Personal Information Processing Rules

Latest version: 30 June, 2023

Welcome to the Beijing Hong Kong Jockey Club Clubhouse!

Beijing Hong Kong Jockey Club Clubhouse is operated and managed by Beijing Hong Kong Jockey Club Clubhouse Limited, a company incorporated under the laws of the People’s Republic of China (“the PRC”, for the purpose of the Rules only, excluding Hong Kong Special Administrative Region, Macau Special Administrative Region and Taiwan), with its registered address at No. 68 Jinbao Street, Dongcheng District, Beijing (“the Club”, “we”, “us” or “our”).

The Club is committed to ensuring the confidentiality and security of the personal information managed by the Club. The Club is well aware of the importance you attach to your personal information, therefore, the Club attaches great importance to the protection of your personal information and privacy, and will make every effort to protect the safety and reliability of your personal information. The Club will, pursuant to applicable laws and regulations and through this Personal Information Processing Rules (“the Processing Rules” or “the Rules”) let you understand how the Club may collect and use your personal information, your options for managing your personal information and the Club’s determination to protect your personal information. The Club is committed to maintaining your trust in us and be bound by the following principles in protecting your personal information: parity of power and responsibility, explicitly setting out the purposes, consent based, data minimisation, ensuring safety, subject participation, and openness and transparency, etc. At the same time, the Club promises to protect your personal information by taking measures in line with widely recognised security standards within the industry.

The Club wishes to draw your particular attention to the scope of application of the Rules:

(1)	The Rules apply to all products and services provided by the Club to you, including (a) products and services provided by the Club to you through online channels such as social media and online communications; and (b) facilities, goods and services provided by the Club to you through your visit to the Club, or through other offline interactions, etc.
(2)	If affiliates of the Club provide products and services without developing independent personal information processing rules and such products and service has utilised products and services provided by the Club, the Rules shall apply equally to such portion of the products and services. If affiliates of the Club have developed independent personal information protection rules, the independent rules shall prevail. However, for the contents that are not mentioned in such independent rules but are agreed upon in the Rules, the Rules shall apply.
(3)	The Rules shall not apply to the products and services provided by third parties that are included in the products and services provided by the Club. Such products and services are operated or provided by third parties. The Club has no control over the processing of your personal information by such third parties nor shall the Club approve the contents or the method of processing thereof. You shall consult with such third parties for their relevant personal information processing rules or similar provisions to find out how your personal information may be used by such third parties.

The Processing Rules will help you understand the following:

1.	How we collect and use your personal information
2.	How we share, transfer, and publicly disclose your personal information
3.	How we protect the security of your personal information
4.	How we store and transfer your personal information across border
5.	How we protect minors’ personal information
6.	Your personal information rights
7.	Updates and notifications of the Processing Rules
8.	How to contact us
9.	Languages

Please read and understand the Processing Rules carefully before using in any manner the products and services of the Club. You are expected to confirm that you have completely understood the contents of the Rules before using the products and services of the Club and shall be guided by the Rules to make appropriate decisions. If you tick the relevant checkbox(es), it means that you fully understand the Rules and agree that the Club may collect, store, use, process, transmit, provide, publicise, and/or delete your personal information in accordance with the Rules. If you do not agree to any part of the Rules, the Club may not be able to provide products and services to you.

1.	How we collect and use your personal information

1.1

The Club may collect your personal information directly from you and/or from other sources including, but not limited to, the Club’s affiliated companies and/or the Club’s service providers, partners and/or other third parties, as permitted by you or in accordance with applicable laws and regulations. The Club will require third parties to provide confirmation of the lawfulness of the source of their personal information and to use such information within the scope of your authorization. Before providing any personal information of any person other than you (e.g. a member of your family) to the Club, you shall ensure and warrant that such person (or such person’s parent or guardian, as the case may be) has carefully read, understood and agreed to the Rules and, in particular, shall inform such person (or such person’s parent or guardian, as the case may be) of how the Club collects and processes personal information and obtain all necessary consents from that person (or that person’s parent or guardian, as the case may be). If requested by the Club, you shall provide the Club with any necessary supporting documentation to prove such action. The Club will process personal information for the following purposes and the personal information listed below (including sensitive personal information) is necessary to enable the Club to achieve the purposes, and if such personal information is unavailable or inaccurate, the Club may not be able to provide the corresponding products and services:

1.2	The Club may process your personal information if required by the following relevant laws and regulations, agreements, or related legal procedures in order to comply with such requirements or obligations:

(1)	Meeting any obligations, requirements or arrangements (whether compulsory or voluntary), or establishing, exercising or defending any legal rights of the Club, in connection with:
	a)	Any existing or future law, regulation, judgment, court order, sanctions regime, within or outside the PRC;
	b)	Any guidelines, directions, demands or requests given or issued by any legal, regulatory, governmental, tax, law enforcement or other authorities within or outside the PRC;
	c)	Any of the Club’s bye-laws, policies and procedures; or
	d)	Any agreements between you and the Club.

(2)

Complying with any obligations, requirements, policies, procedures, measures or arrangements to share information and news of the Club and/or to use such information and news in other ways in accordance with relevant programmes for sanctions compliance or prevention or detection of money laundering, terrorist financing or other unlawful activities;

(3)	Preventing, detecting or investigating anomalies and preventing and/or remediating fraud or other potentially prohibited or illegal activities or otherwise protecting the integrity of the Club and its affiliated companies;

(4)	Responding or taking part in legal proceedings, including seeking professional advice.

1.3

In accordance with applicable laws and regulations, in most cases, the legal basis for the Club to process your personal information is to obtain your consent, and in certain circumstances required by applicable PRC personal information protection laws and regulations, the Club will process your personal information with your separate consent. In addition, you acknowledge and agree that the Club does not need to obtain your consent to process your personal information in the following circumstances:

(1)

where it is necessary for the conclusion or performance of a contract to which you are a party, or for the implementation of human resources management in accordance with the labor rules and regulations formulated in accordance with the law and the collective contract concluded in accordance with the law;

(2)	where it is necessary for the performance of statutory duties or statutory obligations;

(3)	where it is necessary for the response to a public health emergency or for the protection of the life, health and property safety of a natural person;

(4)	where processing your personal information is for the purpose of news reporting or carrying out supervision by media in public interest and is within a reasonable scope;

(5)	where the personal information processed has been disclosed by you or otherwise legally disclosed and such processing is within a reasonable scope as required by law;

(6)	Other circumstances prescribed by laws and administrative regulations.

2.	How we share, transfer, and publicly disclose your personal information

2.1

Share We may share your personal information (including sensitive personal information) with third parties such as our affiliated companies, business partners or suppliers to facilitate the provision of products and services to you for the purposes set forth in Article 1 of the Rules. However, we will only share the personal information for purposes that are legitimate, proper, necessary, specific and clear and only to the extent necessary in order to safeguard and optimize the products and services provided to you by the Club. Such third parties may be entities within or outside of the PRC, including:

(1)	Affiliated companies: in order to ensure the successful provision of the products and services to you and to achieve uniformity in the management of our group, the Club may share your personal information with our affiliated companies. The Club’s affiliated companies will adopt no less stringent protection measures than those set out herein.
(2)	Business partners: only for the purposes set forth in Article 1 of the Rules, certain services of the Club will be provided by partners or jointly provided by the Club and partners. For example, when you make a payment or apply for a refund, the Club needs to share your order information with financial institutions or third-party payment institutions (including payment channels such as WeChat Pay and UnionPay) to fulfil your payment instructions and complete the payment; when the Club applies for insurance claims (including public liability insurance claims), the Club may share identification documents, medical records, payment vouchers, billing information, etc. with insurance institutions. Such other business partners include companies that provide courier services, payment processing, order fulfilment, information technology and related infrastructure, membership services, email transmission, marketing, technical services and consulting services, companies that send newsletters, marketing materials and promotional information, consulting firms that send surveys, conduct marketing analysis, individuals, companies, associations or professionals that provide consulting services (lawyers, accountants and auditors), etc.
(3)	In addition, the Club may share your personal information in accordance with the provisions of Articles 1.2 and 1.3 of the Rules.

Please be aware that the Club will only share your personal information for lawful, legitimate, necessary, specific, integrity and explicit purposes. The Club will assess the legality, legitimacy and necessity of the third party's collection of your personal information, and will require the third party to process your personal information within the scope of your authorization and consent, as well as to take necessary measures and technical means to prevent the leakage, destruction, loss and falsification of your personal information. The third party has no right to use your personal information shared for other purposes, and it shall obtain your additional consent anew in case of changes in the purpose and method of processing your personal information. You may refer to the attachment titled the Third Party List of Information Sharing in the Rules for more information of the recipients.

For companies, organizations and individuals with whom we share personal information, we will enter into appropriate data processing agreements with them, requiring them to handle personal information in accordance with our instructions and any other relevant confidentiality and security measures. In addition, we will also carry out personal information protection impact assessment, and will only start sharing personal information upon successful completion of the assessment. If you want to know more about such data recipients, please contact us through the contact information set out in Article 11 below.

2.2	Transfer We will not transfer your personal information to any company, organization or individual, except in the following cases:

(1)	Such transfer is with your explicit consent or under your authorisation;
(2)	Such transfer is in accordance with applicable laws and regulations, the requirements of legal procedures, mandatory administrative or judicial requirements;
(3)	In the event of a merger, division, liquidation or bankruptcy, we will require the new company or organisation that will obtain your personal information to remain bound by the Processing Rules or to otherwise obtain your consent separately.

2.3	Public disclosure We will only publicly disclose your personal information under the following circumstances:

(1)	Such disclosure is with your explicit consent;
(2)	we may publicly disclose your personal information in accordance with the type of personal information requested and the manner of disclosure when such disclosure is required by law, legal procedures, litigation, or compulsorily by government authorities.

3.	How we protect the security of your personal information

3.1	We are committed to protecting the security of your personal information. We will use a variety of physical, technological and organisational measures to help protect your personal information from unauthorised or accidental access, processing, deletion or other use. From the perspective of the lifecycle of personal information, the Club has established safety protection measures in various aspects such as collection, storage, display, use and deletion, and adopted different control measures according to the level of information sensitivity, including but not limited to access control, encrypted transmission or encrypted storage by encryption algorithms. The Club also adopts strict management of employees who may have access to personal information, and establishes approval mechanisms for important operations such as data access, internal and external transmission and use, desensitization and decryption, as well as signing confidentiality agreements with these employees, etc. At the same time, the Club also regularly conducts information security trainings for employees, requiring them to form good operating habits in their daily work and enhance their awareness of data protection.
3.2	The transmission of information via the internet or mobile network is not completely secure. The security measures described above do not preclude us from the possibility of fraud, cyber-attacks, such as hacking, spyware and viruses, and we do not guarantee that our servers or network will be immune from such attacks. Although we will implement security measures to protect your personal information, we cannot guarantee security of the data transmitted via internet or mobile network. You agree that the Club shall not be liable for any loss or damage arising from risks relating to any transmission.
3.3	In order to respond to personal information security incidents, we will comply with reporting and notification obligations required by laws and regulations, the scope of the notification may include: the basic description and possible impact of the security incident, the measures we have taken or will take, suggestions for you to prevent and reduce risks, remedial measures for you, etc. Where applicable, we will promptly inform you of the relevant circumstances of the incident by email, letter, telephone call, push notification, etc. If it is difficult to inform the individuals affected one by one, we will take a reasonable and effective way to publish an announcement. Meanwhile, we will also proactively report the handling of personal information security incidents in accordance with the requirements of the regulatory authorities.

