Euronext Corporate Solutions B.V
Privacy statement website

1. INTRODUCTION

This Privacy policy serves as the umbrella statement for the Euronext Corporate Solutions group of companies (“ECS,” “we,” “our” or “us”) and explains how we collect, use, share and protect your personal data when you visit or interact with our corporate websites, services and applications. Each ECS Group entity operates as its own independent data controller and maintains its own full privacy statement—see Section 1 below for links to each. All terms used in this Privacy policy have the same meaning as defined under the EU General Data Protection Regulation (GDPR), unless otherwise specified.

Scope
This umbrella policy applies to all personal data of visitors to:

https://www.corporatesolutions.euronext.com

(collectively, the “Website”).

Our corporate sites and applications provide information about—and, where relevant, gateways to—secure digital and advisory solutions for listed companies and market participants (e.g. board portals, investor relations tools, insider log tracking, webcasting), as well as professional training services delivered through the Euronext Academy.

Visit or browse our Website
Download whitepapers or other content
Submit a contact or inquiry form
Register for an event or webinar
Enrol in professional training services provided by the Euronext Academy, such as virtual classrooms or sustainability-focused programmes
Interact with us via chat or other online channels

Euronext Group consists of Euronext N.V, a Dutch holding company, located at Beursplein 5, 1012 JW, Amsterdam, the Netherlands, and its affiliated companies, acting as controllers. A list of all group companies and applicable privacy statements can be found in annex 4 to this Statement.

ECS is committed to maintaining the highest standards of data protection and transparency in accordance with the General Data Protection Regulation (GDPR), the UK GDPR, and all other applicable local data protection laws.

By using any ECS website, platform, or application, you acknowledge and consent to the data processing practices outlined in this Privacy Statement and the individual product policies referenced above.

For any inquiries regarding the processing of your personal data or to exercise your rights under applicable data protection laws, please refer to Section 2: Contact Us.

Table of content

1. INTRODUCTION
2. IMPORTANT INFORMATION AND WHO WE ARE
2.1 Purpose and scope
2.2 Controller /processor
2.3 Contact details
2.4 UK Representative
2.5 Changes to the privacy policy and your duty to inform us of changes
3. The data we collect about you
3.1 Personal data we collect
3.2 If you choose not to provide Personal Data
4. How is your personal data collected?
5. How we use your personal data
5.1 Cookies and tracking technologies
5.2 Training sessions and third-party platforms
5.3 Change of purpose
6. Disclosure of your personal data and international transfers
6.1 Group sharing
6.2 Disclosure to third parties
6.3 Safeguards and responsibilities
6.4 Links to third-party websites and external platforms
6.5 Social media
7. Data security and confidential information
8. Data retention
9. Your Rights
9.1 No fee usually required
10. Applicants
11. Updates to this Statement
12. Annexes
Annex 1 – Glossary of used terms
Annex 2 – Cookie inventory
Annex 3 – Cookie removal instructions
Annex 4 – List of Euronext Corporate Solutions Group Companies

2. IMPORTANT INFORMATION AND WHO WE ARE

2.1 Purpose and scope

ECS is committed to protecting your privacy and ensuring full transparency in how we collect, use, store and process personal data when you interact with our corporate websites. This umbrella Privacy Policy explains those practices and applies when you:

Visit or browse any of our corporate sites (see introduction);
Download whitepapers, brochures or other content;
Submit a contact, inquiry or support form;
Register for events, webinars or demonstrations;
Subscribe to newsletters, alerts or marketing communications;
Engage with our social‑media channels, digital advertisements or campaigns;
Provide data via third parties acting on our behalf;
When we process personal data as a processor on behalf of a client, under an agreement where ECS also acts as a controller for distinct activities related to service provision;
Apply for a job with an ECS company;

Follow a course through ECS Academy.

Note: This Policy does not cover personal data collected through any standalone product platforms (e.g. iBabs, ComplyLog , Company Webcast). Each of those services publishes a product‑specific privacy supplement—linked from its own site—that describes any additional data processing unique to that platform.

All ECS Group companies and their activities comply with the EU General Data Protection Regulation (GDPR), the UK GDPR, and applicable local laws.

2.2 Controller / Processor

Euronext Corporate Solutions (“ECS”) operates under a dual-role data governance model, acting either as a Data Controller or a Data Processor depending on the specific service and context in which personal data is collected and processed.

