Last updated: 18 May 2026

1. Introduction

XGD Media Limited ("XGD Media", "we", "us" or "our") is committed to protecting the privacy and security of the personal data of visitors to our website at https://www.xgd.com.hk (the "Website"), our advertising clients, our landlord partners, our service providers, our job applicants and other individuals with whom we interact.

This Privacy Policy explains how we collect, hold, use, disclose and otherwise handle personal data in accordance with the Personal Data (Privacy) Ordinance (Cap. 486) of the Laws of Hong Kong (the "PDPO"), including the six Data Protection Principles set out in Schedule 1 of the PDPO.

For the purposes of the PDPO, XGD Media is the "data user" in respect of the personal data described in this Privacy Policy.

This Privacy Policy is also a Personal Information Collection Statement (PICS) for the purposes of section 5 and Data Protection Principle 1(3) of the PDPO.

2. Scope

This Privacy Policy applies to personal data collected through:

• the Website and any pages, forms or functionality made available through it;

• emails, telephone calls, WhatsApp messages and other written or electronic communications between you and us;

• our official accounts on third-party platforms such as Facebook, Instagram, LinkedIn, Vimeo and Bilibili (subject to those platforms' own privacy policies); and

• our provision of advertising and creative services, including the booking and management of outdoor billboard and ChargeSPOT digital network campaigns, and our dealings with landlords and contractors.

Separate privacy notices may apply to specific products, services, recruitment processes or campaigns and, where they apply, will be made available to you at the relevant point of collection.

3. Personal Data We Collect

3.1 Information you provide to us

We collect personal data that you provide voluntarily, including when you contact us, submit an enquiry, request a quotation, book advertising space, register as a landlord, apply for a role with us, or sign up to receive marketing communications. Such data may include:

• identification and contact details: name, job title, company name, postal address, email address, telephone number, WhatsApp number;

• commercial and campaign information: brand or product details, target audience, creative briefs, advertising budgets, preferred locations, billing and tax information;

• landlord information: site or property details, ownership or authority to grant rights over a site, bank account or payment details (only where required to pay rent or fees);

• recruitment information: CV/résumé, education and employment history, professional qualifications, references, identification documents and any information you choose to share with us in connection with a job application; and

• any other information you choose to provide in your communications with us.

3.2 Information collected automatically

When you visit the Website, we and our service providers automatically collect certain technical information about your device and usage, including:

• Internet Protocol (IP) address and approximate location derived from it;

• device and browser information (e.g., device type, operating system, browser type and version, screen resolution, language settings);

• usage data (e.g., the pages and URLs you visit, the date and time of your visit, the time spent on each page, the referring URL and exit page, clicks and other actions); and

• cookies and similar identifiers (see Section 9 — Cookies and Similar Technologies).

In particular, we use Google Analytics 4, a web analytics service provided by Google LLC ("Google"), to help us understand how visitors find and use the Website. Google Analytics uses cookies and similar identifiers to collect information such as IP address (which may be truncated), device and browser information, the pages and URLs you visit, time spent on each page, the referring URL and on-site events. Google processes this information on our behalf as our data processor and may transfer it to, and store it on, servers located in the United States or other jurisdictions outside Hong Kong. For more information, see Google's privacy policy at https://policies.google.com/privacy. You can opt out of Google Analytics tracking by installing the Google Analytics Opt-out Browser Add-on (https://tools.google.com/dlpage/gaoptout) or by adjusting your cookie preferences through the cookie banner on the Website (where available) and your browser settings.

3.3 Information from third parties

We may receive personal data about you from third parties, including our affiliates, business partners, recruiters, professional references, public registers and analytics or advertising service providers (such as Google), where you have authorised those third parties to share the data with us or where they are otherwise permitted to do so.

4. Failure to Provide Personal Data

Where we ask you to provide personal data, it is generally on a voluntary basis. However, if you do not provide the personal data that we have indicated to be mandatory, we may not be able to respond to your enquiry, provide you with a quotation, deliver our Services, consider you for a role, or make payments due to you.

5. Forms, Enquiries and Communications

The Website includes various forms and contact channels that you may use to get in touch with us, including contact forms, enquiry forms, quote-request forms, landlord-registration forms, careers and job-application forms, and links to email us or message us on WhatsApp.

When you complete and submit a form or otherwise contact us using the details provided on the Website, you voluntarily provide us with your personal data (typically your name, company, email address, telephone number and the substance of your enquiry). By submitting that information to us, you acknowledge and agree that we may use your contact details to:

• respond to your enquiry, request or application and to communicate with you in connection with that enquiry;

• maintain a record of our communications with you and the resulting business relationship;

• provide you with information about our products and services that we reasonably believe may be of interest to you, including outdoor billboard and ChargeSPOT digital network advertising opportunities, creative services and landlord partnership opportunities; and

• subject to Section 8 below, add you to our mailing list and send you newsletters, case studies, event invitations, industry insights and other marketing communications from time to time.

Where direct-marketing consent is required under Part VIA of the PDPO, submission of the form will be treated as your indication of no objection to receiving direct-marketing communications from us by the channels described in Section 8. You may withdraw your consent and opt out of marketing communications at any time, free of charge, as described in Section 8. Even if you opt out of marketing, we will still send you communications that are necessary to respond to your enquiry or to administer our business relationship with you.

6. Purposes for which We Use Personal Data

In accordance with Data Protection Principles 1 and 3 of the PDPO, we will use your personal data only for the purposes for which it was collected (or for a directly related purpose), or where we have your prescribed consent. Those purposes include:

• operating, maintaining, securing and improving the Website and our Services;

• responding to enquiries, requests and complaints, and providing customer or partner support;

• preparing quotations, negotiating, concluding and performing advertising, creative, landlord and other commercial agreements;

• planning, booking, producing, installing and reporting on advertising campaigns (including on outdoor billboards and the ChargeSPOT digital network);

• issuing invoices, collecting payment, processing refunds, and managing accounts receivable and payable;

• verifying identity and, where required, conducting due diligence (including anti-fraud, anti-money-laundering and sanctions checks);

• assessing applications for employment, internships and other roles, and managing our recruitment processes;

• complying with our legal, regulatory, tax, accounting, audit and risk-management obligations, and responding to lawful requests from public authorities;

• conducting analytics and research to understand how our Website and Services are used and to improve them;

• with your consent where required, sending you marketing communications about our products, services, case studies and events (see Section 8 — Direct Marketing); and

• establishing, exercising or defending legal claims, and protecting our rights, property and safety, and those of our personnel, clients, partners and the public.

7. Disclosure and Transfer of Personal Data

We treat your personal data as confidential. We will not sell your personal data. We may disclose your personal data to the following categories of recipients, on a need-to-know basis and subject to appropriate confidentiality and data-protection obligations:

• members of the XGD Media group of companies, including any affiliates operating in Hong Kong, Singapore or elsewhere;

• our service providers and contractors, including IT and hosting providers (such as our website-hosting platform), email and communications providers, analytics providers, payment processors, advertising production and installation contractors, billboard maintenance providers, accountants, auditors and legal advisers;

• our landlord partners and venue operators (including operators of the ChargeSPOT network), to the extent necessary to install, operate, audit or report on advertising campaigns;

• our advertising clients, where you are a landlord, venue operator or other counterparty, and disclosure is necessary to perform the relevant campaign;

• regulators, courts, law-enforcement agencies and other public authorities, where required by law, regulation, court order or other lawful process; and

• any actual or proposed purchaser, investor or successor of our business, in connection with a merger, acquisition, reorganisation, financing or sale of assets (subject to appropriate confidentiality undertakings).

8. Direct Marketing

In accordance with Part VIA of the PDPO, we will not use your personal data for direct marketing purposes, or provide it to any third party for use by that third party for direct marketing purposes, unless we have first obtained your consent (or, where applicable, your indication of no objection). As described in Section 5, where you submit a form or otherwise provide your contact details to us through the Website, you indicate that you do not object to receiving direct-marketing communications from us as described in this Section 8.

Where you have provided such consent (or indicated no objection), we may use your name, contact details (including email address, telephone number and WhatsApp number) and the products or services in which you have shown an interest to send you direct-marketing communications by email, telephone, SMS, WhatsApp or post about: (a) our products and services, including outdoor billboard and ChargeSPOT advertising opportunities, creative services and landlord partnership opportunities; and (b) related promotions, events, case studies, surveys, newsletters and industry insights.

You may withdraw your consent and opt out of receiving direct-marketing communications from us at any time, free of charge, by using the unsubscribe link included in any marketing email, replying STOP to a marketing SMS or WhatsApp message, or contacting our Data Protection Officer using the details in Section 15. We will action your request without undue delay. We will continue to send you communications that are strictly necessary to respond to your enquiry or to administer our business relationship with you.

9. Cookies and Similar Technologies

A cookie is a small text file that a website places on your device when you visit it. Cookies enable a website to recognise your device on subsequent visits and to store information about your preferences, settings or use of the website.

