This Policy applies to personal data we handle about: • Candidates / job applicants (including prospective candidates) • Client representatives (including hiring managers, HR, and procurement) • Referees and other individuals whose personal data you provide to us • Visitors to our websites and online channels (if applicable)

Depending on your relationship with us, we may collect: • Identification and contact details: name, email, phone number, address, nationality, work authorisation status • Career and recruitment-related data: CV/resume, employment history, education, qualifications, references, compensation expectations, interview notes, assessments, job preferences • Verification / compliance data: where required or permitted, we may collect identifiers such as NRIC/FIN for relevant referrals/placements (including where required under applicable licence conditions) • Online data (if applicable): IP address, device/browser data, cookies, and website usage data You may choose not to provide certain data, but this may limit our ability to provide recruitment services.

We may collect personal data: • Directly from you (e.g., forms, emails, calls, messaging) • From third parties authorised by you (e.g., referrals, job boards) • From publicly available sources (e.g., professional profiles) where permitted under the PDPA • From our clients during recruitment processes (e.g., interview feedback)

We collect, use, and/or disclose personal data for purposes including: 1. Recruitment and placement services (matching you to roles; submitting your profile to clients with your permission or as permitted by law) 2. Assessing suitability (screening, interviews, skills assessments, role-fit analysis) 3. Client services (responding to hiring requests, managing search processes, presenting shortlists, scheduling interviews) 4. Reference checks / due diligence (where relevant and appropriate) 5. Compliance with legal/regulatory obligations (including licence conditions and record-keeping) 6. Business operations (quality assurance, training, audits, dispute handling) 7. Marketing and communications (where you have consented or where permitted by law; see section 11) We will notify you of the purposes at the point of collection where required, and we do not use personal data for purposes that are not reasonable in the circumstances.

We may disclose personal data to: • Our clients / prospective employers (for recruitment and hiring processes) • Service providers / vendors who support our operations (e.g., cloud hosting, CRM/ATS providers) under confidentiality and data protection obligations • Professional advisers (lawyers, auditors) where necessary • Regulators / authorities where required by law or regulatory request We do not sell personal data.

Where we transfer personal data outside Singapore (e.g., to regional clients or service providers), we will take steps to ensure it is protected to a standard comparable to the PDPA.

We implement reasonable security arrangements to protect personal data from unauthorised access, collection, use, disclosure, copying, modification, disposal, or similar risks (e.g., access controls, encryption where appropriate, secure storage, staff confidentiality obligations).

We take reasonable steps to ensure personal data is accurate and complete where it is likely to be used to make decisions that affect you (e.g., job matching) or disclosed to another organisation.

We retain personal data only for as long as: • necessary to fulfil the purposes for which it was collected; and/or • required for legal or business purposes (e.g., dispute resolution, regulatory compliance), after which we will securely dispose of it or anonymise it.

You may request access to, or correction of, your personal data in our possession or under our control. We may need to verify your identity and may charge a reasonable administrative fee where permitted. Requests can be made to our Data Protection Officer (see section 14).

You may withdraw consent for our collection, use or disclosure of your personal data at any time by contacting us. Please note that withdrawal may affect our ability to continue providing recruitment services (e.g., presenting you to clients). If we send marketing messages, we will do so in compliance with applicable requirements (including the Do Not Call provisions where relevant). You may opt out via the instructions in our messages or by contacting us.

If a data breach occurs, we will assess and respond in accordance with the PDPA. Where required, we will notify the PDPC and/or affected individuals in line with Singapore's data breach notification framework.

If our website uses cookies or similar technologies, we use them to operate the site, remember preferences, and analyse traffic. You can manage cookies through your browser settings. Disabling cookies may affect site functionality.

For questions, access/correction requests, or consent withdrawal, contact: Data Protection Officer Nat & Nat Search Pte Ltd Email: talktous@2nats.com

We may update this Policy from time to time. The updated version will be posted on our website or provided upon request, with the "Last updated" date revised accordingly.