Investors and Shareholders' Privacy Notice

Rapbizz Direct Company Limited (the “Company”) would like to assure the investors and/or the registered shareholders of the Company (“You”) that your personal data is important to the Company and the Company guarantee to protect and process those personal data under the best information security measures. The Company, therefore, intend to inform You of this Investors and Shareholders' Privacy Notice (the “Notice”) that defines the necessity that the Company may have in collecting, compiling, processing and/or disclosing your personal data for the performance of Company’s obligations as a company to You in accordance with the Civil and Commercial Code.

The Company may review and update this Notice from time to time to ensure that this Notice comply with the practice and relevant laws or regulations; provided that the Company will notify the change of this Notice by announcing the updated Notice to You via any communication channels of the Company.

Your personal data that the Company is processing

The Company may obtain and collect your Personal Data directly from You or from the shareholder registry book that the Company shall be obliged to keep under the applicable laws.

The Company need to collect and process the following Personal Data of You: 

1. Personal Data of You as the registered shareholder, including full name, nationality, occupation, current address, number of shares held, bank account information, Identification card number, email, and telephone number;
2. In case You are a major shareholder as defined under the laws and regulations of regulatory authorities, the Company would need to collect and store additional Personal Data of You, including your background (i.e., educational record and work experience) and photo of You or your representative in case that You are the corporate shareholder;
3. Any Personal Data that You may provide to the Company during the communication or conversation that You may have with the Company via the investor relation channels, including without limitation full name, nationality, occupation, address and contact information (i.e., telephone number and/or email);
4. Information of the meeting attendance that You as the registered shareholder participating in, including meeting registration information that may include shareholder’s proxy information, as well as video and voice recording during the meeting held both online and offline; and
5. Any Personal Data that You may submit to the Company for processing under other specific purposes.

In case You are the corporate shareholder, the Company would need to collect the information of your directors or in case You have appointed any proxy to attend the shareholders’ meeting and exercise any legal rights on your behalf, the Company would need to process the Personal Data of those persons; provided that when You provide Personal Data of those persons to us, the Company shall deem that You have given the representation that You have obtained all the consent or have the legitimate rights to disclose such persons’ Personal Data to the Company.

Objectives for the personal data process undertaken by the Company.

The Company would need to process your Personal Data for the following purposes:

1. To perform the legal obligations that the Company may have to provide the shareholders’ right to You such as to manage the corporate matters (i.e. company establishment, capital increase, capital decrease, business restructuring, change of company registration); to deliver the meeting invitation and other notices to You as required under the relevant laws, for instance, the invitation to the general shareholders’ meeting or the submission of the annual business report to the shareholders in accordance with your statutory rights; to allocate and distribute dividends to the relevant and entitled shareholders; to prepare the relevant accounting and tax report; and to perform any other legal obligations that the Company being limited company shall perform.
2. To manage and respond to your query or request to the Company including to inform any information about communicate and respond back to your request; to manage complaint relating to the exercise of your shareholder’s rights; or to manage the feedback provided;
3. To protect the legitimate interest of the Company or other person, including to record and manage the shareholders’ meetings (for instance, to register the attendance, to record the resolution passed; to record picture and/or video during the shareholders’ meeting; and to disseminate the information recorded during the meeting on the Company's website and other communication channels. All these activities would be undertaken to ensure the Company’s transparency and corporate governance for the interests of shareholders. The Company may also process the Personal Data for the purpose of data analysis, operating activities and facilitating shareholders in any other special events that the Company may organize; for the risk management and internal control; for internal audit; and for the exercise of the Company’s right in the legal claims;
4. In particular in the case of the majority shareholders as defined, to prepare the Company’s annual report that the Company are obliged to do so and may need to submit to the relevant authorities, or publicly disclose in accordance with the conditions and requirement prescribed in the relevant laws which may include the disclosure of your Personal Data on the Company’s website; and

Retention Period of Your Personal Data

The Company shall be required to process and store your Personal Data for all the purposes defined above as long as necessary to (i) response to any contact that You as an investor or any person interesting to invest in the Company may contact the Company; (ii) for all the period of time that You remain the Company’s shareholder and as long as the Company may have the obligations under relevant laws to perform to You; or (iii) as long as the Company may have the obligations under other relevant laws to retain your Personal Data.

In addition, in order for the Company to protect their legitimate rights that the Company has with you as the shareholders, the Company reserve the right to retain your Personal Data for the period of time that is necessary to protect such rights, in particular, for the appropriate prescription period after the cessation of your shareholder status for the maximum of 10 years for general prescription period.

Disclosure of your Personal Data

In general, your Personal Data shall not be disclosed to any person except in these necessary circumstances that the Company may need to disclose your Personal Data to the following person:

1. To affiliates, business partners, or any third party service providers who provide support to the Company in the business operation and the performance of obligations that the Company may have with the shareholders or to protect the Company’s legitimate rights, and other counsels (legal, accounting or others) as well as the internal and external audits; provided that the Company represent to only disclose your Personal Data under the defined purpose of data processing and on the necessary basis;
2. To the governmental authorities in case the Company shall be obliged under the applicable laws, court orders, or the instructions of such government authorities to disclose your Personal Data to; provided that the Company shall only disclose any information on the necessary basis;
3. To the counterparty where in some cases the Company may be required to disclose the Company’s annual report which may include the Personal Data of majority shareholders for the purpose of executing contract or coordinating to them; provided that the Company shall only disclose the limited Personal Data without causing excessive impact on You as the data subject; and
4. To any other person that You have given explicit consent to the Company to disclose your Personal Data to.

Representation to implement appropriate information security measures

The Company undertake that the Company shall implement the appropriate security measures to prevent the unauthorized or unlawful access, amendment, change, or disclosure of your Personal Data. In addition, the Company shall establish internal policy to limit the access control or the use of your Personal Data in order to maintain data confidentiality and security and the Company commits to review those measures on the regular basis to comply with the industry standard and relevant laws.

Your Rights as the Data Subject

The Company acknowledge and respect your rights as the data subject in relation to your Personal Data that is in the Company's control. You can exercise your rights in accordance with the conditions under the applicable laws as follows:

1. Right to request for access and to obtain copy of the Personal Data including the right to request for the correction and update the Personal Data;
2. Right to request for data portability; 
3. Right to object to the process of Personal Data being undertaken by the Company;
4. Right to request for Personal Data erasure or de-identification when the Personal Data is no longer necessary to be processed or when the data subject has withdrawn the consent;
5. Right to request the Company to restrict the use of the Personal Data, in case the Personal Data shall be deleted or those Personal Data are not necessary to be processed; and
6. Right to withdraw consent that the You have given to the Company under the defined purposes.

You can contact the Company in order to make the request to exercise any defined rights through the defined communication channel. The Company will consider and notify shareholder, investor, and/or any person interested in the investment of the Company of the Company’s determination within a reasonable period of time to the extent under the applicable laws. You can contact the Company at [email protected].