We take our responsibilities under data privacy laws seriously and are committed to process
and protect all the personal data or personal information that are entrusted to us in
consistent with this Policy, and the applicable data protection laws and regulations.

This Privacy Policy (“Policy”) is designed to assist you in understanding how we collect, use,
disclose, store, safeguard, and/or process the personal data you have provided to us. It
applies to all individuals whose personal data may be handled, whether as controller or
processor, by BDx Group and its respective subsidiaries, affiliates and associated
companies (collectively, “BDx” , “we” , “us” ,“our”). It also sets out your rights in relation to
your personal data and who you can contact for more information or queries.

Please read this Policy carefully to understand our practices regarding your personal data
and how we handle it. By visiting or using our Website, data centres, customer portal and/or
services, you agree to be bound by the following terms of this Policy.

We may modify the terms of this Policy at any time at our sole discretion, and such
modifications shall be effective immediately upon posting of the modified Policy terms on
our webpage https://edgenxt.com/ (“Website”), and your continued access to or use of the
Website shall be deemed your conclusive acknowledgment and acceptance of the changes
we make to this Policy.

This Policy applies to the personal data in our possession or under our control, including
personal data which is collected, used, disclosed, safeguard, and/or processed by us in the
operation of our business.

In this Policy, “personal data” means personal data, information or a combination of other
pieces of information that reasonably enables us to identify you and that is related to an
identified or identifiable natural person.

Subject to the applicable data privacy laws, we will obtain your consent before collecting,
using and disclosing your personal data and will notify you of such purposes. In doing so, we
shall make a reasonable effort to ensure your personal data collected is accurate and
complete.

We may collect personal data from you and about you from a variety of sources. The categories of personal data we may collect will depend on the nature of our relationship, with you, and the purpose for which your personal data is collected.

The types of personal data which we may collect include the following:

• your full name, designation, date of birth and other details documented on your legal
  identity card, travel document, student card and/or driver’s license;
• contact details including name, address, phone number, mobile telephone number
  and/or email address;
• your image or likeness as recorded by the CCTV cameras installed in our premises for
  security purposes;
• if you apply for employment with the Company, your employment-related information
  (e.g. curriculum vitae, job history, references);
•  account details or data relating to Services registered with us including the relevant PIN,
  username or password, account numbers and/or service numbers;
• device specific information such as hardware model, operating system, version, unique
  device identifier, serial numbers, setting configurations and software and mobile
  network configuration;
• your internet protocol (IP) address, login data, cookie data, browser type and version,
  time zone setting and location, browser plug-in types and versions, operating system
  and platform, international mobile equipment identity, how you use and view any
  content on the Website and other information and technology on the devices you use to
  access the Website; and/or
• information that allows us to identify you for verification purpose including biometric
  information like your fingerprints and voice pattern.

We may also collect data that is not identifiable to you or otherwise associated with you
such as aggregated data, which is not personal data. To the extent this data is associated
with your personal data, we will then treat it as personal data, otherwise, it is not subject to
this Policy.

We collect personal data directly from you that you knowingly and voluntarily provide in connection with certain activities or transactions with us, for example:

• when you visit our premises (e.g. offices, the Internet Data Centre or data centres under
  construction);
• when you access or use our Website and/or social media (or the website and/or social
  media of any of our affiliates);
• when you enter into a contract with us for the provision of any of our goods and/or
  services;
• when we are providing service and support in connection with our products and/or
  services;
• when you contact us to ask questions, provide feedback, submit an access or
  correction request, or make a complaint; and/or
• when you report a problem with our Website or our services.

In some circumstance, we may also receive information about you from other sources or
third parties, such as your employers, our customers, our suppliers, affiliates, associated
companies, professional advisors or agencies conducting background checks on our
behalf. The types of information from third parties may include, as applicable, name,
employer, criminal data and identity information. We will verify the legitimacy of the sources
and ensure that the processing is within the scope of consent you have given to the third
party before any action taken by us.

We will use your personal data for activities that form part of our business operation. As part of this, we may also share, transfer or use your personal data with our subsidiaries, affiliates and associated companies.

Depending on your relationship with us, the way we use personal data also varies. For example, we may use your personal data for one or more of the following purposes, or in connection with:

• carrying out our obligations or to facilitate your use of the services or access to the Website;
• supporting our relationship with you and the business with which you are associated, including to process and respond to your queries, feedback, claims or disputes, whether directly or through any outsourced customer service vendors;
• supporting our internal activities, such as marketing, updating you on any of our products and services as well as our latest developments;
• enhancing or analysing the use of our Website or to improve the services we provided to you and/or products sold;
• carrying market research on our users’ demographics, advertising or purchasing preferences, and other behaviour;
• carrying out, from time to time, satisfaction surveys about us and the services we provide to you;
• complying with a court order or other legal process or other statutory and/or regulatory requirements of any governmental and/or regulatory authorities;
• administrative, risk analysis and fraud/ crime prevention, including verifying the identity of a person, due diligence checks such as AML, KYC and anti-bribery or corruption sanction screenings or records of investments; and
• establishing the identity of every visitor to our premises in order to safeguard and secure premises, assets and infrastructure;
• assessing the suitability and eligibility of a prospective job candidate who has applied for employment with us;
• protecting our rights and those of our affiliates or related companies including where we believe necessary to prevent or take action regarding suspected activities, fraud or potential threats to the safety of any person; and/or

any other purpose permitted by the applicable data privacy laws, or as may be described to you from time to time at the point of collection of your personal data for example marketing and promotional purposes.

We will not sell nor disclose your personal data to any unrelated third party except to the following and is in connection with one or more of the purposes stated in section “How We Use Your Persona Data” above.

• our affiliates we work closely with for business or reporting purposes;
• financial counterparties to provide our service in accordance with our contract with you and in our legitimate interests for business purposes;
• our professional advisors for example consultants or lawyers;
• third parties including service providers or vendors that provide services to us and/or our affiliates for example, data security and management, networks troubleshooting or data hosting;
• relevant authorities in order to comply with legal obligations or to protect our rights as required by applicable law, our property or safety of our employees or the public; and/or

any other third parties that reasonably require to access your personal data for the purposes stated in section “How We Use Your Persona Data” above.

We are required by law to set out the legal bases on which we rely to process your personal data. In this regard, we process your personal data for the purposes outlined above based on one or more of the following legal bases:  

(a) Performance of Contract

We may use your personal data to enter into, or perform under, the contract between us and you or the business transaction with which you are associated.

(b) Your Consent

We have obtained your consent as required by law, for example, opt-in to direct marketing communications about services and products we offer. You can withdraw your consent any time by contacting our marketing team or through the Section “Contact Us” at the end of this Policy.

(c) Compliance With Legal and Regulatory Obligations

We are required to keep a record for audit or tax purposes or to law enforcement agency to ensure we meet our customers due diligence obligations or to protect our rights.

(d) Legitimate Interest

We may use your personal data for our legitimate interest such as (i) improving our services; (ii) to safeguard the security of our IT systems, networks and premises; (iii) preventing and detecting fraud or criminal activity; and (iv) administrative and legal compliance purposes.

In order to provide our services, we may need to transfer your persona data to locations outside the jurisdiction in which you provide it or where you are viewing this Website for the purposes set out in this Policy.

Where this is the case, we will implement appropriate measures to safeguard and ensure that your personal data remains protected and secure in accordance with this Policy and the applicable data protection laws of that jurisdiction where your personal data is shared and/or transferred.

We will also ensure that the recipient organisation is able to provide the transferred personal data with a standard of protection comparable to that under the applicable data privacy laws, and to include it as contractual commitments.

How We Protect Your Personal Data

We take reasonable organisational, physical, technical and administrative safeguards to protect your personal data from unauthorised access, improper use or disclosure, unauthorised modification, unlawful destruction or accidental loss. However, no method of information security is completely secure. While we use security measures to protect your personal data, we, unfortunately, cannot guarantee that our safeguards will be effective or sufficient. Furthermore, you should be aware that Internet data transmission is not always secure, and we cannot guarantee the security of any information you transmit to us is or will be secured.

Authorizations are granted only on a “need to know” basis that is commensurate an individual’s company role, responsibilities and their training.

Data Retention

We will retain your personal data for as long as the purpose outlined above is needed or  continues, or for any additional period that maybe required or permitted by law such as (i) for our legal, accounting or business requirements; (ii) for any litigation or investigations arise in connection with our activities or to defend any legal claims; or (iii) to deal with any complaints.

If we do not have legal basis to retain your personal data, we will purge or destroy or delete it as required by and in accordance with applicable law.

Your Rights Regarding Your Personal Data

Depending on the data protection laws of the jurisdiction applicable to you, you may be entitled to:

• request a copy of the personal data we hold about you and information on how we process it and for what purposes. For additional copies requested by you (or frivolous request), we may charge a reasonable fee based on administrative costs;
• know with whom and what we have shared your personal data and for what purpose;
• access, modify, or correct personal data about you if you think is incorrect, outdated or incomplete. You may wish to note that it is important for you to provide us accurate and complete personal data;
• receive your personal data in a machine-readable format and transmit it to a third party (right to data portability);
• request your personal data to be removed from our system (right to erasure) or restrict the way we use it ;
• withdraw your consent to our processing of your personal data, if you have provided your consent to us;
• object to decisions based on profiling or automated decision making that cause significant effects on you or processing your personal data;
• complain to a data protection authority or to us, if you believe that we have processed your personal data in violation of this Policy or applicable law.

You may exercise these rights by contacting us as stated in the Section “Contact Us” at the end of this Policy.

Cookies and Web Tracking Tools

Cookies are text files temporarily placed on your computer with your permission, to gather anonymous and non-personally identifiable information about your behaviour on our Website. We do not employ the use of cookies or web tracking tools that collect personal data from this Website.

However, to facilitate your use of our Website and services, we may employ the use of session cookies. Session cookies, which expire at the end of a browser session, are only used to collect and store technical data. Most browsers are automatically set to accept cookies, but you may be able to manage your cookie settings through your internet browser settings or mobile device settings.

Other Important Information About Personal Data

Third-Party Websites and Services

The Website may contain links to other websites operated by other parties, such as our business affiliates, advertisers or other third parties. When you access these third-party websites, you leave our Website. This Policy does not apply to any third-party websites, and we are not responsible for the data protection practices of websites operated by these other parties. You are advised to check on the applicable data protection policies of those websites to determine how they will handle any information they collect from you.

Third Party Personal Data Obtained from You

If you provide personal data of any third party to us, you represent and warrant that you have obtained the necessary consent, license and permissions from that third party to share and transfer his/her personal data to us, and for us to collect, store, use and disclose that data in accordance with this Policy.

Children’s Data

Our services and Websites are not directed to children and if you believe that we are processing a child’s information inappropriately, please contact us through the Section “Contact Us”.

Withdrawal of Consent

If you have provided us your consent, you may withdraw your consent to our processing of your personal data at any time, by contacting through the Section “Contact Us” .

Please note that if you withdraw your consent to our use, disclosure, storing or processing of your personal data for the purposes as stated above, we may not be able to continue to provide the services to you or perform on any contract we have with you, and we will not be liable in the event that we do not continue to provide the services to, or perform our contract with you.

Upon receipt of your written request to withdraw your consent, we may require reasonable time (depending on the complexity of the request and its impact on our relationship with you) for your request to be processed and for us to notify you of the consequences of us acceding to the same, including any legal consequences which may affect your rights and liabilities to us. In general, we shall seek to process and effect your request within ten (10) days of receiving it.

