Stepup (SUP) Pte Ltd hereinafter referred to as "SUP", respects the privacy of all users of its website and online services and we do not collect information about our users without their knowledge. SUP has based its privacy policy on the Personal Data Protection Act 2012 (the "PDPA"), which is reviewed and updated periodically in accordance with the latest amendments to the PDPA or guidelines or regulations issued by the Personal Data Protection Commission (the "PDPC").

What does this Policy Cover?

1.1 This Privacy Policy sets out the principles that SUP follows when collecting, using, disclosing, retaining and removing personal data, that can be used to identify you as an individual whether on its own or in conjunction with other data accessible by us in compliance with the PDPA. This Privacy Policy also describes other important topics relating to an individual's data privacy and applies to all users of SUP's website and online services.

1.2 By accessing SUP's website and using SUP's online services, communicating with SUP through email, by telephone, in writing, or by providing your personal information to SUP, you thereby consent and agree to the collection of your personal data in the manner described in this policy.

Collection of Personal Data

2.1 SUP only collects, uses and discloses personal data with an individual's consent or deemed consent or as otherwise permitted under the PDPA or other applicable laws and regulations.

2.2 In order for SUP to render and perform the services contracted between SUP and the individual, it is necessary for SUP to collect and use certain personal data.

2.3 While the specific types of Personal Data you submit through SUP's website may vary depending on the services used and rendered, and whether you maintain an account with us, these are the broad categories of Personal Data which are collected by us:

• (a) Your name;
• (b) Identity Data (which includes your country of residence, job title, age, marital status and/or gender);
• (c) Contact Data (which includes your email address and telephone number);
• (d) your Resume or Curriculum Vitae;
• (e) Transaction Data (which includes your credit card details, your billing address, your mailing address and other details of services that you have purchased from us);
• (f) Records of communications with SUP;
• (g) Usage Data (which includes information about how you use our website and webapps (including the time you visited our website, the duration of your visit, the types of services you are searching for and/or how you are searching for such products and/or services);
• (h) Marketing and Communications Data (which includes your interests, feedback, survey responses, preferences in receiving marketing materials from us and your communication preferences, as well as your preferences for a product or service);
• (i) Technical Data, which includes your Internet Protocol (IP) address, the internet device identity or media access control address of your device, information regarding the manufacturer, model or operating system of the device that you use and/or information about the web browser that you use to access our website);
• (j) Data for ensuring IT security and resource management and site security, with view of improving SUP's website; and
• (k) Data in compliance with applicable laws and regulations of regulatory authorities and enforcement agencies.

2.4 SUP may collect your Personal Data from you in one of the following ways:

(a) Directly from you when you provide us with your identity, contact, profile and transaction data through one or the following (whether on your own behalf or on behalf of your organisation):

• i. Use our website;
• ii. Create an account on our website;
• iii. Enter into a contract with us for the purchase of our services;
• iv. Apply for or enquire about our website or services;
• v. Participate in a promotion, survey, event or other marketing campaign organized by us;
• vi. Subscribe to our newsletters or alerts;
• vii. Request for marketing materials to be sent to you; or
• viii. Contact us, if you get in touch to provide us with some feedback.

(b) When you interact with our website. As you interact with our website, we may automatically collect your technical data through for example, website cookies.

2.5 There may be situations where SUP collects and uses personal data which are outside a person's reasonable expectation. When this occurs, SUP is committed to providing the relevant individual with an explanation for the possible use of the personal data when asking for the individual's consent.

2.6 We use "cookies" to provide visitors with a personalized experience on our website. Cookies are pieces of information that a website transfers to the memory or hard drive of a visitor's computer for record-keeping purposes. We may use "cookies" to retrieve and store information specific to your computer and on use of the website and the online services via your computer. We also use this information to verify that visitors meet the criteria required to process their requests.

2.7 Most browsers used by visitors have options that allow the visitor to control whether the browser will accept cookies, reject cookies, or notify the visitor each time a cookie is sent. As such, you may disable the cookies by changing the setting on your browser. However, if you do disable or refuse the use of cookies, please note that some parts of our website may not function properly and you may not be able to access or use some features on the website. You have the right to delete your cookies from your browser program at any time.

2.8 SUP does not collect sensitive information without the individual's consent and only if it is specifically relevant and necessary for SUP's primary purpose of conducting, improving, maintaining and developing a business relationship. All sensitive information is collected and used in accordance with this privacy policy.

2.9 In processing personal data, SUP shall take into account the nature of its sensitivity, and will only process sensitive data upon the express consent of the individual and only for the purposes for which it was provided, or in accordance with the law. SUP shall also inform individual of the sensitive data that is necessary to fulfill the core functionality of the product or service, and the consequences of refusal to the processing, for the purpose of allowing the data subjects to decide whether or not to give consent.

2.10 SUP does not knowingly collect personal data from children under the age of 13. Should you be under the age of 13, please do not provide personal data of any kind whatsoever. If a child under the age of 13 provides SUP with personal data, a parent or guardian of that child may have request to have this information deleted from SUP's records by submitting a written request to the Data Protection Officer at DPO@supcareer.app.

