Privacy Policy

1. Introduction / Scope

MRC International Group (“MRC”, “we”, “us”, or “our”) provides Essence and related websites (together, the “Services” for the purposes of this policy).

This Privacy Policy explains, in plain language, how we collect, use, store, and share personal information in connection with Essence.

We serve clients and users in Hong Kong, Macau, Mainland China, and Taiwan. Region-specific rights may differ; see Your rights. Exact statutory mapping still needs counsel confirmation. LEGAL REVIEW

Unless defined in this policy, capitalised terms may also appear in applicable product terms or client agreements for Essence.

2. Roles — controller vs processor

Depending on the Service and the relationship, MRC may act as a data controller, a data processor (or similar role under local law), or both. In plain terms:

• Controller (or similar): We decide why and how personal information is processed for our own purposes — for example, operating Essence product or portal sites, responding to enquiries sent to us, or managing our own business contacts.
• Processor (or similar): We process personal information on behalf of a client under their instructions — for example, data that a client configures or uploads into Essence. In those cases, the client typically remains responsible for deciding what data to collect and for informing their end users.

Exact controller / processor mapping for Essence still needs counsel confirmation. LEGAL REVIEW

3. Information we collect

The categories of personal information we process depend on whether you are a website or portal visitor, client contact, or an end user of a client’s Essence tenant. Examples may include:

• Identity and contact data — such as name, email address, phone number, and postal or office address
• Account and profile data — such as usernames, roles, and preferences within Essence
• Client-configured business or operational data (typically where we act as processor for a client) — fields that the client chooses to store in Essence
• Application or enquiry data — information you submit via forms, email, or support channels
• Technical and usage data — such as IP address, browser type and version, device information, pages visited, timestamps, and similar log data when you use our websites or Essence
• Cookie and similar technology data — see Cookies

We do not intentionally collect special categories of data beyond what a client configures in their tenant or what you choose to provide to us. Exact data types will be listed in the inventory once completed. LEGAL REVIEW

4. How we use information

We use personal information to:

• Provide, operate, maintain, and improve Essence
• Create and manage accounts, authenticate users, and provide support
• Process client instructions where we act as a processor
• Respond to enquiries and communicate about Essence
• Monitor security, prevent abuse, and troubleshoot technical issues
• Analyse usage in aggregate or de-identified form where appropriate to improve performance and user experience
• Comply with legal obligations and enforce our agreements, where applicable LEGAL REVIEW

We do not sell personal information.

5. Cookies

Cookies are small data files commonly used as anonymous unique identifiers. They are sent to your browser from the websites you visit and stored on your device.

Our websites and Essence may use cookies and similar technologies to operate the site, remember preferences, maintain sessions, and understand how the Services are used. You can typically accept or refuse cookies through your browser settings, and you may be notified when a cookie is sent to your device. If you refuse cookies, some parts of Essence may not work as expected.

A detailed cookie schedule (names, purposes, retention) may be added after inventory and counsel review. LEGAL REVIEW

6. Service providers / subprocessors

We may engage third-party companies and individuals to:

• Host or facilitate Essence
• Provide the Services on our behalf
• Perform Service-related work (for example, infrastructure, email delivery, analytics, or support tools)
• Help us analyse how the Services are used

These providers may process personal information only to perform tasks for us (or for our clients, where we are a processor) and are expected not to use that information for their own unrelated purposes.

Named service providers currently used in connection with Essence include:

• Microsoft Azure — cloud hosting / infrastructure
• Alibaba Cloud — cloud hosting / infrastructure
• Cloudflare — CDN, DNS, and edge security

This list is current as of 19 September 2026. Completeness of the list, precise roles of each provider, and any client-facing subprocessor schedule still require counsel review. LEGAL REVIEW

7. International / cross-border transfers

We do not transfer personal data across borders.

Personal information processed in connection with Essence is processed and stored in Hong Kong. MRC confirms that it does not operate cross-border transfers of personal data for these Services: data remains in Hong Kong for processing and storage.

If operational reality ever requires a change to this no-cross-border approach, we will update this policy and obtain any required reviews before implementing such a change. The legal definition of what counts as a “transfer” under applicable local law (and any residual nuance for multi-region clients) remains marked for counsel. LEGAL REVIEW

8. Security

We value your trust in sharing personal information with us and strive to use commercially reasonable technical and organisational measures to protect it. No method of transmission over the internet, or of electronic storage, is 100% secure. We cannot guarantee absolute security.

If you believe you have discovered a security issue related to Essence, please contact us using the details in Contact.

9. Retention

We retain personal information only for as long as needed for the purposes described in this policy, to provide Essence, to meet client contract requirements (where we act as processor), and to satisfy applicable legal or accounting needs.

Specific retention periods by data category are not yet fixed in this draft and must be set with counsel and operations. LEGAL REVIEW

When retention is no longer required, we will delete or anonymise personal information in accordance with our procedures, subject to any lawful requirement to keep records longer.

10. Your rights

Depending on where you live and your relationship with MRC or with our client, you may have rights regarding your personal information. At a high level, these can include rights to:

• Ask whether we process personal information about you
• Request access to, or a copy of, personal information we hold
• Request correction of inaccurate information
• Request deletion or restriction in certain circumstances
• Object to certain processing, where applicable
• Lodge a complaint with a competent authority, where available under local law

How these rights work, and which ones apply, varies by region (Hong Kong, Macau, Mainland China, and Taiwan). Local counsel must confirm the applicable rights and request process. LEGAL REVIEW

If we process your data as a processor for a client, please contact your employer or the relevant client first; we will support them in responding to valid requests where contractually and legally appropriate.

To exercise rights that MRC can address directly, contact us at info@mrchr.com.

11. Children’s privacy

Essence is not directed at children. We do not knowingly collect personal information from children under 13 (or a higher age if required by applicable local law). LEGAL REVIEW

If we discover that a child has provided us with personal information without appropriate consent or authorisation, we will delete it from our systems where feasible. If you are a parent or guardian and believe your child has provided us with personal information, please contact us so we can take appropriate action.

12. Links to other sites

Essence may contain links to other sites. If you follow a third-party link, you will leave our Service. Those external sites are not operated by us.

We strongly advise you to review the privacy policy of any website you visit. We have no control over, and assume no responsibility for, the content, privacy policies, or practices of third-party sites or services.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. Please review this page periodically for changes. We will notify you of material changes by posting the updated Privacy Policy on this page (and, where appropriate, by other reasonable means). Changes take effect when posted, unless a later effective date is stated.

The “Last updated” date at the top of this page reflects the most recent revision of this draft or published version.

14. Contact

If you have questions or suggestions about this Privacy Policy, or wish to make a privacy-related request, please contact us: