DATA PROTECTION POLICY 7.0 (JULY 2026)

This Data Protection Policy outlines how EAAA Pte. Limited (“EAAAPL”) manages Personal Data which is subject to the Singapore Personal Data Protection Act 2012 (No. 26 of 2012) (“the PDPA”) as amended from time to time. Please take a moment to read this Data Protection Policy so that you know and understand the purposes for which we collect, use and disclose your Personal Data.

By interacting with us, submitting information to us, or signing up for any Products and Services offered by us, you agree and consent to EAAAPL (including its related corporations), as well as their respective agents, authorised service providers and relevant third parties (collectively referred to herein as “Edelweiss”, “we”, “us” or “our”) collecting, using, disclosing and/or sharing your Personal Data in the manner set forth in this Data Protection Policy.

This Data Protection Policy supplements but does not supersede nor replace any other consents which you may have previously provided to us nor does it affect any rights that we may have at law in connection with the collection, use and/or disclosure of your Personal Data. We may from time to time update this Data Protection Policy to ensure that this Data Protection Policy is consistent with our future developments, industry trends and/or any changes in legal or regulatory requirements.

1. Personal Data

In this Data Protection Policy, “Personal Data” refers to any data, whether true or not, about an individual who can be identified (a) from that data; or (b) from that data and other information to which we have or are likely to have access.

Examples of such Personal Data include (depending on the nature of your interaction with us):

1. your name, NRIC, passport or other identification number, telephone number(s), mailing address, email address and any other information relating to you which you have provided us in any forms you may have submitted to us, or in other forms of interaction with you;
2. your employment history, education background, and income levels.

2. Collection of Personal Data

Generally, we collect Personal Data in the following ways:

1. when you submit an application form or other forms you may complete, agreements you enter into with us or in the course of your establishing or maintaining a client relationship with us regarding an investment product or vehicle including your name, postal and email address, ongoing statements and other related information. This is to allow us to complete your transaction and also to provide confirmation of the transaction to you;
2. when you interact with our representatives, for example, via telephone calls, letters, face-to-face meetings and emails;
3. when you request that we contact you, be included in an email or other mailing list;
4. when you respond to our promotions, initiatives or to any request for additional Personal Data;
5. when you are contacted by, and respond to, our marketing representatives;
6. when we receive references from business partners and third parties, for example, where you have been referred by them;
7. when we seek information from third parties about you in connection with the Products and Services you have applied for; and
8. when you submit your Personal Data to us for any other reasons.

EAAAPL is also able to collect, use or disclose personal data without the consent of an individual if it is for legitimate interest or for business improvement purposes, among a few other purposes stated in the PDPA.

Under the legitimate interest exception, EAAAPL may collect, use, or disclose personal data about an individual without consent where it is in the legitimate interests of EAAAPL and the legitimate interests of EAAAPL outweigh any adverse effect on the individual. Examples where the legitimate interests exception may apply includes fraud and money laundering detection, threats to safety and physical security and ensuring IT and network security.

For the business improvement exemption, EAAAPL may collect, use, or disclose personal data without consent where the purpose of processing is for certain business improvement purposes, which include developing or enhancing our operational methods or processes, developing or enhancing our products/services, and learning about and understanding the behavior and preferences of EAAAPL’s customers in relation to our products/services.

You should ensure that all Personal Data submitted to us is complete, accurate, true and correct. Failure on your part to do so may result in our inability to provide you with the Products and Services you have requested.

3. Purposes for the Collection, Use and Disclosure of Your Personal Data

Generally, we collect, use and/or disclose your Personal Data, including any additional information you may subsequently provide, for the following purposes:

1. processing of your application for units in the fund or sub-fund;
2. to complete the information on the register of unitholders of the fund or sub-fund;
3. to contact you and to send statements/notices to you relating to your account and holdings therein;
4. to carry out your instructions or respond to any enquiry from you;
5. to deal with any other matters relating to your account and holdings therein;
6. to form part of the records of the recipient as to the business carried out by it;
7. communicating with you to inform you of changes and updates to our policies, terms and conditions and other administrative information;
8. to observe any legal, government or regulatory requirements of Singapore or other relevant jurisdiction including any disclosure or notification requirements to which any recipient of the data is subject;
9. to satisfy the responsibility relating to ‘Know Your Customer’ (KYC) requirements; and
10. other purposes, directly or indirectly relating to any of the above activities.

(hereinafter collectively referred to as the “Purposes”).

Where you have specifically provided us with consents, we may also collect, use and/or disclose for the following purposes: (i) sending you marketing updates on our funds; (ii) promoting and administering events, contests and competitions; and (iii) developing marketing programmes. EAAAPL will comply with applicable requirements under the PDPA, including the Do Not Call Registry provisions where relevant.

4. Disclosure of Personal Data

EAAAPL treats your Personal Data as private and confidential and does not reveal it to any third parties except where such action is necessary to comply with legal and regulatory requirements or to protect and defend the rights of its customers.

Subject to the above, EAAAPL may disclose and/or transfer your Personal Data to third parties in cases where is necessary for providing services to you and/or if you have expressly or you have deemed to have consented for the same.

Deemed consent is given when an individual does not actively consent but voluntarily provides personal data to EAAAPL for the purpose for which it is being collected, when an individual’s personal data is disclosed by an organisation to a third party as part of that organisation’s contractual obligations, or when an individual is notified about the collection, use or disclosure of his/her personal data but did not take any action to opt out. Deemed consent given to EAAAPL by conduct, by contractual necessity and by notification will strictly be in accordance with the PDPA.

We may share your Personal Data without obtaining your prior written consent, with governmental and/or quasi-governmental departments and/or agencies, regulatory and/or statutory bodies, any court and/or officer of a court, where such disclosure is required by law or where we in good faith believe that such action is necessary to comply with a current judicial proceeding, a court order or legal process served on us, or to establish or exercise our legal rights or defend against legal claims.

Where EAAAPL discloses your Personal Data to its holding company, subsidiaries, related and/or associated company, affiliates, delegates, trustee(s), business partners, and/or service providers, or any third party and/or agents (including outsourcing agents and data processors), for any of the above Purposes or any other purpose for which your Personal Data was to be disclosed at the time of its collection or any other purpose directly related to any of the above Purposes, such party will be obligated to use the Personal Data in accordance with, inter alia, the confidentiality terms and conditions contained in the agreements entered into with them.

Personal Data that EAAAPL collects from you may be stored and processed in and transferred between any of the countries in which EAAAPL’s holding company, subsidiaries, related and/or associated company operate to enable the use of the same in accordance with this Data Protection Policy. You agree to such cross-border transfers of your Personal Data in accordance with paragraph 8 below.

5. Securing your Personal Data

EAAAPL will take reasonable technical and organizational precautions to prevent the loss, misuse or alteration of your Personal Data. EAAAPL maintains strict security systems designed to prevent unauthorised access to your Personal Data by anyone, including our staff. EAAAPL will store all the Personal Data you provide in a secure environment protected from unauthorised access, modification or disclosure.

6. Accountability and Data Protection Governance

EAAAPL maintains and implements policies and practices necessary to meet its obligations under the Personal Data Protection Act 2012 (“PDPA”). These policies and practices include data protection governance measures, employee awareness and training programmes, procedures for handling complaints and enquiries relating to Personal Data, periodic reviews of data protection controls and monitoring of compliance with applicable data protection requirements.

7. Personal Data Access

As soon as reasonably possible after a request from an individual to access his or her personal data, EAAAPL should provide the individual with:

1. Personal data about the individual that is in its possession or control; and
2. Information about the ways in which such personal data has been or may have been used or disclosed by it within a year before the date of the request.

If EAAAPL is unable to respond to an access request within 30 days after receiving such request, it must within that 30-day period, inform the individual in writing of the time line within which it will respond to that request.

EAAAPL need not provide access to personal data in circumstances set out in the PDPA’s Fifth Schedule such as where personal data is subject to legal privilege or personal data if disclosed, would reveal confidential commercial information that could in the opinion of a reasonable person, harm EAAAPL’s competitive position.

An individual may also request EAAAPL to correct an error or omission in his/her personal data that is in EAAAPL’s possession or control. If EAAAPL is satisfied that such correction is reasonable, it should make the correction as soon as practicable. In addition, it should send the corrected personal data to every other organisation to whom the personal data was disclosed by it within a year before the date the correction was made, unless that other organisation does not need the corrected personal data for any legal or business purpose.

However, EAAAPL does not need to adhere to a request for correction in circumstances set out in the PDPA’s Sixth Schedule (e.g.: where a document relates to a prosecution if all proceedings related to that prosecution have not been completed).

8. Contacting Us – Withdrawal of Consent, Access and Correction of your Personal Data

If you:

1. have any questions or feedback relating to your Personal Data or our Data Protection Policy;
2. would like to withdraw your consent to any use of your Personal Data as set out in this Data Protection Policy; or
3. would like to obtain access and make corrections to your Personal Data records,

please contact us by writing in to:

Data Protection Officer
EAAA Pte. Limited
3 Church Street, #21-05 Samsung Hub, Singapore 049483
Email: dpo@eaaapl.sg

The Data Protection Officer (DPO) of EAAAPL is Carin Wong. The DPO oversees EAAAPL’s compliance with the PDPA, responds to enquiries and complaints relating to personal data, and coordinates data protection initiatives within EAAAPL.

You, however, understand that your right to removal/destruction shall be subject to EAAAPL’s need to retain your personal data for legal and business purposes, such as EAAAPL’s legal and regulatory obligations to maintain and retain such records in order to comply with applicable law and judicial /quasi-judicial orders, to resolve disputes, if any, to which we are subject or as long as required to provide you with services.

9. Transfer of Data outside of Singapore

Before transferring customer personal data outside Singapore, if required, EAAAPL must take appropriate steps to ascertain whether and to ensure that the recipient of the personal data in that country or territory is bound by legally enforceable obligations granting the transferred personal data a standard of protection that is at least comparable to the protection under the PDPA.

