Claranet privacy policy 2022
 1. Who are we?
 Claranet Limited of 110 High Holborn, London, England, WC1V 6JS and its group of companies
 (www.claranet.com)(“we”, “Claranet”) are committed to protecting and respecting your privacy.
 For the purpose of applicable data protection legislation, the data controller of your personal
 information is the Claranet group company(ies) you have contracted with and/or to whom you
 have granted consent.
 2. What does this Privacy Policy do?
 a) Claranet has developed this privacy policy because we want you to feel confident about
 the privacy and security of your personal information. Claranet takes all reasonable care to
 prevent any unauthorised access to your personal information.
 b) When we refer to “personal information” in this privacy policy, we mean information that
 relates to you in circumstances where we can identify you directly or indirectly. We may
 hold and use personal information about you in your capacity as a consumer, a business
 customer or as an individual when you visit our websites.
 c) This privacy policy only applies to how Claranet deals with your personal information. It
 does not apply to your use of services, products or websites made available to you by third
 parties, even if you access them through Claranet. Please review the applicable privacy
 policies of such third parties to understand how they use your personal information.
 3. What personal information do we collect from you and how
 do we use it?
 We may collect and process the following personal information about you:
 a) Personal information that you provide by filling in forms Claranet provided portals and on
 our website www.claranet.co.uk/ (“our site”) or Claranet Affiliate websites and portals
 where applicable. This includes personal information provided at the time of subscribing to
 our services, posting material or requesting further services. We may also ask you for
 personal information when you report a problem with our site.
 b) We use this information to provide the services to you that you have requested and which
 we have agreed to provide to you.
 • Our lawful ground for processing your personal information for this purpose is that our
 processing is necessary to deliver our services to you, it is necessary for the performance
 of a contract.
 c) We also collect personal information about your use of our services (such as the amount
 of time you spend on-line), which we use to manage our network, and for billing purposes.
 • Our lawful ground for processing your personal information for these purposes is that our
 processing is in our legitimate business interests.

Claranet privacy policy 2021
 d) We may ask you from time to time about what use you make of the services we provide,
 what other services you would like us to provide in the future, and other personal
 information, such as lifestyle data.
 • Our lawful ground for processing your personal information for these purposes is that it is in
 our legitimate business interests to do so.
 e) We collect personal information about your use of our site and services to help us to make
 improvements to our sites and to the services we make available to our customers and
 users.
 • Our lawful ground for processing your personal information for these purposes is that it is in
 our legitimate business interests to do so.
 f) We may also monitor and record our communications with you, including e-mails and
 phone conversations which may then be used for training purposes, quality assurance, to
 record details about the products and services you order from us, and in order to meet our
 legal and regulatory obligations generally.
 • Our lawful ground for processing your personal information for training purposes and quality
 assurance purposes is that it is in our legitimate business interests to do so.
 • Our lawful ground for processing for the remaining purposes described in this section is that
 our processing is necessary to deliver our services.
 g) We receive information about you from other telecommunications operators where you are
 also our customer.
 • Our lawful ground for processing for the remaining purposes described in this section is that
 it is in our legitimate business interests to do so.
 4. How else do we use your personal information?
 4.1. Marketing and Advertising
 a) We may need your personal data in order to send to you marketing materials which we
 think you may be interested in. In most instances our lawful ground for processing your
 personal data for marketing purposes is that it is in our legitimate business interest to do
 so.
 h) Where appropriate, we strive to obtain your consent if we intend to use your personal
 information for certain other marketing purposes and in these instances our lawful ground
 for processing your personal data is that you have consented for us to do so.
 i) Where you have consented to us doing so, we may use personal information that you
 provide directly to us, and/or which we collect about your use of our site and services for
 marketing purposes, either alone or in combination with personal information that we
 receive about you from third party companies and organisations. Where we receive
 personal information about you from such third parties which we use for marketing
 purposes, this is on the basis that such third parties have obtained your consent to such
 disclosure to, and use by Claranet.
 j) Where you have consented to us doing so, we may also share your personal information
 about your use of our site and services with our advertisers and to other companies which
 offer their goods or services on our websites.

Claranet privacy policy 2021
 4.2. Credit checking and account management
 a) When you order goods and services from Claranet, we may make enquiries about you for
 credit reference purposes. These enquires include searching your records held by a Credit
 Reference Agency (CRA) and checking any details held on you by Fraud Prevention
 Agencies (FPA’s). When CRA’s receive a search from us they will place a footprint on your
 credit file that may be seen by other organisations. At all times where your personal
 information is disclosed to us we will protect it in accordance with this privacy policy. We
 do this to help protect you from identity theft and fraud, and also to prevent and detect
 crime and money laundering.
 • Our lawful ground for processing your personal information for these purposes is that it is in
 our legitimate business interests to do so.
 k) Personal information on applications will be sent to CRA’s and will be recorded by them.
 We may also give them details of your accounts and billing information, including how you
 manage it/them to CRA’s. We may tell them about payments you make to us, your
 account balances, and payment defaults. We may also give them historical information we
 hold about your payment history with us. If you do not pay your bills on time, CRA’s will
 record this information and it may be supplied to other organisations by CRA’s and FPA’s
 to perform similar checks and to trace your whereabouts and recover debts that you owe
 to them as well as us.
 • Our lawful ground for processing your personal information for the purposes described in
 this section is that it is in our legitimate business interests to do so.
 5. Do we share your personal information with anyone else?
 5.1. External companies
 a) We sometimes use other companies to help us to provide the services that we have
 agreed to supply to you. To enable them to do this, we may need to share your personal
 information with them. When we do so, these companies are required to act in accordance
 with the instructions we give them and they must meet the requirements of applicable data
 protection legislation when processing your personal information.
 l) Our lawful ground for processing your personal information for the purposes described in
 this section 5.1 is because it is in our legitimate business interests to do so.
 5.2. Lawful requests
 a) We may provide your personal information, in response to lawful requests, for the
 purposes of the prevention and detection of crime, and the apprehension or prosecution of
 offenders. We may also provide information for the purpose of safeguarding national
 security. In either case we do so in accordance with applicable data protection legislation.
 We also provide your personal information to third parties when required to do so by law,
 for example under a court order, or in response to lawful demands, under powers
 contained in legislation.
 m) Our lawful ground for processing your personal information for the purposes described in
 section 5.2 is because such processing is necessary for us to comply with legal obligations
 we are subject to

Claranet privacy policy 2021
 6. For how long does Claranet keep your personal
 information?
 Unless there is a specific legal requirement for us to keep your personal information, we will
 retain it for no longer than is necessary for the purposes for which the data was collected or for
 which it is to be further processed.
 7. How do we protect your data when it is transferred outside
 the EEA?
 Claranet complies with the rules in applicable data protection legislation governing the transfer of
 your personal information from countries in the European Economic Area (EEA) to countries
 outside the EEA. We do sometimes transfer your personal information to a country outside the
 EEA but before doing so we will take steps to ensure that your personal information is only
 transferred in accordance with applicable data protection legislation.
 8. How do we protect your personal information?
 8.1. Security
 We are serious about guarding the security of your personal information. We take appropriate
 organisational and technical security measures to protect your personal information against
 unauthorised disclosure or processing.
 8.2. Passwords
 Where we have given you (or where you have chosen) a password which enables you to access
 certain parts of our site, you are responsible for keeping this password confidential. We ask you
 not to share a password with anyone.
 8.3. Other security measures
 We use various security measures to protect the information we collect, as appropriate to the
 type of information, including encryption, firewalls, and access controls. Our company databases
 are accessible only by persons who have entered into and are bound by a confidentiality and
 nondisclosure agreement with Claranet.
 8.4. Internet security and associated risks
 Unfortunately, the transmission of information via the internet is not completely secure. Although
 we will do our best to protect your personal data, we cannot guarantee the security of your
 information transmitted to our site; any transmission is at your own risk. Once we have received
 your information, we will use strict procedures and security features to try to prevent unauthorised
 access.

Claranet privacy policy 2021
 9. How to access your personal information and your other
 rights?
 9.1. You have the following rights in relation to the personal
 information we hold about you:
 a) Your right of access. If you ask us, we’ll confirm whether we’re processing your personal
 information and, if so, provide you with a copy of that personal information (along with
 certain other details). If you require additional copies, we may need to charge a
 reasonable fee.
 n) Your right to rectification. If the personal information we hold about you is inaccurate or
 incomplete, you’re entitled to have it rectified. If we’ve shared your personal information
 with others, we’ll let them know about the rectification where possible. If you ask us, where
 possible and its lawful to do so, we’ll also tell you who we’ve shared your personal
 information with so that you can contact them directly.
 o) Your right to erasure. You can ask us to delete or remove your personal information in
 some circumstances such as where we no longer need it or you withdraw your consent
 (where applicable). If we’ve shared your personal information with others, we’ll let them
 know about the erasure where possible. If you ask us, where possible and it is lawful to do
 so, we’ll also tell you who we’ve shared your personal information with so that you can
 contact them directly.
 p) Your right to restrict processing. You can ask us to ‘block’ or suppress the processing
 of your personal information in certain circumstances such as where you contest the
 accuracy of that personal information or object to us processing it. It won’t stop us from
 storing your personal information though. We’ll tell you before we lift any restriction. If
 we’ve shared your personal information with others, we’ll let them know about the
 restriction where possible. If you ask us, where possible and it is lawful to do so, we’ll also
 tell you who we’ve shared your personal information with so that you can contact them
 directly.
 q) Your right to data portability. With effect from 25 May 2018, you have the right, in
 certain circumstances, to obtain personal information you’ve provided us with (in a
 structured, commonly used and machine-readable format) and to reuse it elsewhere or
 ask us to transfer this to a third party of your choice.
 r) Your right to object. You can ask us to stop processing your personal information, and
 we will do so, if we’re:
 • relying on our own or someone else’s legitimate interests to process your personal
 information except if we can demonstrate compelling legal grounds for the processing;
 • processing your personal information for direct marketing; or
 • processing your personal information for research unless such processing is necessary for
 the performance of a task carried out in the public interest.
 s) Your rights in relation to automated decision-making and profiling. You have the
 right not to be subject to a decision when it’s based on automatic processing, including
 profiling, and it produces a legal effect or similarly significantly affects you unless such

Claranet privacy policy 2021
 profiling is necessary for entering into, or the performance of, a contract between you and
 us.
 t) Your right to withdraw consent. If we rely on your consent as our legal basis for
 processing your personal information, you have the right to withdraw that consent at any
 time.
 u) Your right to lodge a complaint with the supervisory authority. If you have a concern
 about any aspect of our privacy practices, including the way we’ve handled your personal
 information, you can report it to the UK Information Commissioner’s Office (ICO). You can
 find details about how to do this on the ICO website at https://ico.org.uk/concerns/ or by
 calling their helpline on 0303 123 1113.
 10. Changes to Our Privacy Policy
 Any changes we may make to our privacy policy in the future will be posted on this page and,
 where appropriate, notified to you by e-mail.
 11. When do we use Cookies?
 11.1. Information that can be collected
 We may collect information about your computer, including where available your IP address,
 operating system and browser type, for SYSTEM administration and to report aggregate
 information to our advertisers. This is statistical data about our users’ browsing actions and
 patterns, and does not identify any individual.
 11.2. The purpose of cookies
 Cookies cannot be executed as code or used to deliver a virus. Cookies help us to improve our
 site and to deliver a better and more personalised service. They enable us:
 a) To estimate our audience size and usage pattern.
 b) To store information about your preferences, and so allow us to customise our site
 according to your individual interests.
 c) To speed up your searches.
 d) To recognise you when you return to our site.
 12. What type of Cookies do we use?
 12.1. Types of Cookie
 Two types of cookies may be used on this website, session cookies, which are temporary cookies
 that remain in the cookie file of your browser until you leave the site, and persistent cookies,
 which remain in the cookie file of your browser for much longer (though how long will depend on
 the lifetime of the specific cookie).

Claranet privacy policy 2021
 12.2. Third party advertisements
 We may use a third party to serve advertisements on our site. Cookies may be associated with
 these advertisements to enable the advertiser to track the number of anonymous users
 responding to the campaign. We do not have access to or control of cookies placed by third
 parties.
 12.3. Third party internet sites
 Third party internet sites that you can link to from Claranet’s websites are not covered by our
 privacy policy, so we urge you to be careful when you enter any personal information online.
 Claranet accepts no responsibility or liability for these sites.
 12.4. Additional cookies
 Other companies which advertise or offer their products or services on our website may also
 allocate cookies to your PC. The types of cookies they use and how they use the information
 generated by them will be governed by their own privacy policies and not ours.
 12.5. Deactivating cookies
 You may refuse to accept cookies by activating the setting on your browser which allows you to
 refuse the setting of cookies. However, if you select this setting you may be unable to access
 certain parts of our site. Unless you have adjusted your browser setting so that it will refuse
 cookies, our system will issue cookies when you log on to our site.
 13. Google Analytics
 Google Analytics and Google Tag Manager – data protection declaration
 We use Google Analytics, a web analysis service provided by Google Inc. (“Google”), pursuant to
 Article 6 (1) f) GDPR, for the purposes of tailoring our website to meet your needs and ongoing
 optimisation. In this context, anonymous user profiles are created, and cookies are used. The
 information collected about your use of our website, such as
 • browser type/version,
 • operating system
 • referrer URL (the previously visited page),
 • host name of the accessing computer (anonymous IP address),
 • time of the server request
 is transferred to a Google server in the USA and stored there. Google will use this information to
 evaluate your use of the website to compile reports on website activity for us as website
 operators and to provide other services associated with the use of the website and the Internet.
 Google may also transfer this information to third parties where required to do so by law, or
 where such third parties process the information on Google's behalf. Google will not associate
 your IP address with any other data held by Google Inc. under any circumstances.

Claranet privacy policy 2021
 By using our website, you consent to the processing of data about you by Google in the manner
 and for the purposes set out above.
 You may refuse the use of cookies by selecting the appropriate settings on your browser.
 However, please note that if you do this you may not be able to use the full functionality of our
 website and portal.
 You may also refuse the use of cookies by selecting the appropriate settings on your browser,
 which will prevent the collection of cookies-generated data relating to your use of the website and
 the processing of such data by Google, by downloading and installing the browser plugin
 available at the following link:
 https://tools.google.com/dlpage/gaoptout?hl=de
 Google Tag Manager is used to implement Google Analytics on our website. The Google Tag
 Manager is a solution from Google Inc. that enables companies to manage website tags via a
 single interface. Google Tag Manager is a cookie-free domain that does not collect personally
 identifiable information. The Google Tag Manager triggers other tags that may themselves collect
 data. The Google Tag Manager does not access this data. If the user has disabled it at the
 domain or cookie level, it will remain disabled for all tracking tags implemented with Google Tag
 Manager.
 Deletion of old data, if applicable
 If Google Analytics has created user profiles without IP anonymisation, this data has been
 collected illegally and must therefore be deleted. In the Analytics settings, Google now offers the
 option of moving so-called "properties" and "data views" to the trash, whereby they are deleted
 after three (3) months.
 14. Helpful definitions
 Affiliate means, with respect to any entity, any other entity Controlled directly or indirectly, by the
 entity, any entity that Controls, directly or indirectly, the entity or any entity directly or indirectly
 under common Control with the entity;
 Control means the beneficial ownership of more than fifty per cent (50%) of the issued share
 capital or the legal power to direct or cause the direction of the general management or affairs of
 the company, partnership or other entity in question and “Controls”, “Controlled” and “Controlling”
 shall be construed accordingly.
 15. Contact
 Questions, comments and requests regarding this privacy policy are welcomed and should be
 addressed to Claranet Limited, 110 High Holborn, London, England, WC1V 6JS or by email at
 privacy@uk.clara.net.