Common use of Personal Data Subject to Processing Clause in Contracts

Personal Data Subject to Processing. The Company collects, processes and uses the following types of personal data about the Participant: The Participant’s name, home address, email address, date of birth, social insurance, passport number or other identification number, any shares of stock or directorships held in the Company, details of all RSUs or any other entitlement to Shares awarded, canceled, settled, vested, unvested or outstanding in the Participant’s favor, which the Company receives from the Participant or the Employer (“Personal Data”). Stock Plan Administration Service Providers. The Company transfers Personal Data to Fidelity Stock Plan Services and certain of its affiliated companies (collectively, “Fidelity”), an independent stock plan administrator with operations, relevant to the Company, in the United States, which assists the Company with the implementation, administration and management of the Plan. In the future, the Company may select different service providers and may share Personal Data with such service providers. The Company’s stock plan administrators will open an account for the Participant to receive and trade Shares. The Participant will be asked to agree on separate terms and data processing practices with the service provider, which is a condition of the Participant’s ability to participate in the Plan. The Participant’s Personal Data will only be accessible by those individuals requiring access to it for purposes of implementing, administering and operating the Participant’s participation in the Plan. The Participant understands that the Participant may request a list with the names and addresses of any potential recipients of Personal Data by contacting ▇▇▇▇▇▇’▇ Data Protection Officer as follows: Hilton Office of the Data Protection Officer ▇▇▇▇ ▇▇▇▇▇ ▇▇▇▇▇▇ Drive McLean, VA 22102 USA Via email: ▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇@▇▇▇▇▇▇.▇▇▇ Other Recipients. The Company may further transfer Personal Data to other third party service providers, if necessary to ensure compliance with applicable laws, exercise or defense of legal rights, and archiving, back-up and deletion processes. Such third party service providers may include the Company’s outside legal counsel as well as the Company’s auditor. Wherever possible, the Company will anonymize data, but the Participant understands that his or her Personal Data may need to be transferred to such providers to ensure compliance with applicable law and/or tax requirements. International Data Transfers. The Company and its service providers, including, without limitation, Fidelity, operate, relevant to the Company, in the United States, which means that it will be necessary for Personal Data to be transferred to, and processed in, the United States. The Participant understands and acknowledges that the United States is not subject to an unlimited adequacy finding by the European Commission and that the Participant’s Personal Data may not have an equivalent level of protection as compared to the Participant’s country of residence. The legal basis for the transfer of the Personal Data to the Company and the third-party service providers described above is the necessity of the data transfer for the Company to perform its contractual obligations under the Agreement.