In addition, EAAAPL may transfer personal data outside Singapore in certain circumstances set out in the PDPA, such as where:

1. The individual consents to the transfer of personal data to that recipient outside Singapore;
2. The transfer of personal data to the recipient is reasonably necessary for the performance of a contract between the individual and EAAAPL.

An individual is not taken to have consented to the transfer of his/her personal data to a country or territory outside Singapore if:

1. He/she was not, before giving consent, been provided with a reasonable summary in writing of the extent to which his/her personal data will be protected to a standard comparable to that under the PDPA;
2. EAAAPL required the individual to consent to the transfer as a condition of providing a product or service, unless the transfer is reasonably necessary to provide the product or service to the individual; or
3. EAAAPL obtained or attempted to obtain the individual’s consent for the transfer by providing false or misleading information about the transfer, or by using other deceptive or misleading practices.

10. Accuracy and Retention of Personal Data

EAAAPL shall make a reasonable effort to ensure that personal data collected by or on its behalf is accurate and complete, if the personal data is likely to be used by it to make a decision that affects the individual to whom the personal data relates (for example whether or not it should on-board a customer during the conduct of AML/KYC procedures) or, if it is likely to be disclosed by EAAAPL to another organisation.

EAAAPL shall protect personal data in its possession or under its control by making reasonable security arrangements to prevent unauthorized access, collection, use, disclosure, copying, modification, disposal etc. EAAAPL should achieve this by implementing physical and IT security procedures as part of its internal controls and risk management.

EAAAPL has established procedures in place to protect the safety and confidentiality of client data across both electronic and physical IT systems and at its office premises. Client personal information is collected and stored in a specific databases which are accessible by only authorized employees and will be subject to EAAAPL’s privacy policy and procedures.

Client personal data is stored until at least 5 years after the purpose for which it was collected has been completed if necessary for legal and business purposes. For example, if a client redeems its investment and terminates its contract with EAAAPL, its data will be retained for such period for both legal and regulatory reasons.

11. Personal Data Treatment in relation to Anti-Money Laundering

Where its obligations under anti-money laundering regulations require, EAAAPL is not bound to obtain an individual’s consent for the collection, usage or disclosure of that individual’s personal data. In such circumstances and in accordance with applicable law, EAAAPL may without the individual’s consent, obtain directly or through a third party, personal data of an individual customer, an individual person appointed to act on behalf of a customer, an individual connected party of a customer or an individual beneficial owner of the customer.

Similarly, in order to comply with its obligations under anti-money laundering regulations and in accordance with applicable law, EAAAPL shall not be required to provide an individual customer, an individual appointed to act on behalf of a customer, an individual connected party of a customer or an individual beneficial owner of a customer, with:

1. Access to personal data about the individual that is in EAAAPL’s possession or control;
2. Descriptions of the manner in which such personal data has been used or disclosed by EAAAPL; or
3. Access to correct an error or omission in such personal data.

12. Notification of Data Breaches

EAAAPL is required to notify the Personal Data Protection Commission (“PDPC”) of a data breach that:

1. results in, or is likely to result in, significant harm to the affected individuals; or
2. is of a significant scale.

A data breach has been defined as (a) the unauthorised access, collection, use, disclosure, copying, modification or disposal of personal data; or (b) the loss of any storage medium or device on which personal data is stored in circumstances where the unauthorised access, collection, use, disclosure, copying, modification or disposal of the personal data is likely to occur.

Where EAAAPL has discovered or a service provider of EAAAPL has notified EAAAPL that a data breach has occurred, EAAAPL is required to immediately conduct an assessment to determine if the data breach is a notifiable data breach. EAAAPL is required to no later than 3 calendar days after making the assessment, report the notifiable breach to the PDPC.

EAAAPL is also required to notify each affected individual affected by the data breach if the breach is likely to result in significant harm to individuals except where (i) EAAAPL has taken timely remedial actions such that the likely harm or impact to the affected individual will not be significant or (ii) the compromised personal data is subject to technological measures implemented prior to the occurrence of the data breach such that the likely harm or impact to the affected individual will not be significant (e.g. encryption); or (b) a prescribed law enforcement agency or the PDPC prohibits such notification.

13. Data Portability

An individual may give EAAAPL a data porting request for EAAAPL to transmit to a receiving organization, the applicable data about the individual specified in the data porting request. EAAAPL must upon receiving the data porting request, transmit the applicable data specified in the data porting request to the receiving organisation in accordance with any prescribed requirements only if at the time of receiving the data porting request –

1. EAAAPL has an ongoing relationship with the individual; and
2. The receiving organization is either formed under the laws of Singapore or is resident, has an office or place of business in Singapore.

Should EAAAPL for any reason not transmit any applicable data about an individual, EAAAPL must, within the prescribed time and in accordance with the prescribed requirements, notify the individual of the refusal.

14. Review of Data Protection Policy

The Data Protection Policy will be reviewed at yearly intervals or as and when necessary.