PERSONAL DATA PROTECTIONREGULATIONSSAGAWA EXPRESS (H.K.) CO., LTD.

PERSONAL DATA PROTECTION REGULATIONSGENERAL
The objective of this Personal Data Protection Regulations (the “Regulations”) is to protect therights and privacy of individuals’ Personal Data (defined below), by determination of standards,
rights, duties, and measures for the protection of Personal Data possessed by Sagawa Express(H.K.) Co., Ltd. (the “Company”), and ensure that the Company fully complies with The Personal
Data (Privacy) Ordinance (Cap.486) (the “PDPO”). and where appropriate other applicable laws
and regulations in Hong Kong (collectively, the “Applicable Law”).
This Regulations applies to all employees of the Company (plural as “Employees”, and singularas “Employee”). Any breach of the Applicable Law or this Regulations will be taken very seriously,
and disciplinary action may be taken.
This Regulations shall be effective as of August 1st, 2023 and is subject to further changes orrevisions (which shall be notified to an Employee). The Company shall continue to review theeffectiveness of this Regulations from time to time as and when necessary.
This Regulations works in tandem with the Privacy Policy for Employees and the Employee
Consent Form which the Employee has signed. Please study this Regulations and both
documents carefully to understand how the Company use Employees Personal Data.
1.

KEY DEFINITIONS“Personal Data” refers to any data about an individual which can be used to identify suchindividual (“Data Subject”), whether from that data alone or in combination with otherinformation. This includes any expression of opinion about an individual and intentions
towards an individual. This also includes personal data held visually, such as photographs
and video clips (including CCTV) as well as audio recordings.
“Data Subject” refers to the individual who is the subject of the personal data. For the
purposes of this Regulation, the Employee (plural as Employees) is the Data Subject.
“Data User” is a person who, either alone or jointly with other persons, controls collection,
holding, processing or use of personal data. For the purposes of this Regulation, theCompany is the Data User.
“Data Processor” is a person who processes personal data on behalf of another person (adata user), instead of for his/her own purpose(s).

2.

DATA PROTECTION PRINCIPLES

2.1.

Collection of Personal Data
The Company may, directly or indirectly, collect your personal data from the following
sources:(1) Information that you or your representative directly provided to the Company;(2) Personal data received from affiliates of the Company;(3) Application, website, social media, and/or other public relation media you use in order
to contact the Company;(4) Personal data received from vendor or business partner of the Company such as

2

recruitment agency; or(5) Any reliable public sources.
2.2.

Types of Personal Data Collected
The Company shall only collect personal data that are necessary and adequate (but notexcessive) for a lawful purpose directly related to a function or activity. Depending on
purposes of use and requirement of the operatives in processing personal data, theCompany may collect various types of Employee’s Personal Data including:(1) Identification information such as name-surname, name prefix, date of birth, nationality,
identification number, taxpayer identification number, fax number telephone number, email, social media account (such as Line ID), address, copy of identification card, copyof driver license, copy of car registration, copy of household registration, copy of
passport, photo, voice, signature, picture, and video;(2) Personal characteristics such as a copy of the professional license, copy of license (i.e.,international transportation license), and job position;(3) Financial information such as bank account, transaction information, financial credit
information, withholding tax information, payment method, and other payment details;
and(4) Personal characteristics such as blood type, religion, health check report, medical
records; and(5) Criminal record information such results of background check from Hong Kong Police
Force.
(6) Other information such as vehicle registration number, Personal Data that the data
subject provides to the Company when contacting us such as interest and type ofservice, communication with the Company through social media and other channels.

2.3.

Purposes of use and disclosure
The Company will process Employee’s personal data to: (i) perform contractual obligations
as a party to the contract, (ii) comply with legal obligations, or (iii) for the legitimate interest.
Personal Data which the Company collects from an Employee may be collected, used and/or
disclosed for the following purposes (collectively, the “Purposes”):(1) To process recruitment including application and background review;(2) To conduct performance review for performance appraisal, promotion and careerdevelopment;(3) To monitor personnel to maintain labour management within the Company, including
headcounts and Employee’s database;(4) To administer Employee’s employment;(5) To facilitate Employees with personnel system development including arranging
secondment, training and skill surveys;(6) To manage job and position deployment and transfer;(7) To administer payroll and tax reporting;(8) To administer compensation and benefits and welfare schemes for Employees;(9) To arrange and manage Employee’s benefits and welfare including to purchasecoverage of insurance policies for Employees;(10) To submit to the proper authority, including facilitating the application for governmental
documents including visa and work permit;(11) To make disclosures of Employee’s information as permitted or required by Applicable
Law, such as disclosures in connection with investigations as required by theGovernment, law enforcement agencies, statutory bodies etc., administration of
immigration and insurance matters, to enforce the Company’s rights and/or fulfil its

3contractual or statutory obligations;(12) To maintain security on data protection; and(13) To report and share Employee’s information with our Japanese head office.
In the case where the Company appoints third party service provider(s) (whether within or
outside Hong Kong)to process your Personal Data, the Company shall adopt contractual orother means to prevent any Personal Data transferred to the third party service provider(s)from being kept longer than is necessary for processing of the data.
The Company will not disclose or permit the disclosure or make available your Personal
Data other than in accordance with the Purposes unless you have given a prior writtenconsent to the Company or the Applicable Law allows the Company to do so withoutobtaining your consent.
If you could not share Personal Data that are necessary for the Company to process
Personal Data based on the ground of contractual obligations, or legal obligations, theCompany will not be able to perform its contractual obligations with such subject matter nor
able to comply with legal obligations.
The Company will process Personal Data in strict compliance with Applicable Law. In casewhere you have given a written consent to any data processing activity, you may withdraw
your consent at any time by giving the Company a notice in writing.
2.4.

Data Sharing and Disclosure(1) The Company will not disclose Employee’s Personal Data without Employee’s consent.
This is unless the disclosure has appropriate legal basis, such as:
(i)
(ii)

Is required based on the applicable laws and/or regulations;
Is necessary to respond to an emergency that threatens the life, health or safetyof the Employee or another individual which cannot be obtained in a timely way,provided that the Company shall, in reasonably timely manner, notify the
Employee of the disclosure and the purposes of the disclosure;(iii) Is necessary for any investigation or proceedings; and(iv) Is necessary to verify Employee’s personal particulars and process payment
requests in relation to the provision of the services which Employee may beentitled to or may have requested for.
(2) In order to conduct our business operations more smoothly, the Company may also be
disclosing the Personal Data which have provided to us to our third party service
providers, agents, and/or our affiliates or related corporations, whether within or outside
Hong Kong, or to relevant government authorities or law enforcement agencies when
there is legal obligation or legitimate interest to do so, for one or more of the abovestated Purposes. This is because such third-party service providers, agents and/or
affiliates or related corporations, or relevant government authorities or law enforcement
agencies would be processing Employee’s Personal Data on our behalf for one or moreof the above-stated Purposes. The Company will rely on the same basis as notified orconsented by you for these transfer and processing activities. In such cases, theCompany will ensure a standard of protection for the Personal Data so transferred thatis comparable to the protection under the Applicable Law and the Company’s standards.
(3) In all other instances of disclosure of Personal data to third parties with appropriate legal
basis, including express consent from Employees, insofar as is reasonably practicable
the Company will endeavor to provide adequate supervision over the handling andadministration of Personal Data by such third parties, as well as to provide for adequate
forms of protection over such Personal Data.

4

3.

RULES AND REGULATIONS ON DATA HANDLINGFor the purpose of complying with the Applicable Law in every aspect of daily operations,
the Employees of the Company must strictly comply with the Internal Rules for Handling of
Personal Data specified in the Annex of this Regulations. The Principles apply to thecollection, use, disclosure, storage, erasure, and transfer of Personal Data relating to theoperations of the Company, unless this Regulations or any laws expressly specified
otherwise.

4.

DATA PROTECTION OFFICER

4.1.

