group Ltd
Filing Date: 2025-10-24
Form: 20-F
Item: Item 4
Chunk 124
---
 personal data in writing, except where
the collection, processing or use exceeds the necessary scope of the specific purpose, or where the collection, processing or use based
solely on the consent of the data subject is otherwise prohibited by law, or where such consent is not given by the data subject out of
his/her free will. Articles 8 and 9 shall apply mutatis mutandis to the collection, processing, or use of personal data in accordance
with the preceding paragraph; Paragraphs 1, 2 and 4 of Article 7 shall apply mutatis mutandis to the consent required under Subparagraph
6 of the preceding paragraph.”

Article 8 of PDPA provides:
“ A government or non-government agency shall expressly inform the data subject of the following information when colleting their
personal data in accordance with Article 15 or 19 of the PDPA: 1. the name of the government or non-government agency; 2. the purpose
of the collection; 3. the categories of the personal data to be collected; 4. the time period, territory, recipients, and methods of
which the personal data is used; 5. the data subject’s rights under Article 3 and the methods for exercising such rights; and 6.
the data subject’s rights and interests that will be affected if he/she elects not to provide his/her personal data. The obligation
to inform as prescribed in the preceding paragraph may be waived under any of the following circumstances: 1. where notification may
be waived in accordance with the law; 2. where the collection of personal data is necessary for the government agency to perform its
statutory duties or the non-government agency to fulfill its statutory obligation; 3. where giving notice will prevent the government
agency from performing its statutory duties; 4. where giving notice will harm public interests; 5. where the data subject has already
known the content of the notification; or 6. where the collection of personal data is for non-profit purposes and clearly has no adverse
effect on the data subject.”

Regarding the personal data
other than those stipulated under Article 6, Article 19 of the PDPA stipulates: “ Except for the personal data specified under Paragraph
1, Article 6, the collection or processing of personal data by a non-government agency shall be for specific purposes and on one of the
following bases: 1. where it is expressly required by law; 2. where there is