Privacy Notice

MYRECOVEREASE (UK) LIMITED places a high priority on safeguarding your privacy. Please review this privacy notice, which contains important information about us and the methods and rationale for the collection, use, retention, and sharing of your Personal Data. Additionally, it outlines your rights regarding your Personal Data and provides guidance on how to address any concerns.

The purpose of this privacy notice is to address the handling of Personal Data when you engage with us as a Data Subject, in your capacity as a customer. As an entity that collects, uses, or assumes responsibility for your Personal Data, we must comply with Data Protection Laws.

The primary establishment of MYRECOVEREASE (UK) LIMITED is in England and Wales. The Information Commissioner's Office (ICO) serves as the supervisory authority. The United Kingdom's legal framework for data protection, including the UK GDPR and the Data Protection Act 2018, provides an equivalent standard of protection for personal data.

Capitalised terms used in this notice are defined in the Definitions section below.

MYRECOVEREASE (UK) LIMITED uses software for rental, inventory, bookings, and sales. Your Personal Data will be stored in this software (which may include cloud storage) to enable us to provide services to you. The software is provided by Salad Days B.V. (trading name Booqable), of Blokhuisplein 40, 8911 LJ Leeuwarden, the Netherlands.

Booqable complies with the requirements for the processing of personal data set out in privacy legislation, including the General Data Protection Regulation, and has a Data Protection Agreement in place under which it agrees to use your personal data only to provide services to us and you.

In addition to Booqable, we also use other third-party service providers (including email distribution services such as MailChimp) to support our business operations. Where we share your Personal Data with such providers, we do so under appropriate contractual arrangements and take reasonable steps to ensure they maintain appropriate data protection policies and technical and organisational measures to safeguard your Personal Data.

You can contact us by post, email, or telephone if you have any questions about our privacy policy, the information we hold about you, to exercise a right under the Data Protection Laws, or to make a complaint.

We may update this privacy notice from time to time. The current version is always available on our website at www.myrecoverease.co.uk.

You have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's independent authority for data protection:

Under Data Protection Laws, we can only use your Personal Data if we have a proper reason, including:

• where you have given consent;
• to comply with our legal and regulatory obligations;
• for the performance of the Agreement or other contract with you, or to take steps at your request before entering into the Agreement or other contract;
• in the substantial public interest;
• to protect your vital interests; or
• where necessary for the purposes of our legitimate interests or those of a third party.

A legitimate interest includes when we have a business or commercial reason to use your non-sensitive Personal Data, as long as your rights and interests do not override this. We will conduct an assessment when relying on legitimate interests to balance our interests against yours.

Where our basis for processing your Personal Data is your consent, you can withdraw such consent at any time without penalty.

In most cases, we expect that your Personal Data will be processed to enable us to enter into, fulfil our obligations under, or do anything else required in relation to an Agreement or other contract between you and the company.

We will process Personal Data in accordance with the law and your reasonable expectations. Depending on the nature of our interaction with you, the Personal Data we process may include:

• Contact information — postal address, email address(es), telephone number(s), company details, and where applicable, social media contact information.
• Identity information — current and former names, sex, date and place of birth, nationality, and proof of identity if requested (such as passport information).
• Preference information — dietary restrictions and preferred correspondence language.
• Verification information — government-issued documents, bank statements, and utility bills.
• Financial information — bank account information.
• Connected persons' information — information about familial relationships.
• Information in the public domain.
• Correspondence — between you, your agents or representatives, and us.
• Billing, transaction and payment information.
• Technical data — information about how you use our website, IT, communication, and other systems.

We collect and use this Personal Data (stored on software provided by Booqable) to be able to enter into Agreements and other contracts and to provide relevant services to you. If you do not provide the Personal Data we request, it may delay or prevent us from entering into Agreements or providing other relevant services.

We collect most of this Personal Data directly from you, by telephone, video call, text, email, and via our website. However, we may also collect information:

• from publicly accessible sources;
• from a third party with your consent;
• from cookies on our website;
• via our IT systems, for example from automated monitoring of our websites and other technical systems, such as computer networks and connections, communications systems, email and instant messaging systems.

We may, from time to time, record telephone calls.

We may use your data in the following ways and for the following reasons:

Where we process your Special Category Data, we will also ensure we are permitted to do so under the Data Protection Laws for the following reasons:

• to protect your (or someone else's) vital interests where you are physically or legally incapable of giving consent;
• to comply with another law;
• to prevent unlawful acts, including money laundering or other financial misconduct, and the financing of terrorism;
• to establish, exercise or defend legal claims; or
• where we have your express consent.

We will share your Personal Data with relevant third parties that we use to help deliver our services to you. As required, we also share your Personal Data with:

• other third parties we use to help run our business, such as marketing agencies or website hosts;
• organisations with whom we co-host marketing events;
• professional advisors, including lawyers, regulatory specialists, and tax advisers;
• IT service providers;
• our insurers and banks;
• intermediaries;
• third parties you approve, such as social media sites you choose to link your account to, or third-party payment providers;
• government agencies to whom we have a disclosure obligation; and
• competent courts and tribunals that issue an order with which we are obliged to comply.

We only allow our service providers to handle your Personal Data if we are satisfied they take appropriate measures to protect it.

On occasion, we may also need to:

• share Personal Data with external auditors;
• disclose and exchange information with law enforcement agencies and regulatory bodies to comply with our legal and regulatory obligations; and
• share some Personal Data with other parties, such as potential buyers of some or all of our business or during a restructuring. Information will be anonymised where possible, and any recipient will be bound by confidentiality obligations.

We will keep your Personal Data while you have a relationship with us or we provide services. We will then keep your Personal Data for as long as necessary:

• to respond to any questions, complaints or claims made by you or on your behalf;
• to show that we treated you fairly; and
• to keep records required by law.

Different retention periods may apply for different types of Personal Data. We reserve the right to retain all Personal Data for the longest period required for any particular item, to ensure efficient management. Once the relevant period has ended, we will delete or anonymise the data.

Personal data may be held at our offices, third-party agencies, service providers (including CRM systems and servers), representatives, and agents.

To deliver services to you, it is sometimes necessary for us to transfer your Personal Data to another jurisdiction to share it with our third-party agencies. We may transfer data to other jurisdictions on a routine or ad-hoc basis as particular needs arise. We will transfer data lawfully and in accordance with applicable requirements.

The use of your Personal Data for marketing purposes involves sending you updates about our services, such as exclusive offers, promotions, or new services, via email, text message, telephone, or post.

Where we have a legitimate interest in using your Personal Data for marketing purposes, your consent is not typically required. However, if consent is required, it will be requested explicitly and separately.

If you request additional services in the future or there are changes in the law, regulation, or our business structure, we may request confirmation or an update of your marketing preferences.

You may have the following rights in relation to your data, which you can exercise free of charge:

In many cases, we will have a maximum of four weeks to respond to your request. In certain situations this timeframe can be extended by an additional eight weeks. The specificity and focus of your request will directly affect how quickly we can assist you.

To exercise any of these rights, contact us at info@myrecoverease.co.uk.

We have implemented appropriate security measures, both organisational and technical, to prevent accidental loss, unlawful use, or unauthorised access to Personal Data. Access to Personal Data is strictly limited to individuals with a genuine business need, who must process information in an authorised manner and maintain confidentiality.

We have established procedures to address any suspected data security breaches. In the case of a suspected data protection breach, where legally required, you and the relevant supervisory authority will be promptly notified.

Capitalised terms used in this privacy notice have the following meanings: