Effective Date: 7/28/2026

Strategic Alignment Ltd (referred to herein as "SAL", "we", "us", or "our") is committed to protecting the privacy and security of your personal data. This Privacy Policy explains how we collect, use, share, and protect personal data when you visit our website at www.wearetheoasis.com, enquire about or apply for membership, or interact with us in connection with the services we provide.

SAL is a company incorporated in the Hong Kong Special Administrative Region with its registered office at Unit 1603, 16/F, The L. Plaza, 367-375 Queen's Road Central, Sheung Wan, Hong Kong. We are the data user (as defined in the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong) responsible for the personal data we collect and process.

By accessing our website or providing your personal data to us, you acknowledge that you have read and understood this Privacy Policy.

1. Introduction

1.1. This Privacy Policy applies to all personal data collected by SAL through:

(a) our website at www.wearetheoasis.com;

(b) membership applications, enquiries, and enrollment processes;

(d) property booking and access coordination; and

(e) any other interactions you may have with SAL or its representatives.

1.2. For the purposes of this Privacy Policy, "personal data" has the meaning given to it in the Personal Data (Privacy) Ordinance (Cap. 486) of the laws of Hong Kong ("PDPO"), and broadly refers to any data relating directly or indirectly to an identified or identifiable individual.

1.3. We may update this Privacy Policy from time to time. The effective date at the top of this document indicates the date of the most recent revision. We encourage you to review this Privacy Policy periodically.

2. Information We Collect

2.1. We collect personal data in a number of ways and for a number of purposes. The categories of personal data we collect include the following.

2.2. Information You Provide Directly

2.3. When you interact with us — whether by completing a membership application, making an enquiry, booking a property, or communicating with us — you may provide us with the following personal data:

(a) your full name, date of birth, and nationality;

(b) your email address, telephone number, and residential or mailing address;

(c) passport or government-issued identification details (for identity verification and know-your-customer ("KYC") purposes);

(d) payment information, including bank account or payment card details;

(e) membership application details, including information about your professional background, interests, and reasons for seeking membership;

(f) details you provide in connection with the referral programme; and

(g) any other information you voluntarily provide to us in correspondence or during interactions with our team.

2.4. Information Collected Automatically

2.5. When you visit our website, we may automatically collect certain technical and usage data, including:

(a) your Internet Protocol (IP) address and approximate geographic location;

(b) browser type and version, operating system, and device information;

(d) information collected through cookies, pixel tags, and similar tracking technologies (see Section 5 below); and

(e) date and time of your visit.

2.6. Information From Third Parties

2.7. We may receive personal data about you from third-party sources, including:

(a) payment processors and financial institutions that process membership payments on our behalf;

(b) identity verification and KYC/AML screening service providers;

(d) publicly available sources, where permitted by applicable law.

3. How We Use Your Information

3.1. We use the personal data we collect for the following purposes:

(a) to process and evaluate membership applications and manage enrollment;

(b) to verify your identity in compliance with applicable KYC and anti-money laundering ("AML") regulations;

(c) to facilitate property access, bookings, and coordination with local Property Management Companies and appointed stewards;

(d) to communicate with you regarding your membership, bookings, confirmations, account updates, service changes, and newsletters;

(e) to administer the referral programme, including tracking referrals and issuing any applicable rewards;

(f) to comply with legal and regulatory obligations, including anti-money laundering requirements, tax reporting, and responding to lawful requests from authorities;

(g) to process payments and maintain accurate financial records;

(h) to improve, develop, and enhance our website, services, and member experience;

(i) to protect the security and integrity of our member network, properties, and systems; and

(i) to enforce our terms and conditions, membership agreements, and other contractual arrangements.

3.2. We will not use your personal data for any purpose that is not directly related to or compatible with the purposes described above, unless we have obtained your prior consent or are otherwise permitted or required to do so by law.

4. Legal Basis for Processing

4.1. SAL processes personal data in accordance with the requirements of the PDPO, including the Data Protection Principles set out in Schedule 1 to the PDPO. In particular:

(a) personal data is collected for purposes that are directly related to a function or activity of SAL, and the collection is necessary for or directly related to those purposes;

(b) where we rely on your consent as the basis for processing, your consent is obtained through our website forms, membership application process, booking processes, and other interactions with SAL;

(c) where processing is necessary for compliance with a legal obligation to which SAL is subject (including under Hong Kong anti-money laundering and tax reporting laws), we process your data on that basis; and

(d) where processing is necessary for the legitimate interests of SAL (such as preventing fraud and ensuring the security of our member network), we process your data on that basis, provided that such interests are not overridden by your rights and interests.

4.2. Where we rely on your consent, you may withdraw that consent at any time by contacting us at [email protected]. Please note that withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal, and SAL may continue to process certain personal data where required by law or where another lawful basis applies.

5. Cookies and Tracking Technologies

5.1. Our website uses cookies and similar tracking technologies to enhance your browsing experience, analyse website traffic, and understand how visitors interact with our website.

5.2. The types of cookies we may use include:

(a) Essential cookies: These cookies are necessary for the operation of our website and enable core functionality such as page navigation and access to secure areas. The website cannot function properly without these cookies.

(b) Analytics cookies: These cookies allow us to recognise and count the number of visitors and to see how visitors move around our website. This helps us improve the way our website works, for example by ensuring that users find what they are looking for easily. We may use third-party analytics services, such as Google Analytics, which collect data about website usage. Google Analytics uses cookies to collect information about how visitors use our website. The information generated by the cookie about your use of the website is transmitted to and stored by Google on servers that may be located outside Hong Kong. For further information on how Google collects and processes data, please visit Google's privacy policy at https://policies.google.com/privacy.

(c) Functional cookies: These cookies allow our website to remember choices you make (such as your preferred language or region) and provide enhanced, more personalised features.

5.3. You can manage your cookie preferences through your browser settings. Most browsers allow you to refuse or delete cookies. The methods for doing so vary from browser to browser. Please note that disabling or deleting cookies may affect the functionality of our website and your ability to access certain features.

5.4. For further information about cookies and how to manage them, you may visit www.allaboutcookies.org.

6. Data Sharing

6.1. SAL does not sell, rent, or share your personal data with third parties for their own marketing purposes. We may share your personal data with the following categories of recipients, solely for the purposes described in this Privacy Policy:

(a) Service providers: We engage third-party service providers to assist with the operation of our business, including payment processors and financial institutions (such as Aspire), identity verification and KYC/AML screening providers, our company secretary (Osome, Hong Kong), IT infrastructure and website hosting providers, and cloud storage service providers. These service providers process personal data on our behalf and in accordance with our instructions.

(b) Property Management Companies: Local Property Management Companies ("PMCs") at each property in our network receive limited member data — including your name, contact details, booking dates, and relevant access information — to facilitate your property bookings and coordinate your on-site access and stay.

(c) Stewards: Appointed stewards who manage properties within our network may receive limited member data (including your name, contact details, and booking information) to coordinate property access and provide on-site services.

(d) Professional advisors: We may share personal data with our legal, accounting, audit, and insurance advisors where necessary for the provision of their professional services to SAL.

(e) Law enforcement and regulators: We may disclose personal data where required to do so by law, by a court order, or in response to a lawful request from a government authority or regulatory body, including for the purposes of anti-money laundering compliance, tax reporting, or the prevention or detection of crime.

(f) Corporate transactions: In the event of a merger, acquisition, restructuring, sale of assets, or similar corporate transaction involving SAL, your personal data may be transferred to the acquiring or successor entity, provided that the recipient agrees to protect your personal data in a manner consistent with this Privacy Policy.

6.2. Where we share personal data with third parties, we take reasonable steps to ensure that they are contractually bound to protect your personal data in accordance with applicable law and this Privacy Policy.

7. International Data Transfers

7.1. SAL is based in Hong Kong. Given the international nature of our membership network and property portfolio, your personal data may be transferred to, stored in, and processed in jurisdictions outside Hong Kong, including Mexico and other countries where our properties, Property Management Companies, stewards, and service providers are located.

7.2. These jurisdictions may have data protection laws that differ from those in Hong Kong. Where we transfer personal data internationally, we take reasonable steps to ensure that your data is protected in accordance with this Privacy Policy and applicable law, including:

(a) entering into appropriate contractual arrangements with recipients of personal data that include data protection obligations;

(b) ensuring that service providers maintain adequate technical and organisational security measures; and

7.3. By providing your personal data to SAL, you acknowledge and consent to the transfer, storage, and processing of your personal data in jurisdictions outside Hong Kong as described in this Section 7.

8. Data Security

8.1. SAL takes the security of your personal data seriously. We have implemented appropriate technical and organisational measures to protect your personal data against unauthorised or unlawful processing and against accidental loss, destruction, or damage. These measures include:

(a) encryption of data in transit using Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols;

(b) restriction of access to personal data to authorised personnel on a need-to-know basis;

(d) regular reviews and testing of our security measures and practices; and

(e) training and awareness programmes for personnel who handle personal data.

8.2. While we take all reasonable steps to protect your personal data, no method of transmission over the Internet or method of electronic storage is completely secure. We cannot guarantee the absolute security of your personal data. If you have reason to believe that your interactions with SAL are no longer secure, please contact us immediately at [email protected].

9. Data Retention

9.1. We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required or permitted by applicable law. Our retention practices are as follows:

(a) Active members: Personal data relating to active members is retained for the duration of the membership and for a period of seven (7) years following the termination or expiry of the membership, in order to comply with legal, tax, and regulatory obligations.

(b) Prospective members: Personal data collected from individuals who enquire about membership but do not proceed to enroll is retained for a period of two (2) years from the date of the last interaction, after which it is securely deleted unless you request earlier deletion.

(c) Financial records: Financial transaction records and payment data are retained in accordance with applicable legal and regulatory requirements, including tax and accounting obligations.

(d) Legal holds: Where personal data is relevant to any pending or anticipated legal proceeding, regulatory investigation, or dispute, we may retain the data for as long as necessary to resolve the matter.

9.2. When personal data is no longer required for any of the purposes described above, we will securely delete or anonymise it in accordance with our data retention and disposal procedures.

9.3. You may request the earlier deletion of your personal data by contacting us at [email protected]. Please note that we may be unable to comply with your request to the extent that retention is required by applicable law or for the establishment, exercise, or defence of legal claims.

10. Your Rights Under the PDPO

10.1. Under the PDPO, you have certain rights in relation to your personal data. Subject to applicable law, you have the right to:

(a) access your personal data — you may request access to the personal data we hold about you, and we will provide a copy of that data within 40 days of receiving your request (or such other period as prescribed by the PDPO);

(b) request correction of your personal data — if you believe that any personal data we hold about you is inaccurate, incomplete, or misleading, you may request that we correct it;

(c) request deletion of your personal data — you may request the deletion of your personal data, subject to our legal obligations to retain certain data (as described in Section 9 above);

(d) withdraw consent for direct marketing — you may at any time withdraw your consent to the use of your personal data for direct marketing purposes, and we will cease using your data for such purposes without charge; and

(e) object to processing — in certain circumstances, you may object to the processing of your personal data where we process it for purposes other than those for which it was originally collected.

10.2. To exercise any of your rights, please contact us at [email protected]. We may require you to verify your identity before processing your request.

10.3. If you are not satisfied with our handling of your request, you may lodge a complaint with the Privacy Commissioner for Personal Data in Hong Kong (www.pcpd.org.hk).

11. SMS and Electronic Communications

11.1. By providing your telephone number to SAL — whether through our website, membership application, or other communications — you consent to receive electronic communications from SAL, including SMS messages, relating to your membership, bookings, account notifications, service updates, and promotional information.

11.2. You may opt out of receiving marketing or promotional SMS messages at any time by:

(a) replying "STOP" to any SMS message received from SAL; or

(b) contacting us at [email protected] to request removal from our marketing communications list.

11.3. Please note that even if you opt out of marketing communications, we may continue to send you non-marketing communications that are necessary for the administration of your membership or are required by law.

11.4. Message frequency varies depending on the nature and extent of your interactions with SAL. Standard message and data rates charged by your mobile carrier may apply to SMS messages you receive from us.

11.5. SAL will not share your telephone number with third parties for their own marketing purposes.

11.6. SAL maintains a strict anti-spam policy, available in our Terms of Service at https://join.wearetheoasis.com/terms. SAL sends SMS messages only on a permission basis, honors all opt-out requests promptly, and does not share your telephone number with third parties for their own marketing purposes.

12. Children's Privacy

12.1. Our services, including our website and membership programme, are not directed to individuals under the age of 18. We do not knowingly collect personal data from children under 18 years of age.

12.2. If we become aware that we have inadvertently collected personal data from a person under the age of 18, we will take reasonable steps to delete that data as soon as practicable.

12.3. If you believe that we have collected personal data from a person under 18, please contact us at [email protected] so that we can take appropriate action.

13. Third-Party Links

13.1. Our website may contain links to websites, applications, or services operated by third parties. These links are provided for your convenience and do not signify our endorsement of such websites or their content.

13.2. SAL has no control over, and assumes no responsibility for, the content, privacy policies, or practices of any third-party websites or services. We encourage you to read the privacy policy of every website you visit.

13.3. Any personal data you provide to third-party websites or services is subject to those third parties' own privacy policies and practices, and SAL is not responsible for the data handling practices of such third parties.

14. Changes to This Privacy Policy

14.1. We may update or amend this Privacy Policy from time to time to reflect changes in our data practices, legal or regulatory requirements, or business operations.

14.2. Where we make material changes to this Privacy Policy, we will notify you by:

(a) posting a prominent notice on our website at www.wearetheoasis.com; and/or

(b) sending a notification to the email address associated with your membership account.

14.3. The effective date at the top of this Privacy Policy indicates the date of the most recent revision.

14.4. Your continued use of our website or services following notification of any changes to this Privacy Policy shall constitute your acknowledgement of and agreement to be bound by the updated Privacy Policy. If you do not agree with any changes, you should discontinue use of our website and services and contact us to discuss your concerns.

15. Contact Us

15.1. If you have any questions, comments, or concerns about this Privacy Policy, or if you wish to exercise any of your rights in relation to your personal data, please contact us at:

Strategic Alignment Ltd

Unit 1603, 16/F, The L. Plaza, 367-375 Queen's Road Central, Sheung Wan, Hong Kong

Email: [email protected]

15.2. We will endeavour to respond to all enquiries and requests within a reasonable timeframe and in any event within the timeframes prescribed by the PDPO.

16. Governing Law

16.1. This Privacy Policy is governed by and construed in accordance with the laws of the Hong Kong Special Administrative Region, including the Personal Data (Privacy) Ordinance (Cap. 486).

16.2. Any dispute arising out of or in connection with this Privacy Policy shall be subject to the exclusive jurisdiction of the courts of the Hong Kong Special Administrative Region.