Privacy Policy Statement

What personal data the Group collects, why it collects it, who it may be given to, how long it is kept, and the rights you have in relation to it. Made under the Personal Data (Privacy) Ordinance (Cap. 486). In force from 2 August 2026.

1. About this Statement

1.1 Cheuk Nang (Holdings) Limited (the “Company”, together with its subsidiaries, the “Group”) is committed to protecting the privacy of the personal data it holds. This Privacy Policy Statement explains what personal data the Group collects, why it collects it, who it may be given to, how long it is kept, how it is protected, and the rights you have in relation to it.

1.2 The Group is a data user for the purposes of the Personal Data (Privacy) Ordinance (Cap. 486) of the laws of Hong Kong (the “Ordinance”), and handles personal data in accordance with the six data protection principles set out in Schedule 1 to the Ordinance.

1.3 What this Statement covers. It applies to the Company and to its Hong Kong operations, including this website at cheuknang.asia. Personal data collected by the Group’s operations in Macau is additionally subject to the Macau Personal Data Protection Act (Law No. 8/2005).

1.4 What this Statement does not cover. The Group’s operations in Malaysia and in the mainland of China are subject to their own data protection regimes and publish their own privacy statements through their own websites. This Statement does not apply to them. It also does not apply to any third-party website reached by a link from this one — see Section 12.

1.5 In this Statement, “personal data” has the meaning given in the Ordinance: data relating directly or indirectly to a living individual, from which it is practicable to identify that individual, and which is in a form in which access or processing is practicable.

2. What personal data the Group collects

2.1 Through this website

2.1.1 This website is an information site. It has no enquiry forms, no accounts, no registration and no online transactions. It runs no analytics or advertising services, and it sets no tracking or profiling cookies.

2.1.2 The Group therefore collects personal data through this website only in the following ways:

Source	Personal data	Why
Email you send to a published address	Your name and email address, and whatever else you choose to include	To read and answer your message
Server and security logs	IP address, browser type, pages requested, times of access	Delivering the site, security, and diagnosing faults. Generated automatically by the Company’s hosting and network provider
The partner area at /partners/	Your email address, and a record of access	To verify that you are on the authorised list. Access is controlled by Cloudflare Access, which places a single authorisation cookie on your device for that purpose

2.1.3 The published addresses are comms@, complaints@, whistleblowing@ and info@, each at cheuknang.asia. Their purposes are described on the contact page and, for whistleblowing@, in the Whistleblowing Policy.

2.1.4 If this website begins to collect personal data by any other means — an enquiry form, a registration, a mailing list or a sales interest register — a Personal Information Collection Statement will be given at or before the point of collection, telling you the purpose, the classes of persons to whom the data may be transferred, whether supply is obligatory or voluntary, and how to exercise your rights. Nothing will be collected by a new means without that notice.

2.2 Through the Group’s wider business

2.2.1 Separately from this website, the Group collects personal data in the ordinary course of its business as a property developer and owner. Depending on your relationship with the Group this may include:

• Purchasers, tenants and occupiers — identity and contact particulars, identification documents where required by law, correspondence, payment and account records, and records relating to a property transaction or tenancy.
• Shareholders — the register of members is maintained by the Company’s share registrar, Computershare Hong Kong Investor Services Limited, which holds shareholders’ particulars in that capacity. Enquiries about your shareholding should be directed to the share registrar.
• Job applicants and employees — application materials, employment records, and data required for payroll, benefits and statutory purposes.
• Suppliers, contractors, consultants and agents — the contact particulars of individuals at those organisations, and records of the engagement.
• Persons who raise a concern under the Whistleblowing Policy — see Section 8 of that Policy, which governs how such data is handled.
• Visitors to the Group’s buildings and sites — visitor records, and images recorded by closed-circuit television where it is installed and signposted.

2.2.2 Personal data is collected directly from you in most cases. Where it is obtained from another source — an agent, a joint venture partner, a professional adviser, or a public register — it is used only for the purposes set out in Section 3.

3. Why the Group uses personal data

3.1 Personal data is used for the purpose for which it was collected and for purposes directly related to it, which may include:

• responding to your enquiry, complaint or request;
• marketing, selling, leasing, managing and maintaining the Group’s properties, and administering a transaction or tenancy;
• administering the Group’s relationships with shareholders, and complying with the Company’s obligations as a company listed on The Stock Exchange of Hong Kong Limited;
• recruitment, employment and the administration of staff;
• procurement, and the administration of contracts with suppliers and contractors;
• assessing and investigating a report made under the Whistleblowing Policy;
• the security of the Group’s buildings, sites and information systems;
• meeting the Group’s obligations under any law, court order, or requirement of a regulator, and establishing, exercising or defending legal claims;
• keeping the Group’s own records, and internal management and reporting; and
• direct marketing, subject to Section 5.

3.2 Personal data will not be used for a new purpose unrelated to the above without your prescribed consent, or unless the Ordinance permits it.

4. Who personal data may be given to

4.1 The Group keeps personal data confidential. It may be transferred to the following classes of persons, in each case only so far as necessary for a purpose in Section 3:

• other members of the Group;
• the Company’s share registrar, and its receiving agents;
• professional advisers, including legal advisers, auditors, valuers, surveyors and accountants;
• agents, contractors and service providers who perform a function for the Group, including estate agents, property managers, building contractors, IT and hosting providers, and mailing houses;
• banks, insurers and financial institutions, where relevant to a transaction;
• a purchaser or prospective purchaser of a business or asset of the Group, and their advisers;
• a person to whom the Group is required to make disclosure by law, by a court, or by a regulator, including The Stock Exchange of Hong Kong Limited, the Securities and Futures Commission, the Companies Registry, the Inland Revenue Department, the Privacy Commissioner for Personal Data, the Independent Commission Against Corruption and law enforcement agencies; and
• any person with your consent.

4.2 Where the Group engages a data processor to handle personal data on its behalf, it uses contractual or other means to require that processor to protect the data and to hold it no longer than necessary.

5. Direct marketing

5.1 The Group does not currently use personal data for direct marketing through this website. This Section sets out the position that will apply if and when it does.

5.2 The Group may wish to use your name, contact details and the record of your dealings with the Group in direct marketing, in order to send you information about:

• residential and commercial properties developed, owned, sold or leased by the Group;
• sales launches, showflat and site visit invitations, and property management services; and
• news, publications and events of the Group.

5.3 The Group may not so use your personal data unless it has received your consent, which includes an indication of no objection. Where the Group intends to use your personal data in direct marketing it will tell you so at the time, identify the kinds of personal data to be used and the classes of goods and services to be marketed, and give you a channel through which to respond. No use will be made until consent is given.

5.4 The Group will not provide your personal data to another person for that person’s own direct marketing without your written consent.

5.5 You may opt out at any time, free of charge, by writing to the Company at the address in Section 10, marked Opt-out request. The Group will cease the use on receipt.

6. Whether you have to supply personal data

6.1 You are under no obligation to supply personal data to the Group. Where data is collected for a particular transaction or relationship, the notice given at the time will state whether supply is obligatory or voluntary and what may follow if it is not supplied — for example, that the Group may be unable to process an application, complete a transaction, or answer an enquiry.

7. How long personal data is kept

7.1 Personal data is kept no longer than is necessary for the fulfilment of the purpose for which it is used, in accordance with data protection principle 2(2) of the Ordinance.

7.2 Where a period is fixed by law or by a legitimate business need, that period applies. Records connected with a property transaction, an employment relationship, a company law or tax obligation, or actual or contemplated legal proceedings are kept for as long as those obligations or proceedings require. Reports under the Whistleblowing Policy are kept for seven years from the date of closure, as stated in that Policy.

7.3 Personal data that is no longer required is erased, or is anonymised so that the individual can no longer be identified.

8. How personal data is protected

8.1 The Group takes all reasonably practicable steps to protect personal data against unauthorised or accidental access, processing, erasure, loss or use. These include restricting access to those who need it for a purpose in Section 3, physical and system security measures, and requirements imposed on the Group’s contractors and service providers.

8.2 No transmission of information over the internet can be guaranteed to be completely secure. Where you send information to the Group by email, you do so at your own risk, and you may prefer to use post for anything sensitive.

9. Accuracy

9.1 The Group takes all reasonably practicable steps to ensure that the personal data it holds is accurate having regard to the purpose for which it is used. Please tell the Company if your particulars change, or if you believe the data held about you is inaccurate.

10. Your rights of access and correction

10.1 You have the right under the Ordinance to:

• ask whether the Group holds personal data about you;
• request a copy of that data; and
• request the correction of any data that is inaccurate.

10.2 A request should be made in writing to:

Data Access and Correction Requests
Cheuk Nang (Holdings) Limited
Suite 4901, 49/F, Central Plaza
18 Harbour Road, Wanchai, Hong Kong

Email: [email protected]

10.3 Please mark your message clearly as a data access request or a data correction request. The address above also receives general enquiries, and a request that is not identified may be handled as ordinary correspondence.

10.4 The Company will respond to a data access request within 40 days of receiving it, as the Ordinance requires. A fee may be charged for complying with a data access request; any fee will not be excessive, and you will be told the amount before the request is processed.

10.5 If you are not satisfied with how the Group has handled your personal data, you may complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong.

11. Cookies and this website

11.1 This website sets no analytics, advertising, profiling or tracking cookies, and it does not use any third-party analytics service.

11.2 The Company’s network and security provider may set a small number of strictly necessary cookies for security and performance — for example to identify traffic that is not human, and to maintain a session where one is required. The partner area at /partners/ requires an authorisation cookie, without which the access control cannot function.

11.3 You may block or delete cookies through your browser settings. Blocking strictly necessary cookies may prevent the partner area from working.

12. Links to other websites

12.1 This website links to other websites, including HKEXnews, the websites of regulators and public authorities, and websites operated by other members of the Group. Those websites are not controlled by the Company and are governed by their own privacy statements. The Company is not responsible for their content or their handling of personal data.

13. Transfer of personal data outside Hong Kong

13.1 The Group operates in more than one jurisdiction, and personal data may be transferred to and held in a place outside Hong Kong for a purpose set out in Section 3. Where that occurs, the Group takes reasonable steps to ensure the data continues to be protected to a standard comparable to that required by the Ordinance.

14. Changes to this Statement

14.1 The Company may amend this Statement from time to time. The version in force is the version published on this website, and the date it took effect is stated below. Where a change is material, the Company will draw attention to it.

15. Language

15.1 This Statement is published in English and in Chinese. In the event of any inconsistency between the two versions, the English version prevails.

---

Adopted with effect from 2 August 2026. Cheuk Nang (Holdings) Limited, incorporated in Hong Kong with limited liability, stock code 131. Registered office: Suite 4901, 49/F, Central Plaza, 18 Harbour Road, Wanchai, Hong Kong.