HEARTLANDERS

1. PERSONAL DATA

1.1 In this Data Protection Policy, "Personal Data" refers to any data, whether true or not, about an individual who can be identified (a) from that data; or (b) from that data and other information to which we have or are likely to have access, including data in our records as may be updated from time to time.

1.2 Examples of such Personal Data you may provide to us include (depending on the nature of your interaction with the Platform) your name, email address, device identifiers, session identifiers assigned via cookies, panel-location data derived from the display panel you interact with, in-platform behavioural data, reward redemption records, and any other information relating to you which you have provided us in the course of using the Platform.

2. COLLECTION OF PERSONAL DATA

2.1 Generally, we collect Personal Data in the following ways:

1. when you tap or scan a Target Media NFC-enabled or QR-enabled display panel and enter the Heartlanders platform, at which point a session identifier is automatically assigned to your device via a browser cookie;

2. when you submit any form, including but not limited to account registration or reward redemption forms;

3. when you create a Heartlanders account by providing your name and email address and completing the email verification process;

4. when you browse, claim, or redeem rewards, vouchers, or lucky draw entries within the Platform;

5. when you participate in daily check-in mechanics, gem collection activities, or other gamified engagement features on the Platform;

6. when you interact with our communications, including emails sent to you following reward redemptions, or promotional emails for which you have provided your consent;

7. when your in-platform behaviour is automatically recorded via analytics tools as you navigate the Platform, including pages visited, rewards viewed, time spent, and interaction patterns;

8. when you request that we contact you, that you be included in a mailing or promotional list, or when you respond to our requests for additional Personal Data, our promotions, and/or other initiatives; and/or

9. when you submit your Personal Data to us for any other reason in connection with your use of the Platform.

2.2 If you provide us with any Personal Data relating to a third party, by submitting such information to us, you represent to us that you have obtained the consent of such third party to you providing us with their Personal Data, and for the collection, use, and disclosure of their Personal Data for all purposes set out herein.

2.3 You should ensure that all Personal Data submitted to us is complete, accurate, true, and correct. Failure to do so may result in our inability to provide you with the products and/or services which you have requested, including reward redemptions and follow-up communications.

3. PURPOSES FOR THE COLLECTION, USE AND DISCLOSURE OF YOUR PERSONAL DATA

3.1 Generally, Target Media collects, uses, and discloses your Personal Data for the following purposes:

1. responding to, processing and handling your complaints, queries, requests, feedback and suggestions, or otherwise providing customer support;

2. managing the administrative and business operations of the Companies and complying with our internal policies and procedures;

3. operating and maintaining the Heartlanders platform, including managing your session, account, reward wallet, gem balance, and participation in platform features;

4. serving advertising content, brand campaign materials, and partner promotions that are contextually relevant to the display panel from which you accessed the Platform;

5. verifying your identity and the accuracy of your Personal Data, including through the email verification process upon account registration;

6. conducting market research and analysis, including understanding user behaviour, engagement patterns, platform usage, and preferences, for the purposes of improving the quality of our products and/or services and the Heartlanders platform experience;

7. preventing, detecting, and investigating fraud, abuse of Platform features, or other misuse of our services, and managing the security of our systems and infrastructure;

8. in connection with any claims, actions, or proceedings (including but not limited to obtaining legal advice and facilitating dispute resolution), and/or protecting and enforcing our contractual and legal rights and obligations;

9. meeting or complying with any applicable rules, laws, regulations, codes of practice, or guidelines issued by any legal or regulatory bodies including the Personal Data Protection Commission ("PDPC"), and/or assisting with any enquiries, requests, or investigations by relevant authorities; and/or

10. any other purpose relating to or reasonably necessary for any of the above.

These purposes may also apply even if you no longer use the Heartlanders Platform or have deleted your account.

3.2 In addition, Target Media collects, uses, and discloses your Personal Data for the following purposes, depending on the nature of your interaction with the Platform:

(a) If you are a guest user (accessing the Platform without registering an account):

1. assigning a session identifier to your device to manage your in-platform experience and maintain continuity of your session;

2. recording your in-platform behaviour, including pages visited, rewards viewed, and engagement with platform features, for analytics and platform improvement purposes;

3. recording the panel location from which you accessed the Platform, based on the unique device identifier of the display panel tapped or scanned, for the purpose of serving contextually relevant content; and/or

4. tracking gem accumulation and engagement activity associated with your guest session.

(b) If you are a registered user (holding a Heartlanders account):

1. creating and managing your Heartlanders account, including administering your profile, gem balance, reward wallet, and transaction history;

2. processing reward redemptions, voucher issuances, and lucky draw participations, and maintaining records thereof;

3. sending transactional emails, including reward redemption confirmations and account-related notifications, which are necessary to fulfil your use of the Platform;

4. verifying your email address upon account registration to ensure the accuracy of your Personal Data;

5. linking your guest session history to your registered account upon account creation, where applicable; and/or

6. managing and processing any requests, queries, or complaints submitted by you in connection with your account.

3.3 In addition, where permitted under applicable law, we may also collect, use, and disclose your Personal Data for the following purposes (which we may describe as "Additional Purposes" for the handling of Personal Data):

1. providing or marketing promotions, products, services, and/or benefits to you, including reward and loyalty programmes offered through the Heartlanders Platform;

2. sending you details of promotions, partner offers, special rewards, and campaign updates, either generally to our users, or which we have identified may be of interest to you, where you have provided your consent to receive such marketing communications;

3. conducting market research and understanding user behaviour, preferences, and engagement patterns for the purposes of designing and improving platform features, reward offerings, and advertiser value propositions; and/or

4. sharing anonymised and aggregated data (such as total redemption counts, scan volumes, or general engagement metrics, which are not capable of identifying any individual) with brand partners and advertisers on the Platform, for the purposes of campaign reporting and partner analytics.

3.4 We will only send you marketing or promotional communications, including emails featuring partner offers and Heartlanders campaign updates, where you have explicitly opted in to receive such communications at the point of account registration or thereafter through your communication preferences settings. You have the right to withdraw your consent to receive marketing communications at any time by: (a) clicking the "Unsubscribe" link in any marketing email; (b) updating your communication preferences in your account settings on the Platform; or (c) contacting our Data Protection Officer at the details set out in Section 7. Such requests will be processed within a reasonable time. Please note that after opting out of marketing communications, you may still continue to receive transactional messages, such as reward redemption confirmations and account notifications, as these are necessary for the provision of services you have requested.

3.5 In relation to particular promotions, features, or services on the Platform, we may also specifically notify you of other purposes for which we collect, use, or disclose your Personal Data. If so, we may collect, use, and disclose your Personal Data for these additional purposes as well, unless we have specifically notified you otherwise.

4. COOKIES AND TRACKING TECHNOLOGIES

4.1 The Heartlanders Platform uses cookies and similar session technologies to operate and deliver its features. A cookie is a small file placed on your device that allows us to recognise your session and maintain continuity of your in-platform experience across your visit.

4.2 We use the following types of cookies and tracking technologies on the Platform:

1. Session cookies (Principal ID): A unique session identifier is assigned to your device upon entry to the Platform. This identifier is used to manage your session, track your gem accumulation, maintain your reward wallet state, and associate your in-platform activity with a consistent record. This identifier is linked to your device and browser rather than your personal identity unless and until you register for an account;

2. Analytics tracking (PostHog): We use PostHog, a third-party analytics service, to record in-platform behaviour including pages visited, rewards viewed, interaction sequences, and session duration. This data is used to analyse and improve the Platform experience. Please note that PostHog's infrastructure is operated from servers located in the United States; further details are set out in Section 6; and

3. Preference cookies: We use cookies to remember whether you have acknowledged this Data Protection Policy and to store your communication preferences, including your marketing consent status.

4.3 By acknowledging this Data Protection Policy and continuing to use the Platform, you consent to the use of cookies as described in this Section. You may withdraw this consent at any time by clearing your browser cookies, adjusting your browser settings to refuse cookies, or using the consent withdrawal option within the Platform. Please note that disabling cookies may impair the functionality of certain Platform features, including session continuity, gem tracking, and reward redemption.

5. DISCLOSURE OF PERSONAL DATA

5.1 Target Media will take reasonable steps to protect your Personal Data against unauthorised disclosure. Subject to the provisions of any applicable law, your Personal Data may be provided, for the purposes listed above (where applicable), to the following entities or parties, whether they are located overseas or in Singapore:

1. Target Media's related corporations and affiliated entities within the Target Media group;

2. agents, contractors, or third-party service providers who provide operational services to Target Media, including technology infrastructure providers, analytics providers, email service providers, customer support providers, payment processors, and other service providers engaged in connection with the operation of the Heartlanders Platform;

3. brand partners and advertisers on the Heartlanders Platform, strictly in the form of anonymised and aggregated data (such as total redemption volumes, scan counts, and general engagement metrics) that is not capable of identifying any individual user;

4. any business partner, investor, assignee, or transferee (actual or prospective) to facilitate business asset transactions (which may extend to merger, acquisition, debt, or asset sales) involving any of the Companies;

5. our professional advisers such as our consultants, auditors, and lawyers;

6. relevant government regulators, government ministries, statutory boards or authorities and/or law enforcement agencies, whether local or overseas, to comply with any directions, laws, rules, guidelines, regulations, or schemes issued or administered by any of them, including the PDPC; and/or

7. any other party to whom you authorise us to disclose your Personal Data.

5.2 We do not sell your Personal Data to any third party. We do not share your individually identifiable Personal Data with brand partners or advertisers on the Platform. All data shared with partners for campaign reporting purposes is aggregated and anonymised such that no individual user can be identified therefrom.

6. TRANSFER OF PERSONAL DATA OUTSIDE SINGAPORE

6.1 In the course of operating the Platform, certain Personal Data may be transferred to, stored in, or processed by service providers located or operating outside Singapore. In particular, our analytics service provider PostHog operates servers located in the United States of America.

6.2 Where we transfer Personal Data outside Singapore, we will take steps to ensure that the recipient provides a standard of protection to such Personal Data that is at least comparable to the protection under the PDPA, including through the execution of data processing agreements or other contractual arrangements that incorporate appropriate transfer safeguards, in accordance with Section 26 of the PDPA.

6.3 By using the Platform and consenting to this Data Protection Policy, you acknowledge and consent to the transfer of your Personal Data to such overseas recipients in accordance with the terms of this Section and the PDPA. If you have any questions about the safeguards in place for cross-border transfers of your Personal Data, please contact our Data Protection Officer using the contact details set out in Section 8.

7. RETENTION OF PERSONAL DATA

7.1 Target Media will retain Personal Data only for as long as it is necessary to fulfil the purposes for which it was collected, or as required or permitted by applicable law. We will cease to retain Personal Data, or remove the means by which such Personal Data can be associated with particular individuals, as soon as it is reasonable to assume that the purpose for which that Personal Data was collected is no longer being served by retention of such Personal Data, and such retention is no longer necessary for legal or business purposes.

7.2 In general, the following retention periods apply to Personal Data held by Target Media in connection with the Platform:

1. Guest session identifiers and associated behavioural data: retained for a period of 12 months from the date of your last interaction with the Platform, following which such data will be permanently deleted or anonymised;

2. Registered user profile data (including name and email address): retained for the duration of your account and for a period of 12 months following account closure or deletion;

3. Reward redemption and transaction records: retained for a period of 7 years from the date of the relevant transaction, in accordance with Singapore business record-keeping requirements;

4. Marketing consent records: retained for the duration of your consent and for a period of 3 years following withdrawal of consent, as evidence of our compliance with applicable consent obligations;

5. Platform analytics and event data: retained for a period of 12 months from the date of collection; and

6. Breach response, incident, and audit records: retained for a period of 5 years from the date of the relevant incident.

7.3 Upon expiry of the applicable retention period, Personal Data will be either permanently deleted from our systems or anonymised such that it can no longer be linked to any identifiable individual. Soft-deleted records retained in our systems for operational continuity purposes will be subject to scheduled purging or anonymisation processes on a periodic basis.

8. DEEMED CONSENT

8.1 In addition to the matters set forth above, subject to and in accordance with applicable law, you shall be deemed to have consented to us collecting, using, disclosing, and sharing amongst ourselves your Personal Data, and disclosing such Personal Data to our authorised service providers and relevant third parties:

1. where, in response to a request for your Personal Data in connection with identified purposes, you voluntarily provide such Personal Data to us for such purpose(s) and it is reasonable that you would voluntarily provide such Personal Data, including where you enter the Platform by tapping or scanning a display panel, browse or claim rewards, or register for an account; and

2. where the collection, use, and/or disclosure of your Personal Data is reasonably necessary for the conclusion and/or performance of a contract between you and us or any other organisation entered into at your request, which may include recipients of your Personal Data not indicated in this Data Protection Policy, such as the fulfilment of reward redemptions and the delivery of associated communications.

9. OTHER BASES FOR PROCESSING YOUR PERSONAL DATA

9.1 In addition to and without limiting the consents you have provided to our collection, use, and/or disclosure of your Personal Data for the purposes set out elsewhere in this Data Protection Policy, where permitted by applicable law, we may in accordance with the requirements thereof also collect, use, and/or disclose your Personal Data as further detailed below, including without consent, where we meet the requirements under applicable law:

1. for our legitimate interests or the legitimate interests of another person (but not for sending you direct marketing messages unless you have otherwise provided your consent), including without limitation for the following purposes:

2. to the extent permitted by applicable law, we may collect, use, and share Personal Data across the Companies for the purposes of improving our products, services, and processes, understanding user preferences, and personalising experiences and recommendations.

1. any investigations or proceedings;

2. fraud detection, prevention, and the investigation of misuse of Platform features;

3. managing and maintaining the security and integrity of our systems and infrastructure;

4. recovering a debt owed by you to us or paying a debt owed by us to you;

5. obtaining legal services and enforcing our legal rights;

6. improving the Platform, including analysing aggregated usage patterns and engagement data to enhance user experience and partner value;

10. PROTECTION OF PERSONAL DATA

10.1 Target Media will take reasonable steps to protect Personal Data in our possession or under our control by making reasonable security arrangements to prevent unauthorised access, collection, use, disclosure, copying, modification, disposal, or similar risks. These security arrangements include, without limitation:

1. encryption of Personal Data at rest within our database systems;

2. access controls and role-based permissions limiting internal staff access to Personal Data on a need-to-know basis;

3. secure and authenticated API communication between Platform components;

4. data processing agreements with all third-party service providers who process Personal Data on our behalf; and

5. periodic security reviews and assessments of our platform infrastructure and data handling practices.

10.2 While we take all reasonable steps to protect your Personal Data, no system or method of transmission over the internet can be guaranteed to be completely secure. We cannot accept responsibility for any unauthorised access to or loss of Personal Data that is beyond our reasonable control.

10.3 In the event of a data breach that is, or is likely to be, of a significant scale or is likely to result in significant harm to affected individuals, Target Media will assess the breach in accordance with our internal breach response procedures and notify the PDPC and affected individuals as required under the PDPA within the applicable statutory timeframes.

11. MINORS

11.1 The Heartlanders Platform is not directed at children under the age of 13. We do not knowingly collect Personal Data from children under the age of 13 without the consent of a parent or guardian. If you are a parent or guardian and believe that your child has provided us with Personal Data without your consent, please contact our Data Protection Officer using the contact details set out in Section 12 and we will take steps to delete such information promptly.

12. CONTACTING US — QUESTIONS, FEEDBACK, WITHDRAWAL OF CONSENT, ACCESS AND CORRECTION OF YOUR PERSONAL DATA

12.1 If you:

1. have any questions or feedback relating to your Personal Data or our Data Protection Policy, including without limitation our reliance on deemed consent or other bases for collecting, using, and/or disclosing your Personal Data;

2. would like to withdraw your consent to any use of your Personal Data as set out in this Data Protection Policy;

3. would like to obtain access to your Personal Data records held by us, or to request a copy of such Personal Data in a structured format; or

4. would like to make corrections to any inaccurate or incomplete Personal Data that we hold about you,

please contact our Data Protection Officer at dpo@targetmedia.sg.

12.2 Please note that if your Personal Data has been provided to us by a third party, you should contact such party directly to make any queries, feedback, and access and correction requests on your behalf.

12.3 If you withdraw your consent to any or all collection, use, and/or disclosure of your Personal Data, depending on the nature of your request, we may not be in a position to continue to provide our services to you and/or administer any rewards, account balance, or other platform features associated with your account. Such withdrawal of consent may also result in the cessation of your access to certain Platform features. Our legal rights and remedies in such event are expressly reserved. Please also note that withdrawing consent does not affect our right to continue to process Personal Data where such processing without consent is permitted or required under applicable laws.

12.4 If you are dissatisfied with our handling of your Personal Data or any request made under this Section, you have the right to lodge a complaint with the Personal Data Protection Commission (PDPC) at www.pdpc.gov.sg or by calling the PDPC Advisory Hotline at 6377 3131.

13. GOVERNING LAW

13.1 This Data Protection Policy shall be governed in all respects by the laws of Singapore.