Effective Date: [April 1, 2024]

SHANGHAI COMMERCIAL BANK LIMITED

OVERSEAS INTERNET BANKING PRIVACY POLICY

Introduction

Shanghai Commercial Bank Limited (the "Bank" or "we" or "our") may collect information through our website, Overseas Internet Banking ("OIB"), with an address of https://www3.shacombank.com.hk/us-inb ("the Website"). This document explains our policy regarding any personal information you might supply to us when you visit the Website, register with OIB and utilize any products or services via OIB, and describes how we may collect, use, and disclose your personal information when you use the Website (the "Privacy Policy"). Such personal information may include, but is not limited to, information such as your name, company, address, other contact information, or any other information needed to provide a service that you have requested, as well as information that may be automatically collected by your browser or computer, such as the IP address from which you are accessing the Website and certain activity on the Website ("Personal Information," which is further described and defined below). This Privacy Policy applies to customers or former customers who use our banking products and services via the Website. Information is collected on the use of the Website from users of the Website that are customers of the Bank and using the Bank's products and services via the Website ("Users" or "you" or "your").

The Bank respects the privacy of its Users and takes measures to protect its Users' information. We will maintain your Personal Information as well as your business activities and transactions in accordance with this Privacy Policy.

Data Collection and Usage

In connection with your use of the Website, we may collect Personal Information as described below. In addition, we may collect information regarding your use of the Website through the use of cookies (described below).

The Bank collects Personal Information from Users of the Website only if Users provide such information voluntarily for such purposes as registering for the use of certain services or the use of the Website's banking products or services.

Personal Information may include but not limited to:

• your first and last name
• your email address
• your city, state, and zip code
• your birthday
• company
• phone number(s)
• social security number
• information from a consumer report
• information that may be automatically collected by your browser or computer, such as through "cookies," web beacons or the IP address from which you are accessing the Website and certain activity on the Website. (For more details about this type of data collection, please refer to the sections below on cookies and web beacons.)
• information about you resulting from any transaction involving a financial product or service between you and the Bank
• any other information that you otherwise decide to provide to us in connection with the Bank providing a financial product or service to you

Personal Information collected or held by the Bank is kept confidential and the Bank does not use Users' Personal Information for any purposes other than those already specified to Users herein or in our notice, "Our Privacy Notice & Important Information Regarding Your Privacy," or unless such usage is permitted or required by law, regulations, subpoena, warrant, court order, other legal process, or by government agencies or law enforcement.

To protect your security and privacy, we require that individual users (as opposed to a third party on their behalf) enter the Personal Information that we collect and that the information be current, although the Bank disclaims any legal duty to verify the accuracy of any Personal Information that you provide to the Bank. You may request access to the Personal Information we have on file by contacting your local branch.

Cookies

When you access the internet, the computers that host websites you visit automatically receive some anonymous information. This "usage data" may include a record of a browser type, which pages a web browser has visited, and an IP address. Information related to session management, user preferences and service entitlements may be stored in "cookies."

A cookie is a small data file transmitted from a website to your device's hard drive. Cookies are usually defined in one of two ways, and we may use either (or both) of them: (a) Session cookies, which do not stay on your device after you close your browser, and (b) Persistent cookies, which remain on your device until you delete them or they expire. Cookies set by the website you are visiting are normally referred to as "first-party cookies," and typically only track your activity on that particular site. Cookies set by other sites and companies (i.e., third parties) are called "third-party cookies," and can be used to track you on other websites.

We use the following category of cookies on our Website:

• Strictly Necessary Cookies. These cookies are essential in order to enable you to move around our Website and use its features, such as maintaining a record of your user identity, user logins, account management, or payment processing.

For your convenience, this Website may from time to time include links to third-party sites. Please note that linked third-party websites may also use cookies. We cannot control the use of cookies by these third-party websites. For example, when you visit a third-party website through clicking on a link on this Website, or click on a link to this Website included on a third party website, that third party website may have the ability to recognize that you have come from our Website, and other information, by using cookies. If you have any questions about how third-party websites use cookies, you should review the policies of, and/or contact such third parties directly. These third parties are independent from and not under the control of the Bank.

Web Beacons

We may also employ software technology known as "web beacons" or "clear GIFs" which helps us keep track of which content on our Website is effective. Web beacons are small graphics with a unique identifier that are used to track the online movements of Users. Web beacons are embedded in the web pages you review, so they are not stored on your hard drive. The web beacons we use do not track or collect any personally identifiable information about you and they are in no way linked to your personally identifiable information.

Do Not Track Signals

"Do Not Track" signals are options available on your browser to tell operators of websites that you do not wish to have your online activity tracked. The Website is not currently set up to respond to these signals. Again, if you choose to block cookies and other trackers, certain features of our Website may not work. On a mobile device, you may also be able to adjust your settings to limit ad tracking.

As with other aggregated data, we may disclose such data to our existing or potential business partners, affiliates, sponsors or other third parties, but this aggregate data will in no way personally identify you or any other Users to the Website.

Data Disclosure

The Bank does not disclose Personal Information to any nonaffiliated or affiliated third party, except as permitted by law to provide you with our products and services requested by you. For example, the Bank may disclose Personal Information:

• To companies who perform transaction processing for the bank if the transaction, service, or product is requested or authorized by the consumer.
• As necessary to enforce the Bank's legal or contractual rights or the rights of any other person who is engaged in the financial transaction.
• As required in the ordinary course of banking business, such as the settlement of claims or benefits, the confirmation of information to the consumer or the consumer's agent, and the billing, processing, or clearing of items in the normal course of business.
• To provide information agencies that are rating the Bank, persons who are assessing the Bank's compliance with industry standards, and the Bank's attorneys, accountants, and auditors.
• To the extent permissible under the Right to Financial Privacy Act (12 U.S.C. § 3401 et seq.).
• To comply with federal, state, or local laws, rules, and other applicable legal requirements.

The Bank follows strict privacy procedures in regard to protection of Personal Information. No disclosure of Personal Information to third parties is allowed unless the related User has been previously informed or the disclosure has already been authorized by the User or otherwise is permitted or required by law, regulations, subpoena, warrant, court order, or other legal process, or by government agencies or law enforcement.

We may also share your Personal Information in the event that the business of the Bank is transferred to another entity by way of merger, sale of the company's assets, or other similar transaction. We may also collect and group demographic and preferences information, responses to surveys and other Personal Information that we collect from you into an aggregate, non-personally identifiable form for disclosure to our existing potential business partners, affiliates, sponsors or other third parties. However, please be assured that this aggregate data will in no way personally identify you or any other Users to the Website.

Data Retention

The Personal Information we collect from you will be stored for no longer than necessary to or except as may be required by law, regulations, subpoena, warrant, court order or other legal process, or government agencies or law enforcement. The length of time we retain Personal Information will additionally be determined based upon the following criteria: the length of time your Personal Information remains relevant; the length of time it is reasonable to keep records to demonstrate that we have fulfilled our duties and obligations; any limitation periods within which claims might be made; any retention periods prescribed by law or recommended by regulators, professional bodies or associations; the type of contract we have with you, the existence of your consent, our legitimate interest in keeping such information as stated in this Privacy Policy; compliance with laws, regulations, subpoena, search warrant, or other legal process, or by government agencies or law enforcement.

Data Security

Personal Information provided is protected by limiting access to authorized personnel under the supervision of a Data Protection Officer and encryption, among other reasonable protection measures.

If the Bank engages data processors to handle or process Personal Information on the Bank's behalf (whether within or outside the United States), the Bank employs data protection measures, which may include contractual or other means, to prevent unauthorized or accidental access, processing, erasure, loss or use of the Personal Information processed by processors.

Despite the security measures employed by the Bank, you should be aware that it is impossible to guarantee absolute security with respect to information sent through the Internet. We strive to protect your Personal Information; however, we urge you to take every precaution to protect your Personal Information when you are on the internet.

We will maintain reasonable technical, administrative and organizational measures in order to protect and safeguard your information. Unfortunately, information transferred over the internet is not completely secure. Accordingly, we do not guarantee that your information will not be misused or disclosed to third parties. You acknowledge and agree that any transmission of information to our Website is made at your own risk. We will have no liability to you for any misuse or disclosure of your information. If you share information with third parties via our Website, you do so at your own risk. Any such information you share with the third party will not be governed by this Privacy Policy and we have no liability to you with respect to such information.

You understand that electronic communications may be accessed by unauthorized parties when communicated across the internet, network communications facilities, or other electronic means. You understand and agree that we are not responsible for any electronic communication or any of your information which may be lost, altered, intercepted, or stored without authorization during the transmission of any data whatsoever across networks not owned or operated by us.

Children's Privacy

Our Website is intended for adults at least eighteen (18) years old and for commercial use. We do not knowingly collect any Personal Information from children under the age of thirteen (13). If you are under thirteen (13) years of age, then please do not use or access our Website at any time or in any manner. By using the Website you certify that you are at least eighteen (18) years of age or older. We reserve the right to delete any information we believe to be in violation of this Privacy Policy.

California Consumer Privacy Notice

This section of the Privacy Policy for CALIFORNIA RESIDENTS supplements the information contained in the this Privacy Policy and applies solely to Users who reside in the State of California ("CA Consumers" or "you"). We adopt this notice to comply with the California Consumer Privacy Act of 2018 and its implementing regulations, and as amended by the California Privacy Rights Act ("CCPA"), and other California privacy laws, as may apply. Inclusion of this section in the Privacy Policy does not constitute agreement that referenced laws apply. Any terms defined in the CCPA have the same meaning when used in this Privacy Policy.

This section of the Privacy Policy does not apply to (i) personnel or job applicants, (ii) Personal Information collected, processed or disclosed pursuant to the Gramm-Leach-Bliley Act and its implementing regulations, as described in , "Our Privacy Notice & Important Information Regarding Your Privacy," (iii) the California Financial Information Privacy Act, or any other Personal Information as excluded from scope by applicable law.

Information We Collect

For the purposes of this California Consumer Privacy Notice Section, Personal Information, as previously described and defined above, also includes information we may collect (and may have collected during the twelve-month (12) period prior to the effective date of this Statement) that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular CA Consumer, account, or device.

Personal Information does not include:

• Publicly available information from government records.
• De-identified or aggregated CA Consumer information.
• Information excluded from the CCPA's scope, like:
  • Personal Information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FRCA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA), and the Driver's Privacy Protection Act of 1994;
  • Health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data.

Personal Information is retained as set forth above and in the table below.

In particular, we may have collected, in varying combinations, the following categories of Personal Information from CA Consumers within the last twelve (12) months:
 

We may obtain the categories of Personal Information listed above from the following categories of sources:

• Directly from our clients or if the client is an entity, their authorized agents. For example, from documents that our clients provide to us related to the services for which they engage us.
• Indirectly from our clients or if the client is an entity, their authorized agents. For example, through information we collect from our clients in the course of providing services to them.

Use of Personal Information

We may use or disclose the Personal Information we collect for one or more of the following business purposes:

• To fulfill or meet the reason for which the information is provided. For example, if you provide us with Personal Information in order for us to open an account, process a loan application, provide banking products and services, handle banking transactions, account maintenance, etc.
• To perform services, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying CA Consumer information, processing payments, providing financing or providing similar services.
• To prevent, detect, and investigate security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity.
• As necessary or appropriate to protect the rights, property or safety of us, our clients or others.
• For testing, research, analysis and product development.
• To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.
• To carry out our obligations and enforce our rights arising from any agreements or contracts entered into between you and us.
• As described to you when collecting your Personal Information or as otherwise set forth in the CCPA.
• To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which Personal Information held by us is among the assets transferred.

We will not collect additional categories of your Personal Information or use the Personal Information we collected for materially different, unrelated, or incompatible purposes without providing you notice.

Sale/Sharing of Personal Information

We do not sell or share your Personal Information in exchange for monetary consideration or for cross-context behavioral advertising. We may disclose your Personal Information to a third party for a business purpose. When we disclose Personal Information for a business purpose, we enter a contract that describes the purpose and requires the recipient to both keep that Personal Information confidential and not use it for any purpose except performing the contract.

