ESG Policy

Last updated: December 1, 2025

This policy sets out how XIMNET MALAYSIA SDN BHD ("XIMNET", "the Company") integrates environmental, social and governance considerations into the way it operates, serves clients and works with suppliers. It brings together commitments already established in XIMNET's published policies into a single framework, so that employees, clients, partners and other stakeholders can see how the Company manages its ESG responsibilities.
XIMNET is committed to treating all workers with respect and dignity, ensuring safe working conditions, and conducting environmentally responsible and ethical operations.

This policy applies to:

All XIMNET directors, employees and anyone performing work on behalf of the Company, including contractors, consultants, interns and volunteers.
XIMNET's suppliers and their own suppliers, who are expected to meet the standards in XIMNET's Supplier Code of Conduct.
Third-party service providers (TPSPs) with access to XIMNET's data, systems or facilities.
All of XIMNET's operations, services and business relationships, in all locations where it operates.

ESG commitments

XIMNET commits to:

Environmental responsibility: minimising adverse effects on the community, environment and natural resources, and encouraging resource efficiency across its operations and supply chain.
Respect for people: upholding human rights, fair labour practices, diversity and inclusion, and a safe and healthy working environment.
Integrity and ethical conduct: zero tolerance for bribery and corruption, fair competition, and honest and transparent business dealings.
Responsible data stewardship: protecting the confidentiality, integrity and availability of company, client and personal data.
Accountability: providing accessible channels to raise concerns, protecting those who do so in good faith, and reviewing performance regularly.

Governance and accountability

Senior Leadership Team (SLT): holds ultimate accountability for this policy, retains ownership of corporate data, and provides executive-level commitment to ESG objectives.
Policy owner / ESG lead: [Designation] coordinates implementation, monitors performance and reports to the SLT [at least annually].
Compliance officer / legal function: receives and investigates reports of bribery, anti-competitive conduct and other violations.
Data Governance Committee, Data Custodians and Data Stewards: manage data responsibilities as defined in the Data Governance policy.
Managers and employees: every employee is responsible for understanding and complying with this policy and related company policies, and for reporting suspected violations.

Environmental
XIMNET recognises that environmental responsibility is integral to delivering quality products and services. As a technology and digital services company, XIMNET's most significant environmental influence lies in its day-to-day operations, its use of technology infrastructure, and its supply chain.

Our operations

Comply with all applicable environmental laws, regulations, permits and approvals.
Use energy, equipment, paper and other resources responsibly, and work to reduce unnecessary consumption.
Manage and dispose of electronic and general waste responsibly, including secure disposal of data-bearing equipment in line with the Information Security Policy.

Our suppliers
XIMNET expects suppliers to:

Obtain and keep current all required environmental permits, approvals and registrations.
Reduce consumption of raw materials, energy and water, and track, document and seek to minimise energy consumption and greenhouse gas emissions.
Seek ways to improve energy efficiency and use cleaner energy sources.
Identify and safely manage hazardous and restricted substances, and comply with XIMNET's requirements restricting specific substances.
Reduce or eliminate waste, and manage unavoidable waste in line with applicable laws and in an environmentally responsible and secure way.

Social

Labour and human rights
XIMNET is committed to upholding the human rights of all workers, including temporary, migrant, student, contract and direct employees. XIMNET and its suppliers must:

Not use or permit forced, bonded or indentured labour. All work must be voluntary, workers must be free to leave their employment, and workers must not be charged recruitment fees. Employers must not hold workers' identity, immigration or work permit documents longer than reasonably necessary.
Not use child labour. Workers under 18 must not perform work likely to jeopardise their health or safety, including night shifts and overtime. Properly managed internship and apprenticeship programmes are permitted.
Pay legally mandated wages and benefits, comply with the law on wage deductions, and provide a clear basis for pay. Wages must not be deducted as a disciplinary measure.
Keep working hours within legal limits. For hourly-paid supplier workers, workweeks are expected not to exceed 60 hours including overtime (or the local legal maximum if lower), with at least one day off in every seven.
Provide a written employment agreement in a language the worker understands.
Respect workers' rights to associate freely, bargain collectively and raise grievances without fear of reprisal, in accordance with local laws.

Diversity, inclusion and non-discrimination

XIMNET does not tolerate harassment, abuse, bullying, corporal punishment or inhumane treatment.
Screening, hiring and employment practices must not discriminate on the basis of race, colour, age, sex, gender, gender identity or expression, sexual orientation, marital status, ethnicity, national origin, caste, disability, genetic information, medical condition, pregnancy, religion, political affiliation, union membership or other protected characteristics.
Workers' religious practices will be reasonably accommodated.
XIMNET and its suppliers are expected to identify, measure and improve a culture of diversity and inclusion in all aspects of workplace management.

Health and safety

Comply with all applicable occupational safety and health laws and regulations.
Identify, evaluate and control exposure to safety and health hazards, and provide appropriate protective equipment and information where hazards cannot be fully controlled.
Maintain procedures to prevent, manage, track and report occupational injury and illness, and to encourage worker reporting.
Plan for emergencies, including emergency reporting, notification, evacuation, drills and recovery plans.
Provide access to clean sanitation, potable water and safe facilities, and ensure any worker accommodation provided is clean and safe.

Professional and workplace conduct
All XIMNET employees are expected to uphold the Company's core values of innovation, excellence, integrity, teamwork and customer focus, as set out in the Employee Code of Conduct. This includes:

Treating colleagues, clients and visitors with respect and courtesy.
Communicating openly, honestly and respectfully.
Resolving conflicts peacefully and professionally.
Using company property responsibly.
Protecting company and client confidentiality at all times.

Clients and accessibility

XIMNET prioritises client satisfaction and represents the Company professionally and ethically in all client relations.
XIMNET and its suppliers embed relevant web accessibility standards, innovation and best practices to deliver inclusive products and services for users and stakeholders.

Governance

Business ethics and integrity

Employees and suppliers must comply with all applicable laws and regulations, and avoid conflicts of interest or even the appearance of impropriety.
Business dealings must be accurately reflected in books and records.
Intellectual property rights must be respected, including in technology and know-how transfers.
Suppliers must disclose accurately information about their labour, health and safety, environmental practices, business activities, structure and performance, and cooperate with XIMNET's information requests and audits.

Anti-bribery and corruption
XIMNET prohibits bribery in any form, whether direct or through a third party. In line with the Anti-Bribery & Corruption Policy:

Offering, promising, giving, soliciting, demanding or accepting bribes is prohibited, as are facilitation payments, extortion and embezzlement.
Gifts, entertainment and hospitality must be reasonable and infrequent, never intended to influence a business decision, and require prior approval if above the predetermined value.
Political and charitable contributions must comply with law, be transparent, and not be used to obtain an unfair business advantage.
Employees and third-party representatives acting for XIMNET must comply with the policy and receive regular training.
Suspected violations may be reported anonymously through the confidential reporting hotline, or to a supervisor, manager or compliance officer. All reports are investigated thoroughly and objectively.

Fair competition
XIMNET is committed to complying with competition law and upholding fair competition. In line with the Anti-Competitive Conduct policy:

Employees must not discuss or exchange competitively sensitive information, such as pricing, costs, sales volumes, terms of trade, market strategies or future business plans, with competitors.
Price-fixing, bid-rigging, market allocation and other forms of collusion are prohibited.
Meetings and discussions must focus on legitimate business topics, and legal advice must be sought where there is any doubt.
Suspected anti-competitive conduct must be reported promptly to the designated compliance officer or legal department, which will investigate fairly, impartially and confidentially. XIMNET will cooperate fully with regulators and law enforcement authorities where required.

Information security
XIMNET protects its information assets under the Information Security Policy, including:

Access granted on a least-privilege basis, strong passwords, periodic access reviews and multi-factor authentication for critical systems.
Approval requirements and secure remote access for off-site work, and encryption of company-issued devices.
Restrictions on unauthorised portable storage devices and on storing sensitive data on personal devices.
Data loss prevention controls where implemented.
A documented incident response plan for data breaches involving customer information, and training for employees to recognise and report suspicious activity.

Data governance
XIMNET manages data as an asset under its Data Governance policy, based on the principles that data is a managed asset, shared, accessible, understood and secure. Key requirements include:

Defined roles for Data Custodians, Data Stewards, the Data Governance Committee, IT Services and users.
Classification of data, including identification and inventory of personally identifiable information.
Controls on retention and disposal, and on access and use of data.
A structured data breach response process: prompt investigation, mitigation, and reporting to the relevant data user, data controller or supervisory authority where required by law.

Privacy and personal data protection
In line with the Privacy Policy, XIMNET:

Collects and uses personal data only for stated purposes, such as responding to enquiries, improving services, communicating with consent and meeting legal obligations.
Does not sell or rent personal information, and shares it only with trusted service providers, in business transfers, or where required by law.
Retains personal data only as long as necessary and applies appropriate technical and organisational security measures.
Respects individuals' rights to access, correct and request deletion of their personal data, which can be exercised by contacting info@ximnet.com.my.
Applies the same protections to data collected through its website, chat interface and other digital platforms.

Third-party and supply chain management
In line with the Third Party Service Provider Management Procedure and the Supplier Code of Conduct, XIMNET:

Defines services and data involved before engaging a TPSP, and conducts due diligence covering background, financial stability and security practices.
Uses contracts that set out service delivery, security obligations, data ownership and termination rights, supported by SLAs and data sharing agreements.
Conducts a security risk assessment, security awareness onboarding and least-privilege access for TPSPs.
Maintains an inventory of TPSP engagements, carries out regular performance reviews, and may conduct security audits.
Monitors TPSP activity, responds to security incidents, and may terminate relationships where suppliers fail to meet these responsibilities.
Expects suppliers to maintain a management system with executive-level commitment, legal compliance processes, risk management, training, continuous improvement and a grievance channel for workers.
Expects suppliers to exercise due diligence on the source and chain of custody of tantalum, tin, tungsten and gold in the products they manufacture, so that they do not benefit armed groups committing human rights abuses in or near the Democratic Republic of the Congo.

Raising concerns and grievance mechanism

Concerns about ESG matters, including labour practices, safety, environmental harm, bribery, anti-competitive conduct, privacy or data breaches, can be raised with a supervisor, manager, the compliance officer or legal department, or through the confidential reporting hotline.
Confidentiality: grievances are treated in strict confidence and shared only with those directly involved in the investigation on a need-to-know basis.
Non-retaliation: retaliation against anyone who raises a concern in good faith is prohibited and may lead to disciplinary action.
Process: each grievance is acknowledged within [timeframe], investigated promptly, fairly and impartially, and resolved with appropriate corrective action. Complainants may appeal within [timeframe] to an impartial party not involved in the original investigation.
Records and reporting: grievances, investigations, outcomes and remedial actions are documented, and trends are reported regularly to senior management.

Training and awareness
XIMNET provides regular training and communication to employees on the Employee Code of Conduct, information security, anti-bribery and corruption, fair competition, data governance and privacy. Relevant third-party representatives and suppliers are informed of the standards that apply to them.

Monitoring, reporting and review

The policy owner monitors compliance with this policy and reports to the Senior Leadership Team at least annually.
This policy is reviewed at least annually and whenever there are material changes in law, regulation, technology, business operations or good practice. Employees will be notified of any updates.

Non-compliance
Violations of this policy or the related policies may result in disciplinary action, which may include written warnings, suspension without pay, or termination of employment, depending on severity and prior record. Suppliers and third parties that fail to meet these responsibilities may have their relationship with XIMNET terminated, and XIMNET may take legal action or cooperate with authorities where appropriate.

Contact
Questions about this policy can be directed to info@ximnet.com.my.