If you have any questions on this Policy or if you have any other queries in relation to how we may manage, protect and/or process your personal data, you may contact us at any time using the following contact information:

BDx Data Center
150 Beach Road, #20-05/07
Gateway West, Singapore
189720

Attn: Data Protection Officer

Email: DPO@bdxworld.com  

If you reside in one of the jurisdictions listed below, please review the additional details relevant to your jurisdiction which are in addition to the information provided in our Privacy Statement above.

This additional section applies if you are a resident of Hong Kong (SAR). In this Privacy Policy, the meaning of the term “personal data” is defined in the Hong Kong SAR Personal Data (Privacy) Ordinance Cap. 486 (the “Ordinance”).

Personal data may be disclosed under any of the circumstances described in Part VIII of the Ordinance in which the concerned personal data are exempt from the provisions of Data Protection Principle 3 of the Ordinance.

At time your personal data may be transferred between our BDx Group in order to carry out the purposes, or directly related purposes, for which the personal data were collected. Where such a transfer is performed, it will be done in compliance with the prevailing requirements of the Ordinance.

Access And Correction Of Personal Data

Under the Personal Data (Privacy) Ordinance, you have the right to:

• ascertain our company’s policies and practices in relation to personal data, which are those policies and practices set out herein.

You may also exercise your right of access by:

• completing the Data Access Request Form as prescribed by the Privacy Commissioner for Personal Data or the “Personal Data (Privacy) Ordinance – Data Access Request Form”;
• sending the completed form, along with appropriate proof of identity (a copy of the applicant’s Hong Kong Identity Card or Passport);
• alternatively, if you do not wish to provide a copy of your proof of identity, you may present the completed form in person, along with appropriate identification, at our Hong Kong office at the following address:

BDX Data Centre (HK) Limited

1/F., Watson Centre
16-22 Kung Yip Street
Kwai Chung, Hong Kong

We will, upon satisfying the authenticity and validity of the access request, or validity of the correction request, make every endeavour to comply with and respond to the request within the period set by the Ordinance (i.e. within 40 days after receiving the request).

If you have any questions including your rights on this Policy or if you have any other queries in relation to how we may manage, protect and/or process your personal data, you may contact our data protection officer any time at DPO@bdxworld.com.

This additional section applies if you are a resident of India.

Personal Data means any information, either directly or in combination with other information, that enables us to identify you and which is related to an identified or identifiable natural person (also known as a ‘data subject’), such as a name, address, an identification number, location data, an online identifier to one or more factors specific to the identity of that natural person.

The personal data we collect about you may include some or all of the following:

• Name, age and gender
• Designation or Job Title
• Company or organization
• Contact information, including e-mail address and telephone number(s)
• Demographic information such as postcode, preferences, and interests
• Other information relevant to customer surveys or similar research
• Information pertinent to fulfilling our services to you; and
• Any other personal data that you voluntarily choose to provide to us.

The information we collect about you may include the following types of sensitive personal data or special categories of personal data:

If we ask you to provide any other personal data not described above, the personal data that you are asked to provide, and the reasons why you are asked to provide it, will be made clear to you at the point that you are asked to provide your personal data.

Note that where consent is required from you to process your personal data and if you do not consent to the processing or if you withdraw your consent, we may not be able to provide you the expected services.

If the processing of your personal data is not based on consent, our processing will be based on legitimate bases as allowed and in compliance with the applicable laws.

To the extent provided by applicable laws and regulations, you may withdraw any consent you previously provided to us for processing certain activities by contacting us through the contact details outlined in section “Contact Details” below.

If you have any questions including your rights on this Policy or if you have any other queries in relation to how we may manage, protect and/or process your personal data, you may contact our data protection officer any time at DPO@bdxworld.com.

This section serves as a supplement to the Privacy Policy and applies in situations where we act as the Data Controller, as defined under Law No. 27 of 2022 on Personal Data Protection, in the context of processing personal data in Indonesia.

