Daiwa Capital Markets Singapore Limited Privacy NoticeThis Notice describes how Daiwa Capital Markets Singapore Limited (“DCMSL”, “us”, we” or“our”) manages Personal Data (described below) which is subject to the Personal Data
Protection Act (No. 26 of 2012) of Singapore (“PDPA”). In the course of our business, DCMSL
processes information about individuals, including Personal Data about our prospective, current
and former clients (“you”). Please ensure that you know and understand the purposes for which
we collect, use and disclose your Personal Data.
By interacting with us, submitting information to us, or applying for any products or services
offered by us, you agree and consent to DCMSL, its affiliates and related corporations, as wellas their respective representatives and/or agents (collectively, the " Daiwa Group"), collecting,using, disclosing and sharing amongst themselves your Personal Data, and disclosing such
Personal Data to the Daiwa Group’s authorized service providers and relevant third parties in
the manner described in this Notice, as amended, updated or supplemented from time to time.
1

What does this Notice cover?

This Notice applies to any and all forms of use (“processing”) of Personal Data by us in
Singapore if you are a former, current or prospective client of DCMSL. In this Notice, “Personal
Data” refers to any data, whether true or not, about an individual who can be identified (a) fromthat data; or (b) from that data and other information to which we have or are likely to haveaccess, including data in our records as may be updated from time to time.
2

What types of Personal Data do we collect?

For prospective clients with whom we have not yet made contact, we may collect (to the extent
permitted by applicable law):Personal identification details (such as name, address, gender, nationality), contact
information (such as telephone, e-mail address), and family details (such as marital
status);information related to the professional profile (such as directorship / positions
and professional networks) and information related to company ownership andfinancial background.

For former and current clients or prospective clients with whom we are taking steps to enter into acontractual relationship, we collect (to the extent permitted by applicable law):















personal details such as your name, identification number, date of birth, compliance related
documents (including a copy of your national identity card or passport), phone number,address and domicile electronic address, and family details such as the name of your spouseor partner;
financial information, including payment and transaction records and information relating to
your assets (including fixed properties), financial statements, liabilities, taxes, revenues,
earnings and investments (including your investment objectives);
tax domicile and other tax-related documents and information;
where relevant, professional information about you, such as your job title and work experience;
your knowledge of and experience in investment matters;
details of our interactions with you and the products and services you use, including
electronic interactions across various channels such as e-mails and mobile
applications;
any records of phone calls between you and DCMSL, specifically phone log information suchas your phone number, calling-party number, receiving-party number, forwarding numbers,
time and date of calls and messages, duration of calls, routing information, and types of calls;
where relevant, details of your nomination of a mandate;identifiers we assign to you, such as your client, business relation, partner or accountnumber, including identifiers for accounting purposes;
when you access DCMSL websites or our applications, data transmitted by your browser or
device you are using and automatically recorded by our server, including date and time of
the access, name of the accessed file as well as the transmitted data volume and theperformance of the access, your device, your web browser, browser language andrequesting domain, and IP address (additional data will only be recorded via our Website if1

their disclosure is made voluntarily, e.g., in the course of a registration or request). Whenyou visit a DCMSL website, that website may contain additional information about how we
use your information while you are visiting that website; andin some cases (where permitted by law), special categories of Personal Data, such as yourbiometric information, political opinions or affiliations, health information, racial or ethnic
origin, religious or philosophical beliefs, and, to the extent legally possible, information
relating to criminal convictions or offences.

In some cases, we collect this information from public registers (which, depending on the product orservice you receive and the country of the Daiwa Group entity with which you have a contractual
relationship, may include beneficial ownership and other registers), public administration or otherthird-party or public sources, such as wealth screening services, credit reference agencies, fraud
prevention agencies, intermediaries that facilitate data portability, and other Daiwa Group entities.
We might also collect certain of the above Personal Data types in relation to your business
relationship, such as your additional account holders, business partners (including othershareholders, or beneficial owners), dependants or family members, representatives or agents.
Where you are an institutional or corporate client or investor, we may also collect information about
your directors, representatives, employees, shareholders, or beneficial owner. Before providing
DCMSL with this information, you should provide a copy of this Notice to those individuals.
3

For which purposes do we process your Personal Data and what legal basis do we rely
on?

