Privacy Notice

1 Scope of Notice

1.1 This Privacy Notice applies to information, including ^personal data, collected about you by StraitsInvestment Bank Ltd. (formerly known as FTAG Investment Bank Ltd.) (the “Bank” or “SIB”), referred toin this statement either individually or collectively as “the Bank”, “we”, “our” or “us”.1.2 This Privacy Notice outlines how we process your personal data collected by the Bank through thechannels below from the point we collect, use, share, dispose of and the security measures that wehave established to ensure your personal data is well protected:• ‘Online’ through our Website and mobile banking App; and• ‘Offline’ through our products and services offered over the counter, by the Bank’s CustomerService Representatives, and/or the Bank’s sales and marketing team and during ongoingdue diligence reviews by the Bank’s officers.^ Information extracted from commercial transactions that can reasonably identify you.

2 Our Privacy Commitment

2.1 This Privacy Notice is issued to inform you of the Bank’s commitment to the policy of protecting at alltimes the confidentiality, integrity and security of the information provided by you to us as werecognize the importance of the personal information we hold about customers and the trust theyplace in us.2.2 Your personal data is classified as confidential and can only be disclosed by us where authorized byyou, permitted by any laws (including regulations, standards, guidelines and/or obligations)applicable to the Bank.

3 Source of Collection of Your Personal Information

3.1 We will collect information from a variety of sources including but not limited to the sources mentionedbelow, which may constitute personal data and/or *sensitive personal data which are relevant to ourbusiness relationship with you:(a) Information we collect from you directly in person when you:• Apply for a product or service, open an account (online or offline), make deposits into orwithdrawals from your account, pay your bills or apply for a loan or use your credit or debitcard;• Speak to us over the phone or personally including the process of selling or marketing aproduct or service to you or when you call in for enquiries and/or through our telemarketingcalls; and• Visit our sites, use our services, view our online advertisements.(b) Information we collect about you from other sources without your direct involvementwhere permitted by law:• From Credit Reference Agency for the purpose of credit assessment when considering creditapplications; and• From any court order or regulatory body having authority over the Bank or any lawenforcement agency for the purpose of considering the opening/maintaining of youraccounts with us.• Includes information about your physical and mental health, political opinions, religiousbeliefs or criminal records.

4 Collection of Personal Information

4.1 The type of personal information collected varies depending upon the type of product or service youseek and collection may begin prior to your take-up or upon signing up or depending on how you accessand use our products and services. Information collected will include:(a) Information that identifies you:• Your name, salutation/title, correspondence address, e-mail address and other contactinformation such as telephone no., mobile no., etc.;• Your age, gender, date of birth, race, citizenship, marital status, particulars of identitydocuments such as identity card or passport, where applicable;• Your education and employment details;• Information captured on security systems [including a recording of your image on ClosedCircuit Television (“CCTV”)];• Names and particulars of the authorized officers, directors, shareholders, beneficialowners, business registration, country of incorporation and financial or commercial dealingsof the company, where applicable;• Date of call to the Bar (applicable to lawyers only);• Relationship with other data subject/third parties; and• Goods and Services tax registration number (for tax input purposes).(b) Information about your financial position:• Sources of income, expenses, savings, assets, liabilities, investment portfolio and borrowinghistory;• Account number/Income tax number;• Latest audited/Management financial statements;• Credit reports from credit reporting agencies, daily reconciliation reports; and• Opinions from other banks about your creditworthiness.(c) Information about your intended use of our product or service.(d) Information about your opinion about products, services or staff.4.2 Under certain circumstances, we may also collect sensitive personal data if:(a) We need it to provide you with a specific product or service; or(b) You are applying for employment with us.4.3 We may also collect personal data of a minor from the parent/legal guardian if we need to provide theminor with a specific product or service.

5 Personal Information about Third Parties

If at any time you supply us with personal information about another person or in the case where you aredependent on another person such as your spouse, parents or other third parties, you should ensure that youare authorized to do so and you agree to inform that person who we are, that we may use and disclose thatpersonal information and that they may gain access to it should we hold that information.

6 Use of Personal Information

Although, the primary purpose of collecting your information is for its use in the normal course of the generalbusiness between the Bank and you, the said information may also be applied for purposes connected withthe said primary purpose including but not limited to the following:(a) Provision of financial banking and other related services and credit facilities to you;(b) Offering, cross-selling and marketing products and services of Straits Investment Bank Ltd., ouraffiliates who are (“Affiliates”);(c) Conducting credit and other status checks at the time of application and periodically during the tenureof the credit to ensure ongoing credit worthiness of customers;(d) Creating and maintaining the Bank’s credit scoring and risk related models;(e) Provision of reference (status enquiries);(f) Maintaining credit history of customers;(g) Assisting other financial institutions to conduct credit checks;(h) Customizing and improving financial services or related products for customers’ use;(i) Internal monitoring and control, including but without limitation to determining amounts owed to or bycustomers;(j) Enforcement of customer’s obligations, including but without limitation to collection of amountsoutstanding from customers and other parties having liability to the Bank;(k) Where disclosure is required under any law, rule, regulation, court orders or any guidelines issued by aregulatory body having authority over the Bank or any law enforcement agency;(l) Enabling an actual or proposed assignee of the Bank, or participant or sub-participant of the Bank’srights in respect of the customer to evaluate the transaction intended to be the subject of theassignment, participation or sub participation;(m) Research and statistical analysis (including behavioral analysis);(n) Engaging with legal firms to perfect the Bank’s security documentation for customer’s loan andadvances;(o) Process lawyer’s data to enable the Bank to evaluate their suitability to be appointed to the Bank’s Panelof Solicitors;(p) Assist authorized vendors to perform onsite maintenance and support for IT systems and equipment;(q) Due diligence check for employees, suppliers, vendors, IT hardware and software providers prior tocontracting their services or purchasing their products;(r) Design and organize campaigns/promotions/events for customers’ participation including the processof selecting winners, distribution/delivery of gifts and prize giving ceremonies;(s) Retrieving, recording and storing for internal/external audit purposes;(t) Satisfying the terms and conditions of employment contracts with the Bank;(u) Administration and management of salary, medical and other employment benefits;(v) CCTV footage, in particular, may also be used for the following purposes:• Quality assurance purposes;• Public safety and security;• Detecting and deterring suspicious, inappropriate or unauthorized use of our facilities, products,services and/or premises;• Detecting and deterring criminal behavior; and/or• Conducting incident investigations;(w) Empanelment, appointment and review of valuers, insurance companies and developers; and(x) Complaint resolution.

7 Consent

7.1 We only collect personal information about you that is necessary to perform our functions andactivities. If you do not provide this information or consent to certain use of your personal information,we may not be able to provide you with the product or services that you want or process yourapplication for employment or facilities or establish any business dealings with you.7.2 In most cases, before or at the time of taking out a new product or applying for a facility(ies) or applyingfor employment with the Bank, (or if that is not practicable, as soon as practicable thereafter) we willobtain your consent for the purposes for which it is intended to be used and to disclose your personalinformation.7.3 Your consent can be expressed verbally or in writing, or implied by your actions.

8 Data Confidentiality and Sharing of Personal Information

8.1 We may share your personal information with our Affiliates in order to offer you products and servicesof the Bank and our Affiliates which may interest you. To enable us to do the same, we will obtain yourconsent and only share your personal information for the purposes to which you have agreed.8.2 Data (except data already in the public domain) held by the Bank relating to you will be keptconfidential, but we may need to share your personal information in the normal course of generalbusiness and connected with the primary purpose for which your information was collected with thefollowing parties, subject at all times to any laws (including regulations, standards, guidelines and/orobligations) applicable to us:(a) The Bank and our Affiliates;(b) Any agent, contractor, developer, third party service provider, financial guarantee provider,adviser, liquidators/ Receivers and Managers, auditors, auctioneer, vehicledealers/distributors/traders/manufacturers or consultant who provides administrative,telecommunications, electronic payment, data processing and analysis, payment, securitiesclearing, debt collection, valuation, insurance, research, legal, financial, accounting, taxation,audit or refers business to us or other services to the Bank;(c) Any other person who has expressly or impliedly undertaken to keep such informationconfidential or otherwise is under a duty of confidentiality to the Bank;(d) Any financial or other institution, credit charge or other card company with which the customerhas or proposes to have dealings;(e) Any party jointly with whom the Bank launches, organizes or offers any product, function orservice and any other party having business arrangements with the Bank in connection with theservices, products, customer feedback survey and functions offered or organized by or throughthe Bank;(f) The drawee bank providing a copy of a paid cheque (which may contain information about thepayee) to the drawer;(g) Credit reporting agencies, and, in the event of default, to debt collection agencies;(h) Any person, which is required by law, rule, regulation, court order and under any guidelinesissued by regulatory or other authorities;(i) Any party giving or proposing to give a guarantee or third-party security to guarantee or securethe customer’s obligations;(j) Any party making any request mentioned in paragraph 6(k) above;(k) Any actual or proposed assignee of the Bank or participant or sub participant or transferee ofthe Bank’s rights in respect of the customer;(l) Marketing campaigns prize winners’ names to the media and Bank’s website; and(m) Legal and other professional advisers of any party mentioned in item 8.2 (a) to (l) above.

