NEFFUL INTERNATIONAL HOLDINGS PTE LTD PRIVACY NOTICE

1. INTRODUCTION

1.1 This Privacy Notice describes how Nefful International Holdings Pte Ltd (referred to herein as “Nefful”, “us”, “we” or “our”) collects, processes, uses and discloses your personal data, which will assist you in making an informed decision before you provide us with any of your personal data.

1.2 We may update this Privacy Notice from time to time without any prior notice. When we make any material changes to our Privacy Notice, we will notify you on our website, or by other reasonable means. You may determine if any such revision has taken place by referring to the date on which this Privacy Notice was last updated. Your continued use of our services constitutes your acknowledgement and acceptance of such changes.

2. WHAT PERSONAL DATA WILL WE COLLECT?

2.1 In this Privacy Notice, “personal data” refers to any data, whether true or not, about an individual who can be identified: (a) from that data, or (b) from that data and other information to which Nefful has or is likely to have access.

2.2 Depending on the nature of your interaction with us, the personal data which we may collect, process, use and disclose includes but is not limited to:

(a) Personal details (such as your name, NRIC number or passport number, gender, nationality, date of birth and marital status);

(b) Contact information (such as your address, billing address, delivery address, email address, and telephone number);

(c) Financial information (such as your credit card numbers, debit card numbers, and bank account information);

(d) Profile information (such as your username, password, distributor number, and order history).

2.3 By providing us with your personal data, you consent to our collection, process, use and disclosure of your personal data for the purposes that have been notified to you, and in accordance with the terms of this Privacy Notice.

2.4 In addition, in order to comply with legal and regulatory obligations, to protect Nefful’s assets and employees / external contractors and specifically to ensure that Nefful can comply with trade control, anti-money laundering and/or bribery and corruption laws and other regulatory requirements, we carry out screening on our

distributors on a periodic basis. This screening takes place against publicly available or government issued sanctions lists and media sources.

2.5 This data may include personal data regarding suspected and actual criminal behaviour, criminal records or proceedings regarding criminal or unlawful behaviour but only for the purposes of ensuring Nefful’s compliance with legal and regulatory obligations and/or to the extent permitted or required by local law.

2.6 The screening does not result in any automated decision making in relation to the counter-parties or potential counter-parties.

2.7 As we rely on the personal data provided by you, please ensure that your personal data is current, complete, and accurate. If there are any changes to your personal data, please inform us by contacting our Data Protection Officer at customer@nefful.com.sg.

3. WHY DO WE COLLECT, USE AND DISCLOSE YOUR PERSONAL DATA?

3.1 We will not collect, process, use or disclose your personal data unless:

(a) You have been notified of the purposes for which your personal data is collected, and you consent to the collection, processing, use and disclosure of your personal data for those purposes; or

(b) The collection, processing, use and disclosure of such personal data are permitted or required under the data privacy laws of Taiwan, Hong Kong, Malaysia, and Singapore (the “Data Privacy Laws”).

3.2 Depending on the nature of your interaction with us, we may collect, process, use and disclose your personal data for any or all of the following purposes:

(a) Verifying your identity;

(b) Processing your application and/or transaction with us;

(c) Processing payment or credit transactions;

(d) Performing obligations in the course of or in connection with our provision of the goods and/or services requested by you;

(e) Managing your relationship with us (including responding to, handling, and processing your queries, requests, complaints, and feedback, which could involve the disclosure of personal data to bring about delivery of the same);

(f) Conducting investigations relating to fraud, unlawful activity, omission or misconduct, whether relating to your use of our services or any other matter arising from your relationship with us;

(g) Sending you marketing information about our goods and services, including notifying you of our marketing events, initiatives and promotions, lucky draws, membership and rewards schemes, and other promotions;

(h) Requesting feedback or participation in surveys, as well as conducting market research and/or analysis for statistical, profiling or other purposes for us to review, develop and improve the quality of our products and services;

(i) Complying with any applicable laws, regulations, rules, codes of practice, or guidelines issued by any governmental and/or regulatory bodies (including but not limited to assisting in law enforcement and investigations conducted by any governmental and/or regulatory authorities);

(j) Transmitting to any unaffiliated third parties including our third party service providers (e.g. payment service providers) and agents, and relevant governmental and/or regulatory authorities, for the aforementioned purposes;

(k) Any other incidental business purposes related to or in connection with the aforementioned purposes including disclosure of your personal data to other distributors of Nefful International.

3.3 In particular, if you intend to join us as a distributor in Singapore, please note that we are required under Section 65B(3) of the Singapore Income Tax Act to electronically submit the information on the commission paid to you to the Inland Revenue Authority of Singapore (“IRAS”). In order to make such a submission, the IRAS has confirmed that we will need to obtain the NRIC numbers and/or the relevant identification numbers of our distributors.

3.4 If you intend to join us as a distributor in Malaysia, please note that we are required under Section 83A(1) of the Malaysian Income Tax Act 1967 to keep and retain information on the commission paid to you and shall make it readily accessible to the Inland Revenue Board of Malaysia (“IRBM”). In order to do so, the IRBM has confirmed that we will need to obtain the NRIC numbers and/or the relevant identification numbers of our distributors.

3.5 If you intend to join us as a distributor in Hong Kong, please note that we are required to provide your HKID number and/or other relevant identification number to the Hong Kong Inland Revenue Department when we file our tax returns. In order to do so, we will need to obtain the HKID numbers and/or the relevant identification numbers of our distributors.

3.6 Data collected for the purposes stated above is necessary for us to provide our goods and/or services to you. It is therefore obligatory for you to provide us with the requested data, failing which we may not be in a position to provide our goods and/or services to you.

3.7 We shall seek your consent before we collect any additional personal data and before we use your personal data for a purpose which has not been notified to you (except where permitted or authorised by law).

4. WILL WE TRANSFER YOUR PERSONAL DATA OVERSEAS?

4.1 Where your personal data has been transferred to companies within the Nefful Group and/or to authorised third parties located outside of your country, we take organisational, contractual and legal measures to ensure that your personal data is exclusively processed for the purposes mentioned above, and that adequate levels of protection have been implemented in order to safeguard your personal data.

4.2 By providing us with your personal data, you consent to our transfer of your personal data to our related business entities in Taiwan, Hong Kong, the United States of America, Malaysia, and Singapore, and for their collection, processing, use and disclosure of such personal data in accordance with the terms of this Privacy Notice. These entities include Nefful International Holdings Pte Ltd Taiwan Branch, Nefful Hong Kong Ltd, Nefful U.S.A. Inc, Nefful (Malaysia) Sdn Bhd, and Nefful Singapore Holdings Pte Ltd.

5. CAN YOU WITHDRAW YOUR CONSENT OR ASK US TO DELETE THE PERSONAL DATA COLLECTED?

5.1 You may withdraw your consent for us to collect, process, use and disclose your personal data in our possession or under our control or ask us to delete the same by contacting our Data Protection Officer at customer@nefful.com.sg.

5.2 Upon receiving your written request to withdraw your consent or delete your personal data, we may require reasonable time (depending on the complexity of your request and its impact on the nature of our relationship with you) for your request to be processed and for us to notify you of the consequences of us acceding to the same, including any legal consequences which may affect your rights and liabilities to us. Such legal consequences shall include, but not be limited to, those stated in our Consultant Booklet. In general, we shall seek to process your request within thirty (30) business days of receiving it.

5.3 Whilst we respect your decision to withdraw your consent or your request of asking us to delete your personal data, please note that depending on the nature and scope of your request, we may not be in a position to continue providing our goods or services to you. In such circumstances, we shall notify you of the likely consequences of you withdrawing your consent or deletion of your personal data before we complete processing your request.

5.4 Please note that you withdrawing your consent does not affect our right to continue to collect, process, use and disclose your personal data where such collection, processing, use and disclosure without consent is permitted or required under the Data Privacy Laws.

6. CAN YOU ACCESS YOUR PERSONAL DATA?

6.1 You may request for us to provide you with the personal data which we hold about you or information about the ways in which we collect, process, use or disclose your personal data by contacting our Data Protection Officer at customer@nefful.com.sg.

6.2 We may charge you a reasonable fee for the handling and processing of your request. If so, we will inform you of the fee before processing your request.

6.3 We will respond to your request as soon as reasonably possible. Should we not be able to respond to your request within fifteen (15) days after receiving your request, we will let you know the reason for the extension and inform you in writing within fifteen (15) days of the time by which we will be able to respond to your request. If we are unable to provide you with any personal data, we shall generally inform you of the reasons why we are unable to do so (except where we are not required to do so under the Data Privacy Laws).

7. CAN YOU REQUEST THAT WE CORRECT OR SUPPLEMENT YOUR PERSONAL DATA?

7.1 You may request for us to correct any error or omission in or make supplements for the personal data which we hold about you by contacting our Data Protection Officer at customer@nefful.com.sg.

7.2 We will respond to your request as soon as reasonably possible. Should we not be able to respond to your request within thirty (30) days after receiving your request, we will let you know the reason for the extension and inform you in writing within thirty (30) days of the time by which we will be able to respond to your request. If we are unable to make the correction or supplement requested by you, we shall generally inform you of the reasons why we are unable to do so (except where we are not required to do so under the Data Privacy Laws).

8. HOW DO WE PROTECT YOUR PERSONAL DATA?

8.1 To safeguard your personal data from unauthorised access, collection, use, disclosure, processing, copying, modification, disposal, loss, misuse, modification, or similar risks, we have introduced appropriate administrative, physical, and technical measures such as:

(a) Up-to-date antivirus protection;

(b) Using encryption technology when processing your financial details;

(c) Using a secure website with SSL Certification; and

(d) Disclosing personal data both internally and to our authorised third party service providers and agents only on a need-to-know basis.

8.2 Whilst we strive to protect your personal data, and are constantly reviewing and enhancing our information security measures, please note that no method of transmission over the Internet or method of electronic storage is completely secure. As such, we urge you to take every precaution to protect your personal data when you are on the Internet, when you browse our websites, or use our applications and/or digital services. We recommend that you change your passwords often, use a combination of letters, numbers, and special characters, and ensure that you use a secure browser.

8.3 If you believe that your personal data has been compromised in any way, please change your password immediately, and contact our Data Protection Officer at customer@nefful.com.sg.

9. FOR HOW LONG WILL WE RETAIN YOUR PERSONAL DATA?

9.1 We will retain your personal data for as long as it is necessary to fulfil the purposes for which your personal data was collected, and such retention is necessary for legal or business purposes.

9.2 We will cease to retain your personal data, or remove the means by which your personal data can be associated with you, as soon as it is reasonable to assume that such retention no longer serves the purposes for which the personal data was collected, and is no longer necessary for legal or business purposes.

10. UNITED STATES OF AMERICA

10.1 If you are a US resident, please note that this Privacy Notice, together with the privacy policies and/or privacy clauses set out at the following links will apply to you and your personal data:

(a) http://www.neffulshop.com/privacy-policy;

(b) http://www.neffulshop.com/terms-conditions;

(c) https://www.neffulusa.com/legal-privacy; and

(d) https://www.neffulusa.com/legal-terms-of-use.

10.2 For more information, please refer to the documents here https://www.neffulusa.com/privacy-policy

11. MISCELLANOUS

11.1 If you have any enquiries or feedback on our personal data protection policies and procedures, you may contact our Data Protection Officer at customer@nefful.com.sg.

11.2 This Privacy Notice applies in conjunction with any other notices, contractual clauses and consent clauses that apply in relation to the collection, use and disclosure of your personal data by us.

Last Updated: 01 July 2020