4.	How we store and transfer your personal information across border

4.1

Retention of personal information The Club will store your personal information in accordance with applicable personal information protection laws and regulations and within the period necessary to achieve the purposes described in the Rules, and when the corresponding personal information is no longer relevant and in any case after the expiration of the retention period under applicable law, the Club will delete your personal information or anonymize it in accordance with the requirements of applicable law, unless a longer period of time is required to process the relevant personal information. When assessing the retention period of personal information, the Club will primarily refer to the following criteria whichever is longer:

(1)	To fulfil the purpose of the relevant transaction with you, to maintain the corresponding transaction records and to respond to your possible inquiries, complaints or judicial proceedings;
(2)	To ensure the safety and quality of the products and services provided by the Club to you;
(3)	A longer retention period agreed by you;
(4)	Whether there are other special agreements or legal requirements for retention periods.
	Retention of personal information In addition, the Club will give sufficient consideration to factors such as the volume, nature and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure of the personal information, the purposes of processing the personal information and whether those purposes can be achieved by other means, and applicable legal requirements.

4.2

Cross-border transfer of personal information In principle, the Club will process your personal information in the territory of the PRC in accordance with the processing purposes set out in the Rules. However, as the Club provides products and services through cross-border resources and servers, the Club may have to make cross-border transfer of your personal information in order to complete the relevant orders, process the relevant information or provide the relevant products and services, therefore, the Club may need to provide some of your personal information to recipients outside of the PRC for processing (you may refer to the attachment titled the Third Party List of Information Sharing in the Rules for more information). In such cases, your personal information may be transferred to, or be accessed by jurisdictions outside of the country in which you use the products and services. The aforementioned jurisdiction is the Hong Kong Special Administrative Region, which has enacted personal information protection laws. In addition to obtaining separate consent and completing the appropriate conditions for cross-border transfers, the Club will take all steps reasonably necessary to ensure that your personal information is processed securely and receives sufficiently equivalent protection to the same extent as it is in the territory of the PRC. In the event of a cross-border transfer and/or further transfer outside of the PRC beyond the scope of the Rules, the Club will separately obtain your authorized consent and complete the prerequisites for the cross-border transfer and further transfer in accordance with the requirements of the relevant laws and regulations.

5.	How we protect minors’ personal information

5.1	We attach great importance to the protection of the minors’ personal information (i.e. children under the age of 14), therefore, we have developed special rules on processing of minors’ personal information based on the Processing Rules to clarify relevant matters in relation to the protection of minors’ personal information. Please refer to our Rules on Processing Minors’ Personal Information and Instructions to Guardians for details. We have no intention to collect personal information from minors, unless upon the agreement of their parents or guardians and only if such collection is necessary for the provision of goods, services, facilities or membership to the minors (e.g., personal information of a minor is required if he or she is a holder of the Beijing Hong Kong Jockey Club Clubhouse Supplementary Card, etc.).
5.2	The Club also attaches great importance to the protection of personal information of children (refer to minors under the age of 14). If you are under the age of 14, you shall ensure that your parent or guardian has read and consented to Children’s Personal Information Processing Rules and Instructions to Guardians which is specially established by the Club before providing personal information to the Club and using the Club's products and services under the guidance and consent of your parent or guardian. If your parents or guardians subsequently withdraw the consent for you relating to the provision of your personal information to us, you should immediately cease the provision of such personal information, refrain from using the services, facilities and membership of the Club and/or cease in purchasing any goods from the Club, and notify us of such withdrawal without delay so as to allow us to take appropriate actions.
5.3	The Club does not intend to process minors’ personal information unless we obtain the consent of their parents or guardians. In cases where the Club collects personal information from minors with the consent of their parents or guardians, the Club will only process such personal information as permitted by law or regulation, as agreed by their parents or guardians, or as reasonably necessary to protect the minors.

6.

Your personal information rights For the purpose of collection as set out herein and for the performance of the Club's obligations under the relevant contracts, laws and regulations, all personal information collected from you by the Club shall only be stored for a reasonable period of time, for example:

6.1

You have the right to access, reproduce, revise, add and delete your personal information, subject to the exceptions provided by laws and regulations. You also have the right to request the transmission of personal information, provided that it complies with the law. To exercise the aforesaid rights or require us to provide an explanation, please contact us via the contact information set out in Article 8 of the Rules.

6.2

Withdraw consent and change the scope of consent

(1)

We process your personal information on the basis of your consent. You may withdraw your consent at any time by contacting us via the contact information set out in Article 8 of the Rules below, whereupon you should specify the consent you would like to withdraw. Unless otherwise permitted by law, upon withdrawal of your consent, we will no longer process your personal information. This decision will not affect the personal information processing activities conducted based on your authorisation before such withdrawal.

(2)

By contacting us via the contact information set out in Article 8 below, you may change the scope in your consent with respect to the collection and use of the information you provide.

6.3	De-registrate your membership account

(1)	You may contact us via the contact information set out in Article 8 of the Rules at any time to de-registrate your membership account, and we will respond to your de-registration request within 15 working days.
(2)	Upon the de-registration of your membership account, the Club will cease to provide you with goods or services based on your account and will delete or anonymise your personal information at your request, except as otherwise required by laws or regulations.

7.	Updates and notifications of the Processing Rules

7.1

You acknowledge and agree that we will post on the website at https://www.beijingclubhouse.com/en-US/privacystatement.aspx changes to the Processing Rules from time to time, we shall mark the latest update date of the Processing Rules and such updated Rules shall come into effect after being publicised. Without your explicit consent, we will not reduce your rights under the Processing Rules. For major changes to the Processing Rules, we will provide prominent notifications (including changes of certain personal information processing matters, in which circumstance we will send a notice to you by email, SMS, letter or other contact means explaining the specific changes and obtaining your separate consent (if required)). You are kindly requested to read the latest version of the Processing Rules.

8.

How to contact us If you have any questions, concerns or suggestions regarding the Processing Rules, you may contact our Data Privacy Compliance Officer. We reserve the right to charge a reasonable fee for the processing of requests for access or revision of your personal information. You may direct your request in writing to: Data Privacy Compliance Officer No.68 Jinbao Street, Dongcheng District Beijing, 100005, P.R.C. Tel: (86 10) 5911 8888

9.

Languages This Processing Rules are written in simplified Chinese and may be translated into English and other languages. The simplified Chinese version shall have the same legal effective as other translated versions. In the event of any inconsistency between the simplified Chinese version and the translated versions of this Processing Rules, the simplified Chinese version shall prevail.

Latest version: 30 June, 2023

Welcome to the Beijing Hong Kong Jockey Club Clubhouse!

Beijing Hong Kong Jockey Club Clubhouse is operated and managed by Beijing Hong Kong Jockey Club Clubhouse Limited, a company incorporated under the laws of the People’s Republic of China (“the PRC”, for the purpose of the Rules only, excluding Hong Kong Special Administrative Region, Macau Special Administrative Region and Taiwan), with its registered address at No. 68 Jinbao Street, Dongcheng District, Beijing (“the Club”, “we”, “us” or “our”).

The Club is committed to ensuring the confidentiality and security of the personal information managed by the Club. The Club is well aware of the importance you attach to your personal information, therefore, the Club attaches great importance to the protection of your personal information and privacy, and will make every effort to protect the safety and reliability of your personal information. The Club will, pursuant to applicable laws and regulations, and through this Personal Information Processing Rules (“the Processing Rules” or “the Rules”) let you understand how the Club may collect and use your personal information, your options for managing your personal information and the Club’s determination to protect your personal information. The Club is committed to maintaining your trust in us and be bound by the following principles in protecting your personal information: parity of power and responsibility, explicitly setting out the purposes, consent based, data minimisation, ensuring safety, subject participation, and openness and transparency, etc. At the same time, the Club promises to protect your personal information by taking measures in line with widely recognised security standards within the industry.

The Club wishes to draw your particular attention to the scope of application of the Rules:

(1)	The Rules apply to all products and services provided by the Club to you, including (a) products and services provided by the Club to you through online channels such as social media and online communications; and (b) facilities, goods and services provided by the Club to you through your visit to the Club, or through other offline interactions, etc.
(2)	If affiliates of the Club provide products and services without developing independent personal information processing rules and such products and services has utilised products and services provided by the Club, the Rules shall apply equally to such portion of the products and services. If affiliates of the Club have developed independent personal information protection rules, such independent rules shall prevail. However, for the contents that are not mentioned in such independent rules but are agreed upon in the Rules, the Rules shall apply.
(3)	The Rules shall not apply to the products and services provided by third parties that are included in the products and services provided by the Club. Such products and services are operated or provided by third parties. The Club has no control over the processing of your personal information by such third parties nor shall the Club approve the contents or the method of processing thereof. You shall consult with such third parties for their relevant personal information processing rules or similar provisions to find out how your personal information may be used by such third parties.

The Processing Rules will help you understand the following:

1.	How we collect and use your personal information
2.	How we share, transfer, and publicly disclose your personal information
3.	How we protect the security of your personal information
4.	How we store and transfer your personal information across border
5.	How we protect minors’ personal information
6.	Your personal information rights
7.	Updates and notifications of the Processing Rules
8.	How to contact us
9.	Languages

Please read and understand the Processing Rules carefully before using in any manner the products and services of the Club. You are expected to confirm that you have completely understood the contents of the Rules before using the products and services of the Club and shall be guided by the Rules to make appropriate decisions. If you tick the relevant checkbox(es), it means that you fully understand the Rules and agree that the Club may collect, store, use, process, transmit, provide, publicise, and/or delete your personal information in accordance with the Rules. If you do not agree to any part of the Rules, the Club may not be able to provide products and services to you.

