Formations of Foundations & Associations The Foundations and Associations Unit within MBR receives and processes applications for registration of organisations in terms of the Second Schedule of the Civil Code. The Deed/ Statute of the organisation, constituting the organisation, is forwarded to the Registrar for Legal Persons for registration. It should be accompanied by all relevant documentation, including copies of identification documents of involved parties. In case of an organisation which is registered with the Commissioner of Voluntary Organisation, evidence of such registration should also be produced. Upon registration, the Registrar will issue a certificate of registration, showing that the organisation has been officially registered. The certificate of registration can be collected from MBR. The applicable fees for the registration of an organisation are calculated according to the value of assets as indicated in below: Value of Assets Registration Fee Up to €1,500 €350 Over €1,500 but not exceeding €3,000 €350 with the addition of €23 for each €1,000 or part thereof in excess of €1,500 Over €3,000 but not exceeding €10,000 €420 with the addition of €11 for each €1,000 or part thereof in excess of €3,000 Over €10,000 but not exceeding €20,000 €652 with the addition of €11 for each €11,646 or part thereof in excess of €10,000 Exceeded €20,000 €815 with the addition of €11 for each €11,646 or part thereof in excess of €20,000 up to a maximum of €1,747 In case of an enrolled voluntary organisation, the above-mentioned fees shall be reduced to 10% of the above sums, with a minimum of €35. An administrative fee of 10% is levied on an application for registration which is withdrawn prior to registration, this is not applicable to an enrolled voluntary organisation. Advisory Committee Registrar / CEO Deputy Registrar / COO Registry Unit Compliance Unit Legal & Enforcement Unit Insolvency & Receirvership Service Unit Finanance & Admistration Unit Human Resources & Development Unit Information & Communication Technologies Unit Internation Affairs, Research & Communications Unit Money Laundering Reporting Officer Audit Committee Internal Audit Unit

Code of Ethics and Professional Conduct for Insolvency Practitioners Advisory Committee Registrar / CEO Deputy Registrar / COO Registry Unit Compliance Unit Legal & Enforcement Unit Insolvency & Receirvership Service Unit Finanance & Admistration Unit Human Resources & Development Unit Information & Communication Technologies Unit Internation Affairs, Research & Communications Unit Money Laundering Reporting Officer Audit Committee Internal Audit Unit

Redomiciliations, Domestic & Cross-Border Transactions Advisory Committee Registrar / CEO Deputy Registrar / COO Registry Unit Compliance Unit Legal & Enforcement Unit Insolvency & Receirvership Service Unit Finanance & Admistration Unit Human Resources & Development Unit Information & Communication Technologies Unit Internation Affairs, Research & Communications Unit Money Laundering Reporting Officer Audit Committee Internal Audit Unit

Terms and Conditions for Relying Parties of the Malta Business Wallet Version 1.0. Last updated 14 th May 2026 1.0. INTRODUCTION 1.1. Welcome to the Malta Business Registry ’s (“ MBR ”) Terms and Conditions (the “ T&Cs ”) relating to the provision of the services provided via the Malta Business Wallet , a software application which users can download and install onto their mobile device and/or access via any related website, sub-website and/or associated domains (and/or sub-domains) under which the services of the Malta Business Wallet may be offered (“ MBW ”, “ Software ”), and which You, a relying party, and your officer/s and/or employee/s, shall use to, inter alia , request, obtain, collect and receive data, information and reports made available through the repository by users ( “Relying Party” ) . 1.2. We recommend that you read these T&Cs in full. For the ease of your understanding, these are the contents of these T&Cs: 1.0. INTRODUCTION 2.0. DEFINITIONS 3.0. GENERAL 4.0. OVERVIEW, PURPOSE AND SCOPE 5.0. ELIGIBILITY AND OBLIGATIONS OF RELYING PARTIES 6.0. DATA SUBMISSION, VERIFICATION, AND AUDIT 7.0. DATA PROTECTION 8.0. DEVICE SECURITY 9.0. LIABILITY & INDEMNITY 10.0. INTELLECTUAL PROPERTY 11.0. BREACHES, PENALTIES AND TERMINATION 12.0. AMENDMENTS 13.0. FORCE MAJEURE AND MAINTENANCE 14.0. GOVERNING LAW AND JURISDICTION 15.0. ENTIRE AGREEMENT AND SEVERABILITY 2.0. DEFINITIONS 2.1 For the purposes of these T&Cs, unless defined elsewhere in these T&Cs, the following terms shall have the respective meanings or reference as indicated: “ Credentials ” includes identity documents, licences, or other professional authorisations submitted to evidence User status. “ Data ” means all information and materials that are submitted, uploaded, transmitted, provided, or otherwise made available by the User to the Software and/or the MBR and/or the Registrar, in any form or medium, including content, documents, files, data sets, messages and other communications, and any associated metadata to the extent relating to the foregoing. “ GDPR ” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data. “ Intellectual Property ” means patents, rights to inventions, copyright and neighbouring and related rights, trademarks, domain names, rights in designs, rights in computer software, database rights, rights to use, and protect the confidentiality of, confidential information and all other intellectual property rights, in each case whether registered or unregistered and including all applications and rights to apply for and be granted, renewals or extensions of, and rights to claim priority from, such rights and all similar or equivalent rights or forms of protection which subsist or will subsist now or in the future in any part of the world. “ User ” or “ Users ” means any natural person, whether acting on his behalf or on behalf of another natural or legal person, who has created an account on the Software and is utilising the MBR’s services as provided by the Software, including but not limited to submitting Data, information, documents, or any other Credentials to the Software. “ Personal Data ” means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked (directly or indirectly) to an identified or identifiable natural person, as referred to in Regulation (EU) 2016/679. “ Registrar ” means the Registrar of Companies as referred to under article 400 of the Companies Act, Cap. 386 of the Laws of Malta. “ Subject Person ” or “ Subject Persons ” means subject persons within the meaning of the Prevention of Money Laundering Act (Chapter 373 of the Laws of Malta). 3.0. GENERAL 3.1. The Software and all associated Intellectual Property is owned and operated by the Malta Business Registry, a Government Agency registered in Malta whose address is Malta Business Registry, AM Business Centre, Triq il-Labour, Zejtun, ZTN 2401. 3.2. These Terms and Conditions govern the use by Relying Parties of the Software as maintained and administered by the MBR under the direct responsibility of the Registrar. 3.3. In these T&Cs, “ you ” means you, as a Relying Party of the Software and “ your ” shall be interpreted accordingly. 3.4. By accepting these T&Cs and/or by using or accessing any features of the Software, you confirm that, You, including any officer/s and/or employee/s, have the authority to bind the entity you represent and agree to be legally bound by these T&Cs on its behalf. If you do not read, understand, or agree to these T&Cs or any part of them, you must not use the Software, register for an account, or access any of its features. 3.5. The application of any other general T&Cs other than these is expressly excluded. However, you understand and agree that you may have entered into further agreements dictating the use of the Software and you understand that you are equally bound by such agreements and it is your responsibility to be informed of the contents of such agreements and any obligations arising therefrom. 4.0. OVERVIEW, PURPOSE AND SCOPE 4.1. The Software is established to facilitate the lawful collection, secure storage, transfer and verification of Data in accordance with the Companies Act (Chapter 386 of the Laws of Malta), the Prevention of Money Laundering Act (Chapter 373 of the Laws of Malta), and any other applicable legislation. 4.2. The Software allows users to store virtual representations of Data, and to consequently share it with you, any public body, public authority, or third party who has been granted access to the Software by the MBR and/or the Registrar. Without prejudice to any legal obligations that the MBR and/or the Registrar may have to lawfully disclose the Data, users have complete control with whom they share their Data with, including you, and may opt to not share it with you, even if you have requested access to such Data. Similarly, they may opt to share one specific document with you that they have uploaded onto the Software but not the entire Data. 4.3. The use of the Software and its features, although considered to be legally binding and formally accepted as an official means of Data verification and transfer, remains a fully voluntary and optional service, meaning that nothing will stop Users from manually (and in any other manner as prescribed by you) sending Data (even if not uploaded to the Software), for whatever reasons, to you. Similarly, the Software does not bind and force you to request, collect, and verify Data solely through the Software. 4.4. Furthermore, the Software allows Subject Persons to act on behalf of their clients and to store virtual representations of their clients’ Data, and to consequently share it with you, in the same mode and manner in which the User would share their own Data. 5.0. ELIGIBILITY AND OBLIGATIONS OF RELYING PARTIES 5.1. Only duly authorised persons may access the Software and its features, and you warrant and represent that you are duly authorised to bind the entity you are representing and to access User’s Data on its behalf, and that such entity and yourself remain severally responsible for your acts and omissions. 5.2. If applicable, to set up and use the Software, you must also have a supported device running a version of an operating software that supports the Software (we always recommended, and in some instances require, that you use the latest available version). 5.3. You warrant that you understand that the collection, transmission, processing, or use of Data through the Software does not relieve the User of any legal, regulatory or statutory obligations to submit accurate, complete, and correct Data, and you expressly acknowledge that the submission of accurate and complete Data is a statutory requirement and remains the User’s sole responsibility for the purposes of regulatory compliance and oversight. 5.4. You are responsible for (i) maintaining the confidentiality and security of any account credentials issued to you or used by you to access the Software, (ii) ensuring that only authorised personnel access and use the Software under your account, and (iii) promptly notifying MBR of any actual or suspected unauthorised access or misuse. 5.5. You will ensure that all personnel accessing the Software on your behalf are appropriately trained and subject to confidentiality and data protection obligations at least as protective as those in these T&Cs. 5.6. You further represent and warrant that: I. Access by you to Data stored on the Software shall be limited to such data, information and reports as are necessary and proportionate for the purpose for which your access is requested, and done so in line with any applicable laws and regulations, in particular the Companies Act (Central Data Repository) Regulations; II. In accessing the Software and any of the Data contained therein, you shall comply with all applicable data protection legislation, including the General Data Protection Act (the “GDPR” ), the provisions of the Data Protection Act and any relevant regulations thereunder in relation to any personal data which you may access or receive through the repository; III. You will not use the Software for any illegal or fraudulent purposes, or any other purposes that are prohibited by the MBR and/or the Registrar including through these T&Cs; IV. Without prejudice to any other rights or remedies available at law, any Data accessed or otherwise obtained by you through the repository shall be treated as confidential and shall not be disclosed to any third party; V. You understand and agree that the MBR shall in no way or form be held liable for the submission of any false information by Users in connection with the Software and that you indemnify and hold the MBR harmless in accordance with the same; VI. You will not interfere with or disrupt the Software (including accessing the Software through any automated means), or any servers or networks connected to the Software, or any policies, requirements, or regulations of networks connected to the Software (including any unauthorised access to, use, or monitoring of data or traffic therein); VII. You shall not rely on the Registrar, the MBR and/or the Software as your sole or primary means of retaining, accessing, or retrieving copies of any Data that is submitted to the Software by a User; and VIII. Notwithstanding the MBR’s obligations at law, you remain responsible for maintaining your own complete, accurate, and up-to-date records, in accordance with applicable law and their internal record-retention requirements. 6.0. DATA SUBMISSION, VERIFICATION, AND AUDIT 6.1. You acknowledge that the Registrar, and in certain instances you, may from time to time, and in accordance with the Companies Act (Central Data Repository) Regulations, require the User to provide additional supporting documents, credentials, confirmations, or declarations in relation to any Data submitted to the MBR and/or the Registrar through the Software.. 6.2. The User will provide the requested information promptly and in any event within the period specified in the request. If the User does not respond within the applicable timeframe, or if the response is incomplete or inadequate, the Registrar and/or the MBR may, to the extent permitted by law and without prejudice to any other rights or remedies under the Regulations: I. Decline to process the relevant submission; II. Suspend review or acceptance of the Data pending receipt of a satisfactory response; and/or III. Require the User to resubmit or supplement the Data. 6.3. The Registrar will verify the Data submitted by the User to the extent required or permitted under applicable law and may, to the extent permitted by law, consult with or seek confirmation from any third party identification verification provider, competent authority or official body in Malta and/or in other jurisdictions for the purposes of verification, validation, or compliance checks. 6.4. Without limiting the foregoing, the MBR may verify, audit, and validate any Data submitted and may reject, suspend, or revoke acceptance of any Data where it has reasonable grounds to doubt the authenticity, legality, accuracy, completeness, or regulatory compliance of that Data, including where supporting evidence is not provided when requested. 7.0. DATA PROTECTION 7.1. You understand that the MBR shall process Personal Data relating to Users in its capacity as a Data Controller in accordance with the latest version of its Privacy Policy for the Software (the “ Privacy Policy ”) which is available at https://www.mbr.mt/website-pages/privacy-policy and details what Personal Data is processed by the MBR, the purposes for which Personal Data is processed, the applicable lawful bases under the GDPR, the categories of recipients and circumstances in which Personal Data may be shared, applicable retention periods including the criteria used to determine them, and the rights available to Users under the GDPR. 7.2. When accessing the Software, you agree that you will be processing Data relating to Users in your capacity as a separate and independent Data Controller and in accordance with ‘Annex I - Data Sharing Agreement’ to these T&Cs, which is for all intents and purposes of the law incorporated into these T&Cs by reference and forms an integral part of them. 7.3. Your acceptance of these T&Cs includes your full acceptance of the ‘Annex I - Data Sharing Agreement’. 7.4. Questions relating to ‘Annex I - Data Sharing Agreement’ may be directed to the MBR’s Data Protection Officer (the “ DPO ”) at dpo.mbr@mbr.mt . 8.0. DEVICE SECURITY 8.1. If you authorise or allow any other person other than those lawfully allowed to access the Software, you expressly agree and acknowledge that, without prejudice to any rights that the MBR and/or Registrar may have under these T&Cs and/or any applicable legislation, you will be held fully responsible for all access, verifications, and actions made by that person. 8.2. If you make any unauthorised modifications to your device, such as by disabling hardware or software controls, your device may no longer be eligible to access or use the Software. You acknowledge that the use of a modified device in connection with the Software is expressly prohibited, constitutes a violation of these T&Cs and the MBR and/or Registrar may exercise any rights they have against you arising from these T&Cs and/or any applicable legislation. 8.3. You may need to enable additional security measures as may be dictated by the MBR from time to time, such as two-factor authentication in order to access the Software or any particular features therein. If you subsequently decide to remove and/or decline the use of such additional security measures, you may not be able to continue to access the Software or any particular features therein. 9.0. LIABILITY & INDEMNITY 9.1. To the maximum extent permitted by applicable law, and without limiting any mandatory statutory duties that apply to the MBR in its capacity as a public authority, the MBR will not be liable for any losses, damages, claims, fines, penalties, costs, or expenses arising out of or relating to your receipt, processing, publication, retention, or other reliance on any Data submitted by a User that is inaccurate, incomplete, unlawful, misleading, or fraudulent, as well as any acts by the User or you which breach these T&Cs and/or any applicable legislation. 9.2. You shall indemnify, defend, and hold harmless the MBR and its officers, employees, agents, and representatives from and against any and all claims, actions, proceedings, investigations, demands, liabilities, losses, damages, judgments, settlements, fines, penalties, interest, and legal and professional fees arising out of or relating to: I. Your breach of these T&Cs; or II. Any allegation that the Data submitted by the User is unlawful, infringing, misleading, inaccurate, incomplete, fraudulent, or otherwise non-compliant with applicable law. 10.0. INTELLECTUAL PROPERTY 10.1. MBR is the sole owner of the Software and all Intellectual Property rights therein, including but not limited to brands, trademarks, logos, and all registered and unregistered names, signs and distinctive devices that may be used in the Software. Any unauthorised use of the above will result in legal action being taken against the infringer. 10.2. The Software and its contents may not be reproduced, transmitted or stored in whole or in part without the MBR’s written consent. Your registration and use of the Software does not confer any rights whatsoever to the Intellectual Property contained in or on the same Software. 10.3. You agree not to use any automatic or manual device to monitor the Software, or any content therein. Any unauthorised use or reproduction will result in legal action being taken against the infringer. 11.0. BREACHES, PENALTIES AND TERMINATION 11.1. Without prejudice to any other rights or remedies available to the MBR and/or the Registrar under these T&Cs, the Companies Act, Companies Act (Central Data Repository) Regulations, or otherwise at law, where the MBR and/or the Registrar reasonably considers that you have failed to comply with these T&Cs or applicable law, the MBR may, acting proportionately and to the extent permitted by law, take such measures as it considers appropriate, including suspending, restricting or terminating your access to the Software. 11.2. The MBR may terminate and restrict your access by electronic notice if: I. You commit a material breach of these T&Cs or any applicable law and, where capable of remedy, you do not remedy it within the period indicated by the MBR; or II. You commit repeated breaches of these T&Cs or any applicable law; or III. Your credentials are compromised/misused or you otherwise create a security risk; or IV. Termination is required or advisable to comply with law/regulatory requirements. Notwithstanding the above, and for the avoidance of doubt, the MBR may terminate and restrict your access immediately for fraud, deliberate misrepresentation, serious or non-curable breach, unlawful submissions, material security/integrity risk, or where required by law. 11.3. The MBR may also suspend, restrict, or terminate your access to the Software if the Software is discontinued, withdrawn, replaced, or materially modified, or if continued provision of the Software is not reasonably practicable due to legal or regulatory requirements, security risks, operational constraints, or decisions of the Registrar or any other competent authority. Where reasonably practicable, the MBR will provide advance notice of any discontinuance or material changes affecting the User. 12.0. AMENDMENTS 12.1. The MBR may amend, update, or replace these T&Cs from time to time. Unless a different effective date is stated in the notice, any amendment will take effect on the date in which the notice was published (the “ Effective Amendment Date ”) and will apply only from that Effective Amendment Date onwards. 12.2. By continuing to access or use the Software on or after the Effective Amendment Date, are deemed to have accepted the amended T&Cs. For clarity, unless and to the extent required by applicable law, amendments will not apply retroactively to any Data or submission that was accepted, processed, or otherwise finally recorded by the MBR prior to the Amendment Effective Date. 13.0. FORCE MAJEURE AND MAINTENANCE 13.1. The MBR will not be liable for any failure or delay in performing its obligations under these T&Cs to the extent caused by an event beyond MBR’s reasonable control (an “ Excusable Event ”). Excusable Events include, without limitation, natural disasters and public health emergencies; war, terrorism, civil unrest, sabotage, or malicious damage; acts, directions, restrictions, or failures of any government, court, regulator, or other competent authority; utility/telecommunications outages; failures or unavailability of third-party infrastructure or services (including hosting/cloud/network providers); cyber incidents (including ransomware or denial-of-service attacks); and software, system, or security failures (including planned or emergency maintenance). 13.2. Where reasonably practicable, MBR will; I. Notify you of an Excusable Event; and II. Take reasonable steps to mitigate the impact of the Excusable Event and restore service to the Software and its features. MBR may implement temporary procedures and may suspend, restrict, or defer access to the Software (in whole or in part) as reasonably necessary to address the Excusable Event and protect the integrity, security, and lawful operation of the Software. 13.3. Notwithstanding the above, you acknowledge that access to, availability of, or retrieval of Data from the Software (including any viewing, download, extract, or copy functionality) may be unavailable, restricted, suspended, delayed, or limited from time to time (including due to maintenance, security, legal, or operational reasons). 14.0. GOVERNING LAW AND JURISDICTION 14.1. These T&Cs shall be governed by and construed under the Laws of Malta. 14.2. Any dispute arising from these T&Cs shall fall under the exclusive jurisdiction of the Courts of Malta. 15.0. ENTIRE AGREEMENT AND SEVERABILITY 15.1. These T&Cs, including any other annexes that have been incorporated by reference, constitute the entire agreement between the MBR and you in relation to your access to and use of the Software and supersedes and replaces all prior and contemporaneous understandings, communications, representations, and agreements. 15.2. If any provision of these T&Cs is held to be invalid, unlawful, or unenforceable, that provision will be severed and, where permitted, modified to the minimum extent necessary to make it valid, lawful, and enforceable while preserving its intent as far as possible. If that is not possible, the invalid, unlawful, or unenforceable provision will be deemed replaced by a valid, lawful, and enforceable provision that most closely reflects the regulatory intent of the original provision. The remaining provisions will remain in full force and effect. ANNEX I - DATA SHARING AGREEMENT This Data Sharing Agreement is made by and between the Parties, and unless defined elsewhere, the following terms shall have the respective meanings or reference as indicated: ‘ Agreement ’ means the terms and conditions, and any other agreement that may have been entered into between MBR and the Relying Party as amended or further supplemented by any additional agreements which may apply from time to time; ‘ DSA ’ means this Data Sharing Agreement, including any Appendices attached or referred to herein and including any future amendments and additions in writing; ‘ Data Breach ’ means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data; ‘ Data Protection Laws ’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27th April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter ‘ GDPR ’), as amended from time to time, including national supplementary or implementation measures as applicable, together with any other regulation, law, including national legal instruments in the field of protection of personal data, as may be applicable by virtue of territorial or extra-territorial scope of application; ‘ Delete ’ shall mean deleting data in such a manner that restoring or recovering such data shall be impossible; ‘ Personal Data ’ means Personal Data that are shared by the MBR with the Accessing Party pursuant to this DSA, and vice versa as may be the case, and this in the mode and manner already specified and stipulated in this DSA; The terms “ Controller ”, “ Processing ”, “ Data Subject ”, “ Personal Data Breach ”, “ Joint Controller ”, and “ Supervisory Authority ” shall have the same meaning as in the Data Protection Laws. 1.0 BACKGROUND 1.1. The MBR and You, the Relying Party, are sharing Personal Data in their roles of separate controllers in conjunction with the MBR’s provision of services via the Malta Business Wallet, a software deployed by the MBR to facilitate the sharing of information, inclusive of personal data, between individuals involved in legal entities, government bodies, agencies, and other third parties. 1.2. The Parties hereby acknowledge that this DSA shall apply to any and all Personal Data that have been and shall be shared in conjunction with the above purpose. 1.3. This DSA expressly replaces and supersedes any and all other agreements, oral or written, between the Parties hereto with respect to the subject matter hereof. 1.4. In consideration of the above, in order to protect Personal Data and to ensure they are shared in accordance with Data Protection Laws, the Parties have, for their mutual benefit and for good and valuable consideration, agreed to the following terms for the said sharing of Personal Data. 1.5. Personal Data shared for the Purpose shall mean, the data which is stored on the Malta Business Wallet, which at the sole choice and discretion of the User of the Malta Business Wallet, or otherwise if required by applicable laws, is shared with you, which includes: I. Registration Data provided by the User when they register and/or open an account on the Malta Business Wallet for the first time including their first name, last name, date of birth, gender, nationality, country of birth, and profile image; II. Company Involvement Data which includes data related to Users’ involvements and positions within any legal entities; III. Identification Document Data which includes any identification documents that the user has uploaded onto the Malta Business Wallet, including the Users’ ID Card, Residence Card, Passport, or any other form of identification document which is accepted by the Malta Business Wallet, and any personal information that may be contained within such documents; IV. Verification of Address Data which includes any personal data contained within documents that the user has uploaded onto the Malta Business Wallet that may be used to verify any residential and/or commercial address, including rental agreements, bank statements, utility bills, and any government issued documentation; and V. Source of Wealth Data which includes any personal data contained within documents that the user has uploaded onto the Malta Business Wallet that may be used to verify the users’ source of wealth/income such as bank issued statements, statements of investments/shares, evidence of inheritance, contract of employment, payslips, income statements, profit and loss accounts, and receipts. 2.0 GENERAL DATA PROTECTION PROVISIONS 2.1. Each Party is acting as a separate Controller in its own right with respect to the Processing of the Personal Data it carries out towards its customers and/or users as understood under the Data Protection Laws. Each of the Parties independently determines the purposes and means of processing of Personal Data and acts Independently of the other Party. The Parties do not jointly determine the purposes and means of the processing and do not act as Joint Controllers. Neither of the Parties processes personal data on behalf of the other Party and neither of the Parties acts as a Data Processor of the other Party. Each of the Parties shall independently take all necessary measures to comply with applicable Data Protection Laws. 2.2. Each Party shall independently ensure that all processing of Personal Data carried out as an Independent Controller is done on the basis of the appropriate legal basis. 2.3. Any legal basis established for the processing of Personal Data by one Party, shall in no way affect the rights and/or obligations of the other Party. 2.4. Each Party, acting as an Independent Controller, shall ensure that the legal basis used for the sharing of Personal Data with the other Party, is valid and appropriate in terms of the Data Protection Laws. 2.5. Each Party shall ensure, to the best of its abilities, that any Personal Data it is responsible for is only shared with or sent to the other Party in a manner which is in full compliance with Data Protection Laws and such sending Party must also ensure, to the best of its abilities, that such Personal Data has been collected or otherwise processed lawfully and that where required, appropriate consent or other authorisation has been granted for sharing the personal data with the other Party. 2.6. Each Party shall ensure that Data Subjects to whom such Personal Data relates (to be shared with or sent to the other Party) have been provided with all the necessary information as required by the Data Protection Laws. 2.7. Each Party undertakes to fulfill all of its obligations arising under the Data Protection Laws which it may have with respect to the Data Subjects to whom the Personal Data Subject of this DSA relates and such Party shall be solely responsible for any of its failures to carry out any such obligations. 2.8. The Parties recognise that this DSA shall be interpreted in full compliance with the Data Protection Laws as well as any relevant applicable legislation. 2.9. For the avoidance of all doubt and in addition to anything else agreed between them, the Parties, in whatever role they may occupy and with respect to any sharing of Personal Data they may be involved in together, undertake to comply with the provisions of the Data Protection Laws. 3.0 OBLIGATIONS 3.1. The Parties confirm their ability to comply with the GDPR. 3.2. The Parties confirm that they both separately implement and/or provide sufficient guarantees to implement appropriate technical and organizational measures as well as any other additional measures which satisfy the requirements of Data Protection Laws and ensure the security of the Personal Data and the protection of the rights of the Data Subjects. 3.3. The Parties shall provide each other with all information necessary to demonstrate compliance with this DSA and the Data Protection Laws upon request. 3.4. You shall share Personal Data with MBR as an independent Controller in accordance with this DSA and in compliance with the Data Protection Laws. 3.5. The Parties shall not share any Personal Data with each other except as may be necessary for the performance of any service or task provided for MBR and, in particular, shall share the Personal Data strictly in line with the T&Cs and this DSA. 3.6. Each Party warrants that it shall not perform any of its obligations under this DSA in such a way as to cause either Party to breach any of its obligations arising under the Data Protection Laws or otherwise act or fail to act in such a manner that leads to such breach. 3.7. You shall inform MBR immediately if you think that any obligation pursuant to the T&Cs or this DSA does not comply with the Data Protection Laws. 4.0 AUTHORISED PERSONS AND THIRD PARTIES 4.1. The Parties shall ensure that Personal Data shall only be disclosed to persons authorized to process the Personal Data on a need-to-know basis (including employees). 4.2. Each Party shall ensure that Personal Data is not disclosed or transferred to any third party without the prior explicit written consent of the other Party, except as specifically stated in this DSA or as explicitly required by law. For the avoidance of doubt, third parties as understood in this clause do not constitute and/or include Relying Party or MBR subsidiaries, subcontractors, processors or sub-processors. Each Party shall assume its own responsibilities (in full) for any disclosures to such subsidiaries, subcontractors, processors and/or sub-processors. 5.0 ACCURACY OF DATA 5.1. The Parties shall ensure that all Personal Data, as provided by you to MBR and vice versa in the ordinary course of business, are kept accurate and complete, and where necessary (including upon any MBR Instructions), updated and/or rectified. 5.2. You shall use and are authorized to use all reasonable efforts to ensure that any Personal Data, which is inaccurate or incomplete, is erased or rectified. You agree that you shall not make any other changes to the Personal Data except as agreed with MBR. 6.0 ASSISTANCE 6.1. You shall assist MBR in ensuring compliance with the obligations pursuant to (i) Article 32 of the GDPR relating to the obligation to keep Personal Data Secure, (ii) Article 33 of the GDPR relating to the obligation to notify Personal Data Breaches to the supervisory authority, (iii) Article 34 of the GDPR relating to the obligation to advise data subjects when there has been a Personal Data Breach, (iv) Article 35 of the GDPR relating to the obligation to carry out data protection impact assessment (DPIA), (v) Article 36 of the GDPR relating to the obligation of prior consultation with the supervisory authority where the DPIA indicates there is an unmitigated high risk to the processing. 6.2. You shall assist MBR in responding to Data Subjects Rights requests as required by MBR. 6.3. You shall ensure that you will respond within a reasonable timeframe, provided that the response shall be provided by not later than 48 hours, to every request of MBR for the purpose of verification in relation to the processing of Personal Data as per this DSA. 7.0 DATA BREACHES 7.1. In the case of a Data Breach, you shall immediately and, in any case, not later than 24 hours after having become aware of it, notify such Data Breach to MBR, whether or not the breach was caused by yourself. 7.2. On its part, should MBR become aware of a Data Breach that MBR believes to be your responsibility, MBR shall, within reasonable time, inform you accordingly. 7.3. When notifying MBR of the Data Breach, you shall provide MBR with all information that may be considered necessary in addressing, restricting and minimizing the effects of the Data Breach and/or preventing further Personal Data Breaches. When notifying MBR of the Data Breach, you shall provide, at least, (i) a description of the Data Breach, including in so far as is possible the categories and approximate number of data subjects concerned, and the categories and approximate number of Personal Data records concerned, (ii) the name and contact details of a person who can provide more information on the matter, (iii) a description of the likely consequences of the Data Breach, (iv) a description of the remedial measures taken by you to address the Data Breach and (v) measures to mitigate its possible adverse effects. 8.0 TRANSPARENCY 8.1. Without prejudice to your rights at law, you shall be responsible for ensuring that Data Subjects are informed of all Data Sharing activity that you shall be undertaking and their rights in accordance with Data Protection Laws 9.0 DATA PROTECTION OFFICER 9.1. You shall ensure that you have appointed a Data Protection Officer (‘ DPO '); 9.2. You shall communicate the name and contact details of the DPO to MBR without undue delay. 10.0 TERM AND TERMINATION 10.1. This DSA shall become effective as of the effective date of the T&Cs. 10.2. After the termination of T&Cs, the Parties shall not share any Personal Data and shall continue to be bound by all the obligations relating to the processing of any Personal Data as independent controllers. 10.3. Without prejudice to your rights at law, upon termination of the T&Cs and insofar as the processing of personal data is exclusively required for the purposes of this Agreement, the Parties shall agree upon the process to delete and/or procure deletion of all Personal Data in your possession or control. 10.4. For the avoidance of doubt, this clause shall be without prejudice to any rights or obligations that either Party may have or be subject to at law to retain and/or further process the Personal Data in its capacity as Data Controller even after termination of the T&Cs. In such a case, each Party shall independently assume responsibility for ensuring that such Personal Data may be retained and/or otherwise processed lawfully by itself. 11.0 CONFIDENTIALITY 11.1. In virtue of the above, and without prejudice to anything stipulated in the T&Cs or any separate agreement on the matter, you may become privy to confidential information (which may or may not amount to Personal Data) pertaining to MBR, and therefore you agree to ensure that you and any of your employees, consultants, or agents to whom such confidential information is lawfully disclosed and/or made available to, covenant to keep such information confidential. 11.2. MBR may also become privy to confidential information (which may or may not amount to Personal Data) pertaining to the Relying Party, and therefore, without prejudice to anything stipulated in the T&Cs or any separate agreement on the matter, MBR agrees to ensure that itself and any of its employees and/or consultants and/or agents and/or any other authorized entity to whom such confidential information is lawfully disclosed and/or made available to, covenant to keep such information confidential. 11.3. The Parties agree that the confidentiality obligations described within this DSA shall survive the termination of the T&Cs. 12.0 LIABILITY 12.1. Notwithstanding anything to the contrary contained herein and/or in the T&Cs, you shall fully indemnify and hold and keep MBR (and its directors, officers, employees, shareholders, agents and representatives, consultants) fully indemnified and harmless: I. From and against any and all liabilities, claims, actions, proceedings, damages (including indirect damages), loss suffered (including loss of profits, revenue, business, contracts, anticipated savings) including costs of legal representation, attorney’s fees, court's fees; and/or II. From and against any finally awarded penalties, administrative or other fines or sanctions paid or to be paid by MBR, including costs of legal representation, attorney's fees, court's fees; and/or III. From and against any and all third-party liabilities, compensation claims, actions, proceedings, damages, loss suffered (including loss of profits, revenue, business, contracts, anticipated savings) including costs of legal representation, attorney's fees, court's fees; and/or IV. From and against any other expenses whatsoever; suffered or incurred by MBR or awarded against MBR in relation to or as consequence of or arising out of any breach, non-compliance or non-performance of any or all of the covenants, guarantees, warranties, representations, obligations, or provisions on the Relying Party's part (or any of its subcontractors or sub-processors) contained in this DSA and/or any other agreement between the Parties involving processing of Personal Data (including but not limited to the T&Cs) and/or any applicable laws, including without limitation the Data Protection Laws. 13.0 NO WAIVER 13.1. The failure of either Party hereto to insist upon the strict adherence to any term of this DSA on any occasion shall not be considered as a waiver of any right hereunder nor shall it deprive that Party of the right to insist upon the strict adherence to that term or any other term of this DSA at some other time. 14.0 DISPUTES AND GOVERNING LAW 14.1. Notwithstanding anything to the contrary in the T&Cs, this DSA shall be subject to the laws of Malta, and any dispute on the subject matter shall be settled exclusively by the competent court(s), tribunal(s) or other adjudicating authority/ies in Malta. 14.2. Each Party irrevocably submits to the exclusive jurisdiction of the Maltese courts over any claim, dispute or matter arising under or in connection with this DSA (including non-contractual disputes or claims) or its enforceability or formation or the legal relationships established by this DSA and waives any objection to proceedings in such courts on the grounds of venue or on the grounds that proceedings have been brought in an inconvenient forum. Advisory Committee Registrar / CEO Deputy Registrar / COO Registry Unit Compliance Unit Legal & Enforcement Unit Insolvency & Receirvership Service Unit Finanance & Admistration Unit Human Resources & Development Unit Information & Communication Technologies Unit Internation Affairs, Research & Communications Unit Money Laundering Reporting Officer Audit Committee Internal Audit Unit

Careers The Malta Business Registry (MBR) offers great career opportunities in various disciplines, including accountancy, legal, finance, compliance, internal audit, tax, information technology and management. The posts can be at supporting clerical and administrative entry levels, or at graduate and professional level, in accordance with the MBR’s requirements. In this regard, the MBR gives also high value to relevant experience. Apprenticeships & Internships You can view more information here . Our Values: MBR’s employees exercise any power vested by law to deliver the best possible service to its clients, expeditiously and impartially. MBR’s employees provide objective and professional advice on matters within their respective competence. Through their conduct, staff contribute to making the workplace one which recognises talent, develops skills and abilities, rewards performance, upholds integrity and fosters equality. Benefits: Posts within the MBR are challenging, stimulating and rewarding. The MBR offers appealing overall packages as follows: Competitive salaries based on a performance-related pay system Financial assistance and in time to pursue self-development opportunities at specialised Diploma, Graduate and Post-Graduate levels Career advancement based on meritocracy Continuous Professional Development and Qualification Allowances Other MBR Benefits: High value to employees, working ethics, motivation and job-satisfaction Family-friendly measures, including reduced-hours working schedules, teleworking, flexitime, parental special leave and child-minding facilities Continuous on-the-job training, team-building activities and various opportunities of locally organised seminars and training events Overseas training and exposure Equality measures Excellent office working environment Health insurance for staff and their dependents Death in service benefit Recognition to long-service Social events organised periodically by the Social Committee. The Malta Business Registry is currently looking to grow its team to achieve a new level of excellence. Candidates are to forward a copy of their Curriculum Vitae (C.V.) and an accompanying covering letter providing the motivation for the application to careers.mbr@mbr.mt Advisory Committee Registrar / CEO Deputy Registrar / COO Registry Unit Compliance Unit Legal & Enforcement Unit Insolvency & Receirvership Service Unit Finanance & Admistration Unit Human Resources & Development Unit Information & Communication Technologies Unit Internation Affairs, Research & Communications Unit Money Laundering Reporting Officer Audit Committee Internal Audit Unit

Duties and Liabilities of Directors General Duties of Company Directors Directors of a company are legally required to act in good faith and in the best interests of the company. Their key responsibilities include: Ensuring the proper governance, administration, and management of the company. Supervising the company’s affairs and making informed decisions. Specific duties include: Exercising care, diligence, and skill equivalent to a reasonably diligent person in the director's position. Avoiding secret or personal profits from their role and not misusing confidential company information. Ensuring their personal interests do not conflict with the company's interests. Not using company resources, information, or opportunities for personal gain without consent. Using their powers only for the purposes they were intended for, without abuse. Additionally, individuals may not serve as directors if they are: Undischarged bankrupts or subject to legal restrictions. Convicted of crimes involving public trust, theft, or fraud. Minors without emancipation or subject to a court disqualification order. Advisory Committee Registrar / CEO Deputy Registrar / COO Registry Unit Compliance Unit Legal & Enforcement Unit Insolvency & Receirvership Service Unit Finanance & Admistration Unit Human Resources & Development Unit Information & Communication Technologies Unit Internation Affairs, Research & Communications Unit Money Laundering Reporting Officer Audit Committee Internal Audit Unit

Official Registry Forms Companies Act 1995 – For Limited Liability Companies / Public Limited Liability Companies Form B1(A) Notice of resolution for dissolution and consequential winding up * Form B(2) Declaration of solvency * Form F Notice to Registrar to exercise his power to appoint an auditor Form F(1) Notice of the removal of an auditor * Form F(2) Notification by partnership/company of the resignation of an auditor * Form F(3) Notice of appointment of auditor/s pursuant to article 151(9)/article 66(3) * Form H Return of allotments of shares Form I Notice that a company has become a Single-Member Company Form I(1) Notice that a company has ceased to become a Single-Member Company Form K Notification of changes among directors or company secretary or in the representation of the company and the directors’ consent and declaration for appointment pursuant to Articles 139(1), 139(5) and 146(1) Form K(1) Declaration of compliance with article 139 made by persons applying to become directors of a proposed company Pursuant to article 139(1) and (5) * Form K(2) Notification of appointment, resignation or removal of the person appointed by an order of the Court or by a competent authority pursuant to the last proviso to article 146(1) Form L Notice of appointment of liquidator * Form L(1) Notice of appointment of liquidator by the Court Form L(2) Notification of bank account by liquidator Form L(3) Notice of resignation of a liquidator * Form L(4) Liquidator’s Statement with respect of pending winding up * Form Q Notification of change in the registered office and / or electronic mail address of a Company * Form R Notice of accounting reference date * Form R(1) Notice of alteration of the accounting reference period * Form S Declaration of compliance with Article (110(4)) relating to financial assistance given by a private company for the purchase of its own or its parent company’s shares * Form T Notice of transfer or transmission of shares Form T(1) Notice of redemption of preference shares * Form T(2) Notice of pledge of securities * Form T(3) Notice of termination of a pledge of securities * Form Z Annual Return Form Agricultural Companies Form AC1 Notice that a company has become subject to regulation 1(2) Form AC2 Declaration on Source of Income in terms of regulation 15(1) Youth Enterprises Annex 1 Memorandum and Articles of Association for Youth Enterprise * Annex II – Form YE(1) A Declaration of the Parents exercising parental authority, Guardians or Tutors of the members of the youth enterprise in accordance with regulation 8(c) of the Companies Act (Youth Enterprise) Regulations (S.L. 386.32.) * Annex III – Form YE(2) A Declaration confirming the Mentor of the youth enterprise in accordance with regulation 8(d) of the Companies Act (Youth Enterprise) Regulations (S.L. 386.32.) * Annex IV – Form YE(3) A return in accordance with regulation 8(e) of the Companies Act (Youth Enterprise) Regulations (S.L. 386.32.) * Annex V – Form YE(4) A declaration of the members of the youth enterprise in accordance with regulation 8(g) of the Companies Act (Youth Enterprise) Regulations (S.L. 386. 32.) * Annex VI – Form YE(5) A declaration confirming the training sessions attended by the members of the youth enterprise in accordance with regulation 18 of the Companies Act (Youth Enterprise) Regulations (S.L. 386.32) * Annex VII – Form YE(B1) Notice of a unanimous decision for the dissolution of the youth enterprise in accordance with regulation 12 of the Companies Act (Youth Enterprise) Regulations (S.L. 386.32) * Annex VIII – Form YE(B3) Application for simplified dissolution procedure in accordance with regulation 12 of the Companies Act (Youth Enterprise) Regulations (S.L. 386.32) * Annex IX – Form YE(B4) Members’ Declaration in accordance with regulation 12 of the Companies Act (Youth Enterprise) Regulations (S.L. 386.32) * Simplified Dissolution Procedure Form B1 Notice of a resolution for dissolution * Form B3 Application for simplified dissolution procedure * Form B4 Director’s declaration * Public Limited Companies (PLCs) Form G Notice of declaration of compliance with Section 97 made by a Public Company Form J Declaration of compliance with Section 209 made by the directors of a Public Company Partnerships Form A Notification of appointment of a partner Form A(1) Notification of cessation to be a partner Form A(2) Notice that a partnership has become subject to Art. 7A or 51A Form A(3) Notice that a partnership has ceased subject to Art. 7A or 51A Form B Notice of dissolution of a partnership * Form C Notice of appointment of liquidator – Pursuant to Section 37 (3) / Section 52 * Form D Notice of extension of the duration of a partnership Form E Notice of approval of accounts and scheme of distribution of partnership * Form E(1) Notice of completion of winding up of partnership * Overseas Companies Form M Information pursuant to Article 385 (1) by an oversea company establishing a branch or place of business in Malta * Form V Return of alteration in the charter, statues or memorandum and articles of an oversea company Form W Return of alteration in directors/secretary of an overseas company/particulars contained in directors and secretary list Form X Return of alterations in names or addresses of the individuals authorised to represent an overseas company in Malta Form Y Notice of closure of branch or place of business in Malta Form Y(1) Notification of dissolution of winding up of Oversea Company Form Y(2) Notification of appointment of liquidator of Oversea Company Form Y(3) Notification by liquidator of an oversea company concerning the termination of the winding up of the company Small Companies Template DD1 Declaration by Directors – small companies – (Applicable to accounting periods other than the first account period) * Template DD2 Declaration by Directors – small companies – (Applicable only in respect of the first accounting period) * Template DD3 Declaration by Directors – small companies in terms of article 185(2) * Template DD4 Declaration by Directors – small companies in terms of article 185(2) in respect of the first account period * Small Companies (MSR) Template DD1 – MSR Declaration by Directors – small companies – (Applicable to accounting periods other than the first account period) * Template DD2 – MSR Declaration by Directors – small companies – (Applicable only in respect of the first accounting period) * Merchant Shipping Regulations (MSR) Form A – MSR Notice that a company has become a Single-Member Company Form B – MSR Notice that a company has ceased to be a Single-Member Company Form C – MSR Return of allotments of shares (a) Form D – MSR Notice of disclosure of financial assistance Form E – MSR Notice of redemption of preference shares Form F – MSR Notice of transfer or transmission of shares Form G – MSR Notice of a pledge of securities Form H – MSR Notice of termination of a pledge of securities Form I – MSR Notification of changes among directors or in the representation of a company Form J – MSR Notice of accounting periods Form K – MSR Notice to the Registrar to exercise his power to appoint an auditor Form L – MSR Notice of removal of an auditor Form M – MSR Notification by company of the resignation of an auditor Form N – MSR Notice of appointment of liquidator by the court Form O – MSR Notification of bank account by liquidator Form P – MSR Notice of appointment of liquidator * Form Q – MSR Notice of completion of liquidation * Form R – MSR Declaration of seizure of ship Form S – MSR Notice of dissolution and consequential winding up * Form T – MSR Notice of resignation of liquidator * Form U – MSR Notice of winding up without procedures Form V – MSR Notice of change in registered office of a company Form Z – MSR Contents and Forms of Annual Returns – MSR Companies Act 1995 – Beneficial Owners Form BO1 Declaration on Beneficial Owners in terms of Regulation 3 * Form BO2 Notice on Beneficial Owners in terms of Regulation 6 Form BO3 Declaration on Beneficial Owners in terms of Regulation 8 Form BO4 Declaration on Beneficial Owners in terms of Regulation 5(6) Form BO – Annual Confirmation Declaration on Beneficial Owners in terms of Regulation 6A(1) Form BO – Change in SMO Declaration on Beneficial Owners in terms of Regulation 6A (3) Form BO – Change in Details of BO/SMO Declaration on Beneficial Owners in terms of Regulation 6A (4) Mobility Directive Form CBC1 – Conversion Application by Board of Directors to obtain a pre-conversion certificate in terms of Regulation 17(1) Form CBC2 – Pledgee’s Consent Notice of consent by pledgee in terms of Regulation 24(1)(c) Form – Division Application by Board of Directors to obtain a pre-division certificate in terms of Regulation 17(1) Form – Merger Application by Board of Directors to obtain a pre-merger certificate in terms of Regulation 17(1) * Submitted to the MBR through BAROS Advisory Committee Registrar / CEO Deputy Registrar / COO Registry Unit Compliance Unit Legal & Enforcement Unit Insolvency & Receirvership Service Unit Finanance & Admistration Unit Human Resources & Development Unit Information & Communication Technologies Unit Internation Affairs, Research & Communications Unit Money Laundering Reporting Officer Audit Committee Internal Audit Unit

Internships & Apprenticeships The apprenticeship and internship programme offers the opportunity to gain invaluable insight into the operations of the MBR through hands-on experience, while contributing to the ongoing success of the registry. Work in one of our Units Registry Compliance Legal and Enforcement Finance and Administration Foundations and Associations Information and Communication Technologies Human Resource and Development Internal Control Unit (Risk and Internal Audit) Office of the Money Laundering Reporting Officer Insolvency and Receivership Services Communications, Research, and International Affairs Archives Malta Tax and Customs Administration Your role within the MBR can vary from vetting of documents, assisting in company incorporation, liaising with CSPs, to ICT assistance, amongst several other opportunities that will prove beneficial for your career. Download our brochure here . Advisory Committee Registrar / CEO Deputy Registrar / COO Registry Unit Compliance Unit Legal & Enforcement Unit Insolvency & Receirvership Service Unit Finanance & Admistration Unit Human Resources & Development Unit Information & Communication Technologies Unit Internation Affairs, Research & Communications Unit Money Laundering Reporting Officer Audit Committee Internal Audit Unit

FOI Last Updated on April 9, 2024 Government Agency Malta Business Registry (“MBR”) Description of the agency’s structure The MBR is headed by the Registrar of Companies who performs all the functions and duties of the Chief Executive Officer as stipulated in the Public Administration Act. He is also vested with the legal and judicial representation. The Deputy Registrar is appointed to aid the Registrar of Companies in the execution of his duties. The MBR organisational structure consists of the Executive Committee, Board of Management and the following Departments: – Registry of Commercial Partnerships – Legal and Enforcement Unit – Compliance Unit – Human Resources and Development Unit – Finance and Administration Unit – Information and Communications Technology Unit – International Affairs, Research and Communications Unit – Office of the Official Receiver Description of the department/directorate/entity’s functions and responsibilities The MBR, established under Subsidiary Legislation 595.27, is a government agency tasked to with all the duties and functions pertaining to the Registrar of commercial partnerships under the Companies Act. This entails the registration of new commercial partnerships and other legal entities, the issuing of certified documentation from the register and the general upkeep and maintenance of the register, ensuring that the information is up to date. The MBR is headed by the Registrar of Companies who is also in charge of the register of beneficial owners of commercial partnerships and of maintaining the register of beneficial owners of legal persons (namely Foundations and Associations) in terms of the Civil Code (Second Schedule) and unregistered associations. In addition to this, the MBR is tasked to carry out all additional duties imposed on the Registrar of Companies in accordance with Article 401 of the Companies Act and all functions of pertaining to the Registrar of Legal Persons in terms of the Civil Code (Second Schedule). General description of the categories of documents the department/directorate/entity holds (including exempt documents) The Agency holds documents falling under the following main categories: 1) Website maintained by the Registrar of Companies on all commercial partnerships registered in Malta including basic information, annual returns and annual accounts, all notifications and publications required by law; 2) All information on the website mentioned in (1) are kept also as hard copy; 3) Supporting documents requested by the Registrar in relation to commercial partnerships; 4) Register on beneficial owners of commercial partnerships; 5) Reports on the findings of MBR representatives during on-site inspections carried out at the offices of CSP’s; 6) Internal policies; 7) Published policies and notices; 8) Memoranda of Understanding and related exchange of information documents 9) Copies of agreements entered into by MBR with third parties; Dossiers related to procurement; 10) Human Resources documents; 11) Staff Self-Development scheme files; 12) Health and Safety documents; 13) Legislation (Local and EU); 14) Project Proposals and Implementation Reports; 15) Submission of EU surveys; 16) Court judgement decrees and notification by courts; 17) Court summons; 18) Statistics; 19) Internal notices and communications issued Note: Some of the information listed above is exempt from disclosure under the Freedom of Information Act (Cap. 496). Description of all manuals and similar types of documents which contain policies, principles, rules or guidelines in accordance with which decisions or recommendations are made in respect of members of the public (including bodies corporate and employees of the public authority in their personal capacity) – Staff Handbook – Standard Operating Procedures – Maltese and EU Legislations – Public Procurement Regulations Note: As regards Documents filed in accordance with the Companies Act, it is notified that these documents are already available for public scrutiny. Statement of the information that needs to be available to members of the public who wish to obtain access to official documents from the public authority, which statement shall include particulars of the officer or officers to whom requests for such access should be sent The FOI officer of the MBR may be contacted by e-mail on foi.mbr@mbr.mt or by telephone 22582300 FOI Requests may be submitted by e-mail to foi.mbr@mbr.mt or through the FOI Portal https://foi.gov.mt/ via the e-ID. Details of Internal Complaints Procedure Applicants may submit a complaint to the Public Authority within a maximum of 30 days from the date of the last relevant communication by the Public Authority. A decision will be provided within 10 working days from the receipt of the complaint. Subsequent and different complaints on the same request can only be submitted to the Public Authority after the first complaint has been answered or following the lapse of 10 working days from the date of submission of the complaint. If applicants remain dissatisfied with the outcome of their complaint, they may appeal the decision through the Information and Data Protection Commissioner (IDPC) within 60 days from the date of the notification by the Public Authority. Should applicants remain dissatisfied with the outcome of this procedure, they may appeal the decision through the Information and Data Protection Appeals Tribunal within 20 working days from the last relevant communication by the IDPC. An appeal from this decision may be registered at the Courts of Appeal within 30 days from the last relevant communication of the Information and Data Protection Appeals Tribunal. Other Information Complaints may be submitted by e-mail to foi.mbr@mbr.mt or through the FOI Portal https://foi.gov.mt/ via the e-ID Working Hours: Monday - Thursday 09.00 - 12.00; 13.00 - 14.30 Emails received during the weekend are replied to on the next working day. MBR Contact Details Address: AM Business Centre, Floor 2, Triq il-Labour, Zejtun, ZTN 2402, Telephone: (+356) 22582300 Generic e-mail address: info.mbr@mbr.mt Website: https://mbr.mt/ Advisory Committee Registrar / CEO Deputy Registrar / COO Registry Unit Compliance Unit Legal & Enforcement Unit Insolvency & Receirvership Service Unit Finanance & Admistration Unit Human Resources & Development Unit Information & Communication Technologies Unit Internation Affairs, Research & Communications Unit Money Laundering Reporting Officer Audit Committee Internal Audit Unit

Use of BAROS Advisory Committee Registrar / CEO Deputy Registrar / COO Registry Unit Compliance Unit Legal & Enforcement Unit Insolvency & Receirvership Service Unit Finanance & Admistration Unit Human Resources & Development Unit Information & Communication Technologies Unit Internation Affairs, Research & Communications Unit Money Laundering Reporting Officer Audit Committee Internal Audit Unit

Foundations & Associations - Legislation A list of legal documents pertaining to the formation, registration, governance and dissolution of a foundation or association. Main Legislation CAP 16 CIVIL CODE (in particular the SECOND SCHEDULE) Subsidiary Legislation S.L. 16.07 CIVIL CODE (Second Schedule) (Fees) Regulations S.L. 16.08 CIVIL CODE (Second Schedule) (Notifications and Forms) Regulations S.L. 16.10 CIVIL CODE (Second Schedule) (Existing Organisations) Regulations S.L. 16.17 CIVIL CODE (Second Schedule)(Register of Beneficial Owners – Associations) S.L. 16.18 CIVIL CODE (Second Schedule)(Register of Beneficial Owners – Foundations) Voluntary Organisation (Annual Return and Annual Accounts) Regulations https://legislation.mt/eli/sl/492.2/20200928/eng Advisory Committee Registrar / CEO Deputy Registrar / COO Registry Unit Compliance Unit Legal & Enforcement Unit Insolvency & Receirvership Service Unit Finanance & Admistration Unit Human Resources & Development Unit Information & Communication Technologies Unit Internation Affairs, Research & Communications Unit Money Laundering Reporting Officer Audit Committee Internal Audit Unit

Privacy Policy INTRODUCTION This Master Privacy Policy (“ Privacy Policy ”) relates to the baros.mbr.mt and/or any website/sub-website and/or associated domains (and/or sub-domains) of mbr.mt hereinafter referred to as the “ Site ”) the services provided by Malta Business Registry the owner of the Site, (“ We ”, “ Us ”, “ Our ”, “ Ourselves ”, and/or “ MBR” ) and any related software applications (‘Apps’), where Personal Data are processed by the same (via the Site, any of Our Apps or otherwise) relating to You. Please note that Our website may be hosted and operated using a third-party website platform/provider (currently Wix.com Ltd. and its affiliated companies (“Wix”)). In addition, when We host events or similar activities for which an online payment is required (and only while event registration is open), We will use a third-party payment service provider (currently Stripe – including Stripe Payments Europe, Limited and/or Stripe, LLC (“Stripe”)) to process online payments. In such cases, certain Personal Data will be processed by Wix and/or Stripe (as further explained in this Privacy Policy) in order for Us to operate the Site, administer event registrations and process payments securely. In this Master Privacy Policy, “ You ”, “ Your ” and “ User ” refer to an identified or identifiable natural person being the User of the Site, and/or recipient (or prospective recipient) of any of Our services and/or identifiable natural person whose information (in his/her personal capacity and not when acting as representative of a legal entity) is stored on Our database(s) and which may or may not be publicly available. Our full details, including contact details, can be read below. Please see the sections “ WHAT ARE PERSONAL DATA ” and “ WHAT ABOUT INFORMATION RELATING TO COMMERCIAL PARTNERSHIPS (INCLUDING COMPANIES) AND OTHER LEGAL ENTITIES?” below. You may be reading this Privacy Policy as a User or visitor of the Site or You may have been directed here by one (or more) of Our condensed privacy policies or Our other notices (digital or otherwise) found in one of Our forms or other similar documents. Although this Privacy Policy provides detailed, layered information on how and why We generally process Personal Data (via the Site, any of Our Apps, or otherwise) as well as detailed information about Your various rights, the specific and tailor-made content of such condensed policies or other notices will, in most cases, provide You with more focused and detailed information on specific processing operations (for example, the specific legal basis for processing certain categories of Personal Data and the specific purpose for doing so depending on the matter at hand). Although at MBR, Our goal is to always be as clear and transparent as possible, We appreciate that legal documents can sometimes be difficult to read. However, We strongly encourage You to read this Privacy Policy (which is layered for Your convenience) with care. Please do not hold back from contacting Us for any clarification You may need. For example, if You need clarification on a specific legal basis, We are relying on to process Your Personal Data for a specific processing operation, We would be happy to provide You with any such information You may need. CONTENTS OF THIS MASTER PRIVACY POLICY Introduction Contents of this Master Privacy Policy Applicable Laws What Are Personal Data? What About Information Relating to Commercial Partnerships (Including Companies) and Other Legal Entities? Personal Data MBR Collects About You How and Why We Collect Personal Data Personal Data Relating to Third Parties What We Use Your Personal Data For (Purpose of Processing) Data Which We Make Publicly Available Accuracy of Personal Data Transfer to Third Countries Internet Communications Authorised DIsclosures Sharing Of Personal Data With Other Categories Of Recipients Security Measures Retention Periods Processing For Research And Statistical Reasons Links to Third Party Sources Cookies Minors Automated Decision-Making Your Rights Under the Data Protection Laws What We May Require From You Time Limit For A Response MBR Details Updates APPLICABLE LAWS The MBR is the controller of personal data in terms of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation – “the GDPR”) and the Data Protection Act (Chapter 586 of the Laws of Malta – “the DPA”). The MBR ensures that personal data are processed in accordance with the GDPR, the DPA and any other relevant European Union (“EU”) and national law. The MBR ensures, inter alia, the confidentiality and security of such personal data. All the above, as may be amended from time to time, referred to together as the “Data Protection Laws” WHAT ARE PERSONAL DATA? The term “ PERSONAL DATA ” means any information that identifies You as an individual or that relates to an identifiable individual. Information relating to legal persons (such as companies) does not amount to Personal Data. For more information on this important distinction, please read the section “ WHAT ABOUT INFORMATION RELATING TO COMMERCIAL PARTNERSHIPS (INCLUDING COMPANIES) AND OTHER LEGAL ENTITIES? ” below. Whenever it is not possible or feasible for Us to make use of anonymous and/or anonymised data (in a manner that does not identify any Users of the Site or recipients of Our services), We are nevertheless committed to protecting Your privacy and the security of Your Personal Data at all times. We collect Personal Data in various ways both digitally via the Site (either when You choose to provide Us with certain data or in some cases, automatically or from third parties) as well as non-digitally (for example when a statutory form is submitted to Us or You fill in a physical form to benefit from one or more of Our services). WHAT ABOUT INFORMATION RELATING TO COMMERCIAL PARTNERSHIPS (INCLUDING COMPANIES) AND OTHER LEGAL ENTITIES ? Information relating to legal persons (having a Juridical Personality) as opposed to natural persons does not amount to personal data. Limited liability companies and other legal entities have a distinct legal personality that is separate from that of their owners or even their directors or administrators. This means that information relating to such legal entities (as opposed to the details of the owners, shareholders or even directors or administrators) will not, in most cases, constitute personal data and falls outside the scope of the GDPR. Having said the above, in all those cases where natural persons (such as company directors, shareholders, partners, administrators, founders, controllers, supervisory council members, protectors and even sole traders inter alia ) are individually identifiable, and where information relates to such individuals in their personal capacity as opposed to them acting as representatives of a legal person , MBR will treat such information as personal data and will afford to such individuals (who would be deemed as data subjects) all the data protection rights listed below, as may be applicable . PERSONAL DATA MBR COLLECTS ABOUT YOU There are various categories of Personal Data that We collect about You, namely: CONTACT DETAILS (WITHOUT NEED FOR REGISTRATION ON THE SITE): Name Email Comments containing any personal data You choose to send us. REGISTRATION DATA: Title First Name Surname Date of birth Residential Address E-mail address Telephone Mobile (optional) Fax Number (optional) Nationality ID/Passport Number Username Password INCORPORATION/DECLARATION DATA: Identification details (ID) which shall include but are not limited to the nationality and country of residence. In line with Article 2(5) of the Companies Act, Chapter 386 (“the Companies Act’’), article 29(1)(e) and article 49(2)(f) of the Second Schedule to the Civil Code (CAP 16) (the “Schedule”)“For the purposes of the above-mentioned legislation, where a document required to be delivered to the Registrar for registration is required to state the name and residence or address of a person, it shall be deemed to require further the official identification, by number or otherwise of such person, as may be applicable. Moreover, Article 401(1)(d) paragraph (i) of the Companies Act and the second proviso to Regulation 7 (1)(c) paragraph (i) of the Companies Act (Register of Beneficial Owners) Regulations ( S.L. 386.19) regulation 4(1)(a) of Civil Code (Second Schedule) (Register of Beneficial Owners – Associations) (S.L. 16.17) and regulation 4(1)(a) of Civil Code (Second Schedule) (Register of Beneficial Owners – Foundations) (S.L. 16.18) further allows for the Registrar to obtain identification details and any other information supported by documents including, certified true copies of ID cards, passports, residence cards and other identification documents in order to verify the identification details being disclosed to the Registry. Nationality Country of Residence Registered Office (only considered personal data if this is the home address of the individual sending Us this information). Contact details of shareholders, directors, company secretaries, and other members of the applicant including as applicable: Name Residential address Email address Nationality Business Occupation Contact details of persons liaising and submitting documents on behalf of applicant (for example, a legal representative) including: Name Email address Police conduct and/or certificate of good standing processed in line with Article 10 of the GDPR and the DPA, as authorised by Maltese company law and anti-money-laundering legislation).) (only in specific circumstances) Bank references (only in specific circumstances) Evidence that the commercial partnership (including companies) and other legal entities can use the address as the registered office (only in specific circumstances) TRACKING DATA: IP address Location Data Location Data FINANCIAL INFORMATION: Bank account details (for example, where required for refunds or for other payment-related administration, where applicable) Billing details (for example, billing address, invoice details, receipt details, and similar payment administration data) Payment transaction details (for example, amount, date/time, payment status, and transaction reference/identifier) For the avoidance of doubt, where online payments are processed through Our payment service provider (currently Stripe), Your full card number and card security code (CVC/CVV) are processed directly by Stripe (and/or relevant financial institutions/payment method providers) and are not stored by MBR. EVENT / TRAINING INFORMATION (WHERE APPLICABLE): Event registration details Attendance information Communications relating to an event CPE/CPD ACCREDITATION DATA (where applicable): the minimum attendee information required to verify attendance and to issue/record CPE/CPD accreditation Please note that the online payment functionality will only be made available when an event is approaching and registrations are open; once the event ends (or registration closes), the online payment functionality will be switched off. ADDITIONAL INFORMATION: In some cases, (for example, if You are a recipient [or prospective recipient] of Our services, via the Site, any App or otherwise – even if the service in question is merely information You request from Us), We may request additional Personal Data as a means of securely identifying You or for another similar lawful purpose (which will be explained in the table below and/or in a condensed policy/notice that may have directed You here). The additional information We may request from You to be able to provide You with Our services includes: More secure identification methods Credentials/references Details of Your next of kin Certain special categories of data (sensitive Personal Data) such as health conditions/status/details or trade union membership (only where necessary and with the necessary safeguards in place) in terms of Article 9 (2) of the GDPR Your police conduct and/or certificate of good standing which We may require for the incorporation of legal entities in certain cases, and which We process, primarily for verification purposes in line with Article 10 of the GDPR and the DPA, as authorised by Maltese company law and anti-money-laundering legislation.. Many of the categories of Personal Data above are collected directly from You (for example, Your Contact Details and Your Registration Data). However, WE MAY ALSO COLLECT PERSONAL DATA FROM OTHER SOURCES , including authorised members (e.g. directors, administrators or company secretaries) of the company or other legal entities You may be associated with, third party data companies, publicly accessible databases, social media platforms, other Government agencies and Government bodies (both local as well as foreign bodies within the EU) and other third parties. We may also receive Personal Data about You from third parties when We need to confirm Your Contact Details or even certain Financial Information. Should this be the case, We will take all measures as required by law to further inform You about the source of such Personal Data as well as the categories of Personal Data We collect and process (unless We are satisfied that You already have that information). There are certain instances at law where We are specifically forbidden from disclosing to You such activity (for example, when carrying out due diligence for anti-money laundering purposes). For a detailed description of the reasons why We process the categories of Personal Data above (and any other specific Personal Data We process) as well as the corresponding legal ground(s) for doing so please see the ‘What We Use Your Personal Data For (Purpose of Processing)’ below . For information/ Personal Data that We may collect automatically via the Site, please see the Cookies section below . HOW AND WHY WE COLLECT PERSONAL DATA As a general rule, We do not collect any Personal Data, that is, information that identifies You as an individual other than that which You choose to provide to Us such as the data (including Contact Details and Registration Data) You provide when contacting Us via Our Site (where registration is not required) or registering with the said Site (where this is available), when registering a company or other entity with MBR (if this applies to You as an identifiable natural person), when filing documents with Us on behalf of any legal entity (if this applies to You as an identifiable natural person) when otherwise contacting Us with enquiries relating to Our services, when subscribing to any service offered by Us or via Our Site, such as any newsletters as may be issued by Us from time to time (see Personal Data We Collect About You above). Unless otherwise specified and subject to various controls, as a general rule, we only collect Personal Data (from You or elsewhere) that we: need to be able to provide You with the services/information You request from Us. are legally required to collect/use and to keep for a predetermined period of time. believe to be necessary for the performance of a task carried out in the public interest and believe it to be necessary for the performance of a task carried out in the exercise of official authority vested in Us (as a Government agency). For a detailed description of the reasons why We process specific categories of Personal Data as well as the corresponding legal ground(s) for doing so, please see the ‘ What We Use Your Personal Data For (Purpose of Processing) ’ below . PERSONAL DATA RELATING TO THIRD PARTIES By providing Us with or allowing Us to access Personal Data relating to individuals other than Yourself (such as when You list other involved persons pertaining to company registration or registration of other legal entities with MBR), You are letting Us know that You have the authority to send Us those Personal Data or the authority to permit Us to access those data in the manner described in this Privacy Policy. WHAT WE USE YOUR PERSONAL DATA FOR (PURPOSE OF PROCESSING) The following is a description (in a clear and plain manner) of what We use Your Personal Data for and the corresponding legal ground(s) We rely on for doing so. For more detail on what is meant by terms such as ‘ Contact Details’ , ‘ Registration Data’ and other categories of Personal Data used in the tables below, please see the section above relating to Personal Data We Collect About You . Please note that in the rare instances (if any) where We rely on your consent, this can always be withdrawn at will . GENERAL PROCESSING OPERATIONS PROSPECTIVE RECIPIENTS / USERS OF THE SITE / NEW RECIPIENTS OF OUR SERVICES: PURPOSE OF THE PROCESSING CATEGORIES OF PERSONAL DATA LEGAL BASIS FOR PROCESSING Evaluating application(s)/requests You send Us to use/receive any of Our services) Registration Data Contact Details Financial Information Other Communication Data Incorporation/Declaration Data References Contractual Necessity Official Authority Public Interest Legal Obligations Set up a record on our systems Registration Data Contact Details Financial Information Incorporation/Declaration Data Other Communication Data Contractual Necessity Legal Obligations To manage our relationship with You Registration Data Contact Details Financial Information Incorporation/Declaration Data Other Communication Data Transaction and Usage data Contractual necessity Compliance with the legal obligations To carry out mandatory verification in compliance with applicable laws (anti- money laundering and combatting the financing of terrorism legislation) Registration Data Contact Details Financial Information Incorporation/Declaration Data Identification and verification data Background Checks Compliance with our legal obligations To establish and investigate any suspicious behaviour in order to protect Our systems from any risk and fraud Registration Data Contact Details Identification and Verification Data Log in Data Tracking Data Compliance with the legal obligations To keep an accurate and up to date legal entities database (open to the public) Contact Details (in addition to the specific details of the legal entity that require updating) Incorporation/Declaration Data Compliance with the legal obligations To monitor our premises via CCTV for security purposes, when not exercising any of Our official tasks CCTV footage (deleted after 7 days) Legitimate Interests To ask visitors to enter their name and surname when entering Our premises Login details (deleted after 7 days) Legitimate Interests Legal Obligations To administer event/training registrations and attendance (including related communications), where applicable Registration Data. Contact Details. Other Communication Data. Event / Training Information. Financial Information (only where an event payment is required). Transaction and Usage data (where applicable) Contractual necessity (where applicable); Official Authority / Public Interest (where applicable); Compliance with legal obligations (where applicable) To verify attendance and to issue/record CPE/CPD accreditation (where applicable), including sharing the minimum necessary attendee information with the relevant professional accreditation body Contact Details. Event / Training Information. Other Communication Data. Registration Data (where applicable) Contractual necessity (where applicable); Official Authority / Public Interest (where applicable); Compliance with legal obligations (where applicable) ONGOING RECIPIENTS OF OUR SERVICES: PURPOSE OF THE PROCESSING CATEGORIES OF PERSONAL DATA LEGAL BASIS FOR PROCESSING To be able to continue providing You with (some or all of) Our services Registration Data Contact Details Financial Information Other Communication Data Incorporation/Declaration Data Contractual Necessity Official Authority Public Interest Legal Obligations Maintain records on our systems Registration Data Contact Details Financial Information Incorporation/Declaration Data Other Communication Data Contractual Necessity Legal Obligations Continue to manage Our relationship with you Registration Data Contact Details Financial Information Incorporation/Declaration Data Other Communication Data Transaction and Usage data Contractual necessity Compliance with the legal obligations To pass on certain information to public authorities (including the Malta Financial Services Authority and National Statistics Office) & compile internal statistics and reports Registration Data Incorporation/Declaration Data Contact Details Legal Obligation Public Interest Further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes (within the limits permitted by law). To process and manage payments transactions (where applicable) Financial Information Registration Data Contact details (where applicable) Contractual necessity To help you with your specific concerns/requests, including any requests/applications relating to any entity Registration Contact Details Incorporation/Declaration Data Financial Information (depending on request) Contractual Necessity Official Authority Public Interest Legal Obligations To administer event/training registrations and attendance (including related communications), where applicable Registration Data. Contact Details. Other Communication Data. Event / Training Information. Financial Information (only where an event payment is required). Transaction and Usage data (where applicable) Contractual necessity (where applicable); Official Authority / Public Interest (where applicable); Compliance with legal obligations (where applicable) To verify attendance and to issue/record CPE/CPD accreditation (where applicable), including sharing the minimum necessary attendee information with the relevant professional accreditation body Contact Details. Event / Training Information. Other Communication Data. Registration Data (where applicable) Contractual necessity (where applicable). Official Authority / Public Interest (where applicable). Compliance with legal obligations (where applicable) OTHER SPECIFIC PROCESSING OPERATIONS: Register of Companies and Register of Legal Persons: PURPOSE OF THE PROCESSING CATEGORIES OF PERSONAL DATA LEGAL BASIS FOR PROCESSING Evaluating any request to register any commercial partnership (including companies) and other legal entities and to be able to keep an accurate database of such (including their members) in line with Our obligations at law (Cap 386 and Subsidiary Legislation 386.18 and CAP 16 and S.L. 16.17 & S.L. 16.18) Incorporation/Declaration Data Contact details of shareholders, directors, company secretaries and/or other involved parties Police conduct and/or certificate of good standing Compliance with the legal obligations Contractual Necessity Official Authority Public Interest Register of Beneficial Owners: PURPOSE OF THE PROCESSING CATEGORIES OF PERSONAL DATA LEGAL BASIS FOR PROCESSING To be able to keep an accurate database of beneficial owners of legal entities in line with Our obligations at law (S.L 386.19, S.L 16.17 and S.L 16.18) Name Date of Birth Nationality/Nationalities Country of Residence Incorporation/Declaration Data ID Number / Passport Beneficial Interest/Role Compliance with legal obligations (S.L. 386.19, S.L 16.17 and S.L 16.18) Official Authority Public Interest Disclosures Re Commercial Partnerships (including Companies) and other Legal Entities. To disclose relevant details of the beneficial owners of commercial partnerships (including companies) and other legal entities to persons requesting the same (where permitted or required and subject to applicable restrictions). For persons listed in S.L. 386.19 (7) (1) and regulation 10 of S.L. 16.17 & S.L. 16.18 to the following categories. (a) competent authorities in terms of the above mentioned regulation including but not limited to the Malta FIAU, national tax authorities, etc. that request information about the beneficial owners of commercial partnerships (including companies) and other legal entities: Personal Data shall be disclosed by Us without any restriction and without alerting the legal entity/ies concerned. (b ) subject persons/obliged entities: For this category, Personal Data may be disclosed by Us provided that the request We receive must relate to purposes of carrying out due diligence for the prevention, detection and combating of money laundering or the associated predicate offences or the financing of terrorism. (c ) general public : Provided they have a Legitimate Interest as explained in the below Legitimate Interest section. Compliance with Legal Obligations (S.L. 386.19 (7)) and regulation 10(9) of S.L. 16.17 & S.L. 16.18 – Provided that the registrar may refuse access to subject persons/obliged entities and the general public (as stipulated as outlined in terms of the above mentioned regulations), in full or in part, where in exceptional circumstances to be justified by means of documentary evidence and to be determined on a case by case basis, access to such beneficial ownership information would expose the beneficial owner to the risk of fraud, kidnapping, blackmail, violence or intimidation, or where the beneficial owner is a minor or otherwise incapable. Should We need to process Your data for a new purpose in the future, which is entirely unrelated to the above, We will inform You of such processing in advance and You may exercise Your applicable rights (as explained below) in relation to such processing. Finally, do note that without certain Personal Data relating to You, We may not be in the position to provide some or all of the services You expect from Us , as well as commercial partnerships (including companies)and other legal entities registration/incorporation and requests for information from Us) or even to guarantee the full functionality of Our Site. Legitimate Interest : Commercial Partnerships (including companies) The MBR shall grant access to the Register of Beneficial Owners (“RBO”) upon the demonstration of legitimate interest in the prevention and combating of money laundering, its predicate offences, or the financing of terrorism in terms of regulation 7 (1) (c) of the Companies Act ( Register of Beneficial Owners) Regulations ( S.L.386.19). Such requests for access based on Legitimate Interest would have to be made to the MBR via email on accesstobo@mbr.mt , along with the filing of a Request Form and a Declaration. These would have to be further accompanied by supporting documentation (including, but not limited to, identification documents). Such identification documents shall not be made publicly available and are required for the purpose of making an assessment on the veracity of the individual filing the request for access to beneficial ownership information. MBR shall not retain identification documentation once the necessary data is collected but it shall retain your data in accordance with the retention period for Personal Data mentioned below. The terms of this Privacy Policy shall mutatis mutandis apply to You unless it is otherwise deemed inconsistent. In gaining such access, the persons claiming Legitimate Interest and, therefore, gaining access to the RBO, would be confirming also that they are assuming the role of a data controller under the applicable laws and regulations relating to data protection as in force in Malta. Foundations and Associations In respect of S.L 16.17 and S.L 16.18, a similar process is undertaken where persons or organisations forming part of the general public, provided that they have a legitimate interest, are granted BO information as requested on satisfactory compliance with the above mentioned respective subsidiary legislations. The requests are sent via email on foundations.associations@mbr.mt , along with the filing of the supporting documentation, including but not limited to identification documents. Such identification documents shall not be made publicly available and are required for the purpose of making an assessment on the veracity of the individual filing the request for access to beneficial ownership information. MBR shall retain your data in accordance with the retention period for Personal Data mentioned below. The terms of this Privacy Policy shall mutatis mutandis apply to You unless it is otherwise deemed inconsistent. All persons entitled to access and receive information in terms of S.L. 16.17 and S.L. 16.18 are duty bound to comply with the applicable laws and regulations relating to data protection as in force in Malta. DATA WHICH WE MAKE PUBLICLY AVAILABLE: MBR is required by Article 401 (1) (d) of the Companies Act () and article 31C of the Second Schedule to the Civil Code, as well as by the Companies Act (System of Interconnection of Registers) Regulations (S.L 386.18 ) and regulation 14 of S.L. 16.17 & S.L. 16.18 to make certain information, which You may provide to Us inter alia for the purposes of commercial partnerships (including companies) and other legal entities incorporation, including any Personal Data, where applicable, (such as those pertaining to the name and address of the directors and other relevant persons of the legal entity) relating thereto, publicly available. Thus, whenever MBR makes such information public it relies on its legal obligation to do so as a legal basis for processing Personal Data. The Personal Data that We make public in relation to all commercial partnerships (including companies) and other legal entities registered with Us includes the following: A list of shareholders, directors, company secretaries and other persons vested with administration including such details as: Name Residential address Nationality Business occupation In the case of foundations and associations, information on beneficial owners is not made publicly searchable or openly available to the general public. Access to information held in the Register of Beneficial Owners is granted only to the categories of persons and under the conditions set out in the applicable regulations. Any access granted to subject persons/ onbliged entities or to members of the public is provided on a case-by-case basis following a written request and submission of the required documentation, and is limited to the specific foundation/association and the relevant beneficial owner(s). Only competent authorities as stated in regulation 10 of S.L. 16.17 & 16.18 have access without restriction to the information on the beneficial owners of the organisations. When a commercial partnership (including companies) and other legal entities is struck off the register, such data shall no longer be available to the public. Please note that although such Personal Data will no longer be available to the public, MBR will still retain such information, and this according to Our retention policy. For more background information, please read the sections WHAT ARE PERSONAL DATA and WHAT ABOUT INFORMATION RELATING TO COMMERCIAL PARTNERSHIPS (INCLUDING COMPANIES) AND LEGAL ENTITIES? Above. Please see the table above regarding the Register of Beneficial Owners for more information regarding the rules for how We may disclose information regarding ultimate beneficial owners of companies, foundations and associations and how, in certain instances, We are obliged to do so. ACCURACY OF PERSONAL DATA All reasonable efforts are made to keep any Personal Data We may hold about You up-to- date and as accurate as possible. You can check the information that We hold about You at any time by contacting Us in the manner explained below . If You find any inaccuracies, We will correct them and where required and in accordance with the law (provided that the law permits such deletion), delete them as necessary. Please see below for a detailed list of Your legal rights in terms of any applicable data protection law. TRANSFERS TO THIRD COUNTRIES As a general rule, the data We process about You (collected via the Site, any of our Apps or otherwise) will be stored and processed within the European Union (EU)/European Economic Area (EEA) or any other non-EEA country deemed by the European Commission to offer an adequate level of protection (the so-called ‘white-listed’ countries listed here: https://ec.europa.eu/info/law/law-topic/data-protection_en . In some cases, it may be necessary for Us to transfer Your Personal Data to a non-EEA country not considered by the European Commission to offer an adequate level of protection (for example to one or more of Our data processors located there). In such cases, apart from all appropriate safeguards that We implement, in any case, to protect Your Personal Data, We have put in place additional adequate measures. For example, We have ensured that the recipient is bound by the EU Standard Contractual Clauses (the EU Model Clauses) designed to protect Your Personal Data as though it were an intra-EEA transfer. You are entitled to obtain a copy of these measures by contacting Us as explained below. INTERNET COMMUNICATIONS You will be aware that data sent via the Internet may be transmitted across international borders even where sender and receiver of information are located in the same country. We cannot be held responsible for anything done or omitted to be done by You or any third party in connection with any Personal Data prior to Our receiving it including but not limited to any transfers of Personal Data from You to Us via a country having a lower level of data protection than that in place in the European Union, and this, by any technological means whatsoever (for example, WhatsApp, Dropbox, etc.) Moreover, We shall accept no responsibility or liability whatsoever for the security of Your data while in transit through the Internet unless Our responsibility results explicitly from a law having effect in Malta . AUTHORISED DISCLOSURE Without prejudice to anything contained in this Privacy Policy and in the interest of full transparency, We reserve the right to disclose (and otherwise process) any relevant Personal Data relating to You which We may be processing (including in certain cases relevant IP addresses) to authorised third parties in or outside the EU/EEA if such disclosures are allowed under the Data Protection Laws (whether or not You have provided Your consent) including but not limited to: For the purpose of preventing, detecting or suppressing fraud (for example, if You provide false or deceptive information about Yourself or attempt to pose as someone else, We may disclose any information We may have about You in Our possession so as to assist any type of investigation into Your actions); In the event of MBR being involved in a restructure, transfer or absorption into another Government department (or similar event analogously applicable to Government agencies); To protect and defend Our rights (including the right to property), safety, or those of Our affiliates, of Users of Our Site, of Our members or even Your own; To protect against abuse, misuse or unauthorised use of Our Site; For any purpose that may be necessary for the performance of any agreement You may have entered into with Us (including the request for provision of services by third parties) or in order to take steps at Your request prior to entering into a contract; To comply with any legal obligations such as may arise by way of response to any Court subpoena or order or similar official request for Personal Data; or As may otherwise be specifically allowed or required by or under any applicable law, for example, under anti-money laundering legislation or as part of MBR’s obligation to make certain information available to the public through the system of interconnection of EU Business registers at: https://e-justice.europa.eu/topics/registers-business-insolvency-land_en?language=en (S.L 386.18 S.L. 16.17 and S.L. 16.18) SHARING OF PERSONAL DATA WITH OTHER CATEGORIES OF RECIPIENTS Relevant data will also be disclosed or shared as appropriate (and in all cases in line with the Data Protection Laws) to/with staff/employees and/or officials of MBR, and/or to/with entities within the Maltese Central Government and/or to/with other Government agencies, departments, or similar entities (including such entities of other EU Member States) and/or other entities considered as competent authorities in terms of PMLFTR including but not limited to the Financial Intelligence Analysis Unit, the Malta Police Force, the Malta Financial Services Authority, Asset Recovery Bureau and also entities such as credit reference agencies and/or sub-contractors established within the European Union if pertinent to any of the purposes listed in this Privacy Policy (including to/with Our service providers who facilitate the functionality of the Site and/or any service You may require). Personal information will only be shared by Us to provide the services You request from Us or for any other lawful reason (including authorised disclosures not requiring Your consent) such as Our legal obligation to make available electronic copies of the documents which We are required to retain and register in terms of the Companies Act and S.L. 16.17 and S.L. 16.18 and through the system of interconnection of EU Business Registers at: https://e-justice.europa.eu/topics/registers-business-insolvency-land_en?language=en . Any such authorised disclosures will be done in accordance with the Data Protection laws (for example all Our processors are contractually bound by the requirements in the said Data Protection Laws, including a strict obligation to keep any information they receive confidential and to ensure that their employees/personnel are also bound by similar obligations). The said service providers (Our processors) are also bound by a number of other obligations (in particular, Article 28 of the GDPR). In certain cases, the recipients of Your Personal Data with whom We share Personal Data will not be acting on Our behalf but will be acting in their own capacity as entities/data controllers separate and independent from Us (e.g. Government agencies, Malta Financial Services Authority, Financial Intelligence Analysis Unit etc.). We are not responsible for whatever these entities may do with Your Personal Data and encourage You to read through their respective privacy policies to find out more about how they handle Your Personal Data. YOUR PERSONAL DATA WILL NEVER BE SHARED WITH THIRD PARTIES FOR THEIR MARKETING PURPOSES. The third parties who We may disclose to and/or share Your Personal Data with are, at the date of this Privacy Policy, the following: Category of Recipient Purpose of Processing Cloud Service Providers Hosting of data under state-of-the-art security protocols and our exclusive control IT Service Providers Maintenance and support of our IT systems/Website(s) – with restricted access and under our strict controls` Auditors Compliance with our auditing obligations – with access granted only to essential Personal Data Legal Advisors Compliance with our legal obligations or when necessary for the establishment, exercise or defence of legal claims. Other EU Member State Business Registers under the Business Registers Interconnection System (Directive 2017/1132/EU) and Regulation 2015/884) Compliance with Our legal obligations Other Government agencies, departments or entities (including the Malta Financial Services Authority and the National Statistics Office) Credit Reference Agencies (e.g. Malta Association of Credit Management or CreditInfo, The Malta Police Force) Compliance with legal obligations, in the public interest and/or Our exercise of official authority as necessary in the public interest Website platform / hosting provider Wix.com Ltd. (and its affiliated companies), which processes data of visitors/Users of the Site on Our behalf in order to provide and operate the website and related services. Payment service provider Stripe (including Stripe Payments Europe, Limited and/or Stripe, LLC, and their affiliates/sub-processors) for the processing of online payments and related payment operations. Professional accreditation bodies (CPE/CPD) (where applicable) Where an event is accredited for CPE/CPD purposes, We may share the minimum necessary attendee information with the relevant professional accreditation body solely to verify attendance and facilitate the issuance/recording of accreditation. Such bodies will process that information as separate controllers in accordance with their own privacy notices. SECURITY MEASURES The personal information which We may hold (and/or transfer to any affiliates/partners/subcontractors as the case may be) will be held securely in accordance with Our internal security policy and the law. We use reasonable efforts to safeguard the confidentiality of any and/or all Personal Data that We may process relating to You and regularly review and enhance Our technical, physical and managerial procedures so as to ensure that Your Personal Data is protected from: Unauthorised access Improper use of disclosure Unauthorised modification Unlawful destruction or accidental loss To this end We have implemented security policies, rules and technical and organisational measures to protect the Personal Data that We may have under Our control. All Our members, staff and data processors (including specific subcontractors, such as cloud service providers established within the European Union), who may have access to and are associated with the processing of Personal Data, are further obliged (under contract) to respect the confidentiality of Our Users’ or recipients’ Personal Data as well as other obligations as imposed by the Data Protection Laws. Despite all the above, We cannot guarantee that a data transmission or a storage system can ever be 100% secure. For more information about Our security measures please contact Us in the manner described below . Authorised third parties, and external/third party service providers acting as Our data processors, with permitted access to Your information (as explained in this Privacy Policy) are specifically required to apply appropriate technical and organisational security measures that may be necessary to safeguard the Personal Data being processed from unauthorised or accidental disclosure, loss or destruction and