Company: KNRX
Filing Date: 2025-09-22
Form Type: F-1/A
Source: 0001493152-25-014499
Chunk: 116

Company: KNOREX LTD.
Filing Date: 2025-09-22
Form: F-1/A
Chunk 116
---
 possession or under the control of the organization.                          |

| (v) | Accuracy                                                                                         
 Obligation. An organization must make a reasonable effort to ensure that personal data collected 
 by or on behalf of the organization is accurate and complete if the personal data is likely      
 to be used by the organization to make a decision that affects the individual concerned or       
 disclosed by the organization to another organization.                                           |

| 60 |

| (vi) | Protection                                                                                    
 Obligation. An organization must protect personal data in its possession or under its control 
 by making reasonable security arrangements to prevent unauthorized access, collection, use,   
 disclosure, copying, modification, disposal or similar risks.                                 |

| (vii) | Retention                                                                                         
 Limitation Obligation. An organization must cease to retain documents containing personal         
 data or remove the means by which the personal data can be associated with particular individuals 
 as soon as it is reasonable to assume that (i) the purpose for which the personal data was        
 collected is no longer being served by retention of the personal data, and (ii) retention         
 is no longer necessary for legal or business purposes.                                            |

| (viii) | Transfer                                                                                         
 Limitation Obligation. An organization must not transfer personal data to a country or territory 
 outside Singapore except in accordance with the requirements prescribed under the Personal       
 Data Protection Act 2012.                                                                        |

| (ix) | Openness                                                                                                                                                                        
 Obligation. An organization must implement the necessary policies and procedures to meet its obligations under the Personal Data Protection Act 2012 and shall make information 
 about its policies and procedures publicly available.                                                                                                                           |

The PDPA generally requires organizations to provide notification and obtain consents prior to the collection, use, or disclosure of personal data (being data, whether true or not, about an individual who can be identified from that data or other accessible information), and to provide individuals with the right to access and correct their own personal data. Organizations have mandatory obligations to assess data breaches they suffer, and to notify the Personal Data Protection Commission and where applicable, the relevant individuals where the data breach is (or is likely to be) of a significant scale or resulting in (or is likely to result in) significant harm to individuals. Other obligations include accountability, protection, retention, and requirements around the overseas transfers of personal data.

In addition, Do-Not-Call (“DNC”) requirements require organizations to check “Do-Not-Call” registries prior to sending marketing messages addressed to Singapore telephone numbers, through voice