Rent 2 Own Myanmar — Data Privacy Policy Statement

1. Introduction

This policy applies to all dealings with, information of the client provided and transactions of the client enter with Rent 2 Own (Myanmar) Company Limited and associates (as such term is defined by the Myanmar Companies Law 2017) (collectively "R2O" and the "company").

The client agrees that R2O, acting individually or collectively, may perform all acts contemplated under this policy. The client agreement and acknowledgement of this policy forms a single agreement with, and is incorporated by reference into, all other agreements the client enters with R2O acting individually or collectively. R2O is committed to protecting the personal and financial information collected and held about the client.

R2O recognise that any personal and financial information collected about the client will only be collected, held, used or disclosed for the purposes R2O have collected it for or as allowed under the law (such as under the Anti-Money Laundering Law 2014 and Regulations, the Law Protecting the Privacy and Security of Citizens 2017 or the Financial Institutions Law 2016 and applicable Regulations). It is important to R2O that the client is confident that any personal and financial information R2O holds about the client will be treated in a way which ensures its protection.

2. Personal and Financial Information

When R2O refers to personal and financial information, R2O means information or an opinion about an identifiable individual, or an individual who is reasonably identifiable. This information may include information or an opinion about the client.

The personal and financial information R2O holds about the client may also include credit-related information.

Credit-related information means:

• Credit information, which is information which includes the client identity; the type, terms and maximum amount of credit provided to the client, including when that credit was provided and when it was repaid; repayment history information (information about whether you meet your repayments on time); default information (including overdue payments); payment information; new arrangement information; details of any serious credit infringements; court proceedings information; personal insolvency information and publicly available information; and
• Credit eligibility information, which is credit reporting information supplied to R2O by a credit reporting body, and any information that derives from it.

3. Collection of Personal and Financial Information

The kinds of personal information the client may collect and hold about the client may include the client name, date of birth, address, email address, marital status, number of dependants, occupation, any current loan information, expense details, income details, employer information and any other information R2O made need to identify the client such as the client's passport, driver's licence or NRC number.

The main consequences of R2O not collecting personal information are an inability or delay in being able to identify the client, contact or provide services to the client.

R2O will generally not ask the client to disclose sensitive information, such as the client's bank account and/or password, religion or health related information. However, sometimes R2O may be required to collect or hold sensitive information about the client or the client may provide unsolicited sensitive information (e.g. if the client volunteers information regarding your health). In those circumstances, you consent for R2O to collect and hold such sensitive information.

4. Electronic Collection

R2O will collect information from the client electronically, for instance through internet browsing, mobile or tablet applications, as well as physically. (See "How Our Mobile App Collects Information" below for the specific data our app collects.)

R2O may use a technology called 'cookies' to provide the client with better and more customised service and with a more effective website and mobile application. A 'cookie' is a small text file placed on the client computer by R2O web page server. A cookie can later be retrieved by R2O webpage servers. Cookies are frequently used on websites and the client can choose if and how a cookie will be accepted by configuring the client preferences and options in the internet browser.

R2O or its service providers use cookies for different purposes such as:

• To allocate a unique number to the client internet browsers;
• To customise R2O website for the client;
• For statistical and/or behavioural analysis purposes;
• To identify if the client has accessed a third-party website; and
• For security purposes.

In certain circumstances, data collected from use of cookies, pixels, click redirects and tag containers may reasonably identify the client and/or potentially constitute personal or sensitive information. By using R2O website or service, the client consent to use of cookies, pixels, click redirects and/or tag containers and the data collected or disclosed, including to overseas entities.

5. Purposes of Collection of Personal Information

R2O collect the client personal and credit related information so R2O can:

• Identify the client and conduct appropriate checks on the client and/or any security;
• Understand the client requirements and provide the client with a product or service;
• Set up, administer and manage our products or services, including the management and administration of underwriting, and obtaining loan or lease assessments and credit reports;
• Assess the client eligibility to be provided with products or services and to manage the services R2O provide to the client;
• Manage, train and develop R2O employees and representatives, and providing continuing employment (in relation to the employees only);
• Managing relationship with the client, including debt collection and litigation;
• Manage complaints and disputes, and report to regulatory authorities and dispute resolution bodies;
• Performing research and statistical analysis, including for customer satisfaction and product and service improvement purposes. This may include matching information R2O collects against other information held by third parties. (R2O may also use and disclose de-identified data for these purposes);
• Helping R2O tailor existing or develop new products, services or offers which may be offered to the client, and to help R2O selectively target promotional offers and opportunities to the client needs;
• Developing or seeking to deliver new ranges of products or services; and
• Search and register security interests on registers in the Republic of the Union of Myanmar, such as the Directorate of Investment and Company Administration (DICA).

The client shall only provide with R2O accurate or correct information or omit to provide R2O with information as R2O may not be able to provide the client with R2O services.

Where reasonable and practical R2O will collect the client's personal information directly. R2O may also collect the client's personal information from credit reporting bodies, the client bank account providers, our service providers, other credit providers, lead generation businesses, access seekers, finance brokers and third-party social media platforms such as Facebook.

R2O also collects information when the client interacts with the R2O website. For more information, please see R2O website terms of use.

6. Disclosure of Information

R2O may disclose the client personal information to third party service providers that the company contract with to perform certain functions on our behalf such as:

• Debt collection services;
• Any related bodies corporate and/or associates (e.g. credit committee); and
• Database providers who collect (sometimes through the use of first-party cookies, third-party cookies or other third-party identifiers), hold, use and disclose information in order to assist with identity verification, credit scoring and credit reporting bodies, debt collectors and lead providers.

R2O may also disclose the client information to:

• Any of R2O related bodies corporate and/or associates;
• Direct marketers (that is, associated businesses that may want to market products or services to the client). If the client does not wish to receive marketing information, the client may at any time decline to receive such information by contacting R2O in any of the ways listed at the end of this policy. If the direct marketing is by email the client may also use the unsubscribe function;
• Anyone who represents the client or anyone to whom the client have consented to the information being disclosed;
• Investors, financiers, banks, agents or advisors or any entity that has an interest in, or is considering acquiring an interest in, R2O business or the client contract;
• Where R2O are required or permitted to do so by law, such as under the Anti-Money Laundering Law 2014 and Regulations, the Law Protecting the Privacy and Security of Citizens 2017, and/or the Financial Institutions Law 2016 and applicable Regulations;
• Companies that provide information and infrastructure systems to us;
• Lead generation businesses and other credit providers. R2O may exchange or sell the client information (including personal information and credit-related information) to third party lead generation companies or other credit providers who may use that information for any of the purposes for which R2O can use it. That information may also be disclosed to agents, contractors or advisors of the lead generation business or other credit provider;
• Online third-party messenger applications, such as Facebook messenger, for the purposes of contacting the client;
• Social media platforms, such as Facebook, for marketing related purposes;
• Third parties that assist to enhance R2O business performance and/or the scope and quality of our services to the client, such as website behaviour analysis providers, and interest data / remarketing / network impression reporting providers;
• Customer, product, business or strategic research and development organisations;
• Administration or business management services, consultancy firms, auditors and business management consultants;
• Print/mail/digital service providers;
• Imaging and document management service;
• Search engine optimisation service providers;
• Credit reporting agencies; and
• The client's employer, referees or identity verification services.

The abovementioned recipients may be located overseas and may store the client's personal information outside of the Republic of the Union of Myanmar, including in the USA, the European Union and Singapore.

R2O may use cloud storage to store the personal information the company holds about the client. The cloud storage and the IT servers may be located in or outside the Republic of the Union of Myanmar.

7. Testimonials

R2O may publish testimonials, comments or feedback the client provides to R2O on the website, which may contain personal information such as the client's first name and suburb. If the client wants to remove the personal information that is being displayed on the R2O website, please send a request to R2O at the contact details below.

8. Credit-Related Information

R2O may collect and hold credit-related information and exchange this information with credit reporting bodies and other entities.

This credit-related information may be held by R2O in electronic form on our IT servers and may also be held in paper form. R2O may use cloud storage to store the credit-related information about the client and the IT servers may be located in or outside the Republic of the Union of Myanmar.

When R2O obtains credit eligibility information from a credit reporting body about the client, R2O may also seek publicly available information and information about any serious credit infringement that the client may have committed. R2O may disclose the client credit-related information to entities that provide support functions to R2O. These entities may be located overseas, including in the USA, the European Union and Singapore.

9. Credit Reporting Bodies

The client credit-related information may be exchanged with credit reporting bodies. Credit reporting bodies include credit-related information in reports to assist credit providers assess the client credit worthiness, assess the client application for products or services and to manage the client services.

If the client fails to meet payment obligations in relation to any product or service that R2O has provided or the client has committed a serious financial infringement, then R2O may disclose this information to a credit reporting body.

Sometimes the client credit-related information will be used by credit reporting bodies for the purposes of 'pre-screening' credit offers on the request of other credit providers. The client should contact the credit reporting body to advise them if the client believes that the client may have been a victim of fraud.

10. How Our Mobile App Collects Information

This section describes specifically what the R2O Client App (Android/iOS) collects from you, in addition to the general practices described above.

Identity & Account Information

• Full name — collected at signup, required.
• Phone number — used as your login identifier, required.
• NRC number — entered by you at signup, required.
• NRC photo — a photo of your physical NRC card, required, taken directly via the camera (no gallery upload).
• Selfie photo — used to verify your identity, required, taken directly via the camera (no gallery upload).
• PIN — your 6-digit login PIN, stored in encrypted (hashed) form — never stored or transmitted as plain text.

Contract & Financial Information

• Contract details — the item financed, your installment schedule, amounts, and contract status.
• Payment history — a record of your past installment payments (amount, date, status, payment method used).
• Payment account phone number — for OK$ and AYA Pay, the phone number registered with that payment provider is passed through our systems to initiate your transaction. We do not collect or store card numbers, gateway PINs, or full payment account credentials — those are handled directly by the payment provider (AYA Pay, OK$, CTZPay, Wave Money).

Device & Technical Information

• Device information — device model, manufacturer, operating system type/version, and app version.
• Device identifier — a unique installation ID generated when you first install the app.
• Push notification token — used to deliver payment reminders and app notifications to your device.
• IP address — captured automatically by our servers as part of standard request handling.

Support & User-Generated Content

• In-app chat messages — messages you send to our AI assistant or a live support agent.
• Service ratings/feedback — an optional rating you may submit after certain contract milestones (e.g. confirming receipt of your item).

App Activity

• Notification read status — which notifications you have viewed, used to show unread badges.
• In-app promotion interactions — whether a promotional banner was viewed, tapped, or dismissed, used for internal campaign reporting.

What Our App Does Not Collect

• Email address (not used anywhere in the app)
• Contacts
• Calendar
• Microphone / audio recordings
• Precise real-time location shared with other users
• Advertising identifiers

App Data Shared With Third Parties

• Payment gateways (AYA Pay, OK$, CTZPay, Wave Money) — to process payments you initiate.
• Firebase / Google Cloud Messaging — to deliver push notifications.
• R2O's own backend systems — to manage your contract and account.

We do not sell your data through the app, and we do not share app data with third parties for advertising purposes.

11. Security of Information

R2O will take reasonable steps to protect the client's personal information by storing it in a secure environment. R2O may store the client's personal information in paper and electronic form. R2O will also take reasonable steps to protect any personal information from misuse, loss and unauthorised access, modification or disclosure.

12. Updating Your Personal Information

It is important to the company that the personal information held about the client is accurate and up to date. During the course of the relationship with the client, R2O may ask the client to inform if any of the personal information has changed.

If the client wishes to make any changes to personal information, the client may contact R2O and R2O will generally rely on the client to ensure the information held about the client is accurate or complete.

13. Access and Correction to Your Information

R2O will provide the client with access to the personal information that the company holds about the client. The client may request access to any of the personal information that the company holds about the client at that time by contacting R2O on the details provided below.

Depending on the type of request that the client makes, R2O may respond to the client request immediately, otherwise R2O usually responds within 7 days of receiving the client request. R2O may need to contact other entities to properly investigate the request.

There may be situations where R2O are not required to provide the client with access to the client personal information, for example, if the information relates to existing or anticipated legal proceedings, or if the client request is frivolous. An explanation will be provided to the client, if R2O denies access to the personal and financial information that R2O holds about.

If any of the personal information that R2O holds about the client is incorrect, inaccurate or out of date, the client may request to correct the information by contacting in any of the ways listed at the end of this policy. If R2O refuses to correct personal information, the client will be provided with the reasons for not correcting the information.

14. Using Government Identifiers

If R2O collects government identifiers, such as the client NRC number or passport number or driver's licence number, R2O does not use or disclose this information other than as required or permitted by law. R2O may use government identifiers to verify the identity when the client deals with the company.

15. Business Without Identifying You

In most circumstances, it will be necessary for R2O to identify the client in order to successfully do business, including answering general inquiries about the company product or services or current promotional offers, however depending on the circumstances R2O may in some instances do business with the client without providing personal information. However, the extent of the information and services that the company may be able to provide will be limited.

16. Complaints

If the client is dissatisfied with how the company has dealt with the personal information, or the client has a complaint, the client can contact the company complaints channels in any of the ways listed at the end of this policy.

17. Further Information

The client may request further information or provide feedback on the way the company manages the client's personal and financial (including credit-related) information by contacting us.

18. Changes to Our Privacy Policy

R2O may change this policy from time to time. Any updated versions of this policy will be posted on the website and will be effective from the date of posting.

19. Action Taken to the Employee

In response to data privacy concerns and to safeguard client information, R2O has implemented strict action protocols for employees found to be abusing or mishandling client data. These measurements include rigorous internal investigations, immediate suspension pending investigations and if necessary termination of employment by following HR policy. Additionally, the company continuously educates the staff on data privacy best practices and enforce regular reviews of the company data security policies to ensure a safe and confidential environment for the clients' sensitive information, and also whistleblower mechanism and regular security assessment is in practice.

20. Contact Details

For privacy related queries, complaints or any other requests, you can contact us using any of the following methods: