PRIVACY POLICY AND DATA PROTECTION NOTICE

Komunidad Global Pte. Ltd.

Effective Date: September 12, 2026
Last Updated: September 12, 2026

1. Introduction

Komunidad Global Pte. Ltd. ("Komunidad", "we", "us", or "our") is a company incorporated in Singapore and provides software, artificial intelligence, environmental, climate, sustainability, ESG, regulatory compliance, data and related technology services to organisations globally.

This Privacy Policy and Data Protection Notice ("Privacy Policy") explains how we collect, use, disclose, store, protect and otherwise process personal data when you:

• visit our website;
• communicate with us;
• request information about our products or services;
• subscribe to our communications;
• interact with our employees, representatives or business partners;
• use a Komunidad application or service;
• create or use an account;
• participate in a demonstration, assessment, implementation or other engagement with us; or
• otherwise interact with Komunidad in connection with our business.

This Privacy Policy applies to personal data processed by Komunidad in its capacity as an organisation responsible for such data.

Where Komunidad processes personal data on behalf of an enterprise customer, the customer may determine the purposes and means of processing and Komunidad may act as a data intermediary, processor or service provider on the customer's behalf. In those circumstances, the customer's privacy notice, instructions and contractual arrangements with Komunidad may also apply.

This Privacy Policy should be read together with any applicable terms of service, customer agreement, data processing agreement, security documentation or other contractual terms governing your use of our services.

2. Our Commitment to Privacy

Komunidad recognises the importance of protecting personal data.

We seek to process personal data responsibly, transparently and only for legitimate purposes. We maintain reasonable administrative, technical and organisational safeguards designed to protect personal data against unauthorised access, collection, use, disclosure, alteration, loss or destruction.

Where applicable, Komunidad complies with the Singapore Personal Data Protection Act 2012 ("PDPA") and other applicable data protection and privacy laws.

Depending on the circumstances and the location of the individual or customer, other privacy laws may also apply.

3. Who Is Responsible for Your Personal Data?

For personal data that Komunidad collects and determines the purposes and means of processing, Komunidad Global Pte. Ltd. is generally the organisation responsible for that processing.

Komunidad Global Pte. Ltd.
1 Phillip Street
#05-01 Royal One Phillip
Singapore

Privacy Contact: info@komunidad.co

Where Komunidad processes personal data solely on behalf of a customer, the relevant customer may be the organisation responsible for determining the purposes of processing.

4. Personal Data We May Collect

The information we collect depends on your relationship with Komunidad and how you interact with our services.

4.1 Information You Provide Directly

This may include:

• full name;
• business email address;
• personal email address where voluntarily provided;
• telephone or mobile number;
• job title;
• employer or organisation;
• country or region;
• business address;
• account information;
• information contained in enquiries or communications;
• information provided during demonstrations or consultations;
• information provided through forms;
• information contained in documents submitted to us;
• billing and commercial information;
• information necessary to provide our services; and
• other information you voluntarily provide.

4.2 Account and Platform Information

If you use a Komunidad application or platform, we may collect:

• account identifiers;
• authentication information;
• login and access records;
• user roles and permissions;
• organisation information;
• application configuration information;
• usage information;
• activity logs;
• support requests;
• preferences and settings; and
• information generated through interaction with our services.

4.3 Technical and Usage Information

When you visit our website or use our services, we may automatically collect information such as:

• IP address;
• browser type;
• operating system;
• device type;
• device identifiers;
• approximate geographic information derived from technical information;
• referring and exit pages;
• pages visited;
• links clicked;
• dates and times of access;
• application activity;
• diagnostic information;
• error logs;
• security logs; and
• other technical information necessary to operate and secure our systems.

4.4 Customer and Application Data

Komunidad provides technology that may be configured for environmental, climate, sustainability, ESG, compliance, reporting, audit, risk and other enterprise purposes.

Depending on how a customer configures and uses a Komunidad application, customer-provided information may include:

• environmental information;
• climate information;
• sustainability information;
• ESG information;
• emissions and energy information;
• facility and asset information;
• geographic or location information;
• operational information;
• compliance information;
• audit information;
• documents and records;
• employee or contractor information;
• supplier or customer information;
• financial or business information;
• information relating to risks, incidents or assessments; and
• other information entered into or connected to a customer's application.

Komunidad generally processes such information according to the customer's instructions and applicable contractual arrangements.

5. Sensitive or Regulated Personal Data

Komunidad does not generally require users to provide sensitive personal information through the public website.

However, certain customer applications may be configured to process information that may be considered sensitive or specially regulated under applicable law.

Customers are responsible for determining whether they are permitted to provide such information to Komunidad and for providing any required notices, obtaining any required consents and establishing an appropriate legal basis for processing.

Komunidad will process such information only as permitted by applicable law and the relevant contractual arrangements.

6. How We Use Personal Data

We may collect, use or otherwise process personal data for purposes including:

Providing and Operating Our Services

• providing access to our website and services;
• creating and managing accounts;
• providing demonstrations;
• configuring and deploying applications;
• providing customer support;
• communicating with customers;
• processing transactions;
• managing subscriptions;
• maintaining and administering systems;
• troubleshooting technical problems; and
• providing requested products and services.

Business Operations

• managing our business relationships;
• communicating with customers, suppliers and partners;
• managing contracts;
• processing invoices and payments;
• maintaining business records;
• conducting internal administration;
• managing corporate transactions; and
• protecting our business interests.

Security and Fraud Prevention

• authenticating users;
• monitoring system security;
• detecting and preventing fraud, abuse and unauthorised access;
• investigating security incidents;
• maintaining logs;
• enforcing our terms and policies; and
• protecting our users, systems and business.

Product Development and Improvement

We may use information to:

• improve our products and services;
• develop new products and features;
• understand how our services are used;
• diagnose technical problems;
• conduct testing and quality assurance;
• improve user experience;
• develop analytics and reporting capabilities; and
• conduct research and development.

Where appropriate, we may use aggregated, statistical or de-identified information for these purposes.

Communications and Marketing

Where permitted by law and, where required, with your consent, we may use personal data to:

• send product information;
• provide newsletters;
• communicate about events;
• provide relevant business information;
• conduct marketing activities; and
• inform you about products and services that may be relevant to you.

You may opt out of marketing communications at any time.

We may continue to send transactional, service-related or administrative communications where reasonably necessary.

Legal and Regulatory Purposes

We may process personal data:

• to comply with applicable laws;
• to comply with legal processes;
• to respond to lawful requests from authorities;
• to establish, exercise or defend legal claims;
• to enforce contractual rights;
• to investigate suspected violations; and
• to protect the rights, property or safety of Komunidad, our customers, users or other persons.

7. Legal Bases for Processing

Where laws such as the EU General Data Protection Regulation ("GDPR") apply, Komunidad may rely on one or more lawful bases for processing personal data, including:

• performance of a contract;
• taking steps at your request before entering into a contract;
• compliance with a legal obligation;
• our legitimate interests, where those interests are not overridden by applicable rights;
• consent; or
• another lawful basis permitted by applicable law.

Where processing is based on consent, you may withdraw your consent subject to applicable law and reasonable notice.

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

8. Artificial Intelligence and Automated Technologies

Certain Komunidad services use artificial intelligence, machine learning, automation and related technologies.

These technologies may assist with activities including:

• interpreting requirements;
• structuring information;
• recommending workflows;
• generating application components;
• configuring software;
• analysing information;
• identifying potential gaps or requirements;
• generating reports or summaries;
• assisting with assessments;
• recommending configurations;
• supporting compliance and sustainability workflows; and
• producing other outputs requested by users.

AI-assisted outputs may contain errors, omissions or inaccuracies.

Where appropriate, Komunidad may apply human review, validation, testing or other quality-control processes.

Unless otherwise expressly agreed with a customer or permitted by applicable law, Komunidad does not use Customer Data to train general-purpose third-party artificial intelligence models.

We may use information necessary to operate, secure, improve and develop our own services, subject to applicable law, contractual commitments and appropriate safeguards.

Where third-party AI providers are used, they may process information strictly as necessary to provide the relevant service and subject to applicable contractual and security arrangements.

9. Customer Data

For purposes of this Privacy Policy, "Customer Data" means information submitted, uploaded, transmitted or otherwise provided by a customer or its authorised users through a Komunidad service.

The ownership and permitted use of Customer Data are primarily governed by the applicable customer agreement.

Where Komunidad processes Customer Data on behalf of a customer:

• the customer generally determines the purposes of processing;
• the customer is responsible for ensuring that it has the necessary rights and lawful basis to provide the data;
• Komunidad processes the data in accordance with the customer's documented instructions and applicable agreements;
• Komunidad implements reasonable technical and organisational measures appropriate to the processing; and
• Komunidad may use service providers and subprocessors as necessary to provide the contracted services.

Komunidad will not sell Customer Data.

10. Information Received from Other Sources

We may receive information about you from:

• your organisation;
• our customers;
• business partners;
• service providers;
• professional advisers;
• publicly available sources;
• event organisers;
• referral partners;
• social or professional networks; or
• other lawful sources.

We will process such information in accordance with applicable law.

11. Disclosure of Personal Data

We may disclose personal data to:

• our employees and authorised personnel;
• affiliates and related companies;
• cloud hosting providers;
• infrastructure providers;
• software providers;
• analytics providers;
• communications providers;
• customer support providers;
• security providers;
• payment and billing providers;
• AI and technology providers;
• professional advisers;
• auditors;
• insurers;
• legal advisers;
• business partners where necessary;
• prospective investors, acquirers or transaction counterparties, subject to appropriate confidentiality protections;
• government authorities or regulators where required; and
• other parties where authorised by you or permitted by law.

Service providers are generally required to process personal data only for authorised purposes and to implement appropriate safeguards.

12. Subprocessors and Service Providers

Komunidad may engage third-party service providers and subprocessors to provide infrastructure, hosting, security, communications, analytics, authentication, AI, support, payment and other services.

Depending on the nature of the service, such providers may process personal data in jurisdictions other than Singapore.

Where required by applicable law or contractual commitments, Komunidad will implement appropriate contractual and organisational safeguards in relation to such providers.

Where applicable, enterprise customers may request information regarding relevant subprocessors through the contractual or customer-support process.

13. International Transfers

Komunidad operates internationally and may process personal data in countries outside Singapore.

Where personal data is transferred outside Singapore, Komunidad will take steps required by applicable law to ensure that the transferred personal data receives a standard of protection comparable to that required under applicable Singapore law or otherwise satisfies applicable legal requirements.

Where GDPR or other laws governing international transfers apply, Komunidad may rely on legally recognised transfer mechanisms, including adequacy decisions, standard contractual clauses or other lawful transfer mechanisms.

14. Data Retention

Komunidad retains personal data only for as long as reasonably necessary for the purposes for which it was collected or processed, including:

• providing services;
• maintaining business and transaction records;
• complying with legal obligations;
• resolving disputes;
• enforcing agreements;
• maintaining security;
• preventing fraud or abuse; and
• protecting legitimate business interests.

Customer Data retention and deletion may also be governed by the applicable customer agreement or data processing agreement.

When personal data is no longer required, Komunidad will take reasonable steps to delete, anonymise or otherwise dispose of it in accordance with applicable law and our retention practices.

15. Data Security

Komunidad maintains reasonable technical, organisational and administrative safeguards designed to protect personal data.

Depending on the nature of the information and services, safeguards may include:

• access controls;
• authentication mechanisms;
• role-based permissions;
• encryption;
• system monitoring;
• logging;
• backups;
• vulnerability management;
• security testing;
• incident response procedures;
• employee confidentiality obligations;
• supplier controls; and
• other security measures appropriate to the circumstances.

No method of transmission or storage is completely secure. Accordingly, Komunidad cannot guarantee absolute security.

16. Data Breaches

Komunidad maintains procedures for responding to suspected and confirmed personal data breaches.

Where required by applicable law, Komunidad will notify relevant regulators, affected individuals and/or customers of a personal data breach within the applicable statutory or contractual timeframe.

Where Komunidad processes personal data on behalf of a customer, Komunidad will also follow the applicable contractual incident-notification requirements.

17. Cookies and Similar Technologies

Komunidad may use cookies, pixels, local storage and similar technologies to:

• operate the website;
• maintain security;
• remember preferences;
• understand website usage;
• analyse performance;
• improve services; and
• support marketing activities where permitted.

Some cookies may be necessary for the operation of the website.

Where required by applicable law, Komunidad will request consent before placing or using non-essential cookies or similar technologies.

You may be able to control cookies through your browser or device settings. Disabling certain cookies may affect website functionality.

Where appropriate, Komunidad may maintain a separate Cookie Notice describing the cookies and similar technologies used on particular websites or services.

18. Analytics

We may use analytics and similar technologies to understand how our website and services are used.

Analytics information may include technical and usage information such as pages visited, approximate location, browser type, device information and interaction data.

Where third-party analytics services are used, their own privacy policies may also apply.

19. Third-Party Websites and Services

Our website and services may contain links to websites, applications or services operated by third parties.

Komunidad is not responsible for the privacy practices, security or content of third-party services.

We encourage you to review the privacy policies and terms applicable to those services before providing personal data.

20. Your Privacy Rights

Depending on the applicable law and circumstances, you may have rights including:

• requesting access to personal data;
• requesting information about how personal data has been used or disclosed;
• requesting correction of inaccurate or incomplete personal data;
• withdrawing consent;
• requesting deletion or erasure;
• requesting restriction of processing;
• objecting to certain processing;
• requesting data portability;
• objecting to certain automated decision-making; and
• making a complaint to a relevant data protection authority.

These rights are not absolute and may be subject to applicable legal exceptions.

For requests relating to personal data processed by Komunidad on behalf of a customer, we may refer your request to the relevant customer.

21. How to Make a Privacy Request

To make a request or raise a privacy concern, contact:

Privacy / Data Protection Team
Komunidad Global Pte. Ltd.
1 Phillip Street
#05-01 Royal One Phillip
Singapore

Email: info@komunidad.co

Please provide sufficient information for us to understand and respond to your request.

We may need to verify your identity or authority before fulfilling certain requests.

We will respond within the timeframe required by applicable law.

22. Complaints

If you believe that Komunidad has handled your personal data improperly, you may contact us at:

info@komunidad.co

We will investigate reasonable privacy complaints and seek to resolve them appropriately.

Where applicable, you may also lodge a complaint with the relevant data protection authority, including the Personal Data Protection Commission of Singapore.

23. Business Transfers

If Komunidad is involved in a merger, acquisition, financing, restructuring, sale of assets or other corporate transaction, personal data may be transferred as part of that transaction where permitted by law.

Any such transfer will be subject to appropriate confidentiality and data protection measures.

24. Children

Komunidad's services are primarily intended for businesses and professional users.

Our public website and services are not intentionally directed toward children.

If you believe that a child has provided personal data to Komunidad in circumstances where this was not appropriate, please contact us so that we can investigate and take appropriate action.

25. Changes to This Privacy Policy

Komunidad may update this Privacy Policy from time to time.

When we make material changes, we may update the "Last Updated" date and, where appropriate, provide additional notice.

Your continued use of our website or services after an updated Privacy Policy becomes effective constitutes acknowledgment of the updated policy to the extent permitted by law.

26. Governing Framework

This Privacy Policy is intended to operate in conjunction with applicable privacy and data protection laws.

Nothing in this Privacy Policy is intended to reduce or exclude any mandatory rights or protections available to individuals under applicable law.

Where a customer agreement, data processing agreement or applicable law imposes additional requirements, those requirements will apply to the relevant processing to the extent of any inconsistency.

27. Contact Us

For questions, requests or concerns relating to this Privacy Policy or Komunidad's privacy practices:

Komunidad Global Pte. Ltd.
1 Phillip Street
#05-01 Royal One Phillip
Singapore

Email: info@komunidad.co

Website: https://komunidad.global/

Effective Date: September 12, 2026

Last Updated: September 12, 2026

‍