私隱政策聲明和收集個人資料聲明

有關向客戶、會員及其他個別人士收集個人資料的私隱政策聲明和收集個人資料聲明

甲．私隱政策聲明

目的

鑑於保護個人資料的重要性，以確保遵守適用法律，包括《個人資料（私隱）條例》（第486章）（以下簡稱“《私隱條例》”）以及其中包含的保障資料原則，無添加化粧品有限公司及無添加化粧品（中國）有限公司（以下統稱“本公司”）及其附屬公司（以下統稱“本集團”），特此制定本私隱政策聲明和收集個人資料聲明以保障個別人士的個人資料。本文件包括兩個部分，甲部分為私隱政策聲明，作為我們處理個人資料的私隱政策和實務的概括性説明，而乙部分為收集個人資料聲明，該聲明是我們按照《私隱條例》在向您作為資料當事人（如以下所定義）收集個人資料時或之前須向您提供的。

本私隱政策聲明和收集個人資料聲明的條款構成顧客、會員或其他個別人士已經或可能與本集團簽訂的條款及細則及/或協議或安排的一部分。如有任何歧義，應以本文件的條款為準。

請仔細閲讀本私隱政策聲明和收集個人資料聲明。通過訪問本公司的網站（以下簡稱“網站”）及/或本公司的手機應用程式（包括但不限於iFANCL HK（以下統稱“應用程式”））及/或使用通過網站及/或應用程式提供給您的產品和服務，即表示您同意本私隱政策聲明和收集個人資料聲明適用於我們掌握的與您相關的所有資料，並且在法律允許的最大範圍內，任何關於個人資料收集的爭議都將受到本私隱政策聲明和收集個人資料聲明的約束。

正確收集和使用個人資料

本集團將以合法和公平的方式收集個人資料。本集團從顧客、會員及其他個別人士收集的個人資料將僅在必要範圍內用於實現指定的使用目的，並將採取措施防止超出指定目的的使用。在從個別人士（即《私隱條例》定義下的“資料當事人”）收集資料之時及之前，我們將明確吿知他/她：

收集資料的目的以及該資料可能被轉移至的人士類別；

他/她是否有責任提供或可自願提供該資料，以及（如他/她有責任提供該資料）不提供該資料便會承受的後果；

他/她有權要求查閲和更正我們所持有的資料；及

負責處理資料查閲和更正請求的人員。

禁止向第三方披露和提供個人資料及/或用於其他目的

本集團將妥善管理從資料當事人獲取的個人資料，除非在適用法律和法規要求的情況下，否則不會在未經您同意的情況下向第三方提供或披露您的個人資料。

除非獲資料當事人同意，否則我們將不會將他/她的個人資料用於原先收集目的外的任何其他目的。我們僅會在資料當事人按照《私隱條例》給予同意的情況下，方會將資料當事人的個人資料用於直接促銷。資料當事人隨時可以撤回對個人資料用於直接促銷的同意。

如果本集團委聘外部服務提供者或資料處理者（無論在香港境內還是境外）以協助其處理個人資料，與任何合作方進行涉及個人資料收集的活動，或在其各種身份下與本集團相關的機構分享其收集的個人資料，所有這些服務提供者、資料處理者、合作方和機構須根據合約條款或其他方法以遵守與本集團自身適用的相同標準以防止任何喪失、未獲准許的查閲、使用、修改、披露或保留。

個人資料的準確性和保留期間

本集團將採取一切合理步驟以確保收集和保留的資料當事人個人資料為實現使用目的所需的範圍内是準確和最新的。資料當事人應負責將其個人資料之任何變更通知本集團。個人資料將根據我們現行的政策保留，並其保留期間不會超出為實現收集目的或資料當事人已經同意的時間，唯為履行法律義務或基於持續存在之理由而保留者不受此限。

保安措施

本集團將採取一切合理地必要、可行和恰當的保安措施，以防止未獲批准或意外的查閲、泄露、丟失、喪失及/或個人資料的錯誤使用。倘若出現上述任何問題（縱屬極不可能者），我們將迅速實施糾正措施，並努力將損害降至最低。

此外，本公司將為員工提供必要和適當的教育和內部指導，以確保對個人資料的安全管理。

互聯網不是安全的通信形式，向本集團通過互聯網發送任何個人資料的資料當事人接受此類通信所涉及的風險，包括未獲批准的第三方查閲或干預的風險。通過互聯網傳輸的資訊可能會跨國傳輸（即使發送方和接收方位於同一國家），當中通過的國家的私隱和資料保護法可能比資料當事人所居住的國家的法律更弱。

遵守法律和法規

本集團將遵守當地的法律和法規（包括《私隱條例》），並參考相關當局不時發佈的指引載列的最佳實務。此外，我們將制定並遵守相關的個人資料保護政策。

持續改進

本集團將定期審查、審核和調整個人資料保護措施的實施，以實現持續改進。

通常可以提供的資訊

我們通常能夠應您的要求提供以下與我們收集和處理的個人資料相關的資訊：

所持有的個人資料種類；
使用個人資料的主要目的；及
我們在處理此類個人資料方面的政策和實務。

查閲個人資料和更正資料請求

資料當事人有權通過書面信函至我們客戶關係管理部門的個人資料私隱主任，地址為香港九龍尖沙咀海港城港威大廈第5座20樓，或通過發送電子郵件至enquiry@fancl-hk.com，提交有關查閲其個人資料的書面要求。我們將就每項查閲資料要求收取費用。我們一般能在資料當事人提交查閲要求後的40天內吿知其結果；如果拒絕該要求，我們將提供理由。

資料當事人亦有權利以書面信函至我們客戶關係管理部門的個人資料私隱主任，地址為香港九龍尖沙咀海港城港威大廈第5座20樓，或通過發送電子郵件至enquiry@fancl-hk.com，要求免費更正其不準確的個人資料。

修訂

本集團會不時檢閱本私隱政策聲明、以下的收集個人資料聲明及/或其他本集團的個人資料保護政策。本集團將把上述文件的最新版本發佈至本公司網站及應用程式及/或以其他方式通知資料當事人。

第三方的權益

儘管《合約（第三者權利）條例》（第623章）以及/或任何司法管轄區中任何類似的法律之存在，本私隱政策聲明和收集個人資料聲明僅適用於您與本集團，並為雙方利益而訂立，且不構成或賦予任何第三方任何權利，也不應視作為賦予任何第三方任何利益。明確排除《合約（第三者權利）條例》（第623章），以及/或任何司法管轄區中任何類似的法律的條款賦予或給予第三方權利強制執行本私隱政策聲明和收集個人資料聲明的任何條款的應用，並且本私隱政策聲明和收集個人資料聲明的任何條款不是或不應視作為允許由非本文件締約方的執行。各方終止、撤銷或就與本私隱政策聲明和收集個人資料聲明有關的任何修改、豁免、變更或解決達成協議的權利不受制於任何第三方的同意。

查詢

如果對本集團的私隱政策聲明或以下本集團的收集個人資料聲明有任何疑問，或涉及本集團處理個人資料的任何問題，請以書面信函方式與我們客戶關係管理部門的個人資料私隱主任聯繫，地址為香港九龍尖沙咀海港城港威大廈第5座20樓，或通過發送電子郵件至enquiry@fancl-hk.com。

乙．收集個人資料聲明

簡介

本收集個人資料聲明（“PICS”）主要説明：(a) 我們從您或由本集團持有關於您作爲資料當事人收集的個人資料的類型；(b) 收集個人資料的目的；和(c) 可能將這些個人資料轉移至的人士類別。

在收集您的個人資料之前，我們將向您或您已授權代表您提供個人資料的一方以電子方式（例如網頁連結）或印刷本方式提供本私隱政策聲明和本PICS單一文件副本。本 PICS 適用於您不時向本集團提供的個人資料，本集團將就此類 PICS 作出的任何後續修訂發佈於本公司網站及應用程式上及/或由本集團向您作出另行通知。

我們從您處收集個人資料時，將通過本 PICS 或本集團任何員工吿知您，您是否有責任或可自願提供個人資料。如果您有責任提供資料，您將被吿知不提供此類資料則承受的後果。

如果您未滿 18 歲，您應當咨詢您的父母或對您負有作爲父母親的責任的人士，以確保在向我們提供您的個人資料之前，您瞭解本私隱政策聲明和本PICS 的內容和含義。您向我們提供個人資料時，即視為已取得您的父母或對您負有作爲父母親的責任之人對使用您個人資料的同意。

如果您向我們提供關於他人的個人資料，您向我們聲明並保證已獲得該等他人的所有必要同意，以允許我們按照本文所述使用該等個人資料。

本 PICS 中的任何內容均不應限制《私隱條例》下資料當事人的權利。

我們深知保護您的個人資料的重要性，並感謝您對我們尊重私隱的信任，我們會以謹慎而合理的方式來保護您的私隱。

收集的個人資料類型
- 您的姓名、出生月份及年份、住址及/或通訊及/或送貨地址、電子郵件地址、手機電話號碼及性別；

您的信用卡/借記卡詳情及/或其他支付方式的詳情；

您來訪或到場記錄和使用本集團場所、設備、設施和裝置的記錄；

您的交易記錄；

你的訂閲電子報記錄；

你的皮膚性質、膚況、肌膚問題、護膚諮詢資訊、角質層細胞影像及其他為人工智慧（AI）膚質分析或類似護膚分析服務所拍攝的影像，以及由該等服務產生的相關分析結果、報告、圖表、分數、指標及建議；

當您參與任何錄音計畫時，您與本集團員工之間的對話錄音或語音紀錄、該等錄音的文字紀錄，以及由該計畫產生的相關分析結果；

您首次瞭解本集團產品服務的方式；

您與我們的通訊（包括但不限於通過網站、應用程序或電子郵件的通訊，以及對本公司作出評論和咨詢的內容和記錄）；

您使用我們的網站、應用程序和服務的其他資訊，包括電腦和連線資訊、頁面瀏覽統計數據、網站和應用程序的流量紀錄、廣吿數據、IP 地址和標準網絡日誌資訊；及

您在本集團場所內或周邊的閉路電視（“CCTV”）監控系統捕捉的靜態或動態圖像或影片。

當您使用網站或應用程式時，我們還可能要求您提供上述個人資料，包括當您自願向我們註冊或更新您的現有個人資料、訂閲商品目錄或電子報、給我們發送電子郵件、使用我們的客户服務、回答問卷、參加促銷活動、在我們的社交網絡留言板上發帖或進行其他提交至網站時。

您必須於辦理新會員註冊時，透過填寫會員登記表（不論以電子或其他形式）及／或透過網站及應用程式進行線上購物時，提供您的個人資料。若您拒絕提供該等個人資料及／或提供不完整或不準確的個人資料，可能導致我們無法向您提供特定服務，包括但不限於履行您對末端送貨服務的要求。