2.11 In accordance with the PDPA, SUP also reserves the right to share your Personal Data as required to prevent a threat to the life, health or security of an individual or corporate entity. Further, SUP may disclose your Personal Data to law enforcement agencies, government representative(s) and our advisers, as required, to investigate any suspected or actual unlawful activities, including but not limited to fraud, intellectual property infringement or breach of privacy.

Use of Personal Data

3.1 The use of your personal information for these purposes will be kept to the minimum required. Where necessary, SUP may also use the information to resolve any disputes that may arise.

3.2 First, SUP may use your Personal Data for the following purposes:

• (a) To register you as a new customer;
• (b) To process and deliver the services contracted for to you;
• (c) To manage your account, including managing payments, fees and charges and collection of fees due to us;
• (d) To manage our relationship with you;
• (e) To better the services of SUP and its business partners;
• (f) Tracking and verifying compliance with SUP's internal personal data protection policies;
• (g) Meeting laws and/or for fulfilling editorial and feedback solicitation purposes;
• (h) To administer, operate, provide, maintain and protect our business and our website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data, as well as ensuring that unauthorized users do not access the information on our website);
• (i) To deliver relevant information about our events, news, announcements or promotions;
• (j) Where SUP has to use your Personal Data for another purpose as required by law or regulation, for example, to respond to administrative, judicial or law enforcement requests or to comply with applicable laws and regulations;
• (k) To identify goods or services that may be suitable for customer(s) or personalising/customising such goods or services for customer(s);
• (l) To contact you in relation to all of the above; and
• (m) Where permitted under the PDPA, and any amendments thereto which may be passed by law from time to time, or any other applicable law.

3.3 Second, SUP may also transfer this information to other affiliates of SUP for purposes of updating and enhancing their respective records and for SUP and its affiliates to:

• (a) collect, retain, use, process and disclose your personal information;
• (b) monitor your access to and use of this website and its various services;
• (c) contact you by telephone and/or e-mail; and
• (d) advise you of products and services which may be of interest to you.

3.4 Third, SUP may also disclose and share aggregate information about our users with advertisers, business partners, sponsors and other third parties. This data is used to customise SUP's content and advertising to deliver a better experience to users.

3.5 We will only use your Personal Data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If there is any change in the purpose for which we collect your Personal Data, we will inform you of such change by way of website pop-up screen and email via the email address that you have provided to us earlier. If you wish to have an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact SUP at DPO@supcareer.app. If we need to use your Personal Data for an unrelated purpose, we will notify you and explain the legal basis which allows us to do so.

Disclosure of Personal Data

4.1 SUP will only disclose Personal Data in the following situations:

• (a) For the primary purpose(s) for which it was collected;
• (b) For purposes that a reasonable person will consider appropriate in the circumstances;
• (c) Where the individual in question has provided consent;
• (d) For direct marketing by SUP where consent has been given but giving individuals the opportunity to opt out of such marketing. SUP includes its contact details in any direct marketing; or
• (e) Where permitted under the PDPA or any other applicable law, or if required by law.

4.2 SUP does not disclose your personal data for any secondary purposes unless your consent has been given or if so permitted or required under the PDPA or any other applicable laws and regulations.

4.3 Other than those individuals and entities listed below, your personal information will not be revealed by SUP to any external body. SUP does not disclose your Personal Data to unaffiliated third parties for their independent use unless we have obtained your express consent to do so and pursuant to executing confidentiality agreements with such unaffiliated third parties, or where SUP is under either a legal obligation or any other duty to do so. For the avoidance of doubt, the information provided by you at this website may be disclosed by SUP to:

• (a) regulators;
• (b) lawyers/accountants/auditors/debt collectors;
• (c) suppliers, agents or contractors in connection with the services they perform for SUP pursuant to agreements;
• (d) third parties to comply with a legal obligation, when SUP believes in good faith that an applicable law so requires it, at the request of government authorities conducting an investigation, to verify or enforce our contractual rights or other applicable policies, to detect and protect against fraud or any technical or security vulnerabilities, to respond to an emergency, or otherwise to protect the rights, property, safety or security of third parties and visitors to our website or to the public; and
• (e) any agents acting on our behalf.

4.4 We also require all third parties to respect the security of your Personal Data and to treat it in accordance with the law. SUP uses industry standard practices to safeguard your personal information. SUP shall, on a best efforts basis, ensure that all communications and identifiable information will not be disclosed to third parties, and that communications and personal identifiable information received through the website will remain confidential.

Retention of Information

5.1 Your personal information will not be kept longer than necessary, and only for as long as it is necessary for us to use your Personal Data as described above. For avoidance of doubt, this will only be for a period of two years at maximum after you cease to use our services, which takes into account potential legal liability on SUP's part. Such information will also be deleted or purged at the end of such retention period and we will not retain any such information unless there are special circumstances. We may have to retain some of your Personal Data after you cease to use our services, for instance if that data is necessary to meet our legal obligations, such as retaining the information for tax and accounting purposes. You may also request for information on our policies regarding the purpose and duration of retention of your personal data via email sent to DPO@supcareer.app.

