Doc 04 — Privacy Notice (PDPA Notice)

1. Who we are and how this Notice works

1.1 This Privacy Notice explains how DPW Pte. Ltd. collects, uses, discloses, transfers, protects and retains personal data in connection with the Platform (the CSFile technology platform; "UpVue" is the display name of the current Participating Firm's Professional Services), in accordance with the Personal Data Protection Act 2012 of Singapore ("PDPA").

1.2 This Notice applies to the Platform website, client portal, workflow tooling, document collection, communications facilitation, AI-assisted tooling, and billing functions. It is incorporated by reference into Doc 01 — Website Terms of Use, Doc 02 — Platform Terms of Service, and referenced by Doc 03 — Singapore Terms of Business.

1.3 Professional corporate services (such as incorporation, corporate secretarial, registered office and nominee arrangements) are provided by a Participating Firm — a professional firm, including a registered corporate service provider, that contracts with you directly — and never by DPW. This distinction determines who is responsible for your personal data for each activity (Section 2).

2. Our two data protection roles

2.1 Under the PDPA, DPW acts in two distinct roles, and no single role covers everything we do:

(a) DPW as the responsible organisation. For data we collect and use for our own purposes — operating your platform account, securing the Platform, billing and collection where stated, complying with our own legal obligations, and improving our technology services — DPW is the "organisation" responsible under the PDPA.

(b) DPW as a data intermediary. For regulated customer due diligence ("CDD") data, engagement content and other personal data that a Participating Firm requires to deliver Professional Services (including to satisfy its obligations under the Corporate Service Providers Act 2024 and anti-money-laundering law), DPW processes that data on behalf of and for the purposes of the Participating Firm as a "data intermediary" under section 4(2) of the PDPA. The Participating Firm remains the organisation responsible for that data, makes all CDD decisions, and determines the purposes of that processing. DPW's KYC tooling is the Firm's outsourced tool only; no platform feature approves CDD.

2.2 Role by processing activity.

2.3 Where DPW acts as data intermediary, requests about that data (access, correction, withdrawal, erasure) are decided by the Participating Firm; DPW will route your request to the Firm and assist it (see Doc 19 — DPO / Data Subject Request Procedure ("DSR Procedure")). Where DPW is the organisation, DPW decides the request itself.

2.4 The processing relationship between DPW and each Participating Firm is governed by Doc 05 — Data Processing Addendum ("DPA") and Doc 13 — Security / Data-Protection Schedule ("Security Schedule").

3. Contacting us about personal data

Data Protection Officer: dpo@csfile.ai

Privacy enquiries: privacy@csfile.ai

Postal: Data Protection Officer, DPW Pte. Ltd., 247B Victoria St, Singapore 188033.

4. Categories of personal data we collect

4.1 Identity data — name, NRIC number, FIN, passport number, date of birth, nationality, residential address, identity document images (including photographs), and, where video identity verification is used, verification session data.

4.2 KYC / AML data — politically-exposed-person (PEP) declarations, source-of-funds and source-of-wealth information, beneficial ownership information, screening inputs (name and, optionally, date of birth and nationality) and screening results, risk classifications, and CDD supporting documents.

4.3 Corporate and engagement data — company names, proposed structures, shareholdings, director and officer appointments, registered office details, resolutions, registers, filings and related records.

4.4 Financial data — billing contact details, invoicing records, payment status and transaction references. Full payment-card details are collected by our payment processor, not stored by DPW.

4.5 Communications data — messages sent through the portal, emails to our intake mailbox including the contents of intake emails and their attachments, WhatsApp messages exchanged through our messaging integration, and support correspondence.

4.6 Technical and security data — login records, IP addresses, device and browser information, authentication events, audit ledger entries recording actions taken on the Platform, and error/diagnostic logs.

4.7 Support data — the contents of support requests and feedback you send us.

4.8 We may receive personal data about you from a third party — for example, when a Customer or Authorised Representative submits your details as a proposed director, shareholder or beneficial owner. The submitting party warrants under our terms that it has authority and has notified you; if you believe your data was submitted without basis, contact us at the addresses in Section 3.

5. Purposes and legal bases

5.1 We collect, use and disclose personal data for the following purposes and on the following bases:

5.2 NRIC and other national identifiers. We (and the Participating Firm, for whom we hold the data) collect NRIC, FIN and passport numbers only where required or authorised under written law — principally CDD obligations under the Corporate Service Providers Act 2024 and applicable AML/CFT requirements — consistently with the PDPC's Advisory Guidelines on the PDPA for NRIC and Other National Identification Numbers. Your NRIC number is never used to authenticate you or as a password or login credential.

5.3 Where we rely on consent, you may withdraw it (Section 12). Withdrawal does not affect processing that the law requires the Participating Firm or DPW to continue (for example, retention of CDD records).

6. AI-assisted processing

6.1 The Platform uses artificial-intelligence tools to assist with classifying incoming enquiries, extracting information from documents and emails, producing summaries, drafting workflow content, and triaging tasks. AI output on the Platform is advisory: it may be incomplete or incorrect and is subject to human review as described below. Doc 09 — AI Terms governs your use of AI features in detail.

6.2 In the course of this processing, personal data — including identity data extracted from documents and emails — may be processed by the AI model providers listed in Section 8 and in Doc 06 — Subprocessor and Service Provider Notice. Prompts sent to AI providers pass through a mandatory sanitisation gateway: apart from one document/email extraction task sent to a single foundation-model provider under a fail-closed deployment guard, AI tasks are sent with identifiers redacted (NRIC/FIN, passport numbers, email addresses, phone numbers, dates of birth and addresses are replaced before sending; names are not redacted).

6.3 Automated processing and human decisions. Automated risk classification assists the screening workflow: a clear screening result may automatically mark a screening record as verified and assign a preliminary risk rating, and any match or error always creates a mandatory human review task. However, no engagement is approved and no filing is made without a human professional decision: KYC approval is made by authorised staff of the Participating Firm, and any ACRA filing is performed manually by the Firm's qualified professional. The workflow proceeds in distinct steps — AI recommendation, screening-provider result, staff review, professional approval, filing authorisation, filing submission, government acceptance, incorporation completion — and no step substitutes for another.

6.4 We operate our AI features in accordance with the PDPC's Advisory Guidelines on the Use of Personal Data in AI Recommendation and Decision Systems, including the notification made in this Section about the function of AI in our workflows, the data involved, and the human oversight applied.

7. Disclosures and recipients

7.1 We disclose personal data to:

• Participating Firms — the Firm handling (or evaluating whether to handle) your Engagement receives the data needed for the Professional Services and its legal obligations. The Firm is the responsible organisation for that data and should provide its own privacy information for its processing.
• Service providers and subprocessors — the vendors listed in Section 8, who process data for the functions described there and in Doc 06.
• Authorities — ACRA, IRAS, law enforcement, courts, regulators and other public agencies, where disclosure is required or authorised by law.
• Professional advisers and insurers — our auditors, lawyers and insurers, under confidentiality obligations, where reasonably necessary.
• Corporate transactions — a prospective or actual acquirer or successor of our business, under safeguards required by the PDPA's business asset transaction provisions.

7.2 We do not sell personal data.

8. Named subprocessors and service providers

8.1 The following providers process personal data in connection with the Platform. Doc 06 — Subprocessor and Service Provider Notice is the maintained register for this list, including each provider's status and our change-notification mechanism; if this section and Doc 06 differ, Doc 06 (as most recently updated) prevails.

8.2 Google Drive connected-source import. If a Firm connects a Google Drive folder to import documents into the Platform, our access to and use of the information we receive from that Google API adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• Access: we request read-only access to the single folder the connecting staff member selects, using Google's drive.readonly scope; we never request or use write, delete, or whole-Drive access.
• Use: files in that folder are retrieved solely to bring them into the Firm's document vault for the workflow the Firm requested (e.g. KYC/CDD, incorporation, statutory records, corporate-secretarial, accounting or tax work) — never for advertising, never to build user profiles unrelated to that workflow, and never transferred to any third party except where necessary to deliver the Professional Services and consistent with Section 7.
• Storage: retrieved files are stored in our primary data store on the same basis as any other document you or the Firm upload directly, subject to Doc 17 — Document Retention / Records Notice.
• Sharing: retrieved files are visible only to the appointed corporate-service professional and any other staff/service providers who would otherwise see a directly uploaded document for that Engagement — never to another Firm or another Business Customer.
• Revocation: the connecting staff member can disconnect the Google Drive connection at any time from Settings → Integrations, which revokes UpVue's Google OAuth grant; you can independently revoke access at any time via your Google Account permissions. Revocation does not delete files already imported into the vault — those remain subject to Doc 17's retention terms like any other document.
• We do not modify or delete files in your Google Drive.

8.3 MyInfo/Singpass is not integrated; we make no government identity-service disclosures.

8.4 We update this list through Doc 06 under the change mechanism described there: at least 30 days' notice of any subprocessor addition or replacement, given by both register update and direct notice to Participating Firms and affected Business Customers, with an objection window on data-protection grounds.

9. Overseas transfers

9.1 Primary customer and engagement data is stored in Singapore-region cloud infrastructure. However, some of the service providers listed in Section 8 process data outside Singapore (including in the United States and the European Union), and hosting and delivery infrastructure may route data through other regions.

9.2 Where personal data is transferred outside Singapore, we do so in accordance with section 26 of the PDPA: we transfer only where the recipient is bound by legally enforceable obligations to provide a standard of protection comparable to the PDPA — principally contractual data protection clauses with each provider, and, where applicable, the recipient's binding corporate rules or certifications recognised for this purpose. The mechanism for each provider is recorded (or placeholdered pending verification) in Section 8 and maintained in Doc 06.

9.3 We do not claim that all data stays in Singapore, and you should not rely on any such assumption.

10. Security

10.1 We protect personal data with security arrangements appropriate to its sensitivity, including:

• Field-level encryption: NRIC, passport numbers, dates of birth, residential addresses and raw screening results are encrypted at field level using AES-256-GCM; the Platform refuses to store this data if the encryption key is not configured.
• Private document storage: identity documents are held in private storage buckets accessible only through short-lived signed URLs (default validity one hour).
• Access control: role-based access control for staff functions, with dual approval for certain sensitive actions.
• Audit ledger: actions on records are logged to an audit ledger.
• Encryption in transit and platform-level security controls described in the Security Schedule (Doc 13).

10.2 No system is perfectly secure; Section 14 describes what we do if a data breach occurs.

11. Retention

11.1 We retain personal data only as long as necessary for the purposes above, for legal and regulatory requirements, or as the Participating Firm instructs for data we hold as its data intermediary. Doc 17 — Document Retention / Records Notice ("Retention Notice") sets out the retention framework and classes.

11.2 In particular, CDD and related records held for a Participating Firm are retained for at least five (5) years after the end of the business relationship (or such longer period as law requires), as required of registered corporate service providers.

11.3 Specific retention periods for other record classes are under confirmation [CQ-RET-1 — RETENTION PERIODS TO BE CONFIRMED BY COUNSEL]. Deletion is currently performed by scheduled review and on valid request, not by automatic time-based purge.

12. Your rights

12.1 Access. You may request access to personal data we hold about you and information about how it has been used or disclosed in the past year. We respond as soon as reasonably possible; if we cannot respond within 30 days, we will inform you in writing within 30 days of the soonest time by which we can respond.

12.2 Correction. You may ask us to correct an error or omission. We will correct it as soon as practicable and, where relevant, send the corrected data to organisations to which the data was disclosed within the preceding year, unless an exception applies.

12.3 Withdrawal of consent. You may withdraw any consent you have given, on reasonable notice, by contacting us (Section 3) or using in-product controls where available. We will explain the likely consequences (for example, that we can no longer provide the Platform Services, or that the Participating Firm cannot proceed with an Engagement). Withdrawal does not affect processing required or authorised by law.

12.4 Erasure requests. You may request deletion of your personal data. We will action valid requests, subject to statutory carve-outs: we and the Participating Firm must retain data where law requires (including the 5-year CDD retention obligation), where needed for legal claims, or where another PDPA exception applies. [CQ-RET-2 — ERASURE CARVE-OUTS TO BE CONFIRMED BY COUNSEL]

12.5 Requests concerning Firm-controlled data. Where your request concerns data we process as the Participating Firm's data intermediary, we will forward the request to the Firm without undue delay and assist it in responding; the Firm decides the request.

12.6 The DSR Procedure (Doc 19) sets out how to make a request, identity verification, timelines and any permitted fees.

13. Cookies

The Platform uses authentication/session cookies and a consent-managed framework for any optional categories. No third-party analytics or marketing trackers are currently set. See Doc 07 — Cookie Notice.

14. Data breach response

14.1 If we suspect a data breach, we assess it expeditiously to determine whether it is notifiable under the PDPA.

14.2 If a breach is assessed as notifiable — because it is likely to result in significant harm to affected individuals (including breaches involving NRIC numbers or financial data of the prescribed kinds) or is of significant scale (500 or more individuals) — we will notify the PDPC as soon as practicable and in any event within three (3) calendar days after that assessment, as required by section 26D of the PDPA.

14.3 Where a breach is likely to result in significant harm to you, we will also notify you as soon as practicable under section 26D of the PDPA, unless an exception applies (for example, where remedial action or law-enforcement instructions apply).

14.4 Where a breach affects data we process as a data intermediary, we will notify the responsible Participating Firm without undue delay, as section 26C(2) of the PDPA requires of a data intermediary, so the Firm can meet its own obligations; the notification duties above then apply to the Firm as the responsible organisation, with our assistance.

15. Children

The Platform is a business service and is not directed at minors. We do not knowingly collect personal data directly from individuals under 18 for account purposes. Where the law requires CDD on a minor (for example, a minor shareholder), the data is collected from the responsible adult or corporate representative and handled under Section 2.1(b).

16. Third-party sites and services

The Platform may link to third-party sites (including government portals and Participating Firms' own sites). Their privacy practices are their own; this Notice does not cover them.

17. Changes to this Notice

We may update this Notice from time to time. We will post the updated version with a new version date and, for material changes, give reasonable advance notice through the Platform or by email. Continued use after the effective date constitutes acceptance to the extent permitted by law; where a change requires fresh consent, we will seek it.

18. Complaints

If you are unhappy with how we handle your personal data or a request, please contact our DPO first (Section 3); Doc 18 — Complaints, Support & Escalation Policy ("Complaints Policy") describes our process. You may also lodge a complaint with the Personal Data Protection Commission (PDPC), Singapore: www.pdpc.gov.sg.