Effective Date June 19, 2022

This Hines Singapore Privacy Policy ("Privacy Policy") supplements the information contained in Hines’ standard privacy policy located here and applies to the collection, use, disclosure and/or processing of Personal Data (as defined below) to which the Singapore Personal Data Protection Act 2012 (No. 26 of 2012) ("PDPA") applies.

By interacting with us, submitting information to us (including on or through our website at www.hines.com and all other websites developed, owned or maintained by Hines (collectively, "Site")), using the Site, or signing up for any products and/or services offered by us, you are deemed to have agreed and consented to Hines Singapore Pte. Ltd. and its affiliates ("Companies"), as well as their respective representatives and/or agents ("Representatives") (the Companies and Representatives collectively referred to herein as "Hines", "us", "we" or "our"), collecting, using, disclosing, processing and/or sharing amongst themselves your Personal Data, and disclosing such Personal Data to the Companies' business partners, authorised service providers, vendors, sub-contractors and relevant third parties in the manner and for any of the purposes set forth in this Privacy Policy. If you do not agree to the terms and conditions of this Privacy Policy, do not use the Site.

This Privacy Policy supplements but does not supersede nor replace any other consents you may have previously provided to us in respect of your Personal Data, and your consents herein are cumulative and additional to any rights which Hines may have at law to collect, use, disclose and/or process your Personal Data. This Privacy Policy does not affect any rights which we may have at law in connection with the collection, use, disclosure and/or processing of your Personal Data.

Hines reserves, in its sole discretion, the right to revise this Policy at any time and if we change our Privacy Policy, we will post the changes on this page and may place notices on other pages of the Site, so that you may be aware of how we collect, use, disclose and/or process Personal Data. Subject to your rights at law, you agree to be bound by the prevailing terms of this Privacy Policy as updated from time to time on our Site. Please check the Site regularly for updated information on the handling of your Personal Data.

YOUR PERSONAL DATA

1. In this Privacy Policy, "Personal Data" means all data that falls within the definition of personal information, personal data, personally identifiable information or similar language under any applicable law relating to the protection, privacy and security, collection, use or disclosure of sensitive or other personally identifiable information, including the PDPA (collectively, "Data Protection Laws").

2. Examples of such Personal Data which we collect and/or which you may provide us include (depending on the nature of your interaction with us):

• contact information (such as name, postal or e-mail address, and phone number);
• your professional information (such as job title, department and name of organisation);
• content you provide (such as job and education history, comments, responses to questions); and/or
• information about your visit and use of our Site and services, including cookies, information about your domain name and IP addresses.

3. To the maximum extent permitted under applicable law, we may anonymise your Personal Data so that it no longer identifies you, in which case we shall be entitled to retain, use, disclose, and/or process such anonymised data without restriction, including for business product related reviews.

4. For the avoidance of doubt, in the event that Data Protection Laws permit Hines to collect, use, disclose and/or process your Personal Data without your consent, such permission granted by the law shall continue to apply.

COLLECTION OF PERSONAL DATA

1. Generally, we collect your Personal Data in the following ways:

• when you submit forms (online or otherwise) relating to any of our products, offerings or services, or submit any online queries (including queries for a quotation or a service);
• when you enter into any agreement or provide other documentation or information in respect of your interactions with us;
• when you register for and/or use any of our products, offerings, services, surveys or contests on websites owned or operated by us;
• when you interact with our staff, for example, via telephone calls, letters, fax, face-to-face meetings, social media platforms and emails;
• when you request that we contact you or request that you be included in an email or other mailing list;
• when you respond to our promotions, initiatives or to any request for additional Personal Data;
• when we receive references from business partners and third parties, for example, where you have been referred by them;
• when your images are captured by us via CCTV cameras while you are within our property and/or premises, or via photographs or videos taken by us or our representatives when you attend our events;
• when we seek information about you and receive your Personal Data in connection with your relationship with us, including for our products, offerings or services or job applications, for example, from business partners, public agencies, your ex-employer, referral intermediaries and the relevant authorities; and/or
• when you voluntarily submit your Personal Data to us for any other reason.

2. When you browse our Site, you generally do so anonymously but please see Hines Cookie Policy below for information on cookies which we have implemented on our Site.

3. You shall ensure that all Personal Data submitted to us is complete, accurate, true and correct. Failure on your part to do so may result in our inability to provide you with the products and/or services which you have requested.

PURPOSES FOR THE COLLECTION, USE, DISCLOSURE AND/OR PROCESSING OF PERSONAL DATA

1. In general, we collect, use, disclose and/or process your Personal Data for the following purposes:

• to contact you about our offerings or services in which you have expressed an interest;
• operating, evaluating and improving our business (including developing new products and services; managing our communications; determining the effectiveness of and optimising our advertising; analysing our products, services, websites, mobile applications and any other digital assets; facilitating the functionality of our websites, and mobile applications and any other digital assets);
• anonymising Personal Data and preparing and furnishing aggregated data reports showing anonymised information;
• enforcing our Terms and Conditions or other legal rights;
• as may be required by applicable laws and regulations, court order, or governmental regulations or requested by any law enforcement authorities, judicial process or governmental agency having or claiming jurisdiction over Hines;
• to fulfil or meet the reason you provided the Personal Data. For example, if you share your name, contact information, employment history and/or education history as part of a job application or to ask a question about our products or services, we will use that Personal Data to respond to your inquiry;
• to provide, support, personalise, and develop our Site, products and services;
• to create, maintain, customise, and secure your relationship with us;
• to process your requests and prevent transactional fraud;
• to provide you with support and to respond to your inquiries, including to investigate and address your concerns and monitor and improve our responses;
• to help maintain the safety, security and integrity of our Site, products and services, databases and other technology assets, and business;
• for testing, research, analysis, and product development, including to develop and improve our Site, products and services; and/or
• for purposes which are reasonably related to the aforesaid.

2. In addition, and without prejudice to the generality of the foregoing, if you submit an application to us as a candidate for employment or an internship, or are an existing employee of Hines, we collect, use, disclose and/or process your Personal Data for the following purposes:

• for management and/or evaluative purposes, including without limitation to process your employment application, to conduct pre-recruitment checks, and/or to provide or obtain employee references or other references where relevant for background screening and/or vetting;
• for personnel administration, including to administer benefits and payroll processing, to administer or execute employee remuneration schemes, and/or to his/her employment-related work activities;
• to enter into an employment relationship with you or to appoint you to any office;
• to manage or terminate the employment relationship with you or appoint you, including without limitation role assessment, job compatibility assessment, career progression and/or management of staffing requirements; and/or
• for purposes which are reasonably related to the aforesaid.

3. If you have provided us with your Singapore telephone number(s) and have indicated that you consent to receiving marketing or promotional information via your Singapore telephone number(s), then from time to time, Hines may contact you using such Singapore telephone number(s) (including via voice calls, text, fax or other means) with information about our products and services.

4. In relation to particular products or services or in your interactions with us, we may also have specifically notified you of other purposes for which we collect, use, disclose and/or process your Personal Data. If so, we will collect, use, disclose and/or process your Personal Data for these additional purposes as well, unless we have specifically notified you otherwise.

5. You may withdraw your consent by contacting us using the contact details set out at paragraph 8 below.

DISCLOSURE OF PERSONAL DATA

1. Subject to the provisions of any applicable law, you hereby agree, acknowledge and consent that your Personal Data may be disclosed for any of the purposes listed above in this Privacy Policy (as applicable) to the following entities or parties, regardless of whether they are located overseas or in Singapore:

• amongst Hines and its subsidiaries, affiliates and related corporations (including their respective staff);
• contractors, agents, service providers and other third parties that provide services to Hines, such as IT systems providers, platform providers, financial advisors, consultants (including lawyers and accountants), providers of HR and recruitment services and other goods and services providers (such as providers of marketing services where we are permitted to disclose your Personal Data to them);
• intermediaries, brokers and other individuals and entities that partner with us;
• competent authorities (including any national and/or international regulatory or enforcement body or court or other form of tribunal, where Hines is required to do so by applicable law or regulation);
• any central or local government department and other statutory or public bodies;
• data aggregators;
• our corporate clients;
• any business partner, investor, assignee or transferee (actual or prospective) to facilitate business asset transactions (which may extend to any merger, acquisition or asset sale); and/or
• any other party to whom you authorise us to disclose your Personal Data to.

2. We may share information about you in aggregate or anonymised form, for example, information regarding business product related reviews, with the abovementioned entities or parties (e.g. our business partners).

TRANSFERS OUT OF SINGAPORE

1.1 As a global company, Hines may need to transfer your personal information out of the country in which it was originally collected. For personal data to which the PDPA applies, this means transfers out of Singapore. You should be aware that these countries may not have similar data protection laws to Singapore. In such cases, Hines will ensure that there are adequate safeguards in place to protect your personal data with the aim of ensuring that your privacy rights continue to be protected as outlined in this Privacy Policy.

1.2 In relation to data being transferred out of Singapore, for example, adequate safeguards include the following:

• the country that we send the data to has received “specified certification” under the Asia Pacific Economic Cooperation Cross Border Privacy Rules System or the Asia Pacific Economic Cooperation Privacy Recognition for Processors System; or
• there are binding corporate rules, agreements or instruments in place to ensure that the recipient provides a standard of protection over the personal data that is comparable to the standards of protection under the PDPA.

1.3 In other circumstances the law may permit Hines to transfer your personal data outside the EEA, the UK or Singapore. In all cases, however, Hines will ensure that any transfer of your personal data is compliant with the applicable data protection law.

1.4 You can obtain more details of the protection given to your personal data when it is transferred outside the EEA, the UK or Singapore (including a copy of the standard data protection clauses which we have entered into with recipients of your personal data) by contacting us as described below.

KEEPING YOUR PERSONAL DATA ACCURATE AND UP-TO-DATE

We encourage you to contact us as soon as possible to enable us to update any Personal Data we have about you. Incomplete or outdated Personal Data may result in our inability to provide, or delays in providing you with products and services you have requested, or processing any requests and applications you may have made to us.

HINES COOKIE POLICY

As visitors browse the Site, Hines may collect information about the visit. Hines may monitor statistics such as the number of visitors we have to our Site, which pages are visited, the browsers our visitors use and the domains our visitors come from but none of this information is associated with any visitor as an individual .

THIRD-PARTY INFORMATION

The Site may provide you with links to other web sites. This Privacy Policy does not apply to any information that you may provide to third parties, such as through other sites linked to the Site. Hines is not responsible for those sites and cannot control the content of what is offered on those sites, or links from those sites, or the privacy policy or data security, if any, of those sites.

CONTACTING US – WITHDRAWAL OF CONSENT, ACCESS AND CORRECTION OF YOUR PERSONAL DATA

1. If you:

• have any questions or feedback relating to your Personal Data or about this Privacy Policy;
• would like to withdraw your consent to any use of your Personal Data as set out in this Privacy Policy; or
• would like to obtain access and make correction to your Personal Data records,

please contact us as follows:

2. Please note that if your Personal Data has been provided to us by a third party (e.g. your employer), you should contact that organisation or individual to make such queries, complaints, and access and correction requests to Hines on your behalf.

3. If you withdraw your consent to any or all use of your Personal Data, depending on the nature of your request, Hines may not be in a position to continue to provide its products and services to you, or administer any contractual relationship in place, which in turn may also result in the termination of any agreements with Hines, and your being in breach of your contractual obligations or undertakings. Hines' legal rights and remedies in such event are expressly reserved.

GOVERNING LAW

This Privacy Policy shall be governed in all respects by the laws of Singapore.