Global Data Privacy Policy

CoreX Holding, together with its direct and indirect subsidiaries and overseas branch offices, is hereinafter collectively referred to as “CoreX.”

CoreX is committed to complying with all applicable legal and regulatory requirements relating to data protection and privacy in all jurisdictions in which it operates.

This Global Data Protection Policy (the “Policy”) sets out the minimum requirements applicable to CoreX’s collection, processing, and other use of personal data. This includes any information relating to identifiable individuals, including CoreX employees, business contacts, customers, or suppliers (the “Data Subjects”), as well as information that may qualify as sensitive personal data (collectively, “Personal Data”).

Any entities controlled by CoreX Holding shall also be required to comply with the principles set out in this Policy.

PRIVACY PRINCIPLES

CoreX shall comply with the following principles when Processing Personal Data. Through appropriate contractual arrangements, CoreX shall ensure that its suppliers and business partners also comply with the requirements of this Policy and applicable legal and regulatory compliance standards.

Lawfulness of Processing

CoreX shall collect, store, process, use, share, transfer, analyze, or otherwise handle Personal Data (“Process” or “Processing”) in accordance with applicable legal requirements, where necessary for legitimate business or compliance purposes, where the Data Subject has provided consent, or where another lawful basis for Processing exists under applicable laws or regulations.

Limitation of Collection and Processing

CoreX shall limit the Processing of Personal Data, in terms of scope and duration, to what is necessary for the intended purpose.

Transparency

In accordance with applicable legal requirements, CoreX shall provide Data Subjects with appropriate information regarding the scope and purposes of Processing and the relevant contact point for questions or requests concerning privacy or data protection.

Accuracy

CoreX shall take appropriate measures, as required by applicable laws and regulations, to ensure that the Personal Data it Processes is accurate and appropriate for the purposes for which it is Processed.

Taking into account the purposes of Processing, inaccurate or outdated Personal Data shall be corrected or deleted without undue delay. The accuracy of Personal Data may also depend, where applicable, on the Data Subject notifying CoreX of relevant changes and/or using the mechanisms described in applicable privacy notices.

Security and Confidentiality

CoreX shall implement appropriate organizational, technical, and physical safeguards to protect the confidentiality and security of Personal Data against accidental, unlawful, or unauthorized loss, alteration, disclosure, or access.

Such safeguards shall be appropriate to the risks arising from the Processing activities performed and the nature of the Personal Data concerned.

Privacy by Design

CoreX incorporates Privacy by Design principles into all Personal Data Processing activities carried out through digital systems and technologies or by manual means.

Privacy requirements shall, by default, be embedded into the standards, protocols, and processes implemented by CoreX.

Disclosure of Personal Data

CoreX shall disclose Personal Data to third parties only for the purposes identified in the applicable privacy notice, with the consent of the Data Subject where required, or where such disclosure is otherwise permitted or required by law.

For the purposes of this provision, third parties may include public authorities, law enforcement agencies, and similar competent authorities.

DATA SUBJECT RIGHTS

CoreX shall provide Data Subjects with the opportunity to exercise their data protection rights arising from their relationship with CoreX, in accordance with applicable legal requirements.

These rights may include the right to object to the Processing of Personal Data, request access to Personal Data, and request the correction of incomplete or inaccurate Personal Data.

Each Data Subject request shall be appropriately verified, followed up, and brought to completion.

Depending on applicable law and the Data Subject’s relationship with CoreX, additional rights may apply, including the right to data portability, the right to erasure or to be forgotten, and the right to withdraw consent.

CoreX is committed to maintaining compliance and implementing all necessary measures to facilitate the effective exercise of the rights granted to Data Subjects.

INTERNATIONAL DATA TRANSFERS

CoreX operates globally and may, from time to time, need to transfer Personal Data across national borders.

CoreX recognizes that Personal Data must be handled with appropriate care, including when transferred to countries that may not provide an adequate level of data protection.

Where CoreX transfers Personal Data to such countries, it shall protect the Personal Data in accordance with this Policy and the requirements of applicable law.

DATA RETENTION

CoreX shall maintain and comply with appropriate data retention policies and procedures to ensure that Personal Data is retained only for as long as necessary to fulfil the purposes for which it was Processed and is subsequently deleted, anonymized, or otherwise disposed of in a secure manner..

Exceptions may apply where Personal Data must be retained for a longer period in connection with the relevant purposes, or where applicable law requires Personal Data to be retained for a specified period.

Where CoreX no longer needs to retain Personal Data for the purposes for which it is held, the Personal Data shall be deleted as soon as reasonably practicable.

JURISDICTION-SPECIFIC REQUIREMENTS AND IMPLEMENTATION

CoreX may be subject to additional requirements relating to the Processing of Personal Data under national or local privacy and data protection laws.

Where necessary, CoreX shall establish additional policies and procedures to support the principles set out in this Policy and shall cooperate with relevant regulatory or supervisory authorities as required.

PRIVACY ORGANIZATION AND CONTACT

CoreX has established a global privacy function, managed by the CoreX HQ Compliance Department, which is responsible for overseeing and supporting compliance with applicable privacy and data protection requirements.

Specific data protection or privacy roles and responsibilities may be established for individual countries or geographic regions. CoreX shall also appoint Data Protection Officers (“DPOs”) or individuals performing equivalent functions where required by applicable law.

The privacy function shall also be responsible for delivering training and awareness programs and supporting the integration of privacy principles into CoreX’s business operations and processes.

PERSONAL DATA BREACH REPORTING

Any known or suspected incident involving Personal Data shall be reported without undue delay upon becoming aware of the incident.

This requirement also applies to incidents reported to CoreX by its customers, employees, external service providers, or other business partners.

CoreX shall ensure that its personnel are informed of the procedures for reporting incidents, whether confirmed or suspected. Each incident shall be investigated, followed up, and addressed through appropriate corrective or remedial measures.

IMPLEMENTATION

CoreX has established internal procedures to ensure compliance with this Policy, facilitate the lawful exercise of Data Subjects’ rights under this Policy and applicable law, and address complaints concerning potential non-compliance by CoreX with this Policy, applicable law, or both.

Data Subjects may exercise their rights or make use of the relevant procedures by contacting their local DPO, where applicable.

CHANGES TO THE POLICY

CoreX may update this Policy from time to time, without prior notice to Data Subjects, to reflect changes in applicable laws, regulations, or privacy practices.

For questions regarding this Policy, please contact compliance@corexholding.com.