When ECS acts as Data Controller

In certain instances, ECS determines the purposes and means of processing personal data, and therefore acts as the Data Controller within the meaning of the EU General Data Protection Regulation (GDPR), the UK GDPR, and other applicable data protection laws. These scenarios include, but are not limited to:

Interactions through the corporate website, such as:
- Browsing or navigating site content;
- Requesting a demonstration or proposal;
- Downloading product brochures, reports, or white papers;
- Submitting inquiries through contact forms or subscription to ECS communications.
Engagement with ECS-operated solutions where ECS directly contracts with the end user or learner—for example, the Euronext Academy, where ECS determines course design, user registration, training delivery formats, certification issuance, and learner analytics. In such cases, ECS acts as the Data Controller for all personal data collected in relation to:

Course enrollment and user profiles;
Assessment results and completion records;
Attendance and performance tracking;
Communications between ECS instructors and participants.

Service agreements where ECS provides onboarding, account administration, or support services directly to clients in its own name (not as an agent of another controller).

Each ECS Group entity operating a service platform assumes full controller responsibilities for compliance, transparency, data security, and user rights management as applicable to its jurisdiction.

When ECS acts as Data Processor

In other circumstances—particularly where ECS platforms are used by subscribing corporate clients or institutional partners—ECS acts solely as a Data Processor. In this capacity, ECS processes personal data strictly under the documented instructions of the Data Controller, in accordance with:

A binding Data Processing Agreement (DPA);
Relevant security, confidentiality, and access controls;
The controller’s governance and retention requirements.

Examples include hosted platforms where a client manages user access, uploads proprietary data, or assigns training to its personnel via ECS infrastructure.

Intra-Company processing and data sharing

To provide seamless, high-quality services and to fulfil our contractual, operational, and legal obligations, personal data may be shared internally among ECS Group entities and other relevant Euronext Group affiliates. Such intra-company processing occurs under the following conditions:

Only on a need-to-know basis, for purposes such as technical support, client servicing, training delivery, compliance, billing, security monitoring, and audit;
Pursuant to an intra-group data transfer agreement incorporating appropriate safeguards (including Standard Contractual Clauses where required);
With full adherence to the data minimization, purpose limitation, and access control principles set forth by applicable privacy regulations.

Where such transfers involve cross-border processing (e.g., between the EU and the UK), ECS ensures that appropriate legal mechanisms are in place to maintain an equivalent level of data protection.

All ECS Group entities are subject to our central data protection policies and oversight by the Group Data Protection Officer (DPO), ensuring consistent standards and accountability across jurisdictions.

2.3 Contact details

If you have any questions about this Privacy Policy or how ECS processes your personal data, you can contact us using the details below:

Full legal entity name: Euronext Corporate Solutions B.V.
Company registration: Registered in The Netherlands under company number 68034970 (Dutch Chamber of Commerce)
Registered office address: Beursplein 5, 1012 JW, Amsterdam
Email address: dpo.ecs@euronext.com
Postal address: 14, place des Reflets – CS30064 - 92054 Paris la Défense Cedex.

2.4 UK Representative

For individuals in the UK, our appointed representative is:

Company name: Euronext Corporate Solutions limited
Company registration number: 05682866

Registered office address: 25 north colonnades, 11th floor, canary wharf, London, England, e14 5hs
Email address: dpo.ecs@euronext.com

2.5 Changes to the privacy policy and your duty to inform us of changes

This version was last updated on the date stated at the beginning of this privacy policy. We reserve the right to amend this privacy policy from time to time as required to ensure its accuracy.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

3. THE DATA WE COLLECT ABOUT YOU

3.1 Personal data we collect

As the Data Controller, ECS determines how and why we process personal data collected through our corporate websites, training programmes, and services. Personal data, or personal information, refers to any information relating to an identified or identifiable individual. This does not include data that has been irreversibly anonymised such that the individual can no longer be identified. For a complete definition, please refer to Annex 1 – Glossary of Terms.

ECS collects and processes personal data when you interact with our platforms in the following contexts:

Visiting ECS websites
Registering for a service or resource
Participating in training activities, including virtual classrooms, online learning, or in-person events hosted by Euronext Academy

When you engage with ECS in these contexts, we may collect and process the following categories of personal data, depending on the nature of your interaction.

Note: For our standalone platforms—such as iBabs, ComplyLog and Company Webcast—the categories of personal data processed are detailed in the respective privacy statements published on each product’s website. These standalone statements govern data processing activities specific to those services and supplement this umbrella policy.

Categories of data collected

1. Device and technical information

Information about your browser, device, operating system, and other technical identifiers (e.g., IP address, cookies). This data is collected through analytics tools, cookies, and log files to help us monitor site performance and enhance your experience.

Legal basis: Legitimate interest (performance and security of ECS web infrastructure)

2. Contact and professional Information

If you fill in a contact form, download content, request a demo, or subscribe to a newsletter or event, we may collect your name, email address, phone number, job title, and company name.

Legal basis: Consent (for marketing); contract performance or pre-contractual steps (for service requests); legitimate interest (general business communications)

3. Usage data

Information about how you navigate and interact with our website—such as pages visited, time spent, click behavior, and referring URLs—collected via cookies, pixels, and similar tracking technologies.

Legal basis: Consent (where required for analytics or non-essential cookies); legitimate interest (understanding website performance and user engagement)

4. Marketing preferences

If you consent to receive marketing communications, we may collect your communication preferences and track your interactions with our emails (e.g., open and click rates) to tailor future messages.

Legal basis: Consent (for electronic marketing); legitimate interest (improving communication relevance and effectiveness)

5. Training and course participation data (Euronext Academy)

If you register for or attend an Academy course, workshop, or virtual classroom, we may collect:

Name, contact details, job title, and company name;
Billing and payment information (where applicable);
Course selection, attendance records, and learning goals;
Interaction data from training platforms (e.g. chat input, poll responses, post-event feedback).

This data is collected via booking forms, registration systems, and participation tools such as Microsoft Teams or similar platforms.

Legal basis: Contract performance (for registered users); legitimate interest (quality control and learner support)

6. Contractual Relationship

In some cases, ECS collects and processes personal data in order to perform a contract with you or your organization, or to take steps at your request prior to entering into a contract. This includes:

Registering you for a training programme or ECS service;
Delivering course materials, certifications, or platform access;
Providing onboarding, technical support, or user credentials;
Communicating with you as a designated contact for billing, scheduling, or administrative purposes.

Legal basis: Contract performance; legitimate interest (client administration and support)

Data from third parties and public sources

We may also receive personal data from third-party and public sources, including:

Event registration or survey platforms used to engage with ECS services;
Professional enrichment tools or business directories (e.g., LinkedIn, public company records), where legally permitted;
Marketing and analytics platforms that provide campaign performance metrics or indicate interest in our services.

Legal basis: Legitimate interest (commercial outreach, marketing analytics); consent (where required for enriched profiles or third-party cookies)

Aggregated and anonymised data

We may use aggregated or anonymised data—such as website traffic metrics or content download trends—for analytical, statistical, and internal reporting purposes. This type of data does not identify individual users and is not considered personal data under applicable data protection laws.

If we combine anonymised or aggregated data with information that could identify you, we will treat the combined data as personal data and handle it in accordance with this Privacy Statement.

Legal basis: Legitimate interest (business intelligence and service optimisation)

3.2 If you choose not to provide Personal Data

In cases where we need to collect personal data by law or to fulfil a specific request (e.g. contacting you after a demo request), and you choose not to provide that information, we may be unable to respond to your request or provide certain features of the website. We will inform you at the time if this is the case.

4. HOW IS YOUR PERSONAL DATA COLLECTED?

We collect personal data through a variety of methods when you visit or interact with the ECS website:

1. Direct interactions

You may provide personal data directly by submitting a form on our website—for example, when you request a demo, download a resource, sign up for a newsletter, register for an event, or contact us via email or phone. This may include your name, email address, job title, company name and other contact or professional details.

2. Events and webinars

If you register for or attend an event, webinar or other corporate solutions-hosted activity via the website, we may collect registration information such as your name, contact details, organization and participation data. This may also include responses to polls, chat contributions or feedback provided.

3. Automated technologies and analytics

When you visit the website, we automatically collect certain technical data, such as your IP-address, browser type, device information, language settings and browsing behaviour (for example pages viewed, time on site and clicks). This data is collected through cookies, pixels and similar technologies. Identifiable cookies are only used if you give your consent via our cookie banner. Otherwise, analytics data is collected in an anonymised or aggregated form.

4. Training programmes and virtual events

When you register for a ECS Academy course or attend a virtual training session, we may collect personal data directly through registration forms, booking documents, or during the course itself. This includes attendance records, chat or Q&A participation, and feedback or evaluation forms. Participation platforms (e.g. Teams) may also collect technical and interaction data during the session, in line with their respective privacy policies.

5. Third-party sources

We may receive additional personal data about you from:

Marketing or event platforms you use to register for corporate solutions-related content
Third-party tools we use for lead generation or marketing insights (for example business contact databases);
Publicly available sources such as LinkedIn or company websites, used to enrich your contact or company profile;
Communication platforms or CRM systems (for example when you contact our support team or interact with email campaigns).

This helps us improve our marketing efforts, tailor communications, and respond to your requests more effectively.

In many of these cases, data is collected to fulfil a contractual obligation—either with you directly or with your organization. Where you register for a training programme, request access to a service, or enter into a commercial engagement with ECS, we will process your personal data for the performance of a contract or to take steps at the request of the data subject prior to entering into a contract. This legal basis also applies where we provide technical onboarding, grant service access, or deliver ECS Academy certifications.

5. HOW WE USE YOUR PERSONAL DATA

We only process your personal data where permitted under applicable data protection legislation, such as the EU General Data Protection Regulation (GDPR) and the UK GDPR. In the context of our website and related services, Euronext Corporate Solutions ECS acts as the Data Controller, as we determine the purposes and means of processing your personal data.

The sections below outline the legal bases on which we rely and the specific purposes for which we process your personal data when you interact with the Corporate Solutions website, training programmes, or related services:

Legal Basis	Purpose of Processing
Consent	Where required, we rely on your consent to process your data for specific purposes. You may withdraw your consent at any time. This includes: • Sending newsletters, product updates, and event invitations. • Setting non-essential cookies or trackers on your device. Sending follow-up course materials, satisfaction surveys, or marketing related to similar training opportunities (if opted in).
Contractual Necessity	We process personal data where it is necessary to enter into or perform a contract with you or your organization, or to take steps at your request prior to entering into a contract. This includes: • Registering you for training programs or ECS services • Managing service access, onboarding, and user credentials • Delivering course materials and certifications through Euronext Academy • Providing customer support and account management • Issuing invoices and processing payments for subscribed services
Legal Obligations	• In limited cases, we may process personal data where necessary to comply with legal or regulatory obligations, such as for safeguarding rights or responding to lawful requests from authorities.
Legitimate Interests	We process certain personal data on the basis of our legitimate interests in operating and improving our website, communicating with visitors, and promoting our services. We ensure this does not override your fundamental rights. This includes: • Improving our website and user experience. • Analysing visitor traffic and engagement using cookies and analytics tools. • Managing and responding to inquiries, demo requests, or resource downloads. • Conducting internal reporting and marketing performance analysis. • Identifying potential business leads through B2B marketing tools. • Enriching business contact data from public or third-party sources • Running targeted advertising campaigns (where legally allowed). • Managing your registration, attendance, and participation in training programmes, including issuing course materials and certificates. • Evaluating and improving the quality of training sessions, collecting feedback, and reporting on participation metric.
Profiling or Automated Decision-Making	Corporate Solutions does not engage in automated decision-making or profiling that produces legal or similarly significant effects on individuals. Any analytics or segmentation we conduct is used solely to enhance our marketing efforts and improve visitor experience.

5.1 Cookies and tracking technologies

The ECS website uses cookies and similar technologies to distinguish you from other users, enhance your browsing experience, and help us analyse traffic and improve our platforms. Cookies also allow us to personalise content, remember your preferences, and understand how visitors interact with our site and services. Cookies are small text files stored on your device when you visit a website. They may be set by ECS directly (first-party cookies) or by third-party services used on our site (third-party cookies). If you disable or refuse cookies, some parts of the website may become inaccessible or may not function properly. An overview of the cookies used can be found in Annex 2.

When you first visit the ECS website, you will be prompted with a cookie banner that allows you to manage your cookie preferences. You can choose to accept or reject non-essential cookies such as performance and targeting cookies. If you accept these cookies, you are giving your explicit consent for ECS to process your personal data as described in this privacy policy.

You have the right to change your cookie preferences at any time by accessing the "cookie settings" on our website. Please note that rejecting certain cookies may affect the functionality of some parts of the website and services.

Important: This section applies only to cookies set on the ECS corporate website. Cookies used on ECS product platform are governed by separate cookie policies applicable to those platforms. Users of those services should refer to the relevant in-platform notices for details on platform-specific cookies, trackers, and settings.

Legal Basis

Where required under applicable law, we use cookies on the basis of your consent, which is requested via a cookie banner when you first access our site. You may withdraw your consent or adjust your preferences at any time using your browser settings or the cookie management tool provided on our website.

For cookies that are strictly necessary for the operation of the site, the legal basis is ECS’s legitimate interest in providing a functional, secure digital environment.

Cookie duration and expiry

ECS undertakes to delete or anonymise all cookies that we control after a maximum duration of 12 months. After this period, your consent will be requested again.

Cookie categories and purposes

Cookie Type	Purpose	Description / Examples / Third Parties Involved
Strictly Necessary	Enable platform access and basic website functionality	Used for authentication, load balancing, session management, and remembering your cookie preferences. (e.g. HubSpot, ECS login services)
Functional	Remember user preferences and interface settings	Used to store language selection, interface layout, and form autofill. (e.g. HubSpot CMS, frontend UI tools)
Analytics	Understand user behaviour, traffic patterns, and optimise performance	Track page visits, bounce rates, conversions, and usage metrics. (e.g. Segment, Google Analytics, Leadfeeder)
Targeting	Deliver relevant content and advertising based on your interaction with our campaigns	Used to track advertising campaign performance and build retargeting audiences. (e.g. Google Ads, LinkedIn Ads, Microsoft Ads, Facebook Ads)

You can manage your cookie preferences through your browser settings. You may choose to refuse some or all cookies or set your browser to alert you when cookies are being used. Please note that disabling certain cookies may affect the availability or functionality of parts of the website. An explanation on how you can remove cookies can be found in Annex 3.

5.2 Training sessions and third-party platforms

Some training sessions may be recorded for quality assurance, internal reference, or to support participant learning. Where this applies, participants will be informed in advance and may opt out of being recorded where feasible.

Where third-party platforms are used to deliver training services—such as virtual classrooms (e.g. Microsoft Teams), certification providers, or survey tools—your personal data may be processed by those providers under their respective privacy policies. We take appropriate steps to ensure that any such third parties meet our data protection and security standards.

5.3 Change of purpose

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us at dpo.ecs@euronext.com

If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

6. DISCLOSURES OF YOUR PERSONAL DATA AND INTERNATIONAL TRANSFERS

Personal data processed by ECS may be stored on secure servers located within the European Economic Area (EEA). In certain cases, personal data may be transferred outside the EEA, the United Kingdom (UK), or Switzerland. When such transfers occur, Corporate Solutions ensures that appropriate safeguards are in place in accordance with applicable data protection laws. These safeguards may include:

Standard Contractual Clauses (SCCs) approved by the European Commission
The UK International Data Transfer Agreement (IDTA)
Adequacy decisions issued by the European Commission or relevant UK authority
Participation in recognised data transfer frameworks, such as:

The EU-U.S. Data Privacy Framework
The UK Extension to the EU-U.S. Data Privacy Framework
The Swiss-U.S. Data Privacy Framework

Euronext US Inc. and relevant subsidiaries are certified under these frameworks where applicable.

6.1 Group sharing

We may disclose your personal data to other entities within the Euronext N.V. group, of which ECS is a subsidiary, based on our legitimate interest to do so or for administrative, compliance, and operational purposes.

6.2 Disclosure to third parties

ECS may disclose personal data to trusted third parties only where necessary, proportionate, and lawful. Such disclosures are limited to the specific purposes for which the data was collected or for closely related operational, legal, or compliance purposes. Categories of recipients may include:

Type of Third Party	Purpose of Disclosure	Legal Basis
Regulatory authorities, courts, or law enforcement	Compliance with legal obligations, enforcement of rights, response to lawful requests or investigations	Legal obligation (Art. 6(1)(c) GDPR)
Third-party service providers (e.g., cloud hosting, analytics, IT support, CRM tools)	Provision of technical infrastructure, platform operations, analytics, communications, and customer service on ECS’s behalf	Contract performance (Art. 6(1)(b))Legitimate interest (Art. 6(1)(f)) – e.g. platform maintenance, security
Event partners or academic institutions	Co-hosting training programmes, webinars, or conferences; issuing certifications or facilitating participant management	Contract performance (if user is participant)Legitimate interest – collaborative delivery
External professional advisers (e.g. legal, tax, audit, compliance)	Support for regulatory compliance, legal claims, audits, or risk management	Legal obligationLegitimate interest – professional advice, legal defence
Potential or actual acquirers, investors, or business partners	Evaluation and execution of mergers, acquisitions, or other business transactions	Legitimate interest – business continuity and strategic planning

In all such cases, ECS ensures that appropriate safeguards are in place, including data processing agreements or non-disclosure obligations, and that the recipient processes personal data only for legitimate and authorised purposes. We require all third parties to respect the security and confidentiality of your personal data and to process it in accordance with applicable data protection laws. Third-party service providers are not permitted to use your personal data for their own purposes and may only process it on our instructions and for the specified purposes set out in our agreements with them.

6.3 Safeguards and responsibilities

We require all third parties to respect the security and confidentiality of your personal data and to process it in accordance with applicable data protection laws. Third-party service providers are not permitted to use your personal data for their own purposes and may only process it on our instructions and for the specified purposes set out in our agreements with them.

6.4 Links to third-party websites and external platforms

The ECS website may contain links to external websites or services. This privacy policy does not apply to those third parties, and ECS is not responsible for their data processing practices. We encourage you to review their privacy policies.

Additionally, ECS may use external tools and platforms operated by third parties—for example, to collect customer feedback, reviews, or provide comparison services. When you interact with these tools (such as leaving a review), the processing of your personal data is governed by the privacy policy of the respective third-party provider. ECS is not responsible for how those parties handle your data, and we recommend that you consult their privacy statements before submitting any personal information.

6.5 Social media

If you share content from the ECS website via social media, your personal data may become visible to others based on your privacy settings on those platforms. ECS is not responsible for the processing of your data by such platforms.

7. DATA SECURITY AND CONFIDENTIAL INFORMATION

ECS is committed to protecting your personal data and has implemented appropriate technical and organisational measures to safeguard it against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access.

To protect personal data, ECS applies robust security controls, including:

Secure infrastructure and firewall protection to prevent unauthorised access.
Encryption of personal data where appropriate, including during data transmission.
Role-based access controls limiting access to authorised personnel with a legitimate business need.
Regular audits, security assessments, and continuous monitoring of systems.
Maintenance of certifications and alignment with applicable industry standards (e.g. ISO/IEC 27001, where applicable).

In addition, we have procedures in place to deal with any suspected personal data breaches. Where legally required, we will notify affected individuals and relevant data protection authorities without undue delay.

Please note that while ECS takes reasonable steps to secure your data, the transmission of data over the internet is never completely secure. For example, email and other external communications are not encrypted. We strongly advise you not to send sensitive personal information (such as bank or credit card details) via email. By choosing to use email or other unencrypted methods, you acknowledge the potential risk of interception by third parties and accept that ECS is not responsible for any resulting loss or damage.

8. DATA RETENTION

ECS will only retain your personal data for as long as necessary to fulfil the purposes for which it was collected, including to respond to your inquiries, manage communications, improve our website, or comply with legal and regulatory obligations.

When determining how long to retain your data, we consider:

The nature, sensitivity, and volume of the personal data;
The potential risk of harm from unauthorised access or disclosure;
The specific purpose for which we collected the data and whether that purpose can still be achieved;
Legal, regulatory, or contractual retention obligations that may apply.

If you have an active business relationship with ECS, retention periods may be extended as needed to meet contractual or legal obligations.

You may request the deletion of your personal data at any time, subject to our legal obligations. For more information, please see section 9 on your rights.

9. YOUR RIGHTS

As a data subject, you have certain rights under applicable data protection laws in relation to the personal data we process about you. These rights are not absolute and may be subject to limitations or exemptions under relevant law.

The table below outlines your key rights:

Right	What it means
Right to be informed	You have the right to be informed about how we collect, use, and store your personal data, including your rights in relation to that data.
Right of access	You may request confirmation of whether we process your personal data and obtain a copy of the data we hold about you.
Right to rectification	You can ask us to correct any inaccurate or incomplete personal data we hold about you.
Right to erasure	In certain circumstances, you may request the deletion of your personal data. You may also have the right to provide post-mortem instructions regarding the handling of your personal data after your death, where this is provided under applicable law (e.g. French data protection law). ECS will comply with such instructions where legally required.
Right to restrict processing	You may request that we restrict the use of your personal data in specific cases, such as when you contest its accuracy or object to our use of it. During restriction, we may store your data but not process it further.
Right to object	Where we process your personal data based on legitimate interests, you have the right to object. We will stop the processing unless we demonstrate compelling legitimate grounds to continue.
Right to data portability	Where processing is based on your consent or a contract with you, you may request to receive your personal data in a structured, commonly used, machine-readable format or to have it transferred to another controller, where technically feasible.

You may exercise your rights by contacting us through one of the following methods:

Contacting the ECS Data Protection Officer: dpo.ecs@euronext.com
By post:
Attn. Data Protection Officer
14, place des Reflets – CS30064
92054 Paris la Défense.

We may request proof of identity to verify your request in line with our internal procedures.

Post-mortem rights

To submit post-mortem instructions under French law, you may contact dpo.ecs@euronext.com and submit your request.

Supervisory Authorities

You also have the right to lodge a complaint with the competent data protection authority in the country where you live, work, or where you believe your rights have been infringed. We encourage you to contact us first to give us the opportunity to address your concerns.

Data protection authorities relevant to ECS operations:

Country

Legal Entity

Supervisory Authority

Authority website

Netherlands

Euronext Corporate Solutions B.V.

Autoriteit Persoonsgegevens

autoriteitpersoonsgegevens.nl

France

Euronext Corporate Solutions France S.A.S.

Commission nationale de l'informatique et des libertés (CNIL)

cnil.fr

Germany

Euronext Corporate Solutions Germany GmbH

Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI)

bfdi.bund.de

Italy

Euronext Corporate Solutions Italy S.r.l.

Garante per la protezione dei dati personali

garanteprivacy.it

Sweden

Euronext Corporate Solutions Sweden AB

Integritetsskyddsmyndigheten (IMY)

imy.se

United Kingdom

Euronext Corporate Solutions UK Limited

Information Commissioner's Office (ICO)

ico.org.uk

9.1 No fee usually required

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive.

10. Applicants

This section only applies to personal data which you may provide directly to us or via third parties, in the following cases:

This notice covers:

Applications for roles at any ECS company;
Participation in ECS recruitment campaigns, talent programmes, or referral initiatives;
Submissions received via job boards, recruitment agencies, or unsolicited CVs;
Profiles identified through professional platforms such as LinkedIn;
Data provided to us by third parties, such as referees or recruiters.

This section applies to all recruitment activity conducted by ECS up to the point where:

The recruitment process ends and you are not offered a role, or
You accept a position and begin employment, in which case your personal data will be handled under our internal Staff Privacy Notice.

We are committed to processing your personal data lawfully, fairly, and transparently, and in accordance with applicable data protection legislation such as the GDPR, the UK GDPR, and relevant national law.

This section only applies to personal data which you may provide directly to us or via third parties, in the following cases:

You participate in an ECS recruitment initiative
You voluntarily submit your resume to a representative of Euronext on an ad hoc basis
You apply for an advertised job
A recruiter provides your resume or details to ECS
ECS finds your CV or details in online searches (e.g. LinkedIn)
You are referred to an open position by an employee as part of the Euronext Referral Program.

The personal data we process

As part of the recruitment and job application process, we collect the personal data that you, your agency, or your referrer submit to us, which may include:

Personal details	This may include general personal data such as your name, gender, residential address, email address, contact telephone numbers, nationality, marital status, etc.
Details about your previous employment	Such as the former company names, length of service, business titles and details on your previous roles.
Qualifications	Such as your skills, education, the languages you speak (including your level of proficiency), your eligibility to work in a particular country (e.g. minimum legal age to work, citizenship or visa details), your experience in the job you apply for and other industries, etc.
Preferences	Such as positions you may be interested in, information about when you may be available to interview and/or start date for ECS or work on ongoing basis (e.g. full or part time or on weekends), whether you are open to relocation or working remotely, whether you are willing to travel for work and whether you have your own transport.
Publicly available information	Details about you which we gather from publicly available sources over the internet and your social media accounts where such searches are relevant to the job you have applied for within ECS.
Medical results	Where legally applicable (Portugal and United Kingdom), results on aptitude and/or pre-employment medical tests which we may ask you to undergo after accepting our offer of employment.
Other information	Details you may provide us in response to our queries or questions at interview stage (including information about you which we generate throughout the interview and/or recruitment process), at reference check stage, to complete psychometrics tests (where applicable) or details required where mandatory in the respect of local requirements laws (e.g. Fitness & Probity eligibility in Ireland)

If you apply for a position through the “Apply with LinkedIn” option, we may use information previously provided to LinkedIn to populate your application. You are free to remove details; the main mandatory information we need is your resume.

It is necessary for us to process your personal data to assess your job application and/or include you in a recruitment initiative. If you do not wish to provide us with your personal data for the purposes outlined in this Statement, we will not be able to assess your job application and/or include you in a recruitment initiative or offer you a contract of employment.

Please note that should you include information relevant to your job application or recruitment initiative, such as cover letters, references, and other documents, we will hold and process any such personal data in accordance with this Statement.

How and why we process your personal data

The following table details the key context for which (“Legal Basis”) and why (“Purposes”) we collect, obtain and process your Personal Data within ECS. The third parties and those within Euronext with whom we may share your Personal Data (“Recipients”) are detailed in section 6 of this Statement.

LEGAL BASIS	PURPOSE
LEGITIMATE INTERESTS It is necessary to process your Personal Data where it is necessary for the purpose of initiate and facilitating the recruitment process.	We obtain, collect and process your personal data: • to process your job application, including to contact you in relation to interviews and/or offer you a job after the interview stage. • to assess your personal data against vacancies which we think may be suitable for you. • to request information from third parties such as qualifications and references. • to carry out background checks which aim to verify details you have provided to us, potentially using third party sources in UK & US. You will be notified in advance of the use of third parties for the background check. • to retain your information in order to contact you in relation to future vacancies within Euronext Group that may be of interest to you. • to collect feedback on and evaluate the recruitment process. • to promote internal and external recruitment events such as job fairs, campus events…. • where legally applicable (Portugal and United Kingdom), to assess if you are fit to work or not fit to work (e.g. where you suffer from a health condition which may affect your work capacity).
COMPLIANCE WITH A LEGAL OBLIGATION It is necessary to process your Personal Data in order to comply with legal obligations imposed on us as an employer under applicable Irish and European Union law.	We obtain, collect and process your personal data in order to comply with legal obligations, which may include: • to comply with European Union employment, equality and health & safety law. • to comply with European Union Tax Law. • to comply with other applicable European Union laws. • to comply with the Fitness and Probity requirements (applicable only in Ireland).

IMPORTANT: When we process your personal data based on our legitimate interests, we make sure to consider and balance any potential impact on you and your data protection rights. We will not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted by law).

We will only use your personal data for the purposes for which we collect it (as outlined in this section), unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will notify you in accordance this statement and we will explain the legal basis which allows us to do so.

Disclosure of your personal data

We may disclose some or all of your personal data to the following parties:

Internal business units such as Human Resources, IT, Finance/Payroll, Managers, system administrators, our trusted third-party service providers and our IT service providers.
Your previous employers when you have provided them as a reference third parties that may be contacted to provide additional information related to your previous work experiences.
Recruitment agencies.
Regulatory authorities.
Outsourced service providers who assist ECS with recruitment initiatives and campaigns such as recruitment agencies, technical test assessment, background check and health assessment companies (where applicable); etc.
Professional advisors such as legal advisors, consultants and accountants.

Retention of your personal data

Where you are a successful job applicant, the personal data generated by us and provided by you over the course of the job application/recruitment process will be retained by us for the purpose of your contract of employment. Such personal data will be retained in accordance with our Staff Data Protection Policy and Retention Policy (which will be available to you when you commence employment).

Where you are an unsuccessful job applicant, we will retain your personal data for a period of up to 12 months after it is determined that your application has been unsuccessful for the purposes of both contacting you in relation to future vacancies within ECS which we think may be of interest to you and, for the purpose of defending any potential employment equality claims.

Please note that in certain circumstances, we may hold your data for a longer period, for example, if we are processing an ongoing claim or believe in good faith that the law or a relevant regulator may reasonably in our view expect or require us to preserve your personal data.

11. Updates to this Statement

This Privacy Statement may be updated from time to time. The latest version will always be available on our website. We encourage you to review it periodically.

12. Annexes

Annex 1 – Glossary of used terms

Term	Definition
Anonymised data	Data that has been processed in such a way that it can no longer be used to identify an individual, either directly or indirectly. Anonymised data is no longer considered personal data under data protection laws and is not subject to GDPR requirements.
Compliance with a legal obligation	Processing is necessary to comply with a legal or regulatory obligation to which ECS or a corporate subscriber is subject.
Consent	Your freely given, specific, informed, and unambiguous indication (e.g. via opt-in or checkbox) that you agree to the processing of your personal data for a specific purpose, such as receiving marketing communications. You have the right to withdraw your consent at any time.
Controller	A natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. Where the purposes and means are determined by Union or Member State law, the controller or the criteria for its nomination may be provided by such law.
Cookie	A small text file stored on a user's device by a website or application, often containing an online identifier or other browsing data used for functionality, analytics, or tracking purposes.
Data Protection Authority (DPA)	An independent public authority that is responsible for monitoring the application of data protection laws, handling complaints, and enforcing compliance.
Data subject	An identified or identifiable natural person to whom personal data relates.
Euronext Academy	The training and professional development division of ECS, offering virtual and in-person learning programmes on regulatory, governance, sustainability, investor relations, and other capital markets-related topics. Participation in Euronext Academy events (such as webinars, workshops, or courses including but not limited to CSRD Implementation Unlocked) may involve the collection and processing of personal data such as registration details, contact information, job role, company affiliation, participation records, interaction logs (e.g. polls, chats, feedback), and certification data. These activities are covered under this Privacy Statement.
Lawful basis	The legal grounds under data protection laws that allow the processing of personal data. These include legitimate interest, performance of a contract, compliance with a legal obligation, and consent.
Legitimate interest	Processing is necessary for the purposes of the legitimate interests pursued by ECS or a third party, provided those interests are not overridden by your rights and interests. This includes, for example, internal administrative purposes or ensuring platform security. We always balance our interests with your rights before relying on this basis.
Performance of a contract	Processing is necessary for the performance of a contract to which you are a party, or to take steps at your request before entering into such a contract. This also applies where we process data on behalf of your employer or a corporate subscriber under a service contract.
Personal data	Any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, online identifier, or to one or more factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity.
Processing	Any operation or set of operations performed on personal data, whether or not by automated means. This includes collection, recording, organisation, structuring, storage, alteration, retrieval, consultation, use, disclosure by transmission, dissemination, alignment, restriction, erasure, or destruction.
Processor	A natural or legal person, public authority, agency, or other body which processes personal data on behalf of the Controller.
Pseudonymised data	Personal data that has been processed so that it can no longer be attributed to a specific individual without additional information (e.g. a key). Pseudonymised data is still considered personal data under the GDPR and must be protected accordingly.
Recording (audio/video)	Audio or video content captured during a training session or event for purposes such as quality assurance, internal review, or participant reference. Recordings may include images, voices, