DATA PRIVACY STATEMENT

INTRODUCTION

This statement contains:

Why and with whom we share your personal data
In which cases your personal data may be transferred abroad
How we protect the security and confidentiality of your personal data
The choices and rights available to you regarding the use of your personal data
How you can contact us about our privacy practices and to exercise your rights

The Privacy Policy was last reviewed and updated on 22/10/2021 and is effective as of that date.

KEY POINTS YOU NEED TO KNOW ABOUT HOW WE COLLECT AND USE YOUR DATA

We collect and use your personal data to administer our relationship with you, including to respond to your enquiries or complaints, to provide our products and Services to you, to manage our Contracts with you, to inform you about our products and services, partners, promotions and events, to administer and improve our Websites and Services, to respond to requests from authorities, to comply with our contractual and legal obligations, and for other legitimate business purposes. Colt does not share, sell, rent or trade personal data with third parties for promotional purposes.

When you express an interest in obtaining additional information about the Services, or registering to use the Web sites or other Services, or registering for an event, you provide the Company with personal contact information, such as name, company name, address, phone number, and email address ("Required Contact Information") to contact you. In addition, when you purchase the Services or get registered for an event, Colt may also require you to provide the Company with means for financial qualification and billing information, such as billing name and address, and the number of employees within the organization that will be using the Services ("Billing Information") which is not considered personal data.

We may ask you for information to enable us to provide a Service to you and we collect this information by telephone, written/digital correspondence or via the website.

Subject to your consent where required by law, we use cookies and other technologies to track the use of our websites and services. To learn about our use of cookies and your rights in that respect see below.

Subject to your consent where required by law, we may use your personal data to conduct marketing, promotional and informational activities and to perform business analytics, satisfaction surveys or market research and conduct direct marketing.

We may share your personal data with other entities of the Colt group of companies, with third party providers that we engage to process data on our behalf, when such sharing is required by law or other situations as permitted by law. In accordance with applicable law, you have the right to access personal data we hold about you, to rectify, delete or erase inaccurate data, to object, at any time and free of charge, to the processing of your personal data for direct marketing purposes, as well other rights under applicable law.

Your use of our Services and Websites, and the entering into our Contracts, constitute your consent to the processing and transfer of your personal data to India and to other Colt's entities which are located in other jurisdictions outside of the European Economic Area which may not provide the same level of data protection as your home country.

This privacy policy only applies to how to Colt deals with your personal data. It does not apply to any to any other company or to any other company´s websites even if you have accessed them through Colt. If you disclose your personal data to other companies your information will be dealt with according to their privacy practices.

FREQUENTLY ASKED QUESTIONS

What personal data will Colt collect?

For the purposes of this Privacy Policy, "personal data" means any information that identifies you, that could be used to identify you or that relates to you, and that you submit about you when interacting with us and/or is otherwise collected by us when you visit the Websites, by phone through our customer service, by writing through order forms or in another manner. During our relationship with you we may collect and process your personal data, such as your name, address, telephone, email and other contact details, and any other information relating to you which you may provide, in the following cases:

Visit our Websites and look at our Products and Services
Create an account on our Websites
Enquire about our products and Services or contact our customer service
Enter into a Contract with us and purchase our products and Services
Participate in a promotion, event, survey or other marketing campaign we organise
Sign up for our newsletters and other promotional materials.

Personal data that you provide us

The types of personal data we may obtain in connection with the previous cases are as follows:

Your name, address, and contact details (such as telephone, mobile and fax numbers, email address)
Details of contact persons (such as name, address, function/title, telephone and fax numbers, e-mail address)
Services provided, including online Services
Names, email addresses and telephone numbers of third parties you provide to us
Online account details including username, password and other credentials used to access Colt's products and Services
Financial and payment data such as banking details, invoices and payment terms as well as any personal data for fulfilling and legitimate processing billing information
Complaints and enquiries
Business profile
Tax identification number where you request products or services that require such information
Responses provided in response to surveys

Personal data collected by automated means

When you visit our Websites or use our Services, subject to your prior consent where applicable by law, we may collect personal data without you actively submitting such information, by automated means, using technologies such as cookies, web server logs, web beacons, and similar technologies as described below.

The types of personal data that we may collect through your visits to the Websites or use of the Services include, to the extent permitted under applicable law and, where required, subject to your express consent, are:

the date and time of visit, referring address (location from which a visitor comes to the Websites);
type of Internet browser, OS and device details;
visitor's IP address (a unique number that is assigned to any computer that connects to the Internet for identification purposes);
traffic data for calls or Internet session when you use our phone or Internet services, including called numbers, identification of the phone, duration of the call, date, duration and data volume of the Internet session;
as the case may arise location data generated during calls or Internet sessions;
history of the contact you have had with our customer service.

