This is the customer privacy policy (“Privacy Policy”) of Prodigal Pte Ltd (201726446W), and its respective subsidiaries, related companies and jointly controlled entities (hereinafter collectively referred to as “Prodigal Roasters”)
discloses how “Prodigal Roasters”, “us” or “we” collect, store and handle the
Personal Data (as defined below) of its customers at Prodigal Roasters and
visitors to any of the websites owned and operated by Prodigal Roasters.

We may update this privacy policy from time to time by publishing the
amended version on our websites. This privacy policy applies to personal
information we hold about individuals. We will only use your personal
information in accordance with Personal Data Protection Act 2012 and all other
current data protection law in Singapore and this Privacy Policy.

Please read the following Privacy Policy to understand how Prodigal Roasters uses
the Personal Data we may collect from you.

By providing your Personal Data to us, you are voluntarily consenting to this Privacy Policy and the collection, use, access, transfer, storage and processing of
your personal information as described in this Policy.

OUR WEBSITE

We are committed to keep our website secure. However, we ask you to
recognise that information provided by you to us through our website or when
you ask us to send your Personal Data via email or any other electronic means
of communication may not be secure. We cannot be responsible for any loss or
unauthorised interception of information transmitted via the internet which is
beyond our control.

User-supplied information through registration, surveys, polls or other similar
vehicles found in our website are utilised to improve the content of our
website and overall customer experience. It is not shared with other
organisations for commercial purposes unless specifically stated.

Our website may contain links to other websites outside of Prodigal Roasters.
Please note that our Privacy Policy only applies to our website and we are not
responsible for the security, privacy policy or manner in which how other
websites collect your Personal Data.

OUR COMMITMENT TO PROTECT YOUR PRIVACY

At Prodigal Roasters, the confidentiality and importance of your Personal
Data are our utmost concern; we are therefore committed in protecting your
Personal Data privacy with care and in accordance with the statutory
provisions. To ensure that you can make informed decisions and feel confident
about supplying your Personal Data to us when using our website, mobile and
other services, we provide this notice outlining our practices and the choices
you have concerning how your Personal Data is being collected and used by us.

THE PERSONAL DATA WE COLLECT

We request information from you in several areas of our website, mobile
services and other channels including in-store, which may be used to personally
identify you (“Personal Data”). Personal Data that we receive and process will
vary, depending on the types of products and services requested by you and may
include but not limited to the followings:

1. Your personal information such as your name, gender, date of birth,
passport or other personally identifiable number and information about your
registered status with any of our subsidiaries, associated companies and/or
business associates;

2. Your contact information such as your telephone numbers, mailing addresses,
email addresses, and fax numbers;

3. Your credit or debit card information and billing information, including
name of cardholder, card number, billing address and expiry date;

4. Your business information such as company name, business title and
associated contact information;

5. Your responses to market surveys and contests conducted by us or on our
behalf.

6. Your Personal Data provided by governmental agencies, regulatory and statutory

authorities,

7. Your Personal Data provided by you such as comments, queries or messages
that you

may submit to Spa Esprit Group in whatever manner,

8. Other data from publically available sources.

We acknowledge that the provision of your personal data is voluntary.
However, should you decide not to provide us with your Personal Data
(particularly relating to your personal information, contact information and
past medical history) or should you provide insufficient or inaccurate
information or decline to provide obligatory information requested by us, we
may not be able to process your requirements and deliver or provide you the
products or services you request whether partially or in full.

PURPOSE FOR WHICH THE PERSONAL DATA ARE COLLECTED AND USED

We may use the Personal Data you provided for one or more of the following
purposes:

1. For your use of the online services available at any of our websites
and/or through

other telecommunication channels;

2. For the supply of any products and/or services which we may offer to you or
you may

require from us from time to time including text message (SMS) alerts;

3. For marketing, promotional and customer relationship management purposes,
such as sending you updates on latest offers and promotions in connection with
our products

and services and conducting market research;

4. For identification and verification purposes in connection with any of the
services or

products that may be supplied to you;

5. To contact you regarding your enquiries;

6. To administer contests and sweepstakes conducted by us or on our behalf;

7. To disclose to a third party to comply with any law, legal requirements,
orders,

directions or requests from any court, authority or government body of any
jurisdiction, which may be within or outside of Singapore;

8. To facilitate the payment for products and services provided by us or our
subsidiaries, associated companies and/or business associates including
verification of credit card details with third parties and using the Personal
Data you provide to conduct matching procedures against databases of known
fraudulent transactions (maintained by us or third parties).

