Privacy Policy | WatsMall

Last Updated: June 2025

Our Privacy Principles

Watsons Water, a division of AS Watson Group (HK) Limited, referred to as "we" or "us" or "our", are members of the AS Watson group of companies ("ASW Group"), which is part of the multinational conglomerate CK Hutchison Holdings Limited and its affiliated or related companies ("CK Hutchison Group"). We take your privacy seriously. Here are our 5 privacy promises to you:

1. We will ALWAYS ensure that your personal data is used in line with applicable data protection laws.

2. We will ALWAYS be transparent with you about how we use your personal data. This includes informing you about what information we collect, what we do with it, with whom we share it and who you should contact if you have any concerns.

3. We will ALWAYS provide you simple options to say 'STOP' when you no longer wish to receive our marketing communications.

4. We will ALWAYS take reasonable steps to protect your personal data and make sure no unauthorized person accesses it.

5. We will ALWAYS respond to any questions on the processing of your personal data without undue delay.

Our Privacy Policy

We are committed to safeguarding your privacy rights and ensuring that your personal data is protected.

This Privacy Policy explains the types of personal data we collect and how we process and protect that data in connection with the services we offer. This includes information collected offline in our stores or through our customer services, and online through our websites, applications (including mobile apps) and Third-Party platforms (together referred to as "Sites").

This Privacy Policy also applies to our targeted or personalised content, including online offers and advertisements for products and services, which you may see on Third-Party websites, platforms, and applications (together referred to as "Third-Party Sites"). These Third-Party Sites may have their own privacy policies and terms and conditions. We encourage you to read them before using those Third-Party Sites.

Personal Information Collection Statement ("PICS")

This PICS is issued pursuant to the Personal Data (Privacy) Ordinance (Cap.486) ("PDPO") in relation to the operation of our retail business by Watsons Water, a division of AS Watson Group (HK) Limited, a subsidiary of AS Watson Group (referred to as "we" or "us").

1. WHO IS RESPONSIBLE FOR WHAT HAPPENS WITH YOUR DATA?

Watsons Water, a division of AS Watson Group (HK) Limited (data users) is responsible for processing your personal data on our Sites or offline in our stores.

2. WHAT IS PERSONAL DATA?

Personal Data generally refers to information that can directly or indirectly identify you ("Personal Data"). This typically includes information such as your name, address, email address, and telephone number, but can also include other information such as IP address, shopping habits, information about health and beauty, information about your lifestyle or preferences such as your hobbies and interests. Information about health is called "special categories of Personal Data" that require special protection because of their sensitivity.

3. WHAT PERSONAL DATA DO WE PROCESS?

We may collect the following data either from you directly or from our third parties:

Basic Data: Name, title, age, date of birth, gender, password, account age, account number.

Communications Data: Information about the routing of service, calls and messages you make and receive, the date, time, duration and cost of these, and information about the identity of your device and SIM.

Contact Data: Postal address, email address, and phone number.

Freeform Data: Any other content / information you provide to us via our Sites including our customer services chatbot, and further information submitted by you in relation to a purchase or service request or other query, including communications with customer services regarding refunds or online purchases and your product or service reviews that you share with us.

Images: Pictures or videos when you make a product or service review on our website including when you make a claim for bodily injury or reaction to a product or service. Pictures or videos when you participate in our games or competitions.

Location Data: Data revealing the geographic location of your device when using our mobile services.

Log Data: Information about the type of browser you use when visiting our Sites, your IP and device address, hyperlinks you clicked, websites you browsed before arriving at our Sites and other information collected by cookies or similar tracking technologies (such as actions taken on our Sites or Third Party Sites, information about how you handle emails you receive from us, unique IDs assigned to you, your browsing behaviour). Your location and information about your mobile device (e.g., the unique identifier for your personalised device), your GPS data or wireless network data. Your username, profile picture, and any other information you choose to share when using Third Party Sites (e.g., when you use the "Like" functionality on your social media account).

Loyalty Data: Loyalty card member identification number, account status (including your membership date) and details regarding points collected and redeemed.

Personalization Data: Brands you prefer, products or services you prefer," answers you provide in surveys or competitions, your shopping habits (such as your preferred shopping channels or your shopping frequency), preferences and information about your lifestyle, your preferred communication channel (such as information on which campaign channel you prefer while engaging with us), your preferences that you share with us by using our online tools or in-store kiosks.

Purchase Data: Purchases of goods or services you make on our Sites, mobile apps, in-store or in our pharmacies, prices of purchases, order history, return history, payment history, wish lists, invoices. Payment information (i.e., payment method).

Sensitive Data: In certain limited circumstances, we may process information about any adverse reaction to a product or service (this may constitute health data) or diagnostic data. If we require sensitive information about you, we will inform you about our legal obligations in a transparent manner and ask you for your explicit consent before processing such Personal Data. If you do not provide your explicit consent, we will not process such Personal Data.

4. WHAT HAPPENS WHEN YOU PROVIDE US WITH YOUR PERSONAL DATA OR WHEN WE OTHERWISE RECEIVE YOUR PERSONAL DATA?

We collect your Personal Data directly in a number of ways, for example, when you provide us with your information to register as a customer on our Sites or as a member of our loyalty program, register for prize draws, games or competitions, subscribe to our newsletters, receive information or mailings, use our applications, buy a product or service from us, complete a survey, complete a beauty or health diagnostic test, make a comment or enquiry or contact our customer services.

When you provide us with your Personal Data, we will process it in accordance with this Privacy Policy. If you do not wish us to process your Personal Data in this way, please do not provide us with your personal information.

We may also receive your Personal Data from other sources, including information passively received from available sources such as operators of any Third-Party platforms and Third-Party Sites as referred above and information from Our Partners (as defined in Section 8.1 below). If you do not want us to receive your Personal Data from other sources, please communicate your preferences directly with the relevant sources.

We process your Personal Data to provide you with our services as further explained below. In certain instances, we will only process your Personal Data if you have given us permission, with your consent or indication of no objection to do so, for example where we process your Personal Data for direct marketing purposes, use Cookies (as defined in Section 6.4 below) or location data or where we process your sensitive personal information, or when we process your Personal Data for any new purposes (if any) that are outside of the scope of the purposes set out in this Privacy Policy. In other instances, we may rely on other legal grounds for processing your personal data, such as performance of the contract with you or legitimate interests, like fraud prevention.

If you become a member of our loyalty program, you may still receive service notices or non-direct marketing communications about the program despite you have opted out of receiving direct marketing communications from us without detriment to your loyalty benefits.

Where we process your Personal Data on the basis of your consent or indication of no objection, we will ask for your consent or indication explicitly and only for a particular purpose.

Please refer to Section 6 of this Privacy Policy for details of the various types of Personal Data we may collect and the relevant purposes for such processing.

5. WHAT HAPPENS IF OUR CUSTOMER IS A CHILD?

Our Sites are intended for adults, but there could be instances where some customers under the age of 18 view or purchase products or services on our Sites. If we know that a customer is under the age of 18, we will not use such customer"s Personal Data for direct marketing purposes unless parental or guardian consent is provided to us.

To provide parental consent to marketing, please ask your parent or guardian to call or write to Watsons Water, a division of AS Watson Group (HK) Limited contact details as listed in Section 14 (applicable to loyalty card or online account members only).

Note however that access to certain parts of our Sites and/or eligibility to receive prizes, samples or other rewards may be limited to users over a certain age. We may use your Personal Data to carry out age verification checks and enforce any such age restrictions.

6. FOR WHICH PURPOSES DO WE PROCESS YOUR PERSONAL DATA?

6.1 We process the following categories of Personal Data for the following purposes:

	What categories of Personal Data may we process?	What is the purpose of the processing?	How long do we store your Personal Data?
Browsing on our Sites	Log Data	We (and Third-Party service providers acting on our behalf) use Cookies and similar technologies to process data about you when you visit our Sites. We would like to know whether you have visited us before and your preferences to provide you with a tailored experience of our Sites. See Section 6.4 below for more information about Cookies.	Please check the Cookie Consent Tool to learn about the storage periods for each Cookie. The retention period of Cookies varies from the duration of your visit to the Site depending on the purpose of the Cookie. You can reject or delete historical cookies by changing the settings on your web browsers.
Create and management of accounts and loyalty card accounts	Basic Data and Contact Data, Loyalty Data (if you are a member of our loyalty program)	We process your Personal Data to allow the creation of your account and/or your loyalty card accounts and to manage your accounts on our Sites.	We will keep your Personal Data as long as your account is active and for three (3) years after your last purchase of our goods or services on your account ("Last Activity"), unless we are required by law to store it for a longer period.
Online or in-store purchase of goods or services, making of appointments	Basic Data, Contact Data, Purchase Data, Loyalty Data	We process your Personal Data to handle your purchases of goods and services in our physical and online stores and, as the case may be, to deliver the products to you as ordered or perform the services that you requested.	We will keep your Personal Data as long as your account or loyalty card is active and for three (3) years after your Last Activity, unless we are required by law to store it for a longer period.
Surveys	Basic Data, Contact Data, Personalization Data and Freeform Data, any Data provided in the form and Sensitive Data.	We process your Personal Data to carry out surveys in order to improve our products and services.	Until the business purpose is achieved, or as required by law.
Product reviews, product recommendations and user generated content	Basic Data, Contact Data, Personalization Data and Freeform Data, Images	We process your Personal Data to manage your reviews and/or recommendations about the products you bought and/or used and/or services you received in order to improve our products and services. Your reviews and/or product recommendations are either directly shared by you in our Sites or provided to Third Party Sites by you and use the content you have created and/or shared in accordance with the specific terms and conditions accepted by you e.g. to post your review/content and to promote our products. We also process your Personal Data to comply with our legal obligations relating to moderating website content under applicable laws.	Until the business purpose is achieved, or as required by law.
Prize draws, competitions, events and games	Basic Data, Contact Data, Personalization Data and Freeform Data, Images (pictures / videos) and any Data provided in the form.	We process your Personal Data to allow you to participate in prize draws, competitions or games, and if you choose to participate, to determine the winner and provide you with any prize you win.	For three (3) months after the draw, competition or game is completed, unless we are required by law to store them for a longer period.
Loyalty points and vouchers	Basic Data, Contact Data, Purchase Data and Loyalty Data	When you become a member of our loyalty program, we process your Personal Data to calculate and inform you about the points you have collected, and to send you loyalty vouchers and information related to these vouchers (e.g. duration, expiry date etc.).	For as long as you are a member of any of our loyalty programs. If your Last Activity was more than three (3) years ago, we will delete or anonymise your Personal Data, unless we are required by law to store it for a longer period.
After-sales, customer services and claim management (including the use of AI powered chatbots)	Basic Data, Contact Data, Purchase Data Loyalty Data, Log Data, and Freeform Data In some very limited cases: Sensitive Data and Images (pictures)	We process your Personal Data whenever you contact us in order to respond to your enquiries and comments, to process potential claims and your data subject rights requests and, as the case may require, to reimburse you.	General enquiries and comments relating to service issues, store standards, stock availability, etc.: three (3) years from our last communication with you. Communications relating to personal injuries, accidents and other health and safety issues may be kept for a longer period in cases of legal claims or settlements.
Fraud prevention and other regulatory-related purposes	Basic Data, Contact Data, Purchase Data, Loyalty Data, Log Data and Freeform Data In some very limited cases: Sensitive Data and Images (pictures)	We process your Personal Data to comply with our legal obligations, including data protection regulations and money laundering regulations. We also process your Personal Data to prevent or detect fraud or other crimes, to verify your identity and credit / payment status, to protect log-in details of loyalty member account holders, to maintain the integrity of the Sites" hardware and software systems and to fight against counterfeit and selective distribution.	We retain your Personal Data for regulatory purposes for the duration of any legal or regulatory actions and legal/regulatory requirements.
CCTV	CCTV Images	Our stores are equipped with CCTV systems for theft and fraud detection and prevention. We process personal data obtained through CCTV for the following purposes: " Security and Loss Prevention: To ensure the safety and security of our retail locations, staff, and customers, including the prevention and detection of theft, vandalism, and other unauthorised activities. " Investigation: To investigate and respond to incidents or accidents that occur on our premises. " Record Keeping: To maintain records of activities that take place within our retail locations.	The retention period for personal data collected through CCTV varies depending on the purpose: " Security and Loss Prevention: Footage may be retained for a reasonable period, to review and investigate security incidents. " Investigation: Footage related to specific incidents or investigations may be retained until the investigation is completed, and any related legal matters are resolved. " Record Keeping: In some cases, footage may be retained for historical record-keeping purposes for a limited period.

