Privacy Policy

Statement of Policy

The protection ofour clients’ interests and the security and confidentiality of our clients’ information is at the heart of what we do. We will protect your personal data as a core value and principle of our practice.

• Personal Information: Name, email, or details you submit through forms
• Usage Data: Pages visited, device/browser info, time spent on site
• Cookies: To improve performance and user experience

Statement of Practices

Personal Data Collection:

This Statement applies to personal data CM collects from:

• visitors or people who contact us through our website
• individuals or representatives of companies or other businesses who receive our services; and
• individuals or representatives of suppliers and service providers to CM.

The types of personal data collected by CM include:

• your name, address,email address, telephone number, date of birth, and other contact information;
• your country of nationality or citizenship, and other identification information provided by government authorities;
• your securities account, bank account, utility info, credit card or other similar financial data;
• audio recordings of yourvoice in client phone communications with CM and
• your IP address orunique device identifiers in online engagement with CM.

Provision of the personal data is completely voluntary, however, failure to provide requested personal data may result in CM being unable to process your request or provide you services. Please provide us with accurate, complete and up-to-date information. If the personal data you provide us is inaccurate or incomplete, it may adversely affect how we provide you relevant services.

Use of personal data:

Personal data willbe collected only for lawful and relevant purposes.

Your personal data may be used for one or more of the following purposes:

• providing services to clients;
• reviewing and responding to any queries or complaints from clients or prospective clients;
• engaging and onboarding new clients;
• ongoing monitoring of existing clients;
• researching, designing and marketing products and services for clients or prospective clients, including considering client preferences, suitability, and please see the section on direct marketing below;
• managing, monitoring and assessing the performance of any third-party supplier or service provider who provides administrative, telecommunications, information technology, payment or other services to CM in connection with the conduct of its business;
• performing various activities for the management and conduct of the business of CM, including risk management, client relationship management, credit control management, business research and analysis, and other similar legitimate business purposes;
• complying with legal and regulatory obligations (including anti-money laundering obligations) of CM, including responding to any legal, regulatory orgovern mental investigation, action or proceeding;
• exercising,enforcing or defending legal rights of CM or for the purpose of legal proceedings;
• preventing and responding to actual or potential security threats, fraud or illegal activities;
• other purposes directly related to any of the above.

We may also obtain your personal data in the course of providing you with our services or conducting our business, including from other publicly available sources (suchas media providers, LinkedIn and similar social media platforms, and public registries).

Your personal datawill generally be kept confidential and will not be disclosed to any otherperson without your consent, except for the purposes notified in this Statementfor which your personal data was collected.
Personal datacollected by us may not be used for other purposes, unless:

• you have express lygiven your consent to use for the relevant other purposes;
• the purpose isdirectly related to the purpose for which the personal data was collected; or
• we are permitted to use the personal data for other purposes arising from an exemptionor otherwise in accordance with applicable law and regulation.

Retention:

Your personal datawill be retained by CM for seven years. We may retain your personal data for alonger period if it is necessary for us to do so to comply with our contractualor legal obligations, or you have consented to our continued retention of it.

We will periodicallyreview the personal data we have collected so that only your relevant personal data is retained to satisfy our retention requirements. This will typically belimited to information for:

• record-keeping for statutory purposes; and
• any ongoing contractual or legal obligation.If we believe personal data, which we hold is no longer necessary for permitted purposesprior to the expiry of the permitted retention period and will not be used forthose purposes, then we will take steps to erase the data. At the end of theretention period for any physical document containing your personal data, the documents will be shredded or otherwise destroyed to ensure the confidential and secure destruction of the documents.

We will engage reputable service providers for the confidential and secure destruction of softcopy of the documents containing your personal data and will ensure that theservice provider commits to apply appropriate security protection in itsservices (either by contract in its terms of engagement, or by verification bythe firm of the standards and processes of the service provider).

Security:

CM will take allpracticable steps to ensure security of the personal data and to avoidunauthorized or accidental access, erasure, or other use. CM applies strictmeasures to safeguard the confidentiality of personal data, according to itsPersonal Data Protection Policy. We limit access to your personal data topeople working for us on a business need to know basis, who shall ensure thatyour personal data is protected against unauthorized or accidental access, processing, erasure, loss, or use. In case of a personal data breach, we will notify the Privacy Commissioner for Personal Data (PCPD) without unreasonable delay if the breachposes real risk of harm, per PDPO requirements.

Cookies:

We may record your visit automatically through cookies. Cookies are small data structures sent to your computer to record your visit to our website and to identify you during your future visits. These cookies may be saved permanently in your computer. You may disable these cookies, but thismay affect your browsing of our website. The types of data collected by us through cookies include the browser type and version, the operating system, the IP address, and the domain name of the server. This information collected from you may only be used to compile general statistics in relationto the number of visitors to our website and the usage of our website. We may use cookies to show you subtly tailored content on our site of things we think you might be interested in. Most web browsers automatically accept cookies, but if youprefer, you can edit your browser options to block them in future. Please be reminded that, by continuing to use our website without notifying us of you rrefusal to use cookies or withdrawing your consent, you agree to our use of cookies. The cookie is used to control the repeated display of a pop up during a user’s visit on the website. It is used to remember if a popup is clicked so that it does not display again within 1 month of the same user’s visit.

Transfer of Personal Data:

We may dis close your personal data without your consent to these persons:

• employees, officers, consultants, individual contractors, interns, and directors of CM;
• holding companies, subsidiaries, affiliates, associated companies, companies under common control of CM or any other entity in the CM group of companies from time to time;
• service providers of CM, including third parties providing services in respect offinancial services, compliance, administration, human resources, telecommunications, information technology (including cloud services), data analytics, data entry and processing, and other service providers engaged by CM in the course of providing services to you or for the legitimate conduct of it sbusiness;
• professional advisors of CM including lawyers, notary public, corporate secretary, accountants, tax and financial advisors;
• financial institutions including banks, insurers, brokers and dealers, fund managers,rating agencies, money lenders, and other dedicated research firms and advisorsin the finance industry; and
• co-brandingpartners or business partners of CM.

Exceptfor these people or if CM is to do so by applicable laws or regulations, CMwill not disclose your personal data to any other person without your consent.

Some persons to whomwe transfer your personal data may be located outside Hong Kong, in locationsthat may not have in place data protection laws which are substantially similarto Hong Kong. We shall take appropriate measures to ensure that thetransmission or transfer of such Personal Data will be proceeded withappropriate safeguards pursuant to the Personal Data (Privacy) Ordinance andother relevant laws.

Direct marketing:

Upon obtaining ofyour consent, we may transfer your personal data for direct marketing purposesto the persons stated in the “Transfer of Personal Data” section of thisStatement”.

If you consent, wemay use the following types of personal data for direct marketing:

• yourname;
• your email address;
• your telephone number; and
• your address.

The direct marketingactivities we intend to conduct using your personal data are:

• providing servicesto clients;
• reviewing and responding to any queries or complaints from clients or prospective clients;
• engaging and onboard new clients;
• researching, designing and marketing products and services for clients or prospective clients, including considering client preferences and suitability;
• performing various activities for the management and conduct of the business of CM,including risk management, client relationship management, credit control management, business research and analysis, and other similar legitimate business purposes;
• complying with legal and regulatory obligations (including anti-money laundering obligations) of CM, including responding to any legal, regulatory orgovernmental investigation, action or proceeding;
• other purposes directly related to any of the above.

You may in the future withdraw your consent tothe use your personal data for direct marketing by contacting our Data Privacy Officer by email at info@centuriamgroup.com. Withdrawal is free and effectiveup on notice to our Data Privacy Officer. We honour "do-not-market" requests and suppress your data accordingly.

Access and correction of personal data:

You have the right, subject to certain exemptions:

• to request a copy of your personal data held by CM; and
• after a data access request has been fulfilled, to also request CM to make necessary corrections inrespect of any personal data that you consider in accurate. CM may refuse a data correction request if CM believes the personal data is accurate, an expression of opinion or the proposed correction is in accurate. If you wish to access or correct your personal data, please contact our Data Privacy Officer by email at info@centuriamgroup.com, or by post to:

DataPrivacy Officer

CenturiamLimited

Unit 808, 8/F, K11ATELIER Victoria Dockside, 18 Salisbury Road
Tsim Sha Tsui, Kowloon, Hong Kong CM reserves theright to charge a reasonable fee for processing any access or correction request. CM may revise this Statement from time to time. You should check this page from time to time to take notice of any changes.This Statement doesnot create or confer upon any individual any rights or impose upon CM any rights or obligations outside of, or in addition to, any rights or obligations imposed by applicable privacy laws. If there is any in consistency between this Statement and applicable privacy laws, this Statement will be interpreted to comply with the applicable privacy laws.

This Statement was last updated in March 2026.