What information do we collect and for what purpose

We process various personal data of individuals based on specific legal grounds for processing and for different purposes. For the purpose of this Privacy Notice, the term personal data refers to any information relating to an identified or identifiable natural person as defined in the General Data Protection Regulation (EU) 2016/679 (the “GDPR”). Below you will find an overview of the personal data that we process per category of individuals and the purposes and legal grounds for processing.

• Business Contacts Categories of individuals: business prospects, contact persons of (former) business contacts, clients of business contacts and partners or vendors of business contacts. Categories of personal data: first and last name, gender, business contact details (e.g. telephone number, email, address, title, employer and website), signature and communication data. Purpose: approaching, contacting maintaining prospects, maintaining contact with (former) business contacts, providing services to business contacts, receive services from business contacts, (financial) administrative purposes, handling any requests, complaints and disputes, determining, exercising and defending our right and complying with legal obligations. Legal basis:

• contractual obligation. We process personal data of prospects and contact persons of business contacts in order to provide services to or receive services from business contacts.

• legitimate interest. Our legitimate interest is to adequately provide services to or receive services from business prospects in general and to handle any requests, complaints and disputes.

• legal obligation. We process personal data in order to comply with legal obligations, such as compliance with (financial) administrative and retention obligations.

• (Marketing) activities Categories of individuals: website visitors, persons and participants of Team Gullit activities, e.g. meetings, (online) events and (online) learning sessions. Categories of personal data: first and last name, gender, location, telephone number, email, address, social media information, title, employer, data about presence (location, time of arrival and departure), information about the visit and communication data. Purpose: communication, marketing, analysis of website visitors, maintenance, administration and security of our website, marketing and business development, investigation, analysis and statistics, internal control and business operations, handling any requests, complaints and disputes, determining, exercising and defending our rights, complying with legal obligations. Legal basis:

• consent. We process your personal data only with your (explicit) consent for marketing and activities related purposes, such as subscription to our newsletters.

• legitimate interest. Our legitimate interest is to offer and optimize the usage of our website and the operation of our events.

• legal obligation. We process personal data in order to comply with legal obligations, such as compliance with retention obligations.

For more information about the cookies we place on our website, please see our Cookie Policy.

• Office visitors Categories of individuals: office visitors. Categories of personal data: first and last name, gender, telephone number, email, address, title, employer, data about presence (location, time of arrival and departure), information about the visit, physical appearance and communication data. Purpose: offering and optimizing office facilities, security and protection of our office, employees and data, access registration, control and management, network management and security, access badges procedure and complying with legal obligations. Legal basis:

• legitimate interest. Our legitimate interest is to protect and secure our office, network infrastructure, staff members, property and data.

• legal obligation. We process personal data in order to comply with legal obligations, such as compliance with security and retention obligations.

• Other persons who get in touch with us Categories of individuals: persons that get in touch with us.

Categories of personal data: first and last name, telephone number, email address, title, employer and communication data. Purpose: approaching and maintaining contact, handling any requests, complaints and disputes, determining, exercising and defending our rights and complying with legal obligations. Legal basis:

• legitimate interest. Our legitimate interest is to maintain any contact or handle any requests, complaints and disputes.

• legal obligation. We process personal data in order to comply with legal obligations, such as compliance with retention obligations.

Children We do not intent to process any personal data of children under the age of sixteen (16). In the event a parent or guardian becomes aware that his/her child has provided us their personal data without the consent of its parent or guardian, the parent or guardian should contact us via privacy@OneBrand.com. We will delete such personal data without undue delay and in accordance with the timelines as stated under the sections “04 What are your rights?” and “07 Additional information for individuals in the United States of America”. Automated decision-making We do not engage in any automated decision-making processes or conduct any profiling activities in relation to your personal data processed by us