Service Privacy Policy.

1. PURPOSE AND SCOPE

This Privacy Policy outlines how Allshares collect, use, and disclose Personal Data received from clients (or otherwise processed by Allshares as a processor) to provide Services.

It's important to note that this Policy does not supersede or amend the personal data protection terms and conditions found in Service Agreements (including data processing agreements) between Allshares and its clients, and such agreements prevail over this Policy.

For Personal Data collected, used, and processed through your use of Allshares websites (excluding dedicated web portals or mobile apps for Service access) and Publicly sourced Personal Data, please refer to the Allshares Public Privacy Policy, not this document.

2. DEFINITIONS

The capitalized words have the following meaning in this Policy:

• Allshares (we): Refers to the Allshares company that has entered into a Service Agreement with you, including its affiliates.
• Client (you): Refers to the legal entity that has executed a Service Agreement with Allshares.
• Personal Data: Refers to any information relating to an identified or identifiable natural person in the meaning of:
  • For data subjects residing within the territory of the European Economic Area (EEA), the Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data;
  • For data subjects residing in Switzerland, the Swiss Federal Act on Data Protection and related ordinances;
  • For data subjects residing in the United Kingdom, the UK Data Protection Act 2018 and the UK GDPR (GDPR as it forms part of the law of England, Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018);
  • For residents of California, "Personal Information" as defined under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA).
• Publicly sourced Personal Data: Information gathered from company websites, minutes of general meetings, corporate governance notices, compensation policies, incentive reports, and annual reports.
• Service Agreement: The master service agreement established between Allshares and each of its Clients.
• Services: Encompasses cloud platform, software applications, maintenance and support, and other related training or consulting services as outlined in a Service Agreement.

3. SCOPE OF PROCESSING

3.1 Provision of Services

To deliver the Services specified in your order (including support, cloud, application, or consulting services) and to verify adherence to your order terms, we may access and utilize Personal Data. This scope includes testing and deploying new software updates, patches, upgrades, and system versions; monitoring and testing performance and system usage; as well as diagnosing and resolving bugs or other issues reported to Allshares. Unless copies of Personal Data are replicated for agreed-upon local or geo-redundancy within our cloud infrastructure, any copies generated for these operational activities are kept only for as long as necessary to fulfill those specific purposes.

Furthermore, Allshares may gather details regarding your use of the Services using cookies and electronic communication protocols. As part of the communication connection, we may automatically collect metadata such as network routing details (identifying the source of the connection), device specifications (such as browser type), your IP address, and the precise date and time. We leverage this automated data to customize the user experience and optimize the functionality of our Services. The deployment of cookies aligns with the objectives defined in our data processing agreement and the personal data protection terms of our Service Agreements, or is based on our legitimate interest in facilitating your use of the Service. For comprehensive information about how cookies are used, please review our Cookie Notice.

To further optimize and deliver our Service, Allshares may also employ features driven by Artificial Intelligence ("AI") through proprietary or third-party integrations ("AI Tools"). These tools may process personal data to assist Users in tailoring their search queries and to enhance overall Service capabilities. This processing remains strictly aligned with the terms of our data processing agreement, and the personal data protection clauses in our Service Agreements. Further specifications regarding AI Tools are available in the Service Description.

3.2 Legal Requirements

Allshares may be required to retain or provide access to Personal Data to comply with legally mandated reporting, disclosure or other legal process requirements.

Allshares does not use Personal Data except as stated above or in your order. Allshares may process Personal Data, but does not control your collection or use practices for such data.

If you provide any Personal Data to Allshares, you are responsible for providing any notices and/or obtaining any consent necessary for Allshares to access, use, retain and transfer Personal Data as specified in this Policy and your Service Agreement.

3.3 Subcontractors

When Allshares engages subcontractors to help provide services, their access to Personal Data will align with your Service Agreement and this Services Privacy Policy, as necessary. Allshares is responsible for ensuring these subcontractors adhere to the terms of both this Policy and your Service Agreement.

Our list of approved subprocessors is accessible here. This list may change over the duration of your Service Agreement, and you will be informed of any updates.

4. ACCESS CONTROL

Access to Personal Data within Allshares is governed by job role and responsibility. For data stored in Allshares-hosted systems, access is managed through an access control list and an account management framework. You are responsible for controlling your end users' access to Personal Data. End users and individuals whose Personal Data is processed using Allshares platform solutions should direct any requests regarding their Personal Data to you.

5. SECURITY CONTROLS

Allshares prioritizes the security and confidentiality of your Personal Data through robust technical and organizational measures, designed to prevent unauthorized access. These industry-leading security measures apply across all Services and to all Allshares employees.

We are dedicated to minimizing risks associated with human error, theft, fraud, and misuse of Allshares facilities. Our comprehensive approach includes background checks, ongoing security awareness programs, and employee training on security policies. All Allshares employees are contractually obligated through written confidentiality agreements to maintain the confidentiality of Personal Data and adhere to company policies concerning information protection.

Allshares promptly investigates and responds to any incidents raising suspicion of unauthorized Personal Data handling. Our Chief Privacy Officer and Legal team are informed of such incidents and define escalation paths and response teams as necessary. Should your Personal Data be misappropriated (even by an Allshares employee) or wrongly acquired by a third party, we will notify you in accordance with the provisions of the data processing agreement between you and Allshares.

Upon termination of your service order or expiry of the retention period agreed in the data processing agreement, and unless you instruct otherwise, Personal Data is permanently deleted from the Allshares system, including all cloud environments.

6. INTERNATIONAL TRANSFER

Except with your prior written consent, Allshares will not transfer any Personal Data received from you for the purpose of providing you the Services outside the territory of the Data Center Region you elected for database hosting or outside the territory where other services are to be performed by Allshares as expressly provided for under any contract between you and Allshares. If you have approved transfer of any Personal Data outside EEA, United Kingdom, Switzerland, or outside jurisdictions not benefitting from adequacy decisions issued by the EU, UK, respectively Swiss authorities, please refer to section 8 hereunder.

7. INFORMATION SHARING, SALES, AND DISCLOSURE

We may share aggregated, non-identifying information and log data with third parties for analysis and other purposes. This information will not contain Personal Data.

Depending on the Services you choose, your Personal Data may be transferred to third parties for hosting or processing. These third parties include IT consulting companies, bound by a subcontracting agreement with Allshares, for the implementation and maintenance of Allshares software. We may also transfer your Personal Data to cloud infrastructure providers for hosting purposes, who are bound by a cloud provider agreement with Allshares.

Allshares does not sell Personal Data to third parties for financial compensation, nor does it share this information for cross-context behavioral advertising.

Under certain circumstances, Allshares may be required to disclose Personal Data in response to valid requests from public authorities, including for national security or law enforcement requirements. Allshares may disclose Personal Data if legally required to do so, for example, in response to a subpoena or request from law enforcement, a court, or a government agency. Such disclosure may also occur if Allshares believes, in good faith, that it is necessary:

• To comply with a legal obligation.
• To protect or defend our rights, interests, or property, or those of third parties.
• To prevent or investigate possible wrongdoing in connection with the Services.
• To act in urgent circumstances to protect the personal safety of users of the Services or the public.

Regarding Personal Data, we will attempt to refer any request for disclosure by public authorities, including those for national security or law enforcement reasons, to our Clients. If legally obligated to do so, Allshares may disclose Personal Data to law enforcement or other government authorities. In such cases, Allshares will notify its Clients of the request unless prohibited by law.

8. CROSSBORDER TRANSFER

Allshares ensures the necessary level of protection for transferred Personal Data by:

• a. Entering into standard contractual clauses approved by the European Commission (for the EU), the UK Information Commissioner's Office (for the UK), and the Swiss Federal Data Protection and Information Commissioner (for Switzerland, for transborder outsourcing of personal data processing). Additionally, specific clauses for transfers from other jurisdictions are included as per the Service Agreement between you and Allshares.
• b. Relying on recognized effective certification mechanisms or an adequacy decision of the relevant authority prior to such transfers.

9. ACCEPTANCE OF THE POLICY

Allshares may amend this Services Privacy Policy as deemed necessary without prior notification to you. It is your responsibility to verify regularly this Policy to be informed of any changes. Your continued use of the Services after any such changes or after explicitly accepting the new Services Privacy Policy upon using the Services shall constitute your consent to such changes. Notwithstanding the foregoing, any changes to this Policy do not supersede or amend the personal data protection terms and conditions found in Service Agreements (including data processing agreements) between you and Allshares.

10. CONTACTING US

Allshares has appointed a Chief Privacy Officer. Clients who believe that their Personal Data have been used in a way that is not consistent with this Policy, or who have further questions regarding this Policy may contact the Chief Privacy Officer throughout the ticketing system on Allshares platform or send a request by email to privacy@allshares.com.

Data subjects' inquiries should initially be directed to their employer (the data controller). If Allshares' assistance is required to fulfill data subject requests, Clients should use the contact information provided above.

11. VALIDITY AND DOCUMENT MANAGEMENT

The current version of this document is effective as of the last update set out in the Change History.

The owner of this document is the Head of Legal, who checks and, if necessary, updates the document at least once a year.

12. CHANGE HISTORY