Supplemental Privacy Policy for the United Kingdom

When you provide us with your personal information in connection with our Websites or Services, we serve as a data controller. Where we act as a data controller we determine how your personal information will be utilized, in accordance with our Privacy Policy and this Supplemental Privacy Policy for the United Kingdom.

Depending on your individual circumstances, the Personal Information we hold about you, and the specific purposes for holding your Personal Information, we rely on one of several legal bases to process your personal information. These legal bases include where:

• The processing is necessary to perform our contractual obligations, such as to provide you with access to our Websites or to provide you Services;
• You have given your prior consent, which you may withdraw at any time (such as for marketing purposes or other purposes for which we obtain your consent from time to time);
• The processing is necessary to comply with a legal obligation, a court order or to exercise or defend legal claims; and
• The processing is necessary for the purposes of our legitimate interests, such as improving, personalizing, and developing our Websites, and Services, marketing new features or products that may be of interest, and promoting safety and security.

If you have any questions about or would like further information concerning the legal bases on which we collect and use your personal information, please submit your request by completing the Individual Data Request Form.

If you are located in the United Kingdom, you have the following rights in respect of your personal information that we hold:

• Right of be informed. The right to be informed about how we collect and use your personal information, including for what purposes and retention periods is processed, and to whom we share your personal information.
• Right of access. The right to access to your personal information and additionally supplementary information, and to obtain a copy of your personal information.
• Right to rectification. The right to have inaccurate or incomplete personal information held about you rectified or completed.
• Right to erasure (the right to be forgotten). The right to obtain the erasure of your personal information.
• Right to restrict processing. The right to restrict or suppress the processing undertaken by us on your personal information in certain circumstances, such as where the accuracy of the personal information is contested by you, for a period enabling us to verify the accuracy of that personal information.
• Right to data portability. The right to portability allows you to move, copy or transfer personal information for your own purposes, from one organization to another.
• Right to object. You have a right to object to processing in certain circumstances, including those based on legitimate interests and direct marketing.

If you wish to exercise one of these rights, submit your request by completing the Individual Data Request Form.

You also have the right to lodge a complaint to your local data protection authority.

• If you are located in the United Kingdom, you can make a complaint at any time to the Information Commissioner’s Office, the UK data protection authority for data protection issues.

However, we would appreciate the opportunity to address your concerns before you contact your local data protection authority, so, if you do have any concerns, please contact our Data Protection Officer as follows:

• By completing the Individual Data Request Form
• By phone at +44 (0) 345 877 7011
• By mail to MBO Partners, Inc, Attention Data Protection Officer, Cork Airport Business Park, Cork, Ireland, T12 E6RY

The personal information we collect may be stored, processed and otherwise made available in any country in which we or our affiliates, suppliers, service providers, or agents maintain facilities or where our Websites, Services, or Products are available, including, but not limited to, the United States of America. We will transfer personal information internally (including with our affiliated entities) and with third parties acting on our behalf in accordance with appropriate or suitable safeguards recognized under applicable laws, including applicable adequacy decisions and standard contractual clauses.

We will respond diligently and appropriately to requests from DPAs about our Privacy Policy and this Supplemental Privacy Policy for the United Kingdom and our compliance with applicable data protection privacy laws and regulations. We will, upon request, provide DPAs with names and contact details of the individuals designated to handle this process. With regard to transfers of personal information, we will: (1) cooperate with inquiries from the DPA responsible for the entity exporting the data; and (2) respect its decisions, consistent with applicable law and due process rights. With regard to transfers of personal information to third parties, we will comply with DPAs' decisions relating to it and cooperate with all DPAs in accordance with applicable laws.

In the event of a data breach leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal information we transmit, store or otherwise process, we will promptly assess any such breach and will notify, as required by applicable law, DPAs and affected data subjects, which may include you.

We may update this Supplemental Privacy Policy for the United Kingdom from time to time. When we do update them, we will post a notice on our Websites, make the updated version of this Supplemental Privacy Policy for the United Kingdom available on this page, and indicate the date it was last updated above. For clarity, any updates will apply from the date they are posted. Please check back periodically to see if this Supplemental Privacy Policy for the United Kingdom has been updated.