Risk Management and Strategy

We rely on information technology systems to process transactions, summarize results and manage our business, and our Operating Subsidiaries collect and store certain customer data, including personal information, on servers located in Hong Kong. We have implemented processes designed to assess, identify and manage material risks from cybersecurity threats as part of our overall risk management, commensurate with the size and complexity of our operations. These include access controls, maintenance of primary and back-up systems, data back-up procedures, anti-virus and firewall protections and periodic security enhancements, including measures to comply with the Personal Data (Privacy) Ordinance (Chapter 486 of the Laws of Hong Kong). We do not currently engage external assessors, consultants or auditors in connection with cybersecurity risk management, and we assess risks arising from third-party service providers, including our information technology vendors, as part of our vendor management practices.

As of the date of this annual report, we are not aware of any cybersecurity threats or incidents, including from any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Group, including our business strategy, results of operations or financial condition. We cannot, however, eliminate all risks from cybersecurity threats or guarantee that undetected incidents have not occurred. See “Item 3. Key Information — 3.D. Risk Factors — Risks Relating to Our Business and Operations — Any disruption to our IT systems and infrastructure could adversely affect our business.” and “Item 3. Key Information — 3.D. Risk Factors — Risks Relating to Our Business and Operations — Cybersecurity risks have increased materially as a result of the Group’s expansion into AI, IoT-enabled smart facility management, and connected robotics systems”.

Governance

Our board of directors has overall oversight of risks from cybersecurity threats. Management, led by our Chief Executive Officer with the support of our third-party information technology service providers, is responsible for the day-to-day assessment and management of such risks, including monitoring the prevention, detection, mitigation and remediation of cybersecurity incidents and compliance with applicable data protection requirements, and reports to the Board on cybersecurity matters periodically and upon the occurrence of any significant incident.