Statement Regarding Information Privacy and Data Security

WEX Inc. (WEX) is committed to protecting the privacy of information supplied by users of WEX services. In the course of providing WEX’s suite of products and services, we need to collect and maintain certain user information which may include nonpublic information.

This statement discloses the privacy practices for WEX and informs you about:

• what organisation is collecting the information;
• what information is collected and fromwhom;
• how to correct, update or delete the information that WEX collects;
• how the information is used and disclosed to third parties; and
• what kind of security procedures are in place to protect the loss, misuse or alteration of information under the company’s control.

General

WEX provides commercial card management, reporting and AP payment applications and services via internet-based technology. Our mailing address is 97 Darling Ave., South Portland, ME 04106, our telephone number is 207-773-8171 and our website can be found at www.wexinc.com where you can learn more about our company.

Our services and use of this website are not intended for use by anyone under the age of 18 and WEX will not knowingly solicit or collect information from users under that age.

Our services are used to facilitate the management and reporting of card based financial transactions between Buyers and Sellers. The majority of our users typically are placed in one of the following categories, and collectively these are called the “System Users”:

1. Public and Private sectors clients and their authorised personnel (End Users); or
2. Financial Institutions who are providing the application through a licensing or contractual agreement to you.

In order to facilitate the usage of our application by End Users and Financial Issuers, some information is required to be obtained to allow access to the system, User IDs and profiles, transaction details and other similar information must be collected from the System Users and stored and shared between the parties.

Information Collection

WEX directly collects and stores a wide variety of information for both End Users and the card issuing financial institutions, including but not limited to organisation and individual-user profile data (name, mailing address, email address, phone numbers, etc.), payment or financial account information (credit card account numbers, bank account information, etc.), and line item details for the goods and services that are bought and sold. Our servers automatically collect information about which sites users visit and which pages are viewed within the WEX website.

The only Personally Identifiable Information (PII) that we directly collect is information that you voluntarily provide to WEX via your financial issuer. If you supply WEX with personal information we will use that information to authenticate you, to contact you, or so that we can:

• Provide you access to the application and your card based transactional data,
• Provide you with information and/or reports you have requested, or
• Sending you other information that you have requested via extracts, reports or custom files.

In the event where PII is directly collected by WEX, (a) the user will have the choice over what information to submit and (b) it will be limited to the minimum amount of information needed to provide the services that have been requested.

Some PII that is directly collected by WEX may be edited or changed by the System User through the user’s own maintenance of their profile and transaction information.

Information Use and Disclosure

WEX may, on occasion, share general information with its relationship partners. WEX may disclose information between System Users, or to WEX affiliates or vendors. In some cases, this may require PII to be sent to other countries and, by providing your information; you consent to your information being transferred across national borders.

Such disclosed PII shall be created and disclosed under strict conditions designed to safeguard the security and privacy of the PII. WEX policies limit access to personal user information that is collected to our employees and agents and the employees and/or agents of our affiliates and business partners who need the information to fulfill our obligations to you and their business responsibilities. Vendors and other outside contractors we engage are subject to WEX’s contractual requirements for safeguarding sensitive information.

Employees and others with duties related to providing WEX services receive annual training about privacy policies and WEX security procedures and are subject to non-disclosure and employee agreements which specify remedies up to and including termination if they fail to comply with such policies.

From time to time, however, WEX may disclose this PII to fulfill legal or regulatory obligations or if we determine such disclosure is legally advisable or necessary to protect our rights, the rights of others, or to prevent harm. In addition, we may aggregate data about users of our site and use it for analytical purposes.

Use of Cookies

WEX makes use of a web browser technology called a “cookie”. The purpose of the cookie is to store session variables (information about a user and their transaction) while moving from page to page within the software applications, to enable user-preferences to be recorded, or to gather use information to enable us to improve the design or usability of the website. Most cookies are stored in Random Access Memory and are deleted when exiting the applications. If the cookie feature is disabled on the user's browser, the user will not be able to use the software properly.

External Internet Sites/Third Parties

Third party external sites may be reached or linked to through WEX’s systems. Such sites may have their own Privacy Statements or Terms of Use and these terms from WEX do not apply. You are responsible for reviewing and accepting third-party terms. WEX specifically disclaims any responsibility for the content available on such sites or actions or events resulting from such interaction. Any access to other Internet sites is done solely at your own discretion and risk.

Data Security Measures

Protecting the confidentiality and integrity of our user’s data is important to us. WEX maintains compliance with the PCI (Payment Card Industry) Data Security Standard and has enacted certain security methods and protocols that employ valid user identities, passwords, digital certificates; encryption, firewalls, and other measures that we believe meet or exceed the best in the industry. However, WEX does not represent and you acknowledge and agree that no system is 100% guaranteed to be secure from attack or other compromise.

Applicability

This privacy policy does not apply to information we collect through other methods or sources, including sites owned or operated by our affiliates, vendors or partners.

Singapore Customer Security Awareness Information

A. Customer Privacy and Security Policy

WEX has an information privacy/data security policy, which can be viewed above. That policy:

• discloses privacy practices
• contains a brief summary of data security measures

Data Security

(1) For security reasons, only the last 4 digits of the respective credit card number are transmitted with the notifications. Furthermore, neither the name nor the surname of the credit card holders (principal cardholders) is indicated. (2) Moreover, the wording of the SMS and/or email is as general as possible and always indicates a telephone number of the Service Centre as re-transmission channel. The length of the message is restricted to 160 digits in case of SMS texts. Depending on the network operator of the Corporate Card Holder, either the Company or a telephone number attributable by the network operator appears as the sender of the message.

B. Customer Dispute Handling, Reporting and Resolution Procedures

Policy Statement

Our goal is to handle all customer questions and complaints fairly, efficiently, and effectively, in compliance with applicable laws and regulations.

How to raise a question or make a complaint

If you have a question or if you are dissatisfied with our provided product or services, you can raise your question or complaint by contacting us via the following channels:

• By telephoning us at +65 6808 5621
• By writing to us - WEX Singapore, #38-01 OCBC Centre Singapore 049513
• By completing the “Contact us” form on our website

If we receive a complaint verbally and consider it appropriate, we may ask you to put your complaint in writing.

6 steps we take once we have received your complaint

1. We acknowledge: Within three business days of receiving your complaint, we will acknowledge receipt of your complaint.
2. We review: We undertake an initial review of your complaint and may contact you to clarify details or request additional information where and when it’s necessary.
3. We investigate: Within 15 business days of receiving your complaint, we will investigate it objectively and impartially by considering the information you have provided us.
4. We respond: Following our investigation, we will notify you of our findings and any actions we may have taken in regards to your complaint.
5. We take action: Where appropriate, we will amend our business practices or policies.
6. We record: We will record your complaint for continuous improvement. Your personal information will be recorded in accordance with the above Privacy Policy.

Recording Complaints

When taking a complaint, we will record your information, which will actively be protected from disclosure, in accordance with our Privacy Policy.

Complaint Escalation Process

Whenever possible, we will attempt to resolve your complaint at the first point of contact. If we are unable to resolve your complaint at the first point of contact, we will undertake an investigation of your complaint and provide you with our findings.

If you are not satisfied with how your complaint has been handled or the resolution we have provided, you can request that we escalate your complaint to the Singapore Civil courts or an alternative dispute resolution entity for independent external review.

WEX currently uses the MasterCard chargeback rules.

What you need to know about your liabilities

1. Fraud on your account(s)
   Subject to the terms of your agreement with WEX, you will be responsible for all fraud on your accounts, unless and until you report fraudulent activity or lost or stolen Cards to WEX at the number or addresses provided to you.
2. Unauthorised access to SMS and/or emails
   You are responsible for ensuring that no unauthorised person has access to your SMS and/or emails (your username and/or password). WEX does not assume any liability for the security of messages received on your mobile phone or in your email box
3. Correctness of the information contained in the SMS and/or emails
   Furthermore, WEX does not assume any liability for the correctness of the information contained in the SMS and/or emails and their proper transmission. This, in particular, also applies in the case that your chosen email provider erroneously identifies your email as a so-called “spam email” and cancels it either automatically or upon or after notifying you.