1. Document Control

• Document Title: Privacy Policy

• Document Identifier: POL-ALL-014

• Version Number: v1.0

• Approval Date: <23 June 2025>

• Effective Date: <23 June 2025>

• Review Date: <23 June 2026>

• Document Owner: <Chief Privacy Officer>

• Approved By: <Data Protection and Compliance Committee>

2. Purpose

The purpose of this Privacy Policy is to define ’s commitment to protecting the personal information of its customers, employees, contractors, and partners. This policy establishes the principles, roles, and controls required to ensure the lawful, fair, and transparent processing of personal data in accordance with global privacy regulations and best practices.

This policy aligns with SOC 2 Privacy Trust Services Criteria P1.1 and P1.2, which require organizations to communicate their privacy commitments and implement systems to ensure compliance with stated policies. It also supports ISO/IEC 27001:2022 Controls A.5.34 (Privacy and protection of PII) and A.5.35 (Regulatory and contractual requirements for PII).

3. Scope

This policy applies to all personal information collected, stored, processed, or transmitted by , regardless of format or medium. It covers:

• Personal data of customers, employees, contractors, job applicants, and third parties

• Data collected through websites, applications, communications, and third-party sources

• Systems and services hosted internally or by vendors on behalf of

The policy is binding on all employees, contractors, and third parties with access to personal data under the organization’s control.

4. Policy Statement

is committed to safeguarding personal information and shall ensure:

1. Lawful Processing: Personal data is collected and used only for legitimate business purposes with appropriate legal basis (e.g., consent, contract, legal obligation).

2. Transparency: Individuals are informed about how their data is used through privacy notices and policies.

3. Purpose Limitation: Data is only processed for specified and legitimate purposes and not further processed in ways incompatible with those purposes.

4. Data Minimization: Only the minimum necessary personal data is collected and retained.

5. Accuracy: Reasonable steps are taken to ensure personal data is accurate and up to date.

6. Storage Limitation: Data is retained no longer than necessary for the intended purpose or legal obligations.

7. Integrity and Confidentiality: Security measures are implemented to protect personal data from unauthorized access, alteration, or loss.

8. Data Subject Rights: Individuals can exercise rights such as access, correction, deletion, and objection in accordance with applicable laws.

5. Safeguards

enforces the following privacy safeguards: