1. Privacy Policy Statement

This Privacy Policy Statement sets out the privacy policy and practices of Nan Fung International Holdings Limited and its holding companies, subsidiaries, affiliates and associated companies (collectively “we”, “us”, “our” or “Group”), for the purposes of complying with the requirements of applicable personal data protection laws and regulations for personal data collected through our website(s) or mobile application(s). We are committed to protecting your privacy and the confidentiality of your personal data that we process in connection with the services, products, events, facilities, promotions or marketing or other activities we offer to clients and individuals using our website(s) or mobile application(s). This Privacy Policy Statement describes how we collect, use, handle and protect your personal data, which is any information that is capable of identifying an individual. When an individual provides personal data to us, they are agreeing to be governed by this Privacy Policy Statement. The collection of your personal data will also be subject to our Personal Information Collection Statement.
 

2. Categories of Personal Data which We Collect

The categories of personal data we may collect and use about you will vary depending on your level of engagement with us. We may collect the following personal data about you:
 

• your name, mailing or delivery address, contact number(s), vehicle licence plate number(s), Octopus card number(s), electronic payment information, email address, and/or other information in relation to your engagement with us;
• information about the devices you use to interact with our website(s) or mobile application(s), which may include internet protocol addresses, device identifiers, web browser, and browsing information collected through cookies and other similar technologies on our website(s) or mobile application(s). The information automatically collected will be associated with any personal data you have provided; and
• (if you choose to connect your applications and/or devices which track your health data to our mobile application(s)) your health data, including but not limited to, exercise or fitness habits, sleep data, steps, active calories burnt, walking and running distance, and any other information related to your health provided or uploaded by you or tracked by your applications and devices connected to our mobile application(s).  You understand that the provision of your health data and the connection of your applications and devices to our mobile app are not mandatory.  However, if you do not provide or share with us your health data, you will not be able to fully utilise the services provided by us.
   

You may provide us voluntarily with information in order to use, or participate in, certain features of our services, such as registering for an account; making a purchase; applying for a job; submitting a survey response; requesting support or assistance; signing up for or registering an activity or a loyalty program; making a donation; contactless parking; making an enquiry or contacting us etc..
 

Certain personal data are required for specific services or products and if you fail to supply such personal data as requested for the specific service or product, we may not be able to deliver you the service or product.
 

Our services are not designed for or targeted at, children younger than 18 years old, and we do not intentionally collect or maintain personal data about anyone under the age of 18. If you are under 18 years old, please ask your parent or guardian to interact with us on your behalf.
 

3. The Purpose and Basis of Our Use of Your Personal Data

We may collect personal data directly from you when you:
 

• visit our website(s) and/or use our mobile application(s) and/or submit paper or online forms and/or register for an account;
• engage or enquire about the services, products, events, facilities, promotions or marketing or other activities offered by us and/or third parties;
• call us, email us or contact us via social media;
• complete questionnaires or surveys;
• provide feedback;
• make a complaint;
• connect your applications and/or devices (including but not limited to Apple Health app, Google Fit, and other permitted applications and/or devices) which track your health data to our mobile application(s); or
• enter into any transaction with us or request information in relation to entering into a transaction.
   

We may also indirectly obtain personal data of you from third parties when you:
 

• visit a third-party site that links to our website(s) (for example New Frontier) or an estate agent website and request information about one of our products, services or property developments;
• engage with other property, investment or finance companies that we have arrangements with;
• engage with solicitors, financial advisers, surveyors, and estate agents involved in your search for, and purchase of, properties or products or services from us; or
• apply for a loan with us where information is collected from credit reference and anti-fraud agencies.
   

Our use of your personal data depends on how and where you interact with us. We may require the collection of personal data for one or more of the following purposes:
 

• to operate, and provide support to your use of, our website(s) or mobile application(s);
• to process your application(s) or request(s) for services, products, facilities or privileges;
• to verify your identity and the accuracy of certain other personal data that you have provided;
• to provide services, products, facilities or privileges to you, and handle the necessary arrangements and matters (including legal, administrative and other matters) for maintaining and managing such services, products, facilities or privileges, including the operation, maintenance and administration of your membership in or the processing of your exercise of any rights under our website(s) and/or mobile application(s);
• to track and record your activities and health data and offer corresponding benefits and/or promotions to you;
• to communicate with you and for overall relationship management and maintenance;
• to investigate, handle and respond to any comments, messages, requests, enquiries, complaints or incidents made by you, made against you or involving you in any manner;
• to design, arrange, provide or procure services, products, facilities, privileges, activities or events for you or for customers generally;
• to conduct survey, research and analysis to facilitate the provision of services, products, facilities, privileges, activities or events to you or to customers generally;
• to market and promote services, products and facilities with your consent or where otherwise permitted by law;
• to comply with any obligations or requirements for using or disclosing personal data by any law or regulations, or by any governmental agency, regulatory authority, law enforcement agency, court or judicial body, whether in or outside of Hong Kong existing currently or in the future; and
• as otherwise permitted by applicable laws.
   

4. Link to Other Websites / Connection of your Applications and Devices to our Mobile Application(s)

We may provide links to third-party websites or information as a service to our users. You may also connect certain applications and devices to our mobile application(s). This Privacy Policy Statement does not cover third-party websites or services and transactions that we link to, nor the collection and processing of your personal data by those applications and devices. Linked sites and those applications and devices may have their own privacy policies and terms of use which you should review. We do not endorse or sponsor, nor are we responsible for, any third-party websites/applications/devices, the content or information contained therein, or their privacy practices.
 

5. Use of Cookies

We use cookies across our website(s), mobile application(s) to improve their performance and enhance users’ online experience.  Session cookies are used to enable users to browse and use the basic functions on our mobile application(s) and website(s), for example maintaining log-in details so that there is a reduced need to transfer information across the internet.
 

When you visit our website(s), if you choose “accept cookies”, we will also automatically collect, store and use technical information about your equipment and interaction with our website(s). This information will be sent from your device to us using a variety of cookies.
 

6. People Who May Process Your Personal Data

Your personal data may be received and processed by other members of our Group and/or the following categories of third parties, located within or outside Hong Kong:
 

• our own employees for the management and administration of our business;
• third-party data processors who provide support services to us and who will process your personal information on our behalf. Such third parties may include IT service providers as well as marketing companies that we use;
• independent financial advisors, estate agents and solicitors that help you with your dealings or purchase of our products or services;
• third-party service providers who we engage to provide or perform services, functions and/or activities to support our interactions with you;
• any prospective buyer or lender, as the case may be, being part of certain due diligence processes in the event of a re-organization, merger, sale, joint venture, acquisition, or other transfer or disposition of all or any part of our business or assets; and/or
• parties that we have a legal obligation to disclose information to, for example regulators and law enforcement agencies.
   

We maintain processes designed to ensure that such third-parties and other members of our Group will provide the same or equal protection of user data as stated in this Privacy Policy Statement to protect the confidentiality, availability and integrity of your personal data.
 

7. Retaining Your Personal Data

Your personal data will be stored securely in our system and all practical steps will be taken to ensure that your personal data will not be kept longer than is necessary for fulfilling the purpose of collection (including any directly related purpose). We retain personal data if it is necessary to support our interaction with you. We may also retain personal data for longer than the duration of the business relationship for legal and/or regulatory reasons, or for analysis or record-keeping. For requests for access, corrections or deletion, please refer to the “Your Rights” section of this Privacy Policy Statement.
 

8. Direct Marketing

Where you agree (or where otherwise permitted by law), we will send you information about any new services, products, events, facilities, promotions or marketing or other activities which may be of interest to you, according to available methods of communication. Even after you agree and ask us to send you information, you can always unsubscribe or withdraw your consent at any time, and we shall stop sending you materials by way of direct marketing.
 

9. Automated Decision Making and Profiling

We may, in some cases, use automated decision making and/or profiling, if it is permitted by law, if you have provided an explicit consent or if it is necessary for the performance of a contract. You can always request a manual decision making and/or profiling process instead, express your opinion or contest a decision and/or profiling based solely on automated processing and/or profiling, if such a decision would produce legal effects or otherwise significantly affect you.
 

When using automated decision-making we will provide you with further information about the logic involved, as well as the significance and the envisaged consequences to you.
 

10. Security

We endeavor to keep your personal data secure. We have set up technical and organizational systems and processes to prevent unauthorized access or disclosure of your personal data. We also check that any third parties that we deal with maintain reasonable measures to safeguard the security of the personal data they process.
 

11. Your Rights

You have certain rights regarding how we use and keep your personal data. These include:
 

• A right to be informed whether and how we process your data.
• A right to withdraw your consent at any time if your personal data is processed on the basis of your consent. The withdrawal of your consent does not affect the lawfulness of processing based on consent before its withdrawal.
• Where permitted by law, you may have the right to request access to your personal data for the purposes of reviewing, modifying or requesting deletion of the data.
• You may have a right to request a copy of your personal data and to have any inaccuracies in that data corrected.
• You may unsubscribe from mailing lists or any paper or online registration.
• You have a right to lodge a complaint with a supervisory authority. However, if you have a complaint about our handling of your personal data, please contact us using the information provided under the “Contact Us” section of this Statement as we would appreciate the opportunity to deal with your concerns before you approach a regulator.
   

You may also have the right, in certain circumstances to:
 

• object to the processing of your personal data;
• be provided with a copy of any personal data that we hold about you. The exceptions to this right include if the information is legally privileged or the information can reveal personal data about another person;
• to require us to delete your personal data without undue delay;
• to “restrict” our use of your personal data, for example if you want us to establish its accuracy or the reason for processing it;
• to object to decisions based exclusively on the automated processing of your personal data;
• to require your personal data which we have obtained by automated means to be provided to you in a machine-readable format so that they can be ported to a replacement service provider.
   

You can exercise your rights by contacting us using the details below. However, we will require you to produce satisfactory proof of your identity and we may charge you a reasonable fee for the administrative costs in certain circumstances. If a fee is necessary, we will inform you of the fee before processing your request.
 

12. Contact Us

You can contact us at any time by post to "Privacy Data Officer" (to 23rd  Floor, Nan Fung Tower, 88 Connaught Road Central, Central, Hong Kong, or to 8F, Tower B, 100 Zunyi Road, Changning District, Shanghai, The People’s Republic of China if you are a natural person in the Mainland China under Article 3 of the Personal Information Protection Law of the People’s Republic of China) or by email (to DPO@nanfung.com).
 

13. Changes to this Privacy Policy Statement

We may revise this Privacy Policy Statement from time to time. All versions of the Privacy Policy Statement are dated with the effective date of that version of the Privacy Policy Statement. Our processing of personal data we collected about you will be governed by the most recent Privacy Policy Statement in effect.
 

This Privacy Policy Statement was last updated in August 2023.