Customer Privacy Notice.

1. INTRODUCTION

A. What This Document Is

At Origina, protecting the personal data of individual representatives of our current and prospective customers (“you”) is a high priority. We have implemented technical and organisational measures designed to protect the Personal Information we process. This privacy notice explains how we collect and use your Personal Information before, during and after your organisation’s commercial relationship with us. It also explains the purposes of processing, the lawful bases on which we rely, how long we retain your information and the rights available to you.

Depending on your location, we are required to notify you of some or all the information contained in this privacy notice.

B. Who This Privacy Notice Applies To

This Notice applies to individual representatives, contacts and personnel of current and prospective customers of the Origina Group (“customer representatives”). Sections marked “EU & UK Specific”, “US Specific” and “Australia Specific” apply only to customer representatives residing in those regions.

For the purposes of this Notice, “Group” means Origina Limited (Ireland), Origina Inc. (USA), Origina UK Limited (United Kingdom), Origina Ltd PTY (Australia), Origina GMBH (Germany) and any other affiliated entity under common control from time to time.

Your data controller depends on the Origina location you reside in. Please refer to Appendix A (Location and Data Controller Details). If you have any questions about data controllers, please refer to the data protection team at [email protected]

C. Your Consent

We do not rely on consent for all processing of your Personal Information. Where consent is required or appropriate under applicable law, we will provide you with sufficient information to make an informed decision. You may refuse consent or withdraw it at any time. Withdrawal will not affect the lawfulness of processing carried out before withdrawal.More information is provided in Part 2D below.

2. COLLECTION AND USE OF PERSONAL INFORMATION

A. What kind of information do we hold about you

“Personal Information” in this Notice, means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked with you, directly or indirectly. Personal Information does not include information that cannot be reasonably linked to you including that which has been anonymised or deidentified.

We collect, store and use one or more of following types of information including Personal Information about you:

• Identification information – name and, where necessary, business identification details

• Business contact details – business email address, telephone number and postal address

• Professional information – employer, job title, department, responsibilities and relationship to your organisation

• Commercial relationship information – communications, meeting notes, service requirements, contractual and account information

• Marketing preferences and records of engagement with our communications

• Event, hospitality and gifting information, including delivery details and relevant preferences

• Limited health information, such as allergen or dietary information, where necessary for events or hospitality

B. How do we collect your information

We collect your Personal Information in various ways.

We collect Personal Information directly from you, including through email, telephone, meetings, events and other communications, and during customer onboarding and the ongoing management of your organisation’s commercial relationship with Origina. We may also receive business contact information from your organisation, colleagues, publicly available professional sources, referrals and service providers.

C. Purposes and legal bases for using your Personal Information

We will use your Personal Information only in accordance with the law. Generally, we rely on one or more of the following legal bases when using your Personal Information:

1. To enter into and perform the contract between your organisation and Origina.

2. To protect your interests or the interests of others.

3. To comply with a legal or regulatory obligation.

4. For law enforcement requests, tax authorities’ regulatory agencies, public and government authorities all of which may include requests and authorities outside of your country of residence.

5. For substantial public interest purposes.

6. For our legitimate interest (or those of third parties) in circumstances where your fundamental rights and interests do not override those legitimate interests.

7. When you have given consent to the use of your Personal Information, which you may withdraw at any time.

D. Practical ways in which we use the information we have about you.

The information described in section 2A (What kind of information do we hold about you) is used for the purposes and on the legal bases outlined in section 2C (Purposes and legal bases for using your Personal Information).

The below non-exhaustive list provides some examples of those obligations:

1. Communicating with you to negotiate, enter into, administer and support the commercial relationship between your organisation and Origina.

2. Managing customer accounts, services, enquiries, meetings, support, invoicing and contractual obligations.

3. Developing and strengthening our relationship with your organisation, improving our services and pursuing relevant business opportunities.

4. Sending relevant service, relationship and marketing communications, subject to applicable law and your preferences.

5. Arranging appropriate customer events, hospitality, gifting and related messages, including delivery where applicable.

We do not routinely collect this information from customer representatives, other than limited allergen or dietary information where needed for events or hospitality. If we exceptionally process other sensitive or special-category information, we will do so only where permitted by applicable law and with appropriate safeguards.

1. Where necessary to comply with a legal obligation and in accordance with our data protection policies.

2. Where you have given explicit consent and applicable law permits us to rely on it.

3. Where necessary to protect your vital interests or those of another person.

4. Where necessary for the establishment, exercise or defence of legal claims or another applicable legal condition.

---

EU & UK Specific: Sensitive or special-category information may include health or biometric information, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, sexual orientation and genetic data. We do not routinely collect this information from customer representatives, other than limited allergen or dietary information where needed for events or hospitality. If we exceptionally process other sensitive or special-category information, we will do so only where permitted by applicable law and with appropriate safeguards.

Where we collect limited allergen or dietary information for events or hospitality, we use it only to accommodate relevant dietary requirements and help protect your health and safety.

If we exceptionally process other sensitive or special-category information, we will do so only where permitted by applicable law and with appropriate safeguards.

EU & UK Specific

E. Automated decision making

Automated decision means a decision is made by a computer using your personal data with no human involvement, and the decision has a legal or similarly significant effect on you. You have the right to request human involvement to review an automated decision if one is made. We do not use automated decision-making of this type.

---

3. DATA SHARING

We may be required to share your data with third party service providers and other entities within our Group of companies. We require third parties to treat your information in accordance with the law. Where we transfer your Personal Information to third jurisdictions, we have in place contractual arrangements to ensure that your data has the same degree of protection as that required by the law of the country you reside in.

Your Personal Information may be processed by third-party service providers and other entities within our Group where necessary to manage customer relationships, provide services and support, communicate with you, organise events or hospitality, and arrange or deliver gifts. These providers may include customer relationship management, service desk, collaboration, secure file-transfer, event, gifting, fulfilment and delivery providers. We share only the information reasonably required for the relevant purpose. A non-exhaustive list is provided in Appendix B.

We may also share your Personal Information with third parties, including government and public bodies, where we are required by law as necessary to administer our working relationship with you or where we have another legitimate interest to do so.

4. DATA SECURITY

We have technical and organisational measures in place to protect the security of your Personal Information. We update and test our security technologies on an ongoing basis, restrict access to those who need the information for legitimate business purposes, and train our employees on confidentiality and data security.

Third parties will only process your Personal Information under our direction and instructions pursuant to a Data Protection Agreement, always subject to the duty of confidentiality and bound with our requirements on its security. Data stored on our CRM platform, Zoho CRM, is subject to access restrictions whereby only those Origina employees who are essential to the furthering the company’s legitimate interest in developing and enhancing good customer relationships will have access to the personal information stored on Zoho CRM.

We have in place systems to address any suspected data security breaches, we will notify you, and any relevant regulator where we are legally required to so notify. Should you require more information on how we address data security breaches, you can refer to our Data Breach Policy and Training or send a query to our data protection/privacy officer at [email protected].

5. DATA RETENTION

We will only retain your Personal Information for the period needed to fulfil the purpose for which we collected. We decide how long to keep it on a case-by-case basis. Some of the reasons we consider when making this decision include ensuring we can fulfil certain business development objectives or you ceasing to be our key customer contact for your organisation. If you would like more details on how long we retain different aspects of your Personal Information, please contact our Data Protection Officer using the details provided at section 4 above.

We may anonymise your Personal Information where circumstances permit, in which case we may use such information without any reference or notification to you. Upon termination of our relationship with your organisation we will retain and securely destroy your Personal Information in accordance with our privacy policy.

---

EU & UK Specific

6. DATA SUBJECT RIGHTS

It is important that the Personal Information we hold about you is accurate and current. Please notify us of any changes as they occur and where you notice an inaccuracy.

You have the following rights in connection with the personal data we hold about you.

1. Right of access where you seek to know what personal data we have processed about you.
2. Right to rectification/correction, where you request the rectification of inaccurate information.
3. Right to erasure commonly referred to as the right to be forgotten.
4. Right to restrict processing
5. Right to data portability where you can request that we transfer your data to another person
6. Right to object to further processing or opt out of any further processing of your Personal Information
7. Rights in relation to automatic decision making and profiling.
8. Right to complain to Origina or your data privacy regulator if you think your data rights have been breached.

If you wish to exercise any of the above rights, please contact us at [email protected]. We will respond to any valid request within one month unless it is particularly complex or you have made multiple requests, in which case we will respond within three months at the latest. We will inform you of any such extension within one month of receipt of your request.

You should be aware that the above rights are not absolute, and we may have a reason not to comply with your request. Some examples of why we may not comply with your request include where required to protect the rights and freedoms of others, where there is an overarching legal obligation, to establish or for the exercise of the company’s legal claims or defences, where your request is excessive. Where we are unable to honour your rights, we shall provide you with the reason within the time frame required by law.

Should you wish to, you can lodge a complaint with the data protection or privacy regulator in the jurisdiction where you reside.

While you typically do not need to pay a fee to access your personal information or exercise other rights, we may charge you a reasonable fee if your request is manifestly unfounded or excessive. Additionally, we reserve the right to refuse to comply with your request.

To protect your Personal Information, we may need to verify your identity and that of an agent you have directed to exercise your rights above before processing any request. This may include collecting additional information such as government issued identification.

7. DATA PROTECTION AND PRIVACY OFFICER

We have a data protection/privacy officer to oversee compliance with this Notice. If you have any questions, you can reach out to the officer at [email protected].

8. COMPLAINTS

Please remember that while we are confident that we can address any concerns you may have, you can always directly contact your regulator in the country that you reside. You may also seek recourse through the appropriate judicial authorities in the country that you reside.

9. CHANGE TO THIS PRIVACY NOTICE

We may update this Notice from time to time. Where we make material updates, we will notify you through appropriate customer communication channels. The most recent version will be made available through our usual customer-facing channels.

---

US Specific

10. US REGION PRIVACY NOTICE

This United States of America Privacy Notice (" USA Notice") applies to all key customer contacts in United States and is to be read with Origina Privacy Policy and supplements specific sections of the EU UK Privacy Notice above.

This USA Notice explains how we collect, use and disclose your Personal Information. It also describes how to exercise your rights under the California Consumer Privacy Act, the Colorado Privacy Act, the Connecticut Act Concerning Personal Data Privacy and Online Monitoring, the Utah Consumer Privacy Act and the Virginia Consumer Data Protection Act, collectively the "US Privacy Laws".

Subject to our privacy policy, we may disclose your Personal Information for business purposes as outlined in this USA Notice. We may also disclose it at your direction or in other ways that are in accordance with the US Privacy Laws.

A. Sensitive Personal Information

Sensitive Personal Information may include government identification numbers; racial or ethnic origin; religious or philosophical beliefs; precise geolocation; account credentials; and health-related information. We do not routinely collect this information from customer representatives, other than limited allergen or dietary information where needed for events or hospitality. If we exceptionally process other sensitive or special-category information, we will do so only where permitted by applicable law and with appropriate safeguards. Sensitive data does not include information that is publicly available or de-identified.

B. Practical ways we use information defined as Sensitive Personal Information

We do not routinely collect this information from customer representatives, other than limited allergen or dietary information where needed for events or hospitality. Where that limited exception applies:

Where we collect limited allergen or dietary information for events or hospitality, we use it only to accommodate relevant dietary requirements and help protect your health and safety.

C. Your Rights

The information we collect, use and disclose about you will vary depending on where you reside and subject to certain exceptions, you may have some or all of the following rights:

1. Right to Correct: You have the right to request the correction of any inaccurate personal information that we maintain about you, considering the nature of the personal information and the purposes of the processing of the personal information. We will use commercially reasonable efforts to correct the inaccurate personal information as you may direct.

2. Right to Know: The right to request that we disclose to you the Personal Information we collect, use, or disclose, and information about our data practices.

3. Right to Request Deletion: The right to request that we delete your Personal Information that we have collected from or about you.

4. Right to Opt Out: The right to opt out of the processing of your Personal Information that have obtained from or about you.

5. Right to Non-Discrimination: The right not to receive discriminatory treatment for exercising your privacy rights.

Under certain US Privacy Laws, you may designate an authorised agent to exercise your rights. If you use an authorised agent to submit a request, we may need to collect additional information, such as a government-issued ID, to verify your and their identity before processing your request to protect your information.

D. California-Specific Customer Contacts

We do not sell, rent, or lease your Personal Information to third parties for monetary or other valuable consideration. To that end, we do not offer the right to opt out of such a sale. Additionally, we don't "share" your Personal Information, as defined in the California Consumer Privacy Act ("CCPA").

We do not routinely collect this information from customer representatives, other than limited allergen or dietary information where needed for events or hospitality. If we exceptionally process other sensitive or special-category information, we will do so only where permitted by applicable law and with appropriate safeguards. Where Sensitive Personal Information is processed under the CCPA, we use or disclose it only as described in this Notice, our privacy policy and for the specific permitted business purposes under section 7027(m) of the CCPA. Accordingly, we do not offer a right to limit its use.

11. AUSTRALIA PRIVACY NOTICE

This Australia Privacy Notice ("Australia Notice") applies to all key customer contacts in Australia and supplements specific sections of the Notice.

This Australia Notice explains how we collect, use and disclose your Personal Information. It also describes how to exercise your rights under the Privacy Act 1988 and Australian Privacy Principles collectively the "Australia Privacy Laws".

Subject to our privacy policy, we may disclose your Personal Information only for business purposes as outlined in this Australia Notice. We may also disclose it at your direction or in other ways that are in accordance with the Australia Privacy Laws. The Company handles all personal information responsibly and in accordance with applicable law.

A. Sensitive Personal Information

Sensitive information includes information or an opinion about an individual’s racial or ethnic origin, political opinions or associations, religious or philosophical beliefs, trade union membership, sexual orientation or practices, criminal record, health or genetic information, and certain biometric information. We do not routinely collect this information from customer representatives, other than limited allergen or dietary information where needed for events or hospitality. If we exceptionally process other sensitive or special-category information, we will do so only where permitted by applicable law and with appropriate safeguards.

B. Practical ways we use information defined as Sensitive Personal Information.

We do not routinely collect this information from customer representatives, other than limited allergen or dietary information where needed for events or hospitality. Where that limited exception applies:

Where we collect limited allergen or dietary information for events or hospitality, we use it only to accommodate relevant dietary requirements and help protect your health and safety.

C. Your Rights

You have the following rights on the information:

1. Right to Information: The right to request that we disclose to you the Personal Information we hold about you.

2. Right to Access: You have the right to request access to the Personal Information we hold about you.

3. Right to correct information. If the Personal Information we hold about you is inaccurate, out-of-date, incomplete, irrelevant, or misleading, you have the right to request that it be corrected.

4. Right to opt out- You have the right to stop receiving unwanted direct marketing.

5. Right to Anonymity and Pseudonymity: You may have the right to interact with us anonymously or by using a pseudonym where this is lawful and practicable in the context of our commercial relationship.

12. APPENDICES

Appendix A (Location and Data Controller Details)

Origina Location	Data Controller
Ireland	Origina Ltd
UK	Origina Ltd UK
Australia	Origina Ltd PTY
United States	Origina Inc
Germany	Origina GMBH

Appendix B- Non - Exhaustive list of our third-party providers

Third-Party Provider or Category	Service Provided
Zoho CRM	Customer relationship management, including storage of customer contact details, communications, relationship information, preferences and relevant gifting information.
Microsoft 365	Business communications, meetings, collaboration and controlled storage of customer contact information and related records.
Gifting and fulfilment providers	Preparation, personalisation and fulfilment of customer gifts. Information shared may include the recipient’s name, delivery address, contact details and relevant non-sensitive preferences.
Courier and delivery providers	Delivery and tracking of gifts or event-related items using the minimum recipient and delivery information required.
Event, hospitality and venue providers	Administration of customer events or hospitality, including attendee details and, where necessary, limited dietary or allergen information.
Customer communications and marketing service providers	Distribution and management of relevant customer communications, subject to applicable law and customer preferences.

The specific providers used may change from time to time. Origina applies appropriate contractual, privacy and security requirements before sharing Personal Information with a provider.