Company: ARBB
Filing Date: 2025-10-31
Form Type: 20-F
Source: 0001213900-25-104705
Chunk: 59

Company: ARB IOT Group Ltd
Filing Date: 2025-10-31
Form: 20-F
Item: Item 4
Chunk 59
---
 of business. We will only process, disclose, transfer or retain personal data to the extent legitimately required
to conduct our activities on an ongoing basis or to comply with legal and regulatory obligations to which we are subject. We will only
transfer personal data in accordance with the requirements of the DPA, and will apply appropriate technical and organizational information
security measures designed to protect against unauthorized or unlawful processing of the personal data and against the accidental loss,
destruction or damage to the personal data.

In our use of this personal
data, we will be characterized as a “data controller” for the purposes of the DPA, while our affiliates and service providers
who may receive this personal data from us in the conduct of our activities may either act as our “data processors” for the
purposes of the DPA or may process personal information for their own lawful purposes in connection with services provided to us.

We may also obtain personal
data from other public sources. Personal data includes, without limitation, the following information relating to a shareholder and/or
any individuals connected with a shareholder as an investor: name, residential address, email address, contact details, corporate contact
information, signature, nationality, place of birth, date of birth, tax identification, credit history, correspondence records, passport
number, bank account details, source of funds details and details relating to the shareholder’s investment activity.

Who this Affects

If you are a natural
person, this will affect you directly. If you are a corporate investor (including, for these purposes, legal arrangements such as trusts
or exempted limited partnerships) that provides us with personal data on individuals connected to you for any reason in relation to your
investment in us, this will be relevant for those individuals and you should transit the content of this Privacy Notice to such individuals
or otherwise advise them of its content.

How We May Use a Shareholder’s Personal Data

We may, as the data controller,
collect, store and use personal data for lawful purposes, including, in particular: (i) where this is necessary for the performance of
our rights and obligations under any agreements; (ii) where this is necessary for compliance with a legal and regulatory obligation to
which we are or may be subject (such as compliance with anti-money laundering and FATCA/CRS requirements); and/or (iii) where this is
necessary for the purposes of our legitimate interests and such interests are not overridden by your interests, fundamental rights or
freedoms.

Should we wish to use