When transferring personal data to another country, we will strive to ensure that your data is processed in a jurisdiction with a level of personal data protection that is equal to or higher than that of the country where the information was originally provided or collected, or at least one that has adequate and binding data protection standards.

Specifically for personal data collected in Indonesia, if the destination country does not offer an adequate level of data protection, we will only proceed with the transfer after obtaining your explicit consent in accordance with applicable laws and regulations.

Additionally, for data transferred from Indonesia, we may be legally required to disclose your personal data to government authorities, regulatory bodies, law enforcement agencies, or courts such as in response to a court order, subpoena, or other lawful request, including those related to national security or law enforcement obligations, or as necessary in legal proceedings to exercise or defend our legal rights. In such cases, we are committed to not disclosing your personal data in response to international legal requests such as those from foreign courts or authorities unless we are legally compelled to do so under the applicable laws.

In addition to the rights mentioned in our Policy above, you are entitled to the right to lodge a complaint with the competent data protection authority in your home country or in the country in which our responsible entity is located, with respect to the result of automated decision-making. In Indonesia, the competent data protection authority is the Ministry of Communication and Informatics.

To comply with the applicable law in Indonesia, this Privacy Policy will be available in Indonesian language. In the event of discrepancy between the English and Indonesian version, the English version shall prevail.

If you have any questions including your rights on this Policy or if you have any other queries in relation to how we may manage, protect and/or process your personal data, you may contact our data protection officer any time at DPO@bdxworld.com.

This section serves as a supplement to the Privacy Policy and applies if you are a resident of mainland China.

We collect your personal information and sensitive personal information for the purposes described in the Policy in strict accordance with the principles of lawfulness, fairness, necessity and transparency. In case we use your personal information for other purposes not contained in the Policy or collect your personal information for other specific purposes, we will inform you in a reasonable manner and obtain your consent again.

We may obtain your personal information from your authorized third parties. In this case, unless otherwise permitted by law or if we have obtained fresh consent from you, we will after verifying the legitimacy of the source of the personal information, process your personal information within the scope of consent you have given to the third party and in compliance with applicable laws and regulations.

In addition, if the personal information you share with us is not your own personal information, you need to:

• ensure that such information shared by you is collected based on and through legitimate purposes and methods;
• notify the individuals or employees whom you act on behalf of or any other persons that requires authorization (such as contractors, business partners or authorized third parties) and obtain consent to the following:
  • The personal information collected and submitted by you will be processed by us;
  • We will process such personal information in accordance with this Policy and applicable laws and regulations.

In addition to the Legal Bases to process your personal information mentioned above, we may collect and process your personal information without obtaining your authorization or consent if your personal information has been disclosed at your own discretion or has been lawfully made public is processed within a reasonable scope.

Where your personal data collected or generated within China is transferred to a country or region outside of China, your personal data will be secured by appropriate safeguards as set forth under Chinese laws and regulations, including without limitation, by the use of the standard contract (where applicable) to be officially published by the Chinese supervisory authority for the transfer of personal data from China to other jurisdictions.

To the extent required under applicable law, we will inform you of the relevant information about the transfer and obtain separate consent from you before the transfer of your personal data. In such cases, we will require the recipient to process your personal information in accordance with our agreement, the Policy, and any other relevant confidentiality and security measures, and to ensure that your personal information will at least enjoy the same protection as it does in the People’s Republic of China.

We will not share your personal information with any company, organization or individual without your specific consent.

If we need to share your personal information with our affiliates, service providers and other third parties for providing services to you, we will strictly follow the principles of lawfulness, fairness and necessity, and obtain your specific consent.

In addition to the above rights in this Policy, you are entitled to the following rights under applicable laws and regulations at any time:

If you request to transfer your personal information to other processors designated by you, we will provide the means of transfer accordingly in compliance with the conditions stipulated by the Cyberspace Administration of China.

We will voluntarily delete your personal information under the following circumstances or you may also make a request to us to delete your personal information:

• If the purposes for which we process your personal information have been fulfilled, cannot be fulfilled, or such purposes are no longer necessary;
• If the retention period of your personal information has expired;
• If our processing of personal information violate laws and regulations;
• If we collect and use your personal information without your consent;
• If our processing of personal information breaches our agreement with you;
• If you no longer use our services; or • If we no longer provide services to you.

When the retention period specified by laws and administrative regulations has not expired, or when it is technically difficult to delete your personal information, we will stop processing activities other than storage and carrying out necessary protective measures.

For the protection of personal information, when you exercise your rights, we may require  you provide us with proof of identity for our verification before processing your request.

You fully acknowledge that we are unable to respond to your request in the following circumstances:

• In connection with our performance of the obligations under the laws and regulations;
• Directly related to national security and defense security;
• Directly related to public security, public health, and major public interests;
• Directly related to criminal investigations, prosecutions, trials and enforcement of court decisions, etc.;
• Where there is sufficient evidence of subjective malice or abuse of right by the subject of personal information
• Where response to your request will result in serious damage to the legitimate rights and interests of the subject of personal information or other individuals or organizations;
• In relation to trade secrets; and

Other circumstances specified in laws and regulations.

If you have any questions including your rights on this Policy or if you have any other queries in relation to how we may manage, protect and/or process your personal data/ personal information, you may contact our data protection officer any time at DPO@bdxworld.com.

This section serves as a supplement to the Privacy Policy and applies if you are a resident of Singapore.

By using our websites, applications or by otherwise giving us your personal data, you are accepting the practices including collection, use and disclosure of your personal data for the purposes describes in this Privacy Policy.

For any cross-border transfer of your information to any country where we have databases or affiliates, we rely on legally enforceable obligations to provide to the personal data transferred a standard of protection that is comparable to that under the Personal Data Protection Act 2012 (“SG PDPA”). We obtain consent for the collection, use and disclosure of your personal data in accordance with the Personal Data Protection Act 2012 (“SG PDPA”) unless an exception applies under the SG PDPA or we are required or authorized by other applicable law.

We are committed to complying with the Do Not Call (DNC) provisions. In respect of sending telemarketing messages to your Singapore telephone number via SMS, telephone calls and other mobile messaging services, please be assured that we shall only do so if:

1. you have provided your clear and unambiguous consent in writing or other recorded form for us to do so; or
2. you have not registered that number with the National DNC Registry; or
3. the sending of such messages is permissible under applicable laws and regulations; or you have not indicated to us in our ongoing relationship that you do not wish to receive telemarketing messages sent to your Singapore telephone number.

You are also able to withdraw your consent to our continued use and disclosure of your information via the contact details set out below.  Please note that after opting out, you may continue to receive non-marketing messages, such as product updates and service notices as permitted under applicable local laws and regulations.

If you have any questions including your rights on this Policy or if you have any other queries in relation to how we may manage, protect and/or process your personal data, you may contact our data protection officer any time at DPO@bdxworld.com.

This section serves as a supplement to the Privacy Policy and applies if you are a resident of Taiwan.

The controller of your personal data processed is BDx Data Center (Taiwan) Co., Ltd.

• With regard to the section titled “Disclosure Of Your Personal Data”, to the extent required by Personal Data Protection Act, we will first obtain your consent before sharing your personal data.
• With regard to the section titled “Your rights”, you also have the right to make an inquiry of and to review your personal data.
• You hereby agree that we can share your personal data to our affiliate, financial/transaction counterparties or other third parties for the purposes listed in the section titled “How We Use Your Personal Data”. You may exercise your rights to restrict the way we process your data, however, our relevant performance may be prevented or delayed.

If you have any questions including your rights on this Policy or if you have any other queries in relation to how we may manage, protect and/or process your personal data, you may contact our data protection officer any time at DPO@bdxworld.com.