ORIX Asia Capital Limited ("ORIX")

CIRCULAR ("CIRCULAR") TO CUSTOMERS AND PERSONS ACTING AS GUARANTORS AND MORTGAGORS RELATING TO THE PERSONAL DATA (PRIVACY) ORDINANCE (THE "ORDINANCE")

1. Collection of Data

From time to time, it is necessary for customers (which term shall include individual customer and corporate customer and their shareholder, directors, managers, employees, sole proprietors, and partners) (collectively, "Customers"), persons providing guarantees or security in respect of a loan/mortgage/credit/hire purchase/ leasing facility ("Guarantors") or persons providing security in respect of a loan/other form of credit facility by way of a mortgage over property ("Mortgagors") to supply ORIX with their "Data" (as defined below) in connection with (i) the opening or continuation of accounts, (ii) the establishment or continuation of loan/mortgage/credit/ hire purchase/leasing facilities or other forms of credit, guarantee or security arrangements or (iii) the provision of financial and other services by ORIX (in this Circular, the particular financial services described in each of (i), (ii) and (iii) above are collectively referred to as "Financial Services"). It is also the case that Data are collected from Customers, Guarantors and Mortgagors in the ordinary course of the continuation of their financial relationship with ORIX, for example, when Customers write cheques or deposit money or otherwise carry out transactions as part of the ORIX's services. ORIX will also collect Data relating to Customers, Guarantors and Mortgagors from third parties, including third party service providers with whom Customers, Guarantors and Mortgagors interact with in connection with the marketing of ORIX's products and services and in connection with the customer's application for ORIX's products and services (including receiving personal data from credit reference agencies approved for participation in the Multiple Credit Reference Agencies Model (hereinafter referred to as "credit reference agencies")).

2. Purposes of Collection

"Data" means all or any of the following data and information relating to Customer, Guarantors or Mortgagors, where applicable: (a) personal data and account data (generated by ORIX in the course of operating the accounts of Customers, Guarantors, Mortgagors and/or borrowers and as such expression is defined in the Code of Practice on Consumer Credit Data (the "Code") issued by the Office of the Privacy Commissioner for Personal Data); (b) information about Customer, transaction, use of the ORIX' product and service and the Customer's relationship with ORIX Group Company (information other than personal data); and (c) tax information. Data will not be disclosed to any (including ORIX Group Company), other than where: (a) ORIX is legally required to disclose; (b) ORIX's legitimate business purpose require disclosure; (c) the disclosure is made with the Customer, Guarantors or Mortgagors consent; (d) it is disclosed as set out in according with this Circular. Failure to supply such Data may result in ORIX being unable to provide any Financial Services. Purposes for which Data relating to Customers, Guarantors or Mortgagors may be used are as follows:-

(i)the daily operation of Financial Services provided to them or a borrower (as the case may be);

(ii)conducting credit checks at the time of application for credit and at the time of regular or special reviews which normally will take place one or more times each year;

(iii)assisting other credit providers in Hong Kong approved for participation in the Multiple Credit Reference Agencies Model (hereinafter referred to as "credit providers") to conduct credit checks and collect debts;

(iv)creating and maintaining ORIX's credit scoring models;

(v)ensuring ongoing creditworthiness of Customers and/or Guarantors and/or Mortgagors;

(vi)designing financial services or related products;

(vii)marketing services, products and other subjects (please see further details in paragraph (3) below);

(viii)determining the amount of indebtedness owed to or by Customers and/or Guarantors and/or Mortgagors;

(ix)enforcing obligations of Customers and/or Guarantors and/or Mortgagors, including but not limited to collecting amounts outstanding from such Customers and/or Guarantors and/or Mortgagors;

(x)complying with obligations, requirements, recommendations, instructions or arrangements for disclosing and using data that apply to ORIX or any other member of the group of companies of which ORIX is a member (such member of the ORIX group of companies, an "ORIX Group Company") or with which it is expected to comply pursuant to:

(1)any present or future law binding or applying to it within or outside Hong Kong;

(2)any guidelines or guidance given or issued by any legal, regulatory, governmental, tax, law enforcement or other authorities, or self-regulatory or industry bodies or associations of financial services providers within or outside Hong Kong existing currently or in the future;

(3)any present or future contractual or other commitment entered into with local or foreign legal, regulatory, governmental, tax, law enforcement or other authorities, or self-regulatory or industry bodies or associations of financial services providers that is assumed by or imposed on ORIX or any of ORIX Group Company by reason of its financial, commercial, business or other interests or activities in or related to the jurisdiction of the relevant local or foreign legal, regulatory, governmental, tax, law enforcement or other authority, or self-regulatory or industry bodies or associations;

(4)internal operational requirements of the ORIX or ORIX Group Company (including without limitation, credit and risk management, system or product development and planning, audit and administrative purposes;

