Virtuos Holdings Pte. Ltd. and its subsidiaries (collectively “Virtuos”, “we”, “us” or “our”) are committed to protecting your personal data. It is a core principle of our business and also our corporate social responsibility to protect and properly manage personal information obtained from third parties. This Privacy Policy describes what personal information we may collect and how we use, disclose, transfer or process it. We encourage you to read this Privacy Policy carefully when using our website/services and/or providing your personal data in any other way. If you do not want us to obtain, use, process or share your information in the ways set forth in this Privacy Policy, you may not be able to use our website/services and/or providing your personal data for any purposes. By using our website/services and/or providing us your personal data for any purposes (including career and recruitment purposes), you are accepting the practices described in this Privacy Policy and other relevant policies/notices described in this Privacy Policy.

This Privacy Policy is effective as of and was last modified on January 16, 2024. If you have any questions, comments, requests, or concerns in regard to this Privacy Policy, please contact our Privacy Office/Data Protection Officer at [email protected].

I. YOUR PERSONAL DATA; HOW WE COLLECT, USE, DISCLOSE OR PROCESS YOUR PERSONAL DATA

1. Definition

“Personal data” means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

2. How we collect, use, disclose or process your personal data

a) Use of Cookies

We use cookies, advertising IDs and/or similar analytical technologies on this website (collectively referred to as “Cookies”) to make the interaction between you and the website faster and easier by letting you navigate between pages efficiently, storing your preferences, and generally improving your experience of a website. On mobile, we use your mobile device advertising ID. Advertising IDs are non-permanent, non-personal identifiers such as the Android advertising ID and/or Apple’s ID for advertising, which are uniquely associated with your mobile device. Cookies may also be set by third parties, including by Google Analytics and/or social networking sites.

By accessing and using our website, you are deemed to consent to receive Cookies, unless you disable or delete Cookies or set your browser to alert you when Cookies are being sent to your computer. Please also note that the use of information obtained by third party providers through cookies placed by them is also subject to their own privacy policies.

b) Contact information (via Contact Us webpage)

By sending your personal data through our Contact Us webpage, you consent to the collection, storage, processing, use and disclosure of your data by us for the purposes of providing subsequent services, direct marketing, and to communicate with you for one or more of such purpose(s).

c) CVs and applications from jobseekers and candidates (via Careers webpage)

• You hereby represent and warranty that all information you provide is true, accurate, complete, up-to-date, and relates to you and not to any other person.
• By applying to our job opportunities and sending us your CV through our Careers webpage, you consent to the collection, storage, processing, use and disclosure of your data by us as described in this Privacy Policy and the Career Privacy Notice. This will include your name, address, e-mail address, phone numbers, educational background, picture, work experience and information from your CV and application. Please read the Career Privacy Notice carefully to learn more about how your privacy is handled during your application process and within our recruitment procedures.
• As we use Oracle Cloud Human Capital Management (“Oracle”)’s services to assist with our recruitment processes, Oracle’s privacy policy (https://www.oracle.com/sg/legal/privacy/) rather than this Privacy Policy, shall apply to the processing of your personal data.
• We may retain your application and personal data submitted for the timeframe permitted under applicable laws, so that your candidacy may be considered for other suitable positions within this timeframe.
• We may also retain your personal data where such retention is necessary for compliance with a legal obligation to which we are subject, or in order to protect your legitimate interests or the legitimate interests of another natural person or entity.

d) Any other way different from collecting information via website

By providing us your personal data via any method other than our website, for example through phone calls, name cards, visiting our office, etc.; you consent to the collection, storage, processing, use and disclosure of your data by us as described in this Privacy Policy.

To avoid any misunderstanding, any personal data which is shared and covered under a non-disclosure agreement shall be protected by such non-disclosure agreement.

e) We use personal data within the scope of the purposes of use specified and notified to you, except where allowed by applicable laws and regulations. Your personal data will not be further processed in a manner that is incompatible with these purposes unless we notify you otherwise. Personal data submitted via the website and/or otherwise provided to us could potentially be shared across our studios globally and this would only be done for the above-mentioned purposes.

f) We will not use personal data beyond the necessary scope for the attainment of the stated purposes of use.

g) We shall not provide personal data and personal identification data to a third party without prior consent from the individual, except where allowed by applicable laws and regulations.

II. HOW WE PROTECT YOUR PERSONAL DATA

1. Respect for Individual Rights and Freedoms

We respect your individual rights and freedoms under the EU General Data Protection Regulation 2016/679 (the “GDPR”) (if applicable) and other applicable data protection laws, including:

• the right to access;
• the right to rectification/correction of errors;
• the right to erasure;
• the right to restrict processing;
• the right to object to processing;
• the right to data portability;
• the right to complain to a supervisory authority; and
• the right to withdraw consent.

If you wish to exercise your rights, have any queries on this Privacy Policy or any other queries in relation to how we manage your personal data, please contact our Privacy Office/Data Protection Officer using the email address at the top of this Privacy Policy. We will respond to any requests in accordance with applicable laws, and so there may be circumstances where we are not able to comply with your request. Notwithstanding your requests, please note, however, that we may retain some information if required by applicable laws. We also have the right to refuse or deny your requests under applicable laws. We may also charge you a reasonable fee for the handling and processing of your requests in accordance with applicable laws and you will be notified in advance of such costs. To the extent permitted by applicable law, please note that we are not required to respond to or deal with your request unless you have agreed to pay the fee.

2. Personal Data Protection Management System

We shall comply with all applicable laws of the territories where it operates, including GDPR (if applicable). We shall ensure that personal data shall be processed in a lawfully, fairly and transparent manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful access, use and processing and against accidental loss, destruction or damage. In order to ensure the security of personal data, we implement security measures necessary for prevention of leakage, loss or damage of personal data, including, as appropriate, the measures referred to GDPR (if applicable). Should the handling of any personal data be outsourced to a third party, an agreement with that third party requiring the protection of personal data will be created. We also provide instructions and supervision to the third party regarding the correct handling of personal data.

Internally, our managers collectively oversee the protection and management of personal data, and employees receive periodic training and guidance on best procedures when handling personal data.

We take appropriate security measures (including physical, electronic and procedural measures) to help safeguard your personal data from unauthorized access and disclosure. However, no system can be completely secure. Therefore, although we take steps to secure your information, we do not promise or guarantee, and you should not expect, that your personal data, searches, or other communications will always remain secure. You should also take care with how you handle and disclose your personal data and should avoid sending personal data through insecure email/link.

Your personal data may be processed in a different country or region from where it was first collected, and the privacy laws of the country/region in which your personal data is processed may be less stringent than the laws of the region in which your personal data was first collected. By providing your personal data to us or otherwise accessing or using our websites or services, you agree to the disclosure of your personal data to third parties (whether located within or outside of the country/region in which your personal data was first collected) for one or more of the purposes described in this Privacy Policy or other policies (e.g. Career Privacy Notice), or as notified/described to you separately, and for the said third parties to subsequently collect, use, disclose and/or process your personal data for one or more of the purposes described in this Privacy Policy.

Where your personal data is to be transferred out of a country (e.g., Singapore), we will comply with the applicable privacy laws (e.g., Singapore’s Personal Data Protection Act (the “PDPA”)) in doing so. In this regard, this includes us obtaining your consent unless an exception under applicable law applies, and taking appropriate steps to ascertain that the foreign recipient organisation of the personal data is bound by legally enforceable obligations to provide to the transferred personal data a standard of protection that is at least comparable to the protection under the applicable law (e.g., the PDPA). This may include us entering into an appropriate contract/legal instrument with the foreign recipient organisation dealing with the personal data transfer or permitting the personal data transfer without such a contract if the applicable law permits us to.

III. RETENTION PERIODS

We will hold your personal data on our systems for as long as is necessary for the relevant purpose in accordance with applicable laws, or as otherwise described in this Privacy Policy and other policies/notices (e.g. Career Privacy Notice).

IV. CHILDREN’S PRIVACY

We do not knowingly collect any personally identifiable information from children below the age without requiring parental consent.

V. CONTINUOUS IMPROVEMENTS

We seek to continuously review and improve our Privacy Policy to adapt to changes in business, legal, cybersecurity or technological environments. When we post changes to this Privacy Policy, we will revise the “last modified” date at the top of this Privacy Policy. We recommend that you check our website from time to time to inform yourself of any changes in this Privacy Policy or any of our other policies. Any amended policy will be posted on our website, and we will notify you if we make any significant changes to this Privacy Policy where required to do so under applicable laws.

Virtuos Holdings Pte. Ltd. and its affiliates (collectively “Virtuos”, “we”, “us” or “our”) value your privacy and are committed to our obligations under applicable privacy laws and regulations (“Privacy Laws”). Our commitment extends to job applicants, prospective employees, and all users of our career website and associated recruitment systems and services (collectively “Career Sites”). We take your personal information protection seriously and take responsibility to handle, protect, and process this information appropriately.

This Career Privacy Notice (this “Notice”) aims to explain how we collect, use, disclose, and/or process the personal data you provide us with or that we may possess about you, both presently and in the future. We aim to provide you with the necessary information to make informed decisions regarding the sharing of your personal data before engaging with us.

By engaging or communicating with us as part of your application and our recruitment process, or entering into an employment agreement, contract of service or contract for service between you and us, you are consenting to the collection, use, disclosure, and processing of your Personal Data (defined below).

1. Type of information we collect, use, disclose and/or process. It will vary by the country and nature of the role for which you will be considered, which may include:

Your first name and last name, age, date and place of birth, national identification number/passport number, country of residence and nationality, marital status, residential address, contact numbers, email address, bank account number, tax number, CV or resume, cover letter, educational and professional qualifications, academic achievements, employment history; depending on the country, gender, social security details, ethinicity, religion, referees, details of family members and dependents, physical or mental health condition and medical history, committed or alleged offence or proceedings and criminal conviction; and any other information necessary to process your personal data for any of the Purposes. (collectively, “Personal Data”);

We may have obtained your Personal Data and information in relation to you directly from you or through third party sources including but not limited to job listing platforms, local authorities or publicly available sources. We may also obtain further information about you, including but not limited to information from your referees, recruitment agencies and/or third party background screening agencies, credit reporting agency and/or any regulatory authorities (where applicable) pertaining to your qualifications, experience, eligibility and/or other information for recruitment-related purposes.

2. How we use the information we collect, use, disclose and/or process. We may collect, use, disclose, and/or process Personal Data and/or information in relation to you for the purposes of processing your application as part of our recruitment process which includes:

• Assessing your skills, qualifications, experience and interests against our career opportunities;
• Verifying your details and, if necessary, conducting relevant and appropriate legally permitted pre-employment and eligibility verification checks;
• Engaging in communication with you regarding the recruitment process and your applications, including, occasionally, reaching out about potential career opportunities at Virtuos;
• Preparing a offer letter, contract of service or contract for service or such other contract as may have been entered into between you and us, and such other purposes as may be related to the foregoing;
• Providing assistance, upon your request, with visa or work permit procurement;
• Compilation of statistics regarding Virtuos employment opportunities, as part of our analytical and statistical studies to continuously improve our internal business processes and recruitment practices;
• Ensuring compliance with our internal rules, procedures and policies;
• Abiding by any laws, regulations, guidelines, obligations and governmental requests applicable to us;
• Responding to legal process, pursuing legal rights and remedies, defending litigation and managing any complaints or claims;
• Where applicable, complying with the compliance and disclosure requirements of any and all governmental and/or agencies, regulatory and statutory bodies; and
• Making improvements to our application and/or recruitment processes; (collectively, “Purposes”).

We will seek your consent before collecting any additional personal data and before using your Personal Data and/or information in relation to you for a purpose which has not been notified to you (except where permitted or authorised by applicable laws).

When you are offered and accept employment with us, your Personal Data and/or information in relation to you collected throughout the application and recruitment process will become part of your employment records.

3. Who may have access to your information. Your Personal Data and/or information in relation to you may be disclosed, accessed, processed, disseminated and/or transferred within Virtuos, allowing access to our recruiters, hiring managers and parties involved in the recruitment process on a need-to-know basis, as relevant and necessary for your application for the role you are being considered for.

We may also disclose your Personal Data and/or information in relation to you to third parties such as (i) service providers relating to verification checks, IT, banks, insurance and professional advisors; (ii) governmental departments, regulatory bodies and/or law enforcement agencies for the purpose of complying with applicable laws and regulations, or in response to legal process; and (iii) any such third party requested or authorized by you (e.g., if you have given us permission to contact your referees), for any of the above Purposes or any other purpose directly related to any of the above Purposes. These third parties may be located outside the country in which you live or the country where the position you have applied for is located.

4. Security and retention of your information. We are committed to ensuring the confidentiality, protection, security and accuracy of your Personal Data and/or information in relation to you made available to us. Any such Personal Data and/or information in relation to you will be retained by us as long as the purpose it was collected for remains valid or as is required to satisfy any legal, regulatory and/or accounting requirements. We assure you that your Personal Data and/or information in relation to you made available to us is treated as confidential and retained securely.

Virtuos operates globally, which means your information may be stored and processed outside of the country or region where it was originally collected. Regardless of where your information is collected, used, disclosed and/or processed, we apply the same protections described in this Notice.

5. Your rights in respect of your information. Depending on countries, you may have certain rights under Privacy Laws. This may include the right to review, request access, make corrections to, or port your Personal Data and/or information in relation to you, request its deletion or anonymization, or object to or restrict its use for certain purposes.

If you wish to exercise your rights, have any queries on this Notice or any other queries in relation to how we manage your personal data, please contact our Privacy Office/Data Protection Officer at [email protected]. We will respond to any requests in accordance with applicable laws, and so there may be circumstances where we are not able to comply with your request. Notwithstanding your requests, please note, however, that we may retain some information if required by applicable laws. We also have the right to refuse or deny your requests under applicable laws. We may also charge you a reasonable fee for the handling and processing of your requests in accordance with applicable laws and you will be notified in advance of such costs. To the extent permitted by applicable law, please note that we are not required to respond to or deal with your request unless you have agreed to pay the fee.

6. Consent to share others’ information. In any circumstances where you may have provided personal data and/or information relating to other individuals (e.g. your next of kin or dependents), you warrant and represent that you are authorised to provide their personal data and/or information to us and you have obtained their consent for their personal data and/or information to be collected, used, disclosed and/or processed by us in the manner as described in this Notice.

7. Changes. As part of our efforts to ensure that we properly manage, protect and process your personal data, we will be reviewing our policies, procedures and processes from time to time. We reserve the right to amend this Notice from time to time without prior notice. We will ensure that such amendments will be made available to you through any mode we view appropriate and suitable.

8. Declaration and Confirmation. You declare and confirm that the Personal Data and/or information in relation to you that you have provided to us are accurate, not misleading, updated and complete in all aspects. You understand that any misrepresentation or deliberate omission of fact may lead to our suspension or termination of your employment or consideration for employment. Hence, please ensure that you provide complete and accurate personal information to us and keep us updated on any changes to your Personal Data and/or information in relation to you.

9. Consent. You are deemed to have consented and agree to the terms in this Notice with respect to our processing of your Personal Data and/or information in relation to you as described in this Notice and that you declare that you have read, understood and accepted the statements and terms herein. Please note that notwithstanding your withdrawal of consent to any of the above purposes, we reserve our rights to rely on any statutory exemptions and/or exceptions to collect, use, disclose and/or process your personal data.

Date of Issuance: January 16, 2024