Data privacy complaints procedure

1. Employees

1.1. As an employee of Crefovi, if you have a complaint about the way in which your personal information has been handled, or if you would like to request access to copies of your HR file, or other personal information, or exercise any of your other rights, please contact an HR representative from your local office. If you are not satisfied with the response of the HR representative, you may proceed with the complaints procedure for ‟Other Inquiries”, as described below.

1.2. If you do not feel comfortable in making your complaint to your local HR department, you may direct your query to the firm’s Global data privacy officer.

2. Former employees

2.1. As a former employee of Crefovi, if you would like to request access to copies of your personal information, such as your HR file or exercise any of your other rights, please contact an HR representative from your local office. Other than in exceptional circumstances, we will acknowledge your request within 48 business hours and will provide a substantive response as soon as practicable, in accordance with any time limits set down by law. Where permitted by law, we may charge a fee for the provision of copies of your personal information.

2.2. If you are not satisfied with our response, you may proceed with the complaints procedure for ‟Other Inquiries”, as described below.

3. Marketing requests

If you would like to request marketing materials from Crefovi, you may subscribe at the following web address: https://crefovi.com/knowledge-library/crefovis-newsletter/. If you would like to update your contact information for Crefovi marketing materials, or if you would like to be removed from any email or other distribution lists for Crefovi marketing materials, you may do so at the same link or you can send an email to . Other than in exceptional circumstances, we will remove your email address from the relevant distribution list(s) within 48 business hours. If you are not satisfied with our response, you may proceed with the complaints procedure for ‟Other Inquiries”, as described below.

4. Other inquiries

4.1. If you have a complaint about the way in which your personal information has been handled, or would like to access or correct your personal information, or exercise any of your other rights, please contact the Global data privacy officer. The Global data privacy officer monitors compliance with the firm’s Global data privacy standards (the ‟Standards”) and is the initial contact point for any enquiry or complaint relating to compliance with those Standards. The Global data privacy officer will undertake an independent review of the investigation into your complaint and advise you of the conclusions. The Global data privacy officer may be contacted by email at .

4.2. You may request a full copy of the Standards by contacting the Global data privacy officer. In order to receive a full copy of the Standards, you will need to sign a confidentiality agreement in a form acceptable to us. The requirement to sign a confidentiality agreement will not prevent you from sharing information with a lawyer in order to obtain legal advice or from using the Standards in legal proceedings in order to exercise your rights.

4.3. You may also submit your request or complaint via email to , which is the email address of the Global data privacy officer. Please mark your email with ‟Privacy Enquiry” in the subject line and in the email provide:

(a) your full name;

(b) your address;

(c) the full details of your data privacy request or complaint;

(d) any previous correspondence with us regarding the specific data privacy issue, and

(e) if you have incurred a loss, evidence to show the value of the loss.

4.4. We may ask you to provide proof of your identity. Where permitted by law, we may charge a fee for the provision of copies of your personal information or for taking other action requested by you.

4.5. Upon receipt of a written request or complaint, Crefovi will:

(a) confirm receipt, where possible, within 2 working days;

(b) assess the request or investigate the complaint fully, and

(c) advise you of the outcome within 2 weeks of receipt of your written request or complaint except that, if the investigation or assessment cannot be completed within 2 weeks, we will write to you to tell you when we expect to respond.

4.6. If you are still not satisfied with our actions and findings, or at any other time if you so choose, you may:

(a) contact and/or lodge a complaint with the French ‟Commission nationale de l’informatique et des libertés” (‟CNIL”) at www.cnil.fr, by telephone on +33 (0)1 53 73 22 22 or by writing to this address: 3 Place de Fontenoy, TSA 80715, 75334, Paris Cedex 07, France;

(b) contact and/or lodge a complaint with the data protection authority in the jurisdiction in the European Economic Area (‟EEA”) in which you work or are habitually resident, or where the alleged breach took place. Contact details can be found at https://ec.europa.eu/commission/index_en; or

(c) bring a claim in the relevant courts as specified under ‟Rights of redress” below.

5. Rights of redress

5.1. The provisions of this Section 5 apply to:

(a) personal data which is processed by Crefovi as a data controller and which is governed by laws implementing the General Data Protection Regulation 2016/679/EU (‟GDPR”) and related European privacy legislation, including the United Kingdom (‟UK”) data protection act 2018; and

(b) the export of such personal data outside of the EEA or the UK by Crefovi and the processing of such exported data by another Crefovi entity (either in the capacity of a data controller or a data processor) located outside the EEA or the UK.

5.2. If any Crefovi entity breaches the Standards, with respect to your personal data, in the circumstances described in 5.1. above, you are entitled in accordance with the provisions of this Section 5 to bring a claim as a third party beneficiary in:

(a) the courts of France;

(b) the courts of the EEA jurisdiction of establishment of the relevant Crefovi data controller that initially collected the personal data to which your claim relates;

(c) the courts of the EEA jurisdiction of establishment of the relevant Crefovi data controller that exported the personal data to which your claim relates:

(d) the courts of the EEA jurisdiction in which you are habitually resident.

The selected jurisdiction will be referred to as the ‟Relevant jurisdiction”.

5.3. Crefovi is composed of one legal entity which has entered into an agreement pursuant to which each Crefovi office has agreed to comply with the Standards (the ‟BCR Agreement”) and provide certain rights to data subjects. If you have completed this Data Privacy Complaints Procedure, but you are not satisfied with the response you have received from us, and would like to make a claim in a court pursuant to this ‟Rights of Redress” Section, you may request a copy of the BCR Agreement by contacting the Global data privacy officer. In order to receive a copy of the BCR Agreement, you will need to sign a confidentiality agreement in a form acceptable to us. The requirement to sign a confidentiality agreement will not prevent you from sharing information with a lawyer in order to obtain legal advice or from using the BCR Agreement in legal proceedings in order to exercise your rights.

5.4. If you wish to make a claim against Crefovi for compensation for damages resulting from an alleged breach of the Standards, or in any other case where you allege a breach of the Standards has been committed, you will be required to provide evidence which shows that it is likely that a breach has occurred, and/or that it is likely that the damage has occurred because of the breach of the Standards by one or more of the Crefovi entities. In such cases, the Paris office of Crefovi will accept the burden of proof on behalf of Crefovi’s offices located outside the EEA, to demonstrate that responsibility for any breach of the Standards does not rest with the Crefovi entity or entities which are the subject of the claim. Consequently, any claims against Crefovi offices located outside the EEA should be brought against Crefovi’s Paris office. In order to discharge itself from responsibility under any such claim, Crefovi’s Paris office must demonstrate either that no such breach occurred or that the Crefovi office located outside the EEA is not responsible for a breach of the Standards which resulted in the damages or other remedy claimed by you. You may contact the Paris office at the following address: Crefovi SELAS, 59 rue Legendre, 75017 Paris, France, marked for the attention of the Chair of the Data privacy committee, or by email at .

5.5. The submission, by a Crefovi entity, to the Relevant Jurisdiction does not, in respect of any claims that do not relate to compliance by Crefovi with the Standards, or for any other purpose whatsoever, constitute a submission by the relevant Crefovi entity to the jurisdiction of such courts or a waiver by the relevant Crefovi entity of its rights to claim ‟forum non conveniens”.