AOG Business Partner Privacy Notice

Introduction and Scope

The Addax and Oryx Group plc and its affiliates ("AOG", "we" or "our") are committed to processing personal data responsibly and in compliance with the applicable data protection laws, including in particular (i) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, issued on 27 April 2016 (the "GDPR") and (ii) the Swiss Federal Act on Data Protection of 25 September 2020 (the "FADP"), where applicable.

This AOG Business Partner Privacy Notice (the "Notice") describes the types of personal data relating to its business partners that AOG collects, how AOG uses such personal data, with whom AOG shares such personal data, and the rights AOG's business partners, as data subjects, have regarding AOG’s use of their personal data.

The protection of personal data relating to AOG’s business partners is one of AOG’s priorities. This Notice therefore applies to former, present and prospective business partners such as, without limitation, contractors or subcontractors, service providers, consultants, advisors, auditors, joint venturers, and entities or businesses in which AOG holds a direct or indirect interest, as well as their proxy holders, representatives and employees (each, a "Business Partner", "you" or "your").

We may provide supplemental privacy notices on specific occasions, when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your personal data. Those supplemental notices should be read together with this Notice. In the event of any inconsistency between the provisions of this Notice and those supplemental notices, the supplemental notices will prevail.

Data Controllers and Contact Details

The data controllers for the purposes of processing personal data relating to AOG’s Business Partners and their respective addresses are listed in Annex 1.

For any clarification or additional information you may need in order to fully understand this Notice or for any other query relating to this Notice, please contact us at privacy@aoginvest.com.

Categories of Personal Data Processed

We may process the following types of personal data relating to our Business Partners:

Name, first name, gender, age, address, date and place of birth, ID card or passport details, phone number, email address, nationality, information contained in utility bills, criminal offence data;
Occupation/title, name of organization, department, business postal address, business telephone number, business facsimile number, business email address, VAT numbers, tax identification numbers, language preference;
Bank details and information regarding creditworthiness (e.g. financial statements), source of funds, transaction histories; and
work permit, specific work authorizations, training information, photographs, resume/CV, relevant experience and/or academic and professional qualifications, professional licenses and certifications.

Purposes of Data Processing and Legal Basis

AOG processes personal data relating to its Business Partners for the following purposes and corresponding legal basis:

Purposes	Legal basis
Assessing capabilities and resources of intending bidders in the context of any call for expressions of interest and invitations to tender	Legitimate interests of AOG to run and develop its commercial operations
Managing AOG’s transactions (including but not limited to investments, merger, acquisition, divestiture or liquidation)	Performance of/entering into a contract Legitimate interests of AOG to conduct AOG’s business dealings
Concluding and managing contracts, managing commercial relationships, order fulfillment, managing goods and services deliveries and shipments, payment and invoicing for goods and services, contacting Business Partners (either directly or indirectly through a third party)	Performance of/entering into a contract Legitimate interests of AOG to manage AOG’s business
Carrying out promotional operations, direct marketing and surveys (either directly or indirectly through a third party)	Legitimate interests of AOG to promote AOG’s position in the market Consent
Performing compliance and/or sanction checks and investigations	Legal obligation Legitimate interests of AOG to ensure the proper functioning of AOG and compliance with the laws Consent
Ensuring security, safety, including identity checks and screenings of on-site visitors	Legitimate interests of AOG to ensure security and integrity of AOG
Complying with legal obligations and/or regulatory investigations, and assisting AOG in the context of any claim, litigation, or arbitration, including employment proceedings	Legal obligation Legitimate interests of AOG to ensure the proper functioning of AOG and to defend AOG’s legal interests

Disclosure of Personal Data

AOG will only grant access to personal data on a need-to-know basis, and such access will be limited to the personal data that is necessary to perform the function for which such access is granted.

Subject to the purposes described in Section 4 and applicable laws and regulations, AOG will, from time to time, disclose personal data processed as follows:

Within AOG's organization:

To authorized staff members;
To any entity controlling, controlled by or under common control with the relevant AOG entity acting as data controller (collectively, the "AOG Group").

Outside of AOG's organization:

To relevant third party service providers;
To vendors, contractors, consultants and partners (e.g., professional advisers, auditors or IT service providers);
To insolvency administrators in the event of private bankruptcy;
To regulatory authorities, governmental or quasi-governmental organizations;
To potential purchasers of all or part of the AOG Group or AOG Group's business.

Service providers will only receive personal data according to the purposes of the service agreement with the relevant AOG Group's entity.

Interacting with AOG through Social Media

For information on how your personal data are processed on social media platforms, including any targeted advertising that you may receive, please refer to the respective social media platform’s privacy policies and terms of use.

If you choose to interact with AOG through social media on an AOG administered social media page (each, an "AOG Social Media Page"), your personal data will be visible to all visitors of your personal social media page depending on your privacy settings on the relevant social media platform, and will also be visible to AOG. You can delete any information that you share on these platforms at any time through your relevant social media platform's account.

Additionally, and to the extent AOG is jointly responsible with a social media platform of a AOG Social Media Page, AOG will have access through the social media platform to aggregated data providing statistics and insights that help to understand the types of actions you take on AOG Social Media Pages.

International Data Transfers

International data transfers refer to transfers of personal data outside of the EEA and Switzerland.

The international footprint of AOG involves the transfer of personal data to other group companies or third parties, which may be located outside the EEA and Switzerland. AOG will ensure that when personal data is transferred to countries that have different standards of data protection, appropriate safeguards to adequately protect the personal data are implemented to secure such data transfers in compliance with applicable data protection laws.

AOG has implemented an intra-group data transfer agreement to cover data transfers between companies of the AOG Group, a copy of which can be obtained by contacting us at privacy@aoginvest.com.

Retention of Personal Data

AOG will not retain your personal data processed longer than necessary for the purposes for which it was collected or otherwise processed as set out in this Notice, and for which AOG has a valid legal basis. In any case, we will not retain it longer than allowed under statutory local retention periods.

In case where AOG would be involved in any legal claims, we are entitled to continue to process your personal data that is relevant for such claims, subject to applicable local retention requirements.

Data Protection Rights

Under applicable data protection laws, you will benefit from certain rights as a data subject. In particular, you can exercise the following rights at any time, subject to conditions:

Right to access to, rectification and erasure of personal data;
Right to restriction of processing;
Right to object to processing;
Right of data portability to the extent applicable;
Right to withdraw consent where the processing is based on consent; and
Right to lodge a complaint with the supervisory authority.

Miscellaneous

This Notice may be revised and amended by AOG from time to time and appropriate notice about any amendments will be given on AOG's website.