T&G Global Limited Privacy Statement – Asia

We will only collect personal information for a lawful purpose, in ways that are fair, reasonable, and not unreasonably intrusive, and only where the personal information is necessary for that purpose. Personal information (which may include sensitive personal information, as defined under Applicable Privacy Law) may be collected directly from you or, where permitted by law, indirectly from third parties.

When you provide personal information to us, we will collect, use, store and disclose that information in accordance with this Privacy Statement and the Applicable Privacy Law.

Unless explicitly advised, you are not legally required to provide us with your personal information. However, certain personal information may be required so that we can deal with you effectively as a customer, supplier, contractor, applicant, or other stakeholder in an efficient and effective manner.

You may choose not to provide personal information to us. However, if you do not provide the personal information requested, we may not be able to:

• provide or continue to provide products or services to you;
• process your employment or contracting application; or
• provide access to some or all of our Digital Platforms.

If you do not want us to collect or use your personal information as outlined in this Privacy Statement, please contact our customer service team to discuss how we might assist.

What personal information do we collect and use and why?

Where we collect, use and disclose personal information, we do so in accordance with Applicable Privacy Law. This may include (but is not limited to) the following situations:

• with your consent or deemed consent;
• in the vital interest of an individual;
• in the public interest or in relation to certain matters affecting the public;
• in the legitimate interest of an organisation (including but not limited to any affiliated entity);
• in relation to certain business asset transactions; and
• for research or business improvement purposes.

The personal information we collect will depend on the nature of your interaction with us. Not all personal information will be collected in every case, but the types of personal information we collect include the following, where allowed under applicable law:

What personal information is collected?	What is the purpose of collection?	What is the basis for collection and how we may collect the data
Customers
Name, Address, Telephone number, Email address (together, “Contact Details”). Call recordings where enquiries are made over the phone (“Call Records”). Credit history or other relevant financial information relating to creditworthiness (together, “Financial Information”).	We use your Contact Details to enable us to: (i) provide the products and services you (or your organisation) have requested; (ii) open a customer account for you (or your organisation); (iii) respond to communications from you, including over the phone; and (iv) facilitate your participation (or your organisation’s participation) in any promotion or competition. We use Call Records for quality control and staff training purposes. We use your Financial Information to enable us to provide the products and services you have requested.	As necessary for our legitimate interests in managing our business and client relationships and ensuring excellent customer service or to fulfil our contractual obligations. As necessary for us to comply with our legal obligations. We may collect this data through the account creation process, when you submit your details through a relevant form, during phone calls and other communications with us, etc and from third parties that hold your data.
Suppliers
Contact Details Call Records Taxpayer identification number Financial Information	We use your Contact Details to enable us to: (i) open a vendor account for you; (ii) receive goods and services from you; and (iii) respond to communications from you including enquiries over the phone. We use Call Records for quality control and staff training purposes. We use your Financial Information to enable us to provide the products and services you have requested.	As necessary for our legitimate interests in managing our business and supplier relationships and ensuring excellent customer service or to fulfil our contractual obligations. As necessary for us to comply with our legal obligations. We may collect this data through the account creation process, when you submit your details through a relevant form, during phone calls and other communications with us, etc and from third parties that hold your data.
Contractors
Contact Details Call Records Taxpayer identification number Financial Information	We use your Contact Details to enable us to: (i) receive goods and services from you; and (ii) respond to communications from you including enquiries over the phone. We use Call Records for quality control and staff training purposes. We use your Financial Information to enable us to pay you for the products and services we have received.	As necessary for our legitimate interests in managing our business and contractor relationships and ensuring excellent customer service or to fulfil our contractual obligations. As necessary for us to comply with our legal obligations. We may collect this data when you make transactions with us, when you submit your details through a relevant form, during phone calls and other communications with us, etc and from third parties that hold your data.
Website User
Contact Details Any information provided to us through your use of the website such as application to a survey, promotion or competition (“Website Information”). Information relating to how you use the website (“Website Improvement Information”).	We use your Contact Details to contact you in relation to your use of the website, for example where you have entered a competition or survey or signed up to a newsletter. We use the Website Information in order to facilitate any of the website products and services which are made available to users and to conduct research, statistical analysis and service improvement. We use the Website Improvement Information in order to improve the user experience of our website.	We process your Contact Details, Website Information, and Website Improvement Information as necessary for our legitimate interests in managing our business and ensuring an excellent website user experience. We process your Contact Details on the basis of your consent in order to provide you with a newsletter if you have signed up to it. We may collect this data when you visit or interact with our website, fill in forms on our website, etc.
Visitor to our locations
Your image	We use CCTV information in order to protect and secure our physical premises, staff and goods.	We process your image via CCTV as necessary for our legitimate interest in ensuring the security of our premises. Your image may be collected as part of our collection via CCTV at our locations.

