PERSONAL DATAPROTECTION POLICY

Client Personal Data Processing by TMF Group
September 2022 | Version 3.1

1 PERSONAL DATA PROTECTION POLICY
Client Personal Data Processing by TMF Group
September 2022 | Version 3.1 | Public

TABLE OF CONTENTS

GENERAL NOTICE3INTRODUCTION, SCOPE AND PURPOSE

5PERSONAL DATA PROCESSED BY TMF

6

USE OF PERSONAL DATA7SUBPROCESSING

8

CONFIDENTIALITY AND SECURITY

9

CO-OPERATING WITH REQUESTS OF THE CLIENT

10DELETION OR RETURN OF CLIENT PERSONAL DATA12INCIDENT MANAGEMENT

13

INTERNATIONAL TRANSFERS OF PERSONAL DATA14LIABILITY

16

CONTACT US

17

DEFINITIONS AND ABBREVIATIONS18

REFERENCE TO ASSOCIATED DOCUMENTS

20

REVISION HISTORY AND RECORDS

21

2 PERSONAL DATA PROTECTION POLICY
Client Personal Data Processing by TMF Group
September 2022 | Version 3.1 | Public

GENERAL NOTICEThis document falls under TMF Group Legal governance. The following
applies to this document:This document is controlled as part of TMF Group Legal governance control.
No changes to this document are permitted without formal approval from the document owner.
This document is classified, version controlled and regularly reviewed.
Any questions regarding this document should be raised to the owner.
Distribution, modifications and access must be addressed based on TMF Group’s information
classification.
The version of this document can be found on the cover page.
Revision details are described below.
This document may be available in various languages; however, the version in the English
language will prevail.

3 PERSONAL DATA PROTECTION POLICY
Client Personal Data Processing by TMF Group
September 2022 | Version 3.1 | PublicCLASSIFICATION
PublicSTAKEHOLDERS
Owner

Chief Privacy Officer

ApproverRisk & Compliance Committee of the Board (RCC)

REVIEW
PeriodAnnualLast review

August 2022

StatusFinal

Approval on

13 September 2022

Effective date

13 September 2022

CONTACT POINT
Contact

dataprotection@tmf-group.com

4 PERSONAL DATA PROTECTION POLICY
Client Personal Data Processing by TMF Group
September 2022 | Version 3.1 | Public

INTRODUCTION, SCOPE AND PURPOSE

This Personal Data Protection Policy ("Policy") describes the privacy practices of TMF regarding theProcessing of Personal Data of the directors, officers and employees and – to the extent applicable –the customers of the Client and/or the relevant Client Affiliates, as part of the provision of TMF
Services to its Clients. This Personal Data can be stored on TMF systems, Client systems or thirdparty systems to which TMF is provided access to for the provision of Services. Where TMF provides
Services to its Clients and Processes Personal Data on Clients behalf, TMF will be acting as
Processor and the Client will be acting as Controller.
This Policy applies globally to any and all Services provided by TMF to its Clients under the Service
Agreements where TMF is acting as Processor, executed on or after the effective date of this Policy.
TMF Processes Personal Data on behalf of the Client in accordance with Data Protection Laws.
Insofar necessary, the Service Agreement will be supplemented with an Addendum to set out any
additional matters that are specific to the Client and cannot be regulated in this Policy.
This Policy does not apply to the Processing of Personal Data for which TMF is considered aController of that data. Such Processing is governed by the Privacy Statement of TMF Group and anyother relevant privacy statement or policy presented to the Client Data Subject at the moment ofcollection of their Personal Data.
This Policy is available through the TMF Group website at the following link: https://www.tmfgroup.com/en/legal/data-protection/. TMF reserves the right to update this Policy without consulting or
pre-informing its Clients.
Notwithstanding the foregoing, the version of the Policy that applies and will continue to apply to aparticular Service Agreement will be the version of the Policy that is in effect at the time of theeffective date of such Service Agreement, unless amendments are required to comply with Data
Protection Laws in which case the most recent version of the Policy published on the website shallapply.

5 PERSONAL DATA PROTECTION POLICY
Client Personal Data Processing by TMF Group
September 2022 | Version 3.1 | Public

PERSONAL DATA PROCESSED BY TMF

The details of the Personal Data that will be Processed by TMF on behalf of the Client, including theduration, purpose and types and categories of Personal Data, as well as Subprocessors, if any, will
be set out on TMF Group website pages Details of Processing respectively Subprocessors.
Where additional authorizations or consents are requested from the Client Data Subjects by the Data
Protection Laws to Process the Personal Data on behalf of the Client, the Client shall collect such
authorization or consent from the Client Data Subjects for the respective Processing activity of the
Personal Data, as required under the Data Protection Laws.

6 PERSONAL DATA PROTECTION POLICY
Client Personal Data Processing by TMF Group
September 2022 | Version 3.1 | Public

USE OF PERSONAL DATATMF shall not process, transfer, modify, amend or alter the Personal Data or disclose or permit thedisclosure of the Personal Data to any third party other than:•as necessary to process Personal Data to provide the Services and/or otherwise in accordancewith the documented instructions of Client, or•

as required to comply with Data Protection Laws or other laws to which TMF is subject, in whichcase TMF shall (to the extent permitted by law) inform Client of that legal requirement before
processing the Personal Data.

In addition, TMF is allowed to use aggregated data – to the extent this can no longer be considered
Personal Data and which is, therefore, not subject to the Data Protection Laws - for analysing
purposes, for website and for internal operations, including troubleshooting, data analysis, testing,research, for statistical purposes, for developing and improving Services and products of TMF as well
as benchmarking.

7 PERSONAL DATA PROTECTION POLICY
Client Personal Data Processing by TMF Group
September 2022 | Version 3.1 | Public

SUBPROCESSINGTMF may be required to appoint certain third parties, including TMF Affiliates, to provide part of theServices to the Client or assist with providing technical support, such as IT service providers or othersuppliers. By signing the Service Agreement, the Client authorises TMF to subcontract the Processingof Personal Data to Subprocessors in the relevant countries where the Services will be rendered aslisted on Subprocessors (https://www.tmf-group.com/en/legal/data-protection/subprocessors) page.
Subprocessors are in each case subject to the terms between TMF and the Subprocessor which are
no less protective than those set out in this Policy and the Service Agreement.
TMF will inform the Client of the details of such Subprocessor(s) upon written request from the Client.
TMF will inform the Client in advance of any intended changes concerning the addition or
replacement of Subprocessors and thereby give the Client the opportunity to object to such changes.
If the Client does not provide its contact details on the Subprocessors page and does not object inwriting within fifteen (15) calendar days of receipt of the notice, the Client is deemed to have accepted
the new Subprocessor. If the Client does object in writing within fifteen (15) calendar days of receipt of
the notice, TMF and the Client will discuss possible resolutions within a reasonable timeframe andwithout detriment to the Parties and to their compliance with each of their respective obligations set
forth in the Services Agreement.
Where the TMF Affiliate were to appoint another TMF Affiliate to Process Client Personal Data on
behalf of the Client, TMF Affiliate will inform the Client in advance of such appointment and thereby
give the Client an opportunity to object to such change. If the Client does not object in writing within
five (5) days of receipt of the notice, the Client has deemed to have accepted the respective TMF
Affiliate as a new Subprocessor.

8 PERSONAL DATA PROTECTION POLICY
Client Personal Data Processing by TMF Group
September 2022 | Version 3.1 | PublicCONFIDENTIALITY AND SECURITY

TMF shall keep the Personal Data confidential and will ensure its staff and Subprocessors are boundby the same confidentiality obligation. TMF shall implement appropriate technical and organisational
measures to ensure a level of security of the Personal Data appropriate to the risk required pursuant
to applicable Data Protection Laws and, shall take all measures required pursuant to article 32 GDPR
(Security of Processing) and any other more protective corresponding requirement under the Data
Protection Laws.
In assessing the appropriate level of security, TMF shall take account in particular of the risks that arepresented by Processing, in particular from accidental or unlawful destruction, loss, alteration,
unauthorised disclosure of, or access to Personal Data transmitted, stored or otherwise processed.
The security measures are further described and specified in the document "Statement ofContinuity", which is published on the TMF website (https://www.tmf-group.com/en/legal/dataprotection/). Any subsequent versions of the document Statement of Continuity shall be applicable to
the Services Agreement and its content will be no less stringent than its previous version.

9 PERSONAL DATA PROTECTION POLICY
Client Personal Data Processing by TMF Group
September 2022 | Version 3.1 | Public

CO-OPERATING WITH REQUESTS OF THE
CLIENT

TMF shall, upon request and to the extent required under Data Protection Laws, co-operate withrequests of the Client that relate to the Processing of Personal Data. In particular, TMF shall cooperate with requests that relate to Client Data Subject rights, data protection impact assessments
and Data Protection Audit rights as described below.
Client Data Subject rights: TMF shall co-operate as requested by the Client to enable the Client tocomply with its obligations with any exercise of rights by a Client Data Subject in respect of Personal
Data and assist Client in its compliance with any assessment, enquiry, notice or investigation as
required under Data Protection Laws. Provided in each case that the Client shall reimburse TMF infull for all costs (including for internal resources and any third party costs) reasonably incurred by TMF
performing its obligation to assist Client in its compliance under this section.
Data protection impact assessment: TMF shall provide reasonable assistance to the Client withany data protection impact assessments which are required under Data Protection Laws, including
Article 35 GDPR or other corresponding obligations determined by Data Protection Laws, and withany prior consultations to any Supervisory Authority of the Client which are required under Data
Protection Laws, including Article 36 GDPR or other corresponding obligations determined by Data
Protection Laws, in each case in relation to Processing of Personal Data by TMF on behalf of the
Client and taking into account the nature of the processing and information available to TMF.
Audit rights: On reasonable request and notice, TMF will co-operate in the conduct of any Data
Protection Audit or inspection, reasonably necessary to demonstrate TMF's compliance with theprocessor obligations laid down in Data Protection Laws and this Policy related to the Service
Agreement, provided always that this requirement will not oblige TMF to provide or permit access to
information concerning: (i) TMF internal pricing information; (ii) information relating to TMF's other
Clients; (iii) any of TMF non-public external reports, or (iv) any internal reports prepared by TMF's
internal audit function. The Client shall avoid causing any damage, injury or disruption to TMF's
equipment, personnel and business in the course of such Data Protection Audit or inspection.
A maximum of one Data Protection Audit may be activated under this section in any twelve (12)month period at no additional cost to the Client, unless (i) the audit is following upon a Personal Data
Breach caused by TMF in the same period, (ii) the Data Protection Audit request made by the Clientin the same period would exceed commercially reasonable market audit standard costs and/or (iii) the
Data Protection Audit request made by the Client in the same period would require the allocation of
TMF internal resources for more than one (1) business day in order to fulfil the request In theforegoing events, TMF will promptly notify Client of such additional expected costs in advance, forwhich Client and TMF will agree to such costs prior to initiating the referred Data Protection Audit
request. Any further Data Protection Audit within the referred twelve (12) month period shall be at the
Client’s expense.
10 PERSONAL DATA PROTECTION POLICY
Client Personal Data Processing by TMF Group
September 2022 | Version 3.1 | Public

The Client’s requests provided in this section 6 will be fulfilled in close co-operation with and under
supervision of TMF's Chief Security and Resilience Officer, TMF’s Chief Privacy Officer, or similar
TMF local officials.

11 PERSONAL DATA PROTECTION POLICY
Client Personal Data Processing by TMF Group
September 2022 | Version 3.1 | PublicDELETION OR RETURN OF CLIENTPERSONAL DATA

TMF will, at the choice of the Client, delete or return the Personal Data at the end of the provision of
the Services relating to Processing, unless (i) Data Protection Laws, (ii) any law, statute, order,
regulation, rule, requirement, practice and guidelines of any government, regulatory authority or selfregulating organization that applies to the Services in the country where those Services are being
provided, or (iii) competent court, supervisory or regulatory body, require the retention of such
Personal Data by TMF.

12 PERSONAL DATA PROTECTION POLICY
Client Personal Data Processing by TMF Group
September 2022 | Version 3.1 | Public

INCIDENT MANAGEMENTTMF shall notify the Client without undue delay after becoming aware of a Personal Data breach,providing the Client with sufficient information which allows the Client to meet any obligations to reporta Personal Data breach under Data Protection Laws.
Upon request by the Client, TMF shall fully co-operate with the Client and take such reasonable steps
as are directed by the Client to assist in the investigation, mitigation and remediation of each Personal
Data breach, in order to enable the Client to (i) perform a thorough investigation into the Personal
Data breach and provide incident details as required under Data Protection Laws such as Article 33(3) GDPR or other corresponding obligations determined by Data Protection Laws, (ii) formulate acorrect response and (iii) take suitable further steps in respect of the Personal Data breach in order tomeet any requirement under the Data Protection Laws (“Remediation Measures”).
If TMF has caused the Personal Data Breach, TMF shall bear the reasonable costs of theRemediation Measures taken by TMF. If and to the extent costs incurred by TMF related to theRemediation Measures as directed by the Client are related to the Personal Data breach caused by
the Client, the Client shall compensate reasonable costs of the Remediation Measures taken by TMF.
Any costs borne by TMF that exceed to those reasonable costs for Remediation Measures shall bemutually agreed by the Parties in advance. The Remediation Measures shall: (i) start without undue
delay, (ii) be completed within a reasonable period after TMF has become aware of a Personal Databreach, and (iii) be carried out within the regular business hours of the local office where theRemediation Measures are required to be taken.

13 PERSONAL DATA PROTECTION POLICY
Client Personal Data Processing by TMF Group
September 2022 | Version 3.1 | Public

INTERNATIONAL TRANSFERS OFPERSONAL DATA

Always subject to section 3 and section 4 of this Policy and in the event the Services requireinternational transfers of Personal Data between TMF, TMF Affiliate(s) and/or any Subprocessor(s),the following shall apply (insofar relevant):
a. Transfer to TMF Affiliates in or from EU. The Personal Data may be transferred to (i) one ormore of TMF's Affiliates in either one or more member states of the European Economic Area("EEA"), Switzerland or the UK on the basis of Data Protection Laws, or to (ii) one or more of the
TMF's Affiliates in one or more third countries on the basis of the Binding Corporate Rules, which
are published on the website of TMF Group (https://www.tmf-group.com/en/legal/dataprotection/binding-corporate-rules/). The Client or the relevant TMF Affiliate shall upon request of the
Client Data Subject, provide the Client Data Subject with a copy of such Binding Corporate Rules andthis Policy (without any business sensitive or confidential information). Where permitted by Data
Protection Laws, TMF shall obtain all relevant authorizations or permits for such transfer of Personal
Data based on such Binding Corporate Rules. Where Data Protection Laws do not allow TMF to
obtain such authorization or permit for itself, the Client shall in a timely manner issue a required
authorisation to TMF and any other relevant TMF Affiliate. In the event the Binding Corporate Rules
were not recognized or applicable under Data Protection Laws of a specific jurisdiction, TMF and therelevant TMF Affiliate(s) will undertake the necessary actions to satisfy the cross border transfer
requirements applicable to Personal Data under the Data Protection Laws of that jurisdiction.
b. Transfer to Subprocessors in or from EU. The Personal Data may be transferred (i) to one ormore Subprocessors (other than TMF's Affiliates) in one or more member states of the EEA,
Switzerland or the UK on the basis of Data Protection Laws pursuant to the Clients authorisation ex
section 4 of this Policy, or (ii) to one or more such Subprocessors in one or more third countries on
the basis of an exception under Data Protection Laws, or (iii) on the basis of adequate safeguards
added either, insofar as allowed under Data Protection Laws, by TMF to ensure the protection of the
Personal Data, or by the Client, in which case TMF shall cooperate with the Client to seek anadequate basis for the cross-border transfer of Personal Data to such Subprocessor. At the Client's
request, TMF shall inform the Client of the applicable basis for the cross-transfer of the PersonalData.
c. Transfer between Client and TMF. Where the Services provided by TMF would require aninternational transfer of Personal Data from one of the parties, either Client or TMF, located in amember state of the EEA to another party, respectively Client or TMF, located in a country notsupported by an adequacy decision from the EU Commission for the cross-border transfer of
Personal Data, the Client and TMF will duly execute the relevant EU Standard Contractual Clauses
for such specific transfer, pursuant to the requirements set forth under the GDPR. A pre-signed
version of the EU Standard Contractual Clauses can be found on the TMF Website, page named EU
14 PERSONAL DATA PROTECTION POLICY
Client Personal Data Processing by TMF Group
September 2022 | Version 3.1 | PublicStandard Contractual Clauses, for which Client and TMF will cooperate in ensuring the applicableversion is duly executed.
d. Other transfers. Pursuant to the Data Protection Laws outside the EEA, Switzerland or the UK
applicable to the Personal Data Processed to render the Services, the Client – acting as Controller –shall ensure that any cross-border transfer of Personal Data from TMF to a Subprocessor shall beallowed, by implementing additional safeguards as required under those Data Protection Laws. If
such Data Protection Laws would require further information to be provided to the Client Data
Subjects or further consents to be obtained by the Controller, the Client shall take these additional
steps before the transfer to TMF and or TMF Affiliates is taking place.

15 PERSONAL DATA PROTECTION POLICY
Client Personal Data Processing by TMF Group
September 2022 | Version 3.1 | Public

LIABILITYThe Client warrants that all Personal Data processed by TMF on behalf of the Client has been andshall be Processed by the Client in accordance with Data Protection Laws including without limitation:(a) ensuring that all notifications to and approvals from regulators which are required by Data
Protection Laws are made and maintained by the Client; and (b) ensuring that all Personal Data is
Processed fairly and lawfully, is accurate and up to date and that a fair notice is provided to Client
Data Subjects which described the Processing to be undertaken by TMF or its Subprocessors
pursuant to the Services agreed upon in the Service Agreement.
TMF shall be liable for the damage caused by Processing only where it has not complied withobligations of Data Protection Laws specifically directed to processors or where it has acted outside
or contrary to lawful instructions of the Client as indicated in the Service Agreement. Client shall be
liable for the damage caused by Processing by Client which infringes Data Protection Laws. Client orProcessor shall be exempt from liability under this section 10 if it proves that it is not in any way
responsible for the event giving rise to the damage.
Where more than one Controller or Processor, or both a Controller and a Processor, are involved in
the same processing and where they are, under the Service Agreement, responsible for any damage
caused to Client Data Subject by Processing, each Controller or Processor shall be held liable for theentire damage in order to ensure effective compensation of the Client Data Subject(s). Where aController or Processor has paid full compensation for the damage suffered, that Controller orProcessor shall be entitled to claim back from the other Controller(s) or Processor(s) involved in thesame Processing that part of the compensation corresponding to their part of responsibility for thedamage, in accordance with the conditions set out in the previous paragraph.
Save for this section 10 third paragraph, the indemnities, liabilities and exclusions or limitations
thereof set out in the Service Agreement, shall also apply to the obligations of the parties pursuant tothis Policy and the Service Agreement, and in case of any conflict will prevail.

16 PERSONAL DATA PROTECTION POLICY
Client Personal Data Processing by TMF Group
September 2022 | Version 3.1 | Public

CONTACT US

If you have any queries about this Policy or about the privacy practices of TMF Group, please send an
email to dataprotection@tmf-group.com and be sure to indicate the nature of your query.
Information about rights of Clients or Client Data Subjects that TMF Processes as Controller,
including with regard to transfers of their Personal Data within TMF Group, and principles related toProcessing their Personal Data that TMF Group applies, are included in the Privacy Statement of
TMF Group, available on TMF Group website (https://www.tmf-group.com/en/legal/privacystatement/).

17 PERSONAL DATA PROTECTION POLICY
Client Personal Data Processing by TMF Group
September 2022 | Version 3.1 | Public

DEFINITIONS AND ABBREVIATIONS

The capitalized terms and abbreviations listed below, have the follow meaning in this Policy:
TERM

DEFINITION

Clientmeans the counterparty to the Service Agreement with TMF.

Client Affiliate

means any legal entity affiliated to the Client.

Client Data
Subjects

shall mean the former and current directors, officers and employees and customers of
the Client and Client Affiliates.

Controller

shall mean the natural or legal person, public authority, agency or other body which,alone or jointly with others, determines the purposes and means of the Processing of
Personal Data.

Data Protection
Audit

means audits, including data protection compliance questionnaires, carried out by the
Client or a third-party on behalf of the Client, with the objective to verify TMF
compliance with the data protection obligations stated in the Service Agreement andthis Policy.

Data Protection
Laws

means in relation to any Personal Data which is Processed in the performance of theService Agreement, the General Data Protection Regulation (EU) 2016/679 ("GDPR")
together with all implementing laws and any other applicable data protection laws,
privacy laws or privacy regulations. Any references to specific clauses of the GDPR in
this Policy shall also be understood as references to the corresponding clauses of any
other applicable data protection laws, privacy laws or privacy regulations, if applicable.

Personal Data

means any information through which a Client or a Client Data Subject can be
identified directly or indirectly, including any other information if and to the extent that
information is protected by Data Protection Laws.

Personal Data
Breachmeans a breach of security leading to the accidental or unlawful destruction, loss,
alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored
or otherwise Processed.

Processingmeans any operation or set of operations which is performed upon Personal Data or
on sets of Personal Data, whether or not by automated means, such as collection,
recording, organization, structuring, storage, adaptation or alteration, retrieval,consultation, use, disclosure by transmission, dissemination or otherwise making
available, alignment or combination, restriction, erasure or destruction.

Servicesmeans services TMF provides to the Client under the Service Agreement.

Service Agreementmeans any written contract, any written statement of work, or any other written binding
agreement, including any annexes thereto, between TMF and the Client.

EU Standard
Contractual Clausesmeans the Standard Contractual Clauses for the transfer of personal data to third
Countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of
the Council adopted by the European Commission Decision 2021/914 of 4 June 2021,
as updated from time to time.

Subprocessor

means any third party appointed or engaged by Processor to process Personal Dataon behalf of the Controller.

TMF

means the TMF Affiliate that is the contracting entity to the Service Agreement.

18 PERSONAL DATA PROTECTION POLICY
Client Personal Data Processing by TMF Group
September 2022 | Version 3.1 | PublicTMF Affiliate

means with respect to any specified person or entity, any other person or entity
directly or indirectly controlling or controlled by or under direct or indirect common
control of TMF Group B.V., including it. For the purpose of this definition, “control”,
when used with respect of any specified person or entity means the power to direct or
cause the direction of the management or policies of such person or entity, whether
through ownership of voting securities or by contract or otherwise. The terms“controlling” and “control” have meaning correlative to the foregoing. Specifically
excluded from this definition are the shareholding companies controlling TMF Group
B.V.

19 PERSONAL DATA PROTECTION POLICY
Client Personal Data Processing by TMF Group
September 2022 | Version 3.1 | Public

REFERENCE TO ASSOCIATED DOCUMENT S

RELATED STANDARDSStatement of Continuity

Latest version available on the website of TMF Group

Binding Corporate Rules for
Processing Client Personal Data
(Processor)

Latest version available on the website of TMF GroupRELATED DOCUMENTSBCR Controller Extract

Latest version available on the website of TMF Group

20 PERSONAL DATA PROTECTION POLICY
Client Personal Data Processing by TMF Group
September 2022 | Version 3.1 | Public

REVISION HISTORY AND RECORDS

VERSIONDATE

AUTHORDETAILS

v.1.0

01-03-2018

Chief Privacy Officer

First version approved.

v.2.0

29-04-2019

Chief Privacy Officer

Sections 1, 3, 6, 7, 9, 10 and 11 revised to clarify TMF
Group Personal Data Processing role and duties.

v.2.1

24-01-2020

Chief Privacy Officer

Sections 3 and 5 revised to include the details ofprocessing and the list of Subprocessors links.

v.2.2

17-05-2021

Group Privacy OfficeSection 1 revised to clarify appliable version of Policy to
the Services Agreement, as well as amendments
required by law.
Section 2 updated to include definitions for “Data
Protection Audit” and “Personal Data Breach”.
Section 5 revised to increase number of days forcontroller to object to appointment of new
subprocessor(s) and clarifying language for potential
resolutions upon objection.
Section 6 revised to clarify application of further
versions of the Statement of Continuity.
Section 7 revised language to clarify obligations underdata protection laws, inclusion of new defined terms andupdate due to organisational change.
Section 9 updated to include allocation of costs for
personal data breaches caused by TMF

v.3.0

20-05-2022

Senior Privacy Officer

Template updated to the most recent version.
Section 1 revised as to clarify TMF Affiliate role as a
Processor for the purpose of this Policy and reference
to the TMF Group Privacy Statement, where links areavailable for situations where TMF Affiliate processes
Personal Data as a Controller.
Former section 2 (Definitions) moved to an appendix –Definitions and Abbreviations.
Section 2 updated to contemplate client obligations withregards to data subjects under data protection laws.
Section 3 revised language to clarify concept ofaggregated data.
Section 4 updated language to clarify notification
mechanism and objection period: language added for
notification and authorization obligations in the event
TMF Affiliate acts as a Subprocessor.
Section 5 revised language to clarify legal coverage of
security requirements under Data Protection Laws.
Section 6 revised language to include commercial costs
resulting from Data Protection Audits.
Section 8 revised language to contemplate compliancewith additional legal requirements in relation to Personal
Data Breaches.
Section 9 revised language to comply with international
data transfers requirements under current Data
Protection Laws, including EU Standard Contractual

21 PERSONAL DATA PROTECTION POLICY
Client Personal Data Processing by TMF Group
September 2022 | Version 3.1 | PublicClauses.
Section 10 revised to include liability of TMF Affiliate forappointed Subprocessors.
Section 11 updated to include reference to theController BCR Extract.
Definitions and Abbreviations - updated to include
definition “EU Standard Contractual Clauses” andrevised language added to definitions “Data ProtectionLaws”, “Personal Data”, “Subprocessors” and “TMF
Affiliate” to provide legal coverage and clarification on
data protection laws requirements.
v. 3.1

18-08-2022

Senior Privacy Officer

Numbering was adjusted.
Section 3 updated with regard to purposes for which
aggregated data could be used.

22 PERSONAL DATA PROTECTION POLICY
Client Personal Data Processing by TMF Group
September 2022 | Version 3.1 | Public