Page 34 - MY_English HandBook

Rules of Conduct

(2) The sponsors of the Independent Distributors or the sponsor distributors of the organization.
(3) An agency with investigative powers vested by the law or an agency that exercises public powers in
accordance with the law.
(4) The Company will require the Nefful International companies, and third parties referred to in (1) above, and
the sponsors of the Independent Distributors or the sponsor distributors of the organization referred to in (2)
above to comply with the provisions of the PDPA, and will take organizational, contractual and legal measures
to ensure that personal data is exclusively processed for the purposes mentioned at 4.1.1, and that adequate
levels of protection have been implemented to safeguard the personal data.
4) Processes: By automated machines or other non-automated processes.

4.1.4 Independent Distributors’ Rights and Authorization of Use of Personal Data
• Independent Distributors may make requests to the Company to exercise their following rights with respect to their personal
data held by the Company:
1) Make an inquiry of or request to review or request for copies of their personal data, and the Company may charge a fee to
defray the necessary costs incurred according to the PDPA.
2) Request to supplement or correct their personal data by providing an appropriate explanation in accordance with the PDPA.
3) Demand the cessation of the collection, processing or use of their personal data or request to delete their personal data.
4) When the Independent Distributors make a request pursuant to the foregoing paragraphs, the Company shall handle the
request in accordance with the PDPA.
5) Independent Distributors may direct their requests to the Company’s Data Protection Officer at customer@nefful.com.my or
by mail to UBN Banking Hall, No 1, Lorong P.Ramlee, 50250, Kuala Lumpur.
4.1.5 Consequences Arising from Refusal to Provide, Provision of Inaccurate or Request to Delete Personal Data
by Independent Distributors
• The Company's collection, processing, use or cross-border transfer of personal data of Independent Distributors for the
aforesaid purposes is necessary for them to participate in the Company's business. However, if the Independent Distributors
refuse to provide or provide incomplete personal data or request to delete personal data previously provided, depending on the
nature and scope of the personal data not provided, provided inaccurately, or deleted, the Company may not be in a position to
continue providing its goods and services as a direct selling business.
4.2 Procedures on Violations

4.2.1 Commencement of Investigation on Violation
• When the Company discovers that an Independent Distributor has violated or has reasons to believe that the Independent
Distributor may have violated the terms of this Business Handbook, the Company's business strategy, any contracts with the
Company, the Company's business policies, the Company’s announcements, the Company’s publicities or communications, the
applicable local direct sales laws or any other relevant laws and regulations (hereinafter collectively referred to as the
“Violations” ), or when other Independent Distributor (hereinafter referred to as the “Whistleblower”) lodge a written
complaint to the Company which is accepted by the Company, the Company may investigate the Independent Distributor that
has committed the Violations or has been alleged to committing the Violations (hereinafter collectively referred to as the
“Violating Party”), his or her Sponsors and downlines (the Violating Party, his or her Sponsors and downlines collectively
referred to as the “Relevant Independent Distributors”) and may also take necessary emergency measures.

4.2.2 Reporting Violations
• The Whistleblower shall specify the following in writting when lodging a report with regard to the Violations:
The Dispute Resolution Team shall consist of at least two people, including members of the Company's customer services
department and other departments.
1) The name, background information, and contact information of the Whistleblower; in the event the Whistleblower is a
business entity, the name of the business entity, the relevant information of the business entity and its representatives.
2) The purpose of the report and facts relating to the Violations.
3) Information of the relevant evidence.
4) Relevant documents.
• Where the Whistleblower fails to comply with the aforesaid reporting method, and where corrections are not possible or the
Whistleblower fails to make corrections within the time limit, the Company may reject the report.

33