Kuala Lumpur Kepong Berhad (hereinafter: “KLK”, “we” or “us”), with its registered address at Wisma Taiko, No. 1, Jalan S.P. Seenivasagam, 30000 Ipoh, Perak Darul Ridzuan, Malaysia is the “Controller” of your Personal Data collected via the Website. When Personal Data is collected in a different manner, KLK as well as another KLK Group entity and/or affiliate may be the Controller of your Personal Data and reference to KLK in this Privacy Notice shall also refer to such other KLK Controller. For instance, if you are:

• Visiting our website: KLK will be the Controller if you are visiting www.klk.com.my. Otherwise, the KLK entity that operates the website will be the Controller.

• A business partner: the relevant KLK entity you are contracting with will be the Controller.

• Visiting our premise: the relevant KLK entity operating the location are you visiting will be the Controller.

This means that we are responsible for deciding how your Personal Data is used, and for ensuring (in conjunction with other parties involved in the processing of your Personal Information, as explained in this Privacy Policy) that your Personal Data is handled in compliance with applicable data protection law. An overview of applicable KLK entities, and where applicable, their representative, can be found below. Please see Section 11 to find out how to contact us.

COMPANY
Kuala Lumpur Kepong
KLK OLEO

DOMAIN
www.klk.com.my
www.klkoleo.com
www.klkoleo.com/davoslife
www.klkoleo.com/davoslife/estore
www.klkoleo.com/klkemmerich
www.klkoleo.com/tensachem
www.klkoleo.com/temix
www.klkoleo.com/kolb
www.kolb.ch
www.temixoleo.com
www.tensachem.com
www.tocotrienolresearch.com

KLK Refineries
www.klk.com.my/refineries
www.astra-klk.com
www.kaeo.com.my

KL-Kepong Rubber Products
www.klkrp.com.my

KLK Hardwood Flooring
www.klkflooring.com

KLK Land
www.klkland.com.my

We collect the following types of Personal Data when you visit and use the Website or a KLK location or enter into business with us as a partner or supplier:

1. Information you provide to us: We collect Personal Data that you choose to provide to us.

   • if you visit a Website: when filling out an enquiry form on this Website, when subscribing to e-mail notifications or our e-mail newsletter, when corresponding with us on this Website. Such Personal Data may include: your first name and surname, email address, telephone number, information about your preferences and interests, information about your business such as your work telephone number, your work e-mail address, and any Personal Data you provide to us when corresponding with us;

   • when visiting a KLK location: such Personal Data may include: your first name and surname, email address, telephone number, information about your business such as your work telephone number, your work e-mail address, your position within the business, and/or training etc., date, time and reason of visit (if applicable), and any Personal Data you provide to us when corresponding with us;

   • when entering into business with us as partner or supplier: such Personal Data may include: your first name and surname, email address, telephone number, information about your business such as your work telephone number, your work e-mail address, your position within the business, financial information (if required for the performance of the service and/or invoicing) and any Personal Data you provide to us when corresponding with us.

2. Information automatically collected by us: When you visit or interact with this Website, we automatically collect Personal Data about you and your visit. Such information includes: your IP address and other unique identifiers for the computer, mobile and/or other device you use to access this Website, your user behaviour and any referring to this Website including the date, time and duration of your visit, your browser type and your operating system. We gather such information through cookies and other web technologies. More information on the use of cookies can be found in our Cookie Policy

3. Information collected from or provided by third parties: We may also obtain Personal Data about you from third parties, for example, collecting or verifying information when using third party tools to conduct sanctions checks, collecting contact details of personnel from a service provider in advance of a visit to a KLK Group location etc.

We process your Personal Data when you visit the Website or engage with us as a contractor or vendor for the following purposes and based on one or more of the following lawful bases:

1. When you provide your consent (art. 6(1)(a) GDPR), as permitted by applicable law: to inform you and to promote our (new) products and/or services (for instance via direct marketing communications); to place cookies on your device (please refer to our Cookie Policy for more information).

2. To perform our contract with you or enter into such contract with you (art. 6(1)(b) GDPR): to provide our services to you; to recover our debts from you.

3. For our legitimate (business or legal) interest (art. 6(1)(f) GDPR): to answer your queries and further maintain contact with you, if necessary; for our internal management; for administrative purposes; for security purposes; for the handling of complaints and disputes; to provide, maintain, secure and/or optimise our Website and compile user statistics for improvement of the Website to ensure that we can provide you with a well-functioning website (please refer to our Cookie Policy for more information).

4. For compliance with our legal obligations (art. 6(1)(c) GDPR): to comply with our legal obligations when required under applicable local laws. These can be specific regulations, court orders or governmental regulations.

We may share your information with other third parties (such as persons employed by or working on behalf of our entities from the KLK group of companies (“KLK Group”) or data processors engaged by us) for the purposes described below. We will only disclose your Personal Data to those with a legitimate business need and after we have taken steps to ensure that your Personal Data is processed in a manner consistent with this Privacy Notice.

These include:

• • Our KLK Group entities to provide you with the services: For the purpose of providing you with the services of subsidiaries we may disclose Personal Data that you provide to us to KLK Group that are entrusted to process your information on our behalf in accordance with our instructions, this Privacy Notice and other appropriate measures for privacy and security.

  • Our Service Providers: Your Personal Data may be disclosed to our service providers who perform services on our behalf. The service providers provide services such as cloud hosting providers, website management providers and IT services. We will put suitable safeguards in place to ensure that our service providers safeguard your Personal Data and only process the Personal Data as instructed.

  • Other third parties when necessary pursuant to regulatory obligations: We may disclose your Personal Data with third parties including but not limited to any national and/or international regulatory, enforcement or exchange body or court where we are required to do so by applicable law or regulation or at their request (such as with other organisations for fraud prevention and detection).

  • Successors in title of our business in case of a corporate transaction.

  • Any central or local government department and other statutory or public bodies.

We do not sell Personal Data to anyone and only share it with third parties when this is necessary.

The Personal Data may also be processed in a country outside the European Economic Area (the “EEA”), which covers the EU Member States, Iceland, Liechtenstein and Norway. Non-EEA countries may not offer the same level of Personal Data protection as EEA countries.

We will put suitable safeguards in place to ensure that transfers are carried out in compliance with the applicable data protection rules. For transfers from the EEA to outside the EEA, these include, for instance, relying on adequacy decisions or standard contractual clauses issued by the European Commission together with binding and enforceable commitments by the recipient.

Subject to your applicable laws, you may request additional information in this respect and obtain a copy of the relevant safeguard by exercising your rights as set out below.

Subject to your applicable law, you may have certain legal rights in respect of the information KLK holds about you. These include:

• Request access to your Personal Data (for example the right to be provided with certain information about KLK’s Processing of Personal Data and access to that data (subject to exceptions);

• Request rectification or correction of your Personal Data (such as where the individual’s home address changes and KLK needs to have the up-to-date information);

• Request erasure of your Personal Data in certain circumstances including where it is no longer necessary for KLK to Process the Personal Data for the purpose it was collected;

• Request restriction of Processing of your Personal Data (for example, where you dispute the accuracy of Personal Data relating to you or where KLK no longer needs the Personal Data but the contractor needs it for the establishment, exercise or defence of legal claims);

• Request data portability (such as the right to receive any Personal Data you have provided to KLK in a structured, commonly used and machine-readable format, as well as to require KLK to transmit it to another controller when technically feasible);

• Object to the Processing of your Personal Data (such as on grounds relating to your particular situation where such Processing is based on KLK’s legitimate interests or on public interest); and

• Withdraw consent (where such consent was obtained and relied on for the purposes of the Processing).

Subject to your applicable laws, you may also have the right to lodge a complaint with a local supervisory authority.

Individuals wishing to exercise any of the above rights can send an email to privacy@klk.com.my.

KLK will honour any of the above requests, withdrawal or objections as required under the applicable data protection rules but not all of these rights are absolute; they do not always apply, and sometimes exemptions may be engaged. We may, in response to a request, ask you to verify your identity and/or provide information that help us to understand your request better. Whenever reasonably possible and required under applicable laws, we will strive to respond to your requests within one month. If we do not comply with your request within such time frame, we will explain why.

We have implemented adequate technical and organisational measures to safeguard the Personal Data we process. We restrict access to your Personal Data to employees on a need-to-know basis and train staff about the importance of confidentiality and maintaining the privacy and security of your information.

We will retain your Personal Data for no longer than necessary in relation to the purposes for which the data are processed, or for such longer period as is permitted or required by applicable law.

We may change this Privacy Notice from time to time by posting the updated version of the Privacy Notice on our Website. We will give you reasonable notice on our Website of any material changes. The “effective date” at the top of this Privacy Notice indicates when such changes will take effect. We encourage you to visit frequently to stay informed about how we use your Personal Data.

To ask questions or comment about our Privacy Notice and our privacy practices, you can contact our Data Protection Officer at privacy@klk.com.my

Please refer to our Cookie Policy for more information on our use of cookies with this Website.