Company: GRAN
Filing Date: 2025-07-31
Form Type: 20-F
Source: 0001213900-25-069627
Chunk: 9

Company: Grande Group Ltd/HK
Filing Date: 2025-07-31
Form: 20-F
Item: Item 3
Chunk 9
---
 subject to
fines and other government sanctions, which may materially and adversely affect the business of our subsidiaries in Hong Kong, and our
financial condition and results of operations.

Compliance
with Hong Kong’s Personal Data (Privacy) Ordinance and any such other existing or future data privacy related laws, regulations
and governmental orders may entail significant expenses and could materially affect our business.

Although
we and our subsidiaries are not subject to cybersecurity review by the CAC nor any other PRC authorities to obtain regulatory approval
regarding the data privacy and personal information requirements from the CAC nor any other PRC authorities for ours and our Operating
Subsidiary’s operations in Hong Kong, we and our subsidiaries are subject to a variety of laws and other obligations regarding
data privacy and protection in Hong Kong.

In
particular, the Personal Data (Privacy) Ordinance (Chapter 486 of the laws of Hong Kong) (“ PDPO”) imposes a duty
on any data user who, either alone or jointly with other persons, controls the collection, holding, processing or use of any personal
data which relates directly or indirectly to a living individual and can be used to identify that individual. Under the PDPO, data users
shall take all practicable steps to protect the personal data they hold from any unauthorized or accidental access, processing, erasure,
loss, or use. Once collected, such personal data should not be kept longer than necessary for the fulfilment of the purpose for which
it is or is to be used and shall be erased if it is no longer required, unless erasure is prohibited by law or is not in the public interest.
The PDPO also confers on the Privacy Commissioner for Personal Data (“ Privacy Commissioner”) power to conduct investigations
and institute prosecutions. The data protection principles (collectively, the “ DPP”), which are contained in Schedule 1
to the PDPO, outline how data users should collect, handle, and use personal data, complemented by other provisions imposing further
compliance requirements. The collective objective of DPPs is to ensure that personal data is collected on a fully informed basis and
in a fair manner, with due consideration towards minimizing the amount of personal data collected. Once collected, the personal data
should be processed in a secure manner and should only be kept for as long as necessary for the fulfilment of the purposes of using the
data. Use of the data should be limited to or related to the original collection purpose. Data subjects are given certain rights,