Last Updated: 15th May 2020

Protecting our customers' privacy is a priority at M800 Group (the "M800") and we are committed to maintaining strong and compliant privacy protections in line with the provisions of the Hong Kong Personal Data (Privacy) Ordinance (CAP 486) and the General Data Protection Regulation (EU) 2016/679. Ensuring the privacy of your information is an important responsibility and we thank you for the trust you place in us.

M800 Privacy Policy (the "Policy") is aiming at informing you about the personal information we collect and use.

This Policy applies to our website visitors, app users and to all customers of M800. Please take time to read it in order to understand better what information we collect and for what purposes. By using the Website or any Service, you are also agreeing to M800 Terms of Use, please make sure you read and agree with them. For the Use of our Maaii App, our maaiiconnect App and our maaiiconnect service, your consent will be first requested before you can proceed further.

It is important to us you understand that by using M800 websites (the "Website"), M800 online platform, M800 Apps or M800 services (the "Services") you allow us to collect, use, disclose, transfer, store your personal information or your end-users information to provide us with the best service. Also understand that we do not access the content you or your end-users are sharing privately using the Services.

By accepting the terms of this Policy, you consent to the automatic processing of the personal data you will provide to us for the purposes detailed below.

Type of personal data collected and collection means

We collect the minimum information necessary to provide you our Service and you may at any time limit such collection as specified below in "User Rights" below. When necessary, M800 will collect and use the personal data you will voluntary share with us, such as:

• Identification data (e.g. phone number, username, email address, date of birth, where strictly necessary ID number or copy);
• Profile information (e.g. age, gender, location information, language preference, CV and any information that you choose to disclose as part of your M800 account such as picture, video, status, phone contact list, Facebook contact list);
• Electronic identification data (e.g. IP addresses as detailed below);
• Payment details (credit card information);
• Traffic data;
• Device data (e.g. hardware data, OS data and the like);
• Service quality and survey results;
• Information about your usage of and interaction with M800 Products and websites (including computer, platform, device and connection information, client performance information, error reports, device capability, bandwidth, statistics on page views, and traffic to and from our websites, browser type and usage statistics);
• Products ordered and delivered;
• M800 test calls made to and from you;
• Correspondence between you and M800; and
• All data requested by relevant authorities, courts, law enforcement or regulatory bodies to enable M800 to comply with any applicable law, regulation, court order whether in Hong Kong or not.

Most often, the provision of the said personal data is optional. However, where the requested M800 Service is a customized service or provision of the M800 Service depends on you providing the requested personal data, failure to provide it may prevent us from providing that specific customized service or dependent on you product.

We collect personal data from you (customers and employees, end users, suppliers, website visitors, applications users, job candidates) as follow:

• Directly from you by phone, fax or e-mail, registration on internet and/or on mobile application or other applications, order form or contract;
• From our own records of your usage of M800 Services;
• From your enquiries;
• From applicants for employment;
• From your visits on our Website (our web server may collect information relating to your online session, the use of which is to provide aggregated, anonymous statistical information on the server's usage so that we may better meet our customers and visitors expectations. Our Website may also place cookies as defined below on your device to personalize the services we provide while you are surfing our Website and/or maintain your identity during your visits on our Website across one or more sessions. Such cookies may be disabled by you but doing so may make part of our Website features unavailable to you;
• From third parties such as financial information about customers to assess its risks in granting credit terms; and
• About third parties (users, customers as defined in our terms and conditions of service) in which case you will be requested to confirm you comply with the applicable laws.

Personal Data processing by M800

Unless otherwise specified, M800 will retain only your personal data and for the duration that is necessary to achieve the purposes detailed below and to comply with the applicable laws and regulations. Your personal data will remain accessible to you at any time after the registration with M800 for the purposes set out herein. You may at any time request to correct, update or delete your personal information by following an identity check process for insuring your data best protection. Upon, where applicable, withdrawal of your consent, deactivation/termination of your account, we will only retain such minimum necessary data pursuant to the applicable laws or any legal requirements. We may also decide for statistic reasons or to improve the Service to keep track of your activity data on an anonymous basis.

Purpose of the Processing

Our primary purpose in collecting your personal data is to provide you with a safe, smooth, efficient, and customized experience.