What categories of Personal Data may we process?

What is the purpose of the processing?

How long do we store your Personal Data?

Browsing on our Sites

Log Data

We (and Third-Party service providers acting on our behalf) use Cookies and similar technologies to process data about you when you visit our Sites. We would like to know whether you have visited us before and your preferences to provide you with a tailored experience of our Sites.

See Section 6.4 below for more information about Cookies.

Please check the Cookie Consent Tool to learn about the storage periods for each Cookie.

The retention period of Cookies varies from the duration of your visit to the Site depending on the purpose of the Cookie. You can reject or delete historical cookies by changing the settings on your web browsers.

Create and management of accounts and loyalty card accounts

Basic Data and Contact Data, Loyalty Data (if you are a member of our loyalty program)

We process your Personal Data to allow the creation of your account and/or your loyalty card accounts and to manage your accounts on our Sites.

We will keep your Personal Data as long as your account is active and for three (3) years after your last purchase of our goods or services on your account ("Last Activity"), unless we are required by law to store it for a longer period.

Online or in-store purchase of goods or services, making of appointments

Basic Data, Contact Data, Purchase Data, Loyalty Data

We process your Personal Data to handle your purchases of goods and services in our physical and online stores and, as the case may be, to deliver the products to you as ordered or perform the services that you requested.

We will keep your Personal Data as long as your account or loyalty card is active and for three (3) years after your Last Activity, unless we are required by law to store it for a longer period.

Surveys

Basic Data, Contact Data, Personalization Data and Freeform Data, any Data provided in the form and Sensitive Data.

We process your Personal Data to carry out surveys in order to improve our products and services.

Until the business purpose is achieved, or as required by law.

Product reviews, product recommendations and user generated content

Basic Data, Contact Data, Personalization Data and Freeform Data, Images

We process your Personal Data to manage your reviews and/or recommendations about the products you bought and/or used and/or services you received in order to improve our products and services. Your reviews and/or product recommendations are either directly shared by you in our Sites or provided to Third Party Sites by you and use the content you have created and/or shared in accordance with the specific terms and conditions accepted by you e.g. to post your review/content and to promote our products. We also process your Personal Data to comply with our legal obligations relating to moderating website content under applicable laws.

Until the business purpose is achieved, or as required by law.

Prize draws, competitions, events and games

Basic Data, Contact Data, Personalization Data and Freeform Data, Images (pictures / videos) and any Data provided in the form.

We process your Personal Data to allow you to participate in prize draws, competitions or games, and if you choose to participate, to determine the winner and provide you with any prize you win.

For three (3) months after the draw, competition or game is completed, unless we are required by law to store them for a longer period.

Loyalty points and vouchers

Basic Data, Contact Data, Purchase Data and Loyalty Data

When you become a member of our loyalty program, we process your Personal Data to calculate and inform you about the points you have collected, and to send you loyalty vouchers and information related to these vouchers (e.g. duration, expiry date etc.).

For as long as you are a member of any of our loyalty programs.

If your Last Activity was more than three (3) years ago, we will delete or anonymise your Personal Data, unless we are required by law to store it for a longer period.

After-sales, customer services and claim management (including the use of AI powered chatbots)

Basic Data, Contact Data, Purchase Data Loyalty Data, Log Data, and Freeform Data

In some very limited cases: Sensitive Data and Images (pictures)

We process your Personal Data whenever you contact us in order to respond to your enquiries and comments, to process potential claims and your data subject rights requests and, as the case may require, to reimburse you.

General enquiries and comments relating to service issues, store standards, stock availability, etc.: three (3) years from our last communication with you.

Communications relating to personal injuries, accidents and other health and safety issues may be kept for a longer period in cases of legal claims or settlements.

Fraud prevention and other regulatory-related purposes

Basic Data, Contact Data, Purchase Data, Loyalty Data, Log Data and Freeform Data

In some very limited cases: Sensitive Data and Images (pictures)

We process your Personal Data to comply with our legal obligations, including data protection regulations and money laundering regulations.

We also process your Personal Data to prevent or detect fraud or other crimes, to verify your identity and credit / payment status, to protect log-in details of loyalty member account holders, to maintain the integrity of the Sites" hardware and software systems and to fight against counterfeit and selective distribution.

We retain your Personal Data for regulatory purposes for the duration of any legal or regulatory actions and legal/regulatory requirements.

CCTV

CCTV Images

Our stores are equipped with CCTV systems for theft and fraud detection and prevention.

We process personal data obtained through CCTV for the following purposes:

" Security and Loss Prevention: To ensure the safety and security of our retail locations, staff, and customers, including the prevention and detection of theft, vandalism, and other unauthorised activities.

" Investigation: To investigate and respond to incidents or accidents that occur on our premises.

" Record Keeping: To maintain records of activities that take place within our retail locations.

The retention period for personal data collected through CCTV varies depending on the purpose:

" Security and Loss Prevention: Footage may be retained for a reasonable period, to review and investigate security incidents.

" Investigation: Footage related to specific incidents or investigations may be retained until the investigation is completed, and any related legal matters are resolved.

" Record Keeping: In some cases, footage may be retained for historical record-keeping purposes for a limited period.

6.2 We process the following categories of Personal Data for direct marketing purposes (only where we have already obtained your prior consent or indication of no objection to do so):

	What Personal Data may we collect?	What is the purpose of the processing?	How long do we store your Personal Data?
Direct marketing and suggesting products and services which may be of interest to you	Log Data, Basic Data, Contact Data, Purchase Data, Personalization Data, Loyalty Data, Sensitive Data	We process your Personal Data to send you via post, email, newsletter, SMS, push notifications, WhatsApp, WeChat or phone - details of products, services, special offers, promotions and other information (unless you opt-out of receiving such communications, which you can do at any time). These communications may contain suggestions of products or services that we think may be of interest to you from (i) us and Our Partners (as defined in Section 8.1 below)) related to Retail Goods or Services (as further defined below), and (ii) other companies within the CK Hutchison Group only in relation to telecommunications goods and/or services, e-commerce services (including trading platforms and online auctions), payment services, financial, investment and insurance products and services, hotel and tourism services and real property and related services, and (iii) other Third-Party merchants that we cooperate with offering Retail Goods or Services. To determine which products or services you may be interested in, we will process your Personal Data and in particular, your shopping history, your behaviour on our Sites and Third Party Sites, your behaviour when you receive an email from us, and your preferences to include you in segments according to our segmentation strategy. We will also process your Personal Data to show you targeted content, including online offers and advertisements for products and services that belong to us or Third Parties, which you may see on our Sites or on Third Party Sites via cookies or directly sharing your email address with a transfer method (such as API) (if you have consented to social media targeting). Please note that even if you opt out of cookies, you may still receive advertisements from us that are not customised. If you agree to the localisation function on your device, and if you are a loyalty card member and have uploaded the electronic card to your wallet, we may process your location data to send you a notification when you are near one of our stores.	For three (3) years after your Last Activity with us, unless we are required by law to store it for a longer period.

What Personal Data may we collect?

What is the purpose of the processing?

How long do we store your Personal Data?

Direct marketing and suggesting products and services which may be of interest to you

Log Data, Basic Data, Contact Data, Purchase Data, Personalization Data, Loyalty Data, Sensitive Data

We process your Personal Data to send you via post, email, newsletter, SMS, push notifications, WhatsApp, WeChat or phone - details of products, services, special offers, promotions and other information (unless you opt-out of receiving such communications, which you can do at any time).

These communications may contain suggestions of products or services that we think may be of interest to you from (i) us and Our Partners (as defined in Section 8.1 below)) related to Retail Goods or Services (as further defined below), and (ii) other companies within the CK Hutchison Group only in relation to telecommunications goods and/or services, e-commerce services (including trading platforms and online auctions), payment services, financial, investment and insurance products and services, hotel and tourism services and real property and related services, and (iii) other Third-Party merchants that we cooperate with offering Retail Goods or Services.

To determine which products or services you may be interested in, we will process your Personal Data and in particular, your shopping history, your behaviour on our Sites and Third Party Sites, your behaviour when you receive an email from us, and your preferences to include you in segments according to our segmentation strategy.

We will also process your Personal Data to show you targeted content, including online offers and advertisements for products and services that belong to us or Third Parties, which you may see on our Sites or on Third Party Sites via cookies or directly sharing your email address with a transfer method (such as API) (if you have consented to social media targeting). Please note that even if you opt out of cookies, you may still receive advertisements from us that are not customised.

If you agree to the localisation function on your device, and if you are a loyalty card member and have uploaded the electronic card to your wallet, we may process your location data to send you a notification when you are near one of our stores.

For three (3) years after your Last Activity with us, unless we are required by law to store it for a longer period.

For the purposes of this Privacy Policy, the term "Retail Goods or Services" comprises means the sales of goods or provision of services in relation to any of the following (whether through physical or online channels): food, water & beverages, restaurants, catering, groceries, houseware & household products, general merchandise, health & beauty, lifestyle, pharmaceuticals, medical and healthcare services, online consultation services, fragrance & cosmetics, baby products, wine and liquor, cigarettes and cigars, stationery, books and paper products, confectionary, toys, clothing, shoes, textiles, fashion accessories, eyewear, bags & luggage, jewellery, watches, furniture, plants and accessories, office supplies, sports & leisure equipment, phones & mobile devices & related accessories, electronics & electrical appliances, computer software & games, music, pet products, pet care and veterinary services, fuel, motor vehicle services, photography and printing services, educational products and services, wellness and bodycare products, extendible product warranty protection or similar loss or damage protection, SIM card sales and subscriber subscription or pre-paid or post-paid telecommunications services, bill acceptance, telecommunications products and services and/or any ancillary or supplemental products and services.

6.4 Cookies and Similar Technologies

We use cookies, pixel tags, web beacons and similar technologies (together referred to as "Cookies") to improve our products and your experience on our Sites by collecting information on how you use our Sites. Some of the Cookies we use are required to enable core site functionality, for example to provide secure log-in or to remember how far you are through an order, but we also use Cookies that allow us to analyse site usage (so we can measure and improve performance), and advertisement Cookies which are used by advertising companies to serve ads that are relevant to your interests.

We may also tailor our Sites and our products to your interests and needs, by collecting information about your device and linking this to your Personal Data so as to ensure that our Sites present the best experience on our Sites for you. The types of data we may collect from you when you visit the Sites include:

" information about the mobile device used and the characteristics of such mobile device;

" information about the type of browser you use;

" details of the web pages you have viewed;

" your IP address;

" the hyperlinks you have clicked; and

" the websites you visited before arriving at our Site.

Our websites are initially set up to accept Cookies. You can opt-out of or delete historical cookies by changing the settings on your web browsers; however, if you do so, you may find that certain features on our website and/or our app do not work properly

If you wish to change your cookie preferences, please click the "Cookie Settings' button below. However, the content or functionality of our site may be limited or unavailable if cookies are disabled.

orm6.5 About using our Sites

When you choose to use access or download our Sites or allow connectivity via Wi-Fi connections to your device, we receive information about your location and mobile device, including a unique identifier for your personalised device, your GPS data or wireless networks data (WLAN). Location data is neither stored nor transmitted to third parties. If you agree with the localisation function and/or enable the notifications function on your device mobile, we can provide you with location-based services including advertising, search results and personalised content. When you are near one of our Stores, then we can use push email communications or notifications (such as recommended promotion and recommended products) to you based on your geo-location data services and/or immediately previous on-line activities if you have provided your consent to receive such communications and advertising.

Most mobile devices allow you to turn off location services and push notifications on your device. Should you wish to do so, please access your own device and vary the settings for notification on your device to reflect your own preference to be notified (or not) following the relevant instructions under your device.

7. OUR USE OF ARTIFICIAL INTELLIGENCE

How do we use AI Technologies?

On our Sites, we may offer tools and services where we use artificial intelligence ("AI") technologies. Our use of AI may include following; AI powered customer services chatbots, beauty consultants, product recommendation tool, website content analyzer etc. In the future, we may add new features with AI to our Sites to provide you a better user experience.

Is usage of AI technologies optional for you?

In most of the cases yes, engaging with AI technologies is optional when we offer additional features to you. You may choose not to use it by not interacting with the service. For instance, if you do not wish to use our AI powered customer services chatbot or product recommender, you may always contact our customer service team via our customer service team by contacting them via our online chat options which you can access through our Sites. On the other hand, there may be instances where we use AI technologies for our own legitimate business interests, including use of your collected personal data for improving our own products and services provided to you or recommendations made to you).

How should you use the output given by AI?

When you interact with an AI technology, the accuracy, relevance, adequacy and quality of the interaction may vary while such technology is constantly evolving. The output provided by AI technologies are based on available data and patterns, and they should not be considered a substitute for professional advice or personalized consultations. While we strive to assist you, the ultimate decisions you make based on the AI's guidance are yours.

What is our purpose for processing personal data through AI technologies?

For the purpose of providing services and improving our service quality, and where we monitor and test AI products throughout their lifecycle (including if required by law), we may analyse the data you shared with AI powered features on our Sites. Unless it is not prompted to do so, please do not share any personal data with these AI powered features.

We may also use the Personal Data collected through AI technologies for machine learning and training purposes.

When we make available to you such AI powered services, we will inform you about our legal obligations in a transparent manner.

8. WHO DO WE SHARE YOUR PERSONAL DATA WITH?

To protect your privacy, we will endeavour to only share with third parties data which has either been aggregated and anonymised or which otherwise does not contain your name or contact details. However, there may be limited circumstances where we will share data (which may include your Personal Data) with third parties who may or may not be located overseas, as detailed in this section. By using our Sites, you agree to allow us to share your Personal Data with third parties and to the cross-border transfer of your personal data in accordance with this section. Regardless of where we store or process your Personal Data, we are committed to protecting it and will take reasonable steps to safeguard it in accordance with this Privacy Policy and all applicable laws.

8.1 Partners

Your Personal Data may be shared by us with our trusted business partners which offer Retail Goods or Services ("Our Partners"), such as Third-Party merchants providing the relevant Retail Goods or Services with whom we may from time to time cooperate with to offer you with those goods or services, to facilitate the processing of earning and redemption of loyalty points and related transactions, as well as for data analytics purposes in order to improve their operations for and supply of the relevant Retail Goods or Services to you.

Provided we have obtained your prior consent or indication of no objection, your Personal Data may be shared by us with Our Partners when we engage in customer matching with our members and Our Partners" customers to undertake data analytics of common customers who may have shown an interest in receiving any offers tailored to the products offered by Our Partners and/or us.

Please be aware that Our Partners may themselves directly collect personal data from you if you give it to them when you purchase any goods or services at their stores, or if you register with them as a customer. The handling of your data collected by Our Partners will be governed by the relevant Partner's separate privacy policy (and not this Privacy Policy), and we are not involved or responsible for the collection and handling of such data.

8.2 ASW Group and CK Hutchison Group

Your Personal Data may be transferred from us to other members of ASW Group and/or CK Hutchison Group which offer Retail Goods or Services (each a "Group Company") for any of the purposes we have set out in Section 6 above (including for any such Group Company to engage in direct marketing-related activities in the manner as set out in Section 6 above for or on our behalf, provided that you have not opted-out from direct marketing). However, we will not provide your Personal Data to any Group Company in order for them to send you direct marketing communications or materials regarding their own products and services under their own capacity, unless we obtain your prior explicit consent.

8.3 Our service providers

Your Personal Data may be shared with our service providers (including agents and contractors) which process Personal Data on our behalf to help us administer and operate our business and our Sites to conduct data analytics, to help aggregate and anonymise the personal data, or to carry out any of the purposes set out in Section 6 above. These may include IT vendors, back-office and front-end or ancillary service providers, logistic and delivery service providers, call centre operators, marketing agencies, data management and analytics service providers, and customer contact services. Our service providers may contact you on our behalf or on our behalf for any of the purposes set out in Section 6 above.

8.4 Professional advisors and assignees

When necessary, we may share your Personal Data with our professional advisors, including lawyers, accountants, financial advisors and insurers. Your Personal Data may also be shared with third parties in connection with any merger, acquisition, consolidation, restructuring, sale of assets, financing or any other similar scenarios involving the transfer of some or all of our business assets.

8.5 Government and regulatory authorities

We will disclose your Personal Data to courts, law enforcement, regulatory or other governmental agencies if we are required to do so by law, or by a warrant, subpoena or court order.

8.6 Other recipients

We may transfer your Personal Data in the following scenarios:

" to data analytical firms, such as Google Analytics Inc. (to the extent that such Personal Data is not aggregated or anonymised) where your Personal Data was collected by cookies or similar tracking technologies across our Sites and other parties" sites for these data analytical firms" own benefit;

" to social media platforms such as Facebook or Google, when we engage in audience building or customer matching activities of our loyalty members with social media platforms including Facebook members or Google customer segmentation to undertake data mapping of common customers in accordance with the requirements of Hong Kong"s PDPO and that you hereby expressly consent for us to do so;

" in an emergency, such as to safeguard the life, health or property of an individual; and/or

" with our consent to proceed to share your Personal Data with third parties where required by law.

9. TO WHICH COUNTRIES / TERRITORIES DO WE TRANSFER YOUR PERSONAL DATA?

Many of our trusted third parties and Group companies are based in countries / territories that provide an adequate level of data protection, such as the European Economic Area, the United Kingdom and Singapore to ensure your Personal Data are safeguarded with sufficient protection in compliance with applicable Data Protection Laws.

When we need to transfer your Personal Data to a trusted Third-Party or Group company based in a country / territory where data protection laws are considered not to offer the same level of protection, we ensure adequate data protection safeguards by relying on other legitimate means, such as Standard Contractual Clauses.

More details on the transfer mechanisms can be obtained from our Customer Service Department (see contact details in Section 14).

10. HOW LONG DO WE PROCESS YOUR PERSONAL DATA?

We will store your Personal Data only until the aforementioned purposes for which we have collected or received your Personal Data are fulfilled and once our statutory obligations to preserve records have expired as further described in Section 6.

11. HOW DO WE PROTECT YOUR PERSONAL DATA?

We maintain appropriate technical and organisational measures to protect the Personal Data you provide to us against accidental or unlawful destruction, loss, alteration, and/or unauthorised disclosure of, or access to your Personal Data.

Our Sites may contain hyperlinks to other websites provided by third parties. We do not control these Third-Party websites or apps or any of the content contained on those websites or apps. Once you have left our website or apps, we cannot be responsible nor accept any liability for the protection and privacy of any information which you provide to other sites or apps. You should exercise caution and look at the privacy policies of the other sites that you visit.

12. WHAT ARE YOUR RIGHTS?

If certain requirements are fulfilled and to the extent permitted by PDPO, you have the right to:

" Obtain from us confirmation as to whether or not we process Personal Data from you and, where that is the case, access to your Personal Data;

" Rectification of inaccurate Personal Data;

" Withdraw your consent for marketing communications (by logging into your account under "Marketing Preferences" or using the unsubscribe link in any of our marketing communications); and

" Withdraw your consent for use of Cookies (via adjusting the setting under your web browser).

To exercise your rights, please contact the Customer Service Team (see Section 14 for contact details). You can also use our web form to exercise your rights.

13. CAN WE CHANGE OUR PRIVACY POLICY?

We may change this Privacy Policy from time to time by posting the updated version of the Privacy Policy here. We encourage you to visit this area frequently to stay informed.

14. HOW DO I MAKE ENQUIRIES ABOUT MY PERSONAL DATA?

If you have any question or request in relation to how we process your personal data, you can contact (i) our Customer Service Team via email at watsmallcs@aswatson.com or via post at 5/F, 6 Dai Li Street, Tai Po Industrial Estate, N.T., Hong Kong; or (ii) our Global Data Protection Officer via email asia.privacy@aswatson.com or via post at Group Privacy Office, Watson House, 1-5 Wo Liu Hang Road, Fotan, Shatin, New Territories, Hong Kong.

15. OTHERS

In case of any discrepancy between the English and Chinese versions of this Privacy Policy, the English version shall prevail.