This Data Privacy Statement ("Statement") explains how the Company collects, uses, processes, stores, and protects your personal data in connection with our Know Your Customer ("KYC") process, Anti-Money Laundering ("AML") compliance, and investor onboarding procedures. This Statement is provided in compliance with the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486) ("PDPO") and, where applicable to the Company, other applicable data protection laws.

By submitting your personal data to us through our investor onboarding form or other means, you acknowledge that you have read, understood, and agree to the practices described in this Statement.

We may collect, use, store, and process the following categories of personal data:

A.    Identification Data:

·       Full legal name

·       Date of birth

·       Nationality

·       Passport number, Hong Kong ID card number, or other government-issued identification numbers

·       Copy of identification documents

·       Photograph (if applicable)

B.    Contact Information:

·       Residential address

·       Email address

·       Telephone numbers

·       Proof of address documentation

C.    Financial and Investment Information:

·       Source of wealth details

·       Source of funds documentation

·       Investment amount and preferences

·       Financial statements and bank details

·       Tax identification numbers

·       Investment experience and qualifications

D.    Corporate Information (for institutional investors):

·       Company registration details

·       Certificate of incorporation

·       Memorandum and Articles of Association

·       Business registration certificates

·       Beneficial ownership information

·       Organizational structure charts

E.    Compliance and Risk Assessment Data:

·       Politically Exposed Person (PEP) status

·       Sanctions screening results

·       Adverse media findings

·       Risk ratings and assessments

·       AML/CFT compliance checks

We process your personal data for the following lawful purposes:

A.    Regulatory Compliance Obligations:

·       To comply with our legal obligations under:

o   Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO)

o   Companies Ordinance (Cap. 622)

o   Inland Revenue Ordinance (Cap. 112)

o   PDPO and other data protection laws

·       To conduct mandatory KYC and AML checks

·       To verify identity and beneficial ownership

·       To screen against sanctions lists and PEP databases

·       To prevent money laundering, terrorist financing, and financial crimes

B.    Investment Relationship Management:

·       To assess your suitability as an investor

·       To manage the investor onboarding process

·       To process investment applications

·       To administer your investment with us

·       To communicate regarding your investment

·       To maintain investor records

C.    Business Operations:

·       To conduct risk assessments

·       To maintain internal records

·       For audit and compliance purposes

·       For statistical analysis (in anonymized form)

We process your personal data based on the following legal grounds:

A.    Legal Obligation: Processing is necessary for compliance with our legal obligations under Hong Kong laws and regulations.

B.    Performance of functions directly related to the Company’s business, including:

1. • Preventing fraud and financial crime

   • Protecting the integrity of our investment processes

   • Maintaining accurate investor records

C.    Contractual Necessity: Processing is necessary for the performance of a contract to which you are a party or to take steps at your request prior to entering into a contract.

D.    Consent: Where required by law, we will obtain your prescribed consent for specific processing activities.

We may share your personal data with the following categories of recipients:

A.    Within Our Organization:

·       Authorized employees who need access to perform their duties

·       Compliance and legal teams

·       Investment management teams

·       Senior management (as necessary)

B.    Third-Party Service Providers:

·       KYC/AML Verification Services: Companies that provide identity verification, sanctions screening, and PEP checking services

·       Legal and Professional Advisors: Lawyers, accountants, auditors

·       IT Service Providers: Data storage, cybersecurity, and software providers

·       Administrative Service Providers: Document processing and record-keeping services

C.    Regulatory and Government Authorities:

·       Hong Kong Monetary Authority (HKMA)

·       Securities and Futures Commission (SFC)

·       Hong Kong Police Force and other law enforcement agencies (when required by law)

·       Hong Kong Inland Revenue Department

·       Courts and tribunals (when required by court order)

D.    Business Partners (with appropriate safeguards):

·       Co-investors in specific ventures (only with your consent or as required for the investment)

·       Portfolio company management (limited information only as necessary)

International Data Transfers: Where we transfer your personal data outside Hong Kong, we will ensure adequate protection through:

·       Contractual arrangements based on the PCPD's 2022 “Recommended Model Contractual Clauses for Cross-border Transfer of Personal Data,” or equivalent safeguards

·       Your prescribed consent where required

We will retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including:

Minimum Retention Periods:

·       KYC/AML Records: Minimum 5 years from the end of our business relationship, as required by AMLO

·       Transaction Records: Minimum 5 years from transaction date

·       Investor Records: For the duration of your investment and, thereafter, for the minimum periods required by law (7 years under the Inland Revenue Ordinance for tax records; 5 years under the AMLO for AML records).

After the retention period expires, we will securely delete or anonymize your personal data in accordance with our data retention policy.

We implement appropriate organizational measures to protect your personal data, including:

• Access Controls: Strict access controls and authentication mechanisms

• Regular Audits: Security audits and vulnerability assessments

• Employee Training: Regular data protection and security training for staff

• Secure Storage: Protected physical and electronic storage systems

• Data Minimization: Collecting only necessary data

Under the PDPO, you have the following rights regarding your personal data:

1.     Right to Access: Ascertain whether we hold personal data of which you are the data subject and request a copy of such personal data

2.     Right to Correction: Request correction of inaccurate or incomplete data

3.     Right to Complain: Lodge a complaint with the Privacy Commissioner for Personal Data

4.     Right to Information about Our Policies, Practices and Personal Data Held:  (i) our policies and practices in relation to personal data, (ii) the kinds of personal data we hold, and (iii) the main purposes for which personal data held by us is or is to be used.

How to Exercise Your Rights:
To exercise any of these rights, please contact our Data Protection Officer using the contact details in Section 10. We may request specific information to verify your identity before processing your request.  We will respond within 40 days of receiving your request.

Exceptions: Please note that certain rights may be limited in specific circumstances, particularly where:

·       Processing is required by law

·       Disclosure would compromise our AML/CFT obligations

·       Information is subject to legal privilege

·       Disclosure would harm the rights of others

·       The exemptions in Part 8 of the PDPO (e.g. sections 58, 60, 60A and 60B) apply

We may use automated systems for:

·       Initial sanctions and PEP screening

·       Risk scoring based on predefined parameters

·       Transaction monitoring for suspicious activities

As a matter of Company policy, where an automated sanctions or risk screening result materially affects your investor onboarding, you may request that the decision be reviewed by a human reviewer. Please contact us using the details in Section 10.

Data Protection Officer
Vengine Limited
Flexi No. 370, Smart Space 2, Units 1205-08

Level 12, Cyberport 2, Hong Kong
Email: info@vengine.one

Privacy Commissioner for Personal Data, Hong Kong
Office of the Privacy Commissioner for Personal Data
Room 1303, 13/F, Sunlight Tower
248 Queen's Road East, Wan Chai, Hong Kong
Website: www.pcpd.org.hk
Complaint Hotline: (852) 2827 2827

We may update this Statement from time to time to reflect changes in our practices, legal requirements, or services. The updated version will be posted on our website with an updated effective date. We encourage you to review this Statement periodically. Where an update introduces a new purpose of use that is not directly related to the original purpose of collection, we will seek your prescribed consent before using your personal data for that new purpose.

By submitting your personal data to us, you acknowledge and agree that:

1.     You have read and understood this Data Privacy Statement

2.     You consent to the collection, use, processing, and disclosure of your personal data as described herein

3.     You understand that providing personal data is mandatory for our KYC process and investment consideration

4.     Failure to provide required personal data may result in our inability to proceed with your investment application

5.     You confirm that all personal data provided is accurate, complete, and up-to-date

6.     You will notify us promptly of any changes to your personal data

For Corporate/Institutional Investors: The individual completing the Investment Qualification and KYC-AML Questionnaire (“Form A”) warrants that they have the authority to provide consent on behalf of the entity and all individuals whose personal data is submitted.