AILURA Fund Manager Private Limited

(Formerly Adansonia Fund Manager Private Limited)

PERSONAL DATA PROTECTION POLICY

1.0 INTRODUCTION & PURPOSE

1.1. Ailura Fund Manager Private Limited (together with its subsidiaries, affiliates, and managed entities, hereinafter referred to as the “Company”, “we”, “us”, or “our”) is committed to safeguarding the personal data of our clients, investors, business partners, employees, and users of our services in compliance with the Personal Data Protection Act 2012 of Singapore (“PDPA”) and all applicable advisory guidelines issued by the Personal Data Protection Commission (“PDPC”).

1.2. This Data Protection Policy (“Policy”) outlines how the Company collects, uses, discloses, processes, retains, and protects personal data in our possession or under our control. It also sets out the rights of individuals regarding their personal data and our operational protocols for managing data protection compliance.

2.0 DATA PROTECTION OFFICER

2.1. In accordance with the requirements of the PDPA, the Company has designated a Data Protection Officer (“DPO”) to oversee data protection compliance, enforce internal policies, handle queries, receive feedback, and address access/correction requests or complaints.

2.2. You may contact our Data Protection Officer using the dedicated contact details set out below:

• Entity Name: Ailura Fund Manager Private Limited
• Attention: Data Protection Officer
• Email: brendon.jones@ailurafundmanager.com.sg
• Telephone: +65 8428 6614
• Registered Address: 14 Robinson Road, 08-1A, Far East Finance Building, Singapore, 048585

3.0 KEY DATA PROTECTION PRINCIPLES

The Company strictly adheres to the core Data Protection Obligations mandated by Part 3 to Part 6B of the PDPA:

• 1. Consent Obligation: Personal data is collected, used, or disclosed only with the knowledge and consent of the individual, unless a statutory exception applies under the First or Second Schedules of the PDPA.
• 2. Purpose Limitation Obligation: Personal data is collected, used, or disclosed only for purposes that a reasonable person would consider appropriate in the circumstances and that have been notified to the individual.
• 3. Notification Obligation: Individuals are informed of the purposes for which their personal data will be collected, used, or disclosed on or before such collection, use, or disclosure.
• 4. Accuracy Obligation: Reasonable efforts are made to ensure that personal data collected is accurate and complete, particularly if it is likely to be used to make a decision affecting the individual or disclosed to another organization.
• 5. Protection Obligation: Reasonable security arrangements are implemented to prevent unauthorized access, collection, use, disclosure, copying, modification, disposal, or similar risks.
• 6. Retention Limitation Obligation: Personal data is destroyed or anonymized as soon as it is reasonable to assume that the purpose for which it was collected is no longer served and retention is no longer necessary for legal or business purposes.
• 7. Transfer Limitation Obligation: Personal data is not transferred outside Singapore unless the recipient organization provides a standard of protection comparable to that under the PDPA.
• 8. Access and Correction Obligation: Upon request, individuals are provided with access to their personal data and information on how it has been used or disclosed within the past year, as well as the ability to request correction of errors or omissions.
• 9. Accountability Obligation: Policies, operational procedures, and DPO contact information are made publicly accessible, and internal procedures are established to manage grievances.
• 10. Data Breach Notification Obligation: In the event of a qualifying data breach, the Company will notify the PDPC and affected individuals in accordance with statutory timelines.
• 11. Data Portability Obligation: Upon request, an individual’s personal data will be transmitted to another organization in a commonly used machine-readable format, subject to regulatory exceptions.

4.0 COLLECTION OF PERSONAL DATA

4.1. “Personal Data” refers to any data, whether true or not, about an individual who can be identified from that data, or from that data and other information to which the organization has or is likely to have access.

4.2. Depending on the nature of your relationship with us (e.g., individual investor, corporate client executive, job applicant, vendor), personal data collected may include:

• Full legal name, national identification number (NRIC/FIN/Passport), date of birth, nationality, gender, and residential address.
• Contact details including personal/corporate email address, telephone numbers, and mailing address.
• Financial and investment background, source of wealth, tax residency status, bank account details, and accredited investor documentation.
• Employment history, professional qualifications, directorships, and reference check information.
• Technical data such as IP address, browser type, cookies, and website user analytics when accessing our digital platforms.

5.0 CONSENT & STATUTORY EXCEPTIONS

5.1. Consent Requirement: We shall not collect, use, or disclose your personal data without your knowledge and consent, except where required or authorized under the PDPA or other applicable laws.

5.2. Deemed Consent: Consent may be express or deemed. You are deemed to have consented to the collection, use, or disclosure of personal data if you voluntarily provide the data for a purpose reasonably obvious at the time of provision.

5.3. Deemed Consent by Contractual Necessity: Where you enter into a contract with the Company, deemed consent extends to the disclosure of personal data to third-party service providers necessary for performance of the contract.

5.4. Statutory Exceptions (First & Second Schedules): Under the revised statutory provisions of the PDPA, the Company may collect, use, or disclose personal data without consent under specific exceptions set out in the First Schedule (Exceptions from Consent) and Second Schedule (Exceptions from Notification), including:

• a) Legitimate Interests Exception: Where necessary for legitimate interests pursued by the Company or another organization, provided that the legitimate business interest outweighs any adverse effect on the individual.
• b) Business Improvement Exception: Where necessary for business improvement purposes, operational efficiency, operational risk management, or developing internal products/services.
• c) Emergency Exceptions: Where necessary for responding to an emergency that threatens the life, health, or safety of the individual or another person.
• d) Compliance & Legal Exception: Where the data is publicly available or necessary for legal proceedings, regulatory investigations, or statutory compliance under Singapore law.

6.0 PURPOSES FOR COLLECTION, USE & DISCLOSURE

6.1. The Company collects, uses, and discloses personal data for the following core business purposes:

• Evaluating, onboarding, and administering fund structures, corporate investment vehicles, and advisory engagements.
• Conducting customer due diligence, anti-money laundering (AML), counter-financing of terrorism (CFT), and Know-Your-Customer (KYC) compliance checks.
• Executing portfolio transactions, dividend disbursements, financial reporting, and investor relations communications.
• Managing corporate vendor relationships, operational service contracts, and institutional partnerships.
• Fulfilling legal, statutory, tax, and regulatory reporting obligations to government authorities (e.g., MAS, ACRA, IRAS).
• Processing employment applications, payroll, employee benefits, and internal corporate administration.

7.0 DISCLOSURE & CROSS-BORDER TRANSFERS OF PERSONAL DATA

7.1. Disclosure to Third Parties: We may disclose personal data to third-party service providers, contractors, auditors, legal advisors, custodians, administrators, and financial institutions acting on our behalf.

7.2. Cross-Border Transfers: Where personal data is transferred to entities outside Singapore (including affiliated entities within the Ailura Group, such as Mauritius management or investment advisory entities), the Company will take appropriate steps to ensure that the recipient provides a standard of protection comparable to that under the PDPA.

7.3. Legal Safeguards: Cross-border transfers are governed by robust contractual agreements incorporating standard contractual clauses or legally binding internal corporate rules that mandate equivalent data security standards.

8.0 MANDATORY DATA BREACH NOTIFICATION OBLIGATION

8.1. Assessment of Data Breaches: In the event of a suspected or confirmed security incident involving personal data, the Company will immediately initiate its Internal Data Breach Management Plan to assess whether the breach is a Notifiable Data Breach under Part 6A of the PDPA.

8.2. Thresholds for Notification: A data breach is notifiable if it:

• Results in, or is likely to result in, significant harm to affected individuals (e.g., exposure of financial data, national identity numbers, passwords); or
• Is of a significant scale, affecting 500 or more individuals.

8.3. Notification Timelines:

• a) Notification to PDPC: The Company will notify the Personal Data Protection Commission (PDPC) as soon as practicable, and in any event no later than 3 calendar days after making the assessment that the breach is notifiable.
• b) Notification to Individuals: The Company will notify affected individuals as soon as practicable concurrently with or after notifying the PDPC, providing practical steps individuals can take to mitigate harm.

9.0 DATA PORTABILITY OBLIGATION

9.1. Right to Portability: Subject to statutory exceptions under Part 6B of the PDPA, an individual who has an existing relationship with the Company may request that the Company transmit their personal data (in our possession or control) to another organization in a commonly used machine-readable electronic format.

9.2. Request Processing: Data portability requests must be submitted in writing to our Data Protection Officer. The Company will evaluate and fulfill eligible requests in accordance with PDPC regulations.

10.0 ACCESS AND CORRECTION RIGHTS

10.1. Access Requests: You may submit a written request to our DPO to access your personal data currently in our possession or control, as well as information regarding the ways in which your data has been used or disclosed within the one-year period prior to the date of request.

10.2. Correction Requests: You may request the correction of an error or omission in your personal data. The Company will correct the data as soon as practicable, unless satisfied on reasonable grounds that a correction should not be made.

10.3. Administrative Fees: The Company reserves the right to charge a reasonable administrative fee to process access requests. You will be informed of any applicable fees prior to processing.

11.0 WITHDRAWAL OF CONSENT

11.1. Right to Withdraw: You may withdraw your consent for the collection, use, or disclosure of your personal data at any time by giving reasonable written notice to our DPO.

11.2. Consequences of Withdrawal: Upon receipt of notice, we will inform you of the likely consequences of withdrawing consent (e.g., inability to continue providing fund management or investment advisory services). If you proceed with withdrawal, we will cease collecting, using, or disclosing your personal data, except where authorized or required under law.

12.0 PROTECTION, SECURITY & RETENTION LIMITATIONS

12.1. Security Safeguards: The Company implements comprehensive technical, administrative, and physical security measures—including data encryption, strict access controls, secure firewalls, and staff confidentiality training—to prevent unauthorized access, disclosure, modification, or destruction.

12.2. Retention Policy: Personal data is retained only for as long as necessary to fulfill the purposes for which it was collected, or as required for legal, regulatory, or business accounting purposes. When no longer required, personal data is securely purged, shredded, or anonymized.

13.0 UPDATES TO THIS POLICY

13.1. Policy Reviews: The Company reviews and updates this Policy periodically to ensure alignment with statutory changes under Singapore law and operational updates within the Ailura Group.

13.2. Publication: The latest version of this Policy will be made available on our official website or provided upon request to the DPO.