DXN PRIVACY NOTICE FOR DXN ASSOCIATES

This Privacy Notice describes how DXN Group of Companies (“DXN” or “we” or “us”) use personal data collected or received from DXN Associates (“Associates” or “you”). DXN Associates define as an external party with whom the DXN has established, or plans to establish some form of business relationship. This includes vendor, suppliers, contractors, sub-contractors, consultants, agents, stockists, outsourcing providers, representatives and other intermediaries who are performing work or services for or on behalf of DXN Group of Companies (DXN Group of Companies refers to DXN and its subsidiaries collectively).

This privacy notice describes how we collect or receive your personal data, the types of personal data we process, how we use, share and protect these data, how long we retain these data, your rights with respect to the processing of your personal data, and how you can contact us about our privacy practices.

How We Collect and Receive Personal Data from You

Where we request your personal data, we will specify whether the provision of such data is a statutory or contractual requirement, or if it is necessary to enter into and/or facilitate a contract. We will also inform you whether you are obliged to provide the data and the possible consequences of failing to do so.

DXN collects and receives personal data from DXN Associates through various means, including but not limited to:

• Provision of services: Through the registration forms, supplier/vendor onboarding documents, due-diligence questionnaires, contracts, and other documentation that you complete and submit (either in hard copy or electronically) in order to register and engage with DXN as an Associate.
• Direct communications: Personal data that you provide when corresponding with DXN personnel via email, telephone, messaging applications, DXN digital portals, or face-to-face meetings (e.g. business cards, contact details, company profile).
• Performance and transaction records: Information automatically generated or recorded during the course of providing goods/services to DXN, including purchase orders, invoices, delivery notes, access to DXN premises, project progress reports, and payment records.
• Security and access systems: Personal data collected via DXN’s security systems such as CCTV, visitor registration books, access cards, vehicle registrations and sign-in systems when Associates are present at DXN offices, factories, or sites.
• Publicly available or third-party sources: Information obtained from public databases (e.g. Companies Commission of Malaysia (SSM), regulatory authorities’ portals), credit reporting agencies, or professional references provided by the Associate for onboarding, due-diligence, monitoring, or vendor evaluation purposes.
• Participation in DXN-related events or programmes: Information you provide when participating in DXN-sponsored briefings, supplier engagement sessions, tenders, training, surveys, corporate social responsibility (CSR) programmes, or system rollouts.

The Types of Personal Data We Process

We process the following types of personal data relating to you:

• Contact information: Such as your name, business or personal address, email address, telephone number, fax number, and social media or instant messaging handles;
• Company and employment details: Including company name, business registration number, job title/position, department, nature of services provided, ownership or shareholding information, and details of authorised representatives or signatories;
• Identification and statutory information: Such as NRIC/passport number, professional licence number, company registration documents, tax identification number, EPF/SOCSO registration, and any licenses or permits required to provide services to DXN;
• Financial and payment information: Including bank account details, payment instructions, credit terms, invoices, purchase orders, delivery records, billing information, and tax-related documentation;
• Background and compliance information: Such as due-diligence questionnaires, conflict of interest declarations, anti-bribery and corruption screening forms, references, litigation history, or blacklist/watchlist checks;
• Access and security information: visitor logbooks, CCTV footage, access card records, vehicle plate numbers, and temperature/health declaration where required for accessing DXN premises; and
• Communication and interaction records: Including correspondence with DXN representatives (emails, letters, WhatsApp messages), meeting notes, attendance at briefings, trainings, tender briefings, webinars, or other events organised by DXN.

We may process other personal data under exceptional circumstances only. If we need to process other types of personal data about you, we will make sure that you are informed about the processing of such personal data and that there is a valid legal basis for doing so (e.g., your consent).

How We Use the Personal Data We Collect

We only process your personal data to the extent it is necessary:

1. To perform our contract with you, or to take steps at your request prior to entering into a contract, such as to:
   • Manage your relationship with us as a DXN Associate, from initial registration through ongoing engagement;
   • Respond to your enquiries, requests, or feedback;
   • Fulfil our obligations to you under the agreement;
   • Communicate with you regarding the business or services we have engaged you for;
   • Monitor and evaluate your performance as a DXN Associate;
   • Share your contact details, business credentials, and relevant information with related parties within the DXN Group of Companies (where required for operational purposes);
   • Carry out accounting, billing, payment, audit, and other related administrative activities; and
   • Enforce any applicable contractual terms and conditions.
2. To comply with our legal obligations, including to:
   • Comply with laws which require us to retain records; and
   • Comply with any other laws which may be applicable to us.
3. For the purpose of our legitimate interests, including to:
   • Operate, evaluate, and improve our products, business, and services;
   • Track, document, and evaluate participation in DXN trainings, meetings, and events;
   • Prevent and protect you, us, and others against fraud, unauthorized transactions, claims, and other liabilities;
   • Ensure compliance with company policies and industry standards; and
   • Process personal data for internal administrative purposes.

When we process your personal data for these purposes, we have carefully balanced our organization’s legitimate interests against your data protection rights. You can obtain further information by contacting us at pdpa@dxn2u.com

How We Share Personal Data

DXN does not sell, rent, or trade your personal data. We do share your personal data among us as joint controllers and with:

• Other DXN Group of Companies;
• Providers of infrastructure-or platform- or software-as-a-service solutions, software development services, information system maintenance services, record management services or marketing services;
• Logistics providers;
• Financial transactions service providers; and
• Government authorities or other third parties, if required or allowed otherwise by law or reasonably necessary to protect the rights, legal interests, property, or safety of you, others, or ourselves.

International Data Transfers

We transfer the personal data we collect about you to entities within the DXN organisation, as well as to third-party service providers that process personal data on our behalf. Some of these companies and service providers are located in countries other than the country in which the personal data was originally collected. The laws of those countries may not have the same level of data protection as the country in which you initially provided the personal data. When we transfer your personal data to other countries, we will protect that personal data as described in this Privacy Notice and in accordance with applicable law.

How We Protect Personal Data

We maintain appropriate technical and organisational security safeguards designed to protect the personal data we process against accidental, unlawful or unauthorised destruction, loss, alteration, access, disclosure, or use.

How Long We Retain Personal Data

We store personal data as long as necessary to fulfil the purposes for which we collect the data (see above under "How We Use the Personal Data We Collect"), except if required or allowed otherwise by law. Please contact us using the contact details provided in this Privacy Notice if you have any questions regarding our data retention practices.

Updates to this Privacy Notice

DXN may update this Privacy Notice from time to time. We will notify you of any significant changes to this Privacy Notice on the relevant DXN websites, in official DXN publications, or through other appropriate communication channels. All changes shall be effective from the date of publication, unless otherwise provided in the notification.

Your Rights

Subject to the relevant legislative provisions, you have the following data protection rights:

• The right to access
  You have the right to obtain confirmation as to whether or not your personal data are being processed and, where this is the case, access to the personal data. You also have the right to ask us for a copy of your personal data.
• The right to rectification
  You have the right to ask us to rectify personal data about you that you think are inaccurate. You also have the right to ask us to complete data you think are incomplete. This right always applies.
• The right to erasure
  This is also known as 'the right to be forgotten' and, in simple terms, enables you to request the deletion or removal of your data where there's no compelling reason for us to keep using the data. This is not a general right to erasure; there are exceptions, e.g. if we have a legal obligation to keep your data.
• The right to restriction of processing
  You have the right to ask us to restrict the processing of your personal data under certain circumstances.
• The right to data portability
  This right only applies to personal data you have given us. You have the right to ask that we transfer the data you gave us to another organisation or give the data to you.
• The right to withdraw consent
  Where you have provided us with consent to process your personal data, you have the right to withdraw your consent at any time. This will not affect the lawfulness of the processing that has been carried out based on your consent prior to the withdrawal.
• The right to object
  When we process your personal data for purposes of pursuing our legitimate interests, you have the right to object to such processing at any time. If you object, we will stop the processing unless we have strong and legitimate reasons to continue using your data.
• The right to lodge a complaint
  If you have concerns about the way we handle or process your personal data, please contact our Data Protection Officer (contact details below) who will investigate the matter and report back to you. If you are still not satisfied after our response, depending on the law of the country where you live or work, you may have the right to complain to a data-protection regulator.

How to Contact Us

If you have any enquiries about this Privacy Notice, if you would like to update information we have about you, or if you wish to exercise your data protection rights, you may contact your local affiliate via email to pdpa@dxn2u.com or by letter to:

Data Protection Officer
DXN Holdings Bhd.
DXN Cyberville
Jalan Teknokrat 1, Cyber 3, 63000 Cyberjaya,
Selangor, Malaysia.
Attention: Legal & Compliance Department