1.1 Eupe Corporation Berhad and/or any entities within its corporate group, including the holding Company, subsidiaries, associated, related and affiliated companies as well as their subsidiaries, associated and affiliated companies, both local and international (collectively referred to as "the Company") recognize each individual's data privacy rights and are committed to complying with the Personal Data Protection Act 2010 including any amendments, revisions, or supplementary regulations thereto, which may be enacted or introduced from time to time ("PDPA").

1.2 This Privacy Notice explains how the Company collect, use, disclose, process, transfer, store and protect the Personal Data of the Company's employees (hereinafter collectively be referred to as "Process" and/ "Processing") in connection with the use of all internal systems, software applications, technological platforms, Company website and manual processes and or magazine used by the Company from time to time (collectively, "Company Systems") necessary for effective workforce management, operational security, the smooth administration of the employment relationship, and ensuring the continuity and efficient operation of the Company's business processes.

2.1 "Personal Data" shall have the meaning as ascribed in PDPA, including but not limited to the following: .

2.2 In using the Company's Systems, the Company Process the following categories of your Personal Data:

• a. Identification and contact data including but not limited to your name, National Registration Identity Card number ("NRIC No."), address, employee ID, designation, department, corporate ranking, and personal and business contact information (email, phone number).
• b. Employment data including but not limited to your employment history, reporting structure, and professional qualifications.
• c. Financial and payroll data including but not limited to or the dedicated personal dashboard details, your bank account details, salary, leave records, expense claims, and other entitlement information.
• d. Image and audio-visual data including but not limited to photographs and videos taken at Company's events, meetings, or on Company's premises where you may be featured.
• e. Operational data including any data generated from your use of the Company Systems, including but not limited to meeting room bookings, calendar entries, stationery requests, emails and attendance records.
• f. Any other relevant Personal Data related to your Employment and Company business.

2.3 The Company collect two types of personal data, Obligatory and Optional.

• a. Obligatory Data – This is information the Company require by law or need to manage your employment. This includes but not limited to details like your NRIC No. and bank account for your salary. You must provide this data for your employment.
• b. Optional Data – This is extra information you can choose to provide to improve your staff experience, like photos for Company events. Providing this is your choice.

c. The Data the Company require from you depends on your role and the specific employment-related processes involved.

2.4 "You" and "Your" shall refer to yourself and such other person or companies represented by you of which you are providing the Personal Data.

3.1 The Company Process your Personal Data directly from you, whether voluntarily provided by you or generated through your necessary use of Company's Systems in the course of your employment.

3.2 Personal Data automatically generated by your interaction with all Company Systems. This includes, but is not limited to, access logs, system metadata, operational data, email and records of your activity.

3.3 From within the company, other departments, managers, or colleagues on a need-to-know basis for business purposes (e.g., performance reviews, project assignments).

3.4 From publicly available sources, professional profiles available on public platforms such as LinkedIn, where relevant for business purposes.

3.5 From third parties, from referees provided during your recruitment, background check providers or regulatory bodies.

4.1 Your Personal Data will be processed for the purposes set out below, which include, but not limited to:

4.2 All the purpose hereinabove mentioned shall collectively be referred to as "the Purposes".

5.1 By using the Company's Systems and continuing your employment with the Company, you hereby acknowledge, agree, and consent to the following:

• a. You acknowledge that you have read and understood this Privacy Notice.
• b. You consent to the Company Processing your Personal Data for the Purposes set out in this Privacy Notice.
  • i. To celebrate the Company's achievements and promote our culture, the Company will constantly post photographs and video recordings ("Recordings") taken at Company events. By participating, you are deemed to have consented. If you object, you may opt-out by submitting a "Media Opt-Out Request Form" to the People and Culture Department.
• c. In the event you provide the Personal Data of any third party (emergency contacts, dependents, beneficiaries), you warrant that you have:
  • i. provided said third party with a copy of this Privacy Notice, and
  • ii. obtained their explicit consent for the Company to Process their Personal Data for the related Purposes.
• d. You understand that for processing necessary for your employment contract or legal obligation, consent is not the primary legal basis.

6.1 To facilitate the operation of the Company's business and to fulfil the Company's obligations to you as an employer, the Company will share your Personal Data with the following third parties including but not limited to:

• a. All entities of the Company both within and outside Malaysia.
• b. HR & Payroll Providers.
• c. Professional Advisors.
• d. Banks & Financial Institutions.
• e. Regulatory & Governmental Authorities.
• f. Insurance Providers.

6.2 Notwithstanding the categories listed above, the Company may disclose your Personal Data to any other party that is reasonably involved in the Purposes.

7.1 Under the PDPA, you have the following rights regarding your Personal Data:

• a. Request access to Personal Data the Company hold about you.
• b. Request correction of inaccurate/incomplete data or update.
• c. Withdraw your consent for Processing for specific purposes at any time.
• d. Request to limit Processing in certain circumstances.
• e. Request transfer of your Personal Data to another Controller in machine-readable format (where applicable).
• f. Cross-Border Data Transfer – with your explicit consent and equivalent protection.

7.2 To exercise any of these rights, please contact the Company using the details in Section 10 below.

12.1 As your employer, the Company require certain Personal Data to fulfill our ongoing contractual, statutory, and administrative obligations to you.

12.2 Provision remains mandatory for Purposes related to continued employment. Failure to provide necessary data may prevent us from performing critical functions and could result in our inability to:

• a. Administer your employment benefits accurately (salary, bonuses, insurance).
• b. Process mandatory statutory deductions (EPF, SOCSO, PCB).
• c. Comply with legal and regulatory duties (tax reporting, filings).
• d. Manage your role effectively (performance reviews, training).
• e. Ensure health, safety, and access to facilities and systems.
• f. Receive important company information and updates.

12.3 This may lead to administrative delays, limitation of benefits, or in serious cases, constitute a breach of employment obligations.