DATA PROTECTION POLICY

Last reviewed on 1st March 2019
This data protection policy applies to iColumn which is established in Singapore. This policy governs the
collection, use and disclosure of personal data submitted to iColumn, and explains how we collect and
handle personal data of individuals and comply with the requirements of the Personal Data Protection Act
2012 of Singapore and its regulation(s) (“PDPA”). In this policy, “personal data” shall have the meaning
ascribed to it in the PDPA.

Summary
We will collect, use or disclose personal data for reasonable business purposes only if there is consent or
deemed consent from the individual and information on such purposes have been notified. We may also
collect, use or disclose personal data if it is required or authorised under applicable laws.

Collection of Personal Data
We collect personal data from clients, customers, business contacts, partners, personnel, contractors and
other individuals. Such personal data may be provided to us in forms filled out by individuals, face to face
meetings, email messages, telephone conversations, through our websites or provided by third parties. If
you contact us, we may keep a record of that contact.

We collect these personal data when it is necessary for business purposes or to meet the purposes for
which you have submitted the information.

We will only collect, hold, process, use, communicate and/or disclose such personal data, in accordance
with this policy. If you are acting as an intermediary or otherwise on behalf of a third party or supply us
with information regarding a third party (such as a friend, a colleague, an employee etc), you undertake
that you are an authorised representative or agent of such third party and that you have obtained all
necessary consents from such third party to the collection, processing, use and disclosure by us of their
personal data. Because we are collecting the third party’s data from you, you undertake to make the third
party aware of all matters listed in this policy preferably by distributing a copy of this policy to them.

Use of Personal Data
We use personal data for the following purposes:
• to provide our services
• to respond to the individual’s request or for the purposes for which it was provided to us as stated at the
time of the collection (or as is obvious from the context of collection)
• to maintain contact with clients and other contacts
• for general management and reporting purposes, such as invoicing and account management
• for purposes related to the employment of our personnel and providing internal services to our personnel
• all other purposes related to our business.
• pursuant to an exception under the PDPA or any other written law.

You may choose to unsubscribe from mailing lists, registrations, or elect not to receive further marketing
or related information from us by contacting our Data Protection Officer, or if we have contacted you by
email, you may use the unsubscribe function in that email to notify us. Please allow 15 days for
your request to be processed.

We will not be able to provide some of the products and services if you decided not to provide the
personal data necessary for a transaction or service.

Disclosure of Personal Data to Third Parties
We do not disclose personal data to third parties except when required by law, when we have your consent
or deemed consent or in cases where we have engaged the third party such as data intermediaries or
subcontractors specifically to assist with our firm’s activities. Any such third parties whom we engage will
be bound contractually to keep all information confidential.

We may disclose personal data where it is necessary (i) to meet the purpose for which you have submitted
the information; or (ii) to enable you to be provided with information at a later date which may be of
relevance and interest to you based on the nature and purpose of your voluntary requests. We may also
transfer all data in our possession to a successor-in-interest to our business or assets.

Retention of Personal Data
Personal data that is kept by us will be destroyed after a reasonable period from the time when it becomes
outdated or is no longer required for the purpose for which it was collected or when we receive
your request to delete it. You may contact our DPO via email (dpo@icolumn.com) for more details about
how long we will keep your personal data (the retention period) and how we will destroy the personal
data once the retention period is over etc.

Access to and Correction of Personal Data
Upon request, we will provide the individual with access to their personal data or other appropriate
information on their personal data in accordance with the requirements of the PDPA.

Upon request (you may email to our DPO at dpo@icolumn.com), we will correct an error or omission in
the individual’s personal data that is in our possession or control in accordance with the requirements of
the PDPA.

We may charge for a request for access in accordance with the requirements of the PDPA.

Withdrawal of Consent
Upon reasonable notice being given by an individual of his withdrawal of any consent given or deemed
to have been given in respect of our collection, use or disclosure of his personal data, we will inform
the individual of the likely consequences of withdrawing his consent. We will cease collecting,
using or disclosing the personal data unless it is required or authorised under applicable laws.

Accuracy of Personal Data
We will make a reasonable effort to ensure that personal data collected by us or on our behalf is accurate
and complete.

Security and Protection of Personal Data
We have implemented generally accepted standards of technology and operational security to protect the
personal data in our possession or under our control and to prevent unauthorised access, collection,
use, disclosure, copying, modification, disposal or similar risks. All iColumn personnel follow a
network-wide security policy. Only authorised iColumn personnel are provided access to
personally identifiable information and these personnel have agreed to ensure confidentiality of this
information.

Retention of Personal Data
We will cease to retain personal data, as soon as it is reasonable to assume that the purpose for collection
of such personal data is no longer being served by such retention, and such retention is no longer
necessary for legal or business purposes.

Transfer of Personal Data outside of Singapore
We will ensure that any transfers of personal data to a territory outside of Singapore will be in accordance
with the PDPA so as to ensure a standard of protection to personal data so transferred that is comparable
to the protection under the PDPA.

How is this information secured?
We keep the personal data secure and make it accessible to staff on a need to know basis. iColumn has
implemented generally accepted standards of technology and operational security in order to protect
personal data from loss, misuse, alteration or destruction. Only authorised iColumn personnel are provided
access to personal data and these employees have agreed to ensure confidentiality of this information.

Privacy on Our Web Sites
This Policy also applies to any personal data we collect via our websites. Cookies may be used on some
pages of our website. “Cookies” are small text files placed on your hard drive that assist us in providing a
more customised website experience. Cookies are now used as a standard by many websites to improve
users’ navigational experience. If you are concerned about cookies, most browsers permit individuals to
decline cookies. In most cases, a visitor may refuse a cookie and still fully navigate our websites, however
other functionality in the site may be impaired. After termination of the visit to our site, you can always
delete the cookie from your system if you wish.

Data Protection Officer
If you believe that information we hold about you is incorrect or out of date, or if you have concerns or
further queries about how we are handling your personal data, or any problem or complaint about such
matters, please contact our Data Protection Officer, at dpo@icolumn.com.

Modifications
We reserve the right to modify or amend this Policy at any time. The effective date will be displayed at the
beginning of this Policy.