1.	How we collect and use your personal information

1.1

The Club may collect your personal information directly from you and/or from other sources including, but not limited to, the Club’s service providers, partners and/or other third parties, as permitted by you or in accordance with applicable laws and regulations. The Club will require third parties to provide confirmation of the lawfulness of the source of their personal information and to use such information within the scope of your authorisation. Before providing any personal information of any person other than you (e.g. a member of your family) to the Club, you shall ensure and warrant that such person (or such person’s parent or guardian, as the case may be) has carefully read, understood and agreed to the Rules and, in particular, shall inform such person (or such person’s parent or guardian, as the case may be) of how the Club collects and processes personal information and obtain all necessary consent from that person (or that person’s parent or guardian, as the case may be). If requested by the Club, you shall provide the Club with any necessary supporting documentation to prove such action. The Club will process personal information for the following purposes and the personal information listed below (including sensitive personal information) is necessary to enable the Club to achieve the purposes, and if such personal information is unavailable or inaccurate, the Club may not be able to provide the corresponding products and services:

1.2

Information collected by the Club to enhance your experience or promote the facilities, goods or services of the Club In order to provide you with better services, for the purposes set out in this Article 1.2, the Club may collect and process Identity Information and other information including information collected when you visit, participate in activities of or purchasing goods from the Club, including hobbies, shopping records, usage of special social networks, social networks ID, language, favourite goods, purchasing details, usage of clubhouse facilities, ways of using services, service preferences, and data collected when you browse our website, including behavioural data recorded using cookies or similar technologies, as described below in our cookies policy below: 4

(1)	Meeting any obligations, requirements or arrangements (whether compulsory or voluntary), or establishing, exercising or defending any legal rights of the Club, in connection with:
	a)	Any existing or future law, regulation, judgment, court order, sanctions regime, within or outside the PRC;
	b)	Any guidelines, directions, demands or requests given or issued by any legal, regulatory, governmental, tax, law enforcement or other authorities within or outside the PRC;
	c)	Any of the Club’s bye-laws, policies and procedures; or
	d)	Any agreements between you and the Club.

(2)	Complying with any obligations, requirements, policies, procedures, measures or arrangements to share information and news of the Club and/or to use such information and news in other ways in accordance with relevant programmes for sanctions compliance or prevention or detection of money laundering, terrorist financing or other unlawful activities;
(3)	Preventing, detecting or investigating anomalies and preventing and/or remediating fraud or other potentially prohibited or illegal activities or otherwise protecting the integrity of the Club and its affiliated companies;
(4)	Responding or taking part in legal proceedings, including seeking professional advice.

1.3

In accordance with applicable laws and regulations, in most cases, the legal basis for the Club to process your personal information is to obtain your consent, and in certain circumstances required by applicable PRC personal information protection laws and regulations, the Club will process your personal information with your separate consent. In addition, you acknowledge and agree that the Club does not need to obtain your consent to process your personal information in the following circumstances:

(1)	where it is necessary for the conclusion or performance of a contract to which you are a party, or for the implementation of human resources management in accordance with the labor rules and regulations formulated in accordance with the law and the collective contract concluded in accordance with the law;
(2)	where it is necessary for the performance of statutory duties or statutory obligations;

(3)	where it is necessary for the response to a public health emergency or for the protection of the life, health and property safety of a natural person;
(4)	where processing your personal information is for the purpose of news reporting or carrying out supervision by media in public interest and is within a reasonable scope;
(5)	where the personal information processed has been disclosed by you or otherwise legally disclosed and such processing is within a reasonable scope as required by law;
(6)	Other circumstances prescribed by laws and administrative regulations.

2.	How we share, transfer, and publicly disclose your personal information

2.1

Share We may share your personal information (including sensitive personal information) with third parties such as our affiliated companies, business partners or suppliers to facilitate the provision of products and services to you for the purposes set forth in Article 1 of the Rules. However, we will only share the personal information for purposes that are legitimate, proper, necessary, specific and clear and only to the extent necessary in order to safeguard and optimize the products and services provided to you by the Club. Such third parties may be entities within or outside of the PRC, including:

(1)	Affiliated companies: in order to ensure the successful provision of the products and services to you and to achieve uniformity in the management of our group, the Club may share your personal information with our affiliated companies. The Club's affiliated companies will adopt no less stringent protection measures than those set out herein.
(2)	Business partners: only for the purposes set forth in Aritcle 1 of the Rules, certain services of the Club will be provided by partners or jointly provided by the Club and partners. For example, when you make a payment, the Club needs to share your order information with financial institutions to fulfil your payment instructions and complete the payment; when the Club applies for insurance claims, the Club may share identification documents, medical records, payment vouchers, billing information, etc. with insurance institutions.
(3)	In addition, the Club may share your personal information in accordance with the provisions of Article 1.2 and 1.3 of the Rules.

Please be aware that the Club will only share your personal information for lawful, legitimate, necessary, specific, integrity and explicit purposes. The Club will assess the legality, legitimacy and necessity of the third party's collection of your personal information, and will require the third party to process your personal information within the scope of your authorization and consent, as well as to take necessary measures and technical means to prevent the leakage, destruction, loss and falsification of your personal information. The third party has no right to use your personal information shared for other purposes, and it shall obtain your additional consent anew in case of changes in the purpose and method of processing your personal information. You may refer to the attachment titled the Third Party List of Information Sharing in the Rules for more information of the recipients.

2.2	Transfer We will not transfer your personal information to any company, organization or individual, except in the following cases:

(1)	Such transfer is with your explicit consent or under your authorisation;
(2)	such transfer is in accordance with applicable laws and regulations, the requirements of legal procedures, mandatory administrative or judicial requirements; or

(3)	In the event of a merger, division, liquidation or bankruptcy, we will require the new company or organisation that will obtain your personal information to continue to be bound by the Processing Rules or to otherwise obtain your consent separately.

2.3	Public disclosure We will only publicly disclose your personal information under the following circumstances:

(1)	Such disclosure is with your explicit consent;
(2)	we may publicly disclose your personal information in accordance with the type of personal information requested and the manner of disclosure when such disclosure is required by law, legal procedures, litigation, or compulsorily by government authorities.

3.	How we protect the security of your personal information

3.1	We are committed to protecting the security of your personal information. We will use a variety of physical, technological and organisational measures to help protect your personal information from unauthorised or accidental access, processing, deletion or other use. From the perspective of the lifecycle of personal information, the Club has established safety protection measures in various aspects such as collection, storage, display, use and deletion, and adopted different control measures according to the level of information sensitivity, including but not limited to access control, encrypted transmission or encrypted storage by encryption algorithms. The Club also adopts strict management of employees who may have access to personal information, and establishes approval mechanisms for important operations such as data access, internal and external transmission and use, desensitization and decryption, as well as signing confidentiality agreements with these employees, etc. At the same time, the Club also regularly conducts information security trainings for employees, requiring them to form good operating habits in their daily work and enhance their awareness of data protection.
3.2	The transmission of information via the internet or mobile network is not completely secure. The security measures described above do not preclude us from the possibility of fraud, cyber-attacks, such as hacking, spyware and viruses, and we do not guarantee that our servers or network will be immune from such attacks. Although we will implement security measures to protect your personal information, we cannot guarantee security of the data transmitted via internet or mobile network. You agree that the Club shall not be liable for any loss or damage arising from risks relating to any transmission.
3.3	In order to respond to personal information security incidents, we will comply with reporting and notification obligations required by laws and regulations, the scope of the notification may include: the basic description and possible impact of the security incident, the measures we have taken or will take, suggestions for you to prevent and reduce risks, remedial measures for you, etc. Where applicable, we will promptly inform you of the relevant circumstances of the incident by email, letter, telephone call, push notification, etc. If it is difficult to inform the individuals affected one by one, we will take a reasonable and effective way to publish an announcement. Meanwhile, we will also proactively report the handling of personal information security incidents in accordance with the requirements of the regulatory authorities.

4.	How we store and transfer your personal information across border

4.1

Retention of personal information The Club will store your personal information in accordance with applicable personal information protection laws and regulations and within the period necessary to achieve the purposes described in the Rules, and when the corresponding personal information is no longer relevant and in any case after the expiration of the retention period under applicable law, the Club will delete your personal information or anonymize it in accordance with the requirements of applicable law, unless a longer period of time is required to process the relevant personal information. When assessing the retention period of personal information, the Club will primarily refer to the following criteria whichever is longer:

(1)	To fulfil the purpose of the relevant transaction with you, to maintain the corresponding transaction records and to respond to your possible inquiries, complaints or judicial proceedings;
(2)	To ensure the safety and quality of the products and services provided by the Club to you;
(3)	A longer retention period agreed by you;
(4)	Whether there are other special agreements or legal requirements for retention periods.

In addition, the Club will give sufficient consideration to factors such as the volume, nature and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure of the personal information, the purposes of processing the personal information and whether those purposes can be achieved by other means, and applicable legal requirements.

4.2

Cross-border transfer of personal information In principle, the Club will process your personal information in the territory of the PRC in accordance with the processing purposes set out in the Rules. However, as the Club provides products and services through cross-border resources and servers, the Club may have to make cross-border transfer of your personal information in order to complete the relevant orders, process the relevant information or provide the relevant products and services, therefore, the Club may need to provide some of your personal information to recipients outside of the PRC for processing (you may refer to the attachment titled the Third Party List of Information Sharing in the Rules for more information). In such cases, your personal information may be transferred to, or be accessed by jurisdictions outside of the country in which you use the products and services. The aforementioned jurisdiction is the Hong Kong Special Administrative Region, which has enacted personal information protection laws. In addition to obtaining separate consent and completing the appropriate conditions for cross-border transfers, the Club will take all steps reasonably necessary to ensure that your personal information is processed securely and receives sufficiently equivalent protection to the same extent as it is in the territory of the PRC. In the event of a cross-border transfer and/or further transfer outside of the PRC beyond the scope of the Rules, the Club will separately obtain your authorised consent and complete the prerequisites for the cross-border transfer and further transfer in accordance with the requirements of the relevant laws and regulations.

5.	How we protect minors’ personal information

5.1	We attach great importance to the protection of the minors’ personal information (minors refer to natural persons under the age of 18; however, minors at the age of 16 or above whose main source of support is the income from his own labour is deemed as a person with full capacity for performing civil juristic acts ). If you are a minor, you shall only provide your personal information and use the products and services of the Club only if your parent or guardian has expressly consented to the provision of your personal information in accordance with the Rules.
5.2	The Club also attaches great importance to the protection of personal information of children (refer to minors under the age of 14). If you are under the age of 14, you shall ensure that your parent or guardian has read and consented to Children’s Personal Information Processing Rules and Instructions to Guardians which is specially established by the Club before providing personal information to the Club and using the Club's products and services under the guidance and consent of your parent or guardian. If your parents or guardians subsequently withdraw the consent for you relating to the provision of your personal information to us, you should immediately cease the provision of such personal information, refrain from using the services, facilities of the Club and/or cease in purchasing any goods from the Club, and notify us of such withdrawal without delay so as to allow us to take appropriate actions.
5.3	The Club does not intend to process minors’ personal information unless we obtain the consent of their parents or guardians. In cases where the Club collects personal information from minors with the consent of their parents or guardians, the Club will only process such personal information as permitted by law or regulation, as agreed by their parents or guardians, or as reasonably necessary to protect the minors.

6.	Your personal information rights

6.1

Access, reproduce, revise, add and delete your personal information You have the right to access, reproduce, revise, add and delete your personal information, subject to the exceptions provided by laws and regulations. You also have the right to request the transmission of personal information, provided that it complies with the law. To exercise the aforesaid rights or require us to provide an explanation, please contact us via the contact information set out in Article 8 of the Rules.

6.2

Withdraw consent and change the scope of consent

(1)

We process your personal information on the basis of your consent. You may withdraw your consent at any time by contacting us via the contact information set out in Article 8 of the Rules below, whereupon you should specify the consent you would like to withdraw. Unless otherwise permitted by law, upon withdrawal of your consent, we will no longer process your personal information. This decision will not affect the personal information processing activities conducted based on your authorisation before such withdrawal.

(2)

By contacting us via the contact information set out in Article 8 below, you may change the scope in your consent with respect to the collection and use of the information you provide.

7.

Updates and notifications of the Processing Rules You acknowledge and agree that we will post on the website at https://www.beijingclubhouse.com/en-US/privacystatement.aspx changes to the Processing Rules from time to time, we shall mark the latest update date of the Processing Rules and such updated Rules shall come into effect after being publicised. Without your explicit consent, we will not reduce your rights under the Processing Rules. For major changes to the Processing Rules, we will provide prominent notifications (including changes of certain personal information processing matters, in which circumstance we will send a notice to you by email, SMS, letter or other contact means explaining the specific changes and obtaining your separate consent (if required)). You are kindly requested to read the latest version of the Processing Rules.

8.

How to contact us If you have any questions, concerns or suggestions regarding the Processing Rules, you may contact our Data Privacy Compliance Officer. We reserve the right to charge a reasonable fee for the processing of requests for access or revision of your personal information. You may direct your request in writing to: Data Privacy Compliance Officer No.68 Jinbao Street, Dongcheng District Beijing, 100005, P.R.C. Tel: (86 10) 5911 8888

9.

Languages This Processing Rules are written in simplified Chinese and may be translated into English and other languages. The simplified Chinese version shall have the same legal effect as other translated versions. In the event of any inconsistency between the simplified Chinese version and the translated versions of this Processing Rules, the simplified Chinese version shall prevail.

Latest version: 30 June, 2023

Welcome to the Beijing Hong Kong Jockey Club Clubhouse!

Beijing Hong Kong Jockey Club Clubhouse is operated and managed by Beijing Hong Kong Jockey Club Clubhouse Ltd. Co., a company incorporated under the laws of the People's Republic of China (“the PRC”, for the purpose of the Rules only, excluding Hong Kong Special Administrative Region, Macau Special Administrative Region and Taiwan), with its registered address at No. 68 Jinbao Street, Dongcheng District, Beijing (“the Club”, “we”, “us” or “our”).

The Club is committed to ensuring the security and privacy of the children’s personal information (i.e. minors under the age of 14, same hereinafter). Therefore, on the basis of the Personal Information Processing Rules, the Club would like to, through this Children’s Personal Information Processing Rules and Instructions to Guardians (“the Processing Rules” or “the Rules”), explain the handling rules that the Club applies to collect and use children’s personal information and other relevant matters.

If you are a child, please read the Personal Information Processing Rules and the Rules with your parents or guardians and obtain their consent before providing any personal information to the Club. In addition, you shall use the facilities, purchase/use the goods/services provided by the Club with their consent and guidance.

If you are a parent or guardian and wishes to provide the Club with any personal information about a child in your custody, please ensure that you have previously read and fully understand the Personal Information Processing Rules and the Rules and agree to all terms herein. Your understanding and cooperation are necessary for us to protect the personal information and privacy of your children. In order to safeguard the legitimate rights and interests of your children, we hope that you can assist us to ensure that your children’s use of the facilities, purchase/use of goods and services are all within your consent and guidance. We will take special measures to protect the personal information of your children obtained by us according to the Rules. If you do not agree to the Rules, please ask your children to immediately stop using the Club’s facilities or purchasing/using the Club’s goods/services.

If you have any questions about the Rules or any other relevant matters after you have read it, you may contact the Club through the means provided in the Rules and the Club will provide you with an answer as soon as possible.

The Processing Rules will help you understand the following:

1.	How we collect and use children’s personal information
2.	How we share, transfer, and publicly disclose children’s personal information
3.	How we store and transfer children’s personal information across border
4.	How we protect children’s personal information
5.	How we deal with children’s personal information
6.	Updates to the Processing Rules
7.	How to contact us
8.	Languages

1.	How we collect and use children’s personal information

1.1	Please understand that under certain circumstances, the Club is unable to identify and determine whether the personal information processed falls under the scope of children’s personal information, in such case, the Club will process such personal information in strict accordance with the Personal Information Processing Rules.
1.2	The Club will process children’s personal information for the following purposes and the personal information listed below (including sensitive personal information) is necessary to enable the Club to achieve the purposes, and if such personal information is unavailable or inaccurate, the Club may not be able to provide the corresponding products or services:

1.3

The Club may collect and use other personal information of your children for the purpose of providing you or your children with the relevant facilities, goods and services. For the specific purposes for such use or scope of the said children’s personal information collected for such purposes, please refer to the section titled “How we collect and use your personal information” in the Information Processing Rules .

2.	How we share, transfer, and publicly disclose children’s personal information

2.1

The Club may only share, transfer and publicly disclose children’s personal information in compliance with applicable laws and regulations and under your explicit authorisation and consent. You may refer to the section titled “How we share, transfer, and publicly disclose your personal information” in the Personal Information Processing Rules for more information.

2.2

If it is necessary to share children’s personal information with a third party, the Club will evaluate the legality, legitimacy and necessity of the collection of children’s personal information by the third party. In addition, the Club shall require the third party to take measures to protect the children’s personal information and strictly abide by the relevant laws and regulations and supervision requirements. The Club will require the third party receiving the children’s personal information to comply with strict confidentiality obligations and take effective confidentiality measures so as to prohibit the third party from using the children’s personal information for unauthorized purposes, and to require the third parties to comply with the following obligations in accordance with the law:

(1)	To process children’s personal information in accordance with laws and regulations and the requirements of the Club;
(2)	To assist the Club in responding to applications and inquiries from guardians;
(3)	To take strict measures to safeguard information security and provide timely feedback to the Club whenever there is a security breach;
(4)	To delete or anonymize children’s personal information in a timely manner when the partnership or engagement relationship is terminated;
(5)	Not to subcontract or re-share, transfer or publicly disclose children’s personal information without fulfilling the corresponding legal obligations;
(6)	Any other obligations to protect children’s personal information as required by law.

3.	How we store and transfer children’s personal information across border

3.1

Retention of children’s personal information The Club will store children’s personal Information in accordance with applicable personal Information protection laws and regulations as well as within the period necessary to achieve the purposes described in the Rules, and when the corresponding children’s personal information is no longer relevant and in any case after the expiration of the retention period under applicable law, the Club will delete or anonymize the children’s personal information as required by the applicable laws, unless a longer period of time is required to process the relevant information. You may refer to the section titled “How we store and transfer personal information across borders” in the Personal Information Processing Rules for more information.

3.2

Cross-border transfer of children’s personal information In principle, the Club will process children’s personal information in the territory of the PRC in accordance with the processing purposes set out in the Rules. However, as the Club provides goods and services through cross-border resources and servers, the Club may have to make cross-border transmission of your children’s information in order to complete the relevant orders, process the relevant information or provide the relevant products and services. Therefore, the Club may need to provide some of the children’s personal information to recipients outside of the PRC for processing (You may refer to the attachment titled The Third Party List of Information Sharing in the Personal Information Processing Rules for more information). In such cases, the relevant children’s personal information may be transferred to, or be accessed by jurisdictions outside of the country in which you or your children use the products and services. The aforementioned jurisdiction is the Hong Kong Special Administrative Region, which has enacted personal information protection laws. In addition to obtaining separate consent and completing the appropriate conditions for cross-border transfers, the Club will take all steps reasonably necessary to ensure that the relevant children’s personal information is processed securely and is under sufficiently equivalent protection to the same extent as it is in the territory of the PRC. In the event of a cross-border transfer and/or further-transfer outside of the PRC beyond the scope of the Rules, the Club will separately obtain your or your parent’s or guardian’s authorized consent and complete the prerequisites for the cross-border transfer and further transfer in accordance with the requirements of the relevant laws and regulations.

4.

How we protect children’s personal information The Club attaches great importance to the privacy and security of children’s personal information, and will take all reasonable and feasible measures to protect your or your children’s personal information. The Club shall take physical, technical and organizational measures to protect or assist in protecting children’s personal information from unauthorized or accidental access, processing, deletion or other use. If you wish to know more about the measures taken by the Club to protect the children’s personal information, please refer to the section titled “How we protect the security of your personal information” in the Personal Information Processing Rules for more information.

5.

How we deal with children’s personal information The section titled “Your personal information rights” in the Personal Information Processing Rules shall apply to circumstances where you, as the children’s parent or guardian, may exercise the corresponding personal information rights set forth therein on behalf of the children.

6.

Updates to the Processing Rules You acknowledge and agree that we may post on the website at https://www.beijingclubhouse.com/en-US/privacystatement.aspx changes to the Rules from time to time, we shall mark the latest update date of the Processing Rules and such rules shall come into effect after being published. Without explicit consent, we will not reduce your and your children’s rights under the Processing Rules. For major changes to the Rules, we will provide prominent notifications (including changes of certain children’s personal information processing matters, in which circumstance we may send a notice to you by email, SMS, letter or other contact means explaining the specific changes and obtaining your separate consent (if required)). You are kindly requested to read the latest version of the Processing Rules.

7.

How to contact us If you have any questions, concerns or suggestions regarding the Rules, you may contact our Data Privacy Compliance Officer. We reserve the right to charge a reasonable fee for the processing of requests for access or revision of your and your child’s personal information. You may direct your request in writing to: Data Privacy Compliance Officer No.68 Jinbao Street, Dongcheng District Beijing, 100005, P.R.C. Tel: (86 10) 5911 8888

8.

Languages This Processing Rules are written in simplified Chinese and may be translated into English and other languages. The simplified Chinese version shall have the same legal effect as other translated versions. In the event of any inconsistency between the simplified Chinese version and the translated versions of this Processing Rules, the simplified Chinese version shall prevail.