(xi)complying with any obligations, requirements, policies, procedures, measures or arrangements for sharing data and information with other ORIX Group Companies and/or any other use of data and information in accordance with any group-wide programs for compliance with sanctions or prevention or detection of crime, money-laundering, terrorist financing or other unlawful activities;

(xii)enabling an actual or proposed assignee of ORIX (including without limitation any person with whom it is proposed ORIX will merge or to whom ORIX proposes to dispose of all or any part of its business) or participant or sub-participant of ORIX's rights in respect of Customers and/or Guarantors and/or Mortgagors to evaluate the transaction intended to be the subject of the assignment, merger, disposal, participation or sub-participation;

(xiii)the processing of applications for banking, credit and other services and facilities;

(xiv)performing financial crime risk management activity adopted by ORIX and ORIX Group Company;

(xv)maintaining the ORIX's or ORIX Group Company's overall relationship with the Customer, Guarantor or Mortgagor;

(xvi)any purposes directly relating or incidental to the purposes listed above, and ORIX may carry out "matching procedures" (as such expression is defined in the Ordinance) in respect of all or any of such purposes.

3. Direct marketing

ORIX wishes to use the Data of Customers, Guarantors and Mortgagors for direct marketing in the manner provided in this paragraph - permission to use Data for this purpose is voluntary only. ORIX must obtain a Customer, Guarantor or Mortgagor's written consent (which can include an indication of no objection) if it is to use Data for this purpose. ORIX may not use the Data for direct marketing unless it has received written consent from relevant Customers, Guarantors or Mortgagors. In this connection:

(i)the name, contact details (such as phone number or address), products and services portfolio information, transaction pattern and behaviour, financial background and demographic data of a Customer, Guarantor or Mortgagor held by ORIX from time to time may be used by ORIX for direct marketing;

(ii)the following classes of services, products and subjects may be marketed:

(1)ORIX's Financial Services;

(2)insurance, general credit and banking related products;

(3)reward, loyalty or privileges programmes and related services and products;

(4)services and products offered by ORIX's co-branding partners (the names of such co-branding partners can be found in the application form(s) for the relevant services and products, as the case may be); and

(5)donations and contributions for charitable and/or non-profit making purposes;

(iii)the above services, products and subjects may be provided or (in the case of donations and contributions) solicited by ORIX and/or:

(1)any ORIX Group Company:

(2)any third party, such as insurer, financial institution with whom ORIX has a partnership to market the services, products and subjects described in paragraph 3(ii) above;

(3)third party reward, loyalty, co-branding or privileges programme providers;

(4)co-branding partners of ORIX and ORIX's group companies (the names of such co-branding partners can be found in the application form(s) for the relevant services and products, as the case may be) and

(5)charitable or non-profit making organisations;

(iv)in addition to marketing the above services, products and subjects, ORIX wishes to provide the data described in paragraph 3(i) above to all or any of the persons described in paragraph 3(iii) above for use by them in marketing the same or similar services, products and subjects, and ORIX must obtain the written consent of Customers, Guarantors and/or Mortgagors (which includes an indication of no objection) for that purpose written consent can be given in the Request Form (as defined below); and

(v)ORIX may provide the data described in paragraph 3(i) above to the other persons in paragraph 3(iv) above for gain and, when requesting the Customer, Guarantor or Mortgagor's consent or non-objection as described in paragraph 3(iv) above, ORIX will inform such Customer, Guarantor or Mortgagor if it will so provide such data to the other persons for gain;

To indicate consent / no consent to the use / provision of his/her personal data for direct marketing, a Customer, Guarantor or Mortgagor is required to fill out an "Opt-out Request - Use/Provision of Personal Data in Direct Marketing" ("Request Form").

If a Customer, Guarantor or Mortgagor does not wish ORIX to use his/her data or provide his/her data to other persons for use in direct marketing as described above and also wants ORIX to advise those other persons to stop using his/her data for direct marketing, he/she may say so in the Request Form or notify ORIX of the same at any other time.

4. Classes of Possible Transferees

Data (including mortgage loan data) held by ORIX relating to Customers, Guarantors or Mortgagors will be kept confidential except that ORIX may provide such information to the following parties (whether within or outside Hong Kong) for the purposes set out in paragraph 2 above:-

(i)any person to whom ORIX or any ORIX Group Company is under an obligation or is otherwise required to make disclosure under the requirements of any law, rule, regulation or court order binding on or applying to ORIX or such ORIX Group Company or any disclosure under and for the purposes of any guidelines or guidance given or issued by any legal, regulatory, governmental, tax, law enforcement or other authorities, or self regulatory or industry bodies, or associations of financial service providers with which ORIX or any ORIX Group Company is expected to comply, or any disclosure pursuant to any contractual or other commitment of ORIX or any ORIX Group Company with local or foreign legal, regulatory, governmental, tax, law enforcement or other authorities, or self-regulatory or industry bodies or associations of financial services providers, all of which may be within or outside Hong Kong and may be existing currently and in the future;

