If you are an individual in the European Economic Area (the “EEA”), this addendum applies to you. This addendum supplements our privacy policy (the “Policy”) and prevails over any conflicting provisions in the Policy.

1. Your rights

You have a number of legal rights in relation to the personal data that we hold about you. The following is a summary of each of the rights you may exercise.

• (a) the right to obtain information regarding the processing of your personal data and access to the personal data which we hold about you;
• (b) the right to request that we rectify your personal data if it is inaccurate or incomplete;
• (c) the right to request that we erase your personal data in certain circumstances. This may include (but is not limited to) circumstances in which:
  • (i) it is no longer necessary for us to retain your personal data for the purposes for which we collected it;
  • (ii) we are only entitled to process your personal data with your consent, and you withdraw your consent; or
  • (iii) you object to our processing of your personal data for our legitimate interests, and our legitimate interests do not override your own interests, rights and freedoms;
• (d) the right to request that we restrict our processing of your personal data in certain circumstances. This may include (but is not limited to) circumstances in which:
  • (i) you dispute the accuracy of your personal data (but only for the period of time necessary for us to verify its accuracy);
  • (ii) we no longer need to use the personal data except for the establishment, exercise or defence of legal claims; or
  • (iii) you object to our processing your personal data for our legitimate interests (but only for the period of time necessary for us to assess whether our legitimate interests override your own interests, rights and freedoms);
• (e) the right to object to us about our processing of your personal data.
• (f) the right to receive any personal data which we process about you on the basis of your consent or on a contract (as opposed to any other legal ground) and where the processing is carried out by automated means in a structured, commonly used and machine-readable format and/or request that we transmit that data to a recipient where this is technically feasible. Please note that this right only applies to personal data which you have provided to us;
• (g) the right to withdraw your consent to our processing of your personal data at any time. Please note, however, that we may still be entitled to process your personal data if we can rely on another legal ground for doing so.

You can exercise your rights by contacting us using the information about us indicated in Section 2 of the Policy. You can also lodge a complaint with the data protection regulator if you think that any of your rights have been infringed by us.

2. Data Transfer Outside EEA countries and UK

In the event that the recipients of your personal data are located in third countries for which the EU Commission has not made an adequacy decision to the effect that an adequate level of data protection exists in these third countries, we will take other measures to implement appropriate guarantees for the protection of your personal data in accordance with the GDPR. Personal data is only transferred to external recipients in third countries if, for example, (i) they have concluded EU standard contractual clauses with us or (ii) they are certified under the Privacy Shield for recipients based in the USA. For further information on the respective guarantees, please refer to the following links:

• • EU Standard Contractual Clauses
• • Privacy Shield

Further information and a copy of the implemented measures can be obtained upon request from us (see the information about us indicated in Section 2 of the Policy).

3. Contacts

If you have any questions about the Policy, this addendum, your rights, or any other issues regarding the protection of your personal data, our contact information indicated in Section 2 of the Policy.