SHV Holdings global privacy statement

When SHV process your personal data, we apply two key principles:

• Keep it safe

• Keep it private

Personal data needs to be well protected. Keep it safe.Personal data can only be shared on a need-to-know basis. Keep it private.

You can download the privacy statement for job applicant data here

These privacy statements do not address the processing of personal data of employees in the context of their employment relationship with SHV.

PRIVACY STATEMENT FOR CUSTOMER, SUPPLIER AND BUSINESS PARTNER DATALast updated: 20 March 2023

1. INTRODUCTION – WHO WE ARE

SHV Holdings N.V., Rijnkade 1, 3511 LC Utrecht, The Netherlands and/or its relevant Groups is the company responsible for the processing of your personal information (data controller).

SHV Holdings N.V. and/or its relevant Groups are referred to as “SHV” and “we”, “our” or “us”.

This Privacy Statement is applicable to the processing of your personal data when you -as a supplier or other business partner- do business with us, when you use our websites or apps or when you interact with us (“you” or “your”).

2. PURPOSES FOR WHICH WE USE YOUR PERSONAL DATA

A. Business communication

We collect your information when you contact us for example, via one of our online contact forms, when you send us questions, suggestions, compliments or complaints, or when you request a quote for our Services.

For this purpose– we process – to the extent applicable – your name, (business) contact details, and any other information that you provide to us.

We engage in these activities with your consent, to manage our contractual relationship with you and/or because we have a legitimate interest.

B. When you use our websiteWhen you use our website, we process technical data about your device to offer you functionalities and to allow us to manage and improve the performance of our website.

For this purpose– we process the technical data from your device such as its IP address, the internet browser you use, the pages you have visited on our websites, your click- and surf behavior and the length of your session.

We engage in these activities because we have a legitimate interest (e.g. when offering a technically adequately working website and to improve its performance).

C. Assessment and acceptance of a Business Partner

We will process your personal data for our assessment and acceptance processes, for example confirming and verifying your identity, due diligence and screening against publicly available government and/or law enforcement agency sanctions lists.

For this purpose– we process your contact details such as your (business) address and email address, personal details of Individuals such as your name and date of birth, payment information and details of your correspondence with us– we are required by law to conduct certain checks on our business partners, for example, in the context of the prevention of fraud, terrorism financing or money laundering. To comply with our legal obligations, we (or our service providers) may need to process your criminal data, including data relating to criminal behaviour, criminal records or proceedings regarding criminal or unlawful behavior, and we need to identify and authenticate business partners (including confirming and verifying the identity of relevant Individuals).

We engage in these activities to manage our contractual relationship with you and/or to comply with a legal obligation.

D. For the conclusion and execution of agreement

When you work together with us as a supplier or business partner, we process your personal data for the digital signing of contracts and documents or for administrative purposes such as making payments. We also use your personal data in order to receive and administer your products or services, including related customer services.

For this purpose– we process your contact details such as your (business) address and email address, personal details of Individuals such as your name, payment information, bank account number, IP address (in case of digital signing), details of your correspondence with us and other information which is relevant for the contract and account.

We engage in these activities to manage our contractual relationship with you and/or to comply with a legal obligation.

E. Management reporting for our business purposes including analysis and developmentWe process personal information for reporting on general management, order management and asset management to support various SHV business-related purposes, such as leveraging central processing facilities in order to work more efficiently, conducting audits and investigations, implementing business controls, conducting business partner surveys, managing and using business partner directories, finance, accounting, archiving, insurance, legal and business consulting, dispute resolution, data analysis, developing new products, enhancing, improving or modifying our services, operating and expanding our business activities, such as in the context of mergers, acquisitions and divestitures and in order to manage such transactions.

For this purpose– we process your contact details such as your address and email address, personal details such as payment and credit information, payment and order history, your name, gender, place of residence, digits of your zip code and any other information mentioned in this Privacy Statement or otherwise provided to us by you, if such is compatible with the purposes mentioned in the previous paragraph. We apply aggregation or anonymization to personal data to prepare and perform management reporting and analysis.

We engage in these activities because we have a legitimate interest.

F. Investigating compliance and quality improvementSubject to applicable laws, we may conduct short term carefully controlled monitoring of your activities, such as in emails, text messages or other communications we have with you. We may do this for instance where we have reason to believe that fraud or other crime is being committed, where offences are suspected and where the monitoring is proportionate to the type of the disciplinary offence, or where we suspect non-compliance with anti-money laundering regulations or anti-terrorism screening obligations to which we are subject.We may perform investigations in the interest of protecting the security of our communication systems and procedures or for quality improvement and staff training purposes.

For this purpose– we process your name, your contact information, your correspondence with us, your use of any of our products and services, recorded phone calls and any other information mentioned in this Privacy Statement or otherwise provided to us by you.– to comply with our legal obligations, we (or public and government authorities) may need to process your data, including data relating to criminal behaviour, criminal records or proceedings regarding criminal or unlawful behavior, with respect to criminal offences that have been or, given the relevant circumstances are suspected to be or have been, committed.We engage in these activities to comply with a legal obligation, as appropriate or necessary under applicable law, including laws outside your country of residence and including sectorial recommendations (e.g. counterparty due diligence, anti-money laundering, compliance with competition and tax laws, anti-terrorism screening, financing of terrorism or in relation to the (detection) of fraud or other crimes) or to comply with legal process. In specific situations we may be required to respond to requests from public and government authorities including public and government authorities outside your country of residence. Only if we are required to do so by law or sectorial recommendation to which SHV and/or its Groups is subject, the relevant personal information will be provided to supervisory agencies, fiscal authorities or investigative agencies.We engage in these activities because we have a legitimate interest, such as to enforce our terms and conditions and other applicable policies, to protect our operations, to protect our rights, privacy, safety or property, and/or that of yours or others or to allow us to pursue available remedies or limit the damages that we may sustain or for quality improvement. Where suitable we engage in these activities with your consent, e.g. when we record a phone call with you for quality improvement or staff training purposes.

G. Protecting health, safety, security and ensuring integrity

We process your personal data in order to safeguard our employees, customers, suppliers and business partners and our assets, such as, via access controls to SHV’s systems and premises.

For this purpose– we process your name and your contact information– when you visit our premises we process additional information as set out in the next paragraph H].

We engage in these activities to comply with a legal obligation and/or because we have a legitimate interest.

H. When you visit our premises

We process your personal information when you visit us on our premises for thepurpose of ensuring appropriate access controls and security.

For this purpose– we process your name, your contact information and the person you are visiting and your visiting history to our premises.– when visiting our premises we may also process your car registration number or CCTV footage about you. In some countries photo and video images (such as for instance CCTV) (could) qualify as special categories of data. Our processing hereof is limited to the aim of protecting the safety and security of our assets.– if your biometric data are required for secure access to our premise or if you have to show a form of ID, the biometric data or the ID is used for verification purposes only. We don’t record this information.– in order to accommodate your visit to our premise, we may process data on religious or philosophical beliefs or data about your health. This qualifies as special categories of data. Our processing hereof is only insofar as necessary for accommodating your specific needs during a visit, such as dietary requirements or the use of a wheelchair.

We engage in these activities because we have a legitimate interest (safety and security of our assets).

3. COOKIES

Any processing of your personal data via cookies and/or similar technologies will take place in accordance with our Cookie Statement [LINK?? ].

4. HOW LONG WE RETAIN YOUR PERSONAL DATAWe will retain your personal information for as long as necessary or permitted in light of the purposes outlined in this Privacy Statement and consistent with applicable law.The criteria used to determine our retention periods include– the length of time we have an ongoing relationship with you (for example when you provide products or services to us);– whether there is a legal obligation to which we are subject (for example, certain laws require us to keep records of transactions for a certain period of time before we can delete them); or– whether retention is advisable in light of our legal position (such as in light of an applicable statute of limitations, litigation or regulatory investigations).After the applicable retention period has ended, SHV will apply the procedures we have in place for data deletion, de-identification or anonymization.

5. INTERNATIONAL DATA TRANSFERS AND ACCESS TO YOUR PERSONAL DATADue to the global nature of our organization and in order to offer you a complete package of products and services, your personal information may be stored and/or processed in a country other than the one you reside in.

For international data transfers we have put in place adequate measures, such as through contractual arrangements between SHV’s legal entities, and through contractual arrangements put in place with third parties (for example for transfers from the EEA to countries not considered adequate by the European Commission we have entered into EC Standard Contractual Clauses; you may obtain a copy of these measures by contacting us via the below contact details).

Access to your personal data within SHV

Our employees are authorised to access personal data only to the extent necessary to serve the applicable purpose and to perform their jobs.

Access to your personal data by third parties

Third parties may have access to your personal data where relevant for the provisioning of their products or services to us and to the extent that such processing is necessary for the purpose of processing agreed with us.

Examples of third parties:– Banks, insurance companies, accountants and advisors in the areas of finance, tax or legal.– Service Providers that support us in: 1) assessing and accepting our business partners 2) concluding and executing agreements with our business partners 3) relationship management and marketing 4) running our IT processes, for example to help us maintain our IT network and related infrastructure and security, including forensic specialists; 5) performing any other purpose mentioned in this privacy statement.– In other cases, your personal data will not be supplied to third parties, except when required by law. In specific situations we may be required to respond to requests from public and government authorities including public and government authorities outside your country of residence. Only if we are required to do so by law or sectorial recommendation to which SHV and/or its Groups is subject, the relevant personal information will be provided to supervisory agencies, fiscal authorities or investigative agencies.

6. SECURITY

We seek to use reasonable organizational, technical and administrative measures to protect personal information within our organization.Unfortunately, no data transmission or storage system can be guaranteed to be 100% secure. If you have reason to believe that your interaction with us is no longer secure (for example, if you feel that the security of any account you might have with us has been compromised), please immediately notify us of the problem by contacting us in accordance with the contact details provided in this Privacy Statement.

7. YOUR RIGHTS AND CONTACTING US

If you would like to access, correct, update, restrict or remove your personal data processed by us, object to the processing of personal data, or if you would like to transmit an electronic copy of your personal data to another company (to the extent this right to data portability is provided to you by applicable law), you may contact us with your request to exercise your rights.

In your request, please make as clear as possible what personal information your request relates to. We may request you to provide verification of your identity before responding to your request.

We will try to respond to your request as soon as reasonably practicable and in any event within any applicable legally required timeframes. We will deal with your request in a manner as prescribed by law. Please note that we may need to retain certain information for recordkeeping purposes and/or to complete any transactions that began prior to your request for correction, updating or deletion. There may also be residual information that will remain within our databases and other records, which will not be removed. If we do not grant your request, we will explain to you why.

Questions?If you have any questions or complaints about this Privacy Statement, please contact our privacy office at privacy@shv.nl . Because email communications are not always secure, please do not include sensitive information in your emails to us.

Where SHV’s Groups are involved in the data processing (joint controllers), we have arranged for a co-ordinated or central handling (for example where data is processed in a global IT system). You may obtain the essence of this arrangement upon request to our privacy office via de e-mail address above.

In some countries (e.g. in the EU) you may also lodge a complaint with a supervisory authority of your country or region or where an alleged infringement of applicable data protection law occurs.