How Bureau Protects Your Personal Data

Subject to the law that applies to you, and to the role in which Bureau processes your Personal Data, you have the rights set out below. Where Bureau is the Controller — for example if you are a Bureau employee, contractor, job applicant, website visitor or business contact — you may exercise these rights directly with us.

• Be informed (GDPR Article 13 and Article 14): to receive this notice at or before the point at which we collect your Personal Data, including where we obtained it from a source other than you.

• Access (GDPR Article 15): to confirmation of whether we process your Personal Data, a copy of that data, and information about the purposes, the categories of data, the recipients, the retention period and the source.

• Rectification (GDPR Article 16): to correction of inaccurate Personal Data and completion of incomplete Personal Data.

• Erasure (GDPR Article 17): to deletion of your Personal Data where one of the grounds in Article 17(1) applies.

• Restriction of processing (GDPR Article 18): to have processing limited to storage while a dispute over the accuracy or the lawfulness of processing is resolved.

• Notification to recipients (GDPR Article 19): to have each recipient to whom we disclosed your Personal Data informed of a rectification, erasure or restriction, unless that proves impossible or involves disproportionate effort.

• Data portability (GDPR Article 20): to receive Personal Data you provided to us in a structured, commonly used and machine-readable format, and to have it transmitted to another controller where technically feasible.

• Objection (GDPR Article 21): to object to processing based on legitimate interests. Where you object to direct marketing, we will stop processing your Personal Data for that purpose.

• Automated decision-making and profiling (GDPR Article 22): not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you, and to obtain human intervention, express your point of view and contest the decision. Bureau's verification and risk outputs are provided to our Customers, who decide what action to take; where such a decision is made by a Customer, this right is exercised against that Customer.

• Withdrawal of consent (GDPR Article 7(3)): where processing is based on consent, to withdraw that consent at any time and as easily as it was given, without affecting the lawfulness of processing carried out before withdrawal.

• Complaint (GDPR Article 77): to lodge a complaint with us and with your supervisory authority.

If you are an end-user of one of our Customers, Bureau acts as a Processor and your rights are exercised against that Customer as the Controller. Please contact that Customer in the first instance. If you contact us instead, we will tell you so without undue delay and will assist that Customer in responding to you, as required by GDPR Article 28(3)(e). We will not act on your request directly unless the Customer instructs us to do so.

Under India's Digital Personal Data Protection Act, 2023, if you are a Data Principal you have the right to obtain a summary of your Personal Data and of our processing of it (section 11), to correction, completion, updating and erasure (section 12), to grievance redressal (section 13), and to nominate another individual to exercise your rights in the event of your death or incapacity (section 14).

California residents have rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act, including to know, delete and correct Personal Data and to opt out of its sale or sharing. Residents of Singapore have rights under the Personal Data Protection Act. Where a right described above is not available to you under the law that applies to you, that narrower position applies; nothing in this Policy reduces a right your law gives you.

Requests to exercise the above rights may be made through our Data Protection Officer or the grievance channel set out in Section 15 of this Policy. Where we have reasonable doubts about your identity we may require additional information to verify it. The following applies to every request:

• No charge: we do not charge a fee for responding to a request. Where a request is manifestly unfounded or excessive, in particular because it is repetitive, we may charge a reasonable fee or refuse to act, and we will explain why and how you may challenge that decision (GDPR Article 12(5)).

• Timeline: we respond within one month of receiving your request. Where the request is complex, or where you have made a number of requests, we may extend that period by up to two further months; we will tell you within the first month if we do so, and why (GDPR Article 12(3)).

• Identity verification: we will ask only for the information necessary to confirm the identity of the person making the request (GDPR Article 12(6)).

• If we do not act: we will tell you within one month of the reasons, and that you may lodge a complaint with a supervisory authority and seek a judicial remedy (GDPR Article 12(4)).