PERSONAL DATAPROTECTION POLICY

Client Personal Data Processing by TMF Group
April 2023 | Version 3.2

1 PERSONAL DATA PROTECTION POLICY
Client Personal Data Processing by TMF Group
April 2023 | Version 3.2 | Public

TABLE OF CONTENTS

GENERAL NOTICE3INTRODUCTION, SCOPE AND PURPOSE

5PERSONAL DATA PROCESSED BY TMF

6

USE OF PERSONAL DATA7SUBPROCESSING

8

CONFIDENTIALITY AND SECURITY

9

CO-OPERATING WITH REQUESTS OF CLIENT

10DELETION OR RETURN OF CLIENT PERSONAL DATA12INCIDENT MANAGEMENT

13

INTERNATIONAL TRANSFERS OF PERSONAL DATA14LIABILITY

16

CONTACT US

17

DEFINITIONS AND ABBREVIATIONS18

REFERENCE TO ASSOCIATED DOCUMENTS

20

REVISION HISTORY AND RECORDS

21

2 PERSONAL DATA PROTECTION POLICY
Client Personal Data Processing by TMF Group
April 2023 | Version 3.2 | Public

GENERAL NOTICEThis document falls under TMF Group Risk and Compliance – Group Privacy
Office governance. The following applies to this document:This document is controlled as part of TMF Group Risk and Compliance – Group Privacy Office
governance.
No changes to this document are permitted without formal approval from the document owner.
This document is classified, version controlled and regularly reviewed.
Any questions regarding this document should be raised to the owner.
Distribution, modifications and access must be addressed based on TMF Group’s information
classification.
The version of this document can be found on the cover page.
Revision details are described below.
This document may be available in various languages; however, the version in the English
language will prevail.

3 PERSONAL DATA PROTECTION POLICY
Client Personal Data Processing by TMF Group
April 2023 | Version 3.2 | PublicCLASSIFICATION
PublicSTAKEHOLDERS
Owner

Data Privacy Manager

ApproverTMF Group Management Board

REVIEW
PeriodAnnualLast review

April 2023

StatusApproved

Approval on

28 April 2023

Effective date

1 May 2023

CONTACT POINT
Contact

dataprotection@tmf-group.com

4 PERSONAL DATA PROTECTION POLICY
Client Personal Data Processing by TMF Group
April 2023 | Version 3.2 | Public

INTRODUCTION, SCOPE AND PURPOSE

This Personal Data Protection Policy ("Policy") describes the privacy practices of TMF regarding
processing Personal Data of Client Data Subjects and – to the extent applicable – the customers of
the Client and/or the relevant Client Affiliates, as part of provision of Services to its Clients. Personal
Data can be stored in TMF systems, Client systems or third-party systems to which TMF is provided
access to for the purpose of providing Services. Where TMF provides Services to its Client andprocesses Personal Data on Client’s behalf, TMF will be acting as Processor and the Client will be
acting as Controller.
The Policy applies globally to any and all Services provided by TMF to its Clients under the Service
Agreements where TMF is acting as Processor, executed on or after the effective date of this Policy.
TMF processes Personal Data on behalf of the Client in accordance with Data Protection Laws.
Insofar necessary, the Service Agreement will be supplemented with an addendum to set out any
additional matters that are specific to the Client and cannot be regulated in this Policy.
This Policy does not apply to processing of Personal Data for which TMF is considered Controller .
Such processing is governed by the Privacy Statement of TMF Group and any other relevant privacy
statement or policy presented to the Client or to other data subjects whose/which Personal Data TMF
processes as Controller
The Policy is available through the TMF Group website at the following link: https://www.tmfgroup.com/en/legal/data-protection/. TMF reserves the right to update this Policy without consulting or
pre-informing Clients.
Notwithstanding the foregoing, the version of the Policy that applies and will continue to apply to aparticular Service Agreement will be the version of the Policy that is in effect at the time of theeffective date of such Service Agreement, unless amendments are required to comply with Data
Protection Laws in which case the most recent version of the Policy published on the website shallapply.

5 PERSONAL DATA PROTECTION POLICY
Client Personal Data Processing by TMF Group
April 2023 | Version 3.2 | Public

PERSONAL DATA PROCESSED BY TMF

Details of Personal Data that will be processed by TMF on behalf of the Client, including the duration,
purpose and types and categories of Personal Data, as well as Subprocessors, if any, will be set out
on TMF Group website pages Details of Processing (https://www.tmf-group.com/en/legal/dataprotection/details-of-processing/) and Subprocessors (https://www.tmf-group.com/en/legal/dataprotection/subprocessors/) respectively.
Where additional authorizations or consents are required from the Client Data Subjects underapplicable Data Protection Laws to process Personal Data on behalf of the Client, the Client shallcollect such authorization or consent from the Client Data Subjects for the respective processing
activity of the Personal Data, as required under Data Protection Laws.

6 PERSONAL DATA PROTECTION POLICY
Client Personal Data Processing by TMF Group
April 2023 | Version 3.2 | Public

USE OF PERSONAL DATATMF shall not process, transfer, modify, amend or alter Personal Data or disclose or permit disclosureof Personal Data to any third party other than:•as necessary to process Personal Data to provide Services and/or otherwise in accordance withthe documented instructions of Client; or•as required to comply with Data Protection Laws or other laws which TMF is subject to, in whichcase TMF shall (to the extent permitted by law) inform Client of that legal requirement before
processing Personal Data.

In addition, TMF is allowed to use aggregated data – to the extent this can no longer be considered
Personal Data and which is, therefore, not subject to Data Protection Laws - for analysing purposes,
for website and for internal operations, including troubleshooting, data analysis, testing, research, forstatistical purposes, for developing and improving Services and products of TMF as well as
benchmarking.

7 PERSONAL DATA PROTECTION POLICY
Client Personal Data Processing by TMF Group
April 2023 | Version 3.2 | Public

SUBPROCESSINGTMF may be required to appoint certain third parties, including TMF Affiliates, to provide part ofServices to Client or assist with providing technical support, such as IT service providers or othersuppliers.
By signing the Service Agreement Client authorises TMF to subcontract processing Personal Data to
Subprocessors in the relevant countries where Services will be rendered as listed on Subprocessors(https://www.tmf-group.com/en/legal/data-protection/subprocessors) page. Subprocessors are in eachcase subject to the terms between TMF and Subprocessor which are no less protective than those set
out in the Policy and the Service Agreement.
TMF will inform the Client of the details of such Subprocessor(s) upon written request from the Client.
TMF will inform the Client in advance of any intended changes concerning the addition or
replacement of Subprocessors and thereby give the Client the opportunity to object to such changes.
If the Client does not provide its contact details on the Subprocessors page or does not object inwriting within fifteen (15) calendar days of receipt of the notice, the Client is deemed to have accepted
the new Subprocessor. If the Client does object in writing within fifteen (15) calendar days of receipt of
the notice, TMF and the Client will discuss possible resolutions within a reasonable timeframe andwithout detriment to the Parties and to their compliance with each of their respective obligations set
forth in the Service Agreement.
Where the TMF Affiliate were to appoint another TMF Affiliate to process Client Personal Data on
behalf of Client, TMF Affiliate will inform the Client in advance of such appointment and thereby give
the Client an opportunity to object to such change. If the Client does not object in writing within five (5)calendar days of receipt of the notice, the Client has deemed to have accepted the respective TMF
Affiliate as a new Subprocessor.

8 PERSONAL DATA PROTECTION POLICY
Client Personal Data Processing by TMF Group
April 2023 | Version 3.2 | PublicCONFIDENTIALITY AND SECURITY

TMF shall keep Personal Data confidential and will ensure its staff and Subprocessors are bound by
the same confidentiality obligation. TMF shall implement appropriate technical and organisational
measures to ensure a level of security of Personal Data appropriate to the risk required pursuant toapplicable Data Protection Laws and, shall take all measures required pursuant to Article 32 GDPR
(security of processing) and any other more protective corresponding requirement under Data
Protection Laws.
In assessing the appropriate level of security, TMF shall take account in particular of the risks that arepresented by processing, in particular from accidental or unlawful destruction, loss, alteration,
unauthorised disclosure of, or access to Personal Data transmitted, stored or otherwise processed.
The security measures are further described and specified in the document "Statement ofContinuity", which is published on the TMF website (https://www.tmf-group.com/en/legal/dataprotection/). Any subsequent versions of the document Statement of Continuity shall be applicable to
the Service Agreement and its content will be no less stringent than its previous version.

9 PERSONAL DATA PROTECTION POLICY
Client Personal Data Processing by TMF Group
April 2023 | Version 3.2 | Public

CO-OPERATING WITH REQUESTS OF
CLIENT

TMF shall, upon request and to the extent required under Data Protection Laws, co-operate withrequests of Client that relate to processing of Personal Data. In particular, TMF shall co-operate withrequests that relate to Client Data Subject rights, data protection impact assessments and Data
Protection Audit rights as described below.
Client Data Subject rights: TMF shall co-operate as requested by Client to enable the Client tocomply with its obligations with any exercise of rights by Client Data Subject in respect of Personal
Data and reasonably assist Client in its compliance with any assessment, enquiry, notice orinvestigation as required under Data Protection Laws. In case the assistance provided by TMF to the
Client exceeds the reasonable assistance, the Client shall reimburse TMF in full for all costs(including for internal resources and any third party costs) reasonably incurred by TMF providing theassistance that exceeds the reasonable limits in performing its obligation to assist Client in its
compliance under this section.
Data protection impact assessment: TMF shall provide reasonable assistance to the Client withany data protection impact assessments which are required under Data Protection Laws, including
Article 35 GDPR or other corresponding obligations determined by Data Protection Laws, and withany prior consultations to any supervisory authority of the Client which are required under Data
Protection Laws, including Article 36 GDPR or other corresponding obligations determined by Data
Protection Laws, in each case in relation to Processing of Personal Data by TMF on behalf of the
Client and taking into account the nature of the processing and information available to TMF.
Audit rights: On reasonable request and notice, TMF will co-operate in the conduct of any Data
Protection Audit or inspection, reasonably necessary to demonstrate TMF's compliance with
Processor’s obligations laid down in Data Protection Laws and the Policy related to the Service
Agreement, provided always that this requirement will not oblige TMF to provide or permit access to
information concerning: (i) TMF internal pricing information, (ii) information relating to TMF's other
Clients, (iii) any of TMF non-public external reports, or (iv) any internal reports prepared by TMF's
internal audit function.
The Client shall avoid causing any damage, injury or disruption to TMF's equipment, personnel andbusiness in the course of such Data Protection Audit or inspection.
A maximum of one Data Protection Audit may be activated under this section in any twelve (12)month period at no additional cost to the Client, unless (i) the audit is following upon a Personal Data
Breach caused by TMF in the same period, (ii) the Data Protection Audit request made by the Clientin the same period would exceed commercially reasonable market audit standard costs and/or (iii)
Data Protection Audit request made by the Client in the same period would require allocation of TMF
internal resources for more than one (1) business day in order to fulfil the request. In the foregoing
10 PERSONAL DATA PROTECTION POLICY
Client Personal Data Processing by TMF Group
April 2023 | Version 3.2 | Public

events, TMF will promptly notify Client of such additional expected costs in advance, for which Clientand TMF will agree to such costs prior to initiating the referred Data Protection Audit request. Any
further Data Protection Audit within the referred twelve (12) month period shall be at the Client’s
expense.
The Client’s requests provided in this section 6 of the Policy will be fulfilled in close co-operation withand under supervision of TMF's Chief Security and Resilience Officer, TMF’s Chief Privacy Officer, or
similar stakeholders of TMF local officials.

11 PERSONAL DATA PROTECTION POLICY
Client Personal Data Processing by TMF Group
April 2023 | Version 3.2 | PublicDELETION OR RETURN OF CLIENTPERSONAL DATA

TMF will, at the choice of Client, delete or return Personal Data at the end of the provision of theServices involving processing, unless (i) Data Protection Laws, (ii) any law, statute, order, regulation,
rule, requirement, practice and guidelines of any government, regulatory authority or self-regulatingorganization that applies to the Services in the country where those Services are being provided, or(iii) competent court, supervisory or regulatory body, require the retention of such Personal Data by
TMF.

12 PERSONAL DATA PROTECTION POLICY
Client Personal Data Processing by TMF Group
April 2023 | Version 3.2 | Public

INCIDENT MANAGEMENTTMF shall notify Client without undue delay after becoming aware of a Personal Data Breach,providing the Client with sufficient information which allows the Client to meet any obligations to reporta Personal Data Breach under Data Protection Laws.
Upon request by the Client, TMF shall fully co-operate with the Client and take such reasonable steps
as are directed by the Client to assist in the investigation, mitigation and remediation of each Personal
Data Breach, in order to enable the Client to (i) perform a thorough investigation into the Personal
Data Breach and provide incident details as required under Data Protection Laws such as Article
33(3) GDPR or other corresponding obligations determined by Data Protection Laws, (ii) formulate acorrect response and (iii) take suitable further steps in respect of the Personal Data breach in order tomeet any requirement under the Data Protection Laws (“Remediation Measures”).
If TMF caused the Personal Data Breach, TMF shall bear the reasonable costs of Remediation
Measures taken by TMF.
If and to the extent costs incurred by TMF related to Remediation Measures as directed by the Client
are related to the Personal Data Breach caused by the Client, the Client shall compensate reasonable
costs of the Remediation Measures taken by TMF. Any costs borne by TMF that exceed thosereasonable costs for Remediation Measures shall be mutually agreed by parties to Service
Agreement in advance.
Remediation Measures shall: (i) start without undue delay, (ii) be completed within a reasonable
period after TMF has become aware of a Personal Data Breach, and (iii) be carried out within theregular business hours of TMF where Remediation Measures are required to be taken.

13 PERSONAL DATA PROTECTION POLICY
Client Personal Data Processing by TMF Group
April 2023 | Version 3.2 | Public

INTERNATIONAL TRANSFERS OFPERSONAL DATA

Always subject to section 3 and section 4 of the Policy and in the event Services require internationaltransfers of Personal Data between TMF, TMF Affiliate(s) and/or any Subprocessor(s), the following
shall apply (insofar relevant):
a. Transfer to TMF Affiliates in or from EU. Personal Data may be transferred to:(i) one or more of TMF Affiliates in either one or more member states of the European Economic
Area ("EEA"), Switzerland or the UK on the basis of Data Protection Laws; or(ii) one or more of TMF Affiliates in one or more third countries on the basis of the Binding
Corporate Rules, which are published on the website of TMF Group (https://www.tmfgroup.com/en/legal/data-protection/binding-corporate-rules/).
The Client or the relevant TMF Affiliate shall upon request of the Client Data Subject provide the
Client Data Subject with a copy of such Binding Corporate Rules and this Policy (without any
business sensitive or confidential information).
Where permitted by Data Protection Laws, TMF shall obtain all relevant authorizations or permits
for such transfer of Personal Data based on such Binding Corporate Rules. Where Data
Protection Laws do not allow TMF to obtain such authorization or permit for itself, the Client shallin a timely manner issue a required authorisation to TMF and any other relevant TMF Affiliate.
In the event the Binding Corporate Rules were not recognized or applicable under Data Protection
Laws of a specific jurisdiction, TMF and the relevant TMF Affiliate(s) will undertake the necessary
actions to satisfy the cross-border transfer requirements applicable to Personal Data under the
Data Protection Laws of that jurisdiction.
b. Transfer to Subprocessors in or from EU. Personal Data may be transferred to:(i) one or more Subprocessors (other than TMF Affiliates) in one or more member states of the
EEA, Switzerland or the UK on the basis of Data Protection Laws pursuant to the Clients
authorisation under section 4 of this Policy; or(ii) one or more such Subprocessors in one or more third countries on the basis of an exception
under Data Protection Laws; or(iii) on the basis of adequate safeguards added either, insofar as allowed under Data Protection
Laws, by TMF to ensure protection of Personal Data, or by the Client, in which case TMF
shall cooperate with the Client to seek an adequate basis for the cross-border transfer of
14 PERSONAL DATA PROTECTION POLICY
Client Personal Data Processing by TMF Group
April 2023 | Version 3.2 | PublicPersonal Data to such Subprocessor. At the Client's request, TMF shall inform the Client of
the applicable basis for the cross-transfer of Personal Data.
c.

Transfer between Client and TMF. Where the Services provided by TMF would require aninternational transfer of Personal Data from one of the parties, either Client or TMF, located in amember state of the EEA to another party, respectively Client or TMF, located in a country notsupported by an adequacy decision from the EU Commission for the cross-border transfer of
Personal Data, the Client and TMF will duly execute the relevant EU Standard Contractual
Clauses for such specific transfer, pursuant to the requirements set forth under the GDPR.

d. Other transfers. Pursuant to the Data Protection Laws outside the EEA, Switzerland or the UK
applicable to the Personal Data Processed to render the Services, the Client – acting asController – shall ensure that any cross-border transfer of Personal Data from TMF to a
Subprocessor shall be allowed, by implementing additional safeguards as required under those
Data Protection Laws. If such Data Protection Laws would require further information to beprovided to the Client Data Subjects or further consents to be obtained by the Controller, theClient shall take these additional steps before the transfer to TMF and/or TMF Affiliates is taking
place.

15 PERSONAL DATA PROTECTION POLICY
Client Personal Data Processing by TMF Group
April 2023 | Version 3.2 | Public

LIABILITY

Client warrants that Personal Data processed by TMF on behalf of the Client has been and shall beprocessed by the Client in accordance with Data Protection Laws, including without limitation:a. ensuring that all notifications to and approvals from regulators which are required by Data
Protection Laws are made and maintained by the Client; andb. ensuring that all Personal Data is processed fairly and lawfully, is accurate and up to date andthat a fair notice is provided by the Client to Client Data Subjects which described processing to
be undertaken by TMF or its Subprocessors pursuant to the Services agreed upon in the Service
Agreement.
TMF shall be liable for the damage caused by processing only where it has not complied withobligations of Data Protection Laws specifically directed to Processor or where it has acted outside orcontrary to lawful instructions of the Client as indicated in the Service Agreement. Client shall be liable
for the damage caused by processing by Client which infringes Data Protection Laws. TMF shall be
exempt from liability under this section 10 of the Policy if it proves that it is not in any way responsible
for the event giving rise to the damage.
Where more than one Controller or Processor, or both Controller and Processor, are involved in thesame processing and where they are, under the Service Agreement, responsible for any damage
caused to Client Data Subject by processing, each Controller or Processor shall be held liable for theentire damage in order to ensure effective compensation of Client Data Subject(s). Where Controller
or Processor has paid full compensation for the damage suffered, that Controller or Processor shallbe entitled to claim back from the other Controller(s) or Processor(s) involved in the same processingthat part of the compensation corresponding to their part of responsibility for the damage, in
accordance with the conditions set out in the previous paragraph.
Save for this section 10 third paragraph of the Policy, the indemnities, liabilities and exclusions orlimitations thereof set out in the Service Agreement, shall also apply to the obligations of the parties
pursuant to the Policy and the Service Agreement, and in case of any conflict will prevail.

16 PERSONAL DATA PROTECTION POLICY
Client Personal Data Processing by TMF Group
April 2023 | Version 3.2 | Public

CONTACT US

If you have any queries about the Policy or about the privacy practices of TMF Group, please send an
email to dataprotection@tmf-group.com and be sure to indicate the nature of your query.
Information about rights of Clients or data subjects whose/which Personal Data TMF processes asController, including with regard to details of processing activities regarding their Personal Data,transfers of their Personal Data within TMF Group, and principles related to processing their Personal
Data that TMF Group applies, are included in the Privacy Statement of TMF Group, available on TMF
Group website (https://www.tmf-group.com/en/legal/privacy-statement/).

17 PERSONAL DATA PROTECTION POLICY
Client Personal Data Processing by TMF Group
April 2023 | Version 3.2 | Public

DEFINITIONS AND ABBREVIATIONS

The capitalized terms and abbreviations listed below, have the follow meaning in this Policy:
TERM

DEFINITION

Clientmeans the counterparty to the Service Agreement with TMF.

Client Affiliate

means any legal entity affiliated to the Client.

Client Data
Subjects

mean the former and current employees and customers of the Client and Client
Affiliates and any other categories of data subjects of which Client entrusts TMF forprocessing their Personal Data in order to perform Services.