from any unlawful forms of processing. As stated above, the said service providers (Our data processors) are also bound by a number of other obligations in line with the Data Protection Laws (particularly, Article 28 of the GDPR). RETENTION PERIODS We will retain Your Personal Data only for as long as is necessary (taking into consideration the purpose for which they were originally obtained). The criteria We use to determine what is ‘necessary’ depends on the particular Personal Data in question and the specific relationship We have with You (including its duration). Our normal practice is to determine whether there is/are any specific EU and/or Maltese law(s) permitting or even obliging Us to keep certain Personal Data for a certain period of time (in which case We will keep the Personal Data for the maximum period indicated by any such law). For example, S.L 386.19, S.L. 16.17 and S.L. 16.18 obliges Us to retain Personal Data relating to beneficial owners until the lapse of five (5) years after the name of the concerned commercial partnership (including companies) and other legal entities has been struck off the register and in the case of a private foundation for ten (10) years. Incorporation/Declaration Data (as defined above will be kept for as long as the legal entity is active. Once the legal entity is struck off, only minimal information will be kept publicly accessible and this, in line with the principle of data minimisation. We would also have to determine whether there are any laws and/or contractual provisions that may be invoked against Us by You and/or third parties and if so, what the prescriptive periods for such actions are. In this case, We will keep any relevant Personal Data that We may need to defend Ourselves against any claim(s), challenge(s) or other such action(s) by You and/or third parties for such time as is necessary. Where Your Personal Data are no longer required by Us (in line with all applicable laws), We will either securely delete or anonymise the Personal Data in question. Please note that certain laws oblige Us to disclose some Personal Data to other Government entities (for example, the Malta Financial Services Authority and National Statistics Office) or to other EU Member State Central Registries as part of the Central Registers Interconnection System in which case, such entities (as separate controllers) would then determine their own retention policies (which in such cases may be much longer than those described above). PROCESSING FOR RESEARCH AND STATISTICAL REASONS Research and statistics using User or recipient information is only carried out so that We may understand Our Users’ and/or recipients’ needs, to develop and improve Our services/activities and/or for tasks carried out in the public interest or under the exercise of official authority representative of MBR’s purpose. In any case, where applicable, We will always ensure to obtain any consent We may legally require from You beforehand. As in all other cases, We will also ensure to implement all appropriate safeguards as may be necessary. LINKS TO THIRD PARTY SOURCES Links that We provide to third-party sources (such as websites) are clearly marked and We are not in any way whatsoever responsible for (nor can We be deemed to endorse in any way) the content of such sources (including any applicable privacy policies or data processing operations of any kind). We suggest that You should read the privacy policies of any such third-party sources (including the websites and respective policies or data processing operations of any kind). COOKIES When You visit Our Site, We collect certain categories of Personal Data automatically using cookies and similar technologies. For more detailed information including what cookies are and how and why We process such data in this manner (including the difference between essential and non-essential cookies) please read Our detailed but easy-to-read Cookie Policy . MINORS The Site and Our online services (entering into contracts with MBR) are not intended to be used by any persons under the age of eighteen (18) and therefore We will never intentionally collect any Personal Data from such persons unless under a specific legal exemption. If You are under the age of consent, please consult and get Your parent’s or legal guardian’s permission to use the Site and to use Our services. We shall consider that any Personal Data of persons under the age of eighteen (18) received by Us, shall be sent with the proper authority and that the sender can demonstrate such authority at any time, upon Our request. Provided that persons who have attained the age of sixteen (16) are eligible to be appointed as administrators of voluntary organisations enrolled with the office of voluntary organisations in terms of article 16B(3) of the Voluntary Organisations Act (CAP 492) and hence, are not required to submit authorisation. With respect to Personal Data of minors that We process as part of Our legal obligations (for example, where a minor or minors appear as shareholder(s) and/or ultimate beneficial owner(s)), such Personal Data will be processed by Us with additional layers of protection as required by law. For example, when members of the public enquire about the beneficial owner of a commercial partnerships (including companies) or other legal entities, should this owner be a minor, We are not obliged to disclose the said information save as otherwise stated above. On the contrary We will examine the facts of the case very carefully before making any disclosure (in whole or in part) and in any case, the general principles of the GDPR will be adhered to at all times. AUTOMATED DECISION-MAKING We do not rely on any decisions taken solely by automated means (in other words, without significant human intervention) – including any profiling. Should this position change in the future (and only as We may be legally permitted to do), You will be notified accordingly. YOUR RIGHTS UNDER THE DATA PROTECTION LAWS Before addressing any request you make with Us, We may first need to verify Your identity. In all cases We will try to act on Your requests as soon as reasonably possible. As explained in the Retention Periods section above, We may need to keep certain Personal Data for compliance with Our legal retention obligations but also to complete transactions that You requested prior to the change or deletion that You requested. Your various rights at law include: Your Right of Access : [RG1] You may, at any time request Us to confirm whether or not We are processing Personal Data that concerns You and, if We are, You shall have the right to access that Personal Data and to the following information: What Personal Data We have, Why We Process Them, Who We disclose them to, How long We intend on keeping them for (where possible), Whether We transfer them abroad and the safeguards We take to Protect them, What Your Rights are, How You can make a complaint, Where We got Your Personal Data from, Whether We have carried out any automated decision-making (including profiling) as well as related information. Upon request, We shall (without adversely affecting the rights and freedoms of others including Our own) provide You with a copy of the Personal Data undergoing processing within one month of receipt of the request, which period may be extended by two months where necessary, taking into account the complexity and number of the requests. We shall inform You of any such extension within one month of receipt of the request, together with the reasons for the delay. Your Right to Rectification : You have the right to ask Us to rectify inaccurate Personal Data and to complete incomplete Personal Data concerning You. We may seek to verify the accuracy of the data before rectifying it. Your Right to Erasure (The Right to be Forgotten) : You have the right to ask Us to delete Your Personal Data and We shall comply without undue delay but only where: The Personal Data are no longer necessary for the purposes for which they were collected; or You have withdrawn Your consent (in those rare instances where We process on the basis of Your consent) and We have no other legal ground to process Your Personal Data; or You shall have successfully exercised Your right to object (as explained below); or Your Personal Data has been processed unlawfully; or There exists a legal obligation to which We are subject; or Special circumstances exist in connection with certain children’s rights. In any case, We shall not be legally bound to comply with Your erasure request if the processing of Your Personal Data is necessary: for compliance with a legal obligation to which We are subject (including but not limited to Our duty to retain an accurate database of commercial partnerships (including companies) and other legal entities records and Our data retention obligations); for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in so far as Your exercise of this right to erasure is likely to render impossible or seriously impair the achievement of the objectives of such processing; for the establishment, exercise or defence of legal claims. There are other legal grounds entitling Us to refuse erasure requests although the three instances above are the most likely grounds that may be invoked by Us to deny such requests. Your Right to Data Restriction : You have the right to inform Us to restrict (that is, store but not further process) Your Personal Data but only where: The accuracy of Your Personal Data is contested (see the right to data rectification above), for a period enabling Us to verify the accuracy of the Personal Data; or The processing is unlawful, and You oppose the erasure of Your Personal Data; or We no longer need the Personal Data for the purposes for which they were collected but You need the Personal Data for the establishment, exercise or defence of legal claims; or You exercised Your right to object and verification of Our legitimate grounds to override Your objection is pending. Following Your request for restriction, except for storing Your Personal Data, We may only process Your Personal Data: Where We have Your consent (if any exists); or For the establishment, exercise or defence of legal claims; or For the protection of the rights of another natural or legal person; or For reasons of important public interest. Your Right to Data Portability: You have the right to ask Us to provide Your Personal Data (that You shall have provided to Us) to You in a structured, commonly used, machine-readable format, or (where technically feasible) to have it ‘ported’ directly to another data controller, provided this does not adversely affect the rights and freedoms of others. This right shall apply in relation to where: the legal basis is consent or contract and the processing is carried out by automated means . (Portability is separate from the rights below. It does not apply to all processing—only the above scenarios.) Your Right to Withdraw Consent (when We rely on consent) In the rare instances where We may have relied on Your consent to process Your Personal Data (which, in any case, We would have obtained in the manner required by the GDPR), You may withdraw any such consent at any time in a manner that is as easy as when You first provided the said consent to Us. Your Right to Object to Certain Processing In those cases where We only process Your Personal Data when this is; 1.) necessary for the performance of a task carried out in the public interest or in the exercise of Our official authority, OR 2.) when processing is necessary for the purposes of the legitimate interests pursued by a third party, You shall have the right to object to processing of Your Personal Data by Us. Where an objection is entered, the processing of data shall cease, unless We as data controller provide compelling and legitimate grounds requiring the continuation of the data processing which outweigh the objections You may have raised. For the avoidance of all doubt, when We process Your Personal Data when this is necessary for the performance of a contract, when necessary for compliance with a legal obligation to which We are subject or when processing is necessary to protect Your vital interests or those of another natural person, this general right to object shall not subsist. Your Right to Lodge a Complaint You also have the right to lodge complaints with the appropriate Data Protection Supervisory Authority. The competent authority in Malta is the Office of the Information and Data Protection Commissioner ‘’IDPC’’) . We kindly ask that You please attempt to resolve any issues You may have with Us first even though, as stated above, you have a right to contact the competent authority at any time. WHAT WE MAY REQUIRE FROM YOU As one of the security measures We implement, before being in the position to help You exercise Your rights as described above, We may need to verify Your identity to ensure that We do not disclose to or share any Personal Data with any unauthorized individuals. TIME LIMIT FOR A RESPONSE We try to reply to all legitimate requests within one month from receiving them. In some particular cases (for example, if the matter is particularly complex or if You send Us multiple requests), it may take Us longer than a month. In such cases, We will notify You accordingly and keep You updated. MBR DETAILS The Malta Business Registry is a Government Agency registered in Malta whose address is Malta Business Registry, AM Business Centre, Triq il-Labour, Zejtun ZTN 2405, Malta and is the data controller responsible for processing Your Personal Data that takes place via the Site or in the manner explained above (or in one of Our condensed privacy policies or notices that directed you here). If you have any questions/ comments about privacy or should you wish to exercise any of your individual rights, please contact Us at: info.mbr.@ mbr.mt or by writing to Malta Business Registry, AM Business Centre, Triq il-Labour, Zejtun ZTN 2405 or by phoning Us using telephone number (+356) 2258 2300 (during normal office hours Monday – Thursday: 09:00 – 12:00 & 13:00 – 14:30 and Friday: 09:00-13:00) or by contacting Our Data Protection Officer directly at dpo.mbr@mbr.mt UPDATES We reserve the right, at Our complete discretion, to change, modify, add and/or remove portions of this Privacy Policy at any time. If you are an existing natural person with whom We have a contractual relationship you shall be informed by Us of any changes made to this Privacy Policy (as well as other terms and conditions relevant to the Site). We shall also archive and store previous versions of the Privacy Policy for Your review. As a User of the Site with which We have no contractual relationship or even a lawful way of tracing, it is in your interest to regularly check for any updates to this Privacy Policy (which are usually deemed to be effective on the date they are published on the Site), in the event that Our attempts to notify you of of such updates do not reach you. Advisory Committee Registrar / CEO Deputy Registrar / COO Registry Unit Compliance Unit Legal & Enforcement Unit Insolvency & Receirvership Service Unit Finanance & Admistration Unit Human Resources & Development Unit Information & Communication Technologies Unit Internation Affairs, Research & Communications Unit Money Laundering Reporting Officer Audit Committee Internal Audit Unit