Privacy Notice

Issued pursuant to Section 7 of the Personal Data Protection Act 2010 (Malaysia)

THIRD SPACE (The MET) SDN BHD
Business Registration No. 202201039947 (1485644-W)

1. Introduction

THIRD SPACE (The MET) SDN BHD (“THIRD SPACE”, “3RD SPACE”, “we”, “us” or “our”) is committed to protecting the privacy, confidentiality and security of personal data collected through our website, digital platforms, marketing activities, events, activations, community programmes and other interactions with us.

This Privacy Notice is issued pursuant to Section 7 of the Personal Data Protection Act 2010 (“PDPA”) and explains how we collect, use, process, disclose, retain and protect personal data provided to or collected by us.

This Notice applies to individuals who interact with THIRD SPACE, including visitors, customers, event participants, community members, tenants, business partners, vendors, prospective partners and other individuals who engage with our services, platforms, campaigns or activities.

2. Personal Data We Collect

Depending on your interaction with us, we may collect personal data including, but not limited to:

• Full name
• Job title, company name and organisation details
• Contact details, including email address, telephone number and business address
• Information submitted through enquiry forms, registrations, surveys, contests, promotions, events or community programmes
• Marketing and communication preferences
• Information relating to your participation in events, activations or campaigns
• Photographs, video recordings or other media captured during events or activities, where applicable
• Technical information such as IP address, browser type, device information and website usage data collected through cookies, analytics tools or similar technologies
• Any other information voluntarily provided by you in connection with your interaction with THIRD SPACE

3. Sources of Personal Data

We may collect personal data:

• Directly from you when you contact us, complete a form, register for an event, participate in an activation, subscribe to updates, enter a promotion or otherwise communicate with us
• Automatically through cookies and similar technologies when you access or browse our digital platforms
• Through our events, programmes and activities
• From our tenants, business partners, service providers or event collaborators, where appropriate and permitted
• From publicly available sources or professional and business platforms for legitimate business development, partnership or engagement purposes

4. Purpose of Collection and Processing

We may collect and process your personal data for purposes including:

• Responding to enquiries, requests and feedback
• Managing registrations and participation in events, activations, campaigns and community programmes
• Communicating information about THIRD SPACE, The MET Corporate Towers, participating retailers, events, promotions and community activities
• Sending marketing, promotional and informational communications, where permitted
• Managing business relationships, partnerships, sponsorships and collaborations
• Conducting surveys, contests, campaigns and promotional activities
• Improving our services, programmes, digital platforms and overall visitor or community experience
• Conducting website analytics and understanding engagement with our digital platforms
• Supporting internal administrative and operational requirements
• Maintaining safety and security in connection with our activities and events
• Complying with applicable legal, regulatory and statutory obligations
• Any other purposes directly related or incidental to the purposes stated above

5. Disclosure of Personal Data

We do not sell your personal data.

Where necessary and permitted by law, we may disclose your personal data to:

• Our directors, employees and authorised personnel on a need-to-know basis
• Related or affiliated companies, where necessary for legitimate business and operational purposes
• Property management, building management or relevant operational teams where required
• Service providers supporting our website, marketing, communications, event management, technology, data hosting or other operations
• Event organisers, participating partners, sponsors or collaborators where necessary for the relevant activity and where permitted
• Professional advisers, auditors, consultants or insurers
• Regulatory bodies, government authorities, law enforcement agencies or other parties where disclosure is required or permitted by law
• Other parties where you have provided your consent or where disclosure is otherwise permitted under applicable law

Where third parties process personal data on our behalf, we will take reasonable steps to ensure that appropriate confidentiality and data protection obligations are in place.

6. Data Retention

We retain personal data only for as long as reasonably necessary to fulfil the purposes for which it was collected, to meet our operational requirements, or to comply with applicable legal, regulatory, accounting or reporting obligations.

When personal data is no longer required, we will take reasonable steps to securely delete, destroy or anonymise it in accordance with applicable requirements.

7. Security Measures

We take reasonable and appropriate technical and organisational measures to safeguard personal data against loss, misuse, unauthorised access, disclosure, alteration or destruction.

These measures may include access controls, security procedures, confidentiality requirements, appropriate technology safeguards and restrictions on access to personal data.

While we take reasonable precautions to protect personal data, no method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Your Rights

Subject to the PDPA and any applicable exceptions, you may have the right to:

• Request access to personal data held by us about you
• Request correction of personal data that is inaccurate, incomplete, misleading or not up to date
• Withdraw consent previously provided for the processing of your personal data, subject to applicable legal and contractual restrictions
• Opt out of or withdraw consent to receiving direct marketing communications
• Request information regarding how your personal data is being processed
• Request that we limit certain processing of your personal data, where applicable

Requests may be submitted using the contact details provided in Section 12 below.

We may require sufficient information to verify your identity before processing a request.

9. Whether Supply of Personal Data Is Obligatory

The provision of personal data may be necessary in certain circumstances, for example, when registering for an event, participating in a programme, submitting an enquiry or entering into a business relationship with us.

Where the requested personal data is necessary for us to fulfil your request or provide a particular service or activity, failure to provide such information may result in us being unable to process your request, registration or participation.

Where the provision of personal data is optional, this will be indicated where appropriate.

10. Marketing Communications and Choice

With your consent or where otherwise permitted by applicable law, we may communicate with you regarding THIRD SPACE programmes, events, promotions, retailer updates, community activities and other relevant information.

You may opt out of receiving marketing communications at any time by using the unsubscribe function provided in our communications, where available, or by contacting us directly.

Opting out of marketing communications will not prevent us from contacting you regarding administrative, operational or non-marketing matters where necessary.

11. Cookies and Digital Technologies

Our website and digital platforms may use cookies and similar technologies to improve functionality, understand visitor behaviour, measure engagement and enhance the user experience.

Depending on the technologies used, cookies may collect information such as IP address, browser type, device information, pages visited and interactions with our website.

Where applicable, further information regarding the use of cookies will be provided through our Cookie Notice or cookie-management mechanism.

You may also control or disable certain cookies through your browser settings, although doing so may affect the functionality of certain parts of our website.

12. Contact Us

If you have any questions regarding this Privacy Notice, wish to exercise your rights under the PDPA, or have any concerns regarding the handling of your personal data, please contact:

THIRD SPACE (The MET) SDN BHD
Business Registration No. 202201039947 (1485644-W)

A-31-03
The MET Corporate Towers
No. 20, Jalan Dutamas 2
50480 Kuala Lumpur
Malaysia

Email: 3rdspace.themet@triterra.com.my
Telephone: (+60) 16-360 0828

13. Changes to This Privacy Notice

We may review and update this Privacy Notice from time to time to reflect changes in our practices, operations, legal requirements or regulatory requirements.

The latest version of this Privacy Notice will be made available through our official website or other appropriate channels, together with the effective date.

Effective Date: 20 October 2026