Who we are and how we process your personal data

PageGroup Plc including its subsidiaries (hereinafter collectively: "PageGroup", "us" or "we") is a specialist recruitment company operating under the brands Michael Page, Page Personnel, Page Executive and Page Outsourcing. The protection of personal data relating to you is important to us. This Privacy Policy informs you about the categories of personal data we collect, the purposes for which we use them and how we process your data, when you visit our website, or when we maintain a relationship with you. The following information is directed at you if you fall into one of the following categories of individuals:

• PageGroup investors.
• User/visitor of our page.com website.

(jointly referred to as "you" or "yours").

If you are a candidate, client, potential candidate or potential client, or a service provider, please follow this LINK to view the relevant online privacy policy that applies to you depending on your location and your relationship with us.

Controller

The controller of your data for the purposes described above is PageGroup Plc.

Details of data processing

Below you will find an overview of what kind of personal data we process about you, for which purposes, on which legal basis and where we collect this data.

Users of our website

Purpose	Data categories	Legal basis	Collection of your Data	Recipients of your Data
When you visit our website, we process your data for the following purposes: Calling up the website Ensuring smooth connection establishment, Ensuring and optimising the performance of our website and the user-friendliness of our website Ensuring and evaluating system security and stability In this context, we also use various cookies and other technologies. For further information, see our Cookie Policy.	In this context, we process the following data: IP address of the requesting Internet-enabled device Date and time of access Name and URL of the retrieved file, Website/application from which the access was made (referrer URL), the browser you use and, if applicable, the operating system of your Internet-enabled computer Name of your access provider	The data processing is based on the following legal bases: Art. 6 (1) (f) GDPR - our legitimate interest in the security, stability, and usability of our website. Art. 6 (1) (a) GDPR – your consent if you accepted cookies.	We collect the data directly from you.	It is possible that the following service providers have access to your data: IT Data analytics Marketing

Investors

Purpose	Data categories	Legal basis/legitimate interest	Collection of your Data	Recipient categories
Relationship management.To manage our relationship with you or your business, for registrar management, registration of shares transaction, processing of administrative changes to shareholder records, payment of dividends and interest payment, SCRIP dividend process (if applicable), DRIP process (if applicable),provision of internet and telephone -based services, share dealing services, to respond to queries and complaints, Annual General Meeting services, Management reporting and data feeds, and other Investor-related services.	In this context, we may process the following data: Name. Email address. Telephone number. Date of birth. Nationality. Bank account No. Insurance No. Passport No. ID No. Shareholdings. Communication method preference Any data that is mirrored from the CREST system.	The data processing is based on the following legal bases: Art. 6 (1) (b) GDPR - establishment, performance, or termination of the contract with you. Art. 6 (1) (f) GDPR - our legitimate interest in maintaining our relationship with you. Art. 6 (1) (c) GDPR - compliance with a legal obligation (Companies Act and other applicable legal regimes).	We collect the data directly from you.	It is possible that service providers from the following areas have access to your data: Registrar services service provider.
We process your data to send you custom news and regulatory news such as acquisitions and alliances, results, reports and presentations, shareholder meetings, trading updates and other similar content.	In this context, we may process the following data: Email address. Your marketing information and preferences.	The data processing is based on the following legal bases: Art. 6 (1) (f) GDPR - our legitimate interest in direct marketing and the sending of advertising content	We collect the data directly from you.	It is possible that service providers from the following areas have access to your data: IT service providers Marketing and Data analytics
Due diligence and Anti-money laundering checks.	In this context, we may process the following data: Contact details. Basic personal details. Passport / Driving license. Email address. Utility bills.	The data processing is based on the following legal bases: Art. 6 (1) (c) GDPR – Compliance with legal obligations. Art. 6 (1) (f) GDPR - our legitimate interest in combating fraud and money laundering.	We collect the data directly from you and third-party sources. In addition, we may also collect your data from third parties, namely: Your job or company profiles published in public databases. Sanction lists and other public lists and registers, including terror and embargo lists as well as PEP lists. Public source, telephone directories, newspaper articles Generally accessible databases	It is possible that service providers from the following areas have access to your data: Service provider to carry out the relevant checks.