Controllermeans the natural or legal person, public authority, agency or other body which, alone
or jointly with others, determines the purposes and means of processing of Personal
Data.

Data Protection
Audit

means audits, including data protection compliance questionnaires, carried out by
Client or a third-party on behalf of Client, with the objective to verify TMF compliancewith the data protection obligations stated in the Service Agreement and the Policy.

Data Protection
Laws

means in relation to any Personal Data which is processed in the performance ofService Agreement, GDPR together with all implementing laws and any otherapplicable data protection laws, privacy laws or privacy regulations. Any references tospecific clauses of the GDPR in the Policy shall also be understood as references tothe corresponding clauses of any other applicable data protection laws, privacy laws
or privacy regulations, if applicable.

data subject(s)means (i) an identified or identifiable natural person; an identifiable natural person is
one who can be identified, directly or indirectly, in particular by reference to an
identification number or to one or more factors specific to his/her physical,
physiological, mental, economic, cultural or social identity; and (ii) only if so provided
by national laws of a given country – a legal person.

GDPR

means Regulation (EU) 2016/679 of the European Parliament and of the Councilof 27 April 2016 on the protection of natural persons with regard to the processingof personal data and on the free movement of such data, and repealing Directive
95/46/EC (General Data Protection Regulation) (Official Journal of the European
Union, L 119/1).

Personal Data

means any information that Client entrusts TMF for processing through which a Client
or a Client Data Subject can be identified directly or indirectly, including any otherinformation if and to the extent that information is protected by Data Protection Laws.

Personal Data
Breachmeans a breach of security leading to the accidental or unlawful destruction, loss,
alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored
or otherwise processed.

processingmeans any operation or set of operations which is performed upon Personal Data or
on sets of Personal Data, whether or not by automated means, such as collection,
recording, organization, structuring, storage, adaptation or alteration, retrieval,consultation, use, disclosure by transmission, dissemination or otherwise making
available, alignment or combination, restriction, erasure or destruction.

18 PERSONAL DATA PROTECTION POLICY
Client Personal Data Processing by TMF Group
April 2023 | Version 3.2 | Public

Processor

means the natural or legal person, public authority, agency or other body which
processes Personal Data on behalf of Controller.

Remediation
Measureshave a meaning as provided for in section 8 of the Policy.

Servicesmeans services TMF provides to Client under Service Agreement.

Service Agreementmeans any written contract, any written statement of work, or any other written binding
agreement, including any annexes thereto, between TMF and Client.

EU Standard
Contractual Clausesmeans the Standard Contractual Clauses for the transfer of personal data to third
Countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of
the Council adopted by the European Commission Decision 2021/914 of 4 June 2021,
as updated from time to time.

Subprocessor

means any third party appointed or engaged by Processor to Process Personal Dataon behalf of the Controller.

TMF

means the TMF Affiliate that is the contracting entity to the Service Agreement.

TMF Affiliate

means with respect to any specified person or entity, any other person or entity
directly or indirectly controlling or controlled by or under direct or indirect common
control of TMF Group B.V., including it. For the purpose of this definition, “control”,
when used with respect of any specified person or entity means the power to direct or
cause the direction of the management or policies of such person or entity, whether
through ownership of voting securities or by contract or otherwise. The terms“controlling” and “control” have meaning correlative to the foregoing. Specifically
excluded from this definition are the shareholding companies controlling TMF Group
B.V.

19 PERSONAL DATA PROTECTION POLICY
Client Personal Data Processing by TMF Group
April 2023 | Version 3.2 | Public

REFERENCE TO ASSOCIATED DOCUMENT S

RELATED STANDARDSStatement of Continuity

Latest version available on the website of TMF Group

Binding Corporate Rules for
Processing Client Personal Data
(Processor)

Latest version available on the website of TMF GroupRELATED DOCUMENTSBCR Controller Extract

Latest version available on the website of TMF Group

20 PERSONAL DATA PROTECTION POLICY
Client Personal Data Processing by TMF Group
April 2023 | Version 3.2 | Public

REVISION HISTORY AND RECORDS

VERSIONDATE

AUTHORDETAILS

v.1.0

01-03-2018

Chief Privacy Officer

First version approved.

v.2.0

29-04-2019

Chief Privacy Officer

Sections 1, 3, 6, 7, 9, 10 and 11 revised to clarify TMF
Group Personal Data Processing role and duties.

v.2.1

24-01-2020

Chief Privacy Officer

Sections 3 and 5 revised to include the details ofprocessing and the list of Subprocessors links.

v.2.2

17-05-2021

Group Privacy OfficeSection 1 revised to clarify appliable version of Policy to
the Services Agreement, as well as amendments
required by law.
Section 2 updated to include definitions for “Data
Protection Audit” and “Personal Data Breach”.
Section 5 revised to increase number of days forcontroller to object to appointment of new
subprocessor(s) and clarifying language for potential
resolutions upon objection.
Section 6 revised to clarify application of further
versions of the Statement of Continuity.
Section 7 revised language to clarify obligations underdata protection laws, inclusion of new defined terms andupdate due to organisational change.
Section 9 updated to include allocation of costs for
personal data breaches caused by TMF

v.3.0

20-05-2022

Senior Privacy Officer

Template updated to the most recent version.
Section 1 revised as to clarify TMF Affiliate role as a
Processor for the purpose of this Policy and reference
to the TMF Group Privacy Statement, where links areavailable for situations where TMF Affiliate processes
Personal Data as a Controller.
Former section 2 (Definitions) moved to an appendix –Definitions and Abbreviations.
Section 2 updated to contemplate client obligations withregards to data subjects under data protection laws.
Section 3 revised language to clarify concept ofaggregated data.
Section 4 updated language to clarify notification
mechanism and objection period: language added for
notification and authorization obligations in the event
TMF Affiliate acts as a Subprocessor.
Section 5 revised language to clarify legal coverage of
security requirements under Data Protection Laws.
Section 6 revised language to include commercial costs
resulting from Data Protection Audits.
Section 8 revised language to contemplate compliancewith additional legal requirements in relation to Personal
Data Breaches.
Section 9 revised language to comply with international
data transfers requirements under current Data
Protection Laws, including EU Standard Contractual

21 PERSONAL DATA PROTECTION POLICY
Client Personal Data Processing by TMF Group
April 2023 | Version 3.2 | PublicClauses.
Section 10 revised to include liability of TMF Affiliate forappointed Subprocessors.
Section 11 updated to include reference to theController BCR Extract.
Definitions and Abbreviations - updated to include
definition “EU Standard Contractual Clauses” andrevised language added to definitions “Data ProtectionLaws”, “Personal Data”, “Subprocessors” and “TMF
Affiliate” to provide legal coverage and clarification on
data protection laws requirements.
v.3.1

18-08-2022

Senior Privacy Officer

Numbering was adjusted.
Section 3 updated with regard to purposes for which
aggregated data could be used.

v.3.2

21-03-2023

Privacy Officer

Section 1 - revised as to use the definition of Client Data
Subjects where required and clarify the scope of
application of the TMF Group Privacy Statement.
Section 4 - slightly updated for consistency purposes toalign the wording used for the type of days forobjections (calendar days).
Section 6 - revised language to clarify the costs
resulting from the assistance provided by TMF to the
Client that exceeds the reasonable assistance withrespect to Client Data Subject rights. Section 6
comprises adjusted wording to include thecorrespondent stakeholders of the TMF local officesimilar to TMF's Chief Security and Resilience Officer,
TMF’s Chief Privacy Officer to be involved incooperation with and supervision in case of Data
Protection Audit.
Section 9 - updated language regarding the pre-signed
version of EU Standard Contractual Clauses.
Section 10 - revised to clarify that the Client’s
responsibility to provide a notice to Client Data Subjects
describing the Processing to be undertaken by TMF or
its Subprocessors pursuant to the Services agreed uponin the Service Agreement.
Section 11 - updated to include a reference to thedetails of processing activities provided in the TMF
Group Privacy Statement.
Definitions and Abbreviations - updated to include thedefinition “Processor”.

22 PERSONAL DATA PROTECTION POLICY
Client Personal Data Processing by TMF Group
April 2023 | Version 3.2 | Public