We are committed to protecting and respecting your privacy. This Privacy Policy, together with the Terms of Use in Schedule 1, set out how personal information collected in connection with the Services is handled.

By entering into the Client Agreement, you will be taken to have read and agreed to the terms of this Privacy Policy. This Privacy Policy may change from time to time. It may be accessed at the Website. The Terms of Use take precedence over any conflicting Privacy Policy provisions. References to 'we,' 'us,' and 'our' in this Privacy Policy are deemed to include references to CBIPAY

1 WHAT INFORMATION DO WE COLLECT?

1.1 In order to provide and operate the Services, we may collect, store, and process the following information: 1.1.1 personal information, being information about an identifiable individual such as the individual's full legal name, date of birth, driver's license number, passport number, marital status, postal or residential address, email address, telephone number, nationality, income, bank account details, and taxation details; 1.1.2 accounting and financial information relating to your investment portfolios; and 1.1.3 non-identifiable information relating to your use of the Services such as device-related information (browser type, IP (internet protocol) address), and server log information (date and time of day of your visit and pages you accessed). We also collect information that you input into the Website while accessing CBIPAY. 1.1.4 Any personal financial information you wish to disclose to enable us providing relevant financial services for you.

2 USES MADE OF THE INFORMATION

2.1 The purposes for which information may be used by us in and outside Singapore include (each a Purpose): 2.1.1 as will be required by law, such as in connection with our obligations under know-your-client (KYC), anti-money laundering and countering the financing of terrorism (AML/CFT), Monetary Authority of Singapore regulations and Inland Revenue Authority of Singapore regulation; 2.1.2 in connection with the operation of CBIPAY, such as (without limitation) processing of applications, redemptions, transfers, deposits, payments, generating reports and acquisitions; 2.1.3 carrying out our obligations arising from any contracts entered into between you and us or entered into in connection with CBIPAY generally; 2.1.4 ensuring that content from the Website is presented in the most effective manner for you and for your computer; 2.1.5 providing you with alerts, newsletters, education materials or information that you requested or signed up to; 2.1.6 allowing you to participate in interactive features of CBIPAY, when you choose to do so; 2.1.7 designing and conducting surveys/questionnaires for client profiling/segmentation, statistical analysis, improving and furthering the provision of our products and services; 2.1.8 complying with laws and regulations applicable to us or any of our related companies (as defined in the Companies Act 1994 Rev Ed.) in or outside Singapore; 2.1.9 legal proceedings, including collecting overdue amounts and seeking professional advice; 2.1.10 researching, designing and launching services or products including seminars/events/forums; 2.1.11 promoting and marketing services and products subject to your exercise of the opt-out right (please see further details in Clause 11.3 below); or 2.1.12 purposes directly related or incidental to the above. 2.2 The lawful basis for which we process personal information is to perform the Services for you, to protect our legitimate interests and to comply with our obligations at law. 2.3 By using the Services, you agree that we can access, aggregate, and use non-personally identifiable data that has been collected through the use of the Services. This data will in no way identify you or any other individual. We may use this aggregated non-personally identifiable data without notice or liability to you, too: 2.3.1 assist us in understanding better how our clients are using CBIPAY; 2.3.2 provide users and potential users of CBIPAY with further information regarding the uses and benefits of CBIPAY; and 2.3.3 otherwise to improve CBIPAY.

3 DISCLOSURE OF THE INFORMATION

.1 We will keep personal information collected in connection with CBIPAY confidential but may provide information to third parties where necessary or appropriate to facilitate the purpose for which information was collected pursuant to this Privacy Policy, including the provision of CBIPAY. 3.2 We may disclose your personal information to Government entities and other external data providers that hold information on you in order to verify that the information provided by you is consistent with the records held by such entities for the purpose of complying with our KYC and AML/CFT obligations; 3.3 We will not otherwise disclose your personal information to a third party unless you have provided your consent. However, you should be aware that we may be required to disclose your personal information without your consent in order to comply with any court orders, subpoenas, or other legal processes or investigations, including by tax authorities, if such disclosure is required by law. Where possible and appropriate, we will notify you if we are required by law to disclose your personal information. 3.4 Personal information may be disclosed between related companies (as defined in the Companies Act 1994 Rev Ed.) and our personnel and those of our Agents or delegates in or outside of Singapore. Those related companies, personnel, Agents, and delegates will treat and handle such personal information consistent with this Privacy Policy. 3.5 We may disclose your personal information to third parties outside of Singapore in accordance with clause 8. 3.6 We require all third parties to respect the security of your personal information and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal information for their own purposes and only permit them to process your personal information for specified purposes and in accordance with our instructions.

4 COOKIES

4.1 Our Website uses cookies and similar technologies to distinguish you from other users of the Website and to better understand the usage of the Website. This helps us provide you with a good experience when you browse the Website and also allows us to improve the Website. By continuing to browse the site, you agree to the use of cookies. 4.2 Cookies are small text files they are stored by your browser onto your computer or mobile device. They are widely used in order to make websites work or work in a better, more efficient way. They can do this because websites can read and write these files, enabling them to recognize you and remember important information that will make your use of a website more convenient (e.g., by remembering your user preferences). 4.3 To help you understand cookies, we have classified each cookie as one of the following: 4.3.1 Strictly necessary cookies. These cookies are essential to the operation of a website enabling a user to move around effectively and to use a website's features, such as remembering information entered on forms when a user moves between pages within a browser session. Without strictly necessary cookies, certain services on our Website may not be made possible, and our Website may not perform as smoothly as it should. 4.3.2 Analytical/performance cookies. These collect information about the use of a website and help to improve the way a website works. For example, performance cookies may show which are the most frequently visited pages, help to record any difficulties with a website, and show whether advertising on a website is effective or not. This helps us to improve the way our Website works, for example, by ensuring that users are finding what they are looking for easily. Performance cookies do not collect information that identifies a user personally, and all information that is collected by these cookies is aggregated and anonymous. 4.3.3 Functionality cookies. These allow a website to remember the choices you make and to provide enhanced and more personal features. Functionality cookies also remember changes you have made, such as customizing a certain webpage and for other services you request, such as watching a video or commenting on a blog. This enables us to personalize our content for you, greet you by name, and remember your preferences. Functionality cookies will not track your activity on other websites. 4.3.4 Targeting/advertising cookies. These cookies record your visit to our Website, the pages you have visited and the links you have followed. We will use this information to make our Website and the advertising displayed on it more relevant to your interests. We may also share this information with third parties for this purpose. 4.4 Please note that third parties (including, for example, advertising networks and providers of external services like web traffic analysis services) may also use cookies, over which we have no control. These cookies are likely to be analytical/performance cookies or targeting cookies. 4.5 We use third-party web analytics services on the Website, like Google Analytics (collectively referred to as Analytics Services). Analytics Service providers use technologies such as cookies, web server logs, and web beacons to help us analyze how visitors use the website. For example, Analytics Services collect information such as how often users visit our Website, what pages they visit when they do so, and what other sites they used prior to coming to our Website. We only use the information we get from Analytics Services to improve CBIPAY or the Website. Analytics Services only collect the IP address assigned to you on the date you visit the Website, not your name or other identifying information. We do not combine the information collected through the use of Analytics Services with personally identifiable information. Analytics Services' ability to use and share information about your visits to the Website is restricted by their terms of use and privacy policies. 4.6 You can block cookies by activating the setting on your browser that allows you to refuse the setting of all or some cookies. However, if you use your browser settings to block all cookies (including essential cookies), you may not be able to access all or parts of the Website.

5 LINKS TO OTHER WEBSITES

5.1 The Website may contain links to other websites of interest. However, once you have used these links to leave the Website, you acknowledge that we do not have any control over that other website. We cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites, and such sites are not governed by this Privacy Policy. You should exercise caution and look at the privacy policy applicable to the website in question.

6 SECURITY AND PROTECTION OF THE INFORMATION

6.1 All information you provide to us is stored on secure servers. Where we have given you (or where you have chosen) a password which enables you to access certain parts of our Website, you are responsible for keeping this password confidential and secure. We ask you not to share a password with anyone. 6.2 Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal information, we cannot guarantee the security of your data transmitted to our Website; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to protect your personal information from misuse, loss, and unauthorized access. 6.3 We will never contact you to ask you to disclose your security credentials. Be cautious about opening links contained in SMS messages or emails and beware of phishing scams.

7 WHERE DO WE STORE THE INFORMATION?

7.1 We may store your Data on servers in Singapore, Australia, and the United States. We may also transfer your data to people or entities listed at Clause 4 above, who may be located in or outside of Singapore.

8 RETAINING THE INFORMATION

8.1 We only retain information for so long as it is necessary for the purposes for which the information can lawfully be used or longer if required by applicable laws such as obligations under KYC, AML/CFT, and IRAS regulations. 8.2 To determine the appropriate retention period for personal information, we consider the amount, nature and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

9 CHANGES TO OUR PRIVACY POLICY

9.1 We may modify this Privacy Policy from time to time without prior notice by publishing a new version of this Privacy Policy on the Website, which is your responsibility to review. Any changes to the Privacy Policy will be reflected on this page and will become effective immediately upon publication. We encourage you to periodically review this Privacy Policy to stay informed about how we are protecting the personally identifiable information we collect. If changes to the Privacy Policy are material, we will do our best to notify you via email or through a notification on the Website. Please check the date on which this Privacy Policy was last updated below to determine if there have been any changes since you have last reviewed the Privacy Policy.

10 YOUR CONSENT AND RIGHTS

10.1 By using the Services, making an application to become an investor, or visiting the Website, you consent to the collection, storage and use of your information and other activities as outlined in this Privacy Policy. 10.2 Under the Singapore Personal Data Protection Act 2012, and other relevant law, whether your Data is stored in Singapore or offshore, you have the right: 10.2.1 to check whether we hold personal information about you and to access such data; 10.2.2 to request us to correct as soon as reasonably practicable any data relating to you that is inaccurate; 10.2.3 to ascertain our policies and practices in relation to personal information and the kind of personal information held by us; and 10.2.4 to object to the use of your personal information for marketing purposes, and we shall not use your personal information marketing purposes after you communicate your objection to us. 10.3 We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal information (or to exercise any of your other rights). This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response. 10.4 You may exercise your opt-out right to non-essential communications by using the unsubscribe facility in our electronic messages or notifying us if you wish to object to the use of your personal information for direct marketing purposes. Please send requests for such objections, access to data, correction of data, information regarding policies and practices and kinds of data held, questions or complaints to our privacy officer at support@paycbi.com. 10.5 We will deal with any complaint by investigating the complaint, and providing a response to the complainant within 20 business days, provided that we have all necessary information and have completed any investigation required. In cases where further information, assessment, or investigation is required, we will seek to agree alternative time frames with you. 10.6 In accordance with the Personal Data Protection Act 2012, in some circumstances, we have the right to and may charge a reasonable fee for processing any data access request.

11 GOVERNING LAW AND JURISDICTION

11.1 Subject to paragraph 13, nothing in this Privacy Policy shall limit your rights under the Personal Data Protection Act 2012. This Privacy Policy shall be governed by the laws of Singapore. You agree to submit to the exclusive jurisdiction of the Singapore courts.

12 GLOBAL DATA PROTECTION REGULATION

12.1 Where we process personal information which is subject to the European Union's General Data Protection Regulation (GDPR Data), we do so as a data processor, acting only on the instructions of a relevant data controller. Where we are a processor of GDPR Data, we have entered into a data processing agreement with the relevant data controller, which outlines how we may process that GDPR Data. 12.2 In relation to GDPR Data, you have the right to withdraw your consent or to object to our use of your personal information. You can ask us to delete it, to restrict its use, or to object to our use of your personal information for certain purposes such as marketing. If you would like us to stop using your data in any way, please get in touch. If we are still providing Services to you, we will need to continue using your information to deliver those Services. In some circumstances, we are obligated to keep processing your information for a set period of time. If you withdraw your consent or object to certain processing, we may not be able to provide certain Services to you. We will advise you if this is the case at the time you withdraw your consent or object.