1. Who collects your data?

Derby SA, whose headquarters are located at Chaussée de Wavre 1100/3, 1160 Auderghem, and registered with the ECB under number 0407.042.484, collects your data as a data controller (i.e. it determines the purposes and means of processing the personal data collected).

You can send any requests for further information or queries relating to your personal data to the following address :

dpo.belgium@ladbrokes.be

2. What data is collected by DERBY?

In the context of the contacts you will have with DERBY, the personal data (potentially) collected and processed are the following:

• Identification data (name and surname);

• Contact details (email address, mobile and/or telephone number, postal address);

• Profession and curriculum vitae;

• Other data collected via the registration form(s): Ladbrokes username, username on social networks (Twitter, Facebook, Instagram, etc.), video

• And any other information you provide (LinkedIn url, Portfolio...).

3. For what purposes and on what legal basis does DERBY use personal data?

Regulation (EU) 2016/679 on the protection of individuals with regard to the processing of personal data and on the free movement of such data ("General Data Protection Regulation" or "GDPR") requires that any processing must be based on one of the six grounds of legitimacy it lists: the consent of the data subject, the necessity for the performance of a contract concluded with the data subject or for pre-contractual measures taken at the request of the data subject, a legal obligation, the safeguarding of the vital interest of a natural person, a task carried out in the public interest or the legitimate interest of the controller.

In general, DERBY may process your personal data on the basis of its legitimate interest to :

• identify you and give you access to buildings/parking lots if you visit our premises

• arrange meetings and video conferences if you attend such meetings;

• manage your application if you apply for a job with Derby;

• manage your application if you apply for a job at DERBY;

• ensure the security of the IT infrastructure by filtering Internet traffic (if you connect to our network);

• defend DERBY's interests in the event of a potential dispute;

If you are an (employee/representative of) one of our suppliers and partners, DERBY processes your personal data on the basis of the performance of a contract (if concluded with you) or on the basis of its legitimate interest (if DERBY is in a business relationship with your employer) for the following purposes

• the execution of the contract between you/your company and DERBY;

• in order to take the necessary steps to conclude a contract with you/your company at your request;

• to prevent the risk of fraud and corruption;

If you are an (employee/representative of) one of our investors and shareholders, DERBY processes your personal data in order to manage our relationship and obligations towards you on the basis of its legitimate interest, and to fulfil its legal obligations.

4. To whom is the data transferred?

Personal data is not transferred to third parties.

5. How long is the data kept?

Personal data will only be kept for as long as is necessary to fulfil the purposes identified below, i.e. for as long as is necessary to fulfil our contracts, to comply with our legal obligations (such as accounting and tax obligations), and to resolve disputes or enforce our agreements. In the event of an action, this period will be extended for as long as necessary to defend Derby's interests.

6. What are your rights?

As a data subject, you have various rights with respect to your personal data. However, DERBY may take reasonable steps to verify your identity before acting on your request. Your rights are as follows:

• Right to information - Derby is committed to providing you with information about the processing of your personal data through this Privacy Statement.

• Right of access – You have the right to request access to and receive details of the personal data Derby holds about you, and to obtain a copy of it.

• Right of rectification - If the personal data Derby holds about you is inaccurate or incomplete, you have the right to ask us to update or rectify it.

• Right to be forgotten - In certain circumstances (e.g. where personal data is no longer necessary for the purposes for which it was collected), you have the right to request Derby to delete it.

• Right to restrict processing - In certain specific cases, you have the right to ask Derby to restrict how we process your personal data (e.g. where you dispute the accuracy of personal data, Derby will need to restrict processing while it verifies its accuracy). This means that Derby is only allowed to retain the data but not to process it.

• Right to data portability - This right only applies to personal data that you have provided to Derby and where the processing is based on your consent or on the performance of a contract where the processing is carried out by automated means. Derby will provide you with your personal data in a structured, commonly used and machine-readable format so that it can be transmitted to another controller, or have it transmitted directly by Derby if technically possible.

Right to object - In addition, you have the right to object to the processing of your personal data, on grounds relating to your particular situation, if the processing is based on Derby's legitimate interest or on a public interest. Derby will cease processing your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests or rights, or for the establishment, exercise or defence of legal claims.

• Right to withdraw consent - Where your consent was required for the collection or use of your personal data, you have the right to withdraw your consent at any time. However, such withdrawal does not affect any processing previously carried out on the basis of your consent.

Right to complain - You have the right to lodge a complaint with a supervisory authority (in Belgium: Data Protection Authority https://www.autoriteprotectiondonnees.be/) if you consider that the processing of your personal data violates this Privacy Statement or the GDPR. For more information, please contact your local data protection authority.

7. For any other questions

For any other questions or to exercise your rights, please contact dpo.belgium@ladbrokes.be .