We use the following categories of cookies and similar technologies on the Website:

• Strictly necessary cookies: required for the Website to function (e.g., security, load-balancing, language preference). These cookies do not require your consent.

• Performance and analytics cookies: help us understand how visitors use the Website (e.g., which pages are most popular, how long visitors spend on each page) so that we can improve it. We use Google Analytics or comparable analytics services for this purpose. These tools may set cookies on your device and collect technical information such as your IP address (often in truncated form) and pages viewed.

• Functionality cookies: remember choices you make to provide a more personalised experience (e.g., language version).

• Marketing cookies: may be set by us or our advertising partners to deliver advertising relevant to you on this Website or on other websites and to measure the effectiveness of our marketing campaigns.

You may control the use of non-essential cookies through the cookie banner or settings on the Website (where available) and through your browser settings. Most browsers allow you to refuse cookies, delete cookies or be alerted when a cookie is set. Disabling cookies may affect the functionality of the Website.

10. Data Retention

We retain personal data only for as long as is necessary for the purposes set out in this Privacy Policy, or as required by applicable law. Indicative retention periods include:

• website visitor enquiries: typically up to 24 months from your last interaction with us;

• client and landlord records: for the duration of our commercial relationship and for at least 7 years thereafter, to comply with Hong Kong record-keeping and limitation-period requirements;

• recruitment records of unsuccessful applicants: up to 24 months from the conclusion of the recruitment process, unless you consent to a longer period; and

• financial, tax and audit records: at least 7 years from the end of the relevant accounting period.

When personal data is no longer needed, we will securely delete, destroy or anonymise it.

11. Security

We take reasonable and practicable steps, in line with Data Protection Principle 4 of the PDPO, to safeguard personal data against unauthorised or accidental access, processing, erasure, loss or use. Such steps include physical, technical and organisational measures, restricted access on a need-to-know basis, encryption in transit where appropriate, vendor due-diligence and staff training.

However, no method of transmission over the internet or method of electronic storage is 100% secure. While we strive to protect your personal data, we cannot guarantee its absolute security.

12. Transfers Outside Hong Kong

We are based in Hong Kong and operate in Hong Kong and Singapore. Your personal data may be transferred to, and processed in, jurisdictions outside Hong Kong, including by our affiliates, service providers or business partners. Where we transfer personal data outside Hong Kong, we take reasonable steps to ensure that the recipient is bound by obligations of confidentiality and to a level of protection of personal data comparable to that required under the PDPO, including by way of contractual safeguards.

13. Your Rights

Subject to the PDPO and any applicable exemptions, you have the following rights in relation to your personal data:

• Right of access (Section 18 of the PDPO): you may request confirmation as to whether we hold any personal data about you, and request a copy of such data.

• Right to correction (Section 22 of the PDPO): you may request that we correct personal data we hold about you that is inaccurate.

• Right to withdraw consent: you may withdraw any consent you have previously given (including for direct marketing) at any time.

• Right to make a complaint: you may make a complaint to us using the details in Section 15, or to the Office of the Privacy Commissioner for Personal Data, Hong Kong (https://www.pcpd.org.hk).

To exercise your rights, please contact our Data Protection Officer using the details in Section 15. We will respond to your request within the time limits required by the PDPO (generally 40 days for access and correction requests). We may charge a reasonable fee for complying with a data access request, as permitted by the PDPO. We may also need to verify your identity before processing your request.

14. Children

The Website is not directed to children under the age of 13, and we do not knowingly collect personal data from children under that age. If you believe that a child has provided us with personal data, please contact our Data Protection Officer and we will take appropriate steps to delete it.

15. How to Contact Us

If you have any questions, comments or complaints about this Privacy Policy or our handling of your personal data, or if you wish to exercise any of your rights, please contact our Data Protection Officer:

Data Protection Officer
XGD Media Limited
Registered office: 3/F, 26 Wellington Street,Central, Hong Kong
Email: privacy@xgd.com.hk
Website: https://www.xgd.com.hk
WhatsApp: +852 9862 3511

16. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services or legal requirements. The updated Privacy Policy will take effect from the date it is posted on the Website, and the "Last updated" date at the top of this Privacy Policy will be amended accordingly. Where the changes are material, we will use reasonable efforts to notify you (for example by placing a prominent notice on the Website or by emailing you, where we have your email address).

17. Language

This Privacy Policy is issued in English. We may provide translations into Chinese (Traditional or Simplified) for convenience only. In the event of any inconsistency or conflict between the English version and any translation, the English version shall prevail.

‍