Consolidated Group Privacy Framework

This section establishes the foundational principles and scope of the privacy policy for the entire group.

1. Introduction & Scope: This Privacy Policy and Personal Information Collection Statement ("Statement") applies to CK Energy (CKE), CK Asset Holdings Limited (CKA), and Synergy Power Solutions (SPS), collectively referred to as "the Group," "we," "us," or "our." We are committed to protecting personal data in accordance with the laws of the jurisdictions in which we operate, including Hong Kong's Personal Data (Privacy) Ordinance (PDPO), the EU/UK General Data Protection Regulation (GDPR), and the People's Republic of China's Personal Information Protection Law (PIPL). This Statement explains our practices regarding the collection, use, disclosure, and protection of your personal data across our group structure.

2. Our Commitment: We process personal data lawfully, fairly, and transparently. We collect data for specified, explicit, and legitimate purposes and do not further process it in a manner that is incompatible with those purposes. We ensure data is adequate, relevant, and limited to what is necessary, accurate, and kept in a form which permits identification of data subjects for no longer than necessary. We process it in a manner that ensures appropriate security .

Data Collection and Purposes of Use

This section clearly outlines what data we collect, how we use it, and the legal bases for processing, which is a core requirement under GDPR and PIPL.

Data We Collect: We may collect the following categories of personal data, where necessary and relevant:

Identity and Contact Data: Name, address, email, phone number, identity document number.

Transaction and Financial Data: Details about payments, properties, services, or activities you request from us.

Technical Data: Internet protocol (IP) address, browser type, device information, and cookies (see below).

Recruitment Data: Information contained in a CV, cover letter, or provided during the recruitment process.

Our Purposes and Legal Bases for Processing: The table below summarizes why we use your data and the legal justifications under applicable laws.

Purpose of Processing

Legal Basis (Depending on Jurisdiction)

Processing requests for properties, services, or activities; contract implementation.

Performance of a Contract / Necessity for the Conclusion or Performance of a Contract (PIPL) .

Responding to inquiries; direct marketing (with consent); website analytics.

Consent (which can be withdrawn) / Legitimate Interests (where assessed and applicable, e.g., for website security) .

Recruitment and human resource management.

Necessity for Human Resources Management (PIPL) / Taking Steps at Your Request prior to entering a contract.

Compliance with legal obligations (e.g., disclosures required by law).

Legal Obligation.

Prevention or detection of crime.

Legitimate Interests / Public Interest.

Cookies and Similar Technologies: Our websites use cookies to distinguish you from other users, helping us provide a good experience and improve our sites. You can set your browser to refuse all or some cookies. However, blocking cookies may impair the functionality of our websites .

International Data Transfers and Disclosure

This section addresses the critical aspect of cross-border data transfers, which are heavily regulated under all the mentioned laws.

Transfers Within the Group: As a global organization, we may transfer your personal data to our group companies and affiliates in other countries. We ensure all such transfers are conducted in compliance with legal requirements .

Transfers to Third Parties and Service Providers: We may disclose your data to our agents, contractors, and professional advisers who provide services to us under strict confidentiality agreements. We may also disclose data in connection with a merger or sale of group assets .

Safeguards for Transfers: When transferring data across borders, particularly from the EU/UK to outside the European Economic Area (EEA), or from China to other countries, we rely on legally sanctioned mechanisms. These include:

Adequacy Decisions: For transfers from the EU, we rely on the European Commission's adequacy decision for the UK, which has been extended until 27 December 2025 .

Standard Contractual Clauses (SCCs): For other transfers, we use the EU's SCCs or other approved contractual frameworks to ensure your data receives adequate protection .

PIPL Compliance: For transfers out of China, we will comply with the requirements under PIPL, which may include passing a security assessment, obtaining certification, or using standard contracts formulated by the Chinese authorities .

Data Security and Retention

Security Measures: We have implemented appropriate technical and organizational security measures to prevent unauthorized access, use, or disclosure of your personal data. Our staff are trained to adhere to strict standards of security and confidentiality. While we strive to protect your data, no electronic transmission or storage method is 100% secure .

Data Retention: We will only retain your personal data for as long as necessary to fulfill the purposes for which it was collected, including to satisfy any legal, accounting, or reporting requirements. To determine the retention period, we consider the amount, nature, sensitivity of the data, the potential risk of harm from unauthorized use, and the applicable legal requirements.

Your Data Subject Rights

This section informs individuals of their rights, which are a cornerstone of modern privacy laws.

You have rights over your personal data. Depending on your jurisdiction and subject to certain legal conditions, these may include:

The right to request access to and a copy of your personal data.

The right to request correction of inaccurate or incomplete data.

The right to request erasure of your personal data.

The right to withdraw consent at any time, where processing is based on consent.

The right to object to processing based on legitimate interests.

The right to data portability, to receive your data in a structured, machine-readable format.

Under China's PIPL, you have the right to explain your personal information and the right to restrict or refuse processing by others of your personal information .

To exercise these rights, please contact the Data Protection Officer using the details in the "Contact Us" section.

Regulatory Complaints: You have the right to lodge a complaint with a supervisory authority in your jurisdiction, such as the Office of the Privacy Commissioner for Personal Data in Hong Kong, the Information Commissioner's Office in the UK, or the relevant regulatory body in your EU member state .

Important Additional Notices

Direct Marketing: We will only use your personal data for direct marketing purposes with your prior consent or indication of no objection, and we will always provide you with an easy way to opt-out of such communications, in accordance with the PDPO, GDPR, and PIPL.

Links to Other Websites: Our websites may contain links to third-party sites. This Statement does not apply to those sites, and we encourage you to read their privacy policies.

Policy Updates: We may update this Statement from time to time. The latest version will always be posted on our websites.

Language: This Statement is provided in English and Chinese. In the event of a discrepancy, the English version shall prevail.