Nanofilm Group Privacy Policy

PURPOSE OF PRIVACY POLICY

The Nanofilm Group (as defined below in Section 1) is committed to safeguarding your Personal Data (as defined further below in Section 2).

The purpose of this privacy policy (“Privacy Policy”) is to inform you of how Nanofilm Technologies International Limited manages Personal Data (as defined below) which is subject to the Personal Data Protection Act 2012 of Singapore (“PDPA”).

By interacting with us, submitting information to us, or purchasing or using any products and services offered by us (“Products and Services”), you agree and consent to Nanofilm Technologies International Limited, its related corporations, representatives and/or agents (collectively referred to herein as “Nanofilm Group”, “us”, “we” or “our”) collecting, using, disclosing and sharing amongst themselves your Personal Data, and disclosing such Personal Data to the Nanofilm Group’ authorised service providers and relevant third parties in the manner set forth in this Privacy Policy.

This Privacy Policy supplements but does not supersede nor replace any other consents you may have previously provided to Nanofilm Group in respect of your Personal Data, and your consents herein are additional to any rights which to any of the Nanofilm Group may have at law to collect, use or disclose your Personal Data.

Nanofilm Group may from time to time update this Privacy Policy to ensure that this Privacy Policy is consistent with Nanofilm Group’s developments, industry trends and/or any changes in legal or regulatory requirements. By using our website and/or submitting Personal Data to us, subject to your rights at law, you agree to be bound by the prevailing terms of the Privacy Policy as updated from time to time on our website https://www.nti-nanofilm.com/; and you are responsible for reviewing this Privacy Policy as updated from time to time.

Please check back regularly for updated information on the handling of your Personal Data.

PERSONAL DATA

In this Privacy Policy, “Personal Data” refers to any data, whether true or not, about an individual who can be identified (a) from that data; or (b) from that data and other information to which we have or are likely to have access, including data in our records as may be updated from time to time.

Examples of such Personal Data you may provide to us include (depending on the nature of your interaction with us):

• personal particulars (e.g., name, contact details, date of birth, identity card/passport details)
• contact information (e.g., address, telephone numbers, email address, mailing address, fax numbers)
• education details and professional qualifications (e.g., names of schools and institutions, types of qualification)
• medical and health details (e.g., prior medical history)
• financial details (e.g., income, expenses, credit card information)
• employment details (e.g., employment history, salary, benefits, title, tenure)
• photographs and other audio-visual information
• personal opinions that you make known to us
• marital status and spousal information
• information about next-of-kins
• information about your use of our websites
• information about your device and your geographical location (e.g., your Internet Protocol (IP) address or unique device identification)
• any other data not specified above, including but not limited to any other information relating to any individuals which you have provided us in any forms you may have submitted to us, or via other methods of interaction with you.

Please note that the data protection provisions of the PDPA do not apply to business contact information (“BCI”). BCI is defined in the PDPA as an

individual’s name, position name or title, business telephone number, business address, business electronic mail address or business fax number and any other similar information about the individual, not provided by the individual solely for his personal purposes.

COLLECTION OF PERSONAL DATA

Generally, we collect Personal Data in the following ways:

• when you submit any details (in any kinds of medium), including but not limited to application and registration forms or other kind of forms (including but not limited to forms which relates to internships/employment with us and our Products or Services);
• when you enter into any agreement or provide other documentation or information in respect of your interactions with us, or when you use our Products and Services;
• when you interact with our staff, for example, via telephone calls (which may be recorded), letters, face-to-face meetings, social media platforms and emails;
• when you use our electronic services, or interact with us via our websites, and apps or use services on our websites;
• when you request that we contact you or request that you be included in an email or other mailing list;
• when you respond to our promotions, initiatives or to any request for additional Personal Data;
• when you submit an employment application or when you provide documents or information including your resume and/or CVs in connection with any appointment as an officer, director, representative or any other position;
• when your images are captured by us via CCTV cameras or face recognition system while you are within our premises, or via photographs or videos taken by us or our representatives when you attend events at our premises;
• when you are contacted by, and respond to, our representatives and officers;
• when we receive references from business partners and third parties, for example, where you have been referred by them with your consent;
• when we seek information from third parties about you and receive your Personal Data in connection with your relationship with us, including for our Products and Services or job applications (e.g., from business partners, public agencies, your ex-employer, referral intermediaries and the relevant authorities);
• when you attend our general meetings or results briefing sessions;
• when you contact us with feedback, queries or complaints;
• when you request us to send you information or notify you of developments in Nanofilm Group via posts, emails, or telephone calls; and/or
• when you submit your Personal Data to us for any other reasons.

When you browse our website, you generally do so anonymously but please see the section below on cookies.

If you provide us with any Personal Data relating to a third party (e.g., information of your spouse, children, parents, and/or employees), by submitting such information to us, you represent to us that you have obtained the consent of the third party to provide us with their Personal Data for the respective purposes.

You should ensure that all Personal Data submitted to us is complete, accurate, true and correct. Failure on your part to do so may result in our inability to provide you with the Products and Services you have requested, or delays in processing your applications.

PURPOSES FOR THE COLLECTION, USE AND DISCLOSURE OF YOUR PERSONAL DATA

Generally, Nanofilm Group is likely to collect, use, process and disclose your Personal Data for the following specific purposes on basis of the consent given (where applicable) for:

• internship/employment purposes (including but not limited to application, performance of duties);
• facilitating a smooth usage of our websites;
• transacting with you and providing our Products and Services;
• responding to your queries, feedback, complaints and requests;
• managing the administrative and business operations of Nanofilm Group and complying with internal policies, reporting requirements and procedures;
• facilitating business asset transactions (which may extend to any mergers, acquisitions or asset sales) involving any of the Nanofilm Group;
• requesting feedback or participation in surveys, as well as conducting market research and/or analysis for statistical, profiling or other purposes for us to design our Products and Services, understand customer behaviour, preferences and market trends, and to review, develop and improve the quality of our Products and Services;
• monitoring or recording phone calls and customer-facing interactions for quality assurance, employee training and performance evaluation and identity verification purposes;
• matching any Personal Data held which relates to you for any of the purposes listed herein;
• preventing, detecting and investigating crime and analysing and managing commercial risks;
• managing the safety and security of our premises and services (including but not limited to carrying out CCTV surveillance and conducting security clearances);
• hosting, storing or backing-up your Personal Data, which may be on third party servers or data clouds;
• legal purposes in connection with any claims, actions or proceedings (including but not limited to drafting and reviewing documents, transaction documentation, obtaining legal advice, and facilitating dispute resolution), and/or protecting and enforcing our contractual and legal rights and obligations;
• complying with our legal and regulatory obligations and requirements;
• accounting, risk management and record keeping;
• our legitimate and/or lawful interests pursued by us or third parties appointed by us.

When we rely on such a legitimate and/or lawful interest as a basis, we will conduct an assessment and such interests include (but are not limited to):

• providing Products or Services that you have contracted with us for or have requested from us in;
• responding to queries that you may have of us;
• managing or administering the business relationship between you and us;
• conducting investigations relating to disputes, billing or fraud;
• meeting or complying with any applicable rules, laws, regulations, codes of practice or guidelines issued by any legal, statutory or regulatory bodies which are binding on Nanofilm Group (including but not limited to responding to regulatory complaints, disclosing to regulatory bodies, disclosures required in the public interest or emergencies and conducting audit checks, due diligence and investigations which may be carried out by statutory authorities);
• and/or purposes which are reasonably related to the aforesaid.

