CG ONCOLOGY, INC.
2024 EMPLOYEE STOCK PURCHASE PLAN
SUB-PLAN FOR
INTERNATIONAL PARTICIPANTS
1. APPLICATION
This Sub-Plan for Participants in non-U.S. jurisdictions in the CG Oncology, Inc. Employee Stock Purchase Plan (this “Sub-Plan”) sets forth additional terms and conditions applicable to the rights granted to, and the shares of Common Stock purchased by, Participants in the countries set forth below.
The Plan and this Sub-Plan are complimentary to each other and shall be deemed as one. In any case of contradiction between the provisions of this Sub-Plan and the Plan, the provisions set out in the Sub-Plan shall prevail. Any capitalized terms used in this Sub-Plan but not defined shall have the meaning given to those terms in the Plan.
2. GLOBAL PROVISIONS
(a) Data Protection. It shall be a term and condition for participation in the Plan that a Participant explicitly and unambiguously consent to the collection, use and transfer, in electronic or other form, of a Participant’s personal “Data” (as defined below) by and among, as applicable, the Company, any Parent or Subsidiary and a Participant’s employing entity (the “Employer”), if different, and their affiliates (collectively, the “Company Group”) for the exclusive purpose of implementing, administering and managing the Participant’s participation in the Plan. The Company Group holds certain personal information about the Participant, including, but not limited to, the Participant’s name, home address and telephone number, e-mail address, date of birth, employee identification number, NRIC or passport number or equivalent, salary, nationality, job title, any shares of stock or directorships held in the Company, details of all options or any other entitlement to shares of stock awarded, canceled, exercised, vested, unvested or outstanding in the Participant’s favor, for the purpose of implementing, administering and managing the Plan (“Data”). Data will be transferred to such stock plan service providers, as may be prudently selected by the Company, which are assisting the Company with the implementation, administration and management of the Plan. The recipients of the Data may be located in the United States of America or elsewhere (and, if the Participant is a resident of a member state of the European Union, may be outside the European Economic Area) and that the recipient’s country (e.g., the United States of America) may have different data privacy laws and protections than the Participant’s country. The Participant may request a list with the names and addresses of all recipients of the Data by contacting his or her local human resources representative. Each Participant hereby authorizes the Company Group and any other possible recipients which may assist the Company (presently or in the future) with implementing, administering and managing the Plan to receive, possess, use, retain and transfer the Data, in electronic or other form, for the purposes of implementing, administering and managing the Participant’s participation in the Plan. Data will be held only as long as is necessary to implement, administer and manage the Participant’s participation in the Plan. The Company will also make the Data available to public authorities where required under locally applicable law. A Participant may, at any time, view Data, request additional information about the storage and processing of Data, require any necessary amendments to Data or refuse or withdraw the consents herein, in any case, without cost, by contacting in writing the Participant’s local human resources representative. A Participant’s refusal to provide consent or withdrawal of consent may affect the Participant’s ability to participate in the Plan. This section applies to information held, used or disclosed in any medium.
If Participant resides in the UK or the European Union, the Company Group will hold, collect and otherwise process certain Data as set out in the applicable Company’s GDPR-compliant data privacy
17