9 International Transfers

9.1 As we operate regionally, personal information may be processed and disclosed as described above inany country in which we conduct business or have a service provider in accordance with this PrivacyNotice if:(a) You have given consent to the transfer;(b) The transfer is necessary for the performance of a contract between you and the Bank;(c) The transfer is necessary for the conclusion or performance of a contract between the Bankand a third party which is entered into at your request or is in your interest;(d) The transfer is for the purpose of any legal proceedings or for the purpose of obtaining legaladvice or for establishing, exercising or defending legal rights;(e) The Bank has reasonable grounds for believing that in all circumstances of the case that:• The transfer is for the avoidance or mitigation of adverse action against you;• It is not practical to obtain your consent in writing to the transfer; or• If it is practical to obtain such a consent, you would have given your consent;(f) The Bank has taken all reasonable precautions and exercised all due diligence to ensure thatyour personal information will be processed in that place in accordance with Malaysian law;(g) The transfer is necessary in order to protect your vital interests; or(h) Where the Government deem that the transfer of your personal information is necessary in thepublic interest.9.2 Our Privacy Notice and our practices are designed to provide a consistent level of protection forpersonal information. This means that even in countries whose laws provide for less protection for yourinformation, the Bank will still handle your information in the manner described here.

10 Personal Information Security

10.1 The Bank is committed to protecting the security of your personal information by implementingadequate and stringent security controls, measures and protocols in line with existing industrypractices and legal requirements to safeguard and secure your personal information against any loss,misuse, modification, unauthorized or accidental access or disclosure, alteration or destruction.10.2 To achieve this objective, regular reviews of the risks to personal information would be conducted andany security flaws or weaknesses identified would be promptly addressed and rectified.10.3 We employ security measures regardless of the media on which information is stored (paper, computerdisks, etc.), the systems which process it (microcomputers, mainframes, voice mail systems, etc.), orthe methods by which it is moved (electronic mail, face-to-face conversation, etc.). Such protectionincludes restricting access to information on a need-to-know basis. The Bank devotes sufficient timeand resources to ensure that information is properly protected.10.4 As a source of reference for the Bank's information security needs, information security policies,standards and procedures are fully documented and maintained. All employees, including newrecruits, are educated as to their obligations with regard to your personal information. Consultants orother external parties contracted to carry out work for the Bank must also conform to theserequirements and where appropriate, are also bound by non-disclosure agreements to ensure theconfidentiality of the Bank's information assets.10.5 We also require you to help us by complying with the security measures designed to protect yourpersonal identification numbers and passwords by keeping it secret and confidential. These are set outin the terms and conditions of your account. You may be able to limit your liability for unauthorized useof your account if you observe these requirements.10.6 If we no longer require your personal information for any of the purposes stated in the Privacy Noticeand pursuant to any agreements entered into between you and us, after the expiry of the relevantretention period, whether pursuant to any laws and regulations or based on the requirement under ourpolicies, or otherwise, we will take reasonable steps to destroy it in a secure manner or removeidentifying features from it.

11 Personal Information Accuracy

11.1 The Bank will take all practicable and reasonable steps to ensure that your personal information isaccurate, complete and up-to-date.11.2 You can help the Bank to keep accurate and up-to-date records by informing us in writing of anychanges so that records on you could be updated promptly.

12 Access to Personal Information

12.1 As a customer, you can exercise the following rights:(a) To check whether the Bank holds personal information about you and have access to such data;(b) To require us to correct any data relating to you which is inaccurate;(c) To ascertain our policies and practices in relation to your data and to be informed of the kind ofpersonal data held by us; and(d) To withdraw your consent for the Bank to process your personal data.12.2 The Bank reserves the right to charge a reasonable fee for the processing of any data access request.12.3 Should you have any query in relation to this privacy notice or how we handle your personal data, kindlysubmit your query to the following contact point:12.3.a..1 Level 15(A1), Main Office Tower, Financial Park Labuan,12.3.a..2 Jalan Merdeka, 87000 Labuan F.T12.3.a..3 E-mail: cs@straitsbank.com

13 Direct Marketing/Telemarketing

13.1 The Bank may with your consent use your personal information to provide you with Bank offers,newsletters and marketing materials/information about products, services or other events that may beof interest to you.13.2 If at any time you choose not to receive such marketing information from us, you may visit any of ourbranches to instruct us not to send you any further such material.

14 Website Links

Please note that this website may contain hyperlinks to other sites that are not affiliated with the Bank. Thehyperlinked websites may or may not meet the same privacy standards that we set for ourselves and you are totake care to understand and evaluate their particular privacy standards and procedures. A link to such websitesis not an endorsement of the contents of such websites and makes no warranties as to the informationcontained in such websites.

15 Changes to this Privacy Notice

The Bank will occasionally update this Privacy Notice to reflect changes to our policies, processes and systemsin relation to how we handle your personal information. When we post changes to this notice, we will revise the“Last updated on” date on the top of each page of this notice. We encourage you to periodically review thisnotice.