In addition, Nanofilm Group collects, uses and discloses your Personal Data for the following purposes:

If you are a visitor to our properties or office premises:

• facilities management (including but not limited to issuing visitor access passes, and recording entries to and exits from our premises);
• providing services and facilities; and/or
• purposes which are reasonably related to the aforesaid.
• if you are an intern, employee, officer or owner of an external service provider or vendor outsourced or prospected by Nanofilm Group:
• assessing your suitability as an intern, employee, external service provider or vendor for Nanofilm Group;
• managing project tenders and quotations, processing orders or managing the supply of goods and services;
• managing business operations and product development; and/or purposes which are reasonably related to the aforesaid.
• if you submit an application to us as a candidate for an employment: conducting interviews;
• processing your application (including but not limited to pre-recruitment checks involving your qualifications and facilitating interviews); providing or obtaining references and for background screening; assessing your suitability for the position applied for;
• onboarding successful candidates and facilitating human resource planning and management; and/or
• purposes which are reasonably related to the aforesaid.
• if you are a shareholder of Nanofilm Group:
• onboarding or facilitating your appointment as a shareholder, including the verification of your identity and/or the identity of your proxy (as may be applicable);
• facilitate your attendance at our general meetings or results briefing sessions;
• maintaining statutory registers and to manage the publication and dissemination of shareholder statistics on annual reports, newsletters and circulars; and/or
• purposes which are reasonably related to the aforesaid.

Furthermore, where permitted under the PDPA, Nanofilm Group may also collect, use and disclose your Personal Data for the following “Nanofilm Group Additional Purposes”:

• invitations to exhibitions, seminars and similar events, and organising promotions and corporate social responsibility projects;
• providing additional Product and Services and benefits to you, including marketing/business development programmes;
• matching Personal Data with other data collected for other purposes and from other sources (including third parties) in connection with the provision, marketing or offering of Products and Services, whether by Nanofilm Group or other third parties;
• business improvement purposes;
• conducting market/industry research, understanding and analysing customer behaviour, location, preferences and demographics for us to offer you Products and Services as well as marketing/business development programmes which may be relevant to your preferences and profile; and/or
• purposes which are reasonably related to the aforesaid.

In addition, where permitted under the PDPA and subject to the provisions of any applicable law, your Personal Data may be disclosed, for Nanofilm Group Additional Purposes, to the vendors or other third-party service providers in connection with promotions and services offered by Nanofilm Group.

In relation to particular Products and Services or in your interactions with us, we may also have specifically notified you of other purposes for which we collect, use or disclose your Personal Data. If so, we will collect, use and disclose your Personal Data for these additional purposes as well, unless we have specifically notified you otherwise.

You have a choice to withdraw your consent for receiving marketing/business development materials/communication. You may contact us using the contact details found below in Section 11.

Please be aware that once we receive confirmation that you wish to withdraw your consent for marketing/business development materials/communication, it may take up to 30 working days for your withdrawal to be reflected in our systems.

Therefore, you may still receive marketing/business development materials/communication during this period of time. Please note that even if you withdraw your consent for the receipt of marketing/business development

materials, we may still contact you for other purposes in relation to the Products and Services that you have requested from Nanofilm Group.

If you provide us with any Personal Data relating to a third-party, by submitting such information to us, you are deemed to have represented and confirmed to us that you have obtained the consent of the third-party to you providing us with their Personal Data for the respective purposes set out in this Privacy Policy. For the avoidance of doubt, this applies to any individual, regardless of whether an EU resident or not.

DISCLOSURE OF YOUR PERSONAL DATA

Nanofilm Group will take commercially reasonable steps to protect your Personal Data against unauthorised disclosure.

Subject to the provisions of any applicable law, your Personal Data may be disclosed, for the purposes listed above (where applicable), to the following entities or parties, whether they are located overseas or in Singapore:

• Nanofilm Group’s related corporations and employees (to provide Products and Services to you, address your questions and requests in relation to your interactions with us as well as our Products and Services, to maintain and operate our systems and/or services);
• companies providing services relating to medical screening, insurance and consultancy to Nanofilm Group;
• companies providing services which are in support of, related to, and or ancillary to the Products and Services of Nanofilm Group;
• agents, contractors or third-party service providers who provide operational services to Nanofilm Group, such as courier services, customer service, telecommunications, information technology, payment, printing, billing, payroll, processing, technical services, training, market research, call centre, security, or other services to Nanofilm Group;
• vendors or third-party service providers in connection with marketing/business development offered by Nanofilm Group;
• any business partner, investor, assignee or transferee (actual or prospective) to facilitate business asset transactions (which may extend to any merger, acquisition or asset sale) involving any of the Nanofilm Group;
• collection and repossession agencies in relation to the enforcement of repayment obligations for debts;
• external banks, credit card companies and their respective service providers;
• building and car park management and their respective service providers;
• share registrars;
• companies which provide corporate secretarial, depository, clearing and book entry settlement services;
• our professional advisers such as consultants, auditors and lawyers;
• foreign embassies in relation to facilitating overseas travel arrangements;
• relevant government ministries, regulators, statutory boards or authorities or law enforcement agencies to comply with any laws, rules, guidelines and regulations or schemes imposed by any governmental authority; and/or
• any other party to whom you authorise us to disclose your Personal Data to.

Please note that the disclosures referred to above may be subject to additional legal requirements under applicable law, if we do disclose your Personal Data, we will only do so to the extent necessary, proportionate and legally permitted.

EU Residents

If you are a European Union (“EU”) resident, we are required, under the EU’s General Data Protection Regulation (EU) 2016/679 of 27 April 2016 (“GDPR”) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Data Protection Directive 95/46/EC, to disclose the legal basis for processing your data.

We will only process your personal data when we have a legal basis to do so. The following are our legal bases for processing your personal data:

• you work for a business entity with whom we have a business relationship or with whom we are exploring a business relationship;
• you applied for a job with us, and we have to use your personal data to assess and evaluate your suitability for the job;
• you have consented to us using your information for any particular purpose;we have received your deemed consent, as defined under the PDPA, to use your information for a particular purpose;
• we have a legitimate interest to do so; or
• we are required by legal or regulatory obligations and requirements.

Please be informed that certain categories of personal data (such as information on your health) is considered “sensitive personal data” as defined under the GDPR.

Generally, we try to limit the circumstances where we would collect and process sensitive personal data.

If you are both an EU resident and a job applicant, please note that we may collect sensitive personal data, in particular, your medical details, your marital status and information on your spouse and next-of-kin, when you apply for a job with us.

USE OF COOKIES

When you interact with us on our websites, we automatically receive and record information on our server logs from your browser. We may employ cookies in order for our server to recognise a return visitor as a unique user including, without limitation, monitoring information relating to how a visitor arrives at the website, what kind of browser a visitor is on, what operating system a visitor is using, a visitor’s IP address, and a visitor’s click stream information and time stamp (for example, which pages they have viewed, the time the pages were accessed and the time spent per web page).

Cookies are small text files stored in your computing or other electronic devices which allow us to remember you. The cookies placed by our server are readable only by us. Cookies are not programs and therefore cannot access, read or modify any other data on an electronic device. All web-browsers offer the option to refuse any cookie, and if you refuse our cookie then we do not gather any information on that visitor.

Should you wish to disable the cookies associated with these technologies, you may do so by changing the setting on your browser. You may also remove cookies stored from your computer or mobile device. However, if you do block cookies, you may not be able to use certain features and functions of our web sites or enter certain part(s) of our website.

DO NOT CALL (DNC) REGISTRY

If you have provided us with your Singapore telephone number(s) and have indicated that you consent to receiving marketing/business development materials/information via your Singapore telephone number(s), or where we are permitted to do so under the PDPA, then from time to time, we may contact you using such Singapore telephone number(s) (including via voice calls, text, fax or other means) you have provided to us with information about our Products and Services, and other marketing or promotional materials/communication even if these telephone number(s) are registered with the DNC Registry.

DATA SECURITY

Nanofilm Group will take reasonable efforts to protect Personal Data in our possession or our control by making reasonable security arrangements to prevent unauthorised access, collection, use, disclosure, copying, modification, disposal or similar risks. However, we cannot completely guarantee the security of any Personal Data we may have collected from or about you, or that for example no harmful code will enter our website (for example viruses, bugs, trojan horses, spyware or adware). You should be aware of the risks associated with using websites.

While we strive to protect your Personal Data, we cannot ensure the security of the information you transmit to us via the Internet, and we urge you to take every precaution to protect your Personal Data when you are on the internet.

Please inform us as soon as reasonably practicable if you know or suspect that someone else knows your Personal Data or believe the confidentiality of your Personal Data has been lost, stolen or compromised in any way or that actual or possible unauthorised transactions have taken place. We are not liable for any damages resulting from any security breaches, on unauthorised and/or fraudulent use of Personal Data.

DATA TRANSFER AND DATA RETENTION

If the transfer of your Personal Data within the Nanofilm Group is necessary, we will take reasonable steps to ensure that your Personal Data transmitted outside of your country of residence remains adequately protected to a standard similar to that afforded by the PDPA. In addition, we will ensure that such transfers comply with the requirements of the applicable data protection laws.

All Personal Data is retained for as long as it is necessary for the purposes it has been collected for in accordance with our data retention policy. Any third party who manages our personal data are also required to ensure that the Personal Data is disposed in accordance to the retention period as may be agreed in their respective engagement contract(s).

CONTACTING US – WITHDRAWAL OF CONSENT, ACCESS AND CORRECTION OF YOUR PERSONAL DATA

If you:

• have any questions or feedback relating to your Personal Data or our Privacy Policy;
• would like to withdraw your consent to any use of your Personal Data as set out in this Privacy Policy;
• would like to obtain access and make corrections to your Personal Data records,

you can approach our Data Protection Officer (“DPO”) via the following channels:

• Write to our DPO at:

Data Protection Officer

Email Address: DPO@nti-nanofilm.com

Address: 28 Ayer Rajah Crescent, #02-02/03, Singapore 139959

Please note that if your Personal Data has been provided to us by a third party (e.g., a referrer, or your company), you should contact that organisation or individual to make such queries, complaints, and access and correction requests to Nanofilm Group on your behalf.

If you withdraw your consent to any or all use of your Personal Data, depending on the nature of your request, Nanofilm Group may not be in a position to continue to provide its Products and Services to you, administer any contractual relationship in place, which in turn may also result in the termination of any agreements with Nanofilm Group, and your being in breach of your contractual

obligations or undertakings. Nanofilm Group’s legal rights and remedies in such event are expressly reserved.

Please also note that while we will use reasonable efforts to provide, correct or delete our records of your Personal Data, we may be prevented by law from complying with your request. We may also decline your request if the law permits us to do so.

Please also be informed that we may charge you a reasonable fee to process an access request and in response to your access request. The purpose of the fee is to allow us to recover the incremental costs of responding to the access request. This may include the time and costs incurred to search for the personal data requested. If so, a written estimate of the fee would be provided to you. Where we intend to charge a fee higher than the original written estimate, we will inform you in writing of the increased fee. We may refuse to process or provide access to your Personal Data until you agree to pay the relevant fee.

LINKS TO THIRD-PARTY WEBSITE(S)

The website of our company and its related corporation may contain links to other third-party operated websites operated by third parties over which we have no control over. We are not responsible for the privacy and/or data protection practices of such third-party operated websites that are linked to our websites.

Once you have left our website by clicking a relevant link, your use of that third- party website will be governed by the privacy or data protection policy of that website.

FEEDBACK, SUGGESTIONS AND COMPLAINTS

If you send us feedback, comments or suggestions, we may use your Personal Data in order to respond to you.

When we receive a complaint, we may have to disclose the complainant’s identity to whoever the complaint is about. If you are the complainant and you do not want us to disclose your identity to the party you are complaining about, you must let us know immediately. However, it may not always be possible to handle your complaint on the basis of anonymity.

RETENTION OF PERSONAL DATA

We will retain your personal data for as long as we need to do so for business or legal purposes.

GOVERNING LAW

This Privacy Policy and your use of this website shall be governed in all respects by the laws of Singapore.