Privacy Commitment

This Commitment is intended to operate as GoTyme’s privacy notice / personal information collection statement in Indonesia, Hong Kong and Malaysia. GoTyme MCA Asia Holdings Pte. Limited, together with its subsidiaries and affiliated entities as part of the Tyme Group (including PT GoTyme Capital Indonesia, GoTyme Hong Kong Limited and GoTyme Malaysia Sdn. Bhd.) (collectively, “GoTyme”, “We”, “Us”, “Our”) provide financing to small businesses under the appropriate local regulatory framework in each country of operation — in some countries under Our own lending licence, and in others through a licensed partner. Regardless of the operating model, We remain accountable for handling Personal Data responsibly and lawfully. In this Commitment, “You” includes an Applicant or Borrower, and individuals connected to a business customer or Applicant — such as Directors, Authorised Signatories, Guarantors/Security Providers, and an Ultimate Beneficial Owner (UBO). It may also include a Nominated Contact and individual representatives of Our partners, merchants, suppliers, and service providers. In every country where We operate, We comply with both the applicable local privacy law and the Tyme Group privacy standard (ensuring You benefit from protections that are at least as strong as those mandated by local laws).

What We Mean by Personal Data

Personal Data means any information relating to an identified or identifiable person. A person is identifiable if they can be identified directly or indirectly, including by reference to identifiers such as a name, an identification number, location data, or an online identifier (for example, a device ID or IP address). Some Personal Data is more sensitive (e.g., government ID numbers, biometric data used for verification). We apply enhanced safeguards and only process such data where lawful and necessary.

What We Collect

Depending on Your relationship with Us and the services You use, We may collect Personal Data and use it to assess applications, service loans, manage risk, and support lawful collections/recovery activities (where applicable), including:

• Identity & Contact Information: name, date of birth, address, email, mobile number, and ID details where required
• Company-Related Information (where applicable): details of Directors, UBOs, Authorised Signatories, Guarantors/Security Providers, and other connected individuals needed for responsible lending and compliance
• Financial & Affordability Information: revenue and transaction details, source of funds/wealth (where required), credit history/score from authorised credit information providers (where permitted and with any required notices/consents), repayment behaviour, and other indicators used for lending decisions
• Application and Loan Servicing Data: application details, disbursements, repayments, fees, communications, customer support interactions, and engagement with Our services
• Verification and Fraud-Prevention Data: KYC/verification results, fraud indicators, device risk signals, and other related data
• Biometric and Image Data (where used and lawful): selfie/liveness checks, identity documents, and similar verification measures
• Digital Data / Footprint: device identifiers, log-in activity, cookies and similar technologies (where used), IP address, browser/app activity, and related technical identifiers
• Sources: Where we obtain Personal Data from third parties (e.g., identity verification providers, credit reporting bodies, fraud prevention partners, distribution partners), we will tell you the source categories.

*Our products are intended for business Borrowers and authorised representatives aged 18+. We do not knowingly process children’s Personal Data for lending.

How We Collect It

We may collect Personal Data:

• Directly from You (e.g., during an online application, throughout the loan lifecycle, and during customer support interactions)
• From authorised third parties, where we have a lawful basis to do so (which may include Your explicit, informed consent, contractual necessity, compliance with law, or legitimate interests where recognised), such as identity verification providers, credit bureaus/credit information providers (where permitted), fraud prevention providers, payment/collection partners, and licensed partners (where applicable)

We may also obtain Personal Data from governmental or regulatory authorities, and other legitimate public sources, where relevant and lawful.

Is providing data mandatory? Some Personal Data is required to assess and service financing (e.g., identity and eligibility information). If you do not provide required data, we may be unable to process your application, provide financing, or continue servicing.

If You provide Personal Data about another person (e.g., a Nominated Contact, Director, UBO, Guarantor, or Authorised Representative), You confirm You are authorised to do so and have provided them with appropriate notice (including directing them to this Commitment, and obtaining any required consents/authorisations) under applicable law.

Why We Use Your Data

We use Personal Data for purposes including:

1) Application and Onboarding

• assess eligibility and affordability
• verify identity and prevent fraud
• set up Your profile and enable access to services

2) Loan Servicing (While Your Loan Is Active)

• administer disbursements, repayments, fees, and account servicing
• provide customer support and manage queries or complaints
• inform You of scheduled repayments (where needed)
• protect systems and prevent unauthorised activity

3) Collections and Recovery (Where Applicable)

• contact You (and, where applicable and lawful, Your Nominated Contact) to resolve arrears
• perform tracing and recovery activities where lawful
• engage third-party collections agencies or legal service providers where appropriate and lawful
• enforce agreements and take legal or administrative action where necessary and permitted

4) Legal, Regulatory, Audit and Risk Management

• comply with applicable laws, audits, record retention, and lawful requests from authorities
• operate required risk controls relevant to Our local operating model (including where delivered with a licensed partner)

5) Product Improvement and Analytics

• service and operational analytics, research, and improvements
• responsible use of advanced analytics (including machine learning) to improve decisioning, security, and customer experience (with appropriate safeguards)
• We may use automated processing (including data models) to support eligibility and fraud decisions. Where required by law (including Indonesia), you may have the right to object to decisions based solely on automated processing that have legal or similarly significant effects, and to request human review.

6) Communications and Marketing (Where Permitted)

• send important service messages (e.g., notices, changes, statements where applicable)
• send offers and promotions only where lawful and aligned to Your preferences/consents (see “Your Choices” below)

Our Retention Approach — During Application, Throughout the Loan, and After

We may retain and use Your Personal Data across the full lifecycle:

• During Your application (including if unsuccessful), to assess eligibility, verify information, prevent fraud, and meet legal requirements.
• Throughout the term of Your loan, to service the loan, manage risk, support collections/recovery where required, and comply with legal and regulatory obligations.
• After Your loan ends (including once fully repaid/closed), We may retain and use relevant information to meet legal/record-keeping requirements and to offer You further services (including future financing), where permitted by law and consistent with this Commitment.

We retain data only as long as necessary for these purposes and dispose of it securely when no longer required.

Our legal basis for collecting Your Personal Data depends on context. We process Personal Data to: take steps at your request and perform contracts (e.g., assess, approve, service and collect financing); comply with legal/regulatory obligations (e.g., KYC/AML, record-keeping, responding to lawful requests); protect our legitimate interests where recognised (e.g., fraud prevention, security, risk management); and where required, based on your consent (e.g., certain marketing, certain partner data-sharing, certain biometric uses).

Who Is Responsible for Your Data (Especially Where a Licensed Partner Is Involved)

Depending on the market and product:

• GoTyme and/or a licensed partner may act as a Data Controller or Joint Data Controllers (the entity or entities that determine the purposes and means of processing Personal Data).
• Service providers typically act as Data Processors (processing data on instructions, to deliver contracted services).

Where required, We will make it clear in the relevant application/servicing journey which entity is responsible for Your data for a given product or service, including how to exercise your rights against each entity.

When We Share Your Data

We do not sell Your Personal Data.

We may share data only where necessary and lawful, including with the following classes of recipients:

• Licensed partners (where a product is offered through their licence) to support onboarding, servicing, compliance, payments, and collections
• Service providers and vendors (e.g., cloud hosting, communications, identity verification, fraud prevention, analytics, customer support, collections and legal services)
• Tyme Group and affiliated entities for legitimate operational support, security, audit, and risk management (subject to the Higher Standard Rule)
• Regulators, authorities, or courts when legally required or lawfully requested

Data Privacy Agreements with Third Parties

Where We use third-party services as part of loan application, servicing, or collection/recovery activities, We do so under a Data Privacy agreement (and related security terms) that requires those parties to:

• protect Personal Data with appropriate security controls,
• use it only for the agreed purpose and on Our instructions (unless the law requires otherwise),
• keep it confidential,
• support lawful retention/transfer/deletion requirements, and
• notify Us of relevant security incidents as required.