5.2 In some circumstances, we may anonymize your Personal Data (so that it can no longer be associated with you) for research or statistical purposes in which case we may use this information indefinitely without further notice to you.

5.3 Your personal information in SUP's website will be destroyed if you apply to deregister your records. However, this may result in the termination of your access to the secured portions in the website.

Accuracy and Correction of Personal Data

6.1 SUP takes steps to ensure that the information collected is accurate and up to date by updating its records whenever any changes to information come to its attention. SUP shall disregard information which seems, on a reasonable basis, be inaccurate or out of date by reason of the time which has elapsed since it was collected or by reason of any other information in its possession.

6.2 If you have submitted personal data to SUP through the webform of SUP's webapps and would like to edit such personal data, you may directly update your personal data through the same webforms.

Access to Personal Data

7.1 If an individual wishes to be provided with information regarding their Personal Data that is in the possession or under the control of SUP, or the ways in which such Personal Data has been used or disclosed by SUP in the year preceding such request, that individual must send a written request by email to our Data Protection Officer at DPO@supcareer.app. SUP shall handle such requests as soon as reasonably possible in accordance with the PDPA, in any case, within 30 calendar days.

International transfer of Information

8.1 Any personal data provided to SUP may be transferred to, stored by or disclosed to an overseas recipient.

8.2 Where our partners who help us in the administration or operation of our organisation are based in other locations, your Personal Data may be transferred outside of Singapore. When we send your Personal Data outside of Singapore, SUP shall ensure that your Personal Data is protected to at least the same standard as that in Singapore and comparable to the protection under the PDPA, and that there is a proper contract governing such data transfer.

Security

9.1 SUP's management and their teams take reasonable precautions to keep all information obtained from our online visitors or users secure against unauthorized access (e.g. a data breach) and use, and we periodically review our security measures. SUP is committed to employing reasonable security measures, regularly reviewing our security practices (such as security risk assessments and audits) and providing regular awareness training to all staff.

9.2 Any data destroyed by SUP is disposed of in a manner that protects the privacy of personal data in an appropriate manner.

9.3 If you use a login user ID or password obtained through the website, you shall be responsible for maintaining the confidentiality of the user ID and password and not to share or authorise the use of the user ID and password by third parties. You shall be responsible for all activities undertaken using your user ID and password whether authorised or otherwise. You shall immediately notify us if it comes to your knowledge that your user ID and/or password has been compromised or there has been unauthorised use.

9.4 SUP uses website security certificates. Please be aware that these protection tools do not protect information that is not collected through our website, such as information provided to SUP through email.

Withdrawal of Consent

10.1 You may choose whether or not to provide your personal data, and if already provided, you may choose to exercise your right to object, block or remove such personal data as provided by law.

10.2 Your consent given here will override any registration on the Do Not Call Registry and shall apply to Singapore telephone numbers under your name (including your employee, representative or authorised person), including new telephone numbers which you may provide SUP from time to time.

10.3 You may withdraw your consent for the collection, use or disclosure of personal data by giving SUP reasonable notice via a written request made by email to our Data Protection Officer at DPO@supcareer.app. Once a written request is submitted, SUP shall inform the individual of the outcome and likely consequences of the withdrawal of consent within 5 Business Days. Thereafter, SUP shall cease to collect, use or disclose the personal data upon such withdrawal unless otherwise permitted or required by the PDPA or any other applicable laws and regulations.

10.4 To keep you in control of your personal information and the communications sent to you, you may opt out of receiving communications from SUP and our affiliates about new features, products or services; If you object to any of the above services for any reason, you may stop that service by e-mail request made to DPO@supcareer.app. Information provided when purchasing services from any of our websites may be used for marketing and promotional purposes.

10.5 The entire withdrawal process should not take longer than 10 Business Days, from the receipt of your notice of withdrawal of consent till the provision of written confirmation that the process is completed. All of these processes are subject to finalisation of customer accounts as applicable.

Links to Other Sites

11.1 SUP's website may contain links to or from other websites. This privacy policy is only applicable to the information collected on SUP's website.

11.2 SUP is not responsible for any privacy statements and practices of other third-party websites even if you accessed the third-party website through links from our website or you linked to our website from a third-party website. We encourage you to read the privacy policies of other websites you link to from SUP's website.

Limitation of Liability

12.1 SUP and its affiliates are not liable for any direct, indirect, special or consequential damages or loss of any kind as a result of:- (a) any unauthorised use of your user ID and/or password; and/or (b) your access to and/or use of the website and/or any online services; and/or (c) your non-compliance of this Policy Statement.

Changes to SUP's privacy policy

13.1 SUP reserves the right to modify and/or amend this Privacy Policy and related business practices from time to time and will place the updated Statement on the website. Please check this statement before accessing or using the website and/or its online services.

Contact Us

14.1 If you have any comments, questions or complaints about SUP's privacy policy or about our use of your personal data, you may write to us using the following contact details: