Our Commitment to Transparency and Compliance

Our Privacy Policy explains how we collect, use, share, and protect personal data across our platforms and services. It outlines the legal basis for processing, users’ rights under applicable regulations such as the GDPR, and the measures we take to ensure confidentiality and transparency. This document serves as a comprehensive guide to how we respect and safeguard personal information.

2025

• Privacy Policy English Version

This overview highlights the technical and organizational measures implemented to protect data integrity, confidentiality, and availability. It describes our governance framework, cybersecurity practices, access controls, encryption standards, and incident response procedures. The document demonstrates our proactive approach to risk management and regulatory compliance.

2025

• Information Security and Data Privacy Overview English Version
• Information Security and Data Privacy Overview Dutch Version

We work with carefully selected third-party service providers to support our platforms and operations. This statement lists all current sub-processors involved in the processing of personal data, including the purpose of their role and applicable safeguards. It ensures transparency regarding data transfers and compliance with contractual and regulatory obligations.

2025

• Euronext Corporate Solutions B.V Sub-Processor Disclosure Statement Online English version
• Euronext Corporate Solutions B.V Sub-Processor Disclosure Statement English PDF version

Our Data Privacy Factsheets provide clear, concise summaries of key privacy topics, designed for quick reference by clients, partners, and stakeholders. They outline obligations, data subject rights, security practices, and compliance commitments in an accessible format. These resources support informed decision-making and facilitate due diligence processes.

2025

• IR.Manager Sales Factsheet English version
• Compliance Solutions Factsheet English version
• Compliance Solutions Factsheet Dutch version
• Communication Solutions Factsheet English version

•  Euronext Data Act Addendum - May 2026 - Schedules ECS (IntegrityLog, InsiderLog, IR.Manager)
  

May 2026

CLAUSE 1 DEFINITIONS

Capitalized terms not defined herein, shall have the meaning attributed to them as per the Data Act or the Agreement.

“Agreement” means the underlying agreement between Euronext and the Customer for the provision of services qualified as ‘Data Processing Services’.

“Customer” means the counterparty to Euronext in the Agreement.

“Customer Data” means the input and output data, including metadata, directly or indirectly generated, or cogenerated, by the Customer’s use of the Data Processing Service, excluding any assets or Data protected by intellectual property rights, or constituting a trade secret, of Providers of Data Processing Services or third parties.[1]

“Euronext” means the legal entity that is part of the Euronext group, that is party to the Agreement.

CLAUSE 2 APPLICABILITY AND ORDER

2.1 This Data Act Addendum (“Addendum”) governs all Switching and/or Deletion Requests of Customer Data made by Customer pursuant to the Data Act.[2]

2.2 This Addendum applies to the services provided by Euronext under the Agreement and forms an integral part thereof. In case of conflict between this Addendum and the Agreement, this Addendum shall prevail.

2.3 By continuing to use the services provided under the Agreement, this Addendum will be deemed accepted by Customer.

CLAUSE 3 REQUEST PROCESS

3.1 During the term of the Agreement, a Customer registered in a member state of the EU/EEA may, considering a two-month notice period,[3] request Euronext to migrate Customer Data to a different provider of Data Processing Services covering the same service type, or to port Customer Data to an on-premises ICT infrastructure (each a “Switching Request”); or to erase Customer Data (a “Deletion Request”).[4]

3.2 Euronext will support the Customer’s exit strategy relevant to the Agreement, including by providing all relevant information.[5]

CLAUSE 4 SWITCHING REQUEST

4.1 Euronext will confirm receipt of a Switching Request notice in writing within three working days. Euronext will support the Customer to export the Customer Data within 30 calendar days from the end of the two-month notice period (the “Transition Period”).[6]

4.2 The Customer may extend the Transition Period once for a period that the Customer considers more appropriate for its own purposes.[7] In that case, the Customer will notify Euronext promptly in writing.

4.3 If the Transition Period is technically unfeasible, Euronext will inform the Customer in writing within 14 working days of receipt of the Switching Request notice thereof and provide the Customer with a justification of the technical unfeasibility and an alternative Transition Period, which shall not exceed seven months from the date of the Switching Request notice.[8]

4.4 During the Switching and in accordance with the Agreement, Euronext will:

1. Provide reasonable assistance to the Customer and third parties authorised by the Customer;[9]
2. Act with due care to maintain business continuity and continue the provision of the Services;[10]
3. Provide Customer clear information about known risks to continuity in the provision of the Services;[11] and
4. Ensure that a high level of security of the Customer Data is maintained, especially during the transfer and during the Retrieval Period.[12]

4.5 The Customer shall act in good faith to implement any guidance related to the Switching shared by Euronext.[13]

4.6 Upon completion of the Transition Period, Euronext will retrieve the Customer Data for another 30 calendar days (the “Retrieval Period”).[14]

4.7 Customer shall notify Euronext in writing once the export of Customer Data is completed via the e-mail address that Euronext makes available for that purpose. Upon notification by Customer and expiration of the Retrieval Period, Euronext shall erase all Customer Data.[15]

4.8 For any Switching Request received by Euronext before January 12^th, 2027, Euronext will inform Customer of the applicable Switching Charges.[16]

CLAUSE 5 DELETION REQUEST

5.1 Euronext will support a Deletion Request to the extent permitted by applicable law.

CLAUSE 6 TERMINATION

6.1 The Agreement will automatically terminate either (i) for Switching Requests upon Customer notifying Euronext in writing about the successful export of Customer Data (in the absence of formal notification by Customer, the Switching will be deemed successful at the end of the Transition Period or the alternative Transition Period)[17], or (ii) for Deletion Requests, two months after Euronext has received the Deletion Request (the “Termination Date”).[18]

6.2 For the avoidance of doubt, termination of the Agreement as stated in clause 6.1 will not relieve Customer of its obligation to pay any fees due to Euronext for the period prior to the Termination Date of the Agreement. Further, Euronext will invoice the Customer upon termination of the Agreement for the outstanding fees, if any, for the remainder of the term at once, as an ‘early termination’ fee.[19]

CLAUSE 7 EXCLUSIONS

7.1 Euronext will inform Customer of the categories of Customer Data that can be ported during the Switching and categories that are exempted where there is a risk of breach of trade secrets by Euronext.[20]

7.2 Switching or Deletion Requests will not be accepted for any service that has been provided by Euronext for a limited period specifically for testing and evaluation purposes.

CLAUSE 8 INDEMNIFICATION

8.1 Customer will defend Euronext against any claim, demand, suit or proceeding made or brought against Euronext by a third party alleging that the Switching or Deletion Request infringes such party’s rights and will indemnify Euronext from any damages, attorney fees and costs finally awarded against Euronext, or from any amounts paid by Euronext under a settlement approved by Customer in writing, as a result of such a claim, provided Euronext (a) promptly gives Customer written notice of the claim; (b) gives Customer sole control of defence and settlement over the claim (except that Customer may not settle any such claim unless it unconditionally releases Euronext of all liability); and (c) provides Customer all reasonable assistance, at Customer’s expense.

8.2 The obligations provided in clause 8.1 do not apply if such a claim against Euronext arises from Euronext’ breach of this Addendum or the Agreement.

CLAUSE 9 EXCLUSION OF LIABILITY

9.1 The Customer is responsible for importing the Customer Data into its own systems or into the systems of the destination provider and implementing the Customer Data within these systems, including where the Customer uses the services of a third party for these actions. Further, it is the Customer’s sole responsibility to ensure having all rights and permissions to initiate a Switching or Deletion Requests before exercising its rights under this Addendum.

9.2 Except in case of gross negligence or wilful misconduct, Euronext shall not be liable to Customer or a third party under or in relation to this Addendum for any damages, losses, costs, or expenses arising out of or in connection with the Switching and/or the Deletion Request. This exclusion of liability includes, but is not limited to, any issues related to the Customer Data’s integrity or loss, system downtime, compatibility issues, or any other disruptions or failures that may occur during or as a result of the Switching and/or Deletion Request.

CLAUSE 10 AMENDMENT

10.1 Euronext may amend this Addendum if required to comply with applicable law. In such a case, Euronext will notify the Customer within 30 calendar days before the amendment takes effect.

SCHEDULE 1 – CATEGORIES OF CUSTOMER DATA

In accordance with clause 7 of the Addendum, this Schedule sets out the categories of Customer Data that may be ported following a Switching Request.

SCHEDULE 2 – JURISDICTION AND MEASURES

The ICT infrastructure used to deliver and support IR.Manager, IntegrityLog and InsiderLog is hosted on Amazon Web Services, in AWS regions within the European Economic Area (EEA). Accordingly, such ICT infrastructure is subject to the laws and regulatory framework of the relevant EEA jurisdictions.

Euronext Corporate Solutions applies a comprehensive set of technical and organisational measures to ensure the confidentiality, integrity, and availability of Customer Data throughout its lifecycle. These measures form part of the ISO/IEC 27001-certified Information Security Management System (ISMS). Euronext Corporate Solution’s security framework includes the following controls:

• rigorous access control, based on the principle of least privilege;
• encryption of data in transit and at rest;
• network and infrastructure protection, including firewalls, intrusion detection, and continuous monitoring;
• redundancy and resilience measures to ensure high availability; and
• regular audits, penetration testing, and risk assessments in line with ISO/IEC 27001 and industry best practices.

Further, Euronext Corporate Solutions implemented contractual measures to protect Customer Data held in the EEA against unauthorized international governmental access or transfer, such as restrictions on access to Customer Data and notification obligations relating to governmental requests for access, where legally permitted.

[1] Article 2(38) Data Act.

[2] Regulation (EU) 2023/2854 of the European Parliament and of the Council of 13 December 2023 concerning harmonized rules on fair access to and use of data and amending Regulation (EU) 2017/2394 and Directive (EU) 2020/1828 (the “Data Act”).

[3] Article 25(2)(d) Data Act.

[4] Article 25(3) Data Act.

[5] Article 25(2)(b) Data Act.

[6] Article 25(2)(a) Data Act.

[7] Article 25(5) Data Act.

[8] Article 25(4) Data Act.

[9] Article 25(2)(a)(i) Data Act.

[10] Article 25(2)(a)(ii) Data Act.

[11] Article 25(2)(a)(iii) Data Act.

[12] Article 25(2)(a)(iv) Data Act.

[13] Article 27 Data Act.

[14] Article 25(2)(g) Data Act.

[15] Article 25(2)(h) Data Act.

[16] Article 25(2)(i) and Article 29 Data Act.

[17] Article 25(2)(c)(i) Data Act.

[18] Article 25(2)(c)(ii) Data Act.

[19] Article 29(4) Data Act.

[20] Article 25(2)(e)(f) Data Act.