GBST PRIVACY POLICY

GBST Holdings Ltd ACN 010 488 874 and its subsidiaries ("GBST" or "We", "Our" or "Us") are committed to your privacy and safeguards your personal information collected by GBST, carefully. We respect and value the privacy of everyone who visits this website, www.gbst.com ("Our Site") and will only collect and use personal data in ways that are described here, and in a manner that is consistent with Our obligations and your rights under the law.

This Privacy Policy explains the kinds of personal data we collect, the purposes for which it is collected, how personal data is stored, who it is disclosed to and how to contact us to either access or correct any personal data or to make a privacy related complaint.

Please read this Privacy Policy carefully and ensure that you understand it. Your acceptance of Our Privacy Policy is deemed to occur upon your first use of Our Site. If you do not accept and agree with this Privacy Policy, you must stop using Our Site immediately.

VIETNAM — APPLICANTS NOTICE: SCOPE AND CONSENT

This Notice provides information on how GBST VIETNAM LIMITED LIABILITY COMPANY ("GBST") performs the processing of Personal Data of candidates and applicants and other data subjects involved in personnel selection whose data may become available to GBST within the framework of its personnel selection processes ("Applicants") following Law on Personal Data Protection 2025 and other relevant legislations ("PDPL"). In this Notice, the term "we" refers to GBST or third parties authorized by GBST, and the term "you" or "your" refers to Applicants.

Where you provide the Personal Data of a third party to GBST, you represent and warrant that you have obtained the consent of such third party for GBST's processing of Personal Data (including but not limited to collection, use, and transfer), and you have informed him/her that GBST shall process his/her Personal Data for the purposes set out in this Notice and/or in the contract or commitment (if any) between Applicants and GBST.

Consent: By receiving and reading this Notice before providing your Personal Data and handing over relevant documents via the following methods: (i) GBST's digital services (such as GBST's official career pages, application and social media); (ii) GBST's third-party service providers such as recruitment agencies or recruiting platforms; (iii) to any GBST's staff emails; or (iv) filling out any other consent forms which can express consent in a format that can be printed, reproduced in writing, you agree and consent to GBST's processing of your Personal Data by the terms and conditions set out in this Notice.

1. DEFINITIONS AND INTERPRETATIONS

In this Privacy Policy, the following terms shall have the following meanings:

• "Account" means an account required to access and/or use certain areas and features of Our Site.
• "Cookie" means a small text file placed on your computer or device by Our Site when you visit certain parts of Our Site and/or when you use certain features of Our Site.
• "Personal Data" means information that relates to an identified or identifiable living individual who can be directly or indirectly identified from that data. In this case, it means personal data that you give to Us via Our Site.

UK — Additional Definitions

"Cookie Law" means the relevant parts of the Privacy and Electronic Communications (EC Directive) Regulations 2003 and, where applicable, the UK GDPR. "Personal Data" is as defined by the UK GDPR and the Data Protection Act 2018 (the "Data Protection Legislation"). "UK GDPR" has the meaning given to it by the Data Protection Act 2018.

AU — Additional Definitions

"Personal information" is any information or an opinion about an identified individual or an individual who can be reasonably identified from the information or opinion. Information or an opinion may be personal information regardless of whether it is true. GBST's operations in Australia are subject to the Privacy Act 1988 (Cth) (Privacy Act), as amended from time to time, and the Australian Privacy Principles ("APPs") contained therein.

Vietnam — Additional Definitions

"Personal Data" refers to digital data or information in other forms that identifies or assists the identification of a specific individual, including basic personal data and sensitive personal data. Personal data, once de-identified, is no longer considered personal data.

2. INFORMATION ABOUT US

Our Site is owned and operated by GBST Holdings Limited Australian Company Number 010 488 874 which is in the GBST group of entities.

UK — Entity Details

Our Site is owned and operated by GBST Holdings Limited Australian Company Number 010 488 874 which is in the GBST group of entities and a parent company of:

• GBST Wealth Management Ltd Company No. 06663089
• GBST Hosting Limited 066612
• GBST UK Holdings Limited Company No. 06662908, whose address is 1 Old Street Yard, London EC1Y 8AF England.

Our Privacy Officer can be contacted by email at privacyofficer@gbst.com, or by post at 1 Old Street Yard, London, EC1Y 8AF, England.

AU — Contact Details

Contact: Privacy Officer
Email: privacyofficer@gbst.com
Phone: +61 2 9253 6555
Mail: GBST Holdings Ltd, Level 5, 55 Market Street Sydney NSW 2000

Vietnam — Controller cum Processor

GBST VIETNAM LIMITED LIABILITY COMPANY
Head office: Unit 6.8 and 6.9, Level 6, e.town 1 Building, 364 Cong Hoa Str., Tan Binh Ward, Ho Chi Minh City, Vietnam
Email: privacyofficer@gbst.com
CC: peopleculture@gbst.com

3. WHAT DOES THIS POLICY COVER?

This Privacy Policy applies only to your use of Our Site. Our Site may contain links to other websites. Please note that We have no control over how your data is collected, stored, or used by other websites and We advise you to check the privacy policies of any such websites before providing any data to them.

4. YOUR RIGHTS

As a data subject, you have the following rights under the UK GDPR, which this Privacy Policy and Our use of Personal Data have been designed to uphold:

• The right to be informed about Our collection and use of Personal Data.
• The right of access to the Personal Data We hold about you (see section 10).
• The right to rectification if any Personal Data We hold about you is inaccurate or incomplete (please contact Us using the details in section 12).
• The right to be forgotten — i.e. the right to ask Us to delete any Personal Data We hold about you (We only hold your Personal Data for a limited time, as explained in section 6 but if you would like Us to delete it sooner, please contact Us using the details in section 12).
• The right to restrict (i.e. prevent) the processing of your Personal Data.
• The right to data portability (obtaining a copy of your Personal Data to re-use with another service or organisation).
• The right to object to Us using your Personal Data for particular purposes.
• Rights with respect to automated decision making and profiling.

If you have any cause for complaint about Our use of your Personal Data, please contact Us using the details provided in section 12 and We will do Our best to solve the problem for you. If We are unable to help, you also have the right to lodge a complaint with the Information Commissioner's Office ("ICO") by visiting their website at ico.org.uk which has an online complaint procedure or you can make enquiries via live chat on the ICO website, or by telephoning the ICO on 0303 123 1113.

AU — Your Rights and Right to Anonymity

You have the right to remain anonymous or use a different name (pseudonym or alias) when interacting with us. However, it may not always be possible for this to occur. For example, when we assess your eligibility for a program or service, or when we are authorised or required to deal with you as an identified individual, you may have to provide certain personal information. We will inform you if you are unable to remain anonymous or use a pseudonym when dealing with us.

If you believe that we have not dealt with your personal information in accordance with this Privacy Policy or the APPs, you may make a complaint in writing to us, addressed to our Privacy Officer.

We will acknowledge your complaint in writing within 7 days of receipt, and process and respond to your complaint within 30 days. If we cannot resolve your complaint within 30 days of receipt, we will contact you with an explanation why and ask permission for an extension of time.

If (after 30 days) you are not satisfied with our response, you can raise your concerns with the Office of the Australian Information Commissioner: Online: www.oaic.gov.au Phone: 1300 363 992 (inside Australia); +61 2 9942 4099 (outside Australia) Fax: +61 2 6123 5145 Mail: GPO Box 5288, Sydney NSW 2001

Vietnam — Applicant Rights and Obligations

Regarding your Personal Data, you have the following statutory rights: (i) Right to be informed of the personal data processing; (ii) Right to consent, refuse, or request withdrawal of consent to the personal data processing; (iii) Right to view, modify, or request modification of their personal data; (iv) Right to request provision, deletion, and restriction of personal data processing; to object to personal data processing; (v) Right to complain, denounce, initiate lawsuits, or claim damages according to the law; (vi) Right to request competent authorities or agencies, organizations, or individuals relevant to personal data processing to adopt solutions and measures to protect their personal data according to the law.

Correspondingly, you have the following statutory obligations: (i) Obligation to protect your Personal Data; (ii) Obligation to respect and protect others' Personal Data; (iii) Obligation to adequately and accurately provide your Personal Data according to the law, contracts, or upon your consent to the processing of your Personal Data; (iv) Obligation to comply with personal data protection laws and participate in the prevention and combat against personal data infringement.

Applicants may exercise their rights by contacting GBST using the details provided below. GBST will fulfill your lawful and valid request within the time specified by law from the date of receipt of that request.

5. WHAT DATA DO WE COLLECT?

Depending upon your use of Our Site, We may collect some or all of the following personal and non-personal data (please also see section 11 on Our use of Cookies and similar technologies):

• Name
• Business/company name
• Contact information such as postal address, residential address, email addresses and telephone numbers
• IP address
• Web browser type and version
• Operating system
• A list of URLs starting with a referring site, your activity on Our Site, and the site you exit to

AU — What Information We Collect and How We Use It GBST may collect and hold personal information such as your name, address, email, and telephone number. We typically collect personal information through website inquiries, client or employee onboarding and marketing initiatives.

We may collect 'sensitive' information such as professional memberships and relevant health information, but we will ask for your consent beforehand.

From time to time, we may also receive unsolicited personal information, being information that we have not taken active steps to collect. Examples include misdirected mail and unsolicited employment applications.

When we receive such information, we will decide within a reasonable period whether we could have lawfully collected it. If we determine that we could not have collected the information, we will destroy or de-identify it as soon as practicable. Alternatively, if we determine that we could not have collected the information but are otherwise required to retain it, then we will do so in accordance with our storage of personal information practices as outlined below at section 9 of this Privacy Policy.

Vietnam — Types of Personal Data Collected from Applicants Depending on the purposes of use, GBST may collect various types of Personal Data including:

2.1. General Personal Data (i) Last name, middle name, first name, other names (if any); (ii) Date of birth; (iii) Gender; Place of birth, permanent residence address, temporary residence address, current residence address, contact address, hometown; (iv) Nationality; (v) Photographs and other audio-visual information from CCTV; (vi) ID Card number, personal identification number, passport number, issued date of ID/Passport, issued place of ID/Passport; (vii) Digital account information (including email address); (viii) Personal Data relating to employment relationships including:

• Contact information such as name, address, telephone number, email address and social media data;
• Applied position;
• Source of recruitment;
• Proposed start working date;
• Expected salary;
• Emergency contact;
• Educational background;
• Work experience;
• Language proficiency;
• Computer related skills;
• Full name, phone number, email address, position, and company name of the reference provided by Applicants.

2.2. Sensitive Personal Data Sensitive Personal Data is only required for successful applicants during the background check process and offer process. (i) Data on crimes and criminal activities collected and stored by law enforcement agencies (criminal records); (ii) Images of ID cards, citizen ID cards, or 9-digit ID cards.

6. HOW DO WE USE YOUR DATA?

All Personal Data is processed and stored securely, for no longer than is necessary in light of the reason(s) for which it was first collected. We will comply with Our obligations and safeguard your rights under the UK GDPR at all times. For more details on security see section 7, below.

Our use of your Personal Data will always have a lawful basis, either because it is necessary for Our performance of a contract with you, because you have consented to Our use of your Personal Data (e.g. by submitting an enquiry through Contact Us) or because it is in Our legitimate interests. Specifically, We may use your data for the following purposes:

• Providing and managing your access to Our Site
• Personalising and tailoring your experience on Our Site
• Personalising and tailoring Our services for you
• Replying to emails or enquiries from you

AU — Purposes for Which We Collect and Use Personal Information We collect, hold, use and disclose personal information for the following purposes:

1. Providing products or services to you;
2. Improving our products and services;
3. Surveys, contact and feedback forms and registration pages;
4. Conducting our internal business operations, including meeting any relevant regulatory or legal requirements;
5. Assessing applications for employment; and
6. Communicating between our authorised personnel and related bodies corporate to provide you with our products and services.

We will use your personal information to offer you products and services we believe may interest you, but we will not do so if you tell us not to. These products and services may be offered by us, our related companies, our other business partners or our service providers.

Where you receive electronic marketing communications from us, you may opt out of receiving further marketing communications by following the opt-out instructions provided in the communication. We will ensure that your request has been processed before circulating any further material.

Vietnam — Methods and Purposes of Processing Personal Data Processing of Personal Data refers to activities impacting personal data, including one or more of the following: collection, analysis, summary, encryption, decryption, modification, deletion, destruction, de-identification, provision, disclosure, transfer of personal data, and other activities impacting personal data.

We process your Personal Data for the personnel selection procedure, specifically:

3.1. For the support of recruitment process:

• Considering the information in the application form, CV and other related documents in order to consider whether to enter into the employment agreement or set out the terms and conditions relating to the employment agreement and/or employment-related documents;
• Inviting Applicant to participate in the recruitment process including making an appointment for an interview and participating in relevant tests;
• For communication with the Applicant in line with the job description and this Notice;
• For verification of references about employment history, work experience and qualifications;
• For background-check by lawful third-parties service;
• For defining exact salary, allowances and other benefits to offer to the successful Applicants, ensuring the appropriation with the market practice and employees' interests;
• For offering the Applicant to the given position or other suitable positions available or to be available in the company which the Applicant may not apply yet;
• For contract preparation.

3.2. For improvement: processing and improving GBST's personnel selection procedures;

3.3. Security of GBST's premises and property: CCTVs and guest registration at premises.

7. HOW AND WHERE DO WE STORE YOUR DATA?

We only keep your Personal Data for as long as We need to in order to use it as described above in section 6 and/or for as long as We have your permission to keep it.

We care about protecting your information and We have put in place appropriate measures that are designed to prevent unauthorised access to, and misuse of, your Personal Data. These include measures to deal with any suspected data breach.

We are committed to taking all reasonable and appropriate steps to protect the Personal Data that We hold from misuse, loss, or unauthorised access. We do this by having in place a range of appropriate technical and organisational measures.

UK — Storage Outside the United Kingdom Some or all of your Personal Data may be stored outside of the United Kingdom ("UK"). You are deemed to accept and agree to this by using Our Site and submitting information to Us. If We do store Personal Data outside the UK, We will take all reasonable steps to ensure that your data is treated as safely and securely as it would be within the UK and under the UK GDPR.

AU — Storage of Personal Information We store most information about you in computer systems and databases operated by either us or our external service providers. Some information about you is recorded in paper files that we store and destroy securely. External service providers are carefully selected and required to comply with our information security protocols, which are no less stringent than obligations imposed under the Privacy Act.

We implement both technical and organisational measures to protect personal information which we hold from misuse, interference or loss, and from unauthorised access, modification or disclosure.

These technical and organisational measures include: (a) the use of identity and access management technologies to control access to systems on which personal information is processed and stored; (b) requiring all employees to comply with internal information security and training policies; and (c) monitoring and regularly reviewing our practise against our own policies and against industry best practice.

We will also take reasonable steps to destroy or de-identify personal information once we no longer require it for the purposes for which it was collected or for any permitted secondary purpose, unless we are required by law to retain it further.

Vietnam — Processing Time and Retention Period of Personal Data We will begin processing your Personal Data since GBST receives the Personal Data. We will stop processing your Personal Data after the completion of processing in line with the stated purposes or where the Applicant submits a valid and lawful request to delete, limit or object to Personal Data processing.

If the Applicant accepts the offer, GBST shall retain your data until the end of the employment. After the contract terminates, employment data shall be kept as follows:

• Labour contracts and personnel records related to the performance of the labour contract shall be retained for maximum 10 years after termination of employment, to fulfill tax finalisation and nation social insurance for employees, to comply with labour inspection, dispute resolution, and related accounting obligations.
• Salary, payment, personal income tax, and other employment-related accounting records shall be retained for at least 10 years to comply with accounting, tax, and government audit requirements.

If the Applicant rejects the offer or is not suitable for the applied position, all Personal Data shall be deleted permanently, unless Applicant has explicitly consented to GBST retaining the data for future recruitment opportunities.

In such case, the retention period shall not exceed 7 years, or until the candidate withdraws consent, whichever occurs earlier.

If you wish for GBST to retain your Personal Data for the purpose of future contact when suitable positions become available, please select the corresponding 'Consent' option in the form/information sheet you fill in to GBST.

8. DO WE SHARE YOUR DATA?

We may share your Personal Data with other companies within Our corporate group but only for the purpose for providing services to Our clients, improving Our services, replying to enquiries, conducting Our internal business operations, including meeting any relevant regulatory or legal requirements etc.

We may sometimes contract with third parties to supply services to you on Our behalf. In some cases, the third parties may require access to some or all of your Personal Data. Where any of your Personal Data is required for such a purpose, We will take all reasonable steps to ensure that your data will be handled safely, securely, and in accordance with your rights, Our obligations, and the obligations of the third party under the law.

We may compile statistics about the use of Our Site including data on traffic, usage patterns, user numbers, and other information. All such data will be anonymised and will not include any Personal Data, or any anonymised data that can be combined with other data and used to identify you. Data will only be shared and used within the bounds of the law.

In certain circumstances, We may be legally required to share certain Personal Data held by Us, for example, where We are involved in legal proceedings where We are complying with legal requirements, a court order, or a governmental authority.

AU — Who We Disclose Personal Information To, and Why GBST may disclose personal information to external service providers and other third-party entities so that they may perform services for us or on our behalf. We will only make such disclosures to the extent necessary to provide you with our services. We also share personal information between our related bodies corporate in order to perform our regular activities.

GBST may disclose personal information to the following:

1. Third party suppliers, but only to the extent required to provide our products and services;
2. Professional advisers including auditors, accountants and lawyers, within normal business practices;
3. Overseas entities (further described in section 7); and
4. When required or authorised by law.

If we are required to provide your personal information to other organisations, we will ensure that they appropriately safeguard your privacy.

Vietnam — Transfer and Disclosure of Personal Data At GBST, we utilize all reasonable and compulsory administrative, physical and technical measures to protect your personal data from unauthorized disclosure. For the purposes set out in this Notice, Personal Data may be disclosed, or transferred to governmental organizations, governmental bodies or third parties including: (i) Group company or affiliate within GBST group; (ii) Third-party service providers including, but not limited to cloud storage service, recruitment agencies, reference checking services.

Where GBST discloses and transfers the Personal Data of a data subject to a third party above, GBST will take the necessary steps to ensure that the third party will handle the Personal Data of a data subject in accordance with applicable regulations so as to prevent data loss, unauthorised access, improper use, modification, disclosure, or processing of Personal Data. Where Personal Data is transferred abroad, GBST commits to complying with applicable personal data regulations on personal data transfer abroad.

9. YOUR RIGHT TO WITHHOLD INFORMATION

You may access certain areas of Our Site without providing any Personal Data at all.

You may restrict Our use of Cookies. For more information, see section 11.

10. HOW CAN YOU ACCESS YOUR DATA?

We will provide any and all information in response to your request concerning your Personal Data free of charge. Please contact us for further details at privacyofficer@gbst.com or use the contact details below in section 12.

AU — How to Access, Correct or Update Your Personal Information Only authorised persons have access to your personal information, which we keep in a secure environment. You may enquire about:

1. the personal information that we hold about you, including how we got hold of it;
2. making corrections of inaccurately recorded personal information; and/or
3. requesting the deletion of your personal information, by contacting our Privacy Officer. Requests to delete personal information will be subject to any applicable legal reporting, document filing, or retention obligations imposed on us. However, we undertake to attend to your request within 30 days.

While GBST undertakes all reasonable steps to protect your personal information, sending and receiving information over the Internet is always at your own risk. No guarantee can be given that information sent over the Internet is completely secure.

11. OUR USE OF COOKIES

Our Site may place and access certain first party Cookies on your computer or device. First party Cookies are those placed directly by Us and are used only by Us. We use Cookies to facilitate and improve your experience of Our Site and to provide and improve Our services.

A cookie is a message, or a packet of information given to a web browser by a web server, which it stores for later use, so when someone visits the website again their browser recognises their preferences.

GBST web servers may generate session cookies and/or persistent cookies.

Session cookies, if and when generated, are stored in your browser's memory and are destroyed automatically when you close the browser. The cookies exist only for the time you are accessing our server, and when you close your browser at the end of your interaction with GBST the cookies are no longer existing on your computer and cannot be used for further identification of your machine.

Persistent cookies, if and when generated, are stored on your web browser and are deleted by your browser at a later date. They store your preferences and/or configurations for your convenience and ease of use of our facilities.

Both types of cookies are transmitted to and from your browser automatically as part of your access to our web servers. This access is predominantly via SSL (Secure Sockets Layer) and so the cookies are encrypted between your browser and our web servers.

All cookies are used solely for the purposes of maintaining your favourite settings, optimisation of our websites and/or ensuring only authorised access is possible to your account. GBST does not use the information contained therein for any other purpose.

You can configure your browser to accept all cookies, reject all cookies or alert you when a cookie is sent. If you disable the use of cookies on your web browser or remove or reject cookies from our websites or linked sites, then you may not be able to gain access to the content and facilities in those websites.

By using Our Site, in particular when applying for employment vacancies through the GBST Cloud Recruitment Portal (i.e. Careers) you may also receive certain third-party Cookies on your computer or device. Third party Cookies are those placed by websites, services, and/or parties other than Us. In addition, Our Site uses analytics services provided by YouTube and Google, which also use Cookies. Website analytics refers to a set of tools used to collect and analyse usage statistics, enabling Us to better understand how people use Our Site. For more details, please refer to our Cookies policy which can be found on GBST's website.

12. CONTACTING US

If you have any questions about this Privacy Policy or the way we handle your personal data, please contact our Privacy Officer. We will acknowledge your enquiry promptly and respond within 30 days.

Email: privacyofficer@gbst.com

Australia
GBST Holdings Ltd
Level 5, 55 Market Street, Sydney NSW 2000
Phone: +61 2 9253 6555

United Kingdom
GBST UK Holdings Limited
1 Old Street Yard, London EC1Y 8AF, England

Vietnam
GBST Vietnam Limited Liability Company
Unit 6.8 and 6.9, Level 6, e.town 1 Building, 364 Cong Hoa Street, Tan Binh Ward, Ho Chi Minh City, Vietnam
CC: peopleculture@gbst.com

Please ensure your query is clear, particularly if you are requesting access to personal data we hold about you. For complaints that remain unresolved after 30 days, you may escalate to the relevant authority in your jurisdiction — the ICO (UK), the Office of the Australian Information Commissioner (AU), or the relevant Vietnamese authority (VN).

13. CHANGES TO OUR PRIVACY POLICY

We may change this Privacy Policy from time to time (for example, if the law changes). Any changes will be immediately posted on Our Site and you will be deemed to have accepted the terms of the Privacy Policy on your first use of Our Site following the alterations. We recommend that you check this page regularly to keep up-to-date.