Corporate Standards

Who we are

Carraway & Willow Editorials is operated by FunnelVoyage Sdn. Bhd. (Company No. 202301032343). Registered office: B-5-8, Plaza Mont Kiara, Kuala Lumpur, 50480, Malaysia.

The operator named above is a company incorporated in Malaysia as a private limited company (Sdn. Bhd.), and these Standards apply to it including in its trade as Carraway & Willow Editorials.

Purpose, status and scope

These Corporate Standards (“Standards”) establish the general framework applicable to the conduct, governance, management, employment, business relationships, operations, assets and activities of the operator named above and, where applicable, its subsidiaries, affiliates, representatives and other persons acting on its behalf (collectively, the “Company” or “Carraway & Willow”).

These Standards are intended to provide a general, globally applicable framework rather than a jurisdiction-specific statement of every legal or regulatory requirement applicable to the Company or any particular person, transaction, activity, workplace or relationship.

The Standards apply, to the extent applicable to the relevant relationship or activity, to:

• directors and officers;
• employees;
• temporary and contingent workers;
• interns and trainees;
• contractors and consultants;
• agents and representatives;
• suppliers and vendors;
• manufacturers;
• distributors;
• logistics providers;
• professional advisers;
• service providers;
• business partners; and
• other persons or entities whose activities are subject to contractual, organisational or operational requirements imposed by the Company.

Different provisions may apply differently depending upon the person’s role, contractual relationship, location, activity and applicable law.

Nothing in these Standards is intended to create, and these Standards do not by themselves create, an employment contract, partnership, agency relationship, fiduciary relationship, guarantee, warranty, representation, entitlement, or other contractual right or obligation except to the extent expressly incorporated into an applicable agreement or required by applicable law.

Where a separate agreement, employment arrangement, supplier agreement, statement of work, policy, procedure, instruction, statutory requirement or other legally enforceable instrument applies to a particular matter, the applicable instrument will govern according to its terms and applicable law.

Applicable law and jurisdictional override

These Standards are designed for use across multiple jurisdictions and are intended to operate on an applicable-law basis.

The Company may conduct business, employ personnel, engage suppliers, provide services, sell products, maintain operations or otherwise become subject to laws and regulatory requirements in jurisdictions other than Malaysia.

Nothing in these Standards is intended to exclude, limit, waive, replace or override any mandatory or non-waivable requirement of applicable law.

Where the law of a jurisdiction applicable to the Company, an individual, an entity, an employment relationship, a supplier relationship, an activity, product, service, transaction or other matter imposes requirements, rights, protections, procedures, remedies or restrictions that differ from, supplement or exceed these Standards, those requirements will apply to the extent legally required.

Where applicable law permits contractual or organisational variation, the Company may determine the applicable standard through the relevant agreement, policy, procedure or operational requirement.

No statement in these Standards should be interpreted as an undertaking by the Company to comply with laws that are not applicable to the relevant activity or jurisdiction.

The Company reserves the right to determine, based on applicable law and the circumstances of the relevant matter, which requirements, procedures and standards apply.

Relationship to other Company documents

These Standards form part of a broader legal and governance framework.

The Company’s:

• Privacy Policy addresses information, personal data, privacy, confidentiality and processing matters;
• Terms & Conditions address external-facing products, services, transactions, users, customers, intellectual property, marketing, claims and other commercial relationships; and
• Corporate Standards address internal conduct, governance, people, labour, business relationships, operational conduct and organisational standards.

Where a matter involves more than one category, the applicable documents should be read together.

The Privacy Policy governs the processing of personal information and personal data. These Standards govern conduct concerning that information.

The Terms & Conditions govern external commercial dealings. These Standards govern the Company’s internal conduct and the conduct expected of persons acting for or in business relationships with the Company.

General standard of conduct

Persons subject to these Standards are expected to comply with applicable law and with requirements expressly applicable to their role or relationship with the Company.

Subject to applicable law, Company policy and the relevant relationship, the Company may establish additional procedures, controls, approvals, restrictions or requirements from time to time.

Nothing in these Standards constitutes a guarantee that every individual, supplier, contractor, representative or other person will comply with them at all times.

The Company may use reasonable processes to establish, communicate, monitor, investigate or enforce applicable requirements, but does not represent that every instance of conduct, activity, non-compliance, misconduct, error, omission or violation will be identified or prevented.

General authority and responsibility

Business functions may use approved corporate systems, tools, materials, information and communication channels for legitimate business activities within their assigned responsibilities and applicable authority.

Each function remains responsible for its activities within the scope of its role, delegated authority, applicable contractual obligations and corporate requirements. The existence of general disclaimers, privacy notices or other legal documentation does not independently authorise conduct prohibited by applicable law or override mandatory legal obligations.

The Legal Department’s publication of standard terms, notices and disclaimers does not constitute individual verification or approval of every statement, representation, processing activity or business decision undertaken by another function.

Human rights and fundamental workplace requirements

The Company operates subject to applicable laws concerning human rights, employment, labour and workplace conduct.

Where applicable to the relevant activity, the Company prohibits or restricts conduct involving:

• forced labour;
• slavery;
• human trafficking;
• child labour;
• unlawful discrimination;
• unlawful harassment;
• retaliation;
• violence;
• threats or intimidation; and
• other conduct prohibited by applicable law.

The Company may establish additional requirements concerning workplace dignity, conduct, equality, inclusion, accommodation, freedom of association, collective bargaining, working conditions and related matters where appropriate to the relevant jurisdiction and relationship.

Nothing in these Standards is intended to establish a uniform global employment entitlement where the relevant entitlement is determined by local law or contract.

Mandatory local employment and labour requirements prevail where applicable.

Employment and labour

Employment and labour matters may include:

• recruitment;
• employment eligibility;
• working arrangements;
• compensation;
• working hours;
• overtime;
• leave;
• benefits;
• payroll;
• workplace records;
• performance;
• discipline;
• workplace monitoring;
• termination;
• minimum-age requirements;
• workplace accommodation;
• freedom of association;
• collective bargaining; and
• grievance mechanisms.

The applicable requirements may differ by jurisdiction, employment arrangement, role and contract.

Nothing in these Standards is intended to replace an applicable employment agreement, collective agreement, statutory employment requirement or other mandatory employment instrument.

Workplace conduct

Persons subject to these Standards must not engage in conduct prohibited by applicable law or applicable Company requirements, including, where applicable:

• harassment;
• bullying;
• unlawful discrimination;
• sexual harassment;
• retaliation;
• threats;
• violence;
• intimidation;
• abusive conduct;
• improper interference with another person’s work; or
• other materially inappropriate conduct.

The Company may establish reporting, investigation, disciplinary and remedial procedures appropriate to the relevant circumstances.

Health, safety and security

The Company may establish requirements relating to:

• occupational health and safety;
• physical safety;
• workplace hazards;
• emergency preparedness;
• incident reporting;
• personal protective equipment;
• ergonomic safety;
• travel;
• remote working;
• contractor safety;
• premises security;
• physical access;
• product and service safety; and
• emergency response.

Applicable statutory health, safety and workplace requirements prevail where mandatory.

Persons subject to these Standards are expected to follow applicable safety instructions and report material safety or security incidents through available channels.

Anti-bribery and anti-corruption

The Company prohibits bribery and corruption to the extent prohibited by applicable law and Company requirements.

Subject to applicable law, persons acting for or on behalf of the Company must not offer, promise, authorise, provide, solicit or accept improper benefits intended to influence a decision, obtain an improper advantage or otherwise improperly affect a business or governmental activity.

Relevant matters may include:

• government officials;
• agents;
• intermediaries;
• procurement;
• tenders;
• facilitation payments;
• kickbacks;
• gifts;
• hospitality;
• sponsorships;
• charitable contributions;
• political contributions;
• commissions;
• rebates;
• conflicts of interest; and
• third-party arrangements.

Additional approval, screening, recordkeeping or due-diligence requirements may apply.

Conflicts of interest

Persons subject to these Standards should disclose actual, potential or reasonably apparent conflicts of interest where required by applicable law, contract or Company procedure.

Relevant conflicts may include:

• personal financial interests;
• family relationships;
• outside employment;
• investments;
• supplier relationships;
• customer relationships;
• related-party transactions;
• external directorships;
• gifts or hospitality; and
• circumstances capable of affecting objective business judgment.

The Company may require a conflict to be disclosed, managed, mitigated, restricted or resolved.

Gifts, entertainment and hospitality

Gifts, entertainment, hospitality and other benefits involving Company personnel or representatives may be subject to applicable law and Company requirements.

Particular restrictions may apply to:

• government officials;
• procurement processes;
• tenders;
• regulated activities;
• customers;
• suppliers;
• intermediaries; and
• persons capable of influencing a business decision.

Cash or cash-equivalent benefits may be prohibited except where expressly permitted.

No gift, hospitality or benefit may be used for an improper purpose.

Competition and antitrust

The Company conducts its activities subject to applicable competition and antitrust laws.

Persons acting for the Company must not knowingly participate in unlawful arrangements involving, where prohibited:

• price fixing;
• bid rigging;
• market allocation;
• customer allocation;
• unlawful exchange of competitively sensitive information;
• collusion;
• unlawful restrictions on competition; or
• abuse of a dominant position.

Competition requirements may differ by jurisdiction and activity.

Sanctions, export controls and trade restrictions

The Company may be subject to sanctions, export controls, import restrictions, embargoes, restricted-party requirements and other trade controls.

Relevant activities may include:

• screening;
• restricted parties;
• restricted territories;
• controlled goods;
• controlled technologies;
• software;
• encryption;
• technical information;
• dual-use items;
• end-user checks;
• end-use restrictions;
• licensing;
• escalation; and
• recordkeeping.

Where legally required, the Company may refuse, suspend, restrict or terminate a transaction, relationship or activity.

Financial crime and anti-money laundering

The Company may establish controls appropriate to the activities and risks of the business concerning financial crime.

Relevant matters may include:

• suspicious transactions;
• beneficial ownership;
• unusual payment arrangements;
• third-party payments;
• shell entities;
• sanctions evasion;
• fraud;
• financial misrepresentation; and
• terrorist financing where applicable.

Nothing in these Standards represents that the Company is a regulated financial institution unless the Company is in fact subject to such regulation.

Fraud, dishonesty and misconduct

The Company prohibits conduct that is unlawful or materially dishonest in connection with Company activities.

Examples may include:

• falsification of records;
• expense fraud;
• accounting fraud;
• procurement fraud;
• invoice manipulation;
• identity fraud;
• unauthorised transactions;
• misappropriation;
• misuse of Company property; and
• intentional concealment of material misconduct.

The Company may investigate suspected misconduct and take action permitted by applicable law.

Financial integrity and records

Company records should be maintained in accordance with applicable law, contractual requirements and Company procedures.

Relevant records may include:

• accounting records;
• financial statements;
• invoices;
• receipts;
• expense claims;
• tax records;
• contracts;
• procurement records;
• approvals;
• audit materials;
• regulatory records; and
• other business records.

Records must not knowingly be falsified, concealed or improperly destroyed.

Applicable retention periods, legal holds and regulatory requirements prevail.

Confidentiality and trade secrets

Persons with access to Company confidential information are expected to protect that information in accordance with applicable agreements, law and Company requirements.

Confidential information may include:

• business plans;
• pricing;
• customer information;
• supplier information;
• source code;
• product plans;
• technical information;
• credentials;
• commercial strategies;
• financial information;
• trade secrets; and
• other non-public information.

Personal data and personal information are additionally governed by the Privacy Policy and applicable data-protection law.

Cybersecurity and information security

Persons using Company systems, devices, accounts or information must comply with applicable security requirements.

Relevant controls may concern:

• credentials;
• authentication;
• access permissions;
• devices;
• software;
• cloud services;
• remote access;
• phishing;
• malware;
• unauthorised software;
• data exfiltration;
• security testing;
• incident reporting;
• shadow IT;
• removable media; and
• external services.

Security controls may vary according to risk, system, jurisdiction and role.

Actual security cannot be guaranteed to be absolute or uninterrupted.

Artificial intelligence and automated systems

The use of artificial intelligence and automated systems may be subject to additional requirements.

Where applicable, Company controls may address:

• approved AI systems;
• prohibited uses;
• confidential information;
• personal data;
• intellectual property;
• model inputs;
• model outputs;
• hallucinations and unreliable outputs;
• verification;
• human oversight;
• bias;
• high-impact decisions;
• automated decision-making;
• model security;
• prompt injection;
• external AI tools;
• AI-generated materials;
• disclosure and transparency;
• recordkeeping; and
• applicable regulatory requirements.

AI-generated or AI-assisted material should not be treated as inherently accurate, complete, legally compliant or suitable for a particular purpose without appropriate review where such review is required.

No person should use an AI system in a manner that breaches applicable law, confidentiality obligations, intellectual-property rights, privacy requirements, security requirements or other applicable restrictions.

Intellectual property

The Company and persons acting for it must respect applicable intellectual-property rights.

This may include:

• copyright;
• trademarks;
• patents;
• designs;
• trade secrets;
• software;
• databases;
• domain names;
• photographs;
• video;
• audio;
• text;
• graphics;
• datasets; and
• AI-generated or AI-assisted materials.

Persons acting for the Company must use Company-owned, licensed and third-party materials in accordance with applicable rights and permissions.

Ownership and assignment of intellectual property are determined by applicable law and the relevant contractual arrangements.

Responsible sourcing and suppliers

The Company may impose requirements on suppliers, vendors, manufacturers, distributors, contractors and other business partners concerning:

• compliance with law;
• labour practices;
• human rights;
• forced labour;
• child labour;
• environmental matters;
• health and safety;
• privacy;
• cybersecurity;
• intellectual property;
• anti-bribery;
• sanctions;
• export controls;
• product quality;
• subcontracting;
• traceability; and
• audit or cooperation requirements.

The applicable requirements may be incorporated into contracts, purchase orders, supplier terms, statements of work or other instruments.

Environmental matters

The Company may establish operational requirements concerning environmental matters relevant to its activities.

These may include:

• pollution;
• waste;
• recycling;
• resource efficiency;
• energy;
• water;
• emissions;
• climate-related risks;
• biodiversity;
• hazardous substances;
• packaging; and
• responsible sourcing.

The Company does not represent that every activity, product, service, supplier or business relationship satisfies every environmental standard or framework in every jurisdiction.

Applicable statutory requirements prevail.

Environmental and sustainability claims

Claims concerning environmental or sustainability characteristics must be made only where permitted by applicable law and supported by whatever substantiation is required for the relevant claim.

Relevant claims may include:

• sustainable;
• green;
• environmentally friendly;
• carbon neutral;
• net zero;
• recycled;
• renewable;
• ethical sourcing; and
• similar claims.

Marketing, sales and communications personnel remain responsible for following applicable Company approval processes and applicable law.

Nothing in these Standards constitutes a representation that any particular environmental claim will be lawful or appropriate in every jurisdiction.

Product and service quality

Where applicable, the Company may maintain processes concerning:

• quality;
• testing;
• safety;
• regulatory compliance;
• complaints;
• incident reporting;
• recalls;
• corrective actions; and
• product or service improvement.

The existence of such processes does not constitute a guarantee that every product, service, deliverable or business activity will be free from defects, errors, omissions or regulatory issues.

Mandatory product and service requirements applicable to a particular jurisdiction or activity remain controlling.

Customer and counterparty treatment

Persons acting for the Company must comply with applicable law and applicable Company requirements concerning dealings with customers and other external parties.

Such requirements may address:

• communications;
• pricing;
• product information;
• service information;
• complaints;
• marketing;
• representations;
• customer information;
• refunds;
• safety; and
• other commercial matters.

The Company’s external contractual rights and obligations are principally addressed through the Terms & Conditions and other applicable commercial agreements.

Marketing, sales and communications

Marketing and sales activities must comply with applicable law and Company requirements applicable to the relevant activity.

Relevant matters may include:

• advertising;
• representations;
• performance claims;
• comparative claims;
• testimonials;
• endorsements;
• reviews;
• influencer activity;
• discounts;
• promotions;
• scarcity claims;
• environmental claims;
• health-related claims;
• financial claims;
• AI-related claims; and
• scientific claims.

Nothing in these Standards constitutes a blanket approval of any marketing, sales or advertising statement.

Personnel responsible for communications remain responsible for following applicable approval, substantiation and legal requirements.

Data and privacy

Personal data and personal information must be handled in accordance with:

1. applicable law;
2. the Company’s Privacy Policy;
3. applicable contracts; and
4. applicable security and operational requirements.

Relevant obligations, to the extent they arise under applicable law or contract, may include:

• data minimisation;
• appropriate access;
• confidentiality;
• security;
• retention;
• incident reporting;
• lawful processing;
• rights handling;
• approved service providers; and
• cross-border transfer requirements.

The Privacy Policy governs the Company’s information-processing framework.

Workplace monitoring

The Company may use monitoring or security measures where permitted by applicable law and appropriate to the relevant purpose.

These may include:

• CCTV;
• access logs;
• device monitoring;
• communications monitoring;
• system logging;
• security monitoring;
• location information;
• productivity tools; and
• other operational or security controls.

Any monitoring remains subject to applicable privacy, employment, labour and other mandatory requirements.

Political activity and government relations

Personal political activity is generally separate from Company activity.

Company political activity, lobbying, government relations, political expenditure and interactions with government officials may be subject to applicable law and Company approval requirements.

No person may represent personal political views as authorised Company positions without appropriate authority.

Charitable contributions and sponsorships

Company donations, sponsorships and charitable contributions may be subject to applicable law, internal approval and due diligence.

They must not be used to disguise:

• bribery;
• improper influence;
• political contributions;
• conflicts of interest; or
• other prohibited benefits.

Public statements and representation of the Company

Only persons authorised under applicable Company procedures may make official statements on behalf of the Company.

This may include communications with:

• media;
• customers;
• suppliers;
• regulators;
• government authorities;
• investors;
• business partners; and
• the general public.

Unauthorised persons must not represent themselves as speaking for the Company.

Social media

Persons using social media remain responsible for complying with applicable law, confidentiality obligations and applicable Company requirements.

Persons must not knowingly:

• disclose confidential Company information;
• disclose protected personal information;
• impersonate the Company or another person;
• make unauthorised Company representations;
• engage in unlawful harassment;
• misrepresent authority; or
• otherwise use Company identity or resources without authorisation.

Nothing in this section is intended to restrict lawful personal activity or legally protected conduct.

Whistleblowing and reporting

The Company may maintain reporting channels for concerns involving suspected:

• unlawful conduct;
• fraud;
• corruption;
• harassment;
• discrimination;
• safety concerns;
• security incidents;
• privacy incidents;
• financial misconduct;
• conflicts of interest;
• supplier misconduct; or
• other material violations.

Where required or permitted by law, reporting mechanisms may allow confidential or anonymous reporting.

The Company may prohibit retaliation against persons making reports in good faith where required by applicable law or Company requirements.

Nothing in these Standards prevents a person from making a report to a competent authority where permitted or required by law.

Investigations

The Company may investigate suspected violations of law, contractual requirements, these Standards or applicable Company procedures.

Investigations may involve:

• document preservation;
• interviews;
• system review;
• access to relevant records;
• external advisers;
• legal counsel;
• regulatory engagement; and
• other lawful investigative measures.

Persons subject to an investigation may be required to cooperate to the extent permitted or required by applicable law.

Legal privilege, confidentiality, privacy and other applicable protections remain subject to the laws governing the relevant matter.

Discipline and remediation

Where permitted by applicable law and relevant contractual arrangements, the Company may respond to violations through measures including:

• coaching;
• additional training;
• warnings;
• corrective action;
• access restrictions;
• suspension;
• termination of employment or engagement;
• supplier remediation;
• supplier suspension;
• termination of a business relationship; or
• legal action.

The appropriate response depends on the circumstances, applicable law, contractual arrangements and the nature of the conduct.

Nothing in these Standards creates a guaranteed disciplinary sequence.

Supplier and business-partner requirements

Suppliers, vendors, contractors, agents, distributors, manufacturers, consultants, resellers and other business partners may be required, according to their relationship with the Company, to comply with applicable requirements concerning:

• law;
• labour;
• human rights;
• anti-bribery;
• environmental matters;
• privacy;
• cybersecurity;
• intellectual property;
• sanctions;
• export controls;
• health and safety;
• quality;
• records;
• audit;
• cooperation; and
• subcontracting.

The Company may incorporate these requirements into applicable contracts or other binding arrangements.

Third-party due diligence

The Company may conduct risk-based due diligence concerning:

• suppliers;
• agents;
• distributors;
• contractors;
• consultants;
• resellers;
• intermediaries;
• strategic partners; and
• other relevant counterparties.

The extent of due diligence may vary according to the relevant risk, jurisdiction, activity, relationship and applicable law.

The Company does not represent that every third party will be independently investigated to the same degree.

Company assets

Company assets may include:

• money;
• premises;
• equipment;
• devices;
• software;
• accounts;
• credentials;
• intellectual property;
• data;
• digital assets;
• physical assets;
• vehicles; and
• other property.

Persons entrusted with Company assets must use and protect them in accordance with applicable requirements.

Unauthorised appropriation, access, transfer, destruction or misuse may result in corrective or legal action where permitted by law.

Use of Company resources

Company resources may include:

• internet access;
• email;
• devices;
• software;
• cloud services;
• AI systems;
• vehicles;
• premises;
• expense accounts;
• accounts and credentials; and
• other technology or operational resources.

Use may be subject to security, privacy, acceptable-use and monitoring requirements.

The Company may restrict, suspend or withdraw access where permitted by law and appropriate to the relevant risk.

Physical security and access

The Company may implement controls concerning:

• premises;
• badges;
• keys;
• devices;
• visitors;
• access credentials;
• physical security;
• restricted areas; and
• incident reporting.

Persons must follow applicable access and security procedures.

Business continuity

The Company may maintain business-continuity and recovery arrangements concerning:

• disasters;
• cyber incidents;
• supply disruption;
• critical suppliers;
• pandemics;
• physical emergencies;
• technology failures; and
• other operational disruptions.

The existence of continuity arrangements does not constitute a guarantee of uninterrupted operations or recovery within any particular period.

Regulatory and legal cooperation

The Company may cooperate with lawful:

• audits;
• inspections;
• regulatory inquiries;
• investigations;
• court proceedings;
• governmental requests; and
• other lawful processes.

Responses will be determined according to applicable law, the relevant circumstances and applicable legal rights and obligations.

Tax and fiscal compliance

The Company maintains records and conducts activities subject to applicable tax and fiscal requirements.

Relevant matters may include:

• accounting records;
• invoices;
• tax records;
• reporting;
• applicable registrations;
• lawful tax compliance; and
• cooperation with professional advisers and authorities.

Nothing in these Standards constitutes tax advice or a representation concerning the tax treatment of any person or transaction.

Lobbying and public policy

Where applicable, lobbying and government-relations activities must comply with applicable law and Company authorisation requirements.

Relevant matters may include:

• government officials;
• public policy;
• lobbying;
• political expenditure;
• transparency;
• conflicts of interest; and
• disclosure requirements.

Human rights and environmental due diligence

Where applicable to the Company’s activities, the Company may use risk-based processes concerning:

• identification of relevant risks;
• impact assessment;
• prevention;
• mitigation;
• remediation;
• monitoring;
• supplier engagement; and
• reporting.

The extent of such processes may depend on applicable law, business activity, supply chain, jurisdiction and risk.

Accessibility and inclusion

The Company may establish accessibility and inclusion practices appropriate to its activities.

These may include:

• reasonable accommodation;
• accessible workplaces;
• inclusive design;
• disability inclusion; and
• non-discrimination.

Mandatory accessibility and employment requirements applicable in a particular jurisdiction prevail.

Complaints and remediation

The Company may maintain mechanisms through which relevant persons may raise concerns concerning Company activities or relationships.

Depending on the matter, these mechanisms may be available to:

• employees;
• contractors;
• suppliers;
• business partners;
• affected communities; and
• other relevant persons.

Available remedies, investigation procedures and escalation mechanisms depend upon the nature of the matter and applicable law.

Records, retention and legal holds

Company records may be retained for periods determined by:

• applicable law;
• contractual obligations;
• accounting requirements;
• tax requirements;
• limitation periods;
• security requirements;
• operational requirements;
• investigations;
• disputes; and
• legal holds.

Records subject to a legal hold or preservation requirement must not knowingly be destroyed or altered contrary to that requirement.

Training, acknowledgement and implementation

The Company may provide training, guidance, procedures or acknowledgements concerning these Standards.

The extent and frequency of training may vary according to:

• role;
• jurisdiction;
• risk;
• legal requirements;
• business activity; and
• organisational requirements.

Training or acknowledgement does not by itself establish that every person has understood, followed or complied with every provision.

Exceptions and additional requirements

The Company may establish additional requirements, procedures or controls for particular:

• jurisdictions;
• departments;
• activities;
• products;
• services;
• suppliers;
• roles;
• risks; or
• regulatory requirements.

Where an exception to an internal requirement is permitted, it must be approved through the applicable Company process.

No exception may authorise conduct prohibited by mandatory applicable law.

Enforcement

The Company may interpret, administer, amend, implement and enforce these Standards through appropriate internal or contractual mechanisms.

The Company may:

• issue supplementary procedures;
• require acknowledgements;
• conduct audits;
• conduct investigations;
• impose controls;
• restrict access;
• require remediation;
• suspend relationships; and
• take other action permitted by applicable law or contract.

Nothing in these Standards guarantees that the Company will take action in every circumstance or against every person.

No third-party guarantee or warranty

Except to the extent required by applicable law or expressly provided in a binding agreement, these Standards do not constitute:

• a guarantee of Company conduct;
• a guarantee of supplier conduct;
• a warranty of compliance;
• a representation that all activities satisfy every legal regime;
• a representation that all risks have been identified;
• a representation that all misconduct will be detected;
• a representation that every reported concern will result in a particular outcome; or
• a commitment to a particular remedy, investigation or enforcement action.

These Standards describe the Company’s general governance framework and are not intended to create rights beyond those arising under applicable law or an expressly applicable agreement.

No waiver of mandatory rights

Nothing in these Standards is intended to waive, exclude, restrict or contract out of any right, protection, remedy, obligation or requirement that cannot lawfully be waived, excluded or restricted.

Where a provision of these Standards is unenforceable in a particular jurisdiction, that provision will apply only to the extent permitted by applicable law, without necessarily affecting the remaining provisions.

Governing framework

These Standards are issued by the operator named at the start of this document, a company incorporated in Malaysia.

To the extent legally permissible, the Company’s internal administration of these Standards is governed by the laws applicable to the Company’s corporate organisation and operations in Malaysia.

This statement does not purport to displace mandatory laws applicable to employment, labour, suppliers, business activities, regulated conduct, transactions, persons or operations in other jurisdictions.

Where another jurisdiction’s mandatory law applies, that law will apply to the extent legally required.

Where a dispute arises, the governing law, jurisdiction and available remedies will be determined in accordance with any valid applicable contractual provisions and the laws applicable to the relevant circumstances.

Amendments and version control

The Company may revise, replace, supplement or update these Standards from time to time.

Updates may be made to reflect:

• changes in law;
• changes in Company activities;
• changes in organisational structure;
• changes in risk;
• changes in technology;
• changes in suppliers;
• regulatory developments; or
• changes in internal governance requirements.

The current version published or otherwise designated by the Company supersedes previous versions for purposes of the Company’s general governance framework, subject to applicable contractual and legal requirements.

Severability

If any provision of these Standards is determined to be invalid, unlawful or unenforceable in a particular jurisdiction, that provision will be interpreted or limited to the minimum extent necessary to permit its operation where legally possible.

The remaining provisions will continue to apply to the extent permitted by applicable law.

Interpretation

Headings are provided for convenience and do not determine the meaning or scope of any provision.

References to laws, regulations, standards, requirements or regulatory concepts include amendments, replacements and successor provisions where applicable.

References to “including” or similar expressions are illustrative and not exhaustive unless expressly stated otherwise.

Where a provision is stated to apply “where applicable,” its applicability depends upon the relevant law, activity, jurisdiction, relationship, contract and circumstances.

Contact

Questions or formal notices concerning these Corporate Standards may be directed to the Company at support@carrawayandwillow.xyz, or in writing to the registered office stated at the start of this document.

The Company may designate different contact channels for employment, supplier, whistleblowing, privacy, security, legal or regulatory matters.

Final provision

These Standards are intended to provide a single, globally reusable corporate governance framework without purporting to replace the laws, regulations, contracts, employment arrangements, regulatory instruments or jurisdiction-specific requirements that may apply to particular persons, activities or circumstances.

The Company therefore operates these Standards together with the principle that mandatory applicable law controls wherever it cannot lawfully be displaced.

Except for such mandatory requirements and obligations expressly assumed under an applicable binding agreement, these Standards should not be interpreted as creating additional guarantees, warranties, representations, entitlements or commitments beyond their stated purpose.