WEE Investment Club

---

WEE's Personal Data Protection Policy sets out the structure for  compliance with the Singapore Personal Data Protection Act 2012. This  policy is reviewed annually by the ORMC. The policy’s principles are:

• Personal data must only be collected and used for purposes the customer has consented to, or as may be permitted by law;
• Personal data is used responsibly in accordance with our ethical standards and corporate values;
• Access and disclosure are subject to strict controls;
• Integrity and security of personal data are paramount; and
• Personal data that is no longer required for legal or business  purposes must be anonymised or destroyed, in accordance with document  retention policies.

Line data protection officers at functional and business levels in  Singapore and locally-appointed officers at overseas locations report to  the Franchise Data Protection Officers in Singapore. These officers ensure compliance with local regulations  and Group requirements, as well as assist in the investigation of  alleged breaches as and when required.

Group Operational Risk Management, as well as the Data Protection  Office under Group Legal, review any incidents and consider whether the  incidents need to be reported and/or affected persons notified. 

Breach  reporting and data leakage protocols are clear, and are designed to  ensure timely breach management and mitigation of harm to data subjects.  Post-incident action plans are pursued to closure to address any  weaknesses in process that resulted in the incidents.