收集您個人資料的目的

以下是本集團收集資料當事人個人資料的目的

接受和處理您對本集團商品和服務的請求或訂單；

管理向個人客戶和企業客戶提供本集團商品和服務；

處理、接收、調查和回覆客戶和會員的意見、投訴和查詢；

管理申請、創建、操作及管理會籍和客戶賬户和記錄，並在本集團營運的系統、網站和應用程序中註冊個人資料並使用手機號碼及/或電郵地址和密碼登錄所需的服務；

識別和驗證本集團客戶及會員的身份；

通知資料當事人有關規則變更及與新產品和服務相關的資訊，例如基於客戶和會員的興趣和關注的定向廣吿。

通過各種通知方式，如電子郵件、基於客戶和會員興趣和關注的定向廣吿，以及其他與本集團推薦其他公司的產品和服務相關的資訊，以及其他業務介紹等提供通知；

統計客戶和會員使用本集團產品和服務的數據，以促進和改善產品和服務的質量；

基於客戶和會員的興趣和關注進行行為定向促銷的分析和統計數據製作，以及本集團實施的其他促銷、推廣、銷售、產品和服務規劃；

管理和維護本集團的網站、應用程式，並在必要時進行故障診斷；

進行與本集團交易相關的信用判斷、中間信貸安排和債務管理；

為了改進本集團的服務質量，正確把握客戶和會員的意見、咨詢內容和合同內容；

處理賬單和付款；

開展本集團受其他經營者委託的其他業務；

促銷目的（包括在本集團的公共渠道，如網站和應用程序上發佈客戶和會員對本集團產品和服務的使用相關的匿名統計數據），以及客户滿意度調查；

追蹤和分析您的購買、交易、消費模式、會員賬户活動和支付記錄；

追蹤會員獎勵積分、特權及福利；

提供有關本集團和我們的產品的資訊，例如電子報、活動、促銷或競賽；

以便監控本集團場所的日常營運，並確保特定場所所有用户的安全和保障，預防、發現及/或減少犯罪，並進行分析和調查，包括調查法律索賠和指控以及與健康和安全相關的事項；

為確保本集團履行其合約義務；

為確保遵守本集團須遵守的適用法律及監管規定；及

任何其他直接相關的目的。

請注意：

本集團的求職者和員工可以參考有關求職者和員工的特定收集個人資料聲明，瞭解本集團在收集其個人資料方面的實務。

為了提高本公司內部電話接待服務的質量並準確掌握詢問內容，本公司可能記錄用户電話通話的內容。

就上述第（15）款中規定促銷目的，本集團不會公開或披露以下企業客户的個人（自然人）用户的資料：姓名、性別、年齡、地址、香港身份證號碼、任何其他個人標識符、對其使用本公司產品和服務的具體資訊以及個人歷史。

直接促銷

在您同意的情況下，本集團可能使用您的個人資料發送可能與您相關的直接促銷/推廣材料，包括但不限於我們新產品和服務的促銷、電子報、限時優惠、合約續訂和其他服務、更新或促銷。在此過程中，請注意：

由本公司不時持有，本PICS第2段所述之資料當事人的個人資料可能被本公司用於直接促銷；

可能進行促銷的服務、產品和主題的類別包括：(i) 本集團的產品和服務（包括但不限於：護膚產品、化妝品、彩妝產品、美容保健品、身體護理產品、彩妝服務、身體護理服務及美容服務）；以及 (ii) 與本集團的產品和服務相關的獎勵、忠誠或特權計劃；及

除了促銷上述服務、產品和事宜外，本集團還打算向第三方獎勵、忠誠、合作品牌或特權計劃提供者提供資料當事人的上述數據，以便它們用於促銷這些服務、產品和事宜，並且就目的，本集團需取得資料當事人的書面同意（其中包括不反對的表示）。

根據法律要求，我們需給予您權利選擇不接收這些通訊。請注意，如果您決定不接收這些通訊，您可能會錯過與我們的產品和服務相關的重要資訊，或者影響您作為本集團客户體驗的利益或優惠。

如果您在選擇參與後不希望本集團使用或向其他人提供您的資料用於如上所述的直接促銷，您可以行使您的選擇退出權利，向本集團提供書面通知，地址為香港九龍尖沙咀海港城港威大廈第5座20樓，或發送電子郵件至enquiry@fancl-hk.com。

向第三方披露、轉移和提供個人資料

本集團一般不會向外部人士提供或披露本集團持有的資料當事人的個人資料，但受制於適用法律法規的規定，可能會向以下各方及/或在以下各種情況提供個人資料：

對本集團負有保密責任並有責任保持個人資料機密的任何方；
任何員工、代理人、獨立承包商、合資夥伴、服務提供商或其他第三方，為上述目的以及任何附屬目的所必須，包括向本集團提供香港或其他地方的行政、審計、數據處理、文件管理、技術、電信、儲存、付款、保安、緊急、獎勵、忠誠、合作品牌和特權計劃或其他服務（包括直接促銷服務）所必需者（“附屬目的”），而對本集團承擔保密責任；

與我們共同提供服務或其他合作機會的組織及/或機構；

本集團的控股公司及/或股東，或由其控制或擁有的任何人或實體（每個為“關聯公司”），為用於上述目的和任何此類附屬目的而必須並對本集團承擔保密責任；
我們的專業顧問，如律師、税務顧問、會計師和審計師；

本集團或關聯公司根據適用於本集團或關聯公司的任何法律或法規的要求，或者根據任何法律、監管、政府、税務、執法或其他主管機構，或者本集團或關聯公司需遵守的自我監管或行業組織或協會給予或發佈的任何指引或指導，或者根據本集團或關聯公司與境內或境外法律、監管、政府、税務、執法或其他主管機構，或者自我監管或行業組織或協會的合約或其他承諾的要求而進行披露；所有這些可能涉及在香港境內或境外，並且可能目前存在或將來存在；
與資料當事人就本集團的任何產品或服務提出的或針對資料當事人提出的任何索賠有關的任何人；

我們權利或業務的任何實際或潛在受轉讓人、受移交人、參與方或子參與方；

已經獲得了資料當事人的同意；及
為了保護該資料當事人的身體或心理健康和福利。

如果涉嫌欺詐或違反有關披露、轉移和向第三方提供個人資料的情況，我們將立即採取一切適當的措施對此類風險進行調查和解決。

通過網站、應用程式或其他方式向我們提供個人資料，您明確授權我們如上所述使用和披露您的資料。如果您不同意，請不要繼續操作。

個人資料的查閲和披露、更正、暫停使用等

當資料當事人要求本集團披露、更正、暫停使用等其所持有該資料當事人的個人資料時，本集團在確認請求者身份並經本集團評估確實持有相關個人資料後，將在合理的時間限制內遵從此類請求，但可能會收取處理費。

然而，如果：

請求者未提供足夠資訊以確認其身份；
未能在不披露第三方個人資料的情況下滿足請求；及
遵從請求暫時受到所有適用法律法規的禁止，

本集團可能會拒絕遵從此類資料查閲請求。

如果涉及本公司個人資料的查閲、處理、更正和披露事宜以及投訴和咨詢等問題，您可通過電子郵件聯繫我們客戶關係管理部門的個人資料私隱主任，郵箱為 enquiry@fancl-hk.com，或寫信至香港九龍尖沙咀海港城港威大廈第5座20樓。

外部網站連結

網站及應用程式可能包含指向外部網站的連結。本集團將盡力保護資料當事人的個人資料，但外部網站對個人資料的處理不在本集團責任範圍內。您應仔細審閱所有造訪之外部網站的條款與條件及隱私權政策。如對外部網站有任何評論或疑問，請聯繫運營該外部網站的公司。

安全措施

我們採取合理的步驟，確保我們收集的個人資料免受未獲准許的查閲、披露、濫用或丟失。除非法律另有規定或允許，我們只會在您知情並同意的情況下收集、使用或披露您的個人資料。

我們已實施與資料敏感性相適應的安全防護措施，包括使用物理和電子安全措施。物理安全措施包括限制進入設施以及妥善處理個人資料。

本公司使用由防火牆安全系統保護的專用伺服器來管理個人資料，並盡最大努力防止未獲准許的查閲和資料泄露。

如果本集團與另一第三方機構簽訂合約代表其提供服務，本集團將確保它們採取適當的安全措施，並僅根據本集團被授權的範圍内處理您的資料。這些機構無權將您的個人資料用於其自身目的。本集團將採取合理的步驟檢查這些機構，以確保它們符合本集團認為可接受的安全要求。

網上行爲追蹤資訊的處理

網上行爲追蹤資訊的收集

當您訪問本集團的網站時，本集團可能會從您的設備或系統收集以下資訊（以下簡稱為“網上行爲追蹤資訊”），以幫助區分您與我們產品和服務的其他客户，並在您使用我們的產品和服務時為您提供定製體驗，並幫助我們改進我們的服務。

識別終端的資訊（cookie 資訊和其他個體識別號）
資料當事人的使用環境（IP 地址、操作系統和瀏覽器資訊等）
資料當事人在網站上的瀏覽記錄，包括訪問流量和時間
位置資訊
關於資料當事人與網站互動所收集之資訊，包括但不限於登入身分、購買項目及進行之交易

本集團可能通過 cookie和其他工具收集網上行爲追蹤資訊。cookie是包含少量資訊的小型文本文件，可下載並存儲在您的任何互聯網設備上。我們還可能使用 web beacon 等其他技術，這是一種包含唯一標識符的小型圖形文件，允許我們檢查您是否已訪問特定內容。對於此類聲明，所有這些技術都將被視為“cookie”。您可以通過更改瀏覽器的設定關閉或刪除 cookie。由於這些設定在不同的瀏覽器和瀏覽器擴展中有所不同，我們無法保證網站在所有情況下都能正常運行。請注意，您可能需要清除瀏覽器的 cookie、站點數據和緩存的網頁內容（包括離線內容），然後重新啟動瀏覽器才能使更改生效。但是，如果您關閉或刪除 cookie，我們則可能無法有效提供服務，因此建議您在瀏覽器上允許 cookie。如果您在未刪除或拒絕某些或所有 cookie 的情況下使用我們的網站，則表示您同意我們可以將那些您未刪除或拒絕的cookie 放置在您的設備上。

網上行爲追蹤資訊不會與其他資訊結合以追蹤/分析資料當事人。我們僅在所需功能使用期間保留網上行爲追蹤資訊。

網上行爲追蹤資訊的使用目的

網上行爲追蹤資訊的使用目的如下：-

確認在需要登錄的服務中是否為同一客户或會員的訪問
在特定時間內建立並維持您的登入身分，無需反覆登入
提醒會員在特定時間後重新輸入手機號碼和/或電子郵件地址及密碼，以確保安全性
為資料當事人提供最適合他們的關於本集團及我們的商業合作伙伴各種服務的內容、廣吿和資訊
記錄您對我們網站的使用以及對我們網站和其他社交媒體平台上發佈的在線廣吿的反應，以向您提供個性化內容，包括與您興趣相關的廣吿
豐富和改進本公司及我們的商業合作伙伴提供的服務和廣吿內容，或進行分析和探索新的服務
顯示適合資料當事人使用的佈局和資訊
防範和檢測欺詐行爲
使用第三方數據處理服務進行行為定向廣吿

本公司可能按照以下設置，直接或間接地將資料當事人的網上行爲追蹤資訊傳輸給第三方數據處理者，以基於資料當事人的興趣和關注提供行為定向廣吿。如果您希望我們停止向第三方發送瀏覽歷史和相關資訊，請參閲下文的“選擇退出行為定向廣吿”。

選擇退出行為定向廣吿

本公司可能會與下文列出的第三方合作，允許下列第三方代表我們對我們網站的某些部分的使用和活動進行研究。這些第三方可能使用追蹤標籤和 cookie 等技術來進行此類研究。這些第三方通過這些技術收集的資料可能用於更深入地瞭解我們的客戶和會員，包括訪問者數量、其行為和使用模式，以便進行更準確的報吿並提高我們促銷的效果。這些第三方還可能利用此類技術來了解您在我們網站上交互的內容，以便隨後向您發送一些定向廣吿。您應查閲此類第三方自己的 cookie 和隱私政策，以獲取有關他們如何使用您的資料的資訊，並且這些政策中還包含了是否可以選擇退出、退出其使用和進一步處理您資料的説明，以及退出後的後果（例如停止為上述特定目的收集您的資料，可能會限制其向您投放定向廣告的能力）。

所有這些連結都是屬本集團外部的第三方，因此本集團對這些連結的內容不負責任。

Google and Google tag

https://policies.google.com/privacy

https://policies.google.com/technologies/partner-sites

https://support.google.com/analytics/answer/6004245?hl=en

https://support.google.com/campaignmanager/answer/3027419?hl=en

Meta and Meta pixel

https://www.facebook.com/privacy/policy

https://www.facebook.com/business/help/742478679120153?id=1205376682832142

https://www.facebook.com/off_facebook_activity

https://www.facebook.com/adpreferences/ad_settings

注意：私隱政策聲明和收集個人資料聲明中文譯本僅供參考。文義如有歧異概以英文版本為準。

無添加化粧品有限公司

香港九龍尖沙咀海港城港威大廈第1座19樓1907-11室

無添加化粧品（中國）有限公司

香港九龍尖沙咀海港城港威大廈第1座19樓1907-11室

最後修訂日期: 2026-06-26

Privacy Policy Statement and Personal Information Collection Statement

Regarding Collection of Personal Data from Customers, Members and Other Individuals

Privacy Policy Statement
1. Purpose

In view of the importance of protection of personal data and to ensure compliance with the requirements of the applicable laws including the Personal Data (Privacy) Ordinance (Cap. 486) (the “PDPO”) and the data protection principles as contained therein, Fantastic Natural Cosmetics Limited and Fantastic Natural Cosmetics (China) Limited (collectively hereinafter referred to as the “Companies”) and their affiliated companies (collectively hereinafter referred to as the “Group”) have devised this Privacy Policy Statement and Personal Information Collection Statement to safeguard individuals’ personal data. This document comprises two parts, Part A being the Privacy Policy Statement, as a general statement on our privacy policies and practices in relation to the personal data we handle, and Part B being the Personal Information Collection Statement, which is provided to you in accordance with the PDPO when or before we collect personal data from you as a Data Subject (as defined hereinbelow).

The provisions of this Privacy Policy Statement and Personal Information Collection Statement form part of the terms and conditions and/or the agreement or arrangements that a customer, a member or other individual has entered or may enter into with the Group. If any inconsistency is found, the provisions of this document shall prevail.

Please read this Privacy Policy Statement and Personal Information Collection Statement carefully. By visiting the Companies’ websites (the “Websites”) and/or the Companies’ mobile applications (including but not limited to iFANCL HK, collectively hereinafter referred to as the “Applications”) and/or using the products and services made available to you through the Websites and/or the Applications, you are agreeing to this Privacy Policy Statement and Personal Information Collection Statement which shall apply to all information that we have about you, and that, to the maximum extent permitted by law, any dispute over personal information collection shall be subject to this Privacy Policy Statement and Personal Information Collection Statement.

Proper collection and use of personal data

The Group will collect personal data by lawful and fair means. Personal data collected from customers, members and other individuals will be used only to the extent necessary to achieve the specified purpose of use, and measures will be taken to prevent use beyond the specified purpose. Upon and before collection of data from an individual (“Data Subject” under the PDPO), we will explicitly inform him/her:

the purpose(s) for which the data is to be collected and the groups of persons to whom the data may be transferred;
whether it is obligatory or voluntary to supply the data, and the consequences of not supplying obligatory data;
his/her right to request access to and correction of data held by us; and
the person responsible for handling data access and correction

Prohibition of disclosure and provision of personal data to third parties and/or for other purpose

The Group will appropriately manage personal data obtained from Data Subjects and will not provide or disclose it to third parties without your consent, except in cases as required under applicable laws and regulations.

Unless a Data Subject consents, we will not use his/her personal data for any purpose other than the purpose for which the data was originally collected. We will only use a Data Subject’s personal data for direct marketing purposes if he/she has consented to do so in accordance with the PDPO. Any consent for use of personal data in direct marketing may be withdrawn by the Data Subject at any time.

If the Group engages outsourcing service providers or data processors (whether within or outside Hong Kong) to assist in its handling of personal data, partners with any parties in activities that involve collection of personal data, or shares the personal data it collects with bodies related to the Group in its various identities, all these providers, processors, parties and bodies are required to adhere to the same standards as applied to itself by the Group to prevent any loss, unauthorized access, use, modification, disclosure or retention, either by contractual provisions or other means.

Accuracy and duration of retention of personal data

The Group takes all reasonable steps to ensure that the Data Subject's personal data collected and retained is accurate and up-to-date to the extent necessary to achieve the purpose of use. The Data Subject is responsible for informing the Group of any changes to his/her personal data. Personal data will be retained in accordance with our prevailing policies and no longer than is necessary for the fulfilment of the purposes for which it is collected or to which the Data Subject has given consent, except for the purposes of fulfilling legal obligations or with subsisting reasons.

Security measures

The Group will take all reasonably necessary, practicable and appropriate security measures to prevent unauthorized or accidental access, leakage, loss, damage and/or misuse of personal data. In the unlikely event that any of the aforesaid problem occurs, we will promptly implement corrective measures while striving to minimize the damage.

In addition, the Companies will provide the necessary and appropriate education and internal guidance to employees and supervision in order to ensure the safe management of personal data.

The internet is not a secure form of communication, and a Data Subject who sends any personal data to the Group over the internet accepts the risks that such communication, involves, including the risk of access or interference by unauthorized third parties. Information passing over the internet may be transmitted internationally (even when the sender and recipient are located in the same country) via countries with weaker privacy and data protection laws than a Data Subject’s country of residence.

Compliance with laws and regulations

The Group will comply with the local laws and regulations (including the PDPO) and to take into account the best practices as stipulated in guidelines issued by the relevant local authorities from time to time. In addition, we will establish and comply with the relevant policies for the protection of personal data.

Continuous improvement

The Group periodically reviews, audits, and adjusts the implementation of personal data protection measures to achieve continuous improvement.

Information to be generally available

We will generally be able to provide upon request the following information in relation to personal data collected and processed by us:

the kinds of personal data held;

the main purposes for which personal data is used; and

our policies and practices in relation to the handling of such personal

Access to personal data and data correction requests

Data Subjects have the right to request access to their personal data held by us by writing to our Data Privacy Officer of Customer Relationship Management at 20/F, Tower 5, The Gateway, Harbour City, Tsim Sha Tsui, Kowloon, Hong Kong or by email at enquiry@fancl-hk.com. We will charge a fee for processing each data access request. We will generally be able to inform the Data Subject of the outcome within 40 days of his/her submission of the access request and will give a reason if the request is refused.

A Data Subject also has the right to request correction of his/her personal data that is inaccurate at no charge by writing to our Data Privacy Officer of Customer Relationship Management in writing to 20/F, Tower 5, The Gateway, Harbour City, Tsim Sha Tsui, Kowloon, Hong Kong or by email at enquiry@fancl-hk.com.

Amendment

This Privacy Policy Statement, the following Personal Information Collection Statement and/or other Group’s personal data protection policy are subject to review from time to time. The latest versions of these documents will be posted on the Websites, made available on the Applications and/or otherwise informed to the Data Subject by the Group.

Rights of Third Parties

Notwithstanding the Contracts (Rights of Third Parties) Ordinance (Cap. 623), and/or any comparable law in any jurisdiction, this Privacy Policy Statement and Personal Information Collection Statement is personal to and is made solely for the benefit of you and us, and shall not create or give any rights to, or purport to confer any benefits on any third parties whatsoever. The application of the Contracts (Rights of Third Parties) Ordinance (Cap. 623), and/or any comparable law in any jurisdiction, giving to or conferring on third parties, the right to enforce any term of this Privacy Policy Statement and Personal Information Collection Statement, is expressly excluded, and no term of this Privacy Policy Statement and Personal Information Collection Statement is, or is intended to be, enforceable by any person not being a party to it. The rights of the parties to terminate, rescind, or agree any amendment, waiver, variation or settlement under or relating to this Privacy Policy Statement and Personal Information Collection Statement, are not subject to the consent of any third party.

Enquiries

If there is any query concerning this Group’s Privacy Policy Statement, the following Group’s Personal Information Collection Statement or any issues relating to the handling of personal data by the Group, please contact our Data Privacy Officer of Customer Relationship Management by writing to 20/F, Tower 5, The Gateway, Harbour City, Tsim Sha Tsui, Kowloon, Hong Kong or by email at enquiry@fancl-hk.com.

B. Personal Information Collection Statement

Introduction

This Personal Information Collection Statement (“PICS”) mainly sets out: (a) the kind of personal data collected from you or held by the Group about you as a Data Subject; (b) the purposes for which personal data is collected; and (c) the classes of persons to whom such personal data may be transferred.

When or before obtaining your personal data, we will provide to you or the party to whom you have authorized to provide your personal data on your behalf, a copy of this Privacy Policy Statement and this PICS in a single document, either electronically, by way of a webpage link or in a printed copy. This PICS applies to personal data provided by you to the Group from time to time, subject to any subsequent revision of such PICS which will be posted on the Websites, made available on the Applications and/or otherwise informed to you by the Group.

Through this PICS or any staff of the Group, you will be informed whether it is obligatory or voluntary for you to provide the personal data when we seek to collect the data from you. If provision is obligatory, you will be informed of the consequences for you if you do not supply such data.

If you are under the age of 18, you shall consult your parents or such person(s) having parental responsibility for you on the contents of this Privacy Policy Statement and this PICS, so as to ensure that you understand their contents and implication before providing your personal data to us. By providing your personal data to us, you are deemed to have obtained the consent for using your personal data from your parents or such person(s) having parental responsibility for you.

If you provide us with personal data about another person, you represent and warrant to us that you have obtained all necessary consents from that other person to permit us to use that personal data as set forth herein.

Nothing in this PICS shall limit the rights of Data Subjects under the PDPO.

We understand the importance of protecting your personal data, and appreciate your confidence that we will respect personal privacy in a careful and sensible manner.

2. Type of personal data collected

Your name, month and year of birth, residential and/or correspondence and/or delivery address, email address, mobile phone number and gender;

Your credit/debit card details and/or other payment method details;

Your attendance or visit records and usage records of the Group’s premises, equipment, facilities and devices;

Your transaction records;

Your subscription records to e-newsletters,

Your skin type, skin condition, skin concerns, skincare consultation information, stratum corneum cell images and other images captured for AI-based skin analysis or similar skincare analysis services, and related analysis results, reports, charts, scores, indicators and recommendations generated from such services;

Where you participate in any audio recording programme, audio or voice recordings of conversations between you and the Group’s staff, transcripts of such recordings and related analysis results generated from such programme;

The method of how you first learn of the Group’s offerings;

Your correspondence with the Group (including but not limited to those via the Websites, Applications or emails, and content and records of comments and inquiries about the Companies);

Other information from your usage of our Websites, Applications and services, including computer and connection information, statistics on page views, traffic to and from our website and applications, advertisement data, IP address and standard web log information; and

Static or moving images or footages of you captured via our close circuit television (“CCTV”) surveillance system located across or within the vicinity of the premises of the Group.

We may also ask you to provide aforesaid personal data above when you use the Websites or Applications, including when you voluntarily register or update your existing profile with us, subscribe to catalogues or newsletters, email us, use our customer services, answer surveys, enter promotional opportunities, post on our social networks’ message boards, or make any other submissions to our Websites.

It is mandatory for you to provide your personal data during new member registration process at our retail stores via filling in the member registration form (whether electronically or otherwise) and/or through online retail via the Websites and the Applications. If you refuse to provide such personal data and/or provide incomplete or otherwise inaccurate personal data, it may prevent us from providing certain services to you, including but not limited to fulfilment of your request for last mile delivery service.

3. Purpose for which your personal data is collected

The Group uses Data Subject’s personal data for the following purposes:

To accept and process your requests or orders for the Group’s goods and services;

Administration of provision of the Group’s goods and services to individual customers and corporate customers;

To handle, receive, investigate and respond to customers’ and members’ comments, complaints and enquiries;

To manage services necessary for application, creation, operation and administration of memberships and records for customers and registering personal data and logging in with mobile phone number and/or email address and password in systems and applications operated by the Group;

To identify and verify the identity of the Group’s customers and members;
To notify Data Subjects of changes in the rules and information related to new products and services, such as targeted advertisements based on customers’ and members’ interests and concerns;

To provide notifications through various notification methods such as email, targeted advertisements based on customers’ and members’ interests and concerns, and other information related to the products and services of other companies recommended by the Group, as well as introductions to other businesses, etc.;

To compile customers’ and members’ statistics in relation to the use of the Group’s products and services with a view to promote and improve the quality of the same;

To analyze and produce statistical data for behavior-targeted marketing based on customers’ and members’ interests and concerns and other marketing, promotion, sales, and product and service planning implemented by the Group;

To administer and maintain the Websites, the Applications and diagnosing problems where necessary;

To make credit judgments, intermediate credit facilities, and debt management related to transactions with the Group;

To correctly grasp the opinions of customers and members, the content of consultations, and the content of contracts in order to improve the quality of the Group’s products and services;

To process billing and payment;

To carry out other business when the Group is so entrusted by other business operators;

Marketing purposes (including publication of customers’ and members’ statistics in relation to the use of the Group’s products and services on an anonymous basis on the Group’s public channels such as the Websites and Applications) and customer satisfaction surveys;

To keep track of and analyse purchases, transactions, consumption patterns, membership activity, and payment history;

To keep track of membership rewards points, privileges and benefits;

To provide information about the Group and our products and services, such as newsletters, events, promotions or contests;

To facilitate and monitor daily operation of the premises of the Group, and safeguard security, ensuring specifically the safety and security of all individuals on such premises, prevention, detection and/or reduction of crime, and for analysis and investigation purposes including investigation of legal claims and allegations, and health and safety related matters;

To ensure fulfilment of the Group’s contractual obligations;

To ensure compliance with applicable legal and regulatory requirements to which the Group is subject; and

Any other directly related purposes.

Note:

Job applicants and staff of the Group may refer to the specific personal information collection statement for job applicants and staff on the Group’s practices with respect to collection of their personal data.
In order to improve the quality of the Companies’ internal telephone reception service and to accurately grasp the content of inquiries, the Companies may record the content of the Data Subject’s telephone calls.

In relation to marketing purposes as set out in (15) above, the following data of an individual (natural person) user of a corporate customer shall not be disclosed or publicised: name, gender, age, address, HKID card number, any other personal identifiers, specific information on its use of the Group’s products and services and personal history.

Direct marketing

Subject to your consent, the Group may use your personal data to engage in and send communications that may be considered to be direct marketing/promotional material which are relevant to you, including but not limited to promotion of our new product and service offerings, e-newsletters, limited time deals, contract renewal and other services, updates or promotions. In this connection, please note that:

the personal data of a Data Subject as set out in paragraph 2 above of this PICS and held by the Group from time to time may be used by the Group in direct marketing;
the following classes of services, products and subjects may be marketed: (i) products and services of the Group, including but not limited to skincare products, cosmetics, makeup products, beauty supplements, body care products, makeup services, body care services, and beauty services; (ii) reward, loyalty or privileges programmes related to the products and services of the Group; and (iii) any other promotional activities related to the products and services of the Group; and

in addition to marketing the above aforesaid services, products and subjects, the Group may also provide the aforesaid data of a Data Subject to a third party reward, loyalty, co-branding or privilege programmes providers for use by them in marketing those services, products and subjects, and the Group requires the data subject’s written consent (which includes an indication of no objection) for that

We are required by law to give you the opportunity to not receive these communications. Please note that if you decided not to receive these communications, you may miss important information related to our product and service offerings, or benefits or offers that may impact on your experience as a customer and/or member of our Group.

If you do not wish the Group to use or provide to other persons your data for use in direct marketing as described above after opting-in, you may exercise your opt-out right by filling out an online form immediately below any direct marketing information for opt-out handling, notifying the Group in writing to 20/F, Tower 5, The Gateway, Harbour City, Tsim Sha Tsui, Kowloon, Hong Kong or by email at enquiry@fancl-hk.com.

4. Disclosure, transfer and provision of personal data to third parties

The Group will generally not provide or disclose personal data of a Data Subject held by the Group to external parties but, subject to the provisions of any applicable law and regulations, may be provided to the following parties and/or in any of the following cases:

Any party who owes a duty of confidentiality to the Group and is obliged to keep the personal data confidential;

Any employee, agent, independent contractor, joint venture partners, service providers or any other third party as necessary for the purposes stated above and any such ancillary purpose including provision of administrative, audit, data-processing, document management, technology, telecommunication, storage, payment, security, emergency, reward, loyalty, co-branding and privilege programmes or other services (including direct marketing services) to the Group in Hong Kong or elsewhere (“Ancillary Purposes”) under a duty of confidentiality to the same;
Organisations and/or institutions with which we jointly offer services or other collaboration opportunities, including but not limited to courier vendors and warehouse service vendors;

The holding company and/or shareholder(s) of the Group, or any persons or entities controlled or owned by them (each a “Related Company”) as necessary for the purposes stated above and any such Ancillary Purposes under a duty of confidentiality to the Group;
Our professional advisers such as lawyers, tax adviser, accountants and auditors;

Any person to whom the Group or the Related Company is under an obligation or otherwise required to make disclosure under the requirements of any law or regulation binding on or applying to the Group or the Related Company, or any disclosure under and for the purposes of any guidelines or guidance given or issued by any legal, regulatory, governmental, tax, law enforcement or other authorities, or self-regulatory or industry bodies or associations with which the Group or the Related Company are expected to comply, or any disclosure pursuant to any contractual or other commitment of the Group or the Related Company with local or foreign legal, regulatory, governmental, tax, law enforcement or other authorities, or self-regulatory or industry bodies or associations, all of which may be within or outside the Hong Kong and may be existing currently and in the future;

Any person in connection with any claims made by or against or otherwise involving the Data Subject in respect of any products or services of the Group;

Any actual or potential assignee, transferee, participant or sub-participant of our rights or business;

Consent of the Data Subject has been obtained; and

It is necessary to protect the physical or mental health and well-being of such Data

In the event of any suspected fraud or breaches concerning disclosure, transfer and provision of personal data to third parties, we shall take prompt and all appropriate measures to investigate and address such risks.

By providing personal data through the Websites, the Applications or otherwise to us, you expressly authorize us to use and disclose your information as described. Please do not proceed if you do not agree on the same.

5. Access to personal data and disclosure, correction, suspension of use, etc. of personal data

When a Data Subject requests access, disclosure, correction, suspension of use, etc. of his/her personal data held by the Group, the Group, subject to charging a handling fee, will comply with such request within a reasonable time limit upon ascertaining the identity of the requestor and assessment by the Group that it holds the relevant personal data.

However, the Group may refuse to comply with such data access request if:

It is not supplied with sufficient information to identify the requestor;

It cannot comply with the request without disclosing the personal data of a third party; and

Where compliance with the request is for the time being prohibited under all applicable laws and

For matters and questions regarding the access, handling, correction and disclosure of personal data of the Companies, as well as complaints and inquiries, etc., you may contact our Data Privacy Officer of Customer Relationship Management at 20/F, Tower 5, The Gateway, Harbour City, Tsim Sha Tsui, Kowloon, Hong Kong or by email at enquiry@fancl-hk.com.

6. Links to external websites

The Websites and Applications may contain links to external websites. The Group will do its best to protect the personal data of Data Subjects, but the handling of personal data by external websites is not within the scope of responsibility of the Group. The Companies does not assume any responsibility or legal liability for actions or services of such websites, including without limitation, their privacy statements and terms and conditions. You should carefully review the terms and conditions and privacy policies of all external websites that you visit. If you have any comments or inquiries about an external website, please contact the company that operates the external website.

7. Security measures

We take reasonable steps to make sure that the personal data we collect is protected from unauthorized access, disclosure, misuse or loss, and can only be accessed by authorized personnel. We will collect, use or disclose your personal data only with your knowledge and consent as set out in herein unless otherwise required or permitted by law.

Wehaveimplementedsecuritysafeguardsappropriatetothesensitivityoftheinformation,includingtheuseof the physical and electronic security measures. Physical security measures include implementation of restricted accessfacilitiesandappropriatedisposalofpersonaldata.

The Companies use a dedicated server protected by a firewall security system for management of personal data, and does its best to prevent unauthorized access and data leakage.

If the Group has a contract with another third party organization to provide a service on its behalf, the Group will ensure they have appropriate security measures and only process your information as the Group has authorized. Those organizations will not be entitled to use your personal information for their own purposes. The Group will take reasonable steps to check these organizations to make sure that they are meeting the security requirements as deemed acceptable by the Group.

8. Handling of Online Behavioural Tracking Information

Collection of Online Behavioural Tracking Information

The Group may collect the following information (hereinafter referred to as "Online Behavioural Tracking Information") from your device or system when you visit the Websites to help distinguish you from other customers of our products and services. This helps us to provide you with a tailor-made experience when you use our products and services and also allow us to improve our offerings.

Information that identifies the terminal (cookie information and other individual identification numbers of terminals)
Data Subject's usage environment (IP address, operating system and browser information, )
Records of Data Subject’s browsing history on the Websites, including traffic and time spent
Location information
Information collected regarding Data Subject’s interaction with the Websites, including but not limited to logged-on identity, items purchased and transactions performed

The Group may collect the Online Behavioural Tracking Information by cookies and other tools. Cookies are small text files containing small amounts of information which are downloaded and may be stored on any of your internet enabled devices. We may also use other technologies such as web beacons, which are small graphic files that contain a unique identifier that allows us to check whether you have accessed certain content. For the purpose of this PICS, all such technologies will be considered “cookies”. You may turn off or delete cookies by changing your browser's settings. Since these settings vary in different browsers and browser extensions, we cannot guarantee that the site would function properly in all circumstances. Note that you may need to clear your browser’s cookies, site data and cached web content (including offline content), then restart your browser for the changes to take effect. However, our services may not be effectively provided in the event you turn off or delete cookies, so it is recommended that cookies are allowed on your browser. By using our Websites without deleting or rejecting some or all cookies, you agree that we can place those cookies that you have not deleted or rejected on your device.

The Online Behavioural Tracking Information will not be combined with other information to track/profile Data Subjects. We only retain the Online Behavioural Tracking Information for the duration needed for the function they are used for.

Purpose of use of Online Behavioural Tracking Information

The purpose of use of Online Behavioural Tracking Information is as follows:

To confirm whether it is an access from the same customer or member in the service that requires login
To establish and maintain your logged-on identity for a certain period of time without requiring repeated logins
To remind members to enter their mobile phone number and/or email address and password again after a certain period of time to ensure the security
To provide Data Subjects with content, advertisements and information about various services about the Group and its commercial partners that are most suitable for the Data Subjects
To track your behaviour and preferences, record your use of our Websites and your responses to our online advertisements posted on our Websites as well as other social medial platforms to deliver personalized content to you, including advertisements relevant to your interests;
To enrich and improve the content of services and advertisements provided by the Companies and its commercial partners, or to conduct analysis and explore new services
To display the layout and information suitable for the Data Subject's use
Fraud prevention and detection

Use of Third-Party Data Processing Services for Behaviour-Targeted Advertising

The Companies may directly or indirectly transfer the Data Subject's Online Behavioural Tracking Information to a third-party data processor as set out below to deliver behavior-targeted advertisements based on the Data Subject’s interests and concerns. If you want us to stop sending the Online Behavioural Tracking Information to third parties, please see "Opting Out of Behavior-Targeted Advertising" below.

Opting Out of Behavior-Targeted Advertising

The Companies may work with third parties as set out below to research certain usage and activities on parts of our Websites on our behalf. These third parties may use technologies such as tracking tags and cookies to conduct such research. The information collected through such technologies by these third parties may be used to find out more about our customers and members, including number of the visitors, their behaviour and usage patterns, for more accurate reporting and to improve the effectiveness of our marketing. These third parties may also use such technology to understand the content with which you have engaged on our Websites so they may subsequently deliver some targeted advertisements to you. You should refer to such third parties’ own cookie and privacy policies at the following hyperlinks for information about how they may use your information, which also contain whether it is possible to opt out, instructions to opt out of their use and further processing of your data and consequences of opt out (including ceasing collection of your data for the specific purposes described, which may limit their ability to deliver targeted advertisements to you).

All of these links are external to the Group and so the Group is not responsible for the content of these links.