New ZealandWells Fargo International Customer Privacy Notice
Effective: 05 June 2024
The Wells Fargo entity listed in Section 12 which you and/or your organization have a relationship or otherwise share
Personal Data with (“we”, “our”, “us” or “the Company”) provides this privacy notice ("Notice") to describe our practices asa data controller regarding the collection, storage, use, disclosure and other processing of individually identifiable
information directly or indirectly identifying you or other individuals relating to your organization (“Personal Data”). If youor your organization has a relationship or otherwise share Personal Data with a Wells Fargo entity in any country other than
New Zealand, a different privacy notice at https://www.wellsfargo.com/privacy-security/ will govern the Personal Data
collection and processing activities of that Wells Fargo entity.

1. Types of Personal Data Collected
In New Zealand, we primarily have relationships and accounts only with corporations and other legal entities. However, we
may collect information about individual representatives (“Individuals”) of our customer organizations (“Customers”), suchas the Individual's:•

Work contact details: such as name, work address, phone number, mobile phone number, email address, and online
contact details, including but not limited to unique identification and password for access to our website, mobile
applications, and/or social media features.

•

Position description: such as employer, title, position held, duties, and length of employment.

•

Authentication data: such as passport, driver’s license, other governmental identification information, homeaddress and telephone number, documents that verify address, date of birth, country of domicile, documents thatverify employment, marriage certificate (if the Individual acts as a personal guarantor), and signature authorization.

•

Financial data: such as salary and other income, sources of wealth, assets and documents that verify assets, credit
reports, financial relationships, and financial transactions.

•

Background check data: such as background check information including credit and criminal checks and screening,to the extent required or permitted by local law.

•

Surveillance data: such as images and voices captured by CCTV video and audio surveillance equipment installed (tothe extent permitted by local law) onto the business premises of a Wells Fargo entity if your Individuals visit thebusiness premises.

•

Electronic and voice communications data: such as content, data, recordings, IP addresses and session
identification data relating to business communications exchanged with Wells Fargo through all applicablecommunication channels, including email, text, instant message or chat, transcriptions, telephonic communications,audio or video calls, communications on financial or trading platforms, voice recordings, video recordings, andpresentations hosted by Wells Fargo.

We may collect Personal Data directly from Customers or the Individuals representing the Customers, including throughinteractions with the Bank and use of Bank systems, private lists, and publicly available sources (such as annual reports or© 2024 Wells Fargo Bank, N.A. All rights reserved.
IPN NZL2322 (Rev 05/06/2024)

the public registers, databases, and websites of government entities, regulators, or other authorities). Your Personal Data
will be processed in accordance with New Zealand’s data protection laws, and only where processing is necessary to achieve
the purposes described in Section 2. We will process your Personal Data in physical and electronic form and will do so in a
way that adequately safeguards your Individuals’ personal rights and interests in accordance with New Zealand’s dataprotection laws.
You and your Individuals have the right to refuse to consent to providing Personal Data. However, the collection andprocessing of Personal Data is necessary to enable the provision of services and support the service relationship with theCustomer. Failure to provide Personal Data may result in the Company being unable to provide or to continue providing
services to the Customer where Personal Data is necessary for such provision.

2. Purposes of Collection and Use of Personal Data
The purposes of collection and use of Personal Data are:•

To provide the services requested by our Customers, perform obligations under our agreements, and carry out
related business functions, including performing data and transaction processing, conducting credit checks,
handling Customer inquiries, including communicating, presenting, and meeting with a Customer, and managing theCustomer relationship, we collect and use Personal Data including work contact details, position description,authentication data, financial data, background check data, electronic and voice communications data, and othercategories of Personal Data where needed.

•

To comply with legal obligations, regulations, regulatory guidance or codes of practice applicable to the Company
and its Affiliated Entities (defined below) in the United States and/or any relevant jurisdictions, including but notlimited to complying with “know your customer” obligations based on applicable anti-money laundering andantiterrorism requirements, economic and trade sanctions, customer due diligence, fraud prevention andinformation security, suspicious activity reporting, foreign exchange and international trade, tax reporting and otherapplicable laws, regulations, ordinances, and obligations, complying with any requests from any regulator or
authority to the extent permitted by applicable law, performing risk management to facilitate compliance with theabove, we collect and use Personal Data including work contact details, position description, authentication data,
financial data, background check data, electronic and voice communications data, and other categories of Personal
Data where needed.

•

To confirm a person’s authority as a representative or agent of a Customer with which the Company or its
Affiliated Entities have entered or intend to enter into various arrangements, including but not limited to deposit
contracts, loan contracts, contracts for foreign exchange transactions, contracts for derivative transactions, andletters of credit, we collect and use Personal Data such as work contact details, position description, backgroundcheck data, authentication data, and other categories of Personal Data where needed.

•

To conduct recordkeeping and otherwise manage the business, such as to monitor or facilitate compliance with
Wells Fargo’s internal policies, to perform risk management, to maintain, improve or upgrade Wells Fargo’s
technology, operations or systems, to protect the business, rights or property of any Wells Fargo Group entity(defined in Section 3) by raising any legal claim, defense or proceedings, to support the conduct of audits, support
business transfers, combinations, restructuring, dissolutions or similar activities relating to any Wells Fargo Group
entity, etc., we collect and use Personal Data including work contact details, position description, authentication
data, financial data, background check data, electronic and voice communications data, and other categories of
Personal Data where needed.

3. Disclosure of Personal Data
The Company may disclose or transfer Personal Data to the recipients below for the purposes listed in Section 2 (in each

2

IPN NZL2322 (Rev 05/06/2024)

case to the extent necessary and on a need-to-know basis).
•

Affiliated Entities. The Company has Affiliated entities operating in the United States and around the world("Affiliated Entities"), including the group parent in the United States, Wells Fargo & Company, and Wells Fargo
Bank, N.A. (collectively, the Company and our Affiliated Entities are the "Wells Fargo Group"). We may disclose
Personal Data to our Affiliated Entities on a worldwide basis. A non-exhaustive list of Affiliated Entities is found in
this Wells Fargo & Company 10-K filing made with the US Securities and Exchange Commission:
https://www.sec.gov/Archives/edgar/data/72971/000007297124000064/wfc-11231x2023xex21.htm.

•

Beneficiaries, counterparties, and other parties related to a transaction. The Wells Fargo Group may disclose
Personal Data to beneficiaries, counterparties, or other parties related to a transaction on a worldwide basis, forexample, to provide the services requested by our customers and to comply with legal obligations and regulations.

•

Service providers. The Wells Fargo Group may disclose Personal Data to information technology providers or otherservice providers around the world that act under our instructions regarding the processing of such data ("Data
Processors"). Data Processors will be subjected to contractual obligations to implement appropriate administrative,
technical, physical, and organizational security measures to safeguard Personal Data and to process Personal Data
only as instructed. The Wells Fargo Group may also disclose Personal Data to independent external auditors or otherservice providers around the world that may not be acting as a Data Processor. Such service providers will be subject
to any necessary contractual obligations regarding the protection and processing of such Personal Data.

•

Legal requirements. Subject to applicable law, the Wells Fargo Group may disclose Personal Data if required or
permitted by applicable law or regulation, including laws and regulations of the United States and other countries,
or in the good faith belief that such action is necessary to: (a) comply with a legal obligation or in response to arequest from law enforcement or other public authorities wherever the Wells Fargo Group may do business; (b)protect and defend the rights or property of any Wells Fargo Group entity; (c) act in urgent circumstances to protect
the safety of Customers and their Individuals, the employees or contingent workers of any Wells Fargo Group entity,or others; or (d) protect against any legal liability. In addition, the Wells Fargo Group may share your Personal Datawith U.S. regulators and with other self-regulatory bodies to which we are subject, wherever the Wells Fargo Groupmay do business.

•

Business transfers, combinations, and related activities. As we develop our business, the Wells Fargo Group mightsell, buy, acquire, obtain, exchange, restructure or reorganize businesses or assets. In the event of any actual or
proposed sale, merger, reorganization, transaction, restructuring, dissolution, or any similar event involving ourbusiness or assets, Personal Data may be shared with the relevant entity or may be part of the transferred assets
and will be subject to any necessary contractual obligations to ensure the protection of Personal Data.

The recipients of Personal Data identified in this Section 3 may be in the United States or other jurisdictions outside thecountries where you or your Individuals are based. As such, these overseas recipients may not be required to comply withand provide you or your Individuals with comparable levels of data protection or redress under, the data protection laws
where you or your Individuals are based. Some of these recipients may also act as data controllers (rather than Data
Processors) with respect to your Personal Data. Notwithstanding the above, where required by applicable data protection
laws, the Company will: (i) address any applicable requirement to ensure an adequate level of data protection before
transferring Personal Data by ensuring the execution of appropriate data transfer agreements or confirming otherreasonable safeguards are in place; and (ii) establish that Personal Data will be made available to recipients on a need-toknow basis only for the purposes described in Section 2 above. These measures enable us to transfer and use Personal Data
in a secure manner anywhere in the world where we have an establishment, or where we have contracted third parties toprovide us with services.

4. Credit Reporting Bodies
The Company and its Affiliated Entities may obtain credit reporting information about Individuals from credit reporting

3

IPN NZL2322 (Rev 05/06/2024)

bodies. Credit reporting information includes:•

credit information typically provided to credit reporting bodies by other credit providers and relating primarily to an
Individual’s dealings with such credit providers, including applications for credit, payment information, and default
information; and•credit worthiness information about Individuals that credit reporting bodies derive from the information above,
such as credit scores, risk ratings and other evaluations.

The Wells Fargo Group may also disclose an Individual’s Personal Data (including credit information relating to that
Individual’s dealings with us) to credit reporting bodies. Those credit reporting bodies may include such Personal Data inreports that they provide to other credit providers to assist them to assess the Individual’s credit worthiness. Some
examples include: (a) providing Personal Data about the Individual’s application for credit when obtaining credit reporting
information for the purposes of assessing that application; or (b) if the Individual fails to meet payment obligations to us, orif the Individual commits a serious credit infringement in relation to credit provided by us, we may be entitled to disclose
this information to credit reporting bodies.
The Wells Fargo Group discloses credit information to the following credit reporting bodies:
Equifax New Zealand Information Services and Solutions Limited(NZBN 9429039517487)
http://www.equifax.co.nz
Level 8, 22 Fanshawe Street
Auckland 1010
New Zealand
These credit reporting bodies are each required to have a policy that explains how they will manage credit-related Personal
Data. Please visit their websites and follow the "Privacy" links to review their privacy policies or contact them directly forfurther information.
Individuals have the right to request these credit reporting bodies exclude credit reporting information from: (a) being usedby such bodies in connection with pre-screening for direct marketing requested by a credit provider; and (b) any permissible
direct marketing activities the Wells Fargo Group may request such bodies to perform. Individuals should contact eachrelevant credit reporting body directly if they wish to request this.
Individuals also have the right to request credit reporting bodies not to use or disclose their credit reporting information if
they believe that they have been, or are likely to be, the victim of fraud (for example, they suspect someone is using theiridentity details to apply for credit). Individuals must contact the credit reporting bodies directly should this be the case.

5. Consents
To the extent that consent is required by applicable law and our collection, use, disclosure, or other processing of Personal
Data is not otherwise permitted by applicable law, you expressly consent to the collection, use, disclosure (including
cross-border transfer), and other processing of Personal Data as described in this Notice by providing Personal Data to theWells Fargo Group or authorizing our Customer to provide such information to us. Where you directly or indirectly provide
any Wells Fargo Group entity with the Personal Data of any individuals, you must have first informed such individuals about
our data privacy practices by providing them with a copy of this Notice, and obtained all required informed consents(including separate consents) from such individuals to permit the activities described in this Notice, before providing their
Personal Data to the Wells Fargo Group. You expressly waive the bank secrecy or confidentiality laws and obligations, if any,of the country or countries where you and the accounts are located to the extent permitted by applicable law.
You may revoke consent for the processing of your Personal Data at any time by notifying us using the contact information
provided in Section 10 of this Notice. Revocation of consent will not affect the lawfulness of Personal Data processing
performed prior to the withdrawal request, or processing based on lawful bases other than consent. Revocation of consent

4

IPN NZL2322 (Rev 05/06/2024)

may result in our inability to provide or continue to provide the requested services to the Customer where Personal Data isnecessary to provide the requested services.

6. Security of Personal Data
Wells Fargo takes appropriate technical, physical, and organizational security measures to protect your Personal Data.
•

Wells Fargo’s cybersecurity team, which is part of the broader technology team, provides Front Line information
security risk assessment and management and is responsible for protecting the Company’s information systems,
networks, and data, including customer and employee data, through the design, execution, and oversight of our
information security program.

•Wells Fargo has processes designed to prevent, detect, mitigate, escalate, and remediate cybersecurity incidents,
including monitoring of the Company’s networks for actual or potential attacks or breaches. The Company’s incident
response program includes notification, escalation, and remediation protocols for cybersecurity incidents, including
to our Head of Technology and CISO. In addition, to help monitor and assess our exposure to ongoing and evolving
risks in these areas, the Company has a cyber and information security focused risk committee led by the CISO anda technology risk committee led by the Head of Technology.

•

Additional components of Wells Fargo’s information security program include: (i) enhancing and strengthening ofour practices, policies, and procedures in response to the evolving information security landscape; (ii) designing our
information security program to align with regulatory and industry standards; (iii) investing in emerging
technologies to proactively monitor new vulnerabilities and reduce risk; (iv) conducting periodic internal and thirdparty assessments to test our information security systems and controls; (v) leveraging third-party specialists andadvisors to review and strengthen our information security program; (vi) evaluating and updating our incident
response planning and protocols; and (vii) requiring employees and third-party service providers who have access toour systems to complete annual information security training modules designed to provide guidance for identifying
and avoiding information security risks.

•

Wells Fargo’s third-party risk management program also has processes to incorporate information security andcybersecurity incident notification requirements into contracts with third-party service providers, require third
parties to adhere to defined information security and control standards, and perform periodic third-party risk
assessments.

•

While registering with our website, mobile applications, or social media features (each, a "Site"), we may provide youwith a unique identification and password for accessing our products and services. We encourage you to choose yourpassword wisely such that no intruder or third party can obtain any unauthorized access to the Site. We also
encourage you to keep your password confidential and not have any written or other record of the password thatcan be accessible by an intruder or third party.

Despite our best endeavors, unfortunately no data transmission or storage system can be guaranteed to be absolutely
secure. If you have reason to believe that your interaction or Personal Data with us is no longer secure, please immediately
notify us using the contact information in Section 10.

7. Retention of Personal DataYour Personal Data is retained in a manner consistent with applicable law and for as long as necessary to fulfil the purposesof collection described in Section 2. Records are kept by Wells Fargo and its third-party service providers for varying periods
generally ranging from 1 year to 10 years (and for longer in some cases) depending on the legal, regulatory, or business
requirements for the particular record. The criteria used to determine these retention periods include but are not limited to
the following:

5

IPN NZL2322 (Rev 05/06/2024)•

The length of time we have an ongoing relationship with you and provide the services to you (for example, for as
long as your organization has an account with us or keeps using the services);•

Whether there is a legal obligation to which we are subject (for example, certain laws require us to keep records ofyour transactions for a certain period of time after your organization no longer has an account with us);•

Whether retention is advisable considering our legal position (such as in regard to applicable statutes of limitations,litigation or regulatory investigations); and/or•

Whether our operational needs require maintaining your personal data (for example, for internal or external auditsof company operations, maintaining solicitation preferences (including for former customers and non-customers),
systems administration, or for fraud prevention).

8. Data Subject Rights and Choice for Marketing Materials
Data Subject Rights
Your Individuals may have certain rights in relation to Personal Data we hold about them. They may have the right to access,delete and correct any Personal Data held about them. They also have the right to withdraw their consent to the processingof their Personal Data, but such withdrawal will not affect the lawfulness of processing performed prior to the withdrawal
request or performed based on a lawful basis other than consent.
Requests must be submitted by the Individual in writing using the contact information listed in Section 10 below. After wehave verified the Individual's identity, we will endeavor to respond promptly to valid data subject requests and take the otheractions requested as specified by local law. Where permitted by law, we may charge an appropriate fee to cover the costs of
responding to the request. These rights may not be absolute, and exceptions may be applicable. If Wells Fargo is not able toaccommodate the request, the requestor will be provided with reasons for the denial.
Choice for Marketing Materials
If you do not want to receive marketing and sales materials from Wells Fargo by direct mail, telephone, or email, please follow
the “unsubscribe” instructions provided in those communications or submit a written request using the contact information
listed in Section 10 below. We will comply with your request within a reasonable period of time after receiving it or within
the time period required by local law.

9. Complaints
You have a right to make a complaint if you think we have not adhered to this Notice or any applicable privacy law in handlingyour Personal Data. If you would like to make a complaint, please submit your complaint in writing using the contact details
in Section 10 below. We will respond to a written complaint within 30 days. If you are not satisfied with our response, you
may be able to pursue your complaint with the New Zealand Privacy Commissioner – details on how to do so are available atits website here.

10. Customer Inquiries
Please direct all requests regarding your Personal Data, or any questions regarding this Notice to:
APAC Regional Privacy Officer
138 Market Street, #30-01 CapitaGreen, Singapore, 048946
Telephone: (65) 6395 6900
Email: privacy.apac@wellsfargo.com

6

IPN NZL2322 (Rev 05/06/2024)

Your comments are valuable to us and we assure you that we will do our best to address them.

11. Modifications
This Notice may be modified as a result of amendments to the law or regulations or due to other reasons. In such case, anamended Notice will be posted on our website at http://www.wellsfargo.com/privacy_security/. The page providing the
Notice shall contain a date as to when the Notice was last updated.

12. Wells Fargo Entities covered by this Notice
The name and address of the Wells Fargo entity collecting, and processing Personal Data in New Zealand is as follows:
Entity Name

Address

Wells Fargo International Finance (New Zealand) Limited

North Lobby, Level 1, Office #108, 293 Durham Street,
Christchurch, 8013, New Zealand

7

IPN NZL2322 (Rev 05/06/2024)

Acknowledgement and Consent
By signing in the appropriate space below (or clicking the accept button if acknowledged electronically), theCustomer/Guarantor (as applicable) agrees that:a) it has received this Acknowledgment and Consent before transmitting or otherwise providing any Personal Data to us;b) it consents to the collection, use, processing, storage, and transfer of Personal Data (with knowledge of the implicationsof such transfers described in Section 3) in accordance with the terms and conditions contained in the Notice;c) to the extent it provides us with the Personal Data of any other individuals, that it has informed such individuals about
Wells Fargo's data privacy practices by providing them with a copy of this Notice (also available at:
http://www.wellsfargo.com/assets/pdf/personal/privacy-security/new-zealand-customer-privacy-notice-english.pdf)
and obtained all required informed consents from such individuals necessary to permit the activities described in the
Notice;d) we may amend the Notice at any time by posting an updated version on our website referenced above, which it shallcheck periodically; and in case of any update of the Notice, it shall: (i) to the extent permitted by applicable privacy law,
be deemed to consent to the terms in the updated Notice unless withdrawal of consent is communicated in writing to
us using the contact information in Section 10 of the Notice, and (ii) provide the individuals identified in (c) above witha copy of the updated Notice and obtain all required informed consents from such individuals to permit the activities
described in the updated Notice; ande) the Notice supersedes any prior notice on this subject and shall cover all Personal Data collected or maintained by us inconnection with our relationship with it.

Customer/Guarantor Name (Borrower’s/Corporate Guarantor’s Legal Entity Name)

Signature (Please sign here)

Signatory’s Name (Please print)

Signatory’s Position/Job Title

Date

8

IPN NZL2322 (Rev 05/06/2024)