(ii)any person with the express or implied consent of a Customer and/or Guarantor and/or Mortgagor;

(iii)any person where the interests of ORIX require disclosure;

(iv)any person where the public interest requires disclosure;

(v)any agent, contractor or third party service provider who provides administrative, telecommunications, computer, payment, debt collection or securities clearing or other services to ORIX in connection with the operation of its business and the provision of Financial Services;

(vi)external service providers (including but not limited to mailing houses, telecommunication companies, telemarketing and direct sales agents, call centres, data processing companies and information technology companies) that ORIX engages for the purposes set out in paragraph (2)(vii) above.

(1)any ORIX Group Company;

(2)third party financial institutions, insurers, credit card companies, securities and investment services providers;

(3)third party reward, loyalty, co-branding or privileges programme providers;

(4)co-branding partners of ORIX and ORIX's group companies (the names of such co-branding partners can be found in the application form(s) for the relevant services and products, as the case may be);

(5)charitable or non-profit making organisations; and

(vii)any other person under a duty of confidentiality to ORIX including any ORIX Group Company which has undertaken to keep such information confidential;

(viii)any financial institution with which a Customer, Guarantor or Mortgagor has or proposes to have dealings;

(ix)any actual or proposed assignee of ORIX of participant or sub-participant or transferee of ORIX's rights in respect of a Customer and/or Guarantor and/or Mortgagor including, without limitation, to The Hong Kong Mortgage Corporation Limited ("HKMC") or such other person as may be required or necessary pursuant to contractual arrangements with HKMC in respect of the sale of mortgages or other security by ORIX;

(x)banks of drawers of cheques made payable to a Customer, Guarantor or Mortgagor, for the purpose of confirming to such drawers that payment to the relevant Customer, Guarantor or Mortgagor under such cheques has been made;

(xi)credit reference agencies (including the operator of any centralized database used by credit reference agencies), and in the event of default, debt collection agencies;

(xii)any other person with whom ORIX proposes to merge or to which ORIX proposes to dispose of all or any part of its business; and

(xiii)provided the relevant Customer, Guarantor or Mortgagor has agreed as provided for in paragraph 3 above, any person to whom such Customer, Guarantor or Mortgagor has agreed ORIX may transfer his/her Data for the voluntary purpose of direct marketing.

5. Specific Provisions on Data relating to Mortgage Loans

(i)Mortgage data collected: Of all the Data which may be collected or held by ORIX from time to time in connection with mortgages, the following data relating to a Customer as borrower, or to a Guarantor or Mortgagor (including any changes to any of the following data) may be provided by ORIX, on its own behalf and/or as agent, to credit reference agencies:

(1)mortgage account general data: (a) full name; (b) capacity in respect of each mortgage (as borrower, mortgagor or guarantor); (c) Hong Kong Identity Card Number or travel document number; (d) date of birth; (e) address; (f) mortgage account number in respect of each mortgage; (g) the type of the facility in respect of each mortgage; (h) mortgage account status in respect of each mortgage (such as active, closed, written-off); and (i) if any, mortgage account closed date in respect of each mortgage;

(2)mortgage application data; and

(3)where there is any outstanding default in payment for a period in excess of 60 days in relation to the mortgage loan, default data relating to such default.

(ii)Mortgage data sharing: Credit reference agencies will use the mortgage account general data supplied by ORIX for the purposes of compiling a count of the number of mortgages ("Mortgage Count") from time to time held by the relevant Customer as borrower, or relevant Mortgagor or Guarantor respectively with all credit providers in Hong Kong (including ORIX), and whether in his sole name or in joint names with others, for the sharing of such data in the consumer credit database of credit reference agencies by credit providers (subject to the requirements of the Code of Practice on Consumer Credit Data approved and issued under the Ordinance).

(iii)Access to Mortgage Count: ORIX is entitled to access the Mortgage Count of Customers, Mortgagors and Guarantors through a credit report for the purposes of any of the following:

(1)considering an application for a grant of a mortgage loan to a Customer or another person for whom that Customer will act as mortgagor or guarantor or to the Mortgagor or Guarantor or another person for whom either of them will act as mortgagor or guarantor; or

(2)reviewing and renewing existing mortgage loans to a Customer or another person for whom that Customer will act as mortgagor or guarantor or to the Mortgagor or Guarantor or another person for whom either of them will act as mortgagor or guarantor, or

(3)carrying out a review under the circumstances mentioned in (a)-(c) below: (a) reviewing existing credit facilities currently in default for a period of more than 60 days, with a view to putting in place a loan restructuring arrangement between ORIX and a Customer or Mortgagor or Guarantor; or (b) reviewing existing credit facilities where there is in place a loan restructuring arrangement between ORIX and a Customer, Mortgagor or Guarantor (whether or not other parties are also involved), for implementation of the said arrangement by ORIX; or (c) reviewing existing credit facilities, with a view to putting in place a scheme of arrangement with the Customer initiated by a Customer, Mortgagor or Guarantor.

(iv)Right to request to delete mortgage data: Customers, Mortgagors and Guarantors have the right under and in accordance with the Code to instruct ORIX to request the credit reference agency to delete from its database any account data and mortgage account general data relating to any terminated account.

6. Default in Repayment

In the event of default in repayment of any consumer credit/ hire purchase/lease facility/loan/mortgage, unless the amount in default is fully paid or written off (otherwise than due to a bankruptcy order) before the expiry of 60 days from the date which such default occurred, the relevant Customer and/or the Guarantor and/or the Mortgagor shall be liable to have his/her account repayment data and data relating to mortgage loans (if applicable) retained by credit reference agencies until the expiry of 5 years from the date of final settlement of the amount in default. Account repayment data include amount last due, amount of payment made during the last reporting period (being a period not exceeding 31 days immediately preceding the last contribution of account data by ORIX to the credit reference agency), remaining available credit or outstanding balance and default data (being amount past due and number of days past due, date of settlement of amount past due, and date of final settlement of amount in default lasting in excess of 60 days (if any)).

If any amount is written off due to a bankruptcy order being made against a Customer and/or Guarantor and/or Mortgagor, such individual shall be liable to have his/her account repayment data and data relating to mortgage loans (if applicable) retained by credit reference agencies, regardless of whether the account repayment data or data relating to mortgage loans (if applicable) reveal any material default (ie. a default in payment for a period in excess of 60 days), until the earlier of the expiry of 5 years from the date of final settlement of the amount in default or the expiry of 5 years from the date of the individual's discharge from bankruptcy as notified to credit reference agency(ies) by such individual with evidence.

7. Termination of Account by Full Repayment

Where consumer credit is applied for, upon termination of the account by full repayment by a Customer and/or borrower and/or Guarantor and/or Mortgagor and on condition that there has not been, within 5 years immediately before account termination, any material default (namely, a default in payment for a period in excess of 60 days) on the account, the Customer and/or Guarantor and/or the Mortgagor will have the right to instruct ORIX to make a request to the credit reference agency to delete from its database any account data relating to the terminated account and any data relating to mortgage loans (if applicable).

8. Access to a credit report for considering credit application

ORIX may obtain credit report(s) on a Customer, a Guarantor, or a Mortgagor from credit reference agencies in considering any application for credit. If the Customer, the Guarantor or the Mortgagor wishes to access the credit report(s), ORIX will advise the contact details of the relevant credit reference agency(ies).

9. Access to consumer credit data for purposes of review

Furthermore, for the purpose of the review of existing consumer credit facilities ORIX may from time to time access the consumer credit data of a Customer and/or Guarantor and/or Mortgagor held with a credit reference agency(ies) so as to facilitate ORIX's consideration of all or any one or more of the matters specified below:

(i)an increase in the credit amount;

(ii)the curtailing of credit (including, without limitation, the cancellation of credit or a decrease in the credit amount); and

(iii)the putting in place or the implementation of a scheme of arrangement with the Customer and/or Guarantor and/or Mortgagor.

10. Right of Access and Correction

Under and in accordance with the terms of the Ordinance and the Code, any individual has the following rights:-

(i)to check whether ORIX holds data about him/her and the right of access to such data;

(ii)to require ORIX to correct any data relating to him/her which are inaccurate;

(iii)to ascertain ORIX's policies and practices in relation to data and to be informed of the kind of personal data held by ORIX; and

(iv)in relation to consumer credit, to request to be informed which items of data (including data relating to mortgage loans (if applicable)) are routinely disclosed to credit reference agencies or debt collection agencies, and be provided with further information to enable the making of an access or correction request to the relevant credit reference agency(ies) or debt collection agency(ies).

In accordance with the terms of the Ordinance, ORIX has the right to charge a reasonable fee for the processing of any data access request.

11. Data Protection Officer

For the purposes of paragraphs 3 and 10 above, the person to whom (i) consents, objections and opt-outs in relation to the use or provision of personal data for direct marketing and (ii) requests for access to data or correction of data or for information regarding policies and practices and kinds of data held, are to be addressed is as follows:-

The Compliance Officer
ORIX Asia Capital Limited
3206-08, 32/F, Two Exchange Square,
8 Connaught Place, Central,
Hong Kong
Telephone: 2867 6000

12. Nothing in this Circular shall limit the rights of Customers, Guarantors or Mortgagors under the Ordinance.

If there is any inconsistency or conflicts between English and Chinese version, the English version will prevail.

Jun 2025