DATA PRIVACY STATEMENT

INTRODUCTION

This statement contains:

Why and with whom we share your personal data
In which cases your personal data may be transferred abroad
How we protect the security and confidentiality of your personal data
The choices and rights available to you regarding the use of your personal data
How you can contact us about our privacy practices and to exercise your rights

The Privacy Policy was last reviewed and updated on 19/02/2026 and is effective as of that date.

KEY POINTS YOU NEED TO KNOW ABOUT HOW WE COLLECT AND USE YOUR DATA

We collect and use your personal data to administer our relationship with you, including to respond to your enquiries or complaints, to provide our products and services to you, to manage our contracts with you, to inform you about our products, services, partners or events, where legally permitted, , to administer and improve our Websites and Services, to respond to requests from authorities, to comply with our contractual and legal obligations, and for other legitimate business purposes. Colt does not share, sell, rent, or trade personal data with third parties for promotional purposes.

When you express an interest in obtaining additional information about the Services, or registering to use the websites or other Services, or registering for an event, you provide the Company with personal contact information, such as name, company name, address, phone number, and email address ("Required Contact Information") to contact you. In addition, when you purchase the Services or register for an event, Colt may also require you to provide us with means for financial qualification and billing information, such as billing name and address, and the number of employees within the organization that will be using the Services.

We may ask you for information to enable us to provide a Service to you and may collect this information by telephone, written/digital correspondence or via the website.

Subject to your consent where required by law, we use cookies and other technologies to track the use of our websites and services. To learn about our use of cookies and your rights in that respect please consult our Cookies Policy.

Subject to your consent where required by law, we may use your personal data to conduct marketing, promotional and informational activities and to perform business analytics, satisfaction surveys or market research.

We may share your personal data with other entities of the Colt group of companies, with third party providers that we engage to process data on our behalf, when such sharing is required by law or other situations as permitted by law. In accordance with applicable law, you have the right to access personal data we hold about you, to rectify, delete or erase inaccurate data, to object, at any time and free of charge, to the processing of your personal data for direct marketing purposes, as well other rights under applicable law.

Your use of our Services and Websites, and the entering into our contracts, constitute your consent to the processing and transfer of your personal data to India and to other Colt's entities which are located in other jurisdictions outside of the European Economic Area subject to the implementation of appropriate safeguards under Articles 45–46 GDPR.

This privacy policy only applies to how Colt deals with your personal data. It does not apply to any other company or to any other company´s websites even if you have accessed them through Colt. If you disclose your personal data to other companies your information will be dealt with according to their privacy practices.

FREQUENTLY ASKED QUESTIONS

What personal data will Colt collect?

For the purposes of this Privacy Policy, "personal data" means any information that identifies you, or could be used to identify you, or that otherwise relates to you personally, and which you provide when interacting with us and/or is otherwise collected by us when you visit the Websites, through our customer service channels (phone, digital correspondence, online forms, or other methods).

During our relationship with you we may collect and process your personal data, such as your name, address, telephone, email and other contact details, and any other information relating to you which you may provide, in the following circumstances:

Visiting our Websites and look at our Products and Services.
Creating an account on our websites.
Enquiring about our products and Services or contact our customer service
Entering into a Contract with us and purchase our products and Services
Participating in a promotion, event, survey or other marketing campaign we organise
Sign up for our newsletters and other promotional materials.

Personal data that you provide us

The types of personal data we may obtain in the above scenarios include:

Your name, address, and contact details (such as telephone, mobile, email address)
Details of contact persons (such as name, address, function/title, telephone, e-mail address)
Services provided, including online Services
Names, email addresses, and telephone numbers of third parties you provide to us
Online account details including username, password and other credentials used to access Colt's products and Services
Financial and payment data such as banking details, invoices and payment terms as well as any personal data for legitimate billing, invoicing and payment processing.
Complaints and enquiries
Business profile
Tax identification number where required for specific products or services.
Responses provided in surveys.

Personal data collected by automated means

When you visit our Websites or use our Services, and subject to your consent when required by law, we may automatically collect information using technologies such as cookies, server logs, web beacons, and similar tools.

The types of personal data collected through these means may include:

Date and time of visit, referring address (location from which a visitor accessed the site);
Type of Internet browser, Operating System and device details.
Visitor's IP address.
Traffic data (e.g., called numbers, device identification, duration of calls, date/duration of sessions, data volume used)
Location data generated during calls or sessions, where applicable
History of interactions with our customer service.

Personal data collected by third parties

Colt may also receive information about Customers from third parties, including licensed data providers, and combine it with the data we already hold to update or enrich our records, identify potential new customers, improve segmentation and analysis, and deliver more tailored communications about products and services. We ensure that any such processing complies with GDPR, including requirements for transparency, lawful basis, and respect for marketing preferences

How do we use your personal data?

Colt shall only process your personal data for the purposes described in this Privacy Policy or as otherwise permitted under applicable law. The lawful bases relied upon include Article 6(1) GDPR (performance of a contract, compliance with legal obligations, legitimate interests, and—where applicable—your consent). Special categories of data are processed only under the conditions of Article 9 GDPR where strictly necessary.

Your personal information may be processed, by Colt and its affiliates, for purposes including:

administering our relationship with you, including responding to enquiries or complaints.
providing goods, Services or information requested by you.
administering, operating, maintaining, and improving the Websites and our Services.
efficient customer relationship management.
simplifying access to interactive features on our Websites or Services.
managing accounts, orders, invoices and payments.
providing after-sale services.
administering accounting and taxes.
responding to administrative or judicial authority requests
complying with applicable laws and regulations.

Providing personal data for these purposes is necessary and refusal would make it impossible for Colt to manage the Contract with you or to comply with its contractual and legal obligations.

If required by law, personal data may also be processed based on your consent—for example, for:

improving the way our website works.

· performing analytics to understand usage patterns measuring advertising effectiveness ensuring a consistent and secure user experience across browsers and devices

· providing access to internet‑based information and services

· conducting promotions, surveys, or marketing initiatives

Providing personal data for marketing purposes is optional and refusal does not affect your ability to use our core Services.

We may combine the information you submit to us with other information we lawfully receive from third parties or public sources to improve the relevance and effectiveness of our products, services, and communications, to the extent permitted by law.

In addition, we collect data from website visitors to improve our Websites and Services, such as number of visitors, visit durations and patterns, pages viewed, referral sources. Such data may be shared with advertisers or partners in an aggregated and anonymised form that does not identify individuals.

Why and with whom do we share your personal data?

We may share your personal data with the following categories of recipients, but only where such sharing is compliant with applicable data protection laws and subject to appropriate safeguards:

Colt subsidiaries and affiliated entities ('Colt Affiliates'): To ensure efficient operations and delivery of services, your personal data may be shared with other entities within the Colt group of companies. A full list of all of our legal entities is available at https://docs.colt.net/legal/colt-group-of-companies

Such sharing is carried out under Colt’s EU and UK Binding Corporate Rules (BCRs) to ensure a consistent and high level of protection.

Third-party service providers: Your personal data may be disclosed to third party service providers, acting on our behalf, in connection with managing services, data analytics, finance, accounting or other administrative services and information technology support. These third-party service providers will have access to – and process – personal data only on our behalf and under documented instructions and will be held to appropriate security obligations.

Colt's business partners: In certain circumstances, and only where permitted by law, we may share personal data with selected business partners to enable product or service fulfilment, co‑branded offerings, or event participation or registration. A list of such partners could be provided to Customers upon request provided there is a legitimate reason.

Other data recipients: For the above purposes or where otherwise required by law, we may also need to make personal data available to third parties such as advisors, banks and financial institutions, professionals, independent consultants, potential or existing investors and/or acquirers (in connection with a merger, acquisition, or sale involving Colt or its affiliates or as part of a corporate reorganization, stock or asset sale, or other change in corporate control subject to confidentiality obligations and only to the extent necessary to progress the transaction), regulatory and/or administrative authorities, courts, police and other enforcement authorities.

Colt may provide information, in response to properly made requests, for the purposes of the prevention and detection of crime, and the apprehension or prosecution of offenders, when required to do so by law, for example under a court order, or in response to properly made court or administrative demands. Colt may also provide information for the purpose of safeguarding national security. In either case, Colt will act in accordance with applicable Data Protection Laws.

Other telecommunications operators. Colt receives information from other telecommunications operators about their customers to enable Colt to enter their details (together with our own customer´s information) in telephone directories. We also make telephone numbers available on directory enquiry services unless customers (BT or other licensed telecommunications operators) have chosen to be ex-directory.

We may also disclose personal data about you when you explicitly consent (via contract or other legal instrument) to such transfer or when we believe disclosure is necessary or appropriate for our legitimate interests (or those of the third party to whom we disclose your data), provided that they are not overridden by the data subject's interests or fundamental rights and freedoms, in accordance with applicable laws.

We may share with third parties certain pieces of aggregated, non-personal information, such as how our customers use of our Services or Websites. Such information would not identify you individually.

Please note that when you order goods and services from Colt, the Company may make enquiries about you for credit reference purposes. These enquires include searching your records held by a credit reference agency. At all times where your information is disclosed to us we will protect it in accordance with this policy and keep it secure.

Will personal data be transferred abroad?

In the performance of our Contract with you or in providing our Services or Websites to you, we may need to transfer your personal data to Colt Affiliates, business Partners or other recipients located inside and outside the European Economic Area ("EEA"), including third countries that may not have been granted an adequacy decision by the European Commission. In any case, we will only transfer personal data to recipients that provide an adequate level of data protection or as permitted by applicable data protection laws by implementing appropriate safeguards, including, but not limited to relevant data transfer agreements. Colt has implemented an IGTA (International Group Transfer Agreement) based on the Standard Contractual Clauses adopted by the European Commission on 4 June 2021,, which makes Colt compliant with GDPR International Transfer Data Protection Rules, Brexit and following the invalidation of the EU–US Privacy Shield and in line with the subsequent Data Privacy Framework. . The IGTA standardizes the governance around the transfer of personal data between Colt entities and includes standard contractual clauses approved by the European Commission ("SCCs").

Colt EU BCRs controller and processor have been approved by the European Data Protection Board (EDPB) August 02, 2021. The approval was published in the official Gazette of the EDPB on August 05,2021 and ratified by the Spanish Data Protection Authority, as Colt ́s BCR leading Authority August 16, 2021. The EDPB approved the Privacy and GDPR compliance programme implemented by Colt across the whole group. The approved privacy programme is legally binding on every company of the group.

Colt BCR Controller and Processor decisions are published at the European Data Protection Board (EDPB) website and in the Spanish Data Protection Authority ("AEPD") website.

Colt has also obtained approval from the UK Information Commissioner's Office (ICO) for Colt's UK Controller BCRs and Colt's UK Processor BCRs. Confirmation of such approval can be found on the ICO's website. For further information please consult our dedicated description at: https://docs.colt.net/legal/data-privacy/our-binding-corporate-rules-bcrs-and-iso27701-certifications

The Binding Corporate Rules ("BCRs") are “the golden privacy certification” which represent the highest level of approval available for intra‑group international transfers under the GDPR and the UK GDPR, which allows:

Colt to have the highest recognition in privacy that a group of companies can have. Each set of BCRs is legally binding on all Colt entities, ensuring that the entire Colt group of companies adhere to the same standards of privacy and data protection compliance.
Transfer of personal data easily between all Colt´s entities.
Keeping the same levels and standards of privacy compliance all over Colt worldwide as BCRs act as appropriate safeguards under Art. 46 GDPR.

Colt vendor risk management procedure

As part of Colt´s Privacy Governance Policy, Colt ensures vendors´ privacy compliance through a Vendor Risk Assessment Tool to implement a Vendor Data Privacy Due Diligence covering appropriate security, technical and organisational measures and legal assessment. Once the Privacy Due Diligence is positively completed, and prior to sharing any personal data with vendors, a Data Processing Agreement containing all the requirements stipulated in Article 28 of the GDPR is executed between the parties. In addition, if any personal data needs to be transferred to a third country outside the European Union, Colt implements the European Commission’s Standard Contractual Clauses adopted on 4 June 2021 in accordance with Article 46 GDPR, and applies supplementary measures where required under the Schrems II ruling. Furthermore, Colt reviews vendor compliance status on Data Protection at contract renewal conducts periodic risk based monitoring and carries out audits to check vendors privacy compliance.

How is your personal data protected?

Colt has appropriate policies, procedures, technical and organizational measures in place to safeguard and protect your personal data against unlawful or unauthorised access, accidental loss or destruction, damage, or unlawful or unauthorised use and disclosure. These measures are implemented considering the nature of the processing, the scope and context in which we operate, and the risks to the rights and freedoms of individuals, in line with Article 32 GDPR.

We will also take appropriate and proportionate precautions to ensure that our staff and employees who have access to personal data have received adequate mandatory training and that such access is granted strictly on a need‑to‑know basis.

Colt also requires third‑party service providers to implement security measures that are consistent with GDPR, UK GDPR and industry standards.

How long do we keep your personal data for?

We have a retention policy for personal data that we adhere to, in line with legal and statutory requirements. Our retention periods are determined based on the nature of the personal data, the purposes for which it is processed, applicable legal obligations, and the need to maintain accurate business and financial records in accordance with GDPR, UK GDPR and other applicable regulations.

We may also retain your information for the period of time needed for Colt to pursue specific and documented business needs such as maintaining operational records, defending legal claims, conducting internal or external audits, and ensuring compliance with regulatory and contractual obligations, resolve disputes and enforce our agreements. For further details on our retention schedule please contact the DPO (Data Protection Office) at Colt using the email address gdpr@colt.net.

What happens when you provide us with personal data about third parties?

If you provide us with personal data about third parties, you warrant, represent, and undertake that you have complied with applicable data protection laws including informing and obtaining all necessary consents and approvals for the provision of such personal data to Colt and the processing by Colt of this personal data as described in this Privacy Policy.

How can you update or delete your personal data?

In accordance with applicable data protection laws, you have the right to access personal data we hold about you and request the rectification or erasure of any inaccurate data, and other privacy rights as per the GDPR. You may exercise such rights by contacting us as described under the " What are your data protection rights?" section below.

When you register online for a Colt account, you can also view and update your personal data by logging onto the Website and following the relevant instructions. To ensure any details we hold about you remain accurate, please update your personal data if it changes or send a request to us as described under the "What are your data protection rights?" section below. If you close your account we may, for limited periods and in accordance with applicable law, retain some personal data to comply with legal obligations or for other proper purposes, such as maintaining statutory records, collecting outstanding debts, resolving legal disputes or ensuring compliance with contractual and regulatory obligations. When you request to be removed from certain marketing offers, you will, in accordance with applicable data protection laws, be added to the relevant internal suppression list(s) to ensure full compliance with your preferences.

How do we use your personal data for marketing purposes?

We may use your personal data to conduct marketing, promotional and informational activities and to perform business analytics, satisfaction surveys or market research for direct marketing purposes, including sending notifications about updates to the Websites, information on our services we think may be of interest to you, initiatives or events by mail, e-mail, phone, , SMS, MMS or other electronic means. However, we will only do so in accordance with GDPR requirements and applicable ePrivacy rules. You have the right to object at any time to the processing of your personal data for direct marketing purposes, including profiling related to such marketing. If you no longer wish to receive marketing information, please inform us by email or using the UNSUBSCRIBE option available on the communication.

How do we use your personal data for monitoring and recording of calls?

Your telephone calls to us may be recorded for the purposes of staff training and service quality, as well as evidence of a commercial transaction, subject to applicable law. Call recording is carried out on the basis of our legitimate interests (Article 6(1)(f) GDPR) in improving our services and ensuring service quality, or on the basis of contract performance (Article 6(1)(b) GDPR) where recordings are required to document a commercial transaction.

You will be informed about this in a recorded message before your call is put through to a member of staff. Where call recording is not necessary for contractual or legal purposes, you may choose to continue the call without being recorded, where technically feasible.

Calls that are recorded for these purposes will be kept secure, will not be disclosed outside our group of companies, other than for operational purposes, and will be deleted in accordance with our policies and relevant legal requirements.

How do we treat children's personal data?

We do not knowingly collect personal data from anyone under the age of 18 or knowingly allow such persons to register on our Websites or Services.

What are your data protection rights?

In accordance with applicable data protection law (GDPR), you have a right to:

obtain confirmation of the existence of, and to request a written copy of the personal information Colt holds about you.
have any inaccurate information about you corrected.
have personal data we hold about you deleted, blocked or removed.
withdraw your consent where relevant, without affecting the lawfulness of processing based on your consent before its withdrawal.
restrict the processing we make in relation with your personal data.
receive your personal data, which you have provided to us, in a structured, commonly used and machine-readable format to transmit them to another data controller.
object to the use of your details for marketing activities and other promotional activities, as described under the "How do we use your personal data for marketing purposes?" section.
lodge a complaint with a supervisory authority, in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of your personal data relating infringes applicable data protection law.

In case you wish to exercise any such rights, please send a written and signed request to Colt as described under the "How can you contact us?" section below.

What happens if you visit a linked website?

The information obtained by third party websites accessed via our website is not covered by this Privacy Policy and is governed by the terms applicable to your relationship with that third party, and Colt accepts no responsibility or liability in respect of third-party websites.

Our websites may contain links to third‑party websites. This Privacy Statement does not apply to those websites, which are governed by their own privacy policies. Colt accepts no responsibility or liability for the practices, policies, or content of third-party websites.

How can we update this policy? / How can you contact us?

We may update this Privacy Statement from time to time. When we make material changes, we will notify you through our website or other appropriate communication channels.

We encourage you to periodically review this Privacy Policy to stay informed about our data processing practices.

If you have any questions about this Privacy Policy, or if you wish to exercise your rights under applicable data protection laws, you can contact:

The Group Data Protection Officer

Colt Technology Services Group Limited

Colt House | 20 Great Eastern Street | London | EC2A 3EH | UK

Email: gdpr@colt.net.