Personal data collected by third parties

Colt may also receive information about Customers from other sources, including third parties from whom we have purchased data, and combine this information with Data we already have about you. This helps us to update, expand and analyse our records, identify new customers, and create more tailored advertising to provide products and services that may be of interest to you. We will ensure that any marketing campaigns are aligned to GDPR requirements.

How do we use your personal data?

Colt shall only process your personal data for the purposes described in this Privacy Policy or as otherwise permitted under applicable law. The processing of your personal data by Colt for the purposes described hereunder is based on your explicit consent or on the necessity to process your personal data for the purposes of our legitimate interests, as provided by Article 9, 2., (a) and (f) of the General Data Protection Regulation (EU) 2016/679 of 27 April 2016 ("GDPR").

Your personal information may be processed, both by Colt and its affiliates, for purposes including:

administer our relationship with you, including to respond to your inquiries or complaints;
to provide any goods, Services or information you have requested and information about our products and Services;
to administer, operate, maintain, and improve the Websites and our Services;
for efficient customer management relationship;
to simplify access to some interactive features on our Websites or Services;
to manage your accounts, orders, invoices and payments;
to manage and provide after-sale services;
to administer accounting and taxes;
to respond to requests from administrative or judicial authorities; and
to comply with applicable laws and regulations.

Providing personal data for these purposes is necessary and refusal would make it impossible for Colt to manage the Contract with you or to comply with its contractual and legal obligations. Subject to your consent where required by law, we may also use your personal data in order:

to keep improving the way our website works.
to count how many persons visit our websites, where they come from, when they visit, how long they stay and what pages they look at.
to associate your activity on our website in order to give us insights into products and services you might like and measure how our advertising performs
to note browser, OS and device details used to make sure you get a good online experience when you access our websites.
to provide you access to valuable Colt internet-based information and Services;
to audit usage of the Websites;
to market and improve the Services that we offer; and
to conduct promotions campaigns, survey and other marketing initiatives pursuant to the "How do we use your personal data for marketing purposes?" section to follow.
Let you know about other offers and discounts
Understand how you use products & services to develop newer & better versions
Carry out research and statistical analysis including to monitor how all customers use our network, products and services on an anonymous or business by business basis
Prevent and detect fraud or other crimes, recover debts or trace those who owe us money

Providing personal data for marketing purposes is optional and refusal will have no consequence on the performance of any Contract by Colt.

In order to provide you with a better experience and to improve the quality of our Services, to the fullest extent permitted by applicable law, we may combine the information you submit to us with other information that we may receive from you, from third parties, or with other public demographic information.

In addition, we collect information from visitors to our websites to help us to make improvements to the websites and to the Services we make available. We know, for instance, how many visitors there are to each website page, when they visited, for how long and to which areas of the website. We may share this information with our advertisers and to other companies that offer their goods or services on our websites. It helps us to show these organisations how effective our website is as a sales channel for products. You or any other individual cannot be identified from the information we share as the data is aggregated and anonymised.

Why and with whom do we share your personal data?

Our policy is to not give, sell or otherwise distribute personal data we collect to third parties outside of Colt, except where required with your express consent or where this is necessary and in accordance with applicable law. In line with this, we share personal data with the recipients listed below.

Colt subsidiaries and affiliated entities ('Colt Affiliates'). We may share your personal data with other companies of the Colt Group (a list of Colt Affiliates is available at https://www.colt.net/legal/ and then selecting the option Colt Group of Companies. For the purposes specified under the "How do we use this information?" section previous and as described under the "Will Personal Data be transferred abroad?" section in this document.

Third party service providers. Your personal data may be disclosed to third party service providers, acting on our behalf, in connection with managing services, data analytics, finance, accounting or other administrative services and information technology support. These third party service providers will have access to – and process – personal data only on our behalf and under our instructions and will be held to appropriate security obligations.

Colt's business partners. A list of such partners could be provided to Customers upon request provided there is a legitimate reason.

Other data recipients. For the above purposes or where otherwise required by law, we may also need to make personal data available to third parties such as advisors, banks and financial institutions, professionals, independent consultants, potential or existing investors and/or acquirers (in connection with a merger, acquisition, or sale involving Colt or its affiliates or as part of a corporate reorganization, stock or asset sale, or other change in corporate control), regulatory and/or administrative authorities, courts, police authorities

Colt may provide information, in response to properly made requests, for the purposes of the prevention and detection of crime, and the apprehension or prosecution of offenders, when required to do so by law, for example under a court order, or in response to properly made court or administrative demands. Colt may also provide information for the purpose of safeguarding national security. In either case, Colt will act in accordance with applicable Data Protection Law.

Other telecommunications operators. Colt receives information from other telecommunications operators about their customers to enable Colt to enter their details (together with our own customer´s information) in telephone directories. We also make telephone numbers available on directory enquiry services unless customers (BT or other licensed telecommunications operators) have chosen to be ex-directory.

We may also disclose personal data about you when you explicitly consent (via contract or other legal instrument) to such transfer or when we believe disclosure is necessary or appropriate for our legitimate interests (or those of the third party to whom we disclose your data), provided that they are not overridden by the data subject's interests or fundamental rights and freedoms, in accordance with applicable laws.

We may share with third parties certain pieces of aggregated, non-personal information, such as how our customers use of our Services or Websites. Such information would not identify you individually.

Please note that when you order goods and services from Colt, the Company may make enquiries about you for credit reference purposes. These enquires include searching your records held by a credit reference agency. At all times where your information is disclosed to us we will protect it in accordance with this policy and keep it secure.

Will personal data be transferred abroad?

In the performance of our Contract with you or in providing our Services or Websites to you, we may need to transfer your personal data to Colt Affiliates, business Partners or other recipients identified in the "Why and with whom do we share your personal data?" section previous that are located inside and outside the European Economic Area ("EEA"), including in countries that do not provide the same level of protection for personal data as in the EEA. In any case, we will only transfer personal data to recipients that provide an adequate level of data protection or as permitted by applicable data protection laws by implementing appropriate safeguards, including, but not limited to, relevant data transfer agreements. Colt has implemented an IGTA (International Group Transfer Agreement) based on Model Clauses contract, which makes Colt compliant with GDPR International Transfer Data Protection Rules, Brexit and Privacy Shield null declaration. The IGTA standardizes the governance around the transfer of personal data between Colt entities and includes standard contractual clauses approved by the European Commission ("Model Clauses").

Colt BCRs controller and processor have been approved by the European Data Protection Board (EDPB) August 02, 2021. The approval was published in the official Gazette of the EDPB on August 05, 2021 and ratified by the Spanish Data Protection Authority, as Colt ́s BCR leading Authority August 16, 2021. The EDPB approved the Privacy and GDPR compliance programme implemented by Colt across the whole group. The approved privacy programme is legally binding on every company of the group.

Colt BCR Controller and Processor decisions are published at the European Data Protection Board(EDPB) website https://edpb.europa.eu/our-work-tools/accountability-tools/bcr_en and in the Spanish Data Protection Authority ("AEPD") website: https://www.aepd.es/es/documento/ti-00003-2021-resolucion-aprobacion-bcr-responsable-colt.pdf

The Binding Corporate Rules ("BCRs") are the golden privacy certification approved by three European Data Protection Authorities as well as the European Data Protection Board which allows:

Colt to have the highest recognition in privacy that a group of companies can have.
Transfer of personal data easily between all Colt´s entities.
Keeping the same levels and standards of privacy compliance all over Colt worldwide.

Please be aware that the personal data (e.g. your name and email address) you may provide through the chat bot available at the portal https://online.colt.net/ will be stored at Google LLC Cloud servers in US. You are informed before you interact with the chat bot and should you not wish to continue, you can close the chat bot. Adequate international data transfer safeguards and security measures have been implemented to keep your personal data safe and secure. For further information on how Google secures your data please visit https://cloud.google.com/security/gdpr/resource-center.

Colt vendor risk management procedure

As part of Colt´s Privacy Governance Policy, Colt ensures vendors privacy compliance through a Vendor Risk Assessment Tool to implement a Vendor Data Privacy Due Diligence including appropriate security, technical and organisational measures and legal checking. Once the Privacy Due Diligence is positively completed, prior to sharing any personal data with vendors, a Data Processing Agreement containing all the requirement stipulated in Article 28 of the GDPR is executed between the parties. In addition, if any personal data needs to be transferred to a third country outside the European Union, as per Article 46 of the GDPR, Model Clauses are executed between the parties involved to assure that personal data is processed with the same level of protection that in the European Union. Furthermore, Colt reviews vendor status on Data Protection at contract renewal and carries out audits to check vendors privacy compliance.

How is your personal data protected?

Colt has appropriate policies and technical and organizational measures in place to safeguard and protect your personal data against unlawful or unauthorised access, accidental loss or destruction, damage, unlawful or unauthorised use and disclosure. We will also take all reasonable precautions to ensure that our staff and employees who have access to personal data about you have received adequate training.

How long do we keep your personal data for?

We have a retention policy for personal data that we adhere to, in line with legal and statutory requirements. For further details regarding this please contact the DPO (Data Protection Office) at Colt using the email address [email protected]. We also may retain your information for the period of time needed for Colt to pursue legitimate business interests, conduct audits, comply with our legal obligations, resolve disputes and enforce our agreements.

What happens when you provide us with personal data about third parties?

If you provide us with personal data about third parties, you warrant, represent, and undertake that you have complied with applicable data protection laws including informing and obtaining all necessary consents and approvals for the provision of such personal data to Colt and the processing by Colt of this personal data as described in this Privacy Policy.

How can you update or delete your personal data?

In accordance with applicable data protection laws, you have the right to access personal data we hold about you and request the rectification or erasure of any inaccurate data. You may exercise such rights by contacting us as described under the " What are your data protection rights?" section below.

When you register online for a Colt account, you can also view and update your personal data by logging onto the Website and following the relevant instructions. To ensure any details we hold about you remain accurate, please update your personal data if it changes or send a request to us as described under the "What are your data protection rights?" section below. If you close your account we may, for limited periods and in accordance with applicable law, retain some personal data in order to comply with legal obligations or for other proper purposes, such as legal retention obligations, collecting outstanding debts or resolving legal disputes.

When you request to be removed from certain marketing offers, you will, in accordance with applicable data protection laws, be added to the relevant internal suppression list(s) to ensure your request is complied with.

How do we use your personal data for marketing purposes?

We may use your personal data to conduct marketing, promotional and informational activities and to perform business analytics, satisfaction surveys or market research and direct marketing purposes in general, including sending notifications about updates to the Websites, information on our services we think may be of interest to you, initiatives or events by mail, e-mail, phone, fax, SMS, MMS or other electronic means. However, we will only do so in accordance with GDPR requirements prior to being contacted in this way and/or subject to relevant legal requirements. If you no longer wish to receive marketing information, please inform us by email or using the UNSUBSCRIBE option available on the communication.

How do we use your personal data for monitoring and recording of calls?

Your telephone calls to us may be recorded for the purposes of staff training and service quality, as well as evidence of a commercial transaction, subject to applicable law. You will be informed about this in a recorded message before your call is put through to a member of staff. Calls that are recorded for these purposes will be kept secure, will not be disclosed outside our group of companies, other than for operational purposes, and will be deleted in accordance with our policies and relevant legal requirements.

How do we treat children's personal data?

We do not knowingly collect personal data from anyone under the age of 18 or knowingly allow such persons to register on our Websites or Services.

What are your data protection rights?

In accordance with applicable data protection law, you have a right to:

obtain confirmation of the existence of, and to request a written copy of the personal information Colt holds about you.
have any inaccurate information about you corrected;
have personal data we hold about you deleted, blocked or removed;
withdraw your consent where relevant, without affecting the lawfulness of processing based on your consent before its withdrawal;
restrict the processing we make in relation with your personal data;
receive your personal data, which you have provided to us, in a structured, commonly used and machine-readable format in order to transmit them to another data controller;
object to the use of your details for marketing activities and other promotional activities, as described under the "How do we use your personal data for marketing purposes?" section previous; and
lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of your personal data relating infringes applicable data protection law.

In case you wish to exercise any such rights, please send a written and signed request to Colt as described under the "How can you contact us?" section below.

What happens if you visit a linked website?

The information obtained by third party websites accessed via our Website is not covered by this Privacy Policy and is governed by the terms applicable to your relationship with that third party, and Colt accepts no responsibility or liability in respect of third party websites.

How can we update this policy? / How can you contact us?

We reserve the right to review this Privacy Policy at any time. Where appropriate or required by law, we will notify you about the new privacy Policy by posting appropriate notice on our Services or Website or by e-mail (to the extent that we have your e-mail address). We encourage you to periodically review this Privacy Policy to stay informed about our information practices. We will indicate above the date on which this Privacy Policy was last modified. Your continued use of our Services or Website and participation in Colt events constitutes your agreement to the revised Privacy Policy. If you do not agree to the new Privacy Policy, you must discontinue.

If you have any questions about this Privacy Policy, or if you wish to exercise your rights under applicable data protection laws, please feel free to contact us through our Website or write to us at:

The Group Data Protection Officer

Colt Technology Services Group Limited

Colt House | 20 Great Eastern Street | London | EC2A 3EH | UK

We can be reached via email at [email protected].