The Human Resources Manager or the appointed in-charge shall be the Company’s Data
Protection Officer (“DPO”). The DPO will be responsible for any issues concerning thecompliance with the Applicable Law, including any day-to-day matters relating to thehandling of Personal Data by the Company, and will report to the Managing Director, or in
his absence an appointed personnel, on matters relating to any non-compliance of thisRegulations or the Applicable Law.

4.2.

In case of any concerns regarding this Regulations or any other issues related to Personal
Data handling, please contact the DPO at the below contact information:
Position: Corporate Finance & Administration Division, Division Manager
Address: Units 801-803, 8/F., Tins Enterprises Centre, 777 Lai Chi Kok Road
Kowloon, Hong Kong SAR, China
Tel:+852-2409-9128
Email: shk-hr@sgh-global.com

5.

RESPONISBILITY OF ALL EMPLOYEES

5.1. All Employees shall be responsible for:(1) Ensuring that any information that have been provided to the Company in connection
with their employment is accurate and up to date;(2) Informing the Company of any changes in the information provided, such as changes ofaddress, either at the time it occurs or within a reasonably practicable time thereafter.
The Company will not be held responsible for any inaccuracies or errors of suchinformation unless the Employee informs the Company of such changes;(3) If and when, as part of their responsibilities, Employee needs to process the Personal
Data in their performance of works, they must strictly comply with this Regulations.
(4) If and when, as part of their responsibilities, Employee needs to process Personal Data
for a specific purpose other than the purposes set out in any privacy notices issued by
the Company, Employee will be required to seek prior written approval from the DPO.
(5) Any Employees who fail to comply with this Regulations may be subject to disciplinary
actions, which may result in termination of employment. In addition, the Company isentitled to claim against such persons any loss or damage to the Company as a resultof such non-compliance.
6.

RETENTION OF PERSONAL DATA

6.1.

The Company retains Personal Data of Employees and in-house personnel for a period oftime after they leave or resign. Apart from legal purposes, there are other purposes suchas to provide references, or for financial reasons including relating to any statutory fundpayment and/or taxation.

5

6.2.

Employee’s Personal Data will be retained for period(s) as are reasonable and necessary tomeet the Company’s legal and/or business purposes, and the Company will cease to retain
Employee’s Personal Data as soon as it is reasonably practicable to assume that the
purpose for collection of such Personal Data is no longer being served by such retention,and such retention is no longer necessary for legal and/or business purposes. Our current
Regulations is to retain certain Employee’s Personal Data for up to seven (7) years after
Employees’ cessation of employment, subject to the applicable anonymization procedures
and at all times in accordance with the Company’s document retention and erasure practice,and the Applicable Law.

7.

CONCLUSION

7.1.

Any deliberate breach of this Regulations may lead to disciplinary action or even criminal
prosecution. Any questions or concerns about the interpretation or operation of thisRegulations should be taken up with the appropriate designated DPO.

7.2.

In case there is a material change in the procedure relating to personal data protection, theCompany shall amend and revise this Regulations whenever necessary and shall discloseit to ensure that the Employees have knowledge of the method that the Company collects,
uses, handles, discloses, and protects the data.

6

ANNEXInternal Rules for Handling of Personal Data
Pursuant to Clause 3 of this Regulations, this Internal Rules for Handling of Personal Data formed
part of the Regulations with the details as follows.
1.

Fairness and Legality: In the processing of Personal Data, the rights of Data Subjects areprotected under the Applicable Law. The Company will only collect personal data for a lawful
purpose and the data collected should be necessary and adequate but not excessive forsuch purpose. The means of collection should also be lawful and fair. The processing of
Personal Data should be carried out only for those activities that have legal basis according
to the Applicable Law which may include the following:(1) Contractual Obligation Basis: The processing of Personal Data )a) for entering into
contracts )the processing of Personal Data before entering into contracts(, for example,
checking employment records, knowledge, the capabilities of job applicants before
employment, etc. and )b) the processing of Personal Data that is reasonably necessary
for the performance of contracts, for example, the use of the bank account numbersof Employees for the payment of salaries under employment contracts, etc.
(2) Legal Obligation Basis: This applies to cases where data processing is necessary forthe performance of duties as required by law, for example, submitting withholding tax to
the Revenue Department, or the registration of employees with the Department of Labor
Protection and Welfare, etc. In this regard, the types of data and the scope of processing
may be carried out only to the extent that is necessary for the processing activities as
specified by law.
(3) Legitimate Interests Basis: This applies to cases where data processing is necessary
for any undertaking regarding the legitimate interests of the Company, for example, therecording of CCTV footage for security purposes, or the use of Personal Data for theinterest of others such as the disclosure of Personal Data to the parent company for theCompany’s internal management, etc. In processing of Personal Data on legitimate
interest basis, the Company must take into consideration the legitimate interests that
the Company will receive in comparison with the rights and interests of Data Subjects,
so that such processing shall not breach or prejudice the basic rights and freedom of
Data Subjects.
Accordingly, the legitimate interests basis may not be carried out in the event that thereis clear and unequivocal evidence that such benefits are less important than the basic
rights regarding the Personal Data of Data Subjects. Therefore, if the Employees are
not certain whether they should use the basis of legitimate interest, they should refer
the matter directly to the DPO prior to any processing of Personal Data.
(4) Vital Interests Basis: This refers to the processing of Personal Data that is reasonably
necessary for protecting the vital interests of Data Subjects, or of another person, forthe protection of the health and life of Data Subjects when the Data Subjects are not in
a condition to give consent. The vital interests basis cannot be carried out if the Data
Subjects are in a condition to give consent, or if there is another way to protect the life,
body, and health of the Data Subjects or another person without being required toprocess the data.
(5) Public Task Basis: This refers to the processing of Personal Data that is necessary forthe performance of duties in carrying out any activity in the public interest, or for the
performance of duties delegated by the government to the Company.

7(6) Historical Documents, Public Archives, Research, or Statistics Basis: This refers
to the processing of Personal Data that is necessary to achieve the purposes of aparticular and necessary matter. In this regard, in applying basis (6), the basis for theprocessing of Personal Data under (1) – (5) above )any one case( must apply before basis(6) can apply.
(7) Consent Basis: The processing of Personal Data that does not fall into any other basisof processing ) the basis of the processing of Personal Data under basis (1) – (6) may
not be applicable(, provided that the request of consent shall not be a condition forproviding services or the performance of contracts, for example, in the case that theCompany wishes to use customer data for marketing activities, or a satisfaction survey,
etc. )these activities are considered to be in the interest of the Company(. In general,the basis for the processing of Personal Data under (1)-(6) may not be applied to theuse of data for marketing activities or a satisfaction survey. If the Data Subject does notgive the Company consent to use his or her Personal Data in marketing activities, theCompany cannot refuse to enter into transactions with the Data Subject or refuse to
carry out activities with the Data Subject.
In addition, the bases for the processing of Personal Data as stated above are the basesthat the Employee will use to processing data under the Applicable Law. If Employees haveany questions concerning the basis of the processing of Personal Data, they are advised todirect any questions to the DPO.
2.

Limitations of Processing: The processing of Personal Data can be carried out only inaccordance with the purposes at the time of the collection of which the Data Subject hasgiven his/her consent, or for such new purposes which the Data Subject has subsequently
been informed.

3.

