1.1. This Privacy Policy applies to our corporate websites (“Websites”) and sets out the basis on which any Personal Data that we collect from you or that you provide to us, through the use of our Websites, will be processed and controlled by us.

1.2. Please read this Privacy Policy carefully to understand how your Personal Data is used and treated by us.

2.1. The Personal Data that we collect may include, but not limited to, the following:

• your name, date of birth, nationality, address, contact details (including telephone number and email address), identification details or other national identifier;
• professional and education details, including your position, title, career and education history, professional certifications and licences;
• your location data, including region, country and state;
• user contribution & user content, including personal information in content and communications uploaded, sent, shared, or inputted through our Websites or via our networks and infrastructure, including feedback you provide to us and the content of communications between you and us;
• information that we produce as a record of our relationship with you, including contact and business history;
• information about your visit to our Websites, including the full Uniform Resource Locators (URL), you IP address, clickstream to, through and from our Websites, products you viewed or searched for, page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs); and/or
• any other information that you choose to share on our Websites which may be considered as Personal Data.

3.1. Your Personal Data may be collected and processed by us for purposes including, but not limited to the following:

• to perform our obligations under contracts (if any) entered into with, or for the benefit of, you;
• to allow you to use and access our products, services and Websites;
• for the management, development and administration of our business, including maintaining our relationships with third party suppliers;
• for shareholder and investor relations and management, such as communications and performance announcements;
• to communicate with you about changes to our products, services and Websites, and to communicate any new products and services we offer;
• for the ongoing review, improvement and maintenance of our services, Websites and systems;
• to respond to requests for information submitted by, or on behalf of, you;
• to verify your identity;
• to monitor and protect our systems and Websites from unauthorised access and use, and to maintain or improve our systems and Websites;
• to comply with, and assess our compliance with our internal policies and procedures and any legal and regulatory obligations; and/or
• to exercise or defend our legal rights.

3.2. We may also use cookies to distinguish you from other users. This helps us to provide you with a good experience when you visit our Websites.

4.1. Within the XRG Group We may disclose your Personal Data to other members of our group of companies for the purposes described above. We will take steps to ensure that your Personal Data is accessed only by employees on a need-to-know basis.

4.2. Outside of the XRG Group We may also share your Personal Data with the following categories of third parties outside the XRG Group:

• with third parties for the purposes of providing services to us or performing services on our behalf, or to professional advisors such as law firms, accountants and auditors;
• with any stock exchange and public bodies responsible for the governance and administration of our group of companies;
• if we sell any of our businesses or assets, in which case we may disclose your Personal Data to the prospective buyer for due diligence purposes; and/or
• to the extent required by law, regulation or any court order.

5.1. The Personal Data that we collect from you may be transferred to, and stored at, a destination outside of the jurisdiction in which it was originally collected (“Relevant Location”). It may also be stored and processed by other third parties in other countries, which may include destinations outside of the Relevant Location.

5.2. Where your Personal Data is transferred outside of the Relevant Location, we will ensure that it is protected in a manner that is consistent with how your Personal Data will be protected by us in the Relevant Location and all applicable laws including the ADGM DPR.

6.1. How long we hold your Personal Data for may vary, and the retention period will be determined by various criteria including, but not limited to:

• the purpose for which we are using it and we will need to keep the data for as long as is necessary for that purpose; and/or
• to comply with legal obligations, where applicable laws or regulation may set a minimum period for which we have to keep your Personal Data.

7.1. You have a number of legal rights in relation to your Personal Data including, but not limited to the following (which must be exercised in accordance with the ADGM DPR):

• the right to obtain information regarding the processing of your Personal Data and access to your Personal Data;
• the right to withdraw your consent to the processing of your Personal Data, however, we may still process your Personal Data if we have other legitimate reason for doing so;
• the right to receive your Personal Data in a structured, commonly used and machine-readable format and/or request that we transmit those data to a third party where this is technically feasible;
• the right to request that we rectify your Personal Data if it is inaccurate or incomplete;
• the right to request that we erase your Personal Data, however do note that there may be circumstances where we are legally entitled to retain it (or part of it);
• the right to object to and stop, and the right to request that we restrict, our processing of your Personal Data, however do note that there may be circumstances where we are legally entitled to continue processing your Personal Data and/or to refuse that request;
• the right to object to decisions being taken by automated means which produce legal effects concerning you or similarly significantly affect you; and/or
• the right to lodge a complaint with the relevant data protection authority if you think that any of your rights have been infringed by us.

8.1. If you have any concerns or would like more information about your Personal Data or the exercise of any of the rights listed above, please use the “Contact Us” section on our Websites to send us an enquiry.