Company: GLXG
Filing Date: 2025-10-24
Form Type: 20-F
Source: 0001213900-25-102144
Chunk: 103

Company: Galaxy Payroll Group Ltd
Filing Date: 2025-10-24
Form: 20-F
Item: Item 4
Chunk 103
---
 an offence and is liable on conviction to a fine at HKD10,000 (US$1,280) and a further fine of treble
the undercharged amount.

Personal Data (Privacy) Ordinance (Chapter
486 of the Laws of Hong Kong)

We collect, use, make use
and retain the personal data of our clients and its employees in the normal course of our business and therefore, our business operation
is regulated by the Personal Data (Privacy) Ordinance (Chapter 486 of the Laws of Hong Kong) (the “ PDPO”) and our Group falls
within the definition of “data user” and “data processor” as defined under the PDPO.

We are required to follow
the practices as set out in the data protection principles under the PDPO regarding the collection, use, retention, accuracy and security
of and access to personal data, which are:

  (i)      Principle 1: Purpose and manner of collection. This principle provides for the lawful and fair collection of personal data and sets out the information a data user must give to a data subject w...  

  (ii)      Principle 2: Accuracy and duration of retention. This principle provides that personal data should be accurate and kept no longer than necessary.  

  (iii)      Principle 3: Use of personal data. This principle provides that unless the data subject consents, personal data should be used only for the purposes for which they were collected or a directly ...  

  (iv)      Principle 4: Security of personal data. This principle requires appropriate security measures to be applied to personal data (including data in a form in which access to or processing of the da...  

  (v)      Principle 5: Information to be generally available. This principle provides for openness by data users about the policies and parties adopted by the data user in relation to personal data, the ...  

  (vi)      Principle 6: Access to personal data. This principle provides for data subjects to have rights of access to and correction of their personal data.  

Section 58 of the PDPO provides
that if personal data are used for any of the purposes referred to in Section 58(1) of the PDPO (which includes but not limited to prevention
or detection of crimes, prosecution or detention of offenders and prevention, preclusion or remedying of unlawful or seriously improper
conduct or dishonesty or malpractice by persons etc.) (“ Exempted Matters”) and the application of the personal data protection