Privacy Policy for MASHK MAPS APP

Effective Date: 21 May 2026

This Privacy Policy has been enacted to comply with the Personal Data (Privacy) Ordinance (Cap. 486 of the Laws of Hong Kong, “PDPO”) and applicable regulatory requirements in Hong Kong. If you have already opened a securities account with MASHK, you should also refer to the Client Agreement, in particular Schedule A (Personal Information Collection Statement), for further details regarding the collection, use and handling of your personal information.

For the purposes of this Policy, “personal information” means personal data as defined under the PDPO, being any data relating directly or indirectly to a living individual, from which it is practicable for the identity of the individual to be directly or indirectly ascertained, and in a form in which access to or processing of the data is practicable.

MASHK MAPS APP is operated by Mirae Asset Securities (HK) Limited (“MASHK”, “we”, or “us”), a licensed corporation under the Securities and Futures Commission (“SFC”). MASHK acts as the data user. MASHK MAPS APP is a platform providing functions including market data services (including but not limited to browsing and querying Hong Kong stocks and US stocks) and stock transaction management for users (“MAPS APP”). We take the security of our users' personal information very seriously. In order to provide our products and services to you, we may need to collect, use and process your personal information. We will take appropriate security measures in accordance with applicable laws and regulations, and use commercially reasonable efforts to protect your personal information. For this purpose, this Privacy Policy (this “Policy”) is prepared. We remind you that:

This Policy applies to the products and services of MAPS APP that you use in any manner. Before using any product or service of MAPS APP, please read and understand this Policy. Do not use relevant products or services until you have fully understood and agreed to this Policy. Once you start using any product or service of MAPS APP, it shall be deemed that you have read and understood this Policy. For specific types of personal information requiring your explicit consent (including direct marketing and cross-border transfer), we will seek your separate consent through the APP before any such collection or use. Where any product or service of our affiliated companies has made use of any product or service provided by MAPS APP but has not established its own privacy policy, this Policy shall also apply to such product or service.

Please read this Policy carefully, as we will explain the types of your personal information collected by us as well as their corresponding purposes, so that you can better understand the types, reasons for use and collection methods of the detailed personal information collected by us for specific functions. By clicking "Agree to this Policy" or checking a box with a similar meaning, or by actively logging in, confirming, agreeing, accepting, and using the Mobile Apps and related services provided by us, you agree to our collection, use, storage, sharing, transfer, and disclosure of personal information in accordance with this Policy (including updated versions).

This Policy will help you understand the following contents:

I. How we collect your personal information

II. How we use the information collected by us

III. How we use Cookie and similar technologies

IV. How we share, transfer or publicly disclose your personal information

V. How we protect your personal information

VI. How we store the information

VII. Your right to manage your personal information

VIII. How your personal information is transferred worldwide

IX. Information that we may send to you

X. Information shared by you

XI. How we update this Policy

XII. Scope of application of this Policy

XIII. How to contact us

XIV. Dispute Resolution and Governing Law

I. How we collect your personal information

In order to provide services to you, maintain normal operation of the products and services of MAPS APP, improve and optimise our service experience, and safeguard your account security, we will, for the purposes and in the manners stipulated herein, collect the information you voluntarily provide or authorise to provide, or that is provided based on your requirements when you register/use the products and services of MAPS APP, as well as that is generated from your use of the services of MAPS APP. We apply the principle of data minimisation and will only collect personal information that is necessary for, and not excessive in relation to, the purposes stated in this Policy.

(1) When you run or use MAPS APP, we may obtain network access to your device.

(2) When you use your mobile telephone number and verification code to register with MAPS APP, we will collect your mobile telephone number. The reason that we collect such information is to complete the identity verification required before you can register and use any product and service of MAPS APP.

(3) If MAPS APP enables login via a third-party account, we may obtain your account avatar and nickname in such third-party account through third-party authorisation services, and save the information to the storage server of MAPS APP. The information will be used for managing your account for logging in to MAPS APP. We will not disclose the above-mentioned information to any external party, nor will we use it for any other purpose than this function, unless you choose to do so or we are required to comply with applicable laws and regulations.

(4) When you log in to the services without a verification code, MAPS APP may initiate the Short Message Service (SMS) function on your device. The short message to be sent by you may incur SMS tariffs, which will be charged by your mobile network operator. MAPS APP will not charge any SMS tariff. If you refuse to send the short message, you cannot use the non-verification code login service provided by MAPS APP.

(5) When you register, upload identification documents, edit your personal information, carry out live video and use other functions of MAPS APP, if you adopt the "Photo" or “Video” mode under the “Camera” of your device, MAPS APP will use the Camera permission of your device; if you adopt the "Selecting from Album" mode, MAPS APP will use the album permission and folder read/write permission of your device. In case that you save useful pictures that you find on MAPS APP to your Album, MAPS APP will also use the album permission and folder read/write permission of your device. The photos and files uploaded by you will be stored in our server, since this function cannot be realised without storage. In addition, MAPS APP will use the Microphone permission of your device. The voice message uploaded by you will be stored in our server, since this function cannot be realised without storage.

(6) MAPS APP will use the notification permissions of your device. If you do not grant these permissions, you may not be able to play videos, but this will not affect your use of other services of MAPS APP.

(7) For the purpose of ensuring your normal access to and use of quotation-related rights and services, we will carry out validity recognition of territory or account on the IP address, third-party account and avatar, nickname and similar information provided by you. If you disagree with the above-mentioned content, it may affect the territory or account validity verification process, and may affect your access to and use of quotation-related rights and services.

(8) When you access the account opening function of a broker via MAPS APP, MAPS APP may use the Camera permission and Microphone permission of your device; if you refuse to offer the Camera permission and Microphone permission, you cannot normally complete the account opening procedure. As required by brokers and applicable laws, when you apply to open an account via MAPS APP, you must submit the photo of your identification document(s), your recent photo (without headwear), your residential address, your mailing address, the organisation where you work, your occupation and position, and other similar information. If you disagree with the above-mentioned content, you cannot open an account, but this will not affect your use of other services of MAPS APP.

(9) When you access the account opening function of a broker via MAPS APP, MAPS APP may use the NFC read-write permission of your device to read the NFC-enabled information from your identification document or relevant device where applicable. If you refuse to offer the NFC read-write permission, you cannot normally complete the account opening procedure.

(10) When you share pictures or URLs to any other third-party account via MAPS APP, MAPS APP will read the list of your apps to confirm whether the target third-party application with which you intend to share has been installed on your device.

(11) When you use MAPS APP, in order to allow you to use our services normally and to improve and optimise our service experience, to guarantee the security of your account, and to comply with applicable laws and regulations, we will collect information related to both the services you use and your usage mode, and correlate the information. Such information includes:

(a) Log information: When you use products or services provided by our website or APP, we will automatically collect details of your use of our services and save such information as relevant weblogs, e.g., your login account, search/enquiry content, IP address, browser type, telecom operator, network environment, language used by you, date and time of webpage view, web browsing history, push notification records, duration records, refresh records, posting records, following records and sharing records. We will obtain the storage permission of your device to save the aforementioned log information.

(b) Device information: We may, where technically available and permitted by the relevant operating system and applicable laws, and based on the specific permissions you grant during the installation and use of the software, receive and record information related to the device used by you. Such information may include IMEI, MAC address, serial number, IMSI of SIM card, device model, operating system and its version, the client version, device resolution, package name, device settings, unique device identifier, features of software and hardware, IP address, GPS location, WLAN access point information, and information related to Bluetooth and base station sensors.

(12) When you upgrade your MAPS APP, we will use the Application Installation permission of your device. For the purpose of guaranteeing normal upgrading, we will also use the Installation Channel Tracking permission of your device. If you disagree with the above-mentioned content, you cannot upgrade your APP; in such case, you may not be able to use the updated function of the APP or the updated service of MAPS APP, and you may not be able to normally use your MAPS APP.

Please understand that we will update and improve the functions and services provided by us to you, from time to time. If certain function or service that is not listed in the foregoing clause has collected your information, we will explain the content, scope and purpose of such information collection to you separately, in the manner of page prompts, interactive processes, website announcements, etc.

We may obtain relevant information that you have authorised for sharing from related parties or third-party partners. We will collect and use such information in accordance with the provisions of relevant laws and regulations, and the agreements between us and the related parties or third-party partners, provided that such information provided by them is from legitimate sources.

The above-mentioned information provided by you may contain personal data, e.g., your bank account number, your transaction records, information about your virtual property, your system account number, your email addresses, your telephone number, your web browsing history, and your locational information. Please pay attention to such personal data. You agree that we may process your personal data for the purposes and in the manners stipulated in this Policy.

II. How we use the information collected by us

For the purpose of providing services to you, improving service quality and providing safe, smooth and efficient experience to you, we will use your authorised personal information to implement the functions of the APP based on the intents and purposes set forth in this Policy for the following purposes, under the premise of strictly complying with the provisions of laws and regulations, this Policy and other agreements between you and us:

(1) Account opening and maintenance;

(2) Securities dealing and related services;

(3) Compliance with the SFC, HKEX and regulatory requirements;

(4) Know Your Client / Anti-Money Laundering and Counter Terrorist Financing checks;

(5) Risk management and internal controls;

(6) Complaint handling;

(7) Service improvement;

(8) Providing a variety of other relevant services to you;

(9) Giving us an idea of how you access and use relevant services, so as to optimise our methods of providing service to you;

(10) Optimising our development and services, e.g., in case that a fault occurs to our system, we will record and analyse the information generated from such system fault, so as to optimise our services;

(11) Subject to obtaining your prior explicit consent in accordance with Part VIA of the PDPO, sending you marketing information for the purpose of promoting services of MAPS APP; where we intend to provide your personal information to third parties for their direct marketing use, we will obtain your prior written consent; you may withdraw your consent at any time, free of charge, by contacting our Customer Service; and sending services-related notices in connection with MAPS APP;

(12) Where analytics or usage data is used for targeted marketing in a manner that identifies or targets you as an individual, such use will be subject to your prior consent in accordance with applicable laws;

(13) Evaluating and improving our promotional effectiveness;

(14) Managing software, e.g., software certification and software upgrading;

(15) Inviting you to participate in surveys related to our services;

(16) For the purpose of preventing, detecting and investigating fraud, infringement, safety hazards, illegal activities or violations of agreements, policies or rules of us or with our affiliated companies, to protect the legitimate rights and interests of you, other users, the public, our Company or our affiliated companies, we will use or integrate your personal information, information about service usage, equipment information, log information, the information for which our affiliated companies and partners have obtained your authorisation, and the information shared according to law, so as to comprehensively judge your account risk and transaction exposure, to carry out identity authentication, to detect and prevent security incidents, and to take necessary measures, e.g., recording, audit, analysis and disposal;

(17) For the purpose of ensuring the security of the services and helping us better understand our APP’s running condition, we may record relevant information, e.g., the frequency of your use of the APP, crash data, overall use condition, performance data, and source of the APP. However, we will not combine the information we store in our analytics software with your personal identity information provided by you in the APP;

(18) Please note that if you provide information that contains personal information of another person, you need to ensure that you have the legal authorisation of that person before providing such personal information to us.

(19) Other purposes authorised by you.

If we use your personal information for any purpose other than that we state upon collection or beyond the directly or reasonably related scope, we will, before using your personal information, notify you again and obtain explicit consent from you.

In addition, we may collect and use your personal information without your consent where an exemption applies under Part VIII of the Personal Data (Privacy) Ordinance (Cap. 486), including for:

· compliance with any legal or regulatory obligation applicable to us;

· prevention or detection of crime;

· assessment or collection of any tax or duty;

· protection of the vital interests of the data subject where consent cannot be given or reasonably obtained;

· exercise or defence of legal rights or claims;

· any other exemption as provided under the Ordinance.

You acknowledge and agree that after collecting personal information, we may de-identify the information through technical means, and the de-identified information will not identify you personally, in which case we may use de-identified or aggregated data for analytics, service improvement and business development purposes without obtaining your separate consent. All personal information provided by you when using the Mobile Apps will continue to be authorised for our use unless you delete it or refuse to allow us to continue collecting it through your device's system settings.

III. How we use Cookie and similar technologies

In order to offer you easier access experience, when you use products or services of MAPS APP, we may collect and store your data related to your access to MAPS APP, by a variety of technologies, so that when you access or re-access MAPS APP, we can identify you and offer you better and more services based on data analysis, including identifying you through small-scale data files. We collect such data to understand how users use our services, so that users will not be required to re-type their account information and we can determine whether your account is secure. These data files may be Cookies, Flash Cookies, or other local storage provided by your browser or related applications (collectively referred to as "Cookies"). We will not use Cookies for any purpose not stated in this Policy. You can manage or delete Cookies based on your own preferences. For details, please visit AboutCookies.org. You can delete all the Cookies stored on your computer, and most web browsers provide the option of blocking Cookies. However, by doing so, you may not be able to use the functions of MAPS APP that rely on Cookies in some cases, and you have to change the user settings every time you visit our website.

IV. How we share, transfer or publicly disclose your personal information

Except in any of the following cases, we will not share your personal information with any company, organisation or individual other than the service supplier of MAPS APP:

(1) Sharing your personal information with your consent: After obtaining your explicit consent, we will share your personal information with other parties.

(2) Sharing your personal information under legal circumstances: We may share your personal information as required by laws and regulations, or according to lawsuit/dispute resolution or legal requirements by administrative agencies or judiciary authorities.

(3) It is necessary to share your data (e.g., your IDFA, network identity identifier, IP address, IMEI, MAC address or other relevant information), so that we can provide the third-party products and services required by you, or carry out data analysis or research for MAPS APP, or improve our products and services. At present, third-party software development kit (SDK) services that we access mainly include the following types:

· Providing IM message communication function;

· Providing free-flow services;

· Report and analysis of user behaviour data;

· Providing payment service;

· Report of APP crash;

· For performance statistics;

· Providing live-streaming supporting function;

· Providing services related to browsers;

· For advertising statistics and monitoring;

· For login by third-party account;

· For sharing contents of MAPS APP on third-party platforms by you.

Relevant parties are in charge of operation of these third-party services, which shall be subject to the service terms and privacy statements of such third parties (not this Privacy Policy). To obtain an understanding of device permission types called by such third-party SDK, and how your personal information is collected and used, you should refer to relevant service agreement and privacy policy of the third-party SDK.

We may use third-party SDKs and similar tools for functions such as analytics, crash reporting, authentication, database storage, performance monitoring, security protection and content sharing. We will take reasonable steps to ensure that such third-party service providers process personal information in accordance with applicable laws and appropriate confidentiality and security requirements.

(4) If a complaint is filed against you or you file a complaint against others, we will submit the information related to such complaints, e.g., your identity information to relevant supervisory authorities, for solving such complaints or disputes, unless expressly prohibited by laws and regulations.

(5) Exchanging information with other companies and organisations for the purpose of complying with laws, executing or applying the conditions of use of our services or other agreements, preventing fraud or other illegal activities, or reducing credit risk.

(6) Sharing your personal information with our affiliated companies: We may share your personal information with the affiliated companies of MASHK. We will only share necessary personal information, and will be bound by the purposes stated in this Policy. Where any of our affiliated companies intends to modify the processing intent of your personal information, it will obtain your authorisation and consent.

(7) Sharing with the partners authorised by us: Only for the purpose of fulfilling the purposes stated in this Policy will some of our services be provided by the partners authorised by us. We may share some of your personal information with such partners, so as to provide better customer services and user experiences to you. For example, when you participate in any rewards event provided by us, for the reason of granting rewards or arranging our partners to provide services to you, we must share your personal information with the partners. We will only share your personal information for lawful, proper, necessary, specific and explicit purposes, and will only share the personal information required for providing the services to you. Our partners shall have no right to use the personal information shared by us for any other purpose.

(8) Sharing with third parties in accordance with the Registration Agreement of this software or relevant provisions between you and us.

(9) Other provisions related to information sharing between you and us.

We will sign strict confidentiality agreements with the companies, organisations and individuals with whom we share personal information, requesting them to process personal information according to our instructions, this Policy or any other relevant measures related to confidentiality and security.

Transfer

Except any of the following cases, we will not actively transfer your personal information:

(1) Where the relevant operations have been explicitly agreed by you in advance;

(2) In case of merger, acquisition or bankruptcy liquidation that involves personal information transfer, we will request the new companies and organisations that hold your personal information to be bound by this Privacy Policy; otherwise, we will request such companies and organisations to seek your authorisation and consent.

(3) Other conditions that require the transfer of your personal information pursuant to provisions of laws and regulations or requirements of competent authorities.