Cookies, analytics tool & social media

We use social media and employ various cookies and other analysis technologies on our website. For further information, see our https://www.page.com/cookie-policy

Automated decisions and profiling

We do not make decisions based solely on automated data processing; there is always human intervention before a decision is made.

Data transfers

PageGroup operates globally. Some support functions, such as IT support, are based all around the world. We therefore may share with or give access to your personal data to other companies within PageGroup.Find a list of PageGroup entities and the countries where they are located.

We have in place an intra-group data transfer agreement containing the Standard Contractual Clauses approved by the UK Parliament for the transfer of personal data to ‘third countries’ (“SCCs”). The intra-group agreement also contains the UK’s international transfer agreement addendum to the SCCs. These SCCs act as an additional safeguard to permit cross-border transfers of personal data from within the EEA to third countries outside the UK and EEA, (as data protection laws outside the EEA may not provide an equivalent level of protection to EEA data protection laws).

If you would like a copy of the SCCs, please contact us.

Keeping your personal data secure

We have implemented and maintain appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss or alteration or unauthorised disclosure or access. Only authorised personnel and third-party service providers have access to personal data on a need-to-know basis, and these employees and service providers are contractually required to treat this information as confidential.

How long we store your personal data

We will store your personal data for as long as is necessary to fulfil the purpose for which we have collected them, which may be an ongoing purpose.

We keep some personal data longer than others. In determining the appropriate storage period for personal data, we take into account factors such as the purposes for which we process your personal data, including legal, regulatory, accounting and reporting obligations, the nature and amount of personal data we hold about you, and the potential risk of harm to you from unauthorised use or disclosure of your personal data.

For the retention period of cookies you may refer to the cookie policy.

Your rights in relation to personal data we hold about you

You have several rights under data protection laws. These rights include the right to ask us for a copy of your personal data, to correct, delete or restrict processing of your personal data; to obtain the personal data you provide to us for a contract or with your consent in a structured, machine-readable format, and to ask us to share (port) this data to another controller.

In addition, you can object to the processing of your personal data in some circumstances (in particular, where we don’t have to process your personal data to meet a contractual or other legal requirement, or where we are using the data for direct marketing).

These rights may be limited, for example, if complying with your request would reveal personal data about another person, where they would infringe the rights of a third party (including our rights) or if you ask us to delete information which we are required by law to keep or have compelling legitimate interests for keeping. We will inform you of any relevant exemptions we are relying on when we respond to your request.

How to contact us

Exercising your rights

To exercise your rights, or to withdraw your consent to processing, or to unsubscribe from receiving marketing communications from us, you can:

• complete our GDPR contact form, or
• email us at [email protected], or
• write to us or our DPO at:

PageGroup PLC

UK Data Protection Team
2nd Floor
80 Strand
London
WC2R 0RL.

Questions and Complaints

If you have any questions about our privacy policy, or about our processing of your personal data, or to make a complaint, you can email us or our DPO at [email protected] or write to us at:

PageGroup PLC
UK Data Protection Team
2nd Floor
80 Strand
London
WC2R 0RL.

If you have unresolved concerns, and you live in the UK or believe that a personal data breach happened in the UK, you have the right to complain to the UK Information Commissioner’s Office who can be contacted at:

Telephone: 0303 123 11113
Website:https://ico.org.uk/concerns/
Post:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

If you live or work outside the UK, or you have a complaint concerning our activities outside the UK, you may prefer to lodge a complaint with a different supervisory authority. A list of relevant authorities in the EEA can be accessed here.

Changes to our Privacy Policy

We may update this privacy policy at any time. Any material changes to this privacy policy shall be duly posted on this website and shall be communicated through other communication channels where appropriate.