Common use of Your Rights Clause in Contracts

Your Rights. In relation to personal information we hold about you, you have the right to: • get access to your personal information and information about our processing of it; • ask us to correct the record of your personal information maintained by us if it is inaccurate r to complete incomplete personal information; • ask us, in certain limited instances, to erase your personal information or cease processing; • object to us processing your personal information for direct marketing purposes; • challenge us processing your personal information which has been justified on the basis of ur legitimate interests; • ask us, in certain limited instances, to restrict processing personal information to merely storing; • ask us, in certain limited instances, to transfer your personal information to another online provider; • object to decisions based solely on automated processing, including profiling; • prevent processing that is likely to cause damage or distress to you and seek compensation from us for any damages caused to you by us breaching DP Laws; • be notified of a personal data breach which is likely to result in high risk to your rights and freedoms; and • complain to the Data Protection Commissioner if you believe we have breached DPA Laws (please contact them ICO via [xxxxx://xxx.xxxxxxxxxxxxxx.xx/] (xxxxx://xxx.xxxxxxxxxxxxxx.xx/)). If you would like to exercise any of these rights, please contact our DPO (we may ask you to verify your identity - please cooperate with us in our efforts to verify your identity). Please note that we may need certain personal information to enable us to work with you and/or information to you, so changes you make to your preferences, or restrictions you ask us to make on how we use personal information, may affect what information we can provide. Please also note that sometimes we may not be able to stop using your personal information when you ask us to (for example, where we need to use it because the law requires us to do so or we need to need to retain the information for regulatory purposes). We will tell you if we are unable to comply with your request, or how your request may impact you, when you contact us.

Your Rights. In relation If it is lawful and practicable, we offer you the opportunity to deal with us anonymously or by using a pseudonym. For example, we can provide general information to you about our products or services, or general guidance on how to fill out our forms without collecting any personal information from you. However, if we hold about are unable to collect and/or verify some or all of your personal information, we may not be able to enter into a business relationship with you or provide certain Services to you, . In order for us to provide our Services to you have the right to: • get access it is normally impracticable for us to deal with you anonymously or by using a pseudonym. For example if you do not provide your personal information and information about to us, we will be unable to properly administer your account or adequately provide our processing of it; • ask Services. You may withdraw your consent for us to correct the record of your personal information maintained by us if it is inaccurate r to complete incomplete personal information; • ask uscollect, in certain limited instancesuse, to erase your personal information or cease processing; • object to us processing disclose and/or process your personal information for direct marketing purposes; • challenge us processing your personal information which has been justified some or all of the purposes listed in this Privacy Policy. However, depending on the basis nature and scope of ur legitimate interests; • ask usyour request, in certain limited instances, we may not be able to restrict processing personal information to merely storing; • ask us, in certain limited instances, to transfer your personal information to another online provider; • object to decisions based solely on automated processing, including profiling; • prevent processing that is likely to cause damage or distress continue providing our Services to you and seek compensation from us for any damages caused we shall, in such circumstances, notify you before completing the processing of your request. Withdrawing consent does not affect our right to you by us breaching DP Laws; • be notified of a continue to collect, use, disclose and/or process personal data breach where such collection, use, disclosure and/or processing without consent is permitted or required under applicable laws. Upon receipt of your written request to withdraw your consent, we may require reasonable time (depending on the nature and scope of your request and its impact on our relationship with you) for your request to be processed and for us to notify you of the relevant consequences, including any legal consequences which is likely to result in high risk to may affect your rights and freedoms; and • complain liabilities. In general, we will endeavour to process your request within ten business days from receipt. You may request to access and/or correct the personal information currently in our possession by writing to the Data Protection Commissioner if you believe we have breached DPA Laws (please Privacy Officer using the contact them ICO via [xxxxx://xxx.xxxxxxxxxxxxxx.xx/] (xxxxx://xxx.xxxxxxxxxxxxxx.xx/)). If you would like to exercise any of these rights, please contact our DPO (we may ask you to verify your identity - please cooperate with us in our efforts to verify your identity)details provided below. Please note that we may need certain charge you a reasonable fee for the handling and processing of your requests to access your personal information. We will endeavour to process or respond to your request (where necessary) within thirty business days from receipt. We will provide you with access to your personal information in accordance with the Privacy Act. We may seek to enable us verify your identity before we process any access requests to work make sure that the personal information we hold about you is sufficiently protected. Under the Privacy Act we can deny access to some or all of your personal information in specified circumstances, and we will provide reasons for any refusal in writing. If you are not satisfied with any refusal to grant you and/or information to you, so changes you make access to your preferences, or restrictions you ask us to make on how we use personal information, you may affect what information we can provide. Please also note that sometimes we may not be able to stop using your personal information when you ask us to make a complaint (for example, where we need to use it because the law requires us to do so or we need to need to retain the information for regulatory purposessee section 12). We will tell you if we are unable to comply with your request, or how your request may impact you, when you contact us.

Your Rights. In You have a number of rights in relation to personal the information that we hold about you. These rights include: - the right to access information we hold about youyou and to obtain information about how we process it; - in some circumstances, the right to withdraw your consent to our processing of your information, which you can do at any time. We may continue to process your information if we have another legitimate reason for doing so; - in some circumstances, the right to receive certain information you have provided to us in an electronic format and / or request that we transmit it to a third party; - the right to request that we rectify your information if it's inaccurate or incomplete; - in some circumstances, the right to request that we erase your information. We may continue to retain your information if we're entitled or required to retain it; - the right to object to, and to request that we restrict, our processing of your information in some circumstances. Again, there may be situations where you object to, or ask us to restrict, our processing of your information but we're entitled to continue processing your information and / or to refuse that request. You can exercise your rights by contacting us using the details set out in the `More details about your information' section below. You also have a right to complain to the French Data Protection Authority by visiting xxxxx://xxx.xxxx.xx/, or to the data protection regulator in the country where you live or work. You have the right to: • get access of complaint to your personal the National Commission for Information Technology and Civil Liberties (CNIL) by clicking here (click here) or by writing to CNIL - 0 Xxxxx xx Xxxxxxxx - XXX 00000 - 00000 Xxxxx - Cedex 07 What we need from you You're responsible for making sure the information you give us is accurate and information about our processing of it; • ask us up to correct the record of your personal information maintained by date, and you must tell us if it is inaccurate r to complete incomplete personal information; • ask us, in certain limited instances, to erase your personal information or cease processing; • object to us processing your personal information for direct marketing purposes; • challenge us processing your personal information which has been justified on the basis of ur legitimate interests; • ask us, in certain limited instances, to restrict processing personal information to merely storing; • ask us, in certain limited instances, to transfer your personal information to another online provider; • object to decisions based solely on automated processing, including profiling; • prevent processing that is likely to cause damage or distress to you and seek compensation from us for any damages caused to you by us breaching DP Laws; • be notified of a personal data breach which is likely to result in high risk to your rights and freedoms; and • complain to the Data Protection Commissioner if you believe we have breached DPA Laws (please contact them ICO via [xxxxx://xxx.xxxxxxxxxxxxxx.xx/] (xxxxx://xxx.xxxxxxxxxxxxxx.xx/))anything changes as soon as possible. If you would like to exercise any of these rightsprovide information for another person on your account, please contact our DPO (we may ask you to verify your identity - please cooperate with us in our efforts to verify your identity). Please note that we may need certain personal information to enable us to work with you and/or information to you, so changes you make to your preferences, or restrictions you ask us to make on how we use personal information, may affect what information we can provide. Please also note that sometimes we may not be able to stop using your personal information when you ask us to (for example, where we 'll need to use it because the law requires direct them to this notice and make sure they agree to us to do so or we need to need to retain the using their information for regulatory purposes). We will tell you if we are unable to comply with your request, or how your request may impact you, when you contact usas described in it.

Your Rights. In relation We will only store your data for as long as is necessary to comply with the requirements of your insurance contract(s) and any legal obligations or lawful processing conditions that may exist as a result. You have a number of rights concerning the personal information we use, which you may ask us to observe. In some cases, even when you make a request concerning your personal information, we may not be required, or be able to carry out your request as this may result in us not being able to fulfil our legal and regulatory obligations under the lawful processing conditions under which we hold about youyour data or because there is a minimum statutory period of time for which we have to keep your information. If this is the case, we'll let you have the right know our reasons. You can ask us to: • get access to your personal information and information about our processing of it; • ask us to correct the record Provide a copy of your personal information maintained by us if it is • Correct or delete unnecessary or inaccurate r personal information • Restrict or to complete incomplete personal information; • ask us, in certain limited instances, object to erase the use of your personal information or cease processing; at any time • object Object to us processing any automated decision, including profiling which may have been used by insurers when underwriting your quotation. Where an automated decision has been made, we will advise you of this and of your rights • Provide your personal information for direct marketing purposes; • challenge us processing data in a structured, commonly used, and machine-readable format and to have your personal data transferred to another controller. This right only applies where our processing of your personal data is automated, and the processing took place initially with your consent or for the performance of a contract with you • Where we rely on your consent to use your personal information, you can withdraw that consent at any time. Where your consent is withdrawn, your previous consent will remain valid in respect of our use of your information which prior to the date you withdrew it, or if any marketing material has been justified on the basis of ur legitimate interests; • ask us, in certain limited instances, to restrict processing personal information to merely storing; • ask us, in certain limited instances, to transfer your personal information to another online provider; • object to decisions based solely on automated processing, including profiling; • prevent processing that is likely to cause damage or distress sent prior to you and seek compensation from advising that you don’t want us for any damages caused to contact you by us breaching DP Laws; • be notified of a personal data breach which is likely to result in high risk to your rights and freedoms; and • complain to the Data Protection Commissioner if you believe we have breached DPA Laws (please contact them ICO via [xxxxx://xxx.xxxxxxxxxxxxxx.xx/] (xxxxx://xxx.xxxxxxxxxxxxxx.xx/))again. If you would like to exercise have any of these questions or concerns about this privacy notice or your data protection rights, please contact us using our DPO details set out at the beginning of this privacy notice. You also have the right to make an enquiry or to complain to the Information Commissioner’s Office (we may ask ICO) if you to verify are unhappy with our use of your identity - please cooperate with us in our efforts to verify your identity). Please note that we may need certain personal information to enable us to work with you and/or information to you, so changes you make to your preferencesdata, or restrictions if you ask us to make on how think we use personal information, may affect what information we can providehave breached a legal requirement. Please also note that sometimes we may not be able to stop using your personal information when you ask us to (for example, where we need to use it because Further details about the law requires us to do so or we need to need to retain the information for regulatory purposes). We will tell you if we ICO are unable to comply with your request, or how your request may impact you, when you contact usavailable at xxxxx://xxx.xxx.xx.

Your Rights. In relation Data protection laws provide data subjects with the following rights, (subject to certain exemptions and conditions in some cases) to: • request access to their personal information. This enables them to receive a copy of the personal information we We hold about you, you them and to check that We are lawfully processing it. VendueHost reserves the right to charge in some cases a reasonable fee to cover costs for providing copies of personal information requested; • request correction of the personal information that We hold about them. This enables them to have any incomplete or inaccurate information We hold about them corrected; • request erasure of their personal information. This enables them to ask Us to delete or remove personal information where there is no good reason for Us continuing to process it. Data subjects also have the right to: • get access to your ask Us to delete or remove their personal information and where they have exercised their right to object to processing (see below); • request the restriction of processing of their personal information. This enables them to ask Us to suspend the processing of personal information about our them, for example if they want Us to establish its accuracy or the reason for processing it; Data subjects also have the right to object to the processing of it; • ask us to correct the record of your their personal information maintained by us if it where We are relying on a legitimate interest (or those of a third party) and there is inaccurate r something about their particular situation which makes them want to complete incomplete personal information; • ask us, in certain limited instances, to erase your personal information or cease processing; • object to us processing your on this ground. They also have the right to object where We are processing their personal information for direct marketing purposes; • challenge us processing your . Where legitimate reasons exist, We may refuse to comply with a request by a data subject to access their personal information which has been justified on the basis of ur legitimate interests; • ask us, in certain limited instances, circumstances. We may need to restrict processing personal request specific information from the data subject to merely storing; • ask us, in certain limited instances, help Us confirm their identity and ensure their right to transfer your personal access the information to another online provider; • object to decisions based solely on automated processing, including profiling; • prevent processing that is likely to cause damage (or distress to you and seek compensation from us for any damages caused to you by us breaching DP Laws; • be notified of a personal data breach which is likely to result in high risk to your rights and freedoms; and • complain to the Data Protection Commissioner if you believe we have breached DPA Laws (please contact them ICO via [xxxxx://xxx.xxxxxxxxxxxxxx.xx/] (xxxxx://xxx.xxxxxxxxxxxxxx.xx/)). If you would like to exercise any of their other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it. Our Online Platform may, from time to time, contain links to and from the websites of Auction Houses, our partner networks, advertisers and affiliates. If You follow a link to any of these rightswebsites, please contact our DPO (we may ask you to verify your identity - please cooperate with us in our efforts to verify your identity)note that these websites have their own privacy policies and that We do not accept any responsibility or liability for these policies. Please note that we may need certain check these policies before You submit any personal information to enable us to work with you these websites. In particular where We collect information on behalf of Auction Houses and third parties such Auction Houses and/or third parties and not VendueHost are responsible for how the information to youis processed. International Transfers VendueHost is headquarted in the Republic of South Africa (“RSA”) and has affiliates, so changes you make to your preferences, or restrictions you ask us to make on how we use personal service providers and Auction Houses in other countries. Your information, including personal information that We collect from You, may affect what information we can provide. Please also note that sometimes we be transferred to, stored at and processed by Us and Our affiliates and other third parties outside the country in which You reside, in countries where data protection and privacy regulations may not be able to stop using your personal information when you ask us to (for example, where we need to use it because offer the law requires us to do so or we need to need to retain same level of protection as in the information for regulatory purposes)RSA. We will tell you take all reasonable steps to ensure that Your personal information is treated securely and in accordance with this Privacy Policy. Changes to Our Privacy Policy We reserve the right to modify this Privacy Policy at any time. We encourage You to periodically review this page for the latest information on our privacy practices. If We make material changes to this Privacy Policy You will be notified via email (if we are unable You have an account where We have Your contact information) or another manner through the Service that We believe reasonably likely to comply with your requestreach You (which may include posting a new privacy policy on our Online Platform–or a specific announcement on this page or on our blog). Any modifications to this Privacy Policy will be effective upon our posting of the new terms and/or upon implementation of the new changes on the Service (or as otherwise indicated at the time of posting). In all cases, Your continued use of the Service after the posting of any modified Privacy Policy indicates Your acceptance of the terms of the modified Privacy Policy. This Privacy Policy replaces all prior privacy policies or how your request may impact you, when you contact usstatements.

