Daiwa Capital Markets Singapore Limited
Sydney, Australia Branch

Privacy Policy

Policy version 2.0 (July 2023)

Table of Contents

1. About this Policy ......................................................................................................................... 1
2. What types of personal information do we collect? ................................................................ 1
2.1 Personal information................................................................................................................. 1
2.2 Sensitive information ................................................................................................................ 2
3. How do we collect your personal information? ....................................................................... 2
4. What are the purposes for which we use your personal information? ................................. 2
4.1 Purpose for processing............................................................................................................. 2
4.2 Direct marketing ....................................................................................................................... 3
5. Who has access to your personal information and with whom are they shared with? ....... 35.1 DCMSL and the Daiwa Group .................................................................................................. 35.2 Outside DCMSL and the Daiwa Group .................................................................................... 3
5.3 Data transfers to other countries .............................................................................................. 46. How do we store and protect personal information? .............................................................. 4
7. What are your rights and how can you exercise them? .......................................................... 47.1 Accessing your personal information ....................................................................................... 4
7.2 How to update or correct your personal information? .............................................................. 5
7.3. Complaints and enquiries ........................................................................................................ 5
8. Policy updates ............................................................................................................................. 5

1. About this Policy
This Privacy Policy (“policy”) applies to the handling of personal information that was collected or held inAustralia by Daiwa Capital Markets Singapore Limited (ARBN: 630 088 523), whether directly or throughour Singapore branch, or an affiliated legal entity part of the Daiwa Group (“affiliates”). This policy outlines
how we collect, hold, use and disclose your personal information and the measures we have in place tocomply with our obligations with the Australian Privacy Principles (“APPs”) in accordance with the Privacy
Act 1988 (Cth) (the “Privacy Act”).
In this policy, references to “DCMSL”, “us”, “we” or “our” relates to Daiwa Capital Markets Singapore
Limited and its branches. References to “you” or “your” relates to individuals whose personal
information is collected or held by DCMSL.
As exempted from the Privacy Act, this policy does not apply to employee records of current or formeremployees of DCMSL relating to employment. However, where you are a current or former employee
and to the extent the personal information we have collected from you is within the scope of the Privacy
Act, this policy applies to that personal information.

2. What types of personal information do we collect?
2.1 Personal information
At all times, we will only collect personal information that is reasonably necessary to perform ourfunctions or business activities by lawful and fair means.
Personal information is defined under the Privacy Act as any information or an opinion about an
identified individual, or an individual who is reasonably identifiable, whether the information or opinion
is true or not and whether the information or opinion is recorded in a material form or not.
The types of personal information we may collect from you include:









Personal details such as your full name, signature, date of birth, citizenship, tax domicile,
marital status;
Personal information relating to your immediate family members and your connections to any
political figures;Contact details such as your residential address, business address, postal address, emailaddress, telephone number and facsimile number;
Identification documents (which may include a photograph and/or personal identity number, ora combination of both) and government issued identifiers such as a drivers licence, passport,
government identity card, pension card, Medicare card, ABN and ACN;
Secondary identification documents such as a notice from the Australian Taxation Office orother government agency such as Centrelink, municipal council rates notice or utilities bill (suchas a water, gas or electricity bill);
Financial information such as your source of wealth and source of funds, your businessdealings (including your dealings with us and our affiliates), investment experience or strategy,bank and trading accounts, transactions, investments, assets and liabilities;
Employment information such as your occupation, job title, contact number, current and former
employer, references collected about you from third parties such as a personal or employment
reference;
Personal records about you where permitted by law such as credit information, bankruptcy andcriminal records;
Photographs, videos, CCTV footage, voice recordings;
Internet protocol (IP) address, when you access DCMSL websites or our applications.

In connection with our business we have obligations under the Anti-Money Laundering and CounterTerrorism Financing Act 2006 (“AML/CTF Act”) and Anti-Money Laundering and Counter-Terrorism
Financing Rules Instrument 2007 (No.1) (“AML/CTF Rules”) to know our clients (otherwise known as
KYC obligations). Where applicable, our KYC obligations may require us to collect personal information

1

about: beneficiaries of trusts, directors, beneficial owners, associations with politically exposed persons
which may involve holding information that another person within your organisation has provided to us.
2.2 Sensitive information
Sensitive information is personal information that includes information or opinion about an individual's
racial or ethnic origin, sexual orientation or practices, political opinions, membership of a politicalassociation, religious beliefs or affiliations, philosophical beliefs, membership of a trade union or otherprofessional body, criminal record or health information.
As with any personal information, we will only collect and process sensitive information that isreasonably necessary to perform our functions and where we have a Iegal basis for such collection.
This includes ensuring that we obtain your consent to use your sensitive information.
If we are unable to collect some of the personal information we seek, or where you withdraw yourconsent for us to collect, use, hold and disclose your personal information, this may limit our ability tocarry out your instructions to provide our products and services to you or receive services from you.

3. How do we collect your personal information?
We generally collect personal information directly from you. This occurs when you contact us directly or
we contact you through correspondence by phone, email, facsimile, face to face meetings, videoconferences or by completing our forms.
In some circumstances and where reasonably permitted by law, we may need to collect personal
information about you from:

persons you have authorised or delegated to act on your behalf;
other financial institutions (custodians, settlement agents, issuers) in the ordinary course of ourbusiness;
our authorised persons, delegates or affiliates;
third party service providers such as data providers, screening providers, credit agencies;
government agencies; andpublicly available sources such as public registers

for the purposes described in this policy.
The type of personal information we collect and hold will depend on the type of product or services you
seek from us.

4. What are the purposes for which we use your personal information?
4.1 Purpose for processing
We will only use your personal information for specific purposes where legally permitted. Accordingly, we,our affiliates and/or persons acting on our behalf will only process and use your personal information:

For purposes for which you consent.
When we on-board you as a client, we are required to perform KYC checks to identify and verify
you, as well as perform our due diligence on you before you become a client of DCMSL.
Perform our contractual obligations with you, or to enter into or conclude a contract with you, orfor carrying out our obligations under such a contract.
Provide our products and services to you and ensure proper execution. For example, by ensuringthat we can identify you and make payments to and from your accounts in accordance with yourinstructions and the product terms.
Manage our relationship with you on an ongoing basis. This includes but not limited to ensuring
your personal information is up to date and accurate, understanding your needs and how we canservice you, identify changes in customer risk profile, invite you to events that may interest you.
Comply with our legal and regulatory obligations, including tax laws and audit requirements.
Comply with our internal policies and procedures.

2

Perform our functions that maybe administrative and operational in nature such as accounting, riskmanagement and assessments, record keeping, internal reporting, technology processes (testing,maintenance, upgrades, business continuity).
Monitor and record calls and electronic communications for regulatory reasons, training,investigation and detection of potential misconduct.
Improve our product and service offerings and customer experience, including conducting market,product, or customer research and undertake transactional and statistical analysis.
Manage and respond to enquiries and complaints.
Detect and prevent fraud.
To exercise and defend our legal rights.
For prospective employees (including contractors), we have an obligation under the AML/CTF Act
to have an employee due diligence program which involves background screening checks todetermine the suitability of the role and ensure the person is who they claim to be.

4.2 Direct marketing
Whilst we do not anticipate to engage in direct marketing, in the event that we do, the Privacy Act prohibits
us from using or disclosing your personal information for direct marketing purposes to you unless:
1. With respect to personal information other than sensitive information:a) we have collected the personal information directly from you and you would reasonably expect
us to use or disclose your personal information for direct marketing purpose; orb) your personal information has been collected from a:(i) third party; or(ii) directly from you, but you do not reasonably expect that your personal information will
be used or disclosed for direct marketing purposes; and either(iii) you have consented for us to use or disclose your personal information for direct
marketing purpose; or(iv) it is impractical to obtain your consent; andc) you have not made such a request with us.
2. With respect to sensitive information, we can only use or disclose sensitive information about you
for direct marketing purposes to you, only when you provide your consent to use and disclose yoursensitive information for this purpose.
If you wish to unsubscribe from receiving our direct marketing materials, you can opt out at any time bysending a request to our Privacy Officer in writing using the contact details noted in Section 7.3 of thispolicy.

5. Who has access to your personal information and with whom are they shared with?
We process and use your personal information for the purposes specified in this policy. Where appropriate
and to the extent permitted by law, we may disclosure your personal information with:
5.1 DCMSL and the Daiwa Group
Our Singapore branch and our affiliates. A list of the countries in which DCMSL and the Daiwa Group
operate can be found at https://www.daiwa-grp.jp/english/about/group/
5.2 Outside DCMSL and the Daiwa Group
Third parties outside of DCMSL and the Daiwa Group such as:

A potential buyer, transferee, merger partner or seller and their advisers in connection with anactual or potential transfer or merger of part or all of DCMSL’s business or assets, or any
associated rights or interests, or to acquire a business or enter into a merger with it;
Third party service providers who are contractually bound to confidentiality such as IT systems or
hosting providers, cloud service providers, database providers, consultants (e.g. lawyers, tax
accountants), background screening providers and vendors;

3



Authorities, where required or authorised by law. E.g. regulators, enforcement or courts or party
to proceedings where we are required to disclose information by applicable law or regulation or attheir request, or to safeguard our legitimate interests;
Other financial institutions such as banks, settlement agents and other parties to whom we transfer
personal information in the ordinary course of conducting our business activities;
Any legitimate recipient required by applicable laws or regulations.

Where DCMSL or an affiliate transfers your personal information to a third party service provider forprocessing on behalf of DCMSL or an affiliate, we take steps to ensure they meet our data security
standards so that your personal information remains secure. Third party service providers are asked tocomply with a list of technical and organisational security measures, irrespective of their location, including
measures relating to:
1. information security management;
2. information security risk assessment; and3. information security measures (e.g. physical controls; logical access controls; malware andhacking protection; data encryption measures; backup and recovery management measures).
5.3 Data transfers to other countries
Personal information transferred within or outside DCMSL and the Daiwa Group is in some cases also
processed in other countries. We only transfer your personal information to countries which are considered
to provide an adequate level of data protection, or in the absence of such legislation that guarantees
adequate protection, based on appropriate safeguards (e.g. standard contractual clauses adopted by theEuropean Commission to the extent recognized by the competent data protection authority or anotherstatutory exemption) provided by local applicable law.

6. How do we store and protect personal information?
Your personal information may be stored in hard copy documents or electronically. We are committed toprotecting the personal information that we hold about you from misuse, loss, unauthorised access,modification or disclosure. We do this by having in place technical and organisational security measures.
Our security measures include but not limited to:




Restricting access to our systems and physical records only to authorised employees who require
your personal information to perform their functions.
Ongoing monitoring and review of system access.
We mandate our employees to use unique passwords to access systems and a requirement tochange passwords regularly.
Contracts and disclaimers mandating confidentially of DCMSL’s client information
Firewalls, detection software to prevent viruses and unauthorised access
Security passes provided only to authorised employees to access DCMSL’s office.
We provide training to our employees and have in place internal policies to handle personal
information appropriately.
Where we transfer your personal information to a third party service provider or to an affiliate forprocessing on our behalf, we perform due diligence on the provider to ensure they meet our data
security standards, so that your personal information remains secure.

We retain your personal information for the minimum period legally required by us to comply with our legal
and regulatory obligations.

7. What are your rights and how can you exercise them?
7.1 Accessing your personal information
You are entitled under the Privacy Act to access the personal information we hold about you by contacting
our Privacy Officer. Where reasonable and practical to do so, we will provide you with the information in
the form you request. However, there are circumstances under the Privacy Act where we are not obliged
to provide an individual access to personal information. Circumstances include:

4a) Where we believe that giving access would pose a serious threat to the life, health or safety of anyindividual, or to public health or public safety;b) Where giving access would have an unreasonable impact on the privacy of other individuals;c) Where the request for access is frivolous or vexatious; ord) Where the information would not be ordinarily accessible because it relates to existing oranticipated legal proceedings between DCMSL and the individual;e) Where providing access would reveal the intentions of DCSML in relation to negotiations with theindividual in such a way as to prejudice those negotiations;f) Where providing access would be unlawful;g) Where denying access is required or authorised by or under an Australian law or a court/tribunalorder;h) Where both of the following apply:i.
DCMSL has reason to suspect that unlawful activity, or misconduct of a serious nature,that relates to DCMSL’S functions or activities has been, is being or may be engaged in;andii.
providing access would be likely to prejudice the taking of appropriate action in relation tothe matter;i) Where providing access would be likely to prejudice one or more enforcement related activities
conducted by, or on behalf of, an enforcement body;j) Where providing access would reveal evaluative information generated within the entity inconnection with a commercially sensitive decision-making process.
Where access is restricted or denied, we are required to provide you a written notice as to the reason(s)why.
DCMSL will not charge any fee for your access request, but may charge a reasonable administrative feefor providing a copy of your personal information.
In order to protect your personal information, we may require identification from you before releasing therequested information.
7.2 How to update or correct your personal information?
We take reasonable steps to ensure that your personal information is accurate, complete and up-to-date
whenever we collect or use it. If you find that the information we hold about you is not up to date or isinaccurate, please contact our Privacy Officer in writing using the contact details noted in Section 7.3 tohave your personal information corrected.
We will respond to all requests for access and/or correction within a reasonable time.
7.3. Complaints and enquiriesIf you have any comments or questions about any of the information in this policy, or a complaint in theway we have handled any privacy issue, including your request for access or correction of your personal
information, please contact our Privacy Officer (Head of Compliance) by sending an email to:
DPO@sg.daiwacm.com
We will endeavour to respond to your complaint or query as soon as possible.
If you remain unsatisfied with the way in which we have handled a privacy matter, you can also lodge acomplaint at the Office of the Australian Information Commissioner website at: www.oaic.gov.au/aboutus/contact-us

8. Policy updates
We may amend, vary or supplement this policy from time to time as required to reflect changes in ourpractices and/or applicable law and regulation. Please visit the DCMSL website to locate a copy of ourcurrent policy. All communications, transactions and dealings with us shall be subject to the latest
version of this policy in force at the time.

5