Notification of Processing(1) Principles for notification of data processing: The Company shall notify Data
Subjects of every basis for the processing of Personal Data and the purposes of thedata collection, use, and disclosure, including the period of data retention, the data
disclosure to third parties, the rights of Data Subjects, and the contact details of theCompany relating to the protection of Personal Data. In this regard, the Company has
issued the Privacy Notice For Client )which is a type of notification which is made to thegeneral public through the Company’s website(.
In case there are any new activities that are not mentioned in the Privacy Notice For
Client, or on which data will be used for other purposes not mentioned in the Privacy
Notice For Client, the Data Subject must on every occasion be notified first of the useof such Personal Data. Accordingly, Employees are advised to inform the DPO in orderto keep the Privacy Notice For Client updated and incorporate new activities as andwhen appropriate.
In addition, notifications shall be given to the Data Subjects through every usual channel
by which the Company habitually contacts the Data Subjects, which may be in the formof printed materials, electronic means, or by verbal notification if necessary.
(2) Notification of new purposes: In the case that the Company is required to process
Personal Data to achieve a new purpose that is different from the purposes that theData Subject have been notified of, the Company shall notify the new purpose to the
Data Subject [within a reasonably practicable time period] through the same channel bywhich it previously notified the Data Subject, and the Company will enclose an updated
Privacy Notice For Client.
If the new purpose relates to a purpose which the Data Subject has already been duly

8

notified of and the Data Subject can reasonably expect such processing, the DPO shallrecord the details of the processing activities as evidence.
(3) Notifying the Data Subject of data obtained from other sources: In the case that
the Company collects data from sources other than directly from the Data Subject, theCompany shall notify the Data Subject before processing such data, unless it falls under
any of the following cases in which it is not necessary for the Company to notify the
Data Subject of the purpose and details:(a) If the notification to the Data Subject is not possible due to certain circumstanceresulting in the Company being unable to notify the Data Subject (e.g., no contact
details of the Data Subject are available); or(b) If the notification to the Data Subject will make the purpose of processing materiallyless effective (e.g., for inspection or judicial proceedings); or(c) If notifying the purpose to the Data Subject will cause excessive obstacles for theCompany (e.g., the purpose involves a large number of Data Subjects andnotification of such will incur excessive costs or will take excessive time).
4.

Rights of Data Subjects: The Company shall ensure that Data Subjects are able to exercise
their rights in relation to their Personal Data as follows:(1) The right to withdraw consent: In exercising the right of Data Subjects, if the Data
Subject wishes to withdraw consent that he or she has provided as specified in thisRegulations, the Company shall withdraw the consent according to the request of theData Subject in all cases, and shall, at the same time, notify the Data Subject of the
impact of such withdrawal of consent.
(2) The right to access Personal Data: The Data Subject has the right to request accessto his or her Personal Data, and he or she also has the right to request the Company todisclose how the Company obtained his or her data. In this regard, the Company shallconsider whether or not the request meets certain criteria, including whether the request
was made within a reasonable time and in a reasonable manner. The Company may
exercise its right to reject the request of the Data Subject with reasons and not permit
the Data Subject to access the data in the following events:
(a)
(b)
(c)
(d)

where it is necessary to comply with the law or court orders;
It is a case that may affect and prejudice the rights and freedom of other persons;
where the request is not made in writing in the Chinese or English language;
where the Company is not supplied with such information as it may reasonably
require in order to satisfy itself as to the identity of the requestor, or to locate thepersonal data to which the request relates; or(e) where the request is not made in a reasonable manner.
(3) The right to rectify Personal Data: The Data Subject has the right to request theCompany to rectify his or her Personal Data so that it will be accurate, up to date,complete, and not misleading.
(4) The right to erase Personal Data: The Data Subject has the right to request theCompany to erase, destroy, or anonymize his or her Personal Data in any of thefollowing cases, but for any other cases not specified herein, the Company shall
exercise the right to reject such a request:(a) When it is not necessary to process Personal Data in accordance with the purpose;(b) When the Data Subject withdraws his or her consent to data processing under thisRegulations;9(c) When the Data Subject exercises his or her right to object to data processing under
this Regulations, and there is no reason for the Company to reject such objection;or(d) When the Personal Data has been processed on the basis of data processing orconsent under this Regulations.
In this regard, if the Company considers erasing any Personal Data as requested by the
Data Subject, for an activity in which the Company has disclosed Personal Data to other
Data Processors, the Company shall notify every Data Processors of the exercise of
the rights of Data Subject and erase the Personal Data retained by such persons forany other activities in connection with the activity in which the Data Subject has
exercised the right to erase.
(5) The right to restrict data processing: The Data Subject has the right to request theCompany to restrict the use of his or her Personal Data in any of the following cases
only, and for any other cases that is not specified, the Company shall exercise the rightto reject the request:(a) When the Company is undergoing the inspection of data because the Data Subject
has asked to exercise the right to rectify his or her Personal Data under thisRegulations;(b) It is the data that is to be erased or destroyed under this Regulations, but the Data
Subject requests the Company to restrict the use of such data instead;(c) When it is not necessary to retain the Personal Data, but the Data Subject requests
the Company to retain the Personal Data for the purpose of creating a right of claim
under the Applicable Law, complying with or exercising the right of claim under the
Applicable Law, or in defense of the right of claim under the Applicable Law;(d) When the Company is undergoing the verification of the collection of Personal Dataaccording to the exception from an objection request from the Data Subject under
this Regulations or is undergoing the inspection on the processing of Personal Datafor the purposes as specified by the Applicable Law.
(6) The right to Personal Data portability: In the case that the Company’s system is able
to accommodate this, the Data Subject has the right to receive his or her Personal Data
in a readable format that is commonly used by way of automatic equipment, or torequest an automatic data transfer. In this regard, the Company may reject the requestof the Data Subject if such Personal Data is retained as is necessary in complying withthe law, or if complying with the request of the Data Subject may affect the rights andfreedom of other persons.
(7) The right to reject the processing of Personal Data: The Data Subject has the rightto reject the processing of Personal Data that is related to him or her in any of thefollowing cases, and for any other cases not specified herein, the Company shall
exercise the right to reject the request:(a) It is data that the Company has collected in accordance with its necessity inperforming in the public interests of the Company, or in performing the duties of
the Company under an order of the government, or due to its necessity for the
purpose of the legitimate interests of the Company, or other juristic persons.
The Company may reject the request in )a) if it considers that the rejection of theprocessing of Personal Data will not be in compliance with the Applicable Law, or it
relates to creating a right of claim under the law, complying or exercising the right ofclaim under the law, or defending against the right of claim under the law;10

(b) In the case that the Company processes Personal Data for the purpose of direct
marketing;(c) In the case that the Company processes Personal Data for the purposes ofresearch as specified by the Applicable Law, including in the field of statistics.
In exercising these rights, the Data Subject shall direct his or her request to the
Administrative Department and the Human Resources Management Department for
further referral to the DPO. In this regard, the Company must consider the request forexercising this right within 30 days from the date of receipt of complete information,
unless otherwise extended as specified by law.
5.

Collection of Data: The Company may collect only the Personal Data from Data Subjects
in accordance with the purposes notified to the Data Subjects.

6.

Processing Data as Necessary: Before the processing of Personal Data, considerationmust be given to the necessity and the scope of the processing of Personal Data, in
accordance with the purposes of the data collection. For example, if a document received
contains Personal Data but it is not necessary for the Company to use such data, such asdata of religion or blood groups on an identification card, such Personal Data must be
blacked out or redacted or censored with markers provided by the Company. Alternatively,
the Company may use a digital redaction or choose not to retain such information.
In this regard, for any activity in which it is not necessary to identify Data Subjects or
statistical data can be used instead, the latter method shall be used. In addition, there should
not be any collection of Personal Data in advance for any purpose which is not clearly
defined in the future.

7.

Use and Retention of Data: The Company shall use Personal Data for the purposes as
notified to Data Subjects, or only with the consent of Data Subjects. The Company shall not
retain Personal Data for any period longer than necessary. Accordingly, the Company will
issue a Regulations for the erasure and destruction of documents or of data retained inelectronic format, in order to set out the principles in consideration of the retention period of
Personal Data, to which the Employee must strictly adhere. In this regard, any document not
specified in this Regulations that are related to the erasure and destruction of documents,
or of data retained in electronic format, the retention period of similar documents shall apply,or the matter shall be referred to the DPO.

8.

Erasure or Destruction of Data: The Company shall not retain any data for a period longer
than is reasonably necessary in accordance with the purposes the Data Subjects are notified
of in the collection of Personal Data. The Company shall erase or destroy such data when
the purpose of processing such data no longer exists, or when the Data Subject requests
the Company to erase or destroy it, unless otherwise specified by law. In addition, theCompany shall ensure that Data Processors erase or destroy the Personal Data that isprocessed for the Company after the contracts or agreements that have been entered intoare expired or terminated.

9.

Access of Data: The Employees are prohibited from accessing, using, amending, ordisclosing the Personal Data collected by the Company, except where it is reasonably
necessary for the performance of the duties of such personnel.

10.

Disclosure to Third Parties: Personal Data may be disclosed to third parties only for the
purposes that the Data Subjects have been notified of when the data are being processed,
or if the consent of the Data Subject has been obtained )in the case that is necessary(. The
method of the disclosure of Personal Data must be reasonably safe, for example, if data isdisclosed by electronic methods, then a password is required to open the document in orderto protect the Data Subject. Furthermore, the data may be disclosed only after obtaining a11

confirmation from such third party by which the third party shall protect the Personal Data of
Data Subjects in accordance with the contracts or agreements, laws, or other provisions.
11.

Processing of Personal Data by Data Processor: In using the service of a Data Processor,
the Company shall select a Data Processor with reasonable care including considering theappropriateness of the internal protective measures that the Data Processor has
implemented to protect the data, and the reliability of such Data Processor. In addition, whena Data Processor is selected, the Company and the Data Processor shall enter into a
Personal Data processing agreement in the form and content specified by the Company.

12.

Confidentiality: Personal Data must be treated as confidential in accordance with theRegulations of the Company on information safety and security, whether they are printed
materials or in an electronic format.

13.

Data Security: The Company shall protect and retain Personal Data in accordance with theappropriate organizational and technical measures as prescribed by Applicable Law, in orderto prevent unauthorized or accidental data access, data leakage, improper use, unlawful
data processing and distribution, data loss and erasure, and unintentional data amendment
or destruction. For example, for electronic data, encryption of data, or for printed materials,
the item must be retained in a securely locked location and the person keeping the key must
be clearly delegated.

14.

Data Quality: The Company shall take reasonably practicable steps to ensure that the
Personal Data in its possession is accurate and related to the purposes specified at the timeof collection.

15.

Inspection and Compliance: The Company shall inspect whether or not this Regulations
has been complied with either by the Employees in the organization or by third parties inaccordance with the procedure specified by the Company.

16.

Data Anonymization or Pseudonymization: Before the processing of Personal Data, thenecessity and scope of the processing of Personal Data in accordance with the purposes ofsuch data collection must be taken into consideration. If the purpose can be achieved by theprocessing of data that does not require the identification of Data Subjects, or by using
statistical data and the associated costs incurred are reasonable, the Personal Data should
be anonymized or statistical data should be used.

17.

Complaint of Processing of Personal Data: In the case that a Data Subject wishes tolodge a complaint on the processing of Personal Data of the Company, the Data Subject isadvised to use the complaint form specified by the Company. The Company must consider
the complaint within 30 days from the date of receipt of the complaint form with complete
information.

18.

Record of Processing Activities: The Personal Data recorded must be accurate and inline with the purposes for the collection of Personal Data by using the record of processing
activities form as specified by the Company.

19.

Activities Requiring Data Protection Impact Assessment: Care must be taken in thecase of an ongoing activity, or an activity yet to be organized, that may involve a high risk of
impact on the rights and freedom of Data Subjects. For example, such activity may result in
discrimination, cause financial loss, reputation loss, disclosure of Personal Data, which must
be protected according to professional confidential measures, unauthorized decoding ofpseudonymized data, etc. The data protection impact assessment must be first carried out
prior to the processing of such activities. In this regard, the preliminary principle to consider
regarding whether any activity may involve a high risk can concern large-scale Personal
Data that has been processed by an automatic system )including profiling( or collection of12Personal Data from sources other than directly from the Data Subjects without any privacy
notice.

13