Data Protection Notice

1. Introduction

Phoenix Investment Bank (Labuan) Ltd ("Phoenix", "we", "us", or "our") is committed to protecting the privacy, confidentiality, and security of personal data entrusted to us by our clients, counterparties, website visitors, employees, and business partners.

This Data Protection Notice ("Notice") describes how Phoenix collects, uses, processes, stores, discloses, and protects personal data. It has been prepared in accordance with the Personal Data Protection Act 2010 of Malaysia ("PDPA"), Labuan Financial Services Authority (Labuan FSA) requirements, and applicable international data protection standards.

By accessing Phoenix's website, submitting information to us, or entering into a business relationship with Phoenix, you acknowledge that you have read and understood this Notice and consent to the processing of your personal data as described herein.

2. Personal Data We Collect

Phoenix may collect, use, and process the following categories of personal data, depending on the nature of your relationship with us:

2.1 Identity and Contact Information

• Full legal name, date of birth, nationality, and country of residence;
• Passport number, national identification number, or other government-issued identification;
• Residential and mailing address, email address, telephone number;
• Photographs and audio/visual recordings used for identity verification purposes.

2.2 Financial and Business Information

• Employment status, employer name, occupation, and business activities;
• Source of funds and source of wealth declarations;
• Bank account details, transaction records, and financial statements;
• Credit history and information obtained from credit reference agencies.

2.3 Compliance and Due Diligence Information

• KYC documentation and beneficial ownership information;
• PEP status and sanctions screening results;
• Information obtained from regulatory or law enforcement sources where permitted.

2.4 Technical and Usage Data

• IP address, browser type, and device identifiers when accessing Phoenix's website;
• Website usage data, cookies, and analytics information;
• Communications and correspondence records.

3. Purposes of Processing

Phoenix processes your personal data for the following legitimate business and legal purposes:

• Establishing and administering your client relationship with Phoenix;
• Processing applications for products and financial services;
• Conducting identity verification, KYC, credit, and compliance assessments;
• Meeting legal, regulatory, audit, and record-keeping obligations under Labuan FSA, AMLA, PDPA, and other applicable laws;
• Detecting, preventing, and investigating fraud, money laundering, and financial crime;
• Managing risk and conducting internal analytics and product development;
• Communicating with you regarding your account, transactions, or Phoenix's services;
• Sending marketing or informational communications where you have provided consent or where permitted by law;
• Complying with court orders, subpoenas, or requests from competent regulatory or law enforcement authorities.

The provision of personal data marked as mandatory is required to establish your relationship with Phoenix. If you fail to provide such mandatory personal data, Phoenix will be unable to process your application, open an account, or provide financial services to you. Provision of non-mandatory data is optional.

4. Disclosure of Personal Data

Phoenix does not sell personal data. Personal data may be shared on a strictly need-to-know basis with the following categories of recipients:

• Other entities within the Fintrade Group, subject to confidentiality obligations;
• Third-party service providers, agents, auditors, and professional advisers who assist Phoenix in delivering its services, subject to appropriate data processing agreements;
• Correspondent banks, clearing institutions, and settlement counterparties as required for transaction processing;
• Regulatory authorities, law enforcement agencies, and courts where disclosure is required or permitted by applicable law;
• Credit reference agencies and identity verification providers;
• Any person or organization to whom you have directed Phoenix to disclose your data.

All third-party recipients are required to maintain appropriate data protection standards consistent with Phoenix's obligations.

5. Cross-Border Data Transfers

As an international investment bank, Phoenix may transfer personal data to recipients located in jurisdictions outside Malaysia, including in connection with correspondent banking relationships, transaction processing, and Fintrade Group operations. Phoenix ensures that any cross-border transfer of personal data is made in compliance with PDPA requirements and applicable regulatory standards, including the use of appropriate contractual safeguards where required.

6. Data Retention

Phoenix retains personal data for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. In line with AMLA and Labuan FSA requirements, client transaction records and KYC documentation are retained for a minimum of six (6) years following the end of the business relationship. Marketing data is retained only until consent is withdrawn or the relationship ends.

Where personal data is no longer required, Phoenix takes reasonable steps to securely destroy or irreversibly anonymize such data.

7. Data Security

Phoenix implements appropriate administrative, technical, and physical safeguards to protect personal data against unauthorized access, use, disclosure, alteration, loss, or destruction. Security measures include, but are not limited to:

• Encryption of data in transit and at rest where appropriate;
• Access controls and authentication requirements for all systems holding personal data;
• Regular security audits, vulnerability assessments, and penetration testing;
• Staff training on data security obligations and incident response procedures;
• Incident response protocols for detecting, reporting, and addressing data breaches.

In the event of a data breach that is likely to result in a risk to your rights and freedoms, Phoenix will notify the Personal Data Protection Commissioner (Malaysia) and, where required, affected individuals in accordance with applicable law.

8. Cookies

Phoenix's website uses cookies and similar technologies to enhance user experience, measure website usage, and support security. You may configure your browser to decline cookies, although this may affect the functionality of certain features. Please refer to Phoenix's Cookie Policy for further details.

9. Your Rights

Subject to applicable law, you have the following rights in respect of your personal data held by Phoenix:

• Right of Access: to request a copy of the personal data Phoenix holds about you;
• Right to Correction: to request that inaccurate or incomplete personal data be corrected or updated. It is your responsibility to ensure the information you provide is accurate, complete, and not misleading, and you must promptly notify us of any changes to your personal data;
• Right to Withdraw Consent: where processing is based on your consent, to withdraw that consent at any time (without affecting the lawfulness of processing prior to withdrawal);
• Right to Object: to object to the processing of your personal data for direct marketing purposes;
• Right to Limit Processing: to request that Phoenix limits its processing of your personal data in certain circumstances.

Requests to exercise your rights should be submitted in writing to admin@thephoenixbank.com.

10. Marketing Communications

Phoenix does not send unsolicited commercial communications. Marketing or informational communications from Phoenix are sent only where you have provided your consent or where permitted by applicable law.

11. Amendments to This Notice

Phoenix reserves the right to amend this Data Protection Notice at any time. Any changes will be published on Phoenix's official website. We encourage you to review this Notice periodically. Continued use of Phoenix's services following an amendment constitutes acceptance of the updated Notice.

12. Contact — Data Protection Enquiries

For any questions, concerns, or requests relating to this Notice or the handling of your personal data, please contact: