Personal Data and Information Notice to individual

Duopharma Biotech Berhad (formerly known as CCM Duopharma Biotech Berhad) (“Duopharma Biotech”) respects your privacy. We treat and view your personal data seriously.

This Personal Data & Information Notice is issued to all our valued customers, trading partners, website users and persons who process personal data in respect of commercial transactions pursuant to the requirements of the Malaysia Personal Data Protection Act 2010. This Personal Data & Information Notice sets out how we will collect and deal with your personal data subject to the specific terms and conditions that may apply to you depending on the nature of the commercial relationship in existence between us.

Personal Information & Data Collection

In the course of your dealings with us, we will request that you provide data and information about yourself and/or your family ("Personal Data”) to enable us to enter into transaction with you or to deliver the necessary services and/or products in connection with our business. Such Personal Data may include information concerning name as per your identity card, preferred name, identity card number, age, contact number, residential address, e-mail address, birth date, gender and occupation or other types of data collected. We may also obtain sensitive personal data (such as your physical or mental health or your religious beliefs) from you. If you volunteer such information, you will be consenting to our processing it for the purposes stated below.

Why do we collect Personal Data?

Collection of personal data is relevant in connection with our business process, execution, including delivery of services and/or products and client relationship management. Personal Data you provide will be collected, used and otherwise processed by us for, amongst others, the following purposes:

• a) the delivery of services or products and the marketing of such services or products whether present or future, to you;
• b) trading partners or customer relationship management procedures;
• c) those purposes specifically provided for in any particular service or product offered by us;
• d) conducting marketing and client profiling activities in connection with our services and related products;
• e) our internal record keeping;
• f) meeting any legal or regulatory requirements relating to our provision of services and products and to make disclosure under the requirements of any applicable law, regulation, direction, court order, by-law, guideline, circular, code applicable to us or any related companies of our Group (hereinafter Duopharma Biotech and its related companies are collectively referred to as the “Duopharma Biotech Group”);
• g) enable us to send you information by e-mail, telecommunication means (telephone calls or text messages) or social media about products and services offered by selected third parties that we think may interest you; and
• h) for the purpose of any contests or promotions organised by Duopharma Biotech or the Duopharma Biotech Group.

What are the effects arising from failure to provide Personal Data?

It is not mandatory for you to provide your personal information to us. However, if you volunteer such information, you will be consenting to our processing it for the purpose stated above.

Please note that the failure to supply such Personal Data will / may: -

• a) result in us being unable to provide customers with the services and/or products requested;
• b) result in us being unable to update you on our latest product and/or launches;
• c) result in your inability to enter or participate in the contest, promotions or redemption activities organised by us.

Disclosure

Personal Data provided to us will generally be kept confidential but you hereby consent and authorize us to provide or disclose your Personal Data to the following categories of parties: -

• a) any person to whom we are compelled or required to do so under law or in response to a competent or government agency;
• b) any related companies and subsidiaries of the Duopharma Biotech Group including its affiliates, associate companies, agents, representatives, within and outside Malaysia, including those established in the future;
• c) our business partners, strategic partners and affiliates that provide related services or products in connection with our business;
• d) government agencies, statutory authorities and industry regulators;
• e) our auditors, consultants, accountants, lawyers or other financial or professional advisers;
• f) our sub-contractors or third-party service or product providers as may determine to be necessary or appropriate such as for the purposes of data storage or otherwise; and
• g) any third parties deemed necessary by us to fulfil the above referenced purposes.

Safeguards

We shall keep and process your data in a secure manner. We endeavour, where practicable, to implement the appropriate administrative and security safeguards and procedures in accordance with the applicable laws and regulations to prevent the unauthorized or unlawful processing of your Personal Data and the accidental loss or destruction of, or damage to, your Personal Data.

Use of IP address and cookies

An Internet Protocol (IP) address is a series of numbers attached to your electronic device. Your IP address is recorded in our server when you visit our website. A cookie is a small text file which is placed onto your electronic device when you access our website. We use cookies on this website to recognise you whenever you visit this website and to make your online experience more efficient and enjoyable. The information we obtain from our use of cookies will not usually contain your personal data, although we may obtain information about your electronic device such as your IP address, your browser and other internet log information. In certain circumstances, we may collect personal data about you, but only where you voluntarily provide it, for example, by completing our online feedback form. You can modify the settings of your browser to turn off cookies.

Rights of Access, Correction

You have the right to request access to and correction of information about you held by us and in this respect, you may:

• a) check whether we hold or use your Personal Data and request access to such data;
• b) request that we correct any of your Personal Data that is inaccurate, incomplete or out-ofdate;
• c) request that we specify or explain its policies and procedures in relation to data and types of Personal Data handled by us;

See our Guidelines on Handling Request for Access to Personal Data and the Subject Access Request Form published on www.duopharmabiotech.com for further information on PDPA.

The person to whom written requests for access to Personal Data or correction of Personal Data or for information regarding policies and procedures and types of Personal Data handled by us is:

Ketua Pegawai Undang-Undang
Jabatan Undang-Undang Dan Kesetiausahaan
Duopharma Biotech Berhad

You have the right to request us to stop processing your Personal Data. If you wish to exercise this right, kindly put your request in writing and furnish us the relevant information identifying yourself and your request and send it to:

Ketua Pegawai Undang-Undang
Jabatan Undang-Undang Dan Kesetiausahaan
Duopharma Biotech Berhad

We will endeavour to respond within 21 days of receipt of your request. However, the process may take longer if we receive insufficient information to identify yourself, your request or the data.The Personal Data & Information Notice is provided in English and Bahasa Malaysia. The English version shall prevail in the event of inconsistencies. We may change this Personal Data & Information Notice from time to time. Kindly check the Personal Data & Information Notice from time to time to update yourself as to the most recent version which applies to all our website users.

Guidelines on Handling Requests for Personal Data

i. Requirements for a valid request

The request must be in writing. A Request Form (Form I) (which may be downloaded / obtained from www.duopharmabiotech.com) must be filled out and submitted to us. If you are requesting personal data on behalf of another individual, please use Form II.

Request made by non-Duopharma Biotech employees must be accompanied by the appropriate fee. We currently charge Ringgit Malaysia Ten (RM10.00) only;

We may request supporting documents from you in order to verify your identity before allowing the access. The Request Form contains examples of the type of documents that can be used to do this. Typically, we will request a copy of your National Registration Identity Card / Driving License / passport to enable us to establish your identity. We may also ask for further documents of proof, e.g. recent utility bill (or equivalent) to verify your identity and address. If you are not the data subject, we will require you to produce a copy of your legal authority, such as Power of Attorney, where appropriate. We must be able to identify the information being requested. For example, if the data subject is both an employee and a customer of Duopharma Biotech, we may request you to specify whether you are seeking access to the data subject’s human resource file, customer records or both.

Unless the above requirements are met, we are not obliged to comply with a request.

Time Period for Satisfying a Request

1. Once a valid subject access request is received, we will respond within 21 days after all requirements have been satisfied.iii. Exemptions to the Right of Access Data
2. In certain circumstances we may be exempted from providing some or all of the personal data requested. These exemptions include, but are not limited to the following circumstances:
• Providing access will disclose personal data relating to another individual who can be identified from that information, unless (a) that other individual has consented to the disclosure of the
• information to you; or (b) it is reasonable in all the circumstances to comply with the data access request without the consent of the other individual;
• Providing access would constitute a violation of a court order;
• Providing access would disclose confidential commercial information;
• Providing access would prejudice the purposes of preventing or detecting crime, apprehending or prosecuting offenders;
• Data requested involves confidential references that we have given to third parties for the purpose of your actual or prospective education, training or employment; appointment of you to any office; or provision by you of any service;
• Data requested involves personal data which is subject to legal professional privilege. This covers confidential communication between us and our lawyers where the dominant purpose of the communication is the giving or receiving of legal advice; and confidential communication between us or our lawyers and a third party (such as a witness) where the dominant purpose of the communication is the giving or seeking of legal advice in respect of current or potential legal proceedings;
• Providing access would prejudice the conduct of our business or activity when the personal data we process is for the purpose of management forecasting or management planning to assist us in the conduct of any business or any activity. Examples of management forecasting and planning activities include staff relocation, redundancies, succession planning, promotions and demotions;
• Data requested involves personal data consisting of a record of our intentions in relation to negotiations with you where doing so would be likely to prejudice those negotiations.
3. Each request will be considered on a case-by-case basis after taking into account all facts.