Personal Information Collection Statement 

This Statement applies to the collection, use, handling and processing of personal data by The Mills Limited (“Company”, “we” or “us”).

This Statement applies to the personal data provided by or for you to us from time to time (“Your Personal Data”), and sets out the purposes for which Your Personal Data may be used and other matters required under applicable personal information protection laws and regulations.

The provision of Your Personal Data is on a voluntary basis; however, if you choose not to supply Your Personal Data, we may be unable to serve you or to continue to serve you.

Use of Your Personal Data

1. We may use Your Personal Data for one or more of the following purposes from time to time:

• to process your application or request for services, products, facilities or privileges;
• to provide services, products, facilities or privileges to you, and handle the necessary arrangements and matters (including legal, administrative and other matters) for maintaining and managing such services, products, facilities or privileges;
• to verify your identity and accuracy of Your Personal Data in our records;
• to calculate any amount payable by you or to you in connection with the relevant services, products, facilities or privileges;
• to collect or recover any amount due from you;
• to enforce the terms of any contract or arrangement between you and us and to take suitable action to protect or preserve our rights or benefits;
• to communicate with you and for overall relationship management and maintenance;
• to investigate, handle and respond to any comments, messages, requests, enquiries, complaints or incidents made by you, made against you or involving you in any manner;
• to design, arrange, provide or procure services, products, facilities, privileges, activities or events for you or for customers generally;
• to conduct survey, research and analysis (including any analysis on usage trends);
• to improve our website and enhance user experience;
• where your consent has been given for direct marketing purposes, to send you promotional materials, newsletters, or updates about products and offers or otherwise market or promote services, products, offers and facilities of the Company, our holding companies, subsidiaries, affiliates or associated companies (each, a “Group Member”) or any business partner or selected company that has made any co-branding or cooperative arrangement with any Group Member or with us (each, a “Group Partner”), please see further details in “Use of Your Personal Data in Direct Marketing” section below;
• to comply with any obligations or requirements for using or disclosing personal data that are imposed on us by any law or regulations, or by any governmental agency, regulatory authority, law enforcement agency, court or judicial body, whether in or outside of Hong Kong, existing currently or in the future;
• to comply with any policies and measures for using or disclosing personal data implemented by us for prevention or detection of money laundering, terrorist financing or other unlawful activities;
• to match or compare Your Personal Data held by us from time to time in order to or intending to produce or verify data which may be used for taking adverse action against you;
• (where we believe in good faith that use or disclosure of personal data is necessary) to protect our rights or properties, or to identify, contact or bring legal action against any person who may be causing damage to or interference with our rights or properties (whether intentionally or otherwise), or when any other person could be harmed by such activities;
• to enable actual or potential purchasers or assignees of our Company, business or assets (or any part of them) to evaluate the purchase or assignment in question; and/or
• to fulfill other purposes directly related to any of the above purposes or any other purpose for which you have expressly provided your consent.

Disclosure and Transfer of Your Personal Data

1. We will keep Your Personal Data confidential but may disclose or transfer Your Personal Data to one or more of the following classes of persons from time to time for the purposes set out in paragraph 1 above:

• any Group Member in connection with our website, the provision of services, products, facilities or privileges, or our business or operations in general;
• any agent, sub-agent, supplier, contractor, sub-contractor or service provider (including their employees, directors, officers, agents and service providers) who provide services or support to us in connection with our website, any service, product, facility or privilege offered or procured by us, or with our business or operations in general. These services or support may include sales and marketing, data storage, data processing, data mapping, administrative, telecommunications, or computer services;
• any person to whom we are under any obligation or requirement to disclose personal data in compliance with law, regulation or court order, or in response to lawful request by any governmental agency, regulatory authority, law enforcement agency, court or judicial body;
• any person we believe in good faith that disclosure is necessary for (including but not limited to) protection of our rights or properties, or to identify, contact or bring legal action against any person who may be causing damage to or interference with our rights or properties (whether intentionally or otherwise), or when any other person could be harmed by such activities;
• any person to whom we are required to disclose personal data by any policies and measures implemented by us for prevention or detection of money laundering, terrorist financing or other unlawful activities;
• accountants, auditors, legal advisers and/or other professional advisers who owe a duty of confidentiality to us; and/or
• any actual or potential purchaser or assignee of our Company, business or assets (or any part of them).

3. Your Personal Data may be transferred within or outside of Hong Kong to any of the above-mentioned persons. In particular, for the purposes described in paragraph 1 above, Your Personal Data may be transferred to third-party service providers and/or stored in servers located outside Hong Kong, Such server locations may change from time to time due to cloud-computing arrangements. In these jurisdictions, there may not be in place data protection laws which are substantially similar to, or serve the same purposes as, those of Hong Kong. In those circumstances, Your Personal Data may not be protected to the same or a similar level as in Hong Kong. We will implement appropriate safeguards (such as contractual protections and/or technical or organisational measures) in accordance with applicable laws with an aim to ensure that Your Personal Data is afforded a level of protection consistent with applicable data protection requirements.

                  
Use of Your Personal Data in Direct Marketing

4. We intend to use Your Personal Data in direct marketing and require your consent for this purpose. Please note the following:
   • Types of personal data to be used
     We may use the following types of Your Personal Data that is held by us from time to time in direct marketing:
     • your name, address, telephone number, email address and other contact information;
     • pattern and behaviour relating to your use, purchase or consumption of services, products and facilities (including services and products portfolio information, and spending habits); and
     • your demographic data.
   • Classes of goods, services, products and subjects to be marketed
     We may market one or more of the following classes of goods, services, products and subjects:
     • goods, services and products, including but not limited to those related to medical and pharmaceutical services and products, healthcare, fine dining, clothing and apparel, fashion and accessories, footwear, culture, lifestyle and leisure products, amenities and entertainment, travelling series, sports, toys and children goods, beauty and personal care, dental, groceries, supermarkets, delicatessen and convenience stores, books and magazines, home furnishing, electrical appliances, audio and video products, optical products, jewellery, watches and luxurious goods; and
     • loyalty/membership/privilege programmes, promotion events, apps, games, workshops, promotions, offers, discounts, activities, memberships, rewards, environmental, social and governance initiatives.
   • Providers of goods, services, products and subjects to be marketed
     The above goods, services, products and subjects may be provided by one or more of the following classes of persons singly or jointly:
     • The Company;
     • Group Members; and
     • Group Partners (and the names of these Group Partners can be found in the application form or information leaflet relating to the relevant goods, services, products and subjects). Group Partners may include tenants and licensees of the Company or any Group Member, retail merchants, suppliers, service providers, charitable bodies and non-profit making organizations.

Choice relating to Direct Marketing

5. You have the right to withdraw or give consent to our use of Your Personal Data in direct marketing at any time. Please notify us in the manner as set out in “Contact Us” section below or by such other methods as may be specified by us from time to time.

Data Access and Correction Requests

6. You have the right to request access to and correction of Your Personal Data in accordance with the Personal Data (Privacy) Ordinance and/or other applicable laws. To enable us to process your request, you may be asked to provide certain details about yourself so as to ensure you are the person to whom the data refers. There may be a reasonable charge for a data access request to cover our administrative costs and disbursements. You will be informed in advance of the charge. Please send your data access and/or data correction requests in the manner set out in the “Contact Us” section below.

Contact Us

7. If you wish to exercise any rights relating to Your Personal Data held by us or have any enquiries regarding our privacy policies and practices, please contact our Data Protection Officer by email at dpo@nanfung.comor write to 17th Floor, AIRSIDE, 2 Concorde Road, Kai Tak, Hong Kong and mark for his attention.

Changes to this Statement

8. This Statement is effective from the date stated below. We may revise this Statement from time to time. Please check our website for the most recent version. By continuing to interact with us after such changes, you agree to the updated Statement and our processing of Your Personal Data will be governed by the most recent version of this Statement in effect.

English Version Prevails

9. In case of discrepancies between the English and Chinese versions of this Statement, the English version shall apply and prevail.

Last updated: September 2025