Your Rights. In relation Some jurisdictions’ laws grant specific rights to personal information we hold about youCele Live users, you which are set out in this section. You may have all or some of the right to: • get access following rights set forth below according to applicable laws. We will respond to your personal information and information request consistent with the applicable laws as soon as practicable, normally within one month, after proper verification procedures. Your exercise of these rights is usually free of charge, unless we deem it is chargeable under the applicable laws. Right to access-You may submit a request to access the Personal Information we collect about you by (a) using Help or Feedback function on Cele Services or (b) by sending your request to us via email at xxxxxxx@xxxxxxxx.xxx. Right to rectification-You may submit a request to rectify the Personal Information we collect about you by (a) using Help or Feedback function on Cele Services or (b) by sending your request to us via email at xxxxxxx@xxxxxxxx.xxx. Right to erasure-You may submit a request to erase the Personal Information we collect about you by (a) using Help or Feedback function on Cele Services or (b) by sending your request to us via email. Though we cannot guarantee a complete erasure of your data that has been stored in our processing of it; • backup servers, we promise that we will not use the data within the backup servers for any other purpose. Right to data portability-You may ask us to correct the record transfer some of your personal information maintained by us Personal Information, if it is inaccurate r to complete incomplete personal information; • ask us, in certain limited instances, to erase your personal information or cease processing; • object to us processing your personal information for direct marketing purposes; • challenge us processing your personal information which has been justified collected on the basis of ur legitimate interests; • ask usyour consent, in certain limited instancesstructured, commonly used and machine-readable formats to you or other environments designated by you, if technically feasible, by (a) using Help or Feedback function on Cele Services or (b) by sending your request to us via email at xxxxxxx@xxxxxxxx.xxx. Right to withdraw consent-You may withdraw your consent and ask us not to continue to collect or process your Personal Information at any time if that information is collected on the basis of your consent by (a) using Help or Feedback function on Cele Services or (b) by sending your request to us via email. Your exercise of this right will not affect the processing activities that occurred before your withdrawal. Right to restrict processing-You may request us to stop processing personal information to merely storing; • ask us, in certain limited instances, to transfer your personal information to another online provider; • object to decisions based solely on automated processing, including profiling; • prevent processing that is likely to cause damage or distress to you and seek compensation from us for any damages caused to you by us breaching DP Laws; • be notified of a personal data breach which is likely to result in high risk to your rights and freedoms; and • complain to the Data Protection Commissioner Personal Information if you believe such information is collected unlawfully or you have other reason by (a) using Help or Feedback function on Cele Services or (b) by sending your request to us via email at xxxxxxx@xxxxxxxx.xxx. We will examine your request and respond accordingly. Right to object-You may object to the processing of any Personal Information we have breached DPA Laws collect about you, if such information is collected on the basis of legitimate interests, at any time by (please contact them ICO a) using Help or Feedback function on Cele Services or (b) by sending your request to us via [xxxxx://xxx.xxxxxxxxxxxxxx.xx/] (xxxxx://xxx.xxxxxxxxxxxxxx.xx/)). If you would like to exercise any of these rights, please contact our DPO (we may ask you to verify your identity - please cooperate with us in our efforts to verify your identity)email at xxxxxxx@xxxxxxxx.xxx. Please note that we may need certain personal information to enable us to work with you and/or information to youreject your request if we demonstrate compelling legitimate grounds for the processing, so changes you make to which override your preferencesinterests and freedom or the processing is for the establishment, exercise, or restrictions you defense of legal claims. Right concerning automated decision making and profiling-You may ask us to make stop automated decision making or profile, if you believe such automated decision making and profiling has legal or similarly significant effect upon you by (a) using Help or Feedback function on how we use personal information, may affect what information we can provide. Please also note that sometimes we may not be able Cele Services or (b) by sending your request to stop using your personal information when you ask us to (for example, where we need to use it because the law requires us to do so or we need to need to retain the information for regulatory purposes)via email at xxxxxxx@xxxxxxxx.xxx. We will tell you if we are unable to comply with your request, or how examine your request may impact youand let you know if your request is applicable under the relevant laws and regulations. In addition to the foregoing rights, when you contact usalso have the right to lodge complaints to the competent data protection authority (“DPA”), usually the DPA of your home country.

Your Rights. In relation Right to Object  You have the right to object to our use of your personal data, on grounds relating to your particular situation, to the extent the processing is based on our legitimate interests. If we receive an objection, then we will stop processing the personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or if the processing is necessary for the establishment, exercise or defence of legal claims. Additional Rights Data protection laws provide you with the following rights:  Request access to your personal information (commonly known as a "data subject access request"). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.  Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.  Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see above).  Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.  Request the transfer of your personal information to another party.  Lodge a complaint about the way in which your personal information is being used to a supervisory authority. If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, or request that we transfer a copy of your personal information to another party, please contact us using the details provided below. You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances. We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it. Where we rely on your consent to collect and use your personal information for a specific purpose, you have the right to: • get access to withdraw your personal information and information about our consent for that specific processing of it; • ask at any time. To withdraw your consent, please contact us to correct using the record of contact details provided below. Once we have received notification that you have withdrawn your personal information maintained by us if it is inaccurate r to complete incomplete personal information; • ask usconsent, in certain limited instances, to erase we will no longer process your personal information or cease processing; • object to us processing your personal information for direct marketing purposes; • challenge us processing your personal information which has been justified the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law. CHANGES TO OUR PRIVACY POLICY Any changes we make to our Policy in the future will be posted on the basis of ur legitimate interests; • ask usthis page and, in certain limited instanceswhere material, to restrict processing personal information to merely storing; • ask us, in certain limited instances, to transfer your personal information to another online provider; • object to decisions based solely on automated processing, including profiling; • prevent processing that is likely to cause damage or distress to you and seek compensation from us for any damages caused notified to you by us breaching DP Laws; • be notified of a personal data breach which is likely to result in high risk to your rights and freedoms; and • complain to the Data Protection Commissioner if you believe we have breached DPA Laws (please contact them ICO via [xxxxx://xxx.xxxxxxxxxxxxxx.xx/] (xxxxx://xxx.xxxxxxxxxxxxxx.xx/)). If you would like to exercise any of these rights, please contact our DPO (we may ask you to verify your identity - please cooperate with us in our efforts to verify your identity). Please note that we may need certain personal information to enable us to work with you and/or information to you, so changes you make to your preferences, or restrictions you ask us to make on how we use personal information, may affect what information we can provide. Please also note that sometimes we may not be able to stop using your personal information when you ask us to (for example, where we need to use it because the law requires us to do so or we need to need to retain the information for regulatory purposes). We will tell you if we are unable to comply with your request, or how your request may impact you, when you contact use-mail.

Your Rights. In relation Right to Object • You have the right to object to our use of your personal data, on grounds relating to your particular situation, to the extent the processing is based on our legitimate interests. If we receive an objection, then we will stop processing the personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or if the processing is necessary for the establishment, exercise or defence of legal claims. Additional Rights Data protection laws provide you with the following rights: • Request access to your personal information (commonly known as a "data subject access request"). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it. • Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected. • Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see above). • Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it. • Request the transfer of your personal information to another party. • Xxxxx a complaint about the way in which your personal information is being used to a supervisory authority. If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, or request that we transfer a copy of your personal information to another party, please contact us using the details provided below. You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances. We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it. Where we rely on your consent to collect and use your personal information for a specific purpose, you have the right to: • get access to withdraw your personal information and information about our consent for that specific processing of it; • ask at any time. To withdraw your consent, please contact us to correct using the record of contact details provided below. Once we have received notification that you have withdrawn your personal information maintained by us if it is inaccurate r to complete incomplete personal information; • ask usconsent, in certain limited instances, to erase we will no longer process your personal information or cease processing; • object to us processing your personal information for direct marketing purposes; • challenge us processing your personal information which has been justified the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law. CHANGES TO OUR PRIVACY POLICY Any changes we make to our Policy in the future will be posted on the basis of ur legitimate interests; • ask usthis page and, in certain limited instanceswhere material, to restrict processing personal information to merely storing; • ask us, in certain limited instances, to transfer your personal information to another online provider; • object to decisions based solely on automated processing, including profiling; • prevent processing that is likely to cause damage or distress to you and seek compensation from us for any damages caused notified to you by us breaching DP Laws; • be notified of a personal data breach which is likely to result in high risk to your rights and freedoms; and • complain to the Data Protection Commissioner if you believe we have breached DPA Laws (please contact them ICO via [xxxxx://xxx.xxxxxxxxxxxxxx.xx/] (xxxxx://xxx.xxxxxxxxxxxxxx.xx/)). If you would like to exercise any of these rights, please contact our DPO (we may ask you to verify your identity - please cooperate with us in our efforts to verify your identity). Please note that we may need certain personal information to enable us to work with you and/or information to you, so changes you make to your preferences, or restrictions you ask us to make on how we use personal information, may affect what information we can provide. Please also note that sometimes we may not be able to stop using your personal information when you ask us to (for example, where we need to use it because the law requires us to do so or we need to need to retain the information for regulatory purposes). We will tell you if we are unable to comply with your request, or how your request may impact you, when you contact use-mail.

Your Rights. In relation All individuals (users of our platform or otherwise) have a number of rights with regards to your personal information data under the Data Protection Laws. If you wish to exercise any of your rights, please contact us at xxx@xxxxxxxxxxxxxxxx.xxx • Right of access: You can request access to a copy of the personal data which we hold about you, you have the right to: • get access to your personal information as well as details about why and information about our processing of how we use it.; • Right to rectification: You can ask us to correct the record of your change or complete any personal information maintained by us if it data we hold about you which is inaccurate r to complete incomplete personal informationor incomplete; • ask usRight to be forgotten/erasure: You have a right, in under certain limited instancescircumstances, to erase your personal information or cease processing; • object ask us to us processing your personal information for direct marketing purposes; • challenge us processing your personal information which has been justified on the basis of ur legitimate interests; • ask us, in certain limited instances, to restrict processing personal information to merely storing; • ask us, in certain limited instances, to transfer your personal information to another online provider; • object to decisions based solely on automated processing, including profiling; • prevent processing that is likely to cause damage or distress to you and seek compensation from us for delete any damages caused to you by us breaching DP Laws; • be notified of a personal data breach which is likely to result in high risk to your rights and freedoms; and • complain to the Data Protection Commissioner if you believe we have breached DPA Laws (please contact them ICO via [xxxxx://xxx.xxxxxxxxxxxxxx.xx/] (xxxxx://xxx.xxxxxxxxxxxxxx.xx/)). If you would like to exercise any of these rights, please contact our DPO (we may ask you to verify your identity - please cooperate with us in our efforts to verify your identity)hold about you. Please note that there may be situations where we may need certain must retain your personal information to enable us to work with you and/or information to you, so changes you make to your preferences, or restrictions you data after a request for erasure where we have a lawful basis for doing so; • Right of restriction: You can ask us to make on how restrict (i.e. prevent) the processing of your personal data where you have objected to our use of it and we use have no lawful basis to continue processing your personal informationdata; • Right of data portability: In certain circumstances, may affect what information you can ask us to transfer the data we hold about you to another organisation. This would be sent in a structured, commonly used, electronic form; • Right to object: You can provide. Please also note that sometimes we may not be able object to stop us using your personal information when data for particular purposes; and • Automated decision making: You have a right not to be subjected to automated decision making and profiling in certain situations. If you ask have any cause to complain about our use of your personal data, please contact us by emailing xxx@xxxxxxxxxxxxxxxx.xxx You also have the right to lodge a complaint about our processing with a supervisory authority — in the UK that is the ICO whose details are here: xxxxx://xxx.xxx.xx/make-a-complaint/ Automated decision making We do not use your personal data in any automated processes to make decisions about you What Happens If Our Business Changes Hands? We may, from time to time, expand or reduce our business and this may involve the sale and/or the transfer of control of all or part of Our business. Any personal data that you have provided will, where it is relevant to any part of our business that is being transferred, be transferred along with that part and the new owner or newly controlling party will, depending on the lawful basis, be permitted to use that data only for the same purposes for which it was originally collected by Us. In the event that any of your data is to be transferred in such a manner, you will be contacted in advance and informed of the changes. Changes to Our Privacy Policy We may change this Privacy Policy from time to time (for example, where if the law changes). We recommend that you check this page regularly to keep up-to-date. If we need make any material changes to the manner in which we process and use your personal data, we will contact you to let you know about the change. Get in touch If you have queries about our use of your data, please contact us by emailing us on xxx@xxxxxxxxxxxxxxxx.xxx Potential Employee Privacy Notice Data that we hold and how we use it because As a potential employee we hold the law requires us following data on you: Contact details, CV, and email correspondence with you. If you are successful in gaining employment with WIC then you will fall under the Employee Privacy Notice going forward. Lawful basis for processing Our lawful basis for processing your data is a combination of Contract, legitimate interest and consent. When you applied for a job it was with a view to do so or entering into an employment contract with us. If we need decide not to need go forward with your application then we use legitimate interest to retain the information data should the chosen candidate not work out or another role become immediately available. Data Sharing and Transfers Like most companies, we use a number of other companies as part of our data processing, for regulatory purposes)example cloud services and technology services. We will tell you have Data Processing Agreements in place with these providers. We also transfer your data to our lawyers for contracting and to support with the visa sponsorship process if applicable. Where data is transferred outside of the EEA, we ensure that appropriate protection and mechanisms are unable in place, for example Standard Contractual Clauses. We do not sell your data to comply with your request, or how your request may impact you, when you contact usanybody.

