CATHAY CINEPLEXES PRIVACY POLICY

APPLICATION
This Data Protection Policy (“Policy”) sets out the basis upon which mm Connect Pte Ltd. and its affiliates, including but not limited to Cathay Cineplexes Pte Ltd (“we”, “us”, “our” or "MMC") may collect, use, disclose or otherwise process personal data of our customers in accordance with the Personal Data Protection Act (“PDPA”). This Policy applies to personal data in our possession or under our control, including personal data in the possession of organisations which we have engaged to collect, use, disclose or process personal data for our purposes.
PERSONAL DATA
As used in this Policy: “Customer” means an individual who (a) has contacted MMC through any means to find out more about any goods or services that MMC provides, or (b) may enter or has entered into a contract with MMC for the supply of any goods or services by MMC (including but not limited to through the individual's download and use of our mobile device application, use of our self-service ticketing kiosks and use of or access to our website at www.cathaycineplexes.com and other online channels (collectively referred to as the “Platform”)).

“Personal data” means data, whether true or not, about a Customer who can be identified: (a) from that data; or (b) from that data and other information to which we have or are likely to have access.

Depending on the nature of the Customer's interaction with MMC, some examples of personal data which we may collect from the Customer includes his/her name, contact information such as residential address, email address or telephone number, nationality, gender, date of birth, marital status, photographs and other audio-visual information, employment information and financial information such as credit card numbers, debit card numbers or bank account information.

Other terms used in this Policy shall have the meanings given to them in the PDPA (where the context so permits).
If you are under 18 years of age, you should ensure that you obtain the consent of your parents or legal guardian before using the Platform. If you are a firm, corporation or entity supplying personal data of your partners, directors, shareholders, employees, officers and/or other persons to us, please do ensure that you have obtained their consent and bring this Policy to their attention.
COLLECTION, USE AND DISCLOSURE OF PERSONAL DATA
We generally do not collect Customers' personal data unless (a) it is provided to us voluntarily by the Customer directly or via a third party who has been duly authorised by the Customer to disclose his/her personal data to us ("Customer's authorised representative”) after (i) the Customer (or Customer's authorised representative) has been notified of the purposes for which the data is collected, and (ii) the Customer (or Customer's authorised representative) has provided written consent to the collection and usage of the Customer's personal data for those purposes, or (b) collection and use of personal data without consent is permitted or required by the PDPA or other laws. We shall seek the Customer's consent before collecting any additional personal data and before using the Customer's personal data for a purpose which has not been notified to the Customer (except where permitted or authorised by law).

We may collect and use the Customer's personal data for any or all of the following purposes:
• (a) performing obligations in the course of or in connection with MMC's provision of its goods and/or services;
• (b)verifying the Customer's identity;
• (c) responding to, handling, and processing queries, requests, applications, complaints, and feedback from the Customer;
• (d) managing the Customer's relationship with MMC;
• (e) processing payment or credit transactions;
• (f) contacting the Customer for the purposes of (without limitation), conducting surveys, sending the Customer marketing information about MMC's goods or services, including notifying the Customer of our marketing events, initiatives and promotions, lucky draws, membership and rewards schemes and other promotions;
• (g) complying with any applicable laws, regulations, codes of practice, guidelines, or rules, or to assist in law enforcement and investigations conducted by any governmental and/or regulatory authority;
• (h) creating custom audiences for social media advertisements;
• (i) improving MMC's business operations and processes (e.g. improving customer experience and refining our marketing strategy);
• (j) any other purposes for which the Customer have provided the information;
• (k) transmitting to any unaffiliated third parties including MMC's third party service providers and agents, and relevant governmental and/or regulatory authorities, whether in Singapore or abroad, for the aforementioned purposes; and
• (l) any other incidental business purposes related to or in connection with the above.

MMC may disclose the Customer's personal data:
• (a) where such disclosure is required for performing obligations in the course of or in connection with MMC's provision of the goods or services requested by the Customer; or
• (b) to third party service providers, agents and other organisations MMC has engaged to perform any of the functions listed in clause 7 above for MMC.

The purposes listed in the above clauses may continue to apply even in situations where the Customer's relationship with MMC (for example, pursuant to a contract) has been terminated or altered in any way, for a reasonable period thereafter (including, where applicable, a period to enable MMC to enforce its rights under any contract with the Customer or vis a vis third parties which contract with MMC). MMC may also have specifically notified the Customer of other purposes for which MMC may collect, use or disclose the Customer's personal data in relation to certain goods or services that MMC provide. If so, MMC will then collect, use and disclose the Customer's personal data for these additional purposes as well, unless MMC has specifically notified the Customer otherwise.
WITHDRAWING CONSENT
The consent that the Customer provides for the collection, use and disclosure of his/her personal data will remain valid until such time it is being withdrawn by the Customer in writing. The Customer may withdraw consent and request MMC to stop using and/or disclosing the Customer's personal data for any or all of the purposes listed above by submitting a request in writing or via email to MMC's Data Protection Officer at the contact details provided in Paragraph 24 of this Policy.

Upon receipt of the Customer's written request to withdraw consent, MMC may require reasonable time (depending on the complexity of the request and its impact on MMC's relationship with the Customer) for the Customer's request to be processed and for MMC to notify the Customer of the consequences of MMC acceding to the same, including any legal consequences which may affect the Customer's rights and liabilities. In general, MMC shall seek to process the Customer's request within thirty (30) business days of receiving it. Upon receipt of the Customer's written request to withdraw consent, MMC will ensure that its representatives cease using or disclosing the Customer's personal data within a reasonable period of such request. However, MMC will not inform other organisations to which it has disclosed the Customer's personal data of the Customer's withdrawal of consent. The Customer may find out which other organisations his personal data may have been disclosed to and give notice to withdraw consent to those other organisations directly.

Whilst MMC respects the Customer's decision to withdraw his/her consent, depending on the nature and scope of the Customer's request, MMC may not be in a position to continue providing its goods or services and shall, in such circumstances, notify the Customer before completing the processing of such request. The Customer's withdrawal of consent does not affect MMC's right to continue to collect, use and disclose personal data where such collection, use and disclose without consent is permitted or required under applicable laws. Notwithstanding anything to the contrary, MMC retains the discretion not to delete or destroy any personal data which it may require for its business or legal needs.
ACCESS TO AND CORRECTION OF PERSONAL DATA
If the Customer wishes to make (a) an access request for access to a copy of the personal data which MMC holds about the Customer or information about the ways in which MMC uses or discloses the Customer's personal data, or (b) a correction request to correct or update any of his/her personal data which MMC holds about the Customer, the Customer may submit his/her request in writing or via email to MMC's Data Protection Officer at the contact details provided in Paragraph 24 of this Policy.

A reasonable fee may be charged for an access request. If so, MMC will inform the Customer of the fee before processing his/her request. Also, if the Customer's personal data has been provided to MMC by a third party, the Customer should request for the relevant third party to make the access or correction request on the Customer's behalf.

MMC will respond to the Customer's request as soon as reasonably possible. Should MMC not be able to respond to the Customer's request within thirty (30) days after receiving the request, MMC will inform the Customer in writing within thirty (30) days of the time by which MMC will be able to respond to the Customer's request. If MMC is unable to provide the Customer with any personal data or to make a correction requested by the Customer, MMC shall generally inform of the reasons why MMC are unable to do so (except where MMC is not required to do so under the PDPA).
PROTECTION OF PERSONAL DATA
To safeguard the Customer's personal data from unauthorised access, collection, use, disclosure, copying, modification, disposal or similar risks, MMC has introduced appropriate administrative, physical and technical measures such as up-to-date antivirus protection, encryption and the use of privacy filters to secure all storage and transmission of personal data by MMC, and disclosing personal data both internally and to MMC's authorised third party service providers and agents only on a need-to-know basis.

The Customer should be aware, however, that no method of transmission over the Internet or method of electronic storage is completely secure. While security cannot be guaranteed, MMC strives to protect the security of the Customer's information and are constantly reviewing and enhancing MMC's information security measures.

MMC will respond to the Customer's request as soon as reasonably possible. Should MMC not be able to respond to the Customer's request within thirty (30) days after receiving the request, MMC will inform the Customer in writing within thirty (30) days of the time by which MMC will be able to respond to the Customer's request. If MMC is unable to provide the Customer with any personal data or to make a correction requested by the Customer, MMC shall generally inform of the reasons why MMC are unable to do so (except where MMC is not required to do so under the PDPA).
ACCURACY OF PERSONAL DATA
MMC generally relies on personal data provided by the Customer (or Customer's authorised representative). In order to ensure that the Customer's personal data is current, complete and accurate, the Customer shall update MMC if there are changes to the Customer's personal data by informing MMC's Data Protection Officer in writing or via email at the contact details provided in Paragraph 24 of this Policy.
RETENTION OF PERSONAL DATA
MMC may retain the Customer's personal data for as long as it is necessary to fulfil the purpose for which it was collected, or as required or permitted by applicable laws.

MMC will cease to retain the Customer's personal data, or remove the means by which the data can be associated with the Customer, as soon as it is reasonable to assume that such retention no longer serves the purpose for which the personal data was collected, and is no longer necessary for legal or business purposes.
TRANSFERS OF PERSONAL DATA OUTSIDE OF
MMC generally does not transfer the Customer's personal data to countries outside of Singapore. However, if MMC does so, the Customer's personal data may be stored in external servers that are located out of Singapore, or may be transferred out of Singapore where it is necessary to share the Customer's personal data with and between MMC's related corporations and business units, and third party service providers. MMC is committed to protecting the Customer's personal data when it is transferred out of Singapore. Where the Customer's personal data is transferred out of Singapore, MMC will take reasonable steps to ensure that the Customer's personal data continues to receive a standard of protection that is at least comparable to that provided under the PDPA.
CONTACTING THE CUSTOMER
If the Customer has provided MMC with his/her Singapore telephone number(s) and has indicated that he/she consents to receiving MMC's marketing or other promotional information by way of the Customer's Singapore telephone number(s), then from time to time, MMC and its Employees may contact the Customer using such Singapore telephone number(s) even if these telephone number(s) are registered with the “Do Not Call” Registry. The Customer may however let MMC know in writing if the Customer does not wish to be contacted by MMC at the Customer's telephone number(s) for such purposes. For the avoidance of doubt, nothing in this paragraph restricts or prohibits MMC from contacting the Customer through any other means (e.g. email or social media), where MMC has obtained the consent of the Customer for the collection, use and disclosure of such personal data.
EFFECT OF POLICY AND CHANGES TO POLICY
This Policy applies in conjunction with any other notices, contractual clauses and consent clauses that apply in relation to the collection, use and disclosure of the Customer's personal data by MMC.

MMC may revise this Policy from time to time without any prior notice. The Customer may determine if any such revision has taken place by referring to the date on which this Policy was last updated. The Customer's continued use of MMC's services constitutes the Customer's acknowledgement and acceptance of such changes.
GOVERNING LAW
This Data Protection Policy shall be governed by and shall be construed in accordance with the laws of Singapore. The Customer hereby submits to the non-exclusive jurisdiction of the Singapore courts.
DATA PROTECTION OFFICER
You may contact our Data Protection Officer if you have any enquiries or feedback on our personal data protection policies and procedures; or if you wish to make any request, in the following manner:

Email: [email protected]