9. To improve our security, including in relation to the processing of payment
by credit card to guard against the risk of fraud including carrying out
matching procedures against databases of known fraudulent transactions
(maintained by us or third parties).

We may from time to time use aggregate non-identifying information about our
customers to better design our website and/or to improve our services and
products. This means we may provide this information to third parties. However,
this information will never identify any single user in particular.

Except as provided below, we will not knowingly or intentionally use or
share the Personal Data you provide to use in ways unrelated to the
aforementioned purposes without your prior consent.

HOW TO ACCESS OR CORRECT YOUR PERSONAL DATA

Subjected to the exception provided under Singapore law, you can obtain
information about your Personal Data stored by Prodigal Roasters and, may
request access to any Personal Data stored about you and request for
correction, updating, deletion or disabling of your Personal Data at any time.
If you wish to obtain a copy of any of your Personal Data, or if you believe
that the Personal Data relating to you which we collect and maintain is
inaccurate, incomplete or ceased to be true, or if you believe that the
Personal Data held by us was used beyond the scope of the purpose of use
disclosed above or was acquired by fraudulent or unlawful means or provided to
a third party without your prior consent, please write to us at the address
below.

We reserve a right to impose a reasonable fee as permitted under law for the
processing of any data access request. We have the right to refuse your request
to access and/or make any correction to your Personal Data for reasons
permitted under law.

USE OF COOKIES ON PRODIGAL ROASTERS SITES

A cookie is an alphanumeric string of identifier that websites of the Prodigal
Roasters use to transfer to the cookie file of the browser on your computer’s
hard disk. With the use of cookies, we can better serve you and/or maintain
your information across multiple pages within or across one or more sessions.
Most web browsers automatically accept cookies, but if you prefer, you can edit
your browser options to block them in future.

Two types of cookies are used on the Sites:

Session Cookies, which are temporary cookies that remain in the cookie file of
your browser until you leave the site.

Persistent Cookies, which remain in the cookies file of your browser for much
longer (though how long will depend on the lifetime of the specific cookie).

LINKS TO OTHER SITES

This website contains links to other sites that are operated by third party
companies with different contents, securities and privacy practices. You should
remain alert when you leave our site and read the privacy statements of other
websites. We have no control over Personal Data that you submit to or receive
from these third parties and are not responsible for any Personal Data which
you may submit outside of our website.

OUR COMMITMENT TO PERSONAL DATA SECURITY

For example, we use Secure Socket Layer (SSL) protocol – an industry
standard for encryption over the Internet – to protect in transmission the
Personal Data we collect online. When you type in sensitive information such as
credit card details, it will be automatically converted into codes before being
securely dispatched over the Internet. All electronic Personal Data that we
maintain is securely stored and further protected through our use of
appropriate access controls. When disposing of Personal Data, paper documents
containing Personal Data are securely destroyed, and electronic files storing
Personal Data are permanently deleted.

As stated above, in some instances we may entrust Personal Data to third
party service providers (including service providers outside of your
jurisdiction), binding them to protect the security of Personal Data and only
to use it for the purposes we specify.

DISCLOSURE AND TRANSFER OF PERSONAL DATA

Prodigal Pte Ltd (Co. Registration 201726446W), together with its
subsidiaries and related companies (“Prodigal Roasters”), is a beauty, food and
beverage company with operations, offices, affiliates and business partners
located worldwide. As such, the Personal Data you submit to us in one country
may be transferred, used, processed, stored and accessed worldwide in one or
more additional countries, as described in this Privacy Policy.

In addition, we may disclose and transfer Personal Data to and jointly use
Personal Data with (whether within or outside of your jurisdiction) our
subsidiaries, associated companies, business associates, service providers, and
other persons who we consider appropriate, in connection with the services and
products provided to or requested by you. We may disclose this information to
facilitate communication of news and information about such services and
products and otherwise for the purposes mentioned above, under “Purpose for
which the Personal Data are Collected and Used.”

The entities with whom we may share your Personal Data include but are not
limited to:

1. Prodigal Roasters and its subsidiaries and related companies;

2. Any agent, contractor or third party service provider who provides
administrative,

marketing and research, distribution, data processing, telemarketing,
telecommunications, computer, payment or other services to Prodigal Roasters and
its subsidiaries in connection with the operation of its business;

3. Other business associates such as loyalty program operators and other
companies involved in providing customer service or fulfilling customer
requests;

4. Credit reference agencies;

5. Credit, debit and /or charge card companies and/or banks;

6. Government or non-government authorities, agencies and/or regulators;

7. Medical professionals, insurers and clinics/hospitals.

Where permitted by local law, we may also disclose your Personal Data to
third parties: (i) when required by law, by court order, or in response to a
search warrant or other legally valid inquiry; (ii) to an investigative body;
(iii) to enforce our agreements with you; (iv) when requested by other
government or law enforcement authorities; (v) with your express consent, or,
(vi) pursuant to our good faith belief that disclosure is required by law or
otherwise necessary to the establishment of legal claims or defenses, to obtain
legal advice, to exercise and defend our legal rights, to protect our rights or
property and those of our subsidiaries or associated companies, or to protect
the life, body or property of an individual. This also applies when we have
reason to believe that disclosing the Personal Data is necessary to identify,
contact or bring legal action against someone who may be causing interference
with our rights or properties, whether intentionally or otherwise, or when
anyone else could be harmed by such activities.

We may also transfer any information we have about you as an asset in
connection with a merger or sale (including transfers made as part of
insolvency or bankruptcy proceedings) involving all or part of Prodigal
Roasters or as part of a corporate reorganization or stock sale or other change
in corporate control.

Please be advised that the Personal Data that Prodigal Roasters collects or
obtains may be transferred to jurisdictions that offer lesser protection of
Personal Data than that provided in your jurisdiction. By submitting personal
information to Prodigal Roasters or using any Prodigal Roasters or its related
associates’ website, you understand and consent to such transfer.

CONFIDENTIALITY

Personal Data held by us will be kept confidential in accordance with this
Privacy Policy pursuant to any applicable law that may from time to time be in
force.

Any questions, comments, suggestions or information other than Personal Data
sent or posted to this Website, or any part of this Website by visitors will be
deemed voluntarily provided to us on a non-confidential and non-proprietary
basis.

CHANGES TO PRIVACY POLICY

We reserve the right to amend this Privacy Policy from time to time without
prior notice. We advise that you check this Privacy Policy on a regular basis.
We will post on our website any changes to this policy with the effective date
of the changed policy, so that you can be informed of the way we collect and
use your Personal Data any time you so choose. If at any point we decide to use
the Personal Data you submitted under this current policy in a way that differs
materially from the privacy policy that applied at the time of that submission,
you will be notified and given the opportunity via the website, email or in
writing to opt out or otherwise prevent such usage.

YOUR CHOICE

Occasionally, we may use your personal data (including your name and contact
details) to send you marketing communications such as emails containing news,
offers, promotions and joint marketing offers. However, we will first obtain
your consent before doing so. Please see below on how to provide us with your
consent.

We may also provide your personal data (including your name and contact details)
to third parties including our marketing partners, travel service partners for
the purpose of marketing their products and services to you. Again, we will
only do this if you provide us with your consent.

You may indicate your consent to the above by the following ways:

1. when providing us with your personal data through our website or a form,
ticking boxes

indicating your consent;

2. when providing us with your personal data through the telephone, tell our
customer representative that you consent; or You may opt-out from receiving
marketing communications at any time, free of charge, by:

1. following the opt-out instructions contained in the communications;

2. writing to us at the address listed above; or

Any personal data provided to or gathered by Prodigal Roasters is controlled
primarily by Prodigal Pte Ltd.

RETENTION OF DATA

All Personal Data that has been collected from you will only be stored for a
limited duration that is relevant to the purpose for which it was processed and
for as long as required by applicable law.

This Privacy Policy is written in English language and may be translated
into other languages. In the event of any inconsistency between the English
version and the translated version of this notice, the English version shall
prevail.