Your Rights. In relation We want you to be in control of your information, so we have provided you with the following tools: o Access / Update tools in the service. Tools and account settings that help you to access, rectify or delete information that you provided to us and that’s associated with your account directly within the service. If you have any question on those tools and settings, please contact our customer care team at xxxxxxx@xxxxxxxxx.xxx. o Device permissions. Mobile platforms have permission systems for specific types of device data and notifications, such as phone book and location services as well as push notifications. You can change your settings on your device to either consent or oppose the collection of the corresponding information or the display of the corresponding notifications. Of course, if you do that, certain services may lose full functionality. o Deletion. You can delete your account by emailing xxxxxxx@xxxxxxxxx.xxx and providing us with your username, and submitting a request to delete your account We want you to be aware of your privacy rights. Here are a few key points to remember: o Reviewing your information. Applicable privacy laws may give you the right to review the personal information we keep about you (depending on the jurisdiction, this may be called right of access, right of portability or variations of those terms). You can request a copy of your personal information by putting in such a request at xxxxxxx@xxxxxxxxx.xxx o Updating your information. If you believe that the information we hold about you, you have the right to: • get access to your personal information and information about our processing of it; • ask us to correct the record of your personal information maintained by us if it is inaccurate r or that we are no longer entitled to complete incomplete personal information; • ask ususe it and want to request its rectification, in certain limited instances, to erase your personal information deletion or cease processing; • object to us processing your personal information for direct marketing purposes; • challenge us processing your personal information which has been justified on the basis of ur legitimate interests; • ask us, in certain limited instances, to restrict processing personal information to merely storing; • ask us, in certain limited instances, to transfer your personal information to another online provider; • object to decisions based solely on automated its processing, including profiling; • prevent processing that is likely to cause damage or distress to you and seek compensation from us for any damages caused to you by us breaching DP Laws; • be notified of a personal data breach which is likely to result in high risk to your rights and freedoms; and • complain to the Data Protection Commissioner if you believe we have breached DPA Laws (please contact them ICO via [xxxxx://xxx.xxxxxxxxxxxxxx.xx/] (xxxxx://xxx.xxxxxxxxxxxxxx.xx/)). If you would like to exercise any of these rights, please contact us at xxxxxxx@xxxxxxxxx.xxx For your protection and the protection of all of our DPO (users, we may ask you to verify your provide proof of identity - please cooperate with us before we can answer the above requests. Keep in our efforts to verify your identity). Please note that mind, we may need reject requests for certain personal reasons, including if the request is unlawful or if it may infringe on trade secrets or intellectual property or the privacy of another user. If you wish to receive information relating to enable us another user, such as a copy of any messages you received from him or her through our service, the other user will have to work with you and/or contact our Privacy Officer to provide their written consent before the information to youis released. Also, so changes you make to your preferences, or restrictions you ask us to make on how we use personal information, may affect what information we can provide. Please also note that sometimes we may not be able to stop using your accommodate certain requests to object to the processing of personal information when you ask information, notably where such requests would not allow us to (for exampleprovide our service to you anymore. For instance, where we need to use it because the law requires us to do so or we need to need to retain the information for regulatory purposes). We will tell you cannot provide our service if we are unable to comply do not have your date of birth. o Uninstall. You can stop all information collection by an app by uninstalling it using the standard uninstall process for your device. If you uninstall the app from your mobile device, the unique identifier associated with your requestdevice will continue to be stored. If you re-install the application on the same mobile device, or how we may be able to re-associate this identifier to your request may impact you, when you contact usprevious transactions and activities.

Your Rights. In relation to As a person whose personal information we hold about youdata is processed, you have the following general rights under the applicable data protection regulations: - Right to be informed; - Right of access; - Right to rectification; - Right to erasure (right to: • get access to your personal information and be forgotten); - Right to restriction of processing; - Right to not be subject to automatic decision making; - Right to object; - Right to data portability; - Right to file a complaint with a supervisory authority. More information about our processing your rights under the applicable data protection regulations can also be found on the website of it; • ask us to correct the record local data protection authority in your country. Please be aware that invoking your rights might, depending on the contents of your personal information maintained by us if it is inaccurate r request, have the consequence that we are wholly or partly unable to complete incomplete personal information; • ask us, in certain limited instances, to erase your personal information or cease processing; • object to us processing your personal information for direct marketing purposes; • challenge us processing your continue our services towards you. You may request details of personal information which has been justified on the basis of ur legitimate interests; • ask us, in certain limited instances, to restrict processing personal information to merely storing; • ask us, in certain limited instances, to transfer your personal information to another online provider; • object to decisions based solely on automated processing, including profiling; • prevent processing that is likely to cause damage or distress to Transoft hold about you and seek compensation from us for any damages caused to you by us breaching DP Laws; • be notified of a personal data breach which is likely to result in high risk to your rights and freedoms; and • complain to the Data Protection Commissioner if you believe we have breached DPA Laws (please contact them ICO via [xxxxx://xxx.xxxxxxxxxxxxxx.xx/] (xxxxx://xxx.xxxxxxxxxxxxxx.xx/))at no cost. If you would like a copy of the information that is held on you by Transoft please email xxxxxxx@xxxxxxxxxxxxxxxxx.xxx or write to exercise Transoft Solutions Inc., 000 – 00000 Xxxxxxxxxxxxx Xxxxx, Xxxxxxxx, XX X0X 0X0, Xxxxxx; or Transoft Solutions (Europe) BC, Wijnhaven 00, 0000 XX Xxxxxxxxx, Xxxxxxxxxxx; or Transoft Solutions (UK) Limited, Ardencroft Court, Ardens Grafton, Alcester, Warwickshire, B49 6DP, UK. The accuracy of the personal information we hold is important to us, if you believe that any of these rightsinformation is incorrect or incomplete, please email or write to us using the above addresses so that we can promptly rectify any information found to be incorrect. Questions In case you have questions about the way Transoft processes your personal data you can contact our DPO (we may ask us via xxxxxxx@xxxxxxxxxxxxxxxxx.xxx or write to one of the addresses noted above. Changes to This Privacy Statement Transoft reserves the right to change the provisions of this Privacy Statement at any time but will alert you that changes have been made by updating the date of the last revision below. Your use of the Transoft website following the issuing of an updated statement shall constitute your acceptance of any such changes. We encourage you to verify your identity - please cooperate with us in review our efforts to verify your identity). Please note that we may need certain personal information to enable us to work with Privacy Statement whenever you and/or information to you, so changes you make to your preferences, or restrictions you ask us visit our website to make on sure that you understand how your information will be used. Notwithstanding any change to this Statement, we use personal information, may affect what information we can provide. Please also note that sometimes we may not be able will continue to stop using process your personal information when you ask us to (for example, where we need to use it because the law requires us to do so or we need to need to retain the information for regulatory purposes). We will tell you if we are unable to comply data in accordance with your requestrights and Transoft’s obligations in law. Date of last revision: March 29, or how your request may impact you, when you contact us.2022

Your Rights. In relation The right to personal information we hold about you, be informed – you have the right to: to know what information the council is processing about you • get access The right to rectification – you have the right to correct or rectify any inaccuracies in your records • The right to erasure or right to be forgotten – you have the right to ask for your details to be removed from the systems that we use to process your personal information and information about our data • The right to restrict processing of it; • ask us – you have the right to correct restrict the record processing of your personal information maintained by us if it is inaccurate r to complete incomplete personal information; • ask us, data in certain limited instances, ways • The right to erase data portability – you have the right to ask for the transfer of your personal information or cease processing; data to other controllers • object Rights in relation to us processing your personal information for direct marketing purposes; • challenge us processing your personal information which has been justified on the basis of ur legitimate interests; • ask us, in certain limited instances, to restrict processing personal information to merely storing; • ask us, in certain limited instances, to transfer your personal information to another online provider; • object to decisions based solely on automated processing, including decision making and profiling; • prevent processing that is likely to cause damage or distress to you and seek compensation from us for any damages caused to you by us breaching DP Laws; • be notified of a personal data breach which is likely to result in high risk to your rights and freedoms; and • complain to the Data Protection Commissioner if . If you believe we have breached DPA Laws (made an automated decision about you have the right to ask us to review that decision. To exercise your rights please contact them ICO via [xxxxx://xxx.xxxxxxxxxxxxxx.xx/] (xxxxx://xxx.xxxxxxxxxxxxxx.xx/))us by email, telephone or from the Council’s Website. The council will respond; • Free of charge • Within a month These rights are not absolute but are assessed on a case by case basis, applying relevant exemptions. Requests must be made by the person to whom the information relates or their authorised representative. You may be asked to provide information so that we can validate who you are and that someone isn’t trying to impersonate you. If you would like wish to exercise any authorise someone to act on your behalf – this could be another individual or an organisation, such as your legal representative or Citizens Advice, it is important that you make your wishes clear and provide a form of these rights, please contact our DPO (we may ask you authority to verify your identity - please cooperate with us in our efforts to verify your identity). Please note them so that we may need certain personal information to enable us to work with you and/or information to youknow they are acting under your instruction. Emailing: xxxxxxxxxxxxxxxxxxxxx@xxxxxxxxx.xxx.xx Writing to: The Data Protection Officer, so changes you make to your preferencesMaidstone Borough Council, or restrictions you ask us to make on how we use personal informationMaidstone House, may affect what information we can provide. Please also note that sometimes we may not be able to stop using your personal information when you ask us to (for exampleKings Street, where we need to use it because the law requires us to do so or we need to need to retain the information for regulatory purposes). We will tell you if we are unable to comply with your request, or how your request may impact you, when you contact us.Maidstone Kent ME15 6JQ

Your Rights. In relation to As a result of us processing your personal information we hold about youdata, you have the a right to: • get ● access personal data held about you; ● request us to make any changes to your personal data if it is inaccurate or incomplete; ● request your personal data is erased where we do not have a compelling reason to continue to process such data in certain circumstances; ● receive your personal data provided to us as a data controller in a structured, commonly used and machine- readable format where our processing of the data is carried out by automated means and is based on: (i) your consent; (ii) our necessity for performance of a contract to which you are a party; or (iii) steps taken at your request prior to entering into a contract with us; ● object to, or restrict, our processing of your personal data in certain circumstances; ● if we use your personal data for direct marketing, ask us to stop and we will comply with your request; ● if we use your personal data on the basis of having a legitimate interest, object to our use of it for those purposes, giving an explanation of your particular situation, and we will consider your objection; and ● to object to, and not be subject to a decision which is based solely on, automated processing (including profiling), which produces legal effects or could significantly affect you. To exercise any of your rights set out above, including to withdraw your consent where we have stated we are processing your personal data based on your consent, please contact us at xxxxxxx@xxxxxxxxxx.xxx. We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response. You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances. We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated. You also have the right to lodge a complaint with a supervisory authority about the processing of your personal data. The supervisory authority in the UK is the Information Commissioner who may be contacted at xxxxx://xxx.xxx.xx/concerns/ . Security We have put in place safeguards to prevent your personal data from being lost, used or accessed in an unauthorised way. We limit access to your personal information data to those employees, agents or contractors who have a business need to know in order to provide the Services. Please contact xxxxxxx@xxxxxxxxxx.xxx for a copy of our Security Policy. Third party websites Throughout our website we may link to other websites owned and operated by certain trusted third parties. These other third party websites may also gather information about our processing of it; • ask us you in accordance with their own separate privacy policies. For privacy information relating to correct the record of your personal information maintained by us if it is inaccurate r to complete incomplete personal information; • ask us, in certain limited instances, to erase your personal information or cease processing; • object to us processing your personal information for direct marketing purposes; • challenge us processing your personal information which has been justified on the basis of ur legitimate interests; • ask us, in certain limited instances, to restrict processing personal information to merely storing; • ask us, in certain limited instances, to transfer your personal information to another online provider; • object to decisions based solely on automated processing, including profiling; • prevent processing that is likely to cause damage or distress to you and seek compensation from us for any damages caused to you by us breaching DP Laws; • be notified of a personal data breach which is likely to result in high risk to your rights and freedoms; and • complain to the Data Protection Commissioner if you believe we have breached DPA Laws (please contact them ICO via [xxxxx://xxx.xxxxxxxxxxxxxx.xx/] (xxxxx://xxx.xxxxxxxxxxxxxx.xx/)). If you would like to exercise any of these rightsother third party websites, please contact our DPO (consult their privacy policies as appropriate. Changes to this website privacy policy This privacy policy was last updated in February 2019. We may change this website policy from time to time and we may ask will notify you to verify your identity - please cooperate with us in our efforts to verify your identity). Please note of changes that we may need certain personal information to enable us to work with you and/or information to you, so changes you make to your preferences, or restrictions you ask us to make on how we use personal information, may affect what information we can provide. Please also note that sometimes we may not be able to stop using your personal information when you ask us to (for examplethis privacy policy, where we need to use it because the law requires us to do so or we need to need to retain the information for regulatory purposes)applicable. We will tell you if we are unable to comply with your request, or how your request may impact you, when you contact us.Schedule 3 Data Processing Details

Your Rights. In relation to personal information we hold about you, This section only applies if you are in a country within the EEA and/or if RocketSpace UK is processing your information. By law you have the right to: • get Request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it. We will need you to prove your identity before we release any personal information about our processing of it; to you. • ask us to correct the record Request correction or erasure of your personal information maintained by (unless we have the legal right to retain it). You also have the right to ask us if it is inaccurate r to complete incomplete personal information; • ask us, in certain limited instances, to erase delete or remove your personal information or cease processing; • where you have exercised your right to object to us processing (see below). • Object to processing of your personal information where we are relying on a legitimate interest and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes; . • challenge Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it. • Request the transfer of personal information that you have provided to us to another party. • Change your information processing preferences at any time (where this specifically relates to marketing messages, see MARKETING). You should be aware that if you ask us to stop processing your personal information which has been justified on the basis of ur legitimate interests; • ask us, in a certain limited instances, way or to restrict processing personal information to merely storing; • ask us, in certain limited instances, to transfer erase your personal information to another online provider; • object to decisions based solely on automated processing, including profiling; • prevent processing that is likely to cause damage or distress to you and seek compensation from us for any damages caused to you by us breaching DP Laws; • be notified of a personal data breach which is likely to result in high risk to your rights and freedoms; and • complain to the Data Protection Commissioner if you believe we have breached DPA Laws (please contact them ICO via [xxxxx://xxx.xxxxxxxxxxxxxx.xx/] (xxxxx://xxx.xxxxxxxxxxxxxx.xx/)). If you would like to exercise any of these rights, please contact our DPO (we may ask you to verify your identity - please cooperate with us in our efforts to verify your identity). Please note that we may need certain personal information to enable us to work with you and/or information to you, so changes you make to your preferences, or restrictions you ask us to make on how we use personal information, may affect what information we can provide. Please also note that sometimes we and this type of processing is necessary for you to use our Services, then you may not be able to stop using continue to use our Services. This does not include your right to object to direct marketing, which can be exercised at any time without restriction. If you want to exercise any of the rights listed above, please contact us (see HOW TO CONTACT US). No fee usually required to access your personal information when you ask us You will not normally have to pay a fee to access your personal information (for example, where we need or to use it because exercise any of the law requires us to do so or we need to need to retain the information for regulatory purposesother rights set out above). We will tell you However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we are unable may refuse to comply with the request in such circumstances. What we may need from you We may need to request specific information from you to confirm your request, identity and verify your right to access the information (or how to exercise any of your request may impact you, when you contact usother rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

Your Rights. In You have a number of rights in relation to personal the information that we hold about you. These rights include: - the right to access information we hold about youyou and to obtain information about how we process it; - in some circumstances, the right to withdraw your consent to our processing of your information, which you can do at any time. We may continue to process your information if we have another legitimate reason for doing so; - in some circumstances, the right to receive certain information you have provided to us in an electronic format and / or request that we transmit it to a third party; - the right to request that we rectify your information if it's inaccurate or incomplete; - in some circumstances, the right to request that we erase your information. We may continue to retain your information if we're entitled or required to retain it; - the right to object to, and to request that we restrict, our processing of your information in some circumstances. Again, there may be situations where you object to, or ask us to restrict, our processing of your information but we're entitled to continue processing your information and / or to refuse that request. You can exercise your rights by contacting us using the details set out in the `More details about your information' section below. You also have a right to complain to the French Data Protection Authority by visiting xxxxx://xxx.xxxx.xx/, or to the data protection regulator in the country where you live or work. You have the right to: • get access to your personal information and information about our processing of it; • ask us to correct the record of your personal information maintained by us if it is inaccurate r to complete incomplete personal information; • ask us, in certain limited instances, to erase your personal information or cease processing; • object to us processing your personal information for direct marketing purposes; • challenge us processing your personal information which has been justified on the basis of ur legitimate interests; • ask us, in certain limited instances, to restrict processing personal information to merely storing; • ask us, in certain limited instances, to transfer your personal information to another online provider; • object to decisions based solely on automated processing, including profiling; • prevent processing that is likely to cause damage or distress to you and seek compensation from us for any damages caused to you by us breaching DP Laws; • be notified of a personal data breach which is likely to result in high risk to your rights and freedoms; and • complain complaint to the Data Protection Commissioner if National Commission for Information Technology and Civil Liberties (CNIL) by clicking here (click here) or by writing to CNIL - 0 Xxxxx xx Xxxxxxxx - XXX 00000 - 00000 Xxxxx - Cedex 07 What we need from you believe we have breached DPA Laws (please contact them ICO via [xxxxx://xxx.xxxxxxxxxxxxxx.xx/] (xxxxx://xxx.xxxxxxxxxxxxxx.xx/))You're responsible for making sure the information you give us is accurate and up to date, and you must tell us i f anything changes as soon as possible. If you would like to exercise any of these rightsprovide information for another person on your account, please contact our DPO (we may ask you to verify your identity - please cooperate with us in our efforts to verify your identity). Please note that we may need certain personal information to enable us to work with you and/or information to you, so changes you make to your preferences, or restrictions you ask us to make on how we use personal information, may affect what information we can provide. Please also note that sometimes we may not be able to stop using your personal information when you ask us to (for example, where we 'll need to use it because the law requires direct them to this notice and make sure they agree to us to do so or we need to need to retain the using their information for regulatory purposes). We will tell you if we are unable to comply with your request, or how your request may impact you, when you contact usas described in it.

Your Rights. In relation You have the right to ask us not to process your personal data for marketing purposes. We will usually inform you (before collecting your data) if we intend to use your data for such purposes or if we intend to disclose your information to any third party for such purposes and we will collect express consent from you if legally required prior to using your personal data for marketing purposes. You can exercise your right to accept or prevent such processing by checking certain boxes on the forms we use to collect your data. You can also exercise the right at any time by contacting us at xxx@xxxxxxxxxxxxxxxxxx.xx.xx Our site may, from time to time, contain links to and from the websites of our partner networks, advertisers and affiliates. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies. Please check these policies before you submit any personal data to these websites. The GDPR provides you with the following rights. To: • Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you, you corrected. • Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to: • get access to ask us to delete or remove your personal information and information about our where you have exercised your right to object to processing of it; (see below). • ask us Object to correct the record processing of your personal information maintained by us if it where we are relying on a legitimate interest (or those of a third party) and there is inaccurate r something about your particular situation which makes you want to complete incomplete personal information; • ask us, in certain limited instances, to erase your personal information or cease processing; • object to us processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes; . • challenge us Request the restriction of processing of your personal information which has been justified on information. This enables you to ask us to suspend the basis processing of ur legitimate interests; • ask us, in certain limited instances, to restrict processing personal information about you, for example if you want us to merely storing; establish its accuracy or the reason for processing it. • ask us, in certain limited instances, to Request the transfer of your personal information to another online provider; party in certain formats, if practicable. • object Make a complaint to decisions based solely a supervisory body which in the United Kingdom is the Information Commissioner’s Office. The ICO can be contacted through this link: xxxxx://xxx.xxx.xx/concerns/ Access to information The Data Protection Act 1998 and the GDPR give you the right to access information held about you. We also encourage you to contact us to ensure your data is accurate and complete. Your right of access can be exercised in accordance with the Act (and the GDPR once it is in force). A subject access request should be submitted to xxx@xxxxxxxxxxxxxxxxx.xx.xx Changes to our privacy notice Any changes we make to our privacy notice in the future will be posted on automated processingthis page and, including profiling; • prevent processing that is likely to cause damage or distress to you and seek compensation from us for any damages caused where appropriate, notified to you by us breaching DP Laws; • be notified of a personal data breach which is likely to result in high risk to your rights and freedoms; and • complain to the Data Protection Commissioner if you believe we have breached DPA Laws (please contact them ICO via [xxxxx://xxx.xxxxxxxxxxxxxx.xx/] (xxxxx://xxx.xxxxxxxxxxxxxx.xx/)). If you would like to exercise any of these rights, please contact our DPO (we may ask you to verify your identity - please cooperate with us in our efforts to verify your identity)e-mail. Please note that we may need certain personal information check back frequently to enable us see any updates or changes to work with you and/or information to you, so changes you make to your preferences, or restrictions you ask us to make on how we use personal information, may affect what information we can provide. Please also note that sometimes we may not be able to stop using your personal information when you ask us to (for example, where we need to use it because the law requires us to do so or we need to need to retain the information for regulatory purposes). We will tell you if we are unable to comply with your request, or how your request may impact you, when you contact usour privacy notice.

Your Rights. In relation to You may have rights under applicable laws concerning personal information we hold have collected about you, you have which may include the right to: • get to access to your personal information and information about our processing of it; • we have, to ask us to correct delete, correct, or restrict the record use of your personal information maintained by us if it is inaccurate r information, to complete incomplete withdraw your consent to our use of your personal information; • ask us, in certain limited instances, to erase ask how we have used your personal information or cease processing; • object information, and to ask whether we have shared your personal information. We will honor your rights under any such laws as applicable to us or as we may agree to honor in our sole discretion. Privacy Requests Privacy requests related to access to, rectification of, restriction of, processing of, sharing of, deletion of, or objection to the processing of your personal information for direct marketing purposes; • challenge us processing information, withdrawal of consent to handle your personal information which has been justified on information, or the basis right to be forgotten should be sent to one of ur legitimate interests; • ask usthe following: By email: xxxx@xxxxxxxxxxx.xxx By U.S. Mail: Hyperion Research Holdings, LLC 000 Xxxxxx Xxxxxx Saint Xxxx, MN 55102 All communications must be in certain limited instancesthe English language. We will respond to reasonable requests within the time limits established by applicable law or within a reasonable time if no time limit is established by applicable law. For your protection, to restrict processing personal information to merely storing; • ask us, in certain limited instances, to transfer your personal information to another online provider; • object to decisions based solely on automated processing, including profiling; • prevent processing that is likely to cause damage or distress to you and seek compensation from us for any damages caused to you by us breaching DP Laws; • be notified of a personal data breach which is likely to result in high risk to your rights and freedoms; and • complain to the Data Protection Commissioner if you believe we have breached DPA Laws (please contact them ICO via [xxxxx://xxx.xxxxxxxxxxxxxx.xx/] (xxxxx://xxx.xxxxxxxxxxxxxx.xx/)). If you would like to exercise any of these rights, please contact our DPO (we may ask you to verify your identity - please cooperate with us in our efforts for additional information to verify your identity). Please note that In most cases, we may need certain will provide the access you request and correct or delete any inaccurate personal information you discover. Hyperion Research reserves the right, however, to enable us limit or deny your request to work with you and/or information the extent permitted by applicable law if: (a) the disclosure may be a threat to youthe personal safety, so changes you make to your preferencesproperty, or restrictions rights of any other person or organization; (b) the disclosure may lead to a violation of applicable laws or regulations; or (c) where you ask us have failed to make on how we use personal information, may affect what information we can provide. Please also note that sometimes we may not be able provide sufficient evidence to stop using verify your personal information when you ask us to (for example, where we need to use it because the law requires us to do so or we need to need to retain the information for regulatory purposes)identity. We will tell not delete personal information if that personal information is necessary to preserve a legal right or fulfil a legal obligation. Changes to Privacy Policy We reserve the right to revise this Privacy Policy, in whole or in part, at any time without notice to you. You expressly waive any right to receive notice of any revisions to this Privacy Policy. We encourage you if we to review this Privacy Policy regularly in your use of the Site to ensure you are unable aware of current practices. Any use of the Site following the date on which the revised Privacy Policy is published on the Site shall constitute your acceptance of all such changes. Contact For questions or comments related to comply with your requestthe Site or this Privacy Policy, or how your request may impact youplease email us at xxxx@xxxxxxxxxxx.xxx. Last updated: January 3, when you contact us.2020

Your Rights. In relation As a data subject, you are entitled to a number of rights under the GDPR. • Request access to your personal information data (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it; • Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us. • Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to: • get access to your personal information and information about our processing of it; • ask us to correct the record of delete or remove your personal data where you have successfully exercised your right to object to processing where we may have processed your information maintained by us if it is inaccurate r to complete incomplete personal information; • ask us, in certain limited instances, unlawfully or where we are required to erase your personal information data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request. • Object to processing of your personal data where we are relying on a legitimate interest (or cease processing; • those of a third party) and there is something about your particular situation which makes you want to object to us processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal information data for direct marketing purposes; • challenge us processing . In some cases, we may demonstrate that we have compelling legitimate grounds to process your personal information which has been justified on the basis of ur legitimate interests; • ask us, in certain limited instances, to restrict processing personal information to merely storing; • ask us, in certain limited instances, to transfer your personal information to another online provider; • object to decisions based solely on automated processing, including profiling; • prevent processing that is likely to cause damage or distress to you and seek compensation from us for any damages caused to you by us breaching DP Laws; • be notified of a personal data breach which is likely to result in high risk to override your rights and freedoms; and . • complain Request restriction of processing of your personal data. This enables you to ask us to suspend the Data Protection Commissioner processing of your personal data in the following scenarios: (a) if you believe want us to establish the data’s accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your data but we need to verify whether we have breached DPA Laws (please contact them ICO via [xxxxx://xxx.xxxxxxxxxxxxxx.xx/] (xxxxx://xxx.xxxxxxxxxxxxxx.xx/))overriding legitimate grounds to use it. • Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you. • Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you would like to exercise any of these rightswithdraw your consent, please contact our DPO (we may ask you to verify your identity - please cooperate with us in our efforts to verify your identity). Please note that we may need certain personal information to enable us to work with you and/or information to you, so changes you make to your preferences, or restrictions you ask us to make on how we use personal information, may affect what information we can provide. Please also note that sometimes we may not be able to stop using your personal information when you ask us provide certain products or services to (for example, where we need to use it because the law requires us to do so or we need to need to retain the information for regulatory purposes)you. We will tell advise you if we are unable to comply this is the case at the time you withdraw your consent. Such rights may be exercised by contacting your usual contact within EXT or by contacting the EXT data protection officer directly at xxx@xxxxxx.xx. Such requests must be made by the relevant data subject and will be handled by us in accordance with your request, or how your request may impact you, when you contact usGDPR.