We only use, or have third party service providers acting on M800's behalf using personal data relating to you, as permitted or necessary to:

• Verify your identity;
• Provide the Service and information requested by you to us directly or indirectly( through our customer's portal in the case of maaiiconnect) ;
• Change and/or customize M800 features and functionality;
• Take, process or deliver orders made via our Website, invoice you or notify you of the status of your order;
• Display updates about your recent activity using the M800 Services;
• Provide other Products and/or Services for you (as described when we collect the information);
• Provide you with customer support and manage potential incidents;
• Compare information for accuracy;
• Inform you about service updates and faults;
• Request feedback or participation in on-line surveys for the purposes of improving the quality of M800 Services (including M800 Website);
• Resolve disputes or assist you in the prevention, detection or investigation of fraud;
• Customize, measure, and improve M800 Products and Website, as well as other M800 Services;
• Improve our search and product functionality;
• Unless otherwise indicated by you, send commercial and marketing communication related to M800 Services;
• Manage you job application; and
• Protect your and M800's interests.

Cookies, Clear GIFs, and your Internet Protocol Address

We do not sell to nor share our customer data with third parties for direct marketing purposes. However, M800 Services may include the processing of personal data by third parties for the display of personalized advertising, to keep track of interactions with our portals and offer customized experience thanks to the following:

Cookies: These are pieces of information that a website transfers to an individual's hard drive. They enable your computer and browser to save information when you visit the M800 Website (such as your User ID and password, for easy log in). Cookies also help to improve and enhance the user's experience, by, for example, tailoring the design and content of the M800 Website. Your web browser should have an option to enable or disable cookies. If you choose to have cookies enabled, you may also choose to be informed and whether to accept when any particular website sends you a cookie. Similar options are available on and through Flash Player in relation to Flash cookies. However, if you decide not to accept cookies from the M800 Website, this may totally or partially impair the functionality of the whole or parts of the M800 Website.

Clear GIFs: The M800 Website and any communications sent to you by M800 may also make use of clear GIFs (known also as "web beacons" and "tracking pixels") or technology of a similar nature. Clear GIFs are visible (but more commonly, invisible) images that are embedded in websites, emails and other messages and are used by us to keep a record of the number of visits to the M800 Website and to let us know when you have received and opened an email from us. This helps us to assess the performance of our communications to you and consider how successful our marketing strategies are.

Your Internet Protocol Address or "IP address": IP address is the number that your Internet Service Provider allocates to you when you go online and/or surf the internet. Your IP address and domain name may be logged by our servers when you visit the M800 Website, so that we are able to easily identify you. It also allows us to improve our management of the Service we provide to you and identify any problems with our system.

Regarding the operation of Cookies, GIFs and your IP address, we may use our trusted third parties to carry out the operation of the above technologies on our behalf. For the avoidance of doubt, no information regarding your identity, whatsoever, shall be collected during such operation.

Disclosing your personal data

Except as provided in this section, M800 will not sell, rent or trade any personal data to third parties within or outside Hong Kong and its Affiliates without your explicit permission and to the extent permissible under applicable laws and regulations.

There are however certain circumstances in which M800 will have to disclose your personal data:

i. M800 may also share your personal data and traffic data with trusted service providers or other third parties under contract in order to provide you with an optimal Service. M800 ensures that our trusted service providers and third parties take all necessary measures to protect your personal data and traffic data and comply with the appropriate laws and regulations;

ii. Advertisements that appear through the M800 Products and M800 Website will sometimes be provided to you through M800's advertising partners who may use cookies, web beacons, and/or other technology. Our advertising partners may also collect information that does not identify you personally (such as recording the number of times you view a particular advert) to deliver advertisements to you. The use of such technology by our advertising partners is subject to their own privacy policies and is not covered by this Policy;

iii. Where there is a legal requirement to do so, where a legal action is taken against us or to governmental agencies or authorized parties in response to a verified query relating to criminal investigations or alleged illegal activity or any activity that may tarnish our reputation;

iv. For purposes of providing administrative, payment, collection, business, legal and/or operational support;

v. Where the personal safety of our users or members of the public is at risk; and

vi. Where a merger or acquisition is planned. In such case, we would do our best endeavors to ensure your personal information protection does not vary.

Children's Privacy

M800 does not purposefully collect or maintain personal data from users who we know are under the age of 16. The Website, the Services and their content are not designed to target potential users who are under 16 years of age unless the legal guardian instruct so in writing.

Transfer of personal data

For the processing of your data and in order to provide you with a personalized experience worldwide, M800 will access and process your data on our servers located in Hong Kong and/or from its or its service providers' data centers located outside the European Economic Area and/or non-whitelisted countries. In all cases the processing by M800 and its service providers will be carried out in pursuance with the provisions of the European Regulations (EU) 2016/679 ("GDPR") in addition to any other local applicable law. Accordingly, to ensure your data is adequately protected, we have put in place appropriate measures such as additional contractual obligations, processes and policies.

Your personal data security

M800 maintains a high level of protection of your personal data to ensure it is held and stored by us in a secure and safe place and accessed only by authorized persons. However, because no information provided over the Internet can be guaranteed as fully secured, we cannot guarantee that our system is impenetrable nor the security of the information you supplied to us or you received from us over the internet. We do nevertheless have in place various physical and electronic security measures (including but not limited to industry standard firewall and encryption security technologies) to protect your personal data from unauthorized or accidental access, processing, erasure, loss or use. Information is stored on our servers or those of trusted third parties. Access to these servers is strictly restricted to only a limited number of approved and trained employees.

Retention of your personal data

We will retain your personal data in accordance with the requirements of the applicable laws and our internal policy that is to say that personal data will only be retained for as long as is necessary to fulfil the purposes or related purposes for which it was collected except otherwise stated by you, the applicable laws or regulations.

User Rights

You can view and edit your personal information at any time after registration on our Website or on any application. You have a right of access, update, rectification, erasure, restriction, objection and where applicable data portability by sending an email to GDPR_support@m800.com or a request at the address stated below. In either case, you are requested to provide a valid identity proof. Please note, however, that withdrawing your consent or choosing to delete some types of personal information in our possession may prevent us from supplying part or all of M800 Services to you as a customer, vendor, and partner or from continuing to process internally your job application if you are a candidate. We encourage you to contact us to update or correct your personal information it changes or if the personal information in our possession is inaccurate. If however, you believe we have not been able to address your request or any concern, you have the right to make a complaint to your data protection authority.

Security

We care about the security of your personal information and we maintain technical, physical and administrative security measures to avoid loss, misuse, unauthorized access, disclosure or alteration of your personal information. For instance, we have implemented data encryption on our servers, firewalls, physical access controls to our data centers, information access restrictions measures, trainings of our employees-administrators who have access to our servers and/or where applicable to your content.

No liability for Third-Party

Our Apps, Widget, portals and platforms may contain links to other third-party websites (for contact sharing or payment for instance) M800 takes no responsibility and accepts no liability for any third-party websites and we remind you that you should be mindful when entering information on public networks or when using the Internet.

Mergers, Sales and Acquisitions

M800 may at any time decide to merge with, sell part or all of our assets to or be acquired by another company. If any such transactions take place, your personal data may be handed over to the new entity. We shall ensure that after such transaction, the safety of your personal data will be ensured the same way as it is set out under the terms of this Policy. No such transactions shall take place if we are in any doubt as to the security of your personal data. Once such a transaction has been confirmed we shall alert you in respect of the same by posting a notice on the M800 Website or any other means agreed between us.

Policy Changes

M800 may from time to time update or change this Policy (with or without giving notice on our homepage or any other place we deem appropriate), in this event the updated Policy would be posted on M800 Website. It is your responsibility to check our Website for such updates. For ease of checking the effective date is posted at the end of the Policy. You agree that even if you should choose not to check for any changes to this Policy, by continuing to use the M800 Website and/or M800 Services, you accept and agree to the changes and any updated Policy effective immediately upon posting.

M800 Group

At M800 we are part of a larger group of companies and our sister companies Maaii Limited and M800 Singapore Limited are covered by this Policy.

Contacting us

All queries regarding this Policy or your data protection rights should be addressed to DPO@m800.com or in writing to:

M800 Data Protection Officer
Legal Department,
21/F, Tower 1 Enterprise Square,
9 Sheung Yuet Road,
Kowloon Bay, Hong Kong

Should you decide that you want to permanently delete your account or withdraw your consent, you should contact us at DPO@m800.com and submit your request.

(Effective: 15th May 2020)