Cross-Border Processing

Where allowed by law, We may store and process Personal Data using secure systems and reputable cloud providers, including in locations outside the country where You live. When We transfer data across borders, We apply appropriate legal and security safeguards designed to maintain protection consistent with the Higher Standard Rule. We do not intentionally store Your Personal Data in the United States of America.

Cookies and Similar Technologies

We may use cookies and similar technologies (and comparable app technologies) to:

• keep services running securely,
• remember preferences,
• understand how Our channels are used, and
• improve performance and customer experience.

You can manage non-essential cookies through Your browser settings, and You may also have choices through in-product controls where available. Some cookies/technologies are necessary for service functionality and security.

Call/Chat Recording (Online Channels)

If You contact Us through supported channels, We may record or retain calls, chats, and other communications for quality assurance, training, dispute resolution, fraud prevention, and security — where lawful. Where required, we will provide a recording notice at the start of the call/chat or before you submit an in-app query.

If There’s a Security Incident

If a security incident affects Your Personal Data, We will assess it promptly and notify affected individuals and relevant authorities as required by applicable law, and as soon as reasonably practicable.

Your Choices (Including Marketing)

• We may offer You services from time to time. You can opt out at any time through the channel provided in the message or by contacting Us.
• Service/operational messages (e.g., important account notices) may still be sent as needed to manage Your relationship with Us.

Your Rights

Your rights depend on local law, but may include the right to:

• access Your Personal Data,
• correct inaccurate information,
• object to certain processing (including direct marketing where applicable),
• withdraw consent (where processing is based on consent),
• request deletion/erasure or restriction (where applicable),
• request data portability (where applicable), and
• lodge a complaint with the relevant privacy authority.

Some requests may be limited where We must keep data for legal, regulatory, fraud prevention, or contractual reasons.

Additional Terms in relation to GoTyme Hong Kong Limited and Hong Kong

Where permitted by law, we may obtain Personal Data from third-party sources such as identity verification providers, credit reporting agencies, fraud prevention partners, business partners, and public or regulatory sources, and where required under applicable Hong Kong law we will provide a general description of the categories of such sources. Certain Personal Data is mandatory for us to assess eligibility, approve financing, and service facilities in Hong Kong in accordance with applicable legal and regulatory requirements. If required Personal Data is not provided, we may be unable to process an application, provide financing, or continue servicing an existing facility.

We will not use Personal Data for direct marketing purposes in Hong Kong unless prior express consent has been obtained in accordance with Part VI A of the Personal Data (Privacy) Ordinance (Cap. 486), and such consent may be withdrawn at any time without charge. For products and services offered in Hong Kong, GoTyme Hong Kong Limited will generally act as the primary entity responsible for the collection and handling of Personal Data, unless the individual is clearly notified otherwise during the relevant application or servicing process. Where Personal Data is transferred outside Hong Kong, we adopt contractual and organisational safeguards designed to ensure a level of protection comparable to that required under the Personal Data (Privacy) Ordinance. In addition, where required, we may provide a separate Cookie Notice for Hong Kong describing the types of cookies and similar technologies used, their purposes, and the available controls for managing preferences. Individuals may lodge a complaint with the relevant data protection authority (such as the Office of the Privacy Commissioner for Personal Data).

Contact Us

If You have questions or want to make a privacy request:

MCA Asia Data Protection Officer (DPO)
Email: MCA_DPO@tyme.com

Addresses:

• PT GoTyme Capital Indonesia, company number 1311240037234, with its registered address at Equity Tower, 37th Floor Unit D & H, Jl. Jend. Sudirman Kav. 52-53 (SCBD), Jakarta 12190
• GoTyme Hong Kong Limited, company number 69782007, with its registered address at 2516-17, 25/F AXA Southside, Wong Chuk Hang Road, Hong Kong
• GoTyme Malaysia Sdn. Bhd, company number 202601002243 (1664340-A), with its registered address at The Great Room #02-20, Raffles Shopping Arcade, 328 North Bridge Road, Singapore 188719

Updates to This Commitment

This policy was drafted on and is effective from 2 April 2026. We may update this Privacy Commitment from time to time to align with global best practice and changes in relevant regulations.