In the preceding twelve (12) months, we may have disclosed the following categories of Personal Information for a business purpose:

Category A:Identifiers.

Category B:California Customer Records personal information categories.

Category C:Protected classification characteristics under California or federal law.

Category I:Professional or employment-related information.

We disclose your Personal Information for a business purpose to the following categories of third parties:

• Service providers, e.g. our legal counsel, accountant, auditor, etc.
• Third parties to whom you or your agents authorize us to engage in connection with products or services we provide to you, e.g. appraiser, environmental company, escrow company, title insurance company, etc.;
• Other third parties who enable CA Consumers to conduct transactions online or assist us in rendering services; or
• Government agencies, law enforcement, or other third parties as permitted or required by law, regulations, subpoena, warrant, court order, or other legal process.

In the preceding twelve (12) months, we have not sold any Personal Information and we have not used or disclosed Personal Information for purposes other than those set forth above. We would provide you with a notice and opportunity to opt out as required under CCPA if and before we engage in such practices.

We do not have actual knowledge that we sell Personal Information of minors under 16 years of age.

Your Rights and Choices

The CCPA provides CA Consumers with specific rights regarding their Personal Information. This section describes CA Consumers' CCPA rights and explains how to exercise those rights.

• The categories of and/or Personal Information we collected about you.
• The categories of sources for the Personal Information we collected about you.
• The purpose for collecting or selling that Personal Information.
• The categories of third parties with whom we share that Personal Information.
• The categories of Personal Information that we sells or discloses to third parties.

Exercising Access, Correction and Deletion Rights

To exercise the access, correction and deletion rights described above, please submit a verifiable consumer request using the attached CCPA Rights Request Form. CA Consumers may mail or email such form to us using the contact information provided at the end of this Privacy Policy.

After we acknowledge your request, we will respond within a reasonable time period as required by law.

Only you or your authorized agent may make a verifiable consumer request related to your Personal Information. You may also make a verifiable consumer request on behalf of your minor child.

You may only make a verifiable consumer request for access or data portability twice within a twelve-month (12) period. The verifiable consumer request must:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collected Personal Information or an authorized representative.
• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We cannot respond to your request or provide you with Personal Information if we cannot verify your identity or authority to make the request and confirm the Personal Information relates to you. Making a verifiable consumer request does not require you to create an account with us. We will only use Personal Information provided in a verifiable consumer request to verify the requestor's identity or authority to make the request. To help protect your privacy and maintain security, we will take steps to verify your identity before granting you access to your Personal Information or complying with your request. If you request access to or deletion of your Personal Information, we may require you to provide any of the following information: name, date of birth, email address, telephone number, or postal address. If you designate an authorized agent to make an access, or deletion request on your behalf (a) we may require you to provide the authorized agent written permission to do so, and (b) for access and deletion requests, we may require you to verify your own identity directly with us (as described above).

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee to the extent permitted by applicable law, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Non-Discrimination

We will not discriminate against you for exercising any of your CCPA rights. Unless permitted by the CCPA, we will not:

• Deny you goods or services.
• Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
• Provide you a different level or quality of goods or services.
• Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

Data Protection Rights Under the European Union General Data Protection Regulation and the United Kingdom Data Protection Act 2018

This section of the Privacy Policy supplements the information contained in the this Privacy Policy and applies solely to Users located in the European Economic Area ("EEA") and the United Kingdom ("UK", such Users are referred to as "EU/UK Consumer" or "you"). We adopt this notice to comply with the European Union General Data Protection Regulation ("EU GDPR") and the United Kingdom Data Protection Act 2018 ("UK DPA" or "UK GDPR"). Any terms defined in the EU GDPR or UK GDPR have the same meaning when used in this section of the Privacy Policy.

What are your data protection rights?

The Bank would like to make sure you are fully aware of all of your data protection rights. Every EU/UK Consumer is entitled to the following:

• The right to access – You have the right to request the Bank for copies of your Personal Information. We may charge you a small fee for this service.
• The right to rectification – You have the right to request that the Bank correct any Personal Information you believe is inaccurate. You also have the right to request the Bank to complete the Personal Information you believe is incomplete.
• The right to erasure – You have the right to request that the Bank erase your Personal Information, under certain conditions.
• The right to restrict processing – You have the right to request that the Bank restrict the processing of your Personal Information, under certain conditions.
• The right to object to processing – You have the right to object to the Bank's processing of your Personal Information, under certain conditions.
• The right to data portability – You have the right to request that the Bank transfer the Personal Information that we have collected to another organization, or directly to you, under certain conditions.
• The right to lodge a complaint with a supervisory authority.

If you make a request, we will respond within a reasonable time period as required by law. If you would like to exercise any of these rights, please contact the Bank using the contact information provided at the end of this Privacy Policy.

EU Standard Contractual Clauses and the UK Addendum

The Personal Information you provide through the Website may be maintained and stored within the United States and Hong Kong.

Under the EU and UK GDPR, the Bank may transfer Personal Information to a third country provided the appropriate safeguards are in place. In the EU, such safeguards include the standard contract clauses ("SCCs"), which provide appropriate data protection safeguards to be used as a ground for data transfers from the EU to third countries, and have been pre-approved by the European Commission. To comply with the UK GDPR, we may use the International Data Transfer Addendum to the European Commission's SCCs for international data transfers (the "UK Addendum"). The Bank applies the SCCs and the UK Addendum to transfer data to countries outside the EU and UK.

For a copy of the SCCs or the UK Addendum, please contact the Bank using the contact information provided at the end of this Privacy Policy or click here for the SCCs, or here for the UK Addendum.

Use of the Website Outside the United States

If you use the Website outside of the United States or are a citizen or resident of a country other than the United States that has laws and policies governing the disclosure and management of your Personal Information, you understand and agree that the Personal Information you exchange with the Website may be maintained indefinitely on systems located within the United States and Hong Kong.

By using the Website, you understand and consent to the collection, storage, processing, and transfer of your Personal Information to our facilities in the United States and Hong Kong, which are necessary to provide the Website's products and services to you at your request and pursuant to the Account Agreement entered into between you and the Bank If you do not agree, cease using the Website immediately.

Changes to the Privacy Policy

We reserve the right to amend this privacy notice at our discretion and at any time. Therefore, you are advised to review this Privacy Policy occasionally, or at least every thirty (30) days. Your continued use of this Website subsequent to the Bank's notice of modification of this Privacy Policy shall constitute your acceptance of the modified Privacy Policy. If any term or provision of this Privacy Policy shall be found to be invalid, illegal or otherwise unenforceable, such finding shall not affect the other terms or provisions of this Privacy Policy, or the whole of this Privacy Policy, but such term or provision shall be deemed modified to the extent necessary to render such term or provision enforceable, and the rights and obligations of you and the Bank shall be construed and enforced accordingly, preserving to the fullest permissible extent the intent and agreements set forth in this Privacy Policy.

Contact Us

At any time Users can request that we modify or delete your Personal Information by sending an email to your local branch with the words "UPDATE MY INFORMATION" in the subject line. Please do not send confidential information such as Social Security Numbers or account numbers to us via regular e-mail. We may call you directly with questions to update or verify account information or to clarify information if you are applying for a loan. In these cases, our Bank representatives will introduce themselves by name and give you a specific reason for the request. Please be aware that, to protect your security and privacy, the Bank may take reasonable steps to verify your identity prior to making changes to your Personal Information. The Bank may monitor and in some cases, record calls for staff training and quality assurance purposes.

If Users have any questions about this Privacy Policy or our privacy practices, please contact us by writing, calling or emailing your local branch:

Los Angeles Branch
383 E. Valley Boulevard
Alhambra, CA 91801
(626) 300-8822
la.contact@shacombank.com.hk

San Francisco Branch
231 Sansome Street
San Francisco, CA 94104
(415) 433-6700 (Collect call accept in U.S.)
sf.contact@shacombank.com.hk

New York Branch
125 East 56th Street
New York, NY 10022
(212) 699-2800
ny.contact@shacombank.com.hk