We also utilise automatic data collection technology solutions such as browser cookies to collect information about how our systems are being used. For more information about this, please refer to the Digital Platforms, Cookies and Analytics section below.

Categories of Personal Information we collect

We may collect personal information including, but not limited to:

Categories of Personal Information We May Collect	Examples of Personal Information We May Collect
Identifiers	Name, alias, home and work addresses, home and work phone numbers, mobile phone number, social security number, driver’s licence number, passport number, tax identification number, other government-issued identification numbers, place and date of birth, personal and work email address, username and password, social media name, signature, customer identification number, your image (only via CCTV where operating)
Commercial and Financial information	Financial account number, credit card number, debit card number, account balance, trading activity, transactions, credit history, credit score, products purchased, services used, payment information, other financial details
Confidential communications	Recordings of conversations
Internet or similar network activity	Browsing history, search history, clickstream data, session information, navigation paths, and other information about how you interact with our websites and mobile applications
Sensitive Personal Information	Social security, driver’s licence, state identification card, or passport number account log-in, financial account, credit card number in combination with any required security or access code, password, or credentials allowing access to an account racial or ethnic origin, religious or philosophical beliefs, or union membership contents of a consumer’s mail, email, and text messages unless the business is the intended recipient of the communication Commercial and Financial information Internet or similar network activity

Collection from you

We collect personal information in different ways, but most of this personal information we collect will be directly from you in circumstances where you voluntarily provide personal information to us such as on or around the time you contact us or purchase a product or service from us. This may include when you:

• open a vendor or customer account;
• apply for employment with us;
• visit any of our locations, or talk to us face to face;
• phone us or our customer service team (we may monitor or record your calls for quality control and/or staff training purposes and will let you know when we do, at the time of the call);
• write to us (for example, by letter, email, SMS, or by following or participating in our social media);
• request, receive or use our products or services, or products and services you receive through us;
• complete one of our forms (such as a customer registration, credit application, competition or survey form);
• use our Digital Platforms (for example, our websites or apps);
• subscribe to any update services we currently or may provide in the future; or
• participate in our promotions and competitions.

We may also collect personal information about how you use third-party websites containing our content. You can learn more about how we collect this personal information in Digital Platforms, Cookies and Analytics.

We may also obtain your personal information from public sources.

We may use camera surveillance at any number of our locations, and we will comply with applicable law. Unless otherwise specified, audio recordings are not made as part of the footage. Covert use of camera surveillance systems may be considered only in circumstances where the law permits it.

Collection from third parties

In addition to collecting personal information directly from you, we may collect personal information about you from third parties where this is permitted by law, including:

• credit reporting agencies;
• financial institutions;
• government agencies (such as for identity, work entitlement or compliance checks);
• law enforcement agencies where required for security checks;
• related companies, including members of the T&G Global Group comprising T&G’s parent companies and subsidiaries (“T&G Group“);
• service providers, data brokers, business partners and consumer reporting agencies;
• publicly available sources, including public registers and online sources; and
• third parties you authorise to provide personal information to us.

Where we collect personal information from someone other than you, we will take reasonable steps to ensure that, either before or as soon as reasonably practicable after collection and before use of the data, you are made aware of the matters required under Applicable Privacy Law unless an exception applies.

Depending on the product or service we provide to you, we may disclose your personal information to other parties in certain circumstances. The parties with whom we may share your personal data and the purposes for sharing are as follows:

Purpose for sharing	Personal information shared	Organisations shared with
To facilitate the provision of products or services you seek or have expressed an interest in.	Contact Details. Your preferences in relation to specific products and services.	Other product and service providers. Other members of the T&G Global Group comprising T&G’s parent companies and subsidiaries (the “T&G Group“). Credit reference agencies. A person acting on your behalf, including an adviser or similar.
Where we need to provide financial and other business information required by law, to obtain finance, to evaluate our financial and operational health or to arrange insurance cover.	Financial Information. Taxpayer identification number.	auditors and regulators as required by law; financial institutions; insurance organisations; an authorised person acting on your behalf, including an adviser or similar.

We will not share your personal information with third parties other than for the purposes set out above unless one of the following conditions or reasons apply:

• the disclosure is required to fulfil any of the purposes set out in this Privacy Statement;
• the disclosure is required to comply with applicable law. For example, where disclosure to third parties or government authorities is required by applicable law.
• The disclosure is for our reasonable belief that such action is necessary to protect or defend the legal rights or property of T&G, our Sites or Apps and the users of them; or in an emergency to protect the health and safety of our Site’s or App’s users or the general public.

International transfers

Your personal information will be used in locations where we or the above third parties are situated. Some of the third parties to whom we disclose personal information are located outside the country in which the data was obtained. Where personal information is disclosed overseas, we take steps to ensure that the overseas recipient is required to protect the personal information in a manner consistent with the requirements of Applicable Privacy Law (as applicable), including through contractual protections or other permitted safeguards. A list of the territories in which these third parties are located, and to which personal information may be transferred, is available here.

Methods of Processing

Your personal information may be collected, processed, and used through automated or non-automated means, including but not limited to written documents, telephone, SMS, fax, email, internet, paper-based formats, or any other methods consistent with the purpose of collection and current scientific technology.

The below statements provide details of our use of AI tools:

• We may use artificial intelligence (“AI“) tools provided by third party vendors to assist with certain business functions, including the creation of marketing content such as copy, images and videos.
• We do not use your personal information to train any AI tools.
• All AI-generated marketing content is reviewed and approved before use.
• Where AI has been used for marketing purposes, this will be clearly disclosed.

How do we secure your personal information?

We ensure there are reasonable security safeguards in place to prevent loss, misuse, unauthorised access, modification, disclosure, or other misuse of your personal information.

Personal information may only be accessed by T&G employees, contractors, professional advisors, authorised third parties, and other service providers on a need-to-know basis, for the purpose(s) for which the personal information has been collected and only in support of legitimate purposes.

We will use all reasonable endeavours when selecting and engaging third parties to whom we will disclose your personal information to ensure that they meet the privacy standards required by Applicable Privacy Law.

We also take reasonable precautions to protect your personal information, including regularly assessing and addressing risks of misuse, interference, loss and unauthorised access, and conducting regular reviews and audits of our security measures.

In the event of a data breach involving your personal data, we will notify you as required and in accordance with the Applicable Privacy Law.

How long is personal information retained?

We retain personal information for as long as necessary to fulfil the purposes for which it was collected. In general, we will retain your personal information throughout the course of our relationship, and for a period of a maximum of 7 years thereafter. However, we may need to retain your personal information for a longer period in order to meet our legal, regulatory, tax, and accounting obligations. Retention periods vary depending on the data type and are reviewed regularly.

If you believe we no longer have the right to retain your personal information, please contact us and we will assess your request.

You have the following rights in relation to the personal information we hold about you as covered by the applicable privacy laws in your country of residence:

• Request access to, including a copy of personal information we hold about you
• Request correction of your personal information
• Restrict certain processing activities
• Request the cessation of the collection, processing and/or use of your personal information
• Request deletion of your personal information
• Withdraw your consent
• Lodge a complaint

These rights apply regardless of whether the information was collected directly from you or from a third party.

We will respond to requests for access to personal information as soon as reasonably practicable and in accordance with timeframes of applicable laws. We will make all reasonable attempts to provide the personal information in the format requested by you or failing which will offer it in a format that we feel should be acceptable. To make a request please contact us.

How can I correct my personal information?

If you believe we hold incorrect personal information about you, you can ask us to correct this by providing the details you believe are incorrect and any new information you would like recorded in its place. Please contact us if you would like to request a correction.

Affiliated Sites

Our Digital Platforms may contain links to other websites that are not controlled or maintained by T&G. We are not responsible for the privacy practices employed by these other websites.

In addition, our Digital Platforms may link to websites owned or operated by subsidiaries or companies affiliated with T&G (“Affiliated Sites”). Please note that the Affiliated Sites may also be subject to the terms of use and policies posted on those sites.

Social media features may be hosted by a third party or by us on our Digital Platforms. If you use the social media features, the privacy policies of the applicable social media providers will apply to that use. We are not responsible for the actions of any social media providers, or any loss incurred as a result of using the social media features.

Cookies

When you use our Digital Platforms, we may collect and use personal information about you through cookies and similar technologies. The collection of personal information may be facilitated by our Digital Platforms directly, through the use of cookies, or by using external third-party services including Google Analytics.

Below are examples of the personal information we may collect:

• your activity on our Digital Platforms, including pages visited and actions taken;
• information about your device, browser, app, operating system and IP address; and
• information gathered through cookies, digital tracking tools and location data.

Cookies and identifying information are an important way we interact with your internet browser. We use them to:

• give you better and more customised services;
• improve our website and advertise more effectively; and
• present more relevant information and advertising to you.

We may provide our analysis and certain non-personal information to potential partners, advertisers (who may use this information to provide advertisements or other information tailored to your interests) or other third parties, but we will not disclose any personal information, except as provided in this Privacy Statement.

You have the option of deciding whether or not to accept a cookie by resetting your browser to notify you whenever a cookie is being sent to your hard drive. You may also delete a cookie manually from your hard drive. Please note, however, that some parts of our Digital Platforms may not function properly or may be considerably slower if you refuse to accept a cookie or choose to disable your cookie settings.

What analytics is occurring?

We may use analytics to monitor performance and improve user experience on our Digital Platforms.

Analytics is about understanding how our Digital Platforms are used, including when, how and by which type of customer. We may use third party software and services to measure the performance of our platforms and third party websites that have T&G content.

We may use this information for various reasons, for example, to:

• analyse collective user behaviour — from user statistics such as the number of page views, number of unique visitors, time spent on the platform, time of visits and types of devices used. We use this information for the purposes explained in our Privacy Statement;
• monitor how our Digital Platforms perform, identify issues and proactively improve your customer experience — application performance monitoring (APM) technology tells us how our platforms work on different browsers; and
• if you log on to secure areas, we can combine your identifying information with your other information (including personal information), for the purposes explained in our Privacy Statement.

We may also use third party software and services to measure the performance of our Digital Platforms, and third-party websites that may have T&G content.

This section describes your rights under the U.S. state laws that may apply to you, including the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), and how to exercise those rights.

Description of your rights

If you are a California resident, you have additional rights:

• Right to Know: Request categories and specific pieces of personal information we have collected
• Right to Delete: Request deletion of your personal information
• Right to Opt-Out: Prevent sale or sharing of your personal information
• Right to Correct: Request correction of inaccurate personal information
• Right to Limit Use of Sensitive Information: Restrict use of sensitive personal information
• Non-Discrimination: You will not face adverse treatment for exercising your privacy rights
• Right to Appeal: If we decline to take action regarding your request to exercise any privacy right, you have the right to appeal the decision.

To exercise these rights, you may submit a request in the following ways:

Email us at

You may also use the Cookie Preferences link located in the footer of our website to manage your cookie preferences.

Verification of Identity

In order for us to process your request, we may first need to verify your identity. For example, if you make a request, we will ask you to confirm your name and email address. For certain requests, we will use a combination of your email address, name, and/or zip code to verify your identity. As permitted by California privacy law, any request you submit is subject to an identification and verification process, which may include attestation under penalty of perjury. We will respond to your request within 45 days of receiving it. If we need more time (up to an additional 45 days), we will notify you in writing.

Authorized Agents

You may designate an authorized agent to make privacy requests on your behalf. Authorized agents must provide us with valid written authorization confirming the agent’s authority to act on your behalf, including the agent’s name, email address, and phone number. You must also verify your own identity by following the instructions above. We reserve the right to verify the validity of any third-party request to exercise privacy rights on behalf of our customers to the fullest extent permitted under applicable data protection law.

Appealing a Denied Request

If we deny all or part of your privacy request, you may have a right to appeal that decision. If you would like to make an appeal, please contact us using the methods in the “How to contact the T&G Privacy Officer” section below, and include your name, email address, physical address, the type of request you made, and the reason for requesting an appeal.

If you have questions or comments about this Privacy Statement, or if you wish to make a complaint or exercise your rights under the applicable privacy law (including access or correction), please contact the T&G Privacy Officer using the details below.

T&G Privacy Officer

Email:

Address: PO Box 56, Shortland Street, Auckland 1140, New Zealand

Complaints

Please contact our Privacy Officer using the details above. We may ask you to put your complaint in writing and to provide relevant details. We will respond to complaints as soon as reasonably practicable and in accordance with timeframes of applicable laws.

Your Rights and Obligations

In addition to the rights outlined in the main body of the Privacy Statement, you also have the following rights:

• To be informed about personal information processing activities;
• To give or refuse consent, and to withdraw consent to the processing of personal information;
• To make denunciations, initiate lawsuits, and claim compensation for damages in accordance with applicable law;
• To request competent authorities or relevant organisations or individuals involved in personal information processing to implement measures to protect their personal information in accordance with applicable law.

Your obligations also include the following:

• To protect your personal information;
• To respect and protect the personal information of others;
• To provide complete and accurate personal information in accordance with applicable law, contractual obligations, or when consenting to the processing of their personal information;
• To comply with laws on personal information protection and participate in the prevention of violations of personal information protection laws.

Collecting personal information

Under What personal information might we collect? the IRD number, your image (only via CCTV where operating), criminal records for employment checks and credit history or other financial details are considered sensitive personal information under the PIPL. Accordingly, we will obtain separate consent from the individual prior to the collection of such information.

Use and disclosure of personal information

Under Who might your personal information be disclosed to? where personal information is disclosed overseas, we will acquire your separate consent in advance and take steps to ensure that the overseas recipient is required to protect the personal information in a manner consistent with the requirements of applicable data protection law in China, including through safety assessment, standard contract or other permitted safeguards.

Where we provide the personal information of an individual to an overseas recipient outside the territory of the People’s Republic of China, we shall inform the individual of such matters as the name of the overseas recipient, contact information, purpose and method of handling, type of personal information and the method and procedure for the individual to exercise the rights stipulated herein against the overseas recipient, and shall obtain the individual’s separate consent.

We will not share your personal information with third parties unless one of the following conditions or reasons apply:

• acquired your separate consent in advance;
• for legal purposes: We may transfer your personal information to third parties and/or Government authorities as required or allowed to by applicable law or regulation.

Rights relating to purposes of use and third-party disclosures

In addition to the rights described in the main body of this Privacy Statement, you may, to the extent permitted under the APPI, request that we notify you of the purpose of use of your personal information which we retain.

You also have the following rights in relation to the disclosure of your personal information to third parties to the extent permitted under the APPI:

• Right to access records of third-party disclosures. You may request access to records concerning the disclosure of your personal information to third parties (and, where applicable, records concerning the receipt of such data from third parties). We will respond to such requests without undue delay, subject to any applicable limitations or exceptions under the APPI.
• Right to request restriction of third-party disclosure. You may request that we cease the provision of your personal information to third parties where such disclosure does not comply with applicable legal requirements or where it may otherwise infringe your rights or legitimate interests. Upon receipt of a valid request, we will assess the circumstances and take appropriate measures in accordance with our legal obligations under the APPI.

Korean Statutory Retention Period

Personal information retained under a statutory obligation will be stored separately and will not be used for any other purpose. When personal information is destroyed, electronic files are permanently deleted using methods that prevent restoration, and printed materials are shredded or incinerated.

Legal Basis	Records	Retention Period
Act on Consumer Protection in Electronic Commerce, etc., Article 6(3); Enforcement Decree, Article 6(1)(2)	Contracts or withdrawal of offers	5 years
Act on Consumer Protection in Electronic Commerce, etc., Article 6(3); Enforcement Decree, Article 6(1)(3)	Payment and supply of goods	5 years
Act on Consumer Protection in Electronic Commerce, etc., Article 6(3); Enforcement Decree, Article 6(4)	Consumer complaints or dispute resolution	3 years