Prepared by the Head of Operations (DPO) with the reviewer’s support on 9 February 2027 for the MD and COO meeting on 12 February 2027.

1. Summary for the MD

• At 31 January 2027, eight review areas were Green, three were Amber and none were Red. The Amber areas were consent (G-02), retention (G-08) and transfers (G-09).
• Of the 15 actions in C2, eight were Closed, one was In progress, four were Open and two were Overdue. The overdue items were retention decisions for RS-02, RS-12 and RS-13 (DA-08) and the DV-01 addendum (DA-10).
• Eight requests or complaints were received. Seven were closed and responded to within Quillmarrow’s response target in B7; one remained Open and within target at 31 January. One acknowledgement was late.
• There was one incident in the quarter, INC-2026-11. The MD and DPO recorded a separate decision that it was not notifiable. No PDPC notification was made.
• Ten policy or procedure changes were recorded. The January refresher was attended by 71 of 79 invited staff; the HR Manager owns catch-up for the eight absentees under DA-15.
• Five decisions are needed at the meeting: the three outstanding retention positions; the DV-01 addendum deadline and interim arrangement; the older showroom sign-ups; the conditional DV-04 pilot; and B11 v1.1.

The RAG and tracker figures in this report are a snapshot at 31 January. The decisions recorded after the meeting are shown separately in section 6 and do not change that snapshot.

2. RAG view by area

The ratings show progress against the B2 action plan. Green means the planned actions for that area are done and evidenced; it is not a statement that Quillmarrow is compliant. The handover view is from B2 at 30 October 2026. The current view is at 31 January 2027. Owners below identify the relevant role for follow-up; detailed action owners are in C2.

Late or revised items: The showroom consent method was due on 13 November 2026; the date was revised to 4 December, and it went live on 2 December. The remaining notices were due on 13 November, revised by the COO to 11 December, and completed on 9 December. ShopCloud admin MFA was completed on 19 November, after its 13 November target. The Harbour IT access review was completed on 22 January 2027 against a revised date of 31 January agreed by the COO.

3. Trends this quarter

Actions

DA-03 is awaiting a decision; the other three Open items were on track at the snapshot date. DA-08 was due on 31 January and placed on the 12 February agenda. DA-10 missed its revised 31 January target and was escalated to the COO.

Requests and complaints

AR-13 reached a sales shared mailbox on 5 January and was acknowledged on 12 January, five working days later, against a three-working-day target. Shared mailboxes now forward request-like emails to the DPO. AR-14 was due on 19 February 2027; no outcome after 31 January is recorded here. C3 holds the request-level detail.

Incidents, changes and training

For INC-2026-11, the recipient confirmed deletion on 10 December. The DPO completed the assessment on 11 December, and the MD and DPO recorded the decision separately that afternoon. The Sales Manager told the customer as a courtesy. DA-12, concerning the Finance team’s external-recipient warning and delayed send, closed on 13 January.

The C7 scenario was simulated and never happened. The exercise identified the need for a calendar-day reminder, ShopCloud’s incident contact and a deputy decision-maker, as well as clearer separation of assessment and decision.

4. Open risks

The ratings below reflect the relevant area’s 31 January RAG where one is assigned. They are not separate legal or technical risk scores.

5. Decisions needed

The recommendations below are for management’s consideration at the meeting; they do not replace the decisions recorded in section 6. Legal points should be confirmed with a Singapore-qualified lawyer, and accounting or tax retention matters with Quillmarrow’s accountant or lawyer.

1. Retention positions — DA-08.
   Options: Approve the accountant’s and lawyer’s positions for RS-02, RS-12 and RS-13, or seek clarification before approving them.
   DPO recommendation: Approve the positions if the MD is satisfied that the advice resolves the outstanding questions, then update B8. The actual periods are not reproduced in this report.
   Decision: MD, with the DPO and Finance Director supporting.

2. DV-01 addendum — DA-10.
   Options: If the addendum remains unsigned on 28 February, continue under interim minimisation with a further deadline; or minimise the Malaysia fulfilment data further and examine alternatives.
   DPO recommendation: Set a firm further deadline, retain the interim minimisation and ask the COO to bring alternatives if it is missed. Since 7 December 2026, customer email addresses have not been sent to DV-01; the shared data is limited to name, delivery address, phone and order lines.
   Decision: MD, with the COO responsible for follow-up.

3. Older showroom sign-ups — DA-03.
   Options: Delete the approximately 600 older sign-ups, or consider a single re-permission message after lawyer advice. They have been suppressed from all marketing since 16 December 2026.
   DPO recommendation: Delete the records rather than send a re-permission message, subject to the lawyer’s advice and any other retention question. Keep suppression in place until deletion.
   Decision: MD with the DPO.

4. DV-04 pilot — DA-13.
   Options: Approve the planned 1 March pilot subject to completion of all conditions, or defer it until the conditions are confirmed.
   DPO recommendation: Proceed only if the missing evidence is received, the lawyer’s contract points are agreed, AI reply suggestions remain off, access is limited to ticket and order-lookup roles, and B9 and B3 are updated. The DPO should confirm the conditions before the pilot starts. C4 contains the review.
   Decision: MD at this meeting. The DPO’s conditional decision of 18 January and COO approval of 20 January remain subject to DA-13.

5. B11 v1.1 — DA-14.
   Options: Approve the revised plan with the COO as deputy decision-maker, ShopCloud’s incident contact and a calendar-day reminder; or return it for revision.
   DPO recommendation: Approve the revision, while retaining separate assessment and decision records.
   Decision: MD.

6. Decisions recorded on 12 February 2027

Added after the meeting by the DPO

These are decisions, not evidence that the associated clean-up, addendum or pilot conditions have been completed. C2 should continue to show the relevant follow-up.

7. Next quarter: February to April 2027

• B8 and clean-ups: update B8 to v1.2 by 28 February following the MD’s decision. Continue DA-09: RS-04 disposal was recorded on 25 January; RS-10 visitor-log clean-up is due by 28 February.
• DV-01: maintain interim minimisation and pursue the addendum to the MD’s 31 March deadline. The COO will bring alternatives after that date.
• Older showroom sign-ups: retain marketing suppression and carry out the MD’s deletion decision by 31 March. Do not send a re-permission message.
• DV-04: the Head of Customer Service owns DA-13, due 28 February. The DPO must confirm the conditions before the planned 1 March start. If the pilot starts, conduct the planned check after 30 days.
• Staff refresher: the HR Manager follows up the eight absentees’ recorded session and check by 26 February under DA-15.
• Planning: plan the policy annual review and prepare for the next breach drill in July 2027.

The monthly check-in for January was held on 5 February 2027. The following check-ins are planned for 5 March and 2 April 2027.

8. Sign-off

Report owner: Head of Operations (DPO), who approved it for issue on 9 February 2027

Received by: Managing Director and COO, 12 February 2027

Decisions made by: Managing Director, 12 February 2027, recorded by the DPO in section 6

Prepared with support from: the reviewer, who is not Quillmarrow's DPO