CYBER SECURITY AND DATA PROTECTION

The purpose of this Cyber Security and Data Protection Schedule (hereinafter referred to as “Schedule”) is to ensure adherence to the Cyber Security and Data Protection provisions, as morefully set out herein, by any Company entering into business with ADL.

In this Schedule the following expressions shall, unless the context otherwise requires, have the meanings assigned to them below:

“ADL” means Axiata Digital Labs (Private) Limited, Axiata Digital Labs Sdn Bhd (Formerly known as Axiata Management Services Sdn Bhd) and PT Axiata Digital Labs Indonesia as applicable;

“ADL Data” includes, but is not limited to, the data, text, drawings, diagrams, plans, statistics or images (together with any database made up of any of these) which are embodied in any electronic, magnetic, electromagnetic, optical, tangible or other media,:

(a) which are supplied to the Company by or on behalf of ADL; or

(b) which the Company accesses, processes, stores, transmits or replicates using or on the Company’s systems or equipment pursuant to the Agreement; or

(c) which the Company has custody or control of for purposes connected to the Agreement,

including any Personal Data which ADL controls the Processing of, or which comes into the knowledge, possession or control of the Company pursuant to the Agreement;

For the sake of clarity, ADL Data includes Confidential Information as defined in the Agreement and Personal Data as defined in this Schedule.

“ADL Systems” means the hardware (including computer hardware), software and telecommunications or information technology equipment, systems and networks used or owned by ADL or licensed to ADL by a third party;

“Affiliate” means in relation to a party any entity which, directly or indirectly, controls or is controlled by, or is under common control with, that party, where control is the possession, directly or indirectly, of (a) alone or pursuant to an agreement with other members, a majority of the voting rights in it, (b) the power to direct or cause the direction of the management or operating policies of the entity through the exercise of voting rights, contract, trust or otherwise, or (c) a right to appoint or remove the majority of the directors of the entity, and “Affiliates” means any of them;

“Best Industry Practice” means, in relation to any undertaking and any circumstances, the exercise of the degree of skill, care, diligence, prudence, foresight and judgement which could reasonably be expected from highly skilled, experienced persons, entities and world leading suppliers and contractors engaged in comparable types of undertaking under similar circumstances, applying equivalent or better standards currently applied in the industry relevant to the Professional Services and any other products, works and services that may become available to ensure, without limitation, the objectives and obligations identified in the Agreement are achieved and performed that include best practices and value in respect of price, performance and time to market;

“The Company” shall mean those parties that provide Professional Services to ADL and shall also be referred to as the vendors contractor/s and/or service provider/s.

“Cyber Security and Data Protection” means this Schedule and any amendments effected by ADL from time to time.

“Data Subject” means an individual who is the subject of the Personal Data;

“Deliverables” means the items set out in the Agreement identified as the scope of work and shall include any amendments and modifications as requested by ADL from time to time and shall include anything compiled, written, provided, created and developed by the Company in relation to the Professional Services, including but not limited to materials, studies, methodologies, models or general industry perspective and practices, plans, drawings, diagrams, statistics and reports;

“Malware” means anything, software or device which may impair or otherwise adversely affect the operation of any computer or system, prevent or hinder access to any program or data (whether by rearranging within the computer or any storage medium or device, altering or erasing, the program or data in whole or in part, or otherwise), gain unauthorised access to any program, equipment, system or data or collect data or surveillance without authorisation, including worms, Trojan horses, computer viruses, ransomware, spyware or similar things;

“Party” means a party to the Agreement and “Parties” means the parties to the Agreement;

“Personal Data” means personal data, personal information or data relating to individuals;

“Personnel” means in relation to a party, the employees, directors, officers, agents, advisers, contractors and subcontractors of that party or of its Affiliates or associates, and the employees, directors and personnel of any such agents, advisers, contractors and subcontractors. The Company’s Personnel shall, in addition to the foregoing, include Sub-Processors;

“Process” or “Processing” means collecting, recording, holding or storing Personal Data or carrying out any operation or set of operations on Personal Data, including:

(a) the organization, adaptation or alteration of Personal Data;

(b) the retrieval, consultation or use of Personal Data;

(c) the disclosure of Personal Data by transmission, transfer, dissemination or otherwise making available; or

(d) the alignment, combination, correction, erasure or destruction of Personal Data;

“Professional Services” means the services to be provided by the Company to ADL which includes the Deliverables as more particularly set out in the Agreement.

“Sub-Processor” means any party appointed by, or on behalf of, the Company to Process Personal Data of ADL in connection with the Agreement.

3.1 In this Schedule, unless the context otherwise requires:

a. words denoting the singular number include the plural and vice-versa;

b. words denoting a gender include every gender;

c. words denoting natural persons include bodies corporate and unincorporated;

d. reference to a clause, annexure or schedule is a reference to a clause, annexure or schedule to this Schedule;

e. references to any legislation or law or to any provision of legislation or law shall include any modification or re-enactment of that legislation or law or any legislative provision substituted for such provision of legislation or law and all regulations and statutory instruments issued under such legislation or law;

f. the table of contents, headings and bolding are inserted for convenience only and shall not affect the construction or interpretation of this Schedule;

g. the Recitals and schedules hereto and any documents herein referred to shall be taken, read and construed as an essential and integral part of this Schedule; and

h. all references to time are either Sri Lanka time, Indonesia time or Malaysia time as applicable.

3.2 A rule of construction does not apply to the disadvantage of a Party because the Party was responsible for the preparation of this Schedule or any part of it.

1. In supplying the Deliverables and performing the Professional Services, and in carrying out the other tasks allocated to it in the Agreement, the Company shall in accordance with Best Industry Practice:

(a) take all necessary steps to ensure that all ADL Data are protected at all times from accidental, unauthorised or unlawful access, Processing, use or transfer, or loss, misuse, damage, destruction, corruption, or alteration and this includes the following:

(i) have the necessary protective policies, processes, technical and organisations measures and controls for ADL Data;

(ii) if the Company does not have the necessary protective policies, processes, technical and organisations measures and controls for ADL Data or when the Company’s Personnel is in any member of Axiata Group’s premises, the Company shall comply with the relevant member of Axiata Group’s data privacy, information technology, security, access and usage policies, procedures and directions set out in the Agreement or notified to it from time to time;

(iii) take all necessary steps to prevent any Malware being introduced into any software or onto any of the ADL Systems or any other systems and/or networks used by the Company to access, Process, store, transmit or generate ADL Data or supply the Professional Services to ADL;

(iv) ensure that there is no unauthorised access to any of the ADL Data or ADL Systems without the prior written consent of ADL and/or by any unauthorised third party; and

(v) ensure that there is no unauthorised disclosure of passwords, authentication tokens or credentials supplied by ADL to access the ADL Systems and in the event of an unauthorised disclosure, to remove such access immediately, and revoke or remove such access immediately upon any personnel of the Company no longer having the need to know or leaving the Company; and

(vi) ensure that access to ADL Data shall be solely for the purpose of performing the Agreement.

(b) notify ADL of any breach of Paragraphs 1(a)(i)-(vi) of this Schedule above, without undue delay, within 24 hours.

2. If the Company becomes aware of any actual or suspected:

(a) action taken through the use of computer networks that attempts to access the Company’s information system or ADL Data residing on that system or that results in any actual or potential adverse effect on the Company’s information system or ADL Data residing on that system;

(b) any other unauthorised access or use by a third party or misuse, damage or destruction of any related ADL Data by any person;

(c) breach of any applicable law by the Company; or

(d) an occurrence that actually or potentially jeopardizes the confidentiality, integrity, or availability of an information system or the information the system processes, stores, or transmits or that constitutes a violation or imminent threat of violation of security policies, security procedures or acceptable use policies,

(Respectively or collectively shall be referred to as a “Security Incident”)

the Company shall notify ADL in writing immediately (and no longer than 24 hours after becoming aware of the Security Incident) and to provide the necessary assistance to ADL in relation to the said Security Incident and this includes the following:

(i) to provide full details of the Security Incident and keep ADL updated at all times thereafter in relation to the Security Incident.

