Introduction and Privacy Policy Statement

The "5G Velocity Redefined: Infinite VR Possibilities" campaign (hereinafter referred to as "the Campaign") is organized by MTR Advertising (hereinafter referred to as “the Organizer”), and managed by JCDecaux Pearl & Dean Limited and Bravo Media Limited (hereinafter referred to as "the Advertising Agencies").

We shall strictly comply with the provisions of the Personal Data (Privacy) Ordinance (Cap. 486 of the Laws of Hong Kong) (hereinafter referred to as the "PDPO"). When you register on or use the Campaign website, upload photos, or participate in the Campaign, you acknowledge that you have read, understood, and unconditionally agreed to accept the data handling practices described in this Policy.

Categories of Personal Data Collected

During your booking on the Campaign website and on-site experience, we may collect the following categories of personal data:

• Basic Contact and Identification Data: Including your Chinese or English name, phone number, email address, and age group

• Image and Portrait Data: Including clear, frontal, single-person photos voluntarily uploaded by you, as well as "AI Portraits" and related displays generated by the system based on such photos.

• On-site 5G VR Event Booking and Check-in Records: Including your selected experience items, designated MTR station zones, booking dates and timeslots, check-in records, etc.

• Technical and Device Data: When you browse this website, the server may automatically record your IP address, browser type, operating system, and access times.

You have the right to choose whether to provide the above personal data. However, failure to provide mandatory information (such as name, phone number, email address, and photo) may result in our inability to arrange your booking, send confirmation notifications, or provide customized AI Portrait generation and VR interactive experiences.

Purposes of Collection and Use of Personal Data

We collect and use your personal data for the following purposes:

• Booking Management and Identity Verification: Processing and verifying your experience bookings, sending booking confirmation notifications, and verifying your identity during on-site reception.

• Provision of AI Portrait Generation and VR Experience: Using your uploaded photos for system analysis and AI rendering to generate virtual AI Portraits for display or use in VR experiences, live broadcasts, replays, or featured displays on designated electronic screens within MTR stations.

• Customer Inquiries and Communication: Responding to your inquiries, comments, complaints, or emergency communications.

• Statistical Analysis and Campaign Evaluation: Conducting anonymous statistical analysis, research, and evaluation to assess Campaign effectiveness and improve future service quality.

• Legal and Compliance Purposes: Complying with applicable laws and regulations, regulatory requirements, or assisting law enforcement agencies with investigations.

Direct Marketing Terms

• Use of Personal Data: Participants agree that the Organizer, the Advertising agencies, and authorized business partners may use personal data provided by participants in the Campaign, including name, phone number, email address, and age group to send updates, latest products, services, promotional offers, campaigns, and marketing communications regarding the Organizer or authorised business partners.

• Third-Party Data Transfer (Subject to Explicit Consent): Upon obtaining the explicit prior consent of participants, we may transfer or share participants' personal data (including name, phone number, email address, and age group) with designated third-party partners (such as campaign sponsors and authorized business partners) solely for the purpose of enabling such third parties to provide direct marketing and promotional communications to participants. Without explicit consent, we will never sell, rent, or disclose personal data to unrelated third parties for their independent commercial use.

• Voluntary Principle and Right to Opt-Out: The provision of personal data for direct marketing purposes is purely voluntary. Participants may, at any time and free of charge, choose to opt out of receiving direct marketing communications or withdraw consent for data sharing with third parties. To unsubscribe, access, or correct data, participants may click the unsubscribe link within marketing communications or contact us via email at bmlmarketing@bravomedia.com.hk or/and hk.gameinfo@jcdecaux.com.

We promise not to use your personal data for direct marketing or sell it to third parties unless your explicit prior consent has been obtained.

Transfer and Disclosure of Personal Data

We will keep your personal data confidential. However, we may disclose or transfer data to the following third parties under the following circumstances:

• Authorized Service Providers: Authorized third-party service providers who assist in operating the Campaign, maintaining website systems, providing technical support, cloud storage, or on-site operations (such service providers are bound by strict confidentiality agreements and may only use data for specified service purposes).

• Law Enforcement Agencies or Regulatory Authorities: When disclosure is required by law, court orders, or requests from government departments or law enforcement agencies.

Portrait Authorization and Third-Party Data Sharing Statement

• Portrait Authorization and Usage: Collect, store, reproduce, modify, and use my uploaded portrait to generate an "AI Portrait", create customized VR interactive experience content, and display it via live broadcasts, replays, featured showcases, and related campaign promotions on designated electronic screens within MTR stations. This authorization is worldwide, irrevocable, and royalty-free.

• Warranty of Photo Legality: I warrant that I have legal rights to the uploaded photo and that it does not infringe upon any third party's intellectual property, portrait, or privacy rights. In the event of any legal proceedings arising from photo infringement, I shall assume full legal responsibility.

• Third-Party Data Transfer: Transfer and share my uploaded portrait and necessary personal data (including name, phone number and email address) with authorized third-party technical and operational service providers for system analysis, AI image rendering, cloud storage, and on-site experience operations.

• AI Effect and Intellectual Property: All copyrights of the generated AI Portrait and VR content belong exclusively to the Organizer. I understand that AI generation effects are subject to technical limitations, and the Organizer and the Advertising Agencies make no guarantees regarding similarity or visual effects.

• Data Destruction: All original photos and AI files will be destroyed and deleted from the servers within 30 days after the end of the Campaign. All data processing strictly complies with the Personal Data (Privacy) Ordinance (Cap. 486).

Retention Period of Personal Data

We will only retain your personal data for the period necessary to fulfill the initial purposes of collection:

• Original Photos and AI Portrait Materials: All original photos uploaded by participants and generated AI Portrait files will be completely destroyed and deleted from our servers and databases within 30 days after the end of the Campaign.

• Booking and Contact Data: Booking records and contact information will be destroyed after all follow-up administrative and inquiry processing for the Campaign are completed, in any case no later than 90 days after the end of the Campaign.

Security and Protection of Personal Data

We adopt reasonable technical and organizational security measures (including data transmission encryption, firewalls, access control, etc.) to protect your personal data against unauthorized access, disclosure, loss, misuse, alteration, or destruction.

Protection of Minors' Privacy

All participants must be aged 18 years or above. If we discover that personal data of a person aged under 18 has been submitted as part of an Event registration we reserve the right to delete such data and cancel the relevant registration at any time.

Rights to Access and Correction of Personal Data

In accordance with the PDPO, you have the right to:

• Ascertain whether the Organizer or the Advertising Agencies hold your personal data;

• Access copies of your personal data held by the Organizers and the Advertising Agencies;

• Request the Organizer or the Advertising Agencies to correct any inaccurate personal data.

When processing your access or correction requests, we have the right to verify your identity and may charge a reasonable administrative fee in accordance with the provisions of the PDPO.

Policy Amendments and Language Versions

We reserve the right to update or amend this Policy at any time. The amended Policy will be posted directly on this website and take effect immediately.

This Policy is provided in Traditional Chinese, Simplified Chinese, and English versions. In the event of any conflict or inconsistency among the versions, the English version shall prevail.

Contact Information for Data Access and Privacy Inquiries

If you have any questions regarding this Privacy Policy or wish to exercise your rights to access or correct data, please contact the Advertising Agencies via the following: