Privacy Notice

(version 1.0)

We value your privacy. With this notice, we set out your privacy rights and how we process your personal data when you visit our website, acquire and hold shares in Trustpilot and/or participate in a share scheme operated by Trustpilot.

When we say “Trustpilot”, “we”, “our”, or “us”, we mean Trustpilot Group plc, 5th Floor The Minster Building, 21 Mincing Lane, London, United Kingdom, EC3R 7AG, which is the entity responsible for processing your personal data. When we refer to “you” or “your”, we mean visitors to this website (https://investors.trustpilot.com/).

If you have any questions about this privacy notice, including any requests to exercise your legal rights, please contact us using the details below.

Please note that Trustpilot A/S processes the personal data of the users of Trustpilot platform (reviewers and business users) in different ways to those contemplated by this website and, as such, the consumer and business websites (https://www.trustpilot.com and https://business.trustpilot.com) have their own Privacy Policy.

Personal data means any information about an individual from which that person can be identified. We may collect, use, store and transfer different kinds of personal data about you when you use our site or interact with us; which we have grouped together as follows:

• Identity data: title (Mr, Mrs, Ms), first name, last name, date of birth, nationality.

• Contact data: address, email address, phone number or any other contact details you may provide to us from time to time.

• Shareholder, warantholder and share scheme participant data: shareholder holding reference number, bank account details, the number, type and value of shares, warrants, shares options and/or awards held and where applicable the votes cast.

• Technical data: internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access this website.

• Usage data: information about how you use our website.

• Communications data: all communications we have with you whether by email, post, phone or otherwise.

• Current or former Trustpilot Group employee data: employee ID number, bank account details, tax information and tax ID numbers of current or former employees or directors of Trustpilot or any of its subsidiaries from time to time.

We use different methods to collect data from and about you including through:

• Direct interactions. You may give us your data by filling in forms or by corresponding with us by post, phone, email or otherwise.

• Automated technologies or interactions. As you interact with our website, we may automatically collect data about your equipment, browsing actions and patterns. We collect this personal data by using cookies and other similar technologies. Please see our Cookie Policy for further details.

• Third parties or publicly available sources. We may receive personal data about you from various third parties and public sources, such as shareholder registrars, financial service providers, analytics, storage, tools and media providers, email distribution and service providers, providers of data feeds and hosting services, social media and media networks, etc.

We will only process personal data where we have a genuine need to do so and in line with our obligations under data protection laws. Most commonly, we will use your personal data in the following circumstances:

• Where we need to perform a contract we are about to enter into or have entered into with you.

• Where it is necessary for our legitimate interests or those of a third party.

• With your consent.

• Where we need to comply with a legal or regulatory obligation.

• For the establishment, exercise or defense of legal claims, where necessary.

Note that we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific legal ground we are relying on to process your personal data.

1. To manage our relationship with you, this includes:

   • Performing our contract with you, including the maintenance of the shareholder register, communications with you as a shareholder, and the organization and hosting of General Meetings;

   • Notifying you about changes to our terms or privacy notice;

   • Answering any queries you may have.

2. To engage in various internal business purposes and protect our business and this website. This includes troubleshooting, data analysis, testing, security, fraud, system maintenance, support, reporting and hosting of data.

3. To use data analytics to improve our website, products/services, marketing, customer relationships and experiences.

4. To train our staff and for quality control purposes, helping us improve the quality of our services.

5. To provide news/updates.

6. Exercise or comply with our own legal rights or obligations in connection with legal claims, or for compliance, regulatory and auditing purposes, where necessary. For example, we may retain information where we are required by law, or if we are compelled to do so by a court order or regulatory body.

We may also use the information in other ways for which we provide specific notice at the time of collection.

In circumstances where you have expressly given your consent for us to process your personal data, for example, when subscribing to our newsletters or accepting certain cookies on your device, you are free to revoke your consent at any time, either by using the functionality provided within the appropriate product feature or by contacting us (see ‘Contact us’ below). However, please be aware that we may have the right to continue to process your information if it can be justified on one of the other legal bases mentioned above.

You have the right to object to how we process your personal data, or ask us to restrict the processing. Please see ‘Your rights’ below, for more details.

Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

We may have to share your personal data with the parties set out below for the purposes set out above.

• Internal Third Parties (Including Trustpilot subsidiaries and other companies within the Trustpilot group).

• External Third Parties: shareholder registrars, digital service providers acting as processors, who provide a number of services, including but restricted to data feeds, hosting, SSL, data analysis, CRM, video streaming, social media and sharing services.

• Professional advisers including lawyers, bankers, auditors and insurers who provide consultancy, banking, legal, insurance and accounting services.

• Regulators and other authorities who require reporting of processing activities in certain circumstances.

• Third parties to whom we may choose to sell, transfer, or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy notice.

We require all third parties to respect the security of your personal data and to treat it in accordance with applicable privacy laws. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

We will not transfer your data outside of the European Economic Area (EEA) and the UK unless we have taken necessary measures to ensure that the transfer complies with the applicable data protection laws. These measures may include transferring personal data to a recipient in a country that the European Commission has decided provides adequate protection for personal data or to a recipient that has executed standard contractual clauses adopted or approved by the European Commission.

Keeping your personal data secure is our highest priority. We use various organizational, technical and administrative measures to protect your personal data within our organization and we regularly audit our system for vulnerabilities. However, since the internet is not a completely secure environment, we can’t ensure or warrant the security of the information you transmit to us. Emails sent via the platform may not be encrypted, and we therefore advise you not to include any confidential information in your emails to us.

We’re always working to improve our security practices and policies, and we will update this information as these practices evolve over time.

We only keep your data for as long as we need it, or are required to for legal reasons. This depends on why it was collected, and if we have a continuing legal basis to do so (such as to fulfill a contract between us, meet legal requirements, or for our legitimate interests). When we no longer have a valid reason to keep your data, we'll either delete it or anonymize it so that it doesn't identify you. We treat data differently depending on what it's used for, but you can delete your personal data or ask us to do that for you at any time (see ‘Your rights’ below).

Under certain circumstances, you have rights under data protection laws in relation to your personal data:

• Request access to your personal data.

• Request correction of your personal data.

• Request erasure of your personal data.

• Object to processing of your personal data.

• Request restriction of processing your personal data.

• Request transfer of your personal data.

• Right to withdraw consent.

These rights may be limited, for example, if fulfilling your request would reveal personal data about another person, or if you ask us to delete information which we are required by law, or have compelling legitimate interests, to keep. If you wish to exercise any of the rights set out above, please contact us (see ‘Contact us’ below).

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a necessary measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request, in order to speed up our response.

We try to respond to all legitimate requests within one month, as prescribed by law. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

This website is not directed to children under the age of 16, and we do not knowingly collect personal data from such children. If you become aware that a child under the age of 16 has provided us with their personal data, please contact us using the contact information provided below.

We may change this notice from time to time. Laws, regulations, and industry standards evolve, which may make those changes necessary, or we may make changes to our services or business. We will post the changes to this page and encourage you to review our Privacy notice to stay informed.

Your continued use of our website after we publish or send a notice about the changes to the notice will mean that you accept and agree to the updated notice.

We aim to make this information as clear and transparent as possible. But if you still have questions about how we process your personal data, or would like to exercise your rights under this notice, you're welcome to contact our Data Protection Officer at privacy@trustpilot.com.

You can reach us by mail at:

Trustpilot Group plc5th Floor The Minster Building,
21 Mincing LaneLondon, United Kingdom, EC3R 7AGCompany registration no.: 13184807

You have the right to make a complaint at any time to the relevant supervisory authority for data protection matters. If you are based in the UK, this is the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). If you are based within the EU, you can find out more here. We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.