Privacy Policy

Marketing

We strive to provide you with choices regarding certain personal data uses, particularly around marketing and advertising: You may update your marketing preferences via the website or via dpo@amtico.com (for our UK entities) or dsb@amtico.com (for our European Entities).

Promotional offers from us

We may use your Identity, Contact, Technical, Usage and Profile Data to form a view on what we think you may want or need, or what may be of interest to you. This is how we decide which products, services and offers may be relevant for you (we call this marketing).

You may receive marketing communications from us if you have requested information from us or purchased goods or services from us or if you provided us with your details when you entered a competition or registered for a promotion or survey and, in each case, you have not opted out of receiving that marketing.

Third-party marketing

We will never share your details with third parties for their marketing purposes.

Opting out

You can ask us to stop sending you marketing messages at any time by contacting us through the form on our website or by emailing us at dpo@amtico.com (for our UK entities) or dsb@amtico.com (for our European Entities).

Where you opt out of receiving these marketing messages, this will not apply to personal data provided to us as a result of a product/service purchase, warranty registration, product/service experience or other transactions.

Cookies

You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of this website may become inaccessible or not function properly. For more information about the cookies we use, please see our cookie policy.

Tools for Tracking and Analysis

Statistics & Analysis Tools

Microsoft Clarity

Our website uses the Microsoft Clarity tool from Microsoft Ireland Operations Limited (Ireland/EU). The tool is used to create a heat map. This allows us to better understand which parts of our website are in focus and where vulnerabilities lie. For this purpose, your user behaviour on our website is analysed.

Legal basis: We use Microsoft Clarity if you have given your consent in accordance with Art. 6 (1) (a) GDPR. We obtain your consent when you access our websites via the cookie banner on our website. The granting of consent is voluntary and can be revoked at any time via the cookie page (opt-out) https://www.amtico.com/privacy/cookies/.

The personal data processed includes your IP address, your location, your browser information, your screen resolution, your language preference, the website you visited and, if applicable, subpages, the date and time of your access, as well as clicks, scrolls and mouse movements. You can prevent the collection and processing of data by deactivating the setting of cookies at the following link: https://www.amtico.com/privacy/cookies/. In the case of Microsoft services, a transfer of data to Microsoft Corp. in the USA cannot be ruled out. For more information about privacy at Microsoft, see: https://privacy.microsoft.com/en-GB/privacystatement.

Storage period: The data will be stored for a maximum period of 13 months.

Google Analytics & Google Analytics 4

Google Analytics is a reach analysis tool. This collects data such as users, sessions, session duration, operating systems, device models, or region. Google Analytics is also used to measure and optimize the success of advertising campaigns.

Legal basis: We obtain your consent when you access our websites via the cookie banner on our website (Art. 6 (1) (a) GDPR ); Website: https://marketingplatform.google.com/intl/de/about/analytics/; Privacy Policy: https://policies.google.com/privacy; Data processing agreement: https://business.safety.google/adsprocessorterms; Possibility of objection (opt-out): When using Google Analytics, your data may be transferred to third countries, such as the USA. Based on the European Commission's adequacy decision of 10 July 2023 on the EU-US Data Privacy Framework (DPF), it was determined that the US ensures an adequate level of protection – comparable to that of the European Union – for transferred personal data transferred to US companies under the new framework. For more information on the processing of your personal data by Google LLC, please visit: https://policies.google.com/privacy.

Personal data: We receive various usage data, such as page views, length of stay, operating systems used and origin of the user. This data is assigned to the user's respective end device. The IP address transmitted and shortened by your browser as part of Google Analytics will not be merged with other data held by Google. The data collected as part of the use of Google Analytics 4 will be stored for a maximum period of 14 months and then deleted. Furthermore, with Google Analytics, we can, among other things: Record your mouse and scroll movements and clicks. In addition, Google Analytics uses various modelling approaches to complement the collected data sets and uses machine learning technologies in data analysis.

If you withdraw your consent, we will delete your personal data. We may view your personal data for 14 months.

Google Ads –formerly Google AdWords

Google Ads is an online advertising program provided by Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Ads enables us to display advertisements in the Google search engine or on third-party websites when the user enters certain search terms on Google (keyword targeting). In addition, targeted advertisements can be displayed on the basis of user data available at Google (e.g. location data and interests) (target group targeting). As a website operator, we can evaluate this data quantitatively by, for example, analysing which search terms led to the display of our advertisements and how many advertisements led to corresponding clicks.

With the help of Google conversion tracking, Google and we can see whether the user has taken certain actions. For example, we can evaluate which buttons on our website were clicked on and how often, and which products were viewed or purchased most frequently. This information is used to compile conversion statistics. We learn the total number of users who clicked on our ads and what actions they took. We do not receive any information that allows us to personally identify the user. Google itself uses cookies or comparable recognition technologies for identification. Google Ads conversions are subject to a conversion tracking period of 1 to 90 days. The use of this service is based on your consent in accordance with Art. 6 (1) (a) GDPR. Consent can be revoked at any time.

When using Google Ad, your data may be transferred to third countries, such as the USA. Based on the European Commission's adequacy decision of 10 July 2023 on the EU-US Data Privacy Framework (DPF), it was determined that the US ensures an adequate level of protection – comparable to that of the European Union – for transferred personal data transferred to US companies under the new framework. For more information on the processing of your personal data by Google LLC, please visit: https://policies.google.com/privacy.

Algolia

On our website, we use Algolia Instantsearch, a search engine service provided by Algolia Inc. ("Algolia") to search and index content. By using Algolia Instantsearch, your IP address and search query will be transmitted to an Algolia server and stored there for statistical purposes. Please see Algolia's Terms of Use as well as Algolia's Privacy Policy (https://www.algolia.com/policies/privacy/).

Algolia does not transfer the collected data to third parties, but processes it exclusively internally for statistical evaluations and monitoring of its services. We only receive aggregated data, for example, the number of searches (daily/weekly/monthly) for specific terms or keywords; or search queries that do not return any results from the site.

The use of Algolia Instantsearch is for the purpose of making it easier to find the information contained on our website and thus ensuring user-friendliness. This is also our legitimate interest within the meaning of Art. 6 (1) (f) GDPR.

The data will be stored on Algolia's server for a period of 90 days.

Social media

Facebook

We operate a fan page on Facebook to provide information about our services, for general customer contact and for carrying out various campaigns in connection with our range of services.

When you visit our fan page, Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, D2 Dublin, Ireland ("Meta") processes your personal data, e.g. for the provision of other services or advertising, in accordance with the Meta Privacy Policy, which you can view under https://www.facebook.com/privacy/policy/.

In connection with our Facebook fan page, we use Facebook Insights, which we receive to improve our offering. This service records your activity on our fan page and makes it available to us in anonymised statistics. This gives us insights into, among other things, the activity of our fan site visitors, the views of our site, the reach of posts, views and average duration of video plays, information about which countries and cities our visitors come from, and statistics about the gender ratios of our visitors. It is not possible to draw conclusions about individual users or access to individual user profiles by the administrator. The processing takes place regardless of whether you are logged in to Facebook or are members of the Facebook network.

The processing is carried out under joint responsibility between Meta and us. The basis for this is an agreement on joint responsibility in accordance with Art. 26 GDPR, which you can view under https://www.facebook.com/privacy/policy/. Further processing of the data is the sole responsibility of Meta Platforms Ireland Limited, in particular with regard to the transfer of the data to the parent company Meta Platforms, Inc. in the USA.

The legal basis for processing by us is our legitimate interest in improving our product range, providing information and contact options for interested parties and being able to trace the use of our social media presences, Art. 6 (1) (f) GDPR. In particular, this enables us to record the reach and effectiveness of our campaigns, postings and other activities through processed statistics. This enables us to continuously optimize our website and our offer in line with our needs.

We use Meta's "Lead Ads" function to collect and process certain personal data of interested users – so-called leads – via a contact form displayed on Facebook websites. The content and scope of the data requested in this form depends on the focus of the respective lead campaign. The processing of the data is strictly linked to the purposes pursued with the respective lead ad campaign. These purposes are clearly stated to the user in the lead ad or on the form provided before the data provided is transmitted.

Depending on the type of lead ad campaign, the legal basis for data processing is either your explicit consent in accordance with Art. 6 (1) (a) GDPR (e.g. for direct marketing measures such as registering for e-mail newsletters) or our legitimate interest in optimal marketing of our offer in accordance with Art. 6 (1) (f) GDPR. The data will not be passed on to third parties.

We refer to the data protection and advertising settings in the profile of the users on the Facebook platform as well as within the framework of Facebook's consent procedure (right of objection: opt-out procedure) contact options for exercising information and other data subject rights in Facebook's https://www.facebook.com/privacy/policy/.

In addition, we may share your content on our channel and communicate with you, e.g. as a direct message. In doing so, we process your username and the content of the communication. The legal basis for the processing is our legitimate interest in accordance with Art. 6 (1) (f) GDPR to interact with you or to respond to your communication.

Instagram

We operate a channel on Instagram to provide information about our range of services, to interact with people interested in our company and to carry out other campaigns in connection with Amtico International GmbH.

When you visit our channel, Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, D2 Dublin, Ireland ("Meta") processes your personal data, e.g. for the provision of other services or advertising in accordance with Instagram's privacy policy, which you can view under https://privacycenter.instagram.com/policy.

In connection with the operation of the Instagram channel, we use Instagram Insights, which we are provided with to improve our offering. This service records your activity on our channel and makes it available to us in anonymized statistics. This gives us insights into, among other things, the activity of our channel visitors, the views of our channel, the reach of posts, views and average duration of image views or video playbacks, information about which countries and cities our visitors come from, and statistics about the gender ratios of our visitors. It is not possible to draw conclusions about individual users or access to individual user profiles by the administrator. The processing takes place regardless of whether you are logged in to Instagram or a member of the Instagram network.

The processing is carried out under joint responsibility between Meta and us. The basis for this is an agreement between joint controllers in accordance with Art. 26 GDPR, which you can view under https://privacycenter.instagram.com/policy. Further processing of the data is the sole responsibility of Meta Platforms Ireland Limited, which includes in particular the transfer of the data to the parent company Meta Platforms, Inc. In the U.S.

The legal basis is our legitimate interest in improving our product range, providing information and contact options for interested parties and being able to track the use of our social media presences, Art. 6 (1) (f) GDPR. In particular, this enables us to record the reach and effectiveness of our campaigns, postings and other activities through processed statistics.

We use Meta's "Lead Ads" function to collect and process certain personal data from interested users – so-called leads – via a contact form displayed on Instagram. The content and scope of the data requested in this form depends on the focus of the respective lead campaign. The processing of the data is strictly linked to the purposes pursued with the respective lead ad campaign. These purposes are clearly stated in the lead ad or on the form provided before the data provided is transmitted.

Depending on the type of lead ad campaign, the legal basis for data processing is either your explicit consent in accordance with Art. 6 (1) (a) GDPR (e.g. for direct marketing measures such as registering for e-mail newsletters) or our legitimate interest in optimal marketing of our offer in accordance with Art. 6 (1) (f) GDPR. The data will not be passed on to third parties.

We refer to the data protection and advertising settings in the profile of users on the Instagram platform as well as in the context of Instagram's consent procedure (right of objection: opt out procedure) and Instagram's contact options for exercising information and other data subject rights in Instagram's privacy policy:

https://privacycenter.instagram.com/policy/?entry_point=ig_help_center_data_policy_redirect

In addition, we may share your content on our channel and communicate with you, e.g. as a direct message. In doing so, we process your username and the content of the communication. The legal basis for the processing is our legitimate interest in accordance with Art. 6 (1) (f) GDPR to interact with you or to respond to your communication.

YouTube

We operate a channel on YouTube to provide information about our services, us as an employer and other activities that are related to Amtico International GmbH.

When you visit YouTube, Google LLC ("Google"), Amphitheatre Parkway, Mountain View, CA 94043, USA, as the operator of YouTube, stores and processes personal data in accordance with the privacy policy of Google https://policies.google.com/privacy?hl=en.

In connection with our YouTube channel, we use YouTube Analytics, which we are provided with to improve our offer. This service records your activity on our channel and makes it available to us in anonymized statistics. This gives us insights into visits to our site, the reach of posts, the average length of video plays, information about which countries and cities our visitors come from, and statistics about the gender ratio of our visitors, among other things. It is not possible to draw conclusions about individual users or access to individual user profiles by the administrator. The processing takes place regardless of whether you are logged in to YouTube or a member of YouTube.

The processing is carried out under joint responsibility between YouTube and us (Art. 26 GDPR). The legal basis is our legitimate interest in improving our offering, providing you with an information medium and being able to track the use of our social media presences, Art. 6 (1) (f) GDPR.

In individual cases, we will communicate with you (e.g. via the direct message function). In doing so, we process your username and the content of the communication. The legal basis for the processing is our legitimate interest pursuant to Art. 6 (1) (f) GDPR to interact with you and respond to your communication.

Further information on data processing and the possibility of objection (opt-out) on YouTube can be found in the privacy policy, which you can view under https://policies.google.com/privacy.

Vimeo

This website uses plugins from the video portal Vimeo. The provider is Vimeo Inc., 555 West 18th Street, New York, New York 10011, USA.

When you visit one of our pages equipped with Vimeo videos, a connection to Vimeo's servers is established. In doing so, the Vimeo server is informed which of our pages you have visited. In addition, Vimeo obtains your IP address. However, we have set Vimeo so that Vimeo does not set advertising/tracking cookies, only functional cookies (user/session identifiers) are used that are necessary for the provision of the video.

The use of Vimeo is based on your consent within the meaning of Art. 6 (1) (a) GDPR. Consent can be revoked at any time.

The transfer of data to the USA is based on the European Commission's adequacy decision of 10 July 2023 on the EU-US Data Privacy Framework (DPF), under which it was determined that the US ensures an adequate level of protection – comparable to that of the European Union – for transferred personal data transferred to US companies under the new framework. For more information on the handling of user data, please refer to Vimeo's privacy policy at: https://vimeo.com/privacy.

Pinterest

We have a page on Pinterest where we share information about our products.

When you visit Pinterest, Pinterest Ltd., Palmerston House 2nd. Floor, Fenian Street, Dublin 2, Ireland ("Pinterest"), as the operator of Pinterest, stores and processes personal data in accordance with Pinterest's privacy policy. The privacy policy can be found at the following link: https://policy.pinterest.com/en/privacy-policy.

In addition, we use Pinterest Insights, which we are provided with to improve our offering. This service records your activity on our channel and makes it available to us in anonymized statistics. This gives us insights into the number of visits to our site, the reach of the posts, information about which countries and cities our visitors come from, and statistics about the gender ratio of our visitors. The processing takes place regardless of whether you are logged in to Pinterest or a member of Pinterest.

The legal basis is our legitimate interest in improving our services and being able to track the use of our social media presences, Art. 6 (1) (f) GDPR.

We may communicate with you (e.g. via direct message). In doing so, we process your username and the content of the communication. The legal basis for the processing is our legitimate interest pursuant to Art. 6 (1) (f) GDPR to interact with you and respond to your communication.

Plug-Ins

Our website contains social plug-ins of the social networks "Facebook"( Facebook Inc., 1601 S. California Ave, Palo Alto, California 94304, USA), “Google +” (Google Inc., 1600 Amphitheatre Parkway, Mountain View, California 94043, USA), "Twitter" (Twitter, Inc., 1355 Market St, Suite 900, San Francisco, California 94103, USA), “Instagram” (Instagram LLC., 1601 Willow Road, Menlo Park, CA 94025, USA), “YouTube” (YouTube LLC., 901 Cherry Ave., San Bruno, CA 94066, USA) and “Pinterest” (Pinterest Inc., 808 Brannan Street, San Francisco, CA 94103, USA) . It is possible that personal data about visitors to the website may also be collected via these plug-ins, transmitted to the respective service and linked to the respective service of the visitor.

Amtico Holdings Ltd does not collect any personal data via the social plug-ins. In order to prevent data from being transferred to service providers in the USA without the user's knowledge, we have used the so-called Shariff solution on our website. This has the effect that the respective social plug-ins are initially only integrated as graphics on the website. These graphics contain a link to the website of the corresponding provider of the plug-in. Only when you click on one of the graphics, you will be forwarded to the service of the respective provider. This solution ensures that personal data are not automatically forwarded to the providers of the respective social plug-ins when you visit our website. If you click on one of the graphics of the social plug-ins, data can be transferred to the respective service provider and stored there. If you do not click on any of the graphics, no data transfer takes place between you and the respective provider of the social plug-in.

After clicking on a social plug-in, the respective service provider receives information that you have visited the corresponding page of our online offer. Please note that you do not need to have a user account with the service in question, nor are you already logged in there. However, if you already have a user account with the relevant service provider and are already logged in to this account while visiting our website, the data collected by the social plug-in will be assigned directly to your account. If you do not wish to be assigned to your profile with the service provider, you must log out of your user account before clicking on one of the social plug-ins.

Please note that Amtico Holdings Ltd has no influence on whether and to what extent the respective service providers collect personal data. We are not aware of the scope, purpose and storage periods of the respective data collection. However, we would like to point out that it must be assumed that at least the IP address and device-related information is used and recorded via social plug-ins. It is also possible that the respective service providers use cookies.

The scope and purpose of the data collection by the respective service as well as the further processing and use of your data there can be found in the data protection information directly from the website of the respective service. There you will also receive further information about your corresponding data protection rights and setting options for the protection of your privacy:

1. Facebook Inc., 1601 S California Ave, Palo Alto, California 94304, USA https://en-gb.facebook.com/policy.php

2. Google Inc., 1600 Amphitheater Parkway, Mountain View, California 94043, USA https://www.google.com/policies/privacy/partners/?hl=de

3. Twitter Inc., 1355 Market St, Suite 900, San Francisco, California 94103, USA https://help.twitter.com/en/rules-and-policies/update-privacy-policy

4. Instagram LLC., 1601 Willow Road, Menlo Park, CA 94025, USA https://help.instagram.com/519522125107875?helpref=page_content

5. YouTube LLC., 901 Cherry Ave., San Bruno, CA 94066, USA https://policies.google.com/privacy?hl=en&gl=de

6. Pinterest Inc., 808 Brannan Street, San Francisco, CA 94103, USA https://about.pinterest.com/de/privacy-policy

Change of purpose

We will only use your personal data for the purposes for which we collected it unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us.

If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

5. Disclosures of your personal data

We may have to share your personal data with the parties set out below for the purposes set out in the table in paragraph 4 above.

• Internal Third Parties as set out in the Glossary.

• External Third Parties as set out in the Glossary.

• Third parties to whom we may choose to sell, transfer, or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy notice.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

6. International transfers

We share your personal data within the Amtico Group and within the wider Mannington Mills group which owns the Amtico Group. This may involve transferring your data outside the UK and European Economic Area (EEA).

Some of our External Third Parties are based outside the UK and European Economic Area (EEA) so their processing of your personal data will involve a transfer of data outside the UK and EEA.

Whenever we transfer your personal data out of the UK and EEA, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

• We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the UK Government and European Commission. For further details, see International transfers | ICO (for UK) and Adequacy decisions | European Commission (europa.eu) (for EU/EEA); or

• Where we use certain service providers, we may use specific contracts as issued by the Information Commissioner’s Office under Section 119A Data Protection Act 2018 or as approved by the European Commission which gives personal data the same protection it has in the UK and Europe. These specific contracts currently include the International Data Transfer Agreement (IDTA) and the International Data Transfer Addendum to the European Commission’s Standard Contractual Clauses (Addendum) for UK and Standard Contractual Clauses for EEA). For further details, see International data transfer agreement and guidance | ICO (for UK) and Standard Contractual Clauses (SCC) | European Commission (europa.eu) (for EEA/EU).

Please contact us if you want further information on the specific mechanism used by us when transferring your personal data out of the UK and EEA.

7. Data security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

8. Data retention

How long will you process my personal data for?

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

Details of retention periods for different aspects of your personal data are available in our retention policy which you can request from us by contacting us.

In some circumstances you can ask us to delete your data: see Request erasure below for further information.

In some circumstances we may anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes in which case we may use this information indefinitely without further notice to you.

9. Your legal rights

Under certain circumstances, you have rights under data protection laws in relation to your personal data. Please click on the links below to find out more about these rights:

• Request access to your personal data.

• Request correction of your personal data.

• Request erasure of your personal data.

• Object to processing of your personal data.

• Request restriction of processing your personal data.

• Request transfer of your personal data.

• Right to withdraw consent.

• Right to lodge a complaint with a supervisory authority.

If you wish to exercise any of the rights set out above, please contact us.

No fee usually required

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

What we may need from you

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

Time limit to respond

We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

Glossary

LAWFUL BASIS

Legitimate Interest means the interest of our business in conducting and managing our business to enable us to give you the best service/product and the best and most secure experience. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law). You can obtain further information about how we assess our legitimate interests against any potential impact on you in respect of specific activities by contacting us.

Performance of Contract means processing your data where it is necessary for the performance of a contract to which you are a party or to take steps at your request before entering into such a contract.

Comply with a legal or regulatory obligation means processing your personal data where it is necessary for compliance with a legal or regulatory obligation that we are subject to.

Consent means your personal data will be processed on the basis of consent effectively given by you in advance.

THIRD PARTIES

Internal Third Parties

Other companies in the Amtico Group and/or the Mannington Mills group, acting as joint controllers or processors and who are based in Germany, Sweden, France, Hong Kong and the US.

External Third Parties

• Service providers acting as processors based in within and outside the EEA who provide IT and system administration services.

• Logistics providers who we use to deliver our products or product samples.

• Professional advisers acting as processors or joint controllers including lawyers, bankers, auditors and insurers based in the EEA and the USA who provide consultancy, banking, legal, insurance and accounting services.

• HM Revenue & Customs, regulators and other authorities acting as processors or joint controllers based in the United Kingdom, the EEA and the USA who require reporting of processing activities in certain circumstances.

• Credit agencies who we use to assess risk and prevent fraud.

YOUR LEGAL RIGHTS

You have the right to:

Request access to your personal data (commonly known as a "data subject access request"). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.

Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.

Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.

Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.

Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios: (a) if you want us to establish the data's accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.

Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.

Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

To lodge a complaint with a supervisory authority: You can contact the supervisory authority of your habitual residence, place of work or our company headquarters.

AMTICO GROUP LEGAL ENTITIES