("PPS")

1.Your privacy

MTR Corporation Limited ("MTRCL", "we ", "our " or "us") respects your legal rights of privacy when collecting, storing, using, processing and transmitting Personal Data and this PPS explains our privacy practices. We are legally required to comply with the Personal Data (Privacy) Ordinance (Cap. 486) of the Laws of the Hong Kong Special Administrative Region when collecting, holding, using and/or processing your Personal Data. In doing so, we will ensure compliance by our staff to the strictest standards of security and confidentiality.

Please read the following carefully to understand our policy and practices regarding how your Personal Data will be collected, treated and processed. By providing your Personal Data to us, you are consenting to this PPS and the collection, use, transfer, storage and processing of your Personal Data as described in this PPS.

If there is any inconsistency between the English and Chinese version of this PPS, the English version shall prevail.

We adopt in this PPS the defined terms of the Terms of Use of the Lohas estate management office mobile application.

2.Collection of Personal Data

Depending on the types of services you provide to us and duties we assign to you, we may collect from you:

"Personal Data" means any personally identifying data which we may collect from you when you are using the EMO Mobile Application to fulfil your Duties to us , from which it is practicable for the identity of an individual to be directly or indirectly ascertained. This includes information about your location at a particular time when reporting duties to us through the Application.

The following are the common situations when we may collect and store your Personal Data, although these situations are not exhaustive:

registration for a staff or performing duties as a staff of our mall;

‧using and/or browsing our websites and/or mobile applications;

‧Reporting or fulfilling your Duties by scanning the QR code at a particular location or by posting, uploading, creating or otherwise generating any content and/or information, including any artistic, musical, literary, sound recording, film and/or any type of work on the Application; and

‧request for assistance in connection with your Duties and use of the Application.

3.Purposes for which we will use your Personal Data

The purposes for which we may use your Personal Data will vary depending on the type(s) of duties) assigned to you. Such purposes will be stated in the Personal Information Collection Statement (“PICS”), application form, terms and conditions, mobile application and/or webpage relevant to your provision of Personal Data to us. If you fail to supply the Personal Data required, you may be unable to accomplish your assigned duties.

We will not use or provide third parties your Personal Data for direct marketing without your consent.

4.Disclosure and Transfer of Personal Data

In cases where we do collect Personal Data from you, we will:

(i)tell you (by way of a PICS or by a separate notification) that we are doing so and any purpose of use that we will make of such Personal Data we collect; and

(ii)where relevant, give you the opportunity to object to particular use of your Personal Data.

We will take all practicable steps to keep your Personal Data confidential but we may disclose, transfer and/or assign such data to the following parties:

(i)if MTRCL decides to sell, merge and/or re-organise any part of its business, to any actual or proposed assignee, transferee or successor of or to MTRCL's rights in respect of your Personal Data;

(ii)any agent, adviser, auditor, contractor or third party service provider who provides administrative, telecommunications, computer, payment, fraud prevention, insurance, data processing and/or other services to us in connection with the operation of our business and/or the relevant duties that have been assigned to you from us, and/or who otherwise processes Personal Data for and on our behalf; and

(iii)any person (including without limitation government authorities, regulatory or administrative bodies or law enforcement agencies) to whom MTRCL is under an obligation to make disclosure under the requirement of any law binding on MTRCL or for the purposes of any guidelines or codes of practice issued by regulatory or other authorities with which MTRCL is expected to comply, or such parties who are authorized by law to request information from MTRCL.

We may also disclose and/or transfer your Personal Data in the manner as stated in the Personal Information Collection Statement and/or any terms and conditions relevant to our services or your assigned duties.

5.Security and Storage

Except as mentioned in paragraph 4 above, your Personal Data, however stored, will be accessed only by our employees or contractors who are authorised to do so. Where Personal Data is stored electronically, it will be kept on a secured server and will be encrypted and/or password-protected (or under some equivalent form of protection) and accessible only by authorised personnel of MTRCL or its contractors. The network transmission of Personal Data will also be protected by using the SSL protocol. Personal Data are treated as confidential information by MTRCL and all employees and contractors designated to handle Personal Data will be instructed to do so only in accordance with this PPS.

6.Use of Personal Data in legal proceedings

If it becomes necessary that we have to take action against you for any reason whatsoever including recovering from you any money you owe us, you expressly agree that the Personal Data provided by you can be relied upon in identifying and taking legal action against you.

7.Your right to access and correct Personal Data

You may at any time request access to and correct Personal Data relating to you in any of our records. You may also ask us to delete you or your Personal Data from any active mailing or distribution list. To exercise any of your rights, you could contact us at the address or email below marking your communication "Confidential ". In response, we may ask you to provide certain details about yourself so that we can be sure you are the person to whom the data refers. We are required to respond to your requests within 40 days. We may also charge you a reasonable fee for complying with any data access request.

Personal Data Privacy Officer

Any requests (i) for access to data or correction of data; (ii) for general information regarding our policies and practices with respect to Personal Data; and (iii) about the kinds of Personal Data that we hold; and/or general questions and complaints relating to this PPS should be addressed to the person below:

MTR Corporation Limited

Personal Data Privacy Officer

Legal – General Department

(Marked Confidential)

Address: MTR Headquarters Building

Telford Plaza, Kowloon Bay

Kowloon, Hong Kong

email: PDPO@mtr.com.hk

8.Retention of Personal Data

Personal Data provided by you are retained for as long as the purposes and any directly-related purposes for which such data were collected continue. Once it is not necessary to use the Personal Data to fulfil such purposes (and directly-related purposes), they are then destroyed within a reasonable time unless their retention is required to satisfy legal, regulatory or accounting requirements or to protect the MTRCL's interests.

This PPS is subject to change. Any changes will be posted in the Application. Your continued use of our mobile applications after the posting of such changes indicates your acceptance to the same.

July 2020