PERSONAL DATAPROTECTION POLICY
Client Personal Data Processing by TMF GroupMarch 2018 | Version 1.0TABLE OF CONTENTS

GENERAL NOTICE31.

INTRODUCTION AND SCOPE

52.

DEFINITIONS63.

PERSONAL DATA PROCESSED BY TMF

74.

USE OF PERSONAL DATA75.

SUBPROCESSING

86.

CONFIDENTIALITY AND SECURITY

87.

CO-OPERATING WITH REQUESTS OF THE CLIENT

98.

DELETION OR RETURN OF CLIENT PERSONAL DATA109.

INCIDENT MANAGEMENT

1010.

INTERNATIONAL TRANSFERS OF CLIENT PERSONAL DATA

1111.

INDEMNIFICATION

1212.

CONTACT US

12REFERENCE TO ASSOCIATED DOCUMENTS

13REVISION HISTORY AND RECORDS

132Personal Data Protection Policy | Client Personal Data Processing by TMF Group
March 2018 | Version 1.0 | Public

GENERAL NOTICEThis document falls under TMF Group Legal, Compliance & Risk Management
govervance control. The following applies to this document:This document is controlled as part of TMF Group Legal, Compliance & Risk
Management governance control.
No changes to this document are permitted without formal approval from the documentowner.
This document is classified, version controlled and regularly reviewed.
Any questions regarding this document should be raised to the owner.
Distribution, modifications and access must be addressed based on TMF Group’s DataClassification Policy.
The version of this document can be found on the cover page.
Revision details are described below.
This document may be available in various languages; however the version in the English
language will prevail.

3

Personal Data Protection Policy | Client Personal Data Processing by TMF Group
March 2018 | Version 1.0 | PublicCLASSIFICATION
PublicSTAKEHOLDERS
Owner

Chief Privacy OfficerApprover

TMF Group Board / Risk & Compliance Committee

Custodian

General Counsel / Head of Group Legal, Compliance and Risk Management

Sponsor

CEOREVIEW
PeriodAnnualLast review

March 2018

StatusFinalApproval on

1 March 2018

Effective date

1 March 2018CONTACT POINTContact

4

dataprotection@tmf-group.com

Personal Data Protection Policy | Client Personal Data Processing by TMF Group
March 2018 | Version 1.0 | Public

1. INTRODUCTION AND SCOPE

This Personal Data Protection Policy ("Policy") describes the privacy practices of TMF
regarding the Processing of Personal Data of the directors, officers and employees and – tothe extent applicable – the customers of the Client and/or the relevant Client Affiliates, aspart of the provision of TMF Services to its Clients. This Personal Data can be stored on
TMF systems, Client systems or third-party systems to which TMF is provided access to forthe provision of Services. Where TMF provides Services to its Clients, TMF will be acting as
Processor and the Client will be acting as Controller. This Policy applies globally to any andall Services provided by TMF to its Clients.
TMF Processes Personal Data on behalf of the Client in accordance with Data Protection
Laws. Insofar necessary, the Service Agreement will be supplemented with an Addendum toset out any additional matters that are specific to the Client and cannot be regulated in thisPolicy.
This Policy does not apply to the collection of Personal Data through our website or throughcookies with respect to which Personal data TMF can be considered Controller; we refer toour separate Website Privacy Statement and Cookies Policy for more information in thisregard.
This Policy is available through the TMF Group website at the following link: https://www.tmfgroup.com/en/legal/data-protection/. TMF reserves the right to update this Policy without
consulting or pre-informing its Clients.

5Personal Data Protection Policy | Client Personal Data Processing by TMF Group
March 2018 | Version 1.0 | Public

2. DEFINITIONS

The capitalized terms listed below have the follow meaning in this Policy:
a. “Client” means the counterparty to the Service Agreement with TMF;
b. “Client Affiliate” means any legal entity affiliated to the Client;c. “Client Data Subjects” shall mean the former and current directors, officers andemployees and customers of the Client and Client Affiliates;d. “Controller” shall mean the natural or legal person, public authority, agency or otherbody which, alone or jointly with others, determines the purposes and means of theProcessing of Personal Data;e. “Data Protection Laws” means in relation to any Personal Data which is Processedin the performance of the Service Agreement, the General Data Protection
Regulation (EU) 2016/679 ("GDPR") together with all implementing laws and anyother applicable data protection, privacy laws or privacy regulations;f. “Personal Data” means any information through which a Client Data Subject can be
identified directly or indirectly;
g. “Processing” means any operation or set of operations which is performed upon
Personal Data or on sets of Personal Data, whether or not by automated means,such as collection, recording, organization, structuring, storage, adaptation oralteration, retrieval, consultation, use, disclosure by transmission, dissemination orotherwise making available, alignment or combination, restriction, erasure ordestruction;h. “Processor” shall mean the party, which Processes Personal Data on behalf of theController;
i. “Services” means services TMF provides to the Client under the Service Agreement;
j. “Service Agreement” means any written contract, any written statement of work, or
any other written binding agreement, including any annexes thereto, between TMF
and the Client;k. “Subprocessor” means any data processor appointed by Processor to process
Personal Data on behalf of the Controller;
l. “TMF” means TMF Affiliate that is the contracting entity to the Service Agreement;
m. “TMF Affiliate” means with respect to any specified person or entity, any otherperson or entity directly or indirectly controlling or controlled by or under direct orindirect common control with such specified person or entity. For the purpose of thisdefinition, “control”, when used with respect of any specified person or entity means
the power to direct or cause the direction of the management or policies of such
6

Personal Data Protection Policy | Client Personal Data Processing by TMF Group
March 2018 | Version 1.0 | Publicperson or entity, whether through ownership of voting securities or by contract orotherwise. The terms “controlling” and “control” have meaning correlative to theforegoing. Specifically excluded from this definition are the shareholding companies
controlling TMF Group B.V.

3. PERSONAL DATA PROCESSED BY TMF

The details of the Personal Data that will be Processed by TMF on behalf of the Client,including the duration, purpose and categories of Personal Data, will be set out in (theAddendum to) the Service Agreement.

4. USE OF PERSONAL DATATMF shall not process, transfer, modify, amend or alter the Personal Data or disclose orpermit the disclosure of the Personal Data to any third party other than:as necessary to process Personal Data to provide the Services and/or otherwise inaccordance with the documented instructions of Client, oras required to comply with Data Protection Laws or other laws to which TMF is subject, inwhich case TMF shall (to the extent permitted by law) inform Client of that legal
requirement before processing the Personal Data.
In addition, TMF is allowed to use aggregated data – to the extent this can no longer beconsidered Personal Data - for analysing purposes, for website and for internal operations,
including troubleshooting, data analysis, testing, research, for statistical purposes and forimproving the quality of its Services.

7Personal Data Protection Policy | Client Personal Data Processing by TMF Group
March 2018 | Version 1.0 | Public

5. SUBPROCESSINGTMF may be required to appoint certain third parties to provide part of the Services to theClient or assist with providing technical support, such as IT service providers or othersuppliers. By signing the Service Agreement, the Client authorises TMF to subcontract theProcessing of Personal Data to Subprocessors. Subprocessors are in each case subject tothe terms between TMF and the Subprocessor which are no less protective than those set
out in this Policy and the Service Agreement. TMF will inform the Client of the details of such
Subprocessor(s) upon written request from the Client. TMF will inform the Client in advanceof any intended changes concerning the addition or replacement of Subprocessors andthereby give the Client the opportunity to object to such changes. If the Client does not
object in writing within five (5) days of receipt of the notice, the Client is deemed to haveaccepted the new Subprocessor. If the Client does object in writing within five (5) days ofreceipt of the notice, TMF and the Client will discuss possible resolutions.

6. CONFIDENTIALITY AND SECURITY

TMF shall keep the Personal Data confidential and will instruct its staff and Subprocessors tothe same. TMF shall implement appropriate technical and organisational measures toensure a level of security of the Personal Data appropriate to the risk required pursuant toapplicable Data Protection Laws and, where the Processing concerns personal data of EUresidents, shall take all measures required pursuant to article 32 GDPR. In assessing theappropriate level of security, TMF shall take account in particular of the risks that arepresented by Processing, in particular from accidental or unlawful destruction, loss,alteration, unauthorised disclosure of, or access to Personal Data transmitted, stored orotherwise processed. The security measures are further described and specified in thedocument "Statement of Continuity", which is published on the TMF website(https://www.tmf-group.com/en/legal/data-protection/) and forms an integral part of thisPolicy.

8

Personal Data Protection Policy | Client Personal Data Processing by TMF Group
March 2018 | Version 1.0 | Public

7. CO-OPERATING WITH REQUESTS OF
THE CLIENTTMF shall, upon request and to the extent required under Data Protection Laws, co-operatewith requests of the Client that relate to the Processing of Personal Data. In particular, TMF
shall co-operate with requests that relate to Client Data Subject rights, Data Protection
Impact Assessments and audit rights as described below.
Client Data Subject rights: TMF shall co-operate as requested by the Client to enable theClient to comply with any exercise of rights by a Client Data Subject in respect of Personal
Data and comply with any assessment, enquiry, notice or investigation under Data
Protection Laws. Provided in each case that the Client shall reimburse TMF in full for allcosts (including for internal resources and any third party costs) reasonably incurred by TMF
performing its obligation under this section.
Data Protection Impact Assessment: TMF shall provide reasonable assistance to the Clientwith any data protection impact assessments which are required under Article 35 GDPR andwith any prior consultations to any Supervisory Authority of the Client which are required
under Article 36 GDPR, in each case in relation to Processing of Personal Data by TMF on
behalf of the Client and taking into account the nature of the processing and information
available to TMF.
Audit rights: On reasonable request and notice and at the Client's expense, TMF will cooperate in the conduct of any audit or inspection, reasonably necessary to demonstrate
TMF's compliance with the obligations laid down in this Policy, provided always that thisrequirement will not oblige TMF to provide or permit access to information concerning: (i)Supplier internal pricing information; (ii) information relating to TMF's other Clients; (iii) anyof TMF non-public external reports; (iv) TMF confidential information, or (v) any internalreports prepared by TMF's internal audit function.
The Client’s requests provided in this section 7. will be fulfilled in close co-operation with andunder supervision of TMF's Chief Information Security Officer, TMF’s Chief Privacy Officer,or similar TMF local officials.

9Personal Data Protection Policy | Client Personal Data Processing by TMF Group
March 2018 | Version 1.0 | Public

8. DELETION OR RETURN OF CLIENTPERSONAL DATA

TMF will, at the choice of the Client, delete or return the Personal Data at the end of theprovision of the Services relating to Processing, to the extent reasonably possible andunless (i) Data Protection Laws, (ii) any law, statute, order, regulation, rule, requirement,
practice and guidelines of any government, regulatory authority or self-regulatingorganization that applies to the Services in the country where those Services are being
provided (“Applicable Law”), or (iii) competent court, supervisory or regulatory body, require
the retention of such Personal Data by TMF.

9. INCIDENT MANAGEMENTTMF shall notify the Client without undue delay after becoming aware of a personal data
breach, providing the Client with sufficient information which allows the Client to meet any
obligations to report a data breach under Data Protection Laws. Upon request by the Client
and at the full expense of the Client for all costs incurred by TMF (including for internal
resources and any third party costs), TMF shall fully co-operate with the Client and take suchreasonable steps as are directed by the Client to assist in the investigation, mitigation andremediation of each data breach, in order to enable the Client to (i) perform a thoroughinvestigation into the data breach, (ii) formulate a correct response and to take suitablefurther steps in respect of the data breach in order to meet any requirement under the Data
Protection Laws.

10Personal Data Protection Policy | Client Personal Data Processing by TMF Group
March 2018 | Version 1.0 | Public10. INTERNATIONAL TRANSFERS OF
CLIENT PERSONAL DATAIn the event of international transfers of Personal Data between TMF and any Subprocessor,
the following shall apply (insofar relevant):a. The Personal Data may, at the discretion of TMF, be transferred to (i) one or more ofTMF's Affiliates in either one or more Member States of the European EconomicArea ("EEA") or Switzerland on the basis of Data Protection Laws, or to (ii) one ormore of the TMF's affiliates in one or more third countries on the basis of the Binding
Corporate Rules, which are published on the website of TMF Group (https://www.tmfgroup.com/en/legal/data-protection/). The Client or the relevant TMF Affiliate shallupon request of the Client Data Subject, provide the Client Data Subject with a copyof such Binding Corporate Rules and this Policy (without any business sensitive orconfidential information). Where permitted by Data Protection Laws, TMF shall obtain
all relevant authorizations or permits for such transfer of Personal Data based onsuch Binding Corporate Rules. Where Data Protection Laws do not allow TMF toobtain such authorization or permit for itself, the Client shall in a timely manner issue
a power of attorney to the relevant TMF Affiliate to obtain such authorization orpermit on behalf of the Client. Where the use of a power-of-attorney is not accepted
under Data Protection Laws, the Client warrants that it has obtained all necessary
authorizations or permits to allow TMF to share the personal Data with TMF's
Affiliates in a third country.
b. The Personal Data may (i) be transferred to one or more Subprocessors (other thanTMF's Affiliates) in one or more Member States of the EEA or Switzerland on thebasis of Data Protection Laws pursuant to the Clients permission ex section 5 of thisPolicy, or (ii) to one or more such Subprocessors in one or more third countries on
the basis of an exception under Data Protection Laws, or (iii) on the basis ofadequate safeguards added either, insofar as allowed under Data Protection Laws,by TMF to ensure the protection of the Personal Data, or by the Client, in which case
TMF shall cooperate with the Client to seek an adequate basis for the cross-bordertransfer of Personal Data to such Subprocessor. At the Client's request, TMF shallinform the Client of the applicable basis for the cross-transfer of the Personal Data.
c. Where the data protection or privacy law of any country outside the EEA or
Switzerland applies to the Personal Data, the Client warrants that any cross-border
11

Personal Data Protection Policy | Client Personal Data Processing by TMF Group
March 2018 | Version 1.0 | Publictransfer of Personal Data from TMF to a Subprocessor shall be allowed, byimplementing additional safeguards pursuant to Data Protection Laws or asotherwise permitted by Data Protection Laws.

11. INDEMNIFICATIONThe Client warrants that all Personal Data processed by TMF on behalf of the Client has
been and shall be Processed by the Client in accordance with Data Protection Laws
including without limitation: (a) ensuring that all notifications to and approvals from regulators
which are required by Data Protection Laws are made and maintained by the Client; and (b)ensuring that all Personal Data is Processed fairly and lawfully, is accurate and up to date
and that a fair notice is provided to Client Data Subjects which described the processing tobe undertaken by TMF pursuant to the Services agreed upon in the Service Agreement.
By signing the Service Agreement, the Client shall indemnify and hold TMF harmless against
all claims, actions, third party or Supervisory Authority claims, losses, damages andexpenses arising from any breach by the Client of this Policy.
The exclusions and limitations of the liability of TMF set out in the Service Agreement shallalso apply to this Policy.

12. CONTACT US

If you have any queries about this Policy or about the privacy practices of TMF Group,
please send an email to dataprotection@tmf-group.com and be sure to indicate the nature ofyour query.

12

Personal Data Protection Policy | Client Personal Data Processing by TMF Group
March 2018 | Version 1.0 | Public

REFERENCE TO ASSOCIATED DOCUMENTS

RELATED DOCUMENTS
Statement of Continuity

Latest version available on the website of TMF Group

Binding Corporate Rule

Latest version available on the website of TMF GroupREVISION HISTORY AND RECORDSVERSIONDATEAUTHORDETAILS

1.001-03-2018

Chief Privacy Officer

First version approved.

13

Personal Data Protection Policy | Client Personal Data Processing by TMF Group
March 2018 | Version 1.0 | Public