(ii) to assist in the any investigations, mitigation and remediation Security Incident and in meeting any obligations to report the Security Incident to the relevant authorities.

(iii) where applicable, assist ADL to handle and comply with their respective obligations in complying with Data Subjects’ rights.

(iv) to provide the relevant evidence (including digital forensic evidence) about how, when and by whom the Company’s information system or the ADL Data has or may have been compromised; and to preserve and protecting the relevant evidence herein for a period of at least 12 months.

(v) to implement any mitigation strategies to contain and reduce the impact of the Security Incident or the likelihood or impact of any future similar event, incident, or breach.

2A. In the event of a Security Incident, without limiting any other provisions herein, ADL may investigate or engage a third party to conduct a forensic investigation and to identify the root cause of such Security Incident. Where an investigation is requested by ADL, the Company will immediately provide to ADL or the relevant third party such information and access as may be relevant to the Security Incident, including information on and access to:

(a) audit trails related to the Security Incident, whether access is required on or to the Company’s premises, the Company’s sub-contractors’ (if any) premises, the Company’s Sub-Processor’s (if any) premises, or otherwise.

(b) employment (including background checks) and training records.

(c) security policies, procedures, and guidelines; and

(d) files, records, tapes, or recordings in the control of the Company.

2B. If it is proven that the Security Incident is caused by the Company through its acts or omissions, the Company shall bear the costs of forensic investigation conducted by the third-party investigator.

2C. The Company shall:

(a) notify ADL by telephone and in writing (by email) immediately upon becoming aware of any:

(i) Security Incident; and

(ii) technical difficulties that may compromise any ADL System or the Company’s ability to safeguard ADL Data and Confidential Information.

(b) A notice pursuant to Paragraph 2C(a) of this Schedule above shall be sent to the contact details shared.

(c) Subsequent to the notification as per Paragraphs 2C(a) and (b) of this Schedule above, the Company shall ensure that the final remediation time relating to a Security Incident shall be in accordance with the following timelines:

3. The Company shall take out and maintain insurance to protect against the risks of any Security Incident and comply with the provisions of the insurance policy.

4. The Company shall ensure that:

(a) all subcontracts, other supply chain arrangements and contracts with Sub-Processors, which may allow or cause access to ADL Data, contain provisions that are at least as stringent as those in this Schedule and do not contain any provisions that are inconsistent with this Schedule; and

(b) all the Company’s Personnel who have access, directly or indirectly, to ADL Data or ADL Systems comply with this Schedule as if the Personnel were the Company.

5. The Company shall:

(a) at all times comply with the Malaysian Personal Data Protection Act 2010 / Personal Data Protection Act, No. 9 of 2022 of Sri Lanka / Indonesia’s Personal Data Protection Act No. 27 of 2022 (as the case maybe) and legislation in other jurisdictions (collectively “Personal Data Laws”) in respect of the Processing, of Personal Data of ADL, including but not limited to Personal Data of the customers or employees of ADL;

(b) not do or omit to do anything that would cause ADL to contravene, or that would result in ADL contravening, any Personal Data Laws;

(c) only Process Personal Data of ADL for the sole purpose of performing the Professional Services and in accordance with the Agreement. The Company shall immediately notify ADL if the data Processing instruction infringes the applicable Personal Data Laws;

(d) not transfer, access or remotely access Personal Data of ADL without the prior written consent of ADL. The Company shall ensure that any transfer of, or remote access to, Personal Data of ADL does not contravene any provisions of the Agreement or any applicable Personal Data Laws and that the transfer of such Personal Data shall be encrypted over public and wireless network;

(e) not engage a Sub-Processor to Process any Personal Data of ADL or change any Sub-Processor without the prior written consent of ADL. Where the Company engages any such Sub-Processor, the Company shall ensure that the Sub-Processor adheres to the same obligations as the Company’s obligations with respect to ADL Data and Confidential Information in the Agreement. The Company shall be responsible for verifying the Sub-Processor’s compliance and responsible to ADL for any non-compliance by any Sub-Processor with the aforesaid obligations or any applicable laws;

(f) ensure that if the Company or its Sub-Processor (where applicable) receives a complaint or any request (including any request for access to Personal Data) from any Data Subject or his/her agents, or from any authority, the Company must, without undue delay, inform ADL of the complaint or request. Upon request by ADL, the Company shall, without undue delay, supply the information to ADL to enable them to respond to such complaint or request. The Company shall not respond to these complaints or requests unless instructed in writing by ADL;

(g) establish and maintain a record of Personal Data Processing activities in electronic form and shall furnish a copy of the up-to-date record to ADL upon request. Such record shall, at the minimum, contain the following information:

(i) types/categories of Personal Data Processed;

(ii) transfer details, including countries transferred to and the safeguards for the transfer;

(iii) information of the Sub-Processor and details of the Processing activity;

(iv) specific data security requirements;

(v) information of the Company and its Data Protection Officer or appointed officer responsible for the Processing of Personal Data; and

(vi) technical and organizational security measures employed by the Company to safeguard Personal Data.

(h) provide reasonable assistance to ADL with any data protection impact assessment and consultation with supervisory authority, when required by ADL; and

(i) assist ADL in any investigations, mitigation and remediation related to Personal Data Processed and in meeting any obligations to report any breach, outcome of investigations and any queries related to the Professional Services to the relevant authorities.

(j) In respect of Personal Data:

(i) in the event of any conflict or inconsistency between this Paragraph of Schedule and any other provisions in the Agreement, the former shall prevail to the extent of the conflict or inconsistency.

(ii) if compliance with any mandatory Personal Data Laws will result in any conflict with any provisions in the Agreement, the Company shall comply with such mandatory Personal Data Laws to the extent of the conflict; and

(iii) in the event of any conflict or inconsistency between any provisions in this Schedule and any provisions in the Agreement the former shall prevail to the extent of the conflict or inconsistency.

6. ADL may conduct or require a third party nominated by them to conduct, a security audit to verify Company’s compliance with this Schedule. In this regard, ADL will provide at least ten (10) days’ written notice of any such audit, which audit shall be conducted during the Company’s normal business hours (to the extent conducted in the Company’s premises, the Company’s subcontractor’s (if any) premises or the Company’s Sub-Processor’s (if any) premises) other than where ADL considers (in its sole discretion) that there exists a potential security risk that could have significant adverse impact on ADL‘s business. During this audit / inspection if required, access would be provided to:

(a) Company’s premises; the sub-contractors’ (if any) premises; and the Sub-Processor’ (if any) premises;

(b) the service related books, records, correspondence, accounts, and non-confidential supporting documentation such as Company’s most current information security statement, to protect the ADL Data and Confidential Information at any time and from time to time during the Term, including if directed by the data protection authority or if necessary due to any accidental, unauthorised or unlawful access to, processing or Processing, use or transfer of, or loss, misuse, damage or destruction of, any ADL Data; and

(c) the Company’s digital forensic evidence and other documents used to determine the root cause of the breach, the investigative procedures that were followed, and any remedial actions to be taken to digital forensic evidence of the Agreement and privacy or data protection laws.

6A In addition to ADL’s audit rights under Paragraphs 6 of this Schedule, ADL may require routine audits covering issues relating to IT security, physical security, business and service continuity or a combination thereof. There shall not be more than two (2) such routine audits in each twelve (12) months of the Term (the first twelve (12) months commencing from the Commencement Date).

7. Where the Agreement is terminated:

(a) the Company shall permanently destroy, or return to ADL, all Confidential Information or deal with the same in the manner instructed by ADL, within the earlier of the time period required under law (if any) and fourteen (14) days after the termination or expiry of the Agreement (“Execution Date”), and shall provide a written confirmation to this effect to ADL within seven (7) days of the Execution Date;

(b) the Company shall, at no cost and expense to ADL, make available Personnel and take immediate steps to assist ADL to ensure a smooth transition if a third party has been appointed to replace the Company in the performance of its obligations under the Agreement. The Company shall support ADL with any transfer of Personal Data to a third party if required by them;

(c) the Company shall take immediate steps to cease the Professional Services in a prompt and orderly manner, discontinue from making commitments and shall proceed to cancel all existing orders and terminate all works under the Agreement as promptly as is practicable and hand over all Deliverables and other related materials to ADL; and

(d) ADL shall not be liable to the Company by virtue of early termination of the Agreement including but not limited to any claim for loss of profits and revenue or prospective profits.

The termination or expiry of the Agreement shall not prejudice the rights of ADL to sue for damages or to obtain any other relief in respect of any antecedent breach of the terms of this Cyber Security and Data Protection Schedule prior to such termination or expiry.

The following clauses shall apply only when the Agreement or Scope of Work includes:

(i) Access to network, portal (https)

(ii) Mail transfer

(iii) Data Transfer (e.g., payroll, etc)

8. The Company shall ensure that any and all electronic transmission or exchange of system and application data with ADL and any other parties designated by ADL shall take place via secure means (e.g. using S/MIME, HTTPS or SFTP or equivalent).

9. The Company shall store all ADL Data and Confidential Information as part of its designated backup and recovery processes in encrypted form, using a commercially supported encryption solution.

10. The Company shall ensure that all devices, applications and database under the scope of the Agreement have been security hardened in accordance with the respective minimum baseline security standards (“MBSS”) provided or to be provided by ADL. Where such hardening commands are not obvious, the Company shall provide written methods and procedures on how to validate the compliance to the standard.

11. If either the Company or ADL:

(a) discovers any Malware or unauthorised code; or

(b) identifies any unauthorised code that has been invoked or activated,

in any ADL Systems, where the Malware or unauthorised code was introduced by any Personnel of the Company (“At-Risk Software”), that Party will immediately notify the other Party and provide all information reasonably requested by the other Party in relation to the At-Risk Software (including, its functionality, origin, and criticality). Such notifications shall be via telephone or email, addressed to the contact details shared by each party.

12. The Company shall:

(a) at the Company’s cost, promptly take all steps necessary to eliminate, quarantine or minimise the risk in relation to the At-Risk Software and prevent its introduction or re-introduction to any ADL Systems.

(b) provide all reasonable assistance to ADL to minimise the effects of, or risks posed by, the At-Risk Software.

13. If the presence of the At-Risk Software results:

(a) in a loss of data (including ADL Data); or

(b) has a negative impact on the operation of the affected ADL Systems,

and the Company knowingly or unknowingly caused such At-Risk Software to be introduced into the relevant system, then the Company shall at the Company’s cost:

(i) mitigate the loss of data;

(ii) promptly restore the data (so far as the same is capable of restoration); and

(iii) ensure the operation of the affected system is promptly remedied.

14. In the event that ADL conducts any data protection impact assessment, the Company shall provide reasonable assistance to ADL. Such assistance may, at the discretion of ADL, include:

(a) a systematic description of the envisaged processing and Processing (respectively) operations and the purpose of the processing and Processing;

(b) an assessment of the necessity and proportionality of the processing and Processing (respectively) operations in relation to the Professional Services;

(c) an assessment of the risks to the rights and freedoms of Data Subjects; and

(d) the measures envisaged to address the risks, including safeguards, security measures and mechanisms to ensure the protection of Personal Data.

15. The Company is responsible for all data migration activities (if any are agreed by the Parties) associated with ADL Data and Confidential Information and shall ensure that no ADL Data or Confidential Information is lost or corrupted as a result of any data migration.

16. Without limiting Paragraph 15 of this Schedule, the Company shall:

(a) retain secured back-up copies of all ADL Data and Confidential Information being migrated until the successful completion of the process; and

(b) ensure that in the event of any data migration failure or problem, ADL is able to utilise the ADL Data and Confidential Information within the ADL Systems to store, process and Process the ADL Data and Confidential Information so that ADL’s business operations are not affected.

17. In the event of any breach by the Company of Paragraph 15 or 16 of this Schedule which adversely impacts on ADL’s business operations in any way, and without limiting any of ADL’s rights and remedies under the Agreement or applicable law, the Company shall, at no additional cost to ADL, immediately work with ADL to identify any possible workarounds to the cause of the adverse impact, and provide resources (where necessary) to implement workarounds approved by ADL in writing.

18. The Company shall:

(a) apply a secure Software Development Lifecycle (SDLC) methodology within its product development process that includes design reviews, source code audit on the developed material, and penetration tests on a regular basis;

(b) enable ADL to audit the SDLC and patch level on a regular basis or, with prior written agreement of ADL, provide vulnerability assessment reports issued by reputable international agencies to ADL to prove that the Company’s security controls are effective;

(c) maintain and support the software (including updates, upgrades of the software and third-party software) that it uses or provides to ADL in connection with the Professional Services such that, and to provide verifiable assurance that, the software is, and remains, secure from known vulnerabilities. This includes, but is not limited to, the following measures:

(i) providing up-to-date updates and upgrades; and

(ii) regularly and in a timely manner test and install all available security patches for the operating system, libraries, middleware components, and installed applications.

(d) ensure that the verifiable assurance provided under Paragraph 18 (c) of this Schedule should include the attestations from security audits and certifications like SOC-2 and 3, SSAE-18 and ISO27001.

19. The Company shall enable ADL or any third party authorised by ADL to conduct additional penetration testing on a periodic basis. In the event any information security vulnerabilities are identified pursuant to the penetration testing conducted, the Company shall remediate the vulnerabilities based on the service levels requirements for final remediation as per the Security Vulnerability Remediation Service Level Agreement (“Security Vulnerability Remediation SLA”) below:

“Containment Measures” are compensating controls or adjustments in processes, configuration or changing one or more parameters, recommended by ADL and/or the relevant Customer or reputed industry researchers to reduce the severity and associated risks to an acceptable level. However, permanent solution shall be considered after implementing and testing of relevant patches and/or fixes recommended by ADL and/or the relevant Customer or industry researchers or experts.

Common Vulnerability Scoring System (“CVSS”) is an open framework for communicating the characteristics and severity of software vulnerabilities. CVSS consists of three metric groups: Base, Temporal, and Environmental. ADL’s current severity classifications are 0.1-3.9 = Low, 4.0-6.9 = Medium, 7.0-8.9 = High and 9.0 – 10.0 = Critical.

The service level requirements for information security incidents identified by penetration testing and other assessments/tests will be as follows:

Use reference from FIRST: https://www.first.org/cvss/v3.1/specification-document

20. The Company shall advise ADL of other practices, procedures and safeguards with respect to data (including ADL Data) when the Company becomes aware of any improved practices, procedures and safeguards in accordance with Best Industry Practices.

21. The Company shall at all times maintain network security that conforms to Best Industry Practice. At a minimum, network protection shall include:

(a) network firewall provisioning;

(b) strong user authentication;

(c) encrypted transmissions and storage;

(d) anti-malware programs;

(e) intrusion detection;

(f) controlled access to the physical location of computer hardware; and

(g) regular (two or more each calendar year) third party vulnerability assessments.

22. In the event of any inconsistency between the English version and the local language version of these clauses, the English version shall prevail.