Equiniti Share Plan Trustees Limited For APPS

Equiniti Share Plan Trustees Limited is one company within the Equiniti Group. Our main business is provision of Employee Share Plan services. Our registered address is Highdown House, Yeoman Way, Worthing, BN99 3HH and our Information Commissioner’s Office (ICO) registration number is Z7941663.

The Plan trustees are the ‘Data Controllers’. This means that we are responsible for deciding how and why we hold and use personal data about you.

This Privacy Notice covers the Plan trustee services provided by us in relation to the APSS as set out in the Plan’s trust deed and rules.

If you have questions about your Plan and services, please contact the Employee Helpline shown in your Plan documentation.

The personal information we hold may include your account number, title and name, postal address, your email address and phone number, date of birth, gender, nationality, payroll details such as salary, tax status and tax residency, your pay site code, your payroll reference, your PPS number and your salary bank account, financial information about the value of the Plan, the number of Plan shares, any Persons Discharging Managerial Responsibilities, Directors’ Interest or Closed Period indicators and elections made in connection with the running of the Plan or made as part of a Corporate Action.

This could include special personal data, if we need to record the reason why and when you are no longer an employee of the Company or temporarily not at work, for example due to injury or disability, in order to administer the Plan.

We use different kinds of personal data dependent upon the relationship you have with us, the Plan that you participate in and the products and services that you use. We collect it through a variety of different ways:

Information you provide to us

• By filling in forms via the website;
• By corresponding with us, either directly or via your employer, in writing, by phone, e-mail, live-chat or otherwise;
• Through application and registration forms, identification and legal documentation; and
• Through promotions or surveys.

Information we collect about you

• Images and voice recordings of your communications with us for quality control, training, security and regulatory purposes, but these can also capture your location e.g. use of home landline number;
• Information about the transactions and investments you make as part of the running of the Plan, including financial data and voting instructions; and
• If you contact us via social media, we will collect details from your social media account.

Information we receive from third parties

• Data from your employer as part of the set up and running of the Plan, including identification data, your contact details, information about your job, your payroll details and information about your share plan entitlement and participation;
• As part of our identity and financial crime checking procedures with credit reference agencies, fraud detection agencies and registration or stockbroking industry exchanges;
• In accordance with the Money Laundering Regulations when we require verification of your identity, we will conduct searches of databases and other credit data; and
• Market researchers.

Special types of data

The law and other regulations treat some types of personal information as special. We will only collect and use this information if the law allows us to do so:

• Criminal convictions and offences.
• Genetic and biometric data.
• Health data including gender.
• Racial or ethnic origin.
• Religious or philosophical beliefs.
• Trade union membership.

Keeping your personal data up to date

It is important to us that the information we hold about you remains accurate and up to date at all times, but we need your help in doing this. Please help us by ensuring that you review the

information held about you regularly and let your employer know as soon as anything needs updating or correcting.

Other people’s personal data

The information you give us in connection with your Plan, can contain your or another person’s personal data. If you provide us with information about another person, you confirm that they have appointed you to act for them and/or they consent to you providing their personal data to us and that you have informed

them of our identity and the purpose for which their personal data will be processed – as set out in this Privacy Notice.

In the table below we demonstrate why and how we use your personal data as well as providing the legal reasons which we rely upon.

Personal data will not be retained for longer than necessary for us to achieve the purpose for which we obtained your personal data. We will then either securely delete it or anonymise it so that it cannot be linked back to you. We review our retention periods for personal data on a regular basis.

We will retain personal data for the duration of the Plan and for a period of up to 8 years following the closure of the Plan, for the reasons noted below:

• To respond to enquiries and complaints;
• To demonstrate that your instructions were carried out properly; and
• To maintain records to meet rules and regulatory requirements that are applicable to the administration of the Plan.

For full details of our retention policies, please contact us.