Public disclosure

We will only publicly disclose your personal information in the following cases:

(1) After obtaining your explicit consent;

(2) Public disclosure based on laws: As required by laws, legal procedures, lawsuits or under mandatory requirements of government authorities, we may publicly disclose your personal information;

(3) If we confirm that you have violated laws or regulations or have seriously violated relevant protocol rules of MAPS APP, or for the purpose of protecting the property safety and personal safety of users of MASHK (and its affiliated companies) as well as the public against personal injuries or property damages, we may, without obtaining consent from you, disclose your personal information according to laws or regulations or relevant protocol rules of MAPS APP, including relevant illegal behaviours and measures that MAPS APP has taken on you.

Exceptions to obtaining prior consent for sharing, transferring or publicly disclosing personal information

We may share, transfer or publicly disclose your personal information without your prior consent where an exemption applies under Part VIII of the Personal Data (Privacy) Ordinance (Cap. 486), including for:

· compliance with any legal or regulatory obligation applicable to us;

· prevention or detection of crime;

· assessment or collection of any tax or duty;

· protection of the vital interests of the data subject where consent cannot be given or reasonably obtained;

· exercise or defence of legal rights or claims; and

· any other exemption as provided under the Ordinance.

V. How we protect your personal information

We will take a variety of precautions to safeguard your personal information against loss, theft and misuse and unauthorised access, disclosure, alteration and destruction. To protect your personal information, we have formulated strict information security regulations and processes, and our dedicated information security team will strictly implement the foregoing measures within our Company.

We will take reasonable and practicable measures to guarantee that no irrelevant personal information will be collected. We will retain your personal information for no longer than the period that is necessary for the purposes stated in this Policy, unless the extension of the retention period is required or permitted by law.

The Internet is not absolutely secure, and your emails, instant messages and communications with other users of MAPS APP may not be encrypted, so we strongly suggest you shall not send any personal information in any of such ways.

We will establish emergency response plans; in case of any security incident, e.g., personal information leakage, we will activate the emergency response plans, to prevent such security incident from spreading. We will inform you of the information related to such incident by email, mail, telephone call, push notification, etc. in a timely manner. If it is difficult to notify each affected individual, we will take reasonable and effective measures to issue an announcement. The Internet is not completely secure. Despite these security measures, please note that there is no "perfect security measure" on the Internet, but we will try our best to ensure the security of your information.

VI. How we store the information

(1) By clicking "Agree to this Policy" or checking a box with a similar meaning, or by actively logging in, confirming, agreeing, accepting, and using the MAPS APP, you agree that we may store your personal information within the territory of the Hong Kong Special Administrative Region of the People's Republic of China (hereinafter referred to as “Hong Kong”), and we shall keep such information strictly confidential.

(2) Generally, we will retain your personal information for a minimum of 7 years from the date of account closure or the relevant transaction (in accordance with SFC record-keeping requirements), or such longer period as required by applicable laws and regulations. We will not retain personal information for longer than is necessary for the purposes stated in this Policy, subject to these minimum retention obligations. However, in any of the following conditions, we may change the storage time of your personal information for complying with legal requirements:

(a) To abide by relevant provisions of applicable laws and regulations;

(b) To abide by the provisions of court decision, ruling or other legal procedures;

(d) Purposes reasonably necessary for fulfilling relevant service agreements or this Policy, protecting social and public interests, protecting personal and property safety or other legitimate interests of our customers, our Company or our affiliated companies, other users or our employees.

VII. Your right to manage your personal information

(1) During the period in which you use the services of MAPS APP, in order to allow you to access, modify and delete your personal information more conveniently, and to guarantee your rights to withdraw your consent to use your personal information and rights to close your account, we provide you the following operation setups in our product design, including but not limited to:

(a) Accessing your account information;

(b) Modifying your personal information; and

You can close your MAPS APP account with the help of our Customer Service by contacting us at cs@securities.miraeasset.hk. Our Customer Service team will assist in closing your MAPS APP account.

After you close your account, we will retain your relevant information in accordance with the Personal Data (Privacy) Ordinance (Chapter 486 of the Laws of Hong Kong) and other relevant laws and regulations. Your personal information will be deleted or anonymised after the legal retention period has expired. If you wish to continue to use the services of MAPS APP, you will need to re-register a MAPS APP account.

VIII. How your personal information is transferred worldwide

(1) In principle, the personal information provided by you in accordance with this Policy will be stored within the territory of Hong Kong. Since we provide products or services through the resources and servers around the world, it means that your personal information may be transferred to or be accessed by other jurisdictions outside of the country/region where you use such products or services (“other jurisdictions”) after we obtain your authorisation and consent (e.g. MASHK affiliates, service providers, brokers, custodians, settlement agents, etc). If we subsequently need to transfer the personal information provided by you under this Policy to other jurisdictions for business or administrative purposes (including making your personal information accessible to other jurisdictions), we will meet the necessary pre-requisites and fulfil the corresponding legal obligations in strict compliance with applicable laws and regulations of Hong Kong and requirements of relevant regulatory authorities before such transfer, including informing you of the name and contact details of the recipient in other jurisdictions, the purpose and manner of the transfer, the type of personal information to be transferred, the manner and procedure by which you can exercise your rights with the recipient in other jurisdictions and obtaining your separate explicit consent. Such jurisdictions may enforce different data protection laws, or even have not enacted any relevant law; in such cases, we will implement appropriate safeguards, including contractual protections and internal data governance measures, to ensure that your personal data is afforded a comparable standard of protection to that required under the PDPO, e.g., we may request your consent to transfer of your personal information across boundaries or implement the security measures such as data de-identification or anonymisation, prior to transfer of your personal information across boundaries.

(2) If you visit the service platforms and pages of international brokers or third parties to obtain their products or services, the international brokers or third parties may provide their products or services through resources and servers around the world. If you wish to obtain such products or services, you may need to provide the relevant information directly to the international brokers or third parties located at other jurisdictions according to the demand for the relevant products or services. Please refer to the relevant parts of this Policy to determine your own risk and decide whether to accept, use or provide information to international brokers or third parties in relation to such products or services.

IX. Information that we may send to you

(1) When you use our services, we may send you emails, SMSs, messages or push notifications. You may unsubscribe them on your device according to relevant instructions made by us.

(2) If necessary (e.g., when certain service is suspended for the reason of system maintenance), we may send you announcements related to our services. You may not be able to cancel such non-advertising announcements related to services.

X. Information shared by you

You may share the information (e.g., texts and photos you share publicly in the Discussion Zone of MAPS APP) related to you with your friends, family members and other users, via our services. You may control the extent of the information to be shared by you through the Privacy Settings in our services, or delete the information that you have shared publicly through the Settings in our services or according to our guidance. However, please note that the information shared by you may be independently saved by other users or non-related third parties not under our control.

XI. How we update this Policy

We will update this Policy in a timely manner, as required by relevant laws and regulations, in case of change in our businesses or under other necessary situations. Without your explicit consent, we will not reduce any of your rights to which you are entitled in accordance with this Policy. We will announce any modification to be made by us to this Policy on this page, and notify you of the updated policy by releasing it on our official website or in any other proper way for you to receive notices. In such case, your continued use of our services shall be deemed that you agree to be bound by the revised and updated policy.

XII. Scope of application of this Policy

(1) Except for our expressly stated services to which other separate privacy policies or clauses specially formulated by us apply, this Policy shall be applicable to any and all services provided by MASHK and its affiliated companies to you. However, where we have formulated special privacy policy for certain service as needed, and there is any conflict between this Privacy Policy and the privacy policy of such certain service, the latter shall prevail.

(2) Headings of all clauses herein shall be for convenience only, without any actual substantive meaning, and shall not be used as a basis for interpreting this Policy.

XIII. How to contact us

If you have any question, comment or suggestion on this Policy or our data processing, please contact us by sending email to cs@securities.miraeasset.hk, or by sending mail to us at the following address:

Mirae Asset Securities (HK) Limited

Customer Service

Address: Units 8501, 8506B & 8507-08, Level 85, International Commerce Centre, 1 Austin Road West, Kowloon, Hong Kong

XIV. Dispute Resolution and Governing Law

This Policy shall be governed by and construed in accordance with the laws of the Hong Kong Special Administrative Region of the People's Republic of China, including the Personal Data (Privacy) Ordinance (Cap. 486) and the Securities and Futures Ordinance (Cap. 571). Any dispute or legal proceedings arising out of or in connection with this Policy shall be submitted to the courts of Hong Kong, which shall have non-exclusive jurisdiction.