3.1

Purposes of processing

We always process your Personal Data for a specific purpose and only process the Personal Data
which is relevant to achieve that purpose. In particular, we process Personal Data, within applicablelegal limitations, for the following purposes:a) Client Onboarding. For example:

to verify your identity and assess your application (including the need for guarantees orother securitisation tools) if you apply for credit.
to conduct legal and regulatory compliance checks (for example, to comply with antimoney laundering regulations, and prevent fraud). For more details, please see Sectione) below.

b) Client Relationship Management. For example, to:manage our relationship with you, including communicating with you in relation to the
products and services you obtain from us, other Daiwa Group entities and from ourbusiness partners, handling customer service-related queries and complaints,
facilitating debt recovery activities, making decisions regarding credit or your identity,
tracing your whereabouts, and closing your account (in accordance with applicable law)
if it remains dormant and we are unable to contact you after a period of time;
help us to learn more about you as a client, the products and services you receive, andother products and services you may be interested in receiving, including profiling basedon the processing of your Personal Data, for instance by looking at the types of products
and services that you use from us, how you like to be contacted.

c) Product implementation and execution. For example, to:provide products and services to you and ensure their proper execution, for instance byensuring that we can identify you and make payments to and from your accounts inaccordance with your instructions and the product terms;
perform underwriting.

d) Engaging in prospecting and business development and / or protecting and enhancing the
DCMSL and/or Daiwa Group brand. For example, to:evaluate whether and how DCMSL may offer products, services and events that may
be of interest to you;2

contact you for direct marketing purposes about products and services we think will beof interest to you, including those offered by us, other Daiwa Group entities, and ourother business partners, and facilitating competitions and promotions.

e) Compliance and Risk Management and / or Crime Prevention, Detection and Investigation.
For example, to:








f)

carry out legal and regulatory compliance checks as part of the onboarding process,including to comply with anti-money laundering regulations and fraud prevention;
meet our on-going regulatory and compliance obligations (e.g., laws of the financial
sector, anti- money laundering and tax laws), including in relation to recording andmonitoring communications, disclosures to tax authorities, financial service regulators andother regulatory, judicial and governmental bodies or in proceedings and investigating or
preventing crime;
receive and handle complaints, requests or reports from you or third parties made to
designated units within DCMSL or the Daiwa Group;
reply to any actual or potential proceedings, requests or the inquiries of a public
or judicial authority;
prevent and detect crime, including fraud or criminal activity, misuses of our products orservices as well as the security of our IT systems, architecture and networks;
undertake transactional and statistical analysis, and related research.

Supporting, Enhancing and Maintaining our technology. For example, to:take steps to improve our products and services and our use of technology, including
testing and upgrading of systems and processes, and conducting market research tounderstand how to improve of our existing products and services or learn about otherproducts and services we can provide.

g) Other purposes. For example:








3.2

for the Daiwa Group’s prudent operational management (including credit and risk
management, technological support services, reporting, insurance, audit, systems
and products training and administrative purposes);
to enable a transfer, merger or disposal to a potential buyer, transferee, merger partner
or seller and their advisers in connection with an actual or potential transfer, merger or
disposal of part or all of DCMSL’s business or assets, or any associated rights or interests,
or to acquire a business or enter into a merger with it;
to collect data to ensure the security of buildings as well as property and information
located or stored on the premises, to prevent, and if necessary, investigate
unauthorized physical access to secure premises (e.g., maintaining building accesslogs and CCTV system images);
testing and calibrating analytical models. In such case, pseudonymized data are used as
far as possible;
to exercise our duties and/or rights vis-à-vis you or third parties.

Basis for processing of Personal Data

Depending on the purpose of the processing activity (see Section 3.1), the legal basis for theprocessing of your Personal Data will be one of the following:









necessary to perform our contractual obligations towards you or to enter into or conclude
a contract with you or for carrying out our obligations under such a contract;necessary to comply with our legal or regulatory obligations that are required by law,such as tax reporting requirements;
necessary to protect the vital interests of the relevant individual or of another natural
person, such as responding to an emergency that threatens the health or safety of theindividual or another natural person;
necessary for business improvement purposes to the extent permitted under the PDPA,
such as to improve new processes for business operations in relation to DCMSL’s
services;
where we have obtained your prior consent;
necessary for one or more of the specific purposes deemed by law to be in the legitimate
interests of organisations (PDPA, First Schedule, Part 3, Para 2-10 - “Prescribed
3



4

Legitimate Interests”). Some of these Prescribed Legitimate Interests which arenecessary for DCMSL include the following:i.
for investigation or proceedings (including the establishment, exercise or defenceof a legal claim);ii.
for DCMSL to obtain legal services.
necessary for the general legitimate interests of DCMSL, without unduly affecting
your interests or fundamental rights and freedoms (PDPA, First Schedule, Part 3,
Para 1 - “General Legitimate Interests”). Examples include processing necessary
to:i.
manage our relationship with you and to help us to learn more about you as aclient, the products and services you receive, and other products and services you
may be interested in receiving (with the exception of direct marketing, i.e., sendingof unsolicited marketing material for which we would obtain your consent);ii.
evaluate whether and how DCMSL may offer products, services and events that may
be of interest to you;iii.
prevent fraud or criminal activity, misuses of our products or services as well as the
security of our information, IT systems, architecture and networks and security of
DCMSL premises;iv.
receive and handle complaints, requests or reports from you or third parties
made to designated units within DCMSL or the Daiwa Group;v.
take steps to improve our products and services and our use of technology andto conduct market research;vi.
cooperate with a request made in any actual or potential proceedings or theinquiries of a public or judicial authority;vii.
make disclosures for the purposes referred to in Section 5 below, such as providing
products and services and assuring a consistently high service standard across the
Daiwa Group, and keeping our clients, employees and other stakeholders satisfied.
How do we protect Personal Data?

All DCMSL employees accessing Personal Data must comply with our internal rules and processes
in relation to the processing of your Personal Data to protect them and ensure their confidentiality.
DCMSL and the Daiwa Group have also implemented adequate technical and organisational
measures to protect your Personal Data against unauthorised, accidental or unlawful destruction,
loss, alteration, misuse, disclosure or access and against all other unlawful forms of processing.
5

Who has access to Personal Data and with whom are they shared?

5.1

With DCMSL and the Daiwa GroupWe may share Personal Data with other Daiwa Group companies in order to ensure a consistently
high service standard across our group, and to provide services and products to you.
5.2

Outside DCMSL and the Daiwa Group

When providing products and services to you, we may share Personal Data with persons acting on
your behalf. For the purposes listed in section 3.1 above, and to the extent permitted under applicablelaw, we may also transfer Personal Data to third parties outside DCMSL and the Daiwa Group, such
as:








A potential buyer, transferee, merger partner or seller and their advisers in connection withan actual or potential transfer or merger of part or all of DCMSL’s business or assets, or any
associated rights or interests, or to acquire a business or enter into a merger with it;
Third party service providers, who are contractually bound to confidentiality, such as IT
system or hosting providers, cloud service providers, database providers, consultants(e.g., lawyers, tax accountants), and other goods and services providers;
Authorities, e.g., regulators, enforcement or exchange body or courts or party to proceedings
where we are required to disclose information by applicable law or regulation or at theirrequest, or to safeguard our legitimate interests;
Other credit, financial services, comparable institutions or other recipients to whom wetransfer Personal Data in order to conduct business. In particular: (i) when providing products
and services to you, to persons acting on your behalf or otherwise involved in the transaction(depending on the type of product or service you receive from us), including, where relevant
the following types of companies: a party acquiring interest in, or assuming risk in or in4connection with, the transaction (such as an insurer); or (ii) issuers of securities (including
third parties appointed by them) in which you have an interest, where such securities are heldby third party banks for you; (iii) payment recipients, beneficiaries, account nominees,intermediaries, and correspondent and agent banks (including custodian banks); (iv) clearing
houses, and clearing or settlement systems and specialised payment companies or
institutions such as SWIFT; (v) other banks, market/transaction counterparties (including
broker to whom we have executed a give-up agreement with), upstream withholding agents,
swap or trade repositories, stock exchanges; (vi) any third-party fund fiduciary administrator
or asset manager who provides services to you; (vii) other financial institutions, credit
reference agencies or credit bureaus (for the purpose of obtaining or providing credit
references); and (viii) any introducing broker to whom we provide introductions or referrals;
Any legitimate recipient required by applicable laws or regulations.

Where DCMSL or the Daiwa Group transfers your data to third party service providers processing
data on DCMSL or the Daiwa Group’s behalf, we take steps to ensure they meet our data security
standards, so that your Personal Data remains secure. Third party service providers are asked tocomply with a list of technical and organisational security measures, irrespective of their location,
including measures relating to: (i) information security management; (ii) information security risk
assessment and (iii) information security measures (e.g., physical controls; logical access controls;
malware and hacking protection; data encryption measures; backup and recovery management
measures).
5.3

Data transfers to other countries

The Personal Data transferred within or outside DCMSL and the Daiwa Group as set out in Sections
5.1 and 5.2, is in some cases also processed in other countries. We only transfer your Personal Dataabroad to countries which are considered to provide an adequate level of data protection, or in theabsence of such legislation that guarantees adequate protection, based on appropriate safeguards(e.g., standard contractual clauses adopted by the European Commission to the extent recognizedby the competent Data Protection Authority or another statutory exemption) provided by local
applicable law. As detailed in sections 4 and 5.2 above, DCMSL and the Daiwa Group ensure that
their third-party service providers take steps to implement, technical and organisational measures tosafeguard your Personal Data against unauthorized processing.
A list of the countries in which DCMSL and the Daiwa Group operate can be found at https://www.daiwagrp.jp/english/about/group/.
6

How long do we store your data?

We will only retain Personal Data for as long as necessary to fulfil the purpose for which it wascollected or to comply with legal, regulatory or internal policy requirements. To help us do this, weapply criteria to determine the appropriate periods for retaining your Personal Data depending on
its purpose.
As far as necessary, we will keep your data for the duration of our banking relationship subject toapplicable legal and regulatory requirements. In addition, we might process your data after thetermination of our banking relationship for operational purposes in accordance with the applicablelaws as well as pursuant to various retention and documentation obligations.
However, if you wish to have your Personal Data removed from our databases, you can make arequest as described in Section 7 below, which we will review as set out therein.
7

What are your rights and how can you exercise them?

7.1

Your rights

You have a right to access and to obtain information regarding your Personal Data that we process.
If you believe that any information we hold about you is incorrect or incomplete, you may also request
the correction of your Personal Data. You also have the right to withdraw your consent where DCMSL
obtained your consent to process Personal Data (without this withdrawal affecting the lawfulness ofany processing that took place prior to the withdrawal).
DCMSL will honour such requests, withdrawal or objection as required under applicable dataprotection rules but these rights are not absolute: they do not always apply and exemptions may be5engaged. We will usually, in response to a request, ask you to verify your identity and/or provide
information that helps us to understand your request better. If we do not comply with your request,
we will explain why.
7.2

Exercising your rights

To exercise the above rights, please send an e-mail to DPO@sg.daiwacm.com. If you are not satisfied
with how DCMSL processes your Personal Data, we would like to discuss it with you to understand
how we can rectify the issue. If you would like to speak to us about our use of your Personal Data,
you can contact DCMSL’s Data Protection Office by emailing DPO@sg.daiwacm.com.
If you are not satisfied with DCMSL’s response, you have the right to make a complaint to the Data
Protection Authority. The contact details of the Data Protection Authority can be found at the following
website: https://www.pdpc.gov.sg.
8

Changes to your Personal Data

We are committed to keeping your Personal Data accurate and up to date. Therefore, if your
Personal Data changes, please inform us of the change as soon as possible.
9

Updates to this Notice

We reserve the right to amend, vary or supplement this Notice it from time to time. Any amendment
or update to this Notice we will make available to you on the DCMSL website. Please visit the
DCMSL website frequently to understand the current Notice, as the terms of this Notice are closely
related to you. All communications, transactions and dealings with us shall be subject to the latest
version of this policy in force at the time.

6