This is the company policy to protect and deal carefully with personal information received from its employees, and take all the precautions to secure the data while it is retained by the company.

Scope

All Permanent & Contractual employees of YKK Pakistan Private Limited

1. Purpose

1. In the course of business, YKK PAKISTAN may collect, use, retain and disclose personal information as defined in paragraph 2.1 for statutory and reasonable operational purposes.
2. YKK PAKISTAN commits to observe the applicable laws that govern the handling of personal information.
3. YKK PAKISTAN expects employees to take all reasonable steps to ensure that personal information collected is carefully protected and dealt with as set out below.
4. This policy and guidelines shall be read in connection with YKK PAKISTAN Asia Group Code of Conduct and Business Compliance Guide Book and YKK PAKISTAN Group Information Security Regulations.

2. Personal Information

1. "Personal information" refers to information not in the public domain which identifies an individual and which is capable of being associated with a specified individual.
2. For the purpose of this policy, the person providing his/her personal information shall be known as "person concerned".

3. Compliance with the Applicable Laws, Regulations and Policy

1. Employees who are collecting, using, retaining and disclosing any personal information on behalf of YKK PAKISTAN shall at all times comply with the relevant laws and regulations governing protection of personal information.
2. In the absence of relevant laws and regulations governing protection of personal information in Pakistan, employees who are collecting, using, retaining and disclosing any personal information on behalf of YKK PAKISTAN shall act according to the guidelines of this policy.

GUIDELINES

4. Notification of Purpose for Collection, Usage, Retention and Disclosure

1. Employees who are collecting, using, retaining and disclosing any personal information on behalf of YKK PAKISTAN shall at all times notify the person concerned of the purpose before the collection, usage, retention and disclosure of the personal information from the person concerned.
2. The purpose informed to the person concerned shall be as precise as possible and avoid any ambiguity.

5. Consent from Person Concerned

1. Employees who are collecting, using, retaining and disclosing any personal information on behalf of YKK PAKISTAN shall, if possible, obtain the written consent from the person concerned on the purpose of which the personal information will be collected, using, retained and disclosed.
2. No consent shall be automatic. Person concerned shall be given the option to give his/her consent to YKK PAKISTAN to collect, use, retain and disclose his/her personal information.
3. In the event, the personal information collected is to be used, retained and/or disclosed for purposes other than the purpose informed to person concerned ("New Purposes"), written consent from the person concerned has to be obtained for such New Purposes.
4. In the event employees intend to collect, use, retain and disclose any personal information of a minor person on behalf of YKK PAKISTAN, employees shall obtain the written consent from the individual that can legally give consent on behalf of the minor person, such as the minor person's parent or guardian. For the avoidance of doubt, "minor person" refers to person under the age of 18 years old.

6. Retention Of Personal Information

1. YKK PAKISTAN shall retain personal information of person concerned as long as such personal information is necessary for the purposes and/or required by any relevant laws and regulations.
2. In the event such personal information is no longer necessary for the purposes and/or required by any relevant laws and regulations, YKK PAKISTAN shall destroy such personal information without delay.
3. Methods of disposal of such persona information shall be as follows:-

1. Personal information printed on paper: Destroy by shredding or incinerating.
2. Personal information stored in a form of electronic file: Permanently delete through a technical method that cannot reproduce records.

7. Right To Access And Correct By Person Concerned

1. YKK PAKISTAN shall allow person concerned to access, correct and/or update his/her personal information retained by YKK PAKISTAN on a reasonable notice.
2. YKK PAKISTAN shall appoint a Privacy/Personal Information Protection Officer to respond and process such notices.
3. Upon receiving such notice, YKK PAKISTAN shall within reasonable time respond to such notice.
4. If person concerned requests to correct an error in his/her personal information, his/her personal information will not be used or provided before correction is completed.
5. If the non-updated personal information has already been provided to a third party, YKK PAKISTAN will immediately notify the result of correction to the third party for request of correction.
6. Personal information terminated or deleted upon request of the person concerned shall be handled according to paragraph 6, and it will not be viewed or used for any other purposes.
7. YKK PAKISTAN shall not be under an obligation to allow person concerned to access the following personal information regarding the person concerned if:-

1. Opinion data kept solely for evaluative purposes.
2. A document related to a prosecution if all proceedings related to the prosecution have not yet been completed.
3. Personal information which is subject to legal privilege.
4. Personal information which, if disclosed, would reveal confidential Commercial information that could, in the opinion of a reasonable person, harm the competitive position of YKK PAKISTAN.
5. Any request:-

1. That would unreasonably interfere with the operations of YKK PAKISTAN because of the repetitious or systematic nature of the requests,
2. If the burden or expense of providing access would be unreasonable to YKK PAKISTAN or disproportionate to the interests of the person concerned;
3. For information that does not exist or cannot be found;
4. For information that is trivial; or
5. That is otherwise frivolous or vexatious.

8. Protection Of Personal Information

1. YKK PAKISTAN shall use its reasonable effort to ensure that the personal information collected is accurate and up to date.
2. YKK PAKISTAN shall also use its reasonable effort to prevent loss, theft, leakage or damage to personal information.

9. Disclosure of Personal Information To Third Parties

1. YKK PAKISTAN shall not disclose any collected personal information to third parties without the consent from the person concerned except in the following cases:-

1. If the person concerned agrees to the provision of disclosure of personal information to a third party, including joint use of personal information among the YKK PAKISTAN Group companies.
2. If YKK PAKISTAN has signed an agreement related to personal information protection with a contractor, such contractor may be entrusted with an assignment or services that falls within the scope of the stated purposes of the information.
3. When required by law, including under any personal information protection law.

This policy supplements YKK PAKISTAN's other relevant policies. If need any clarification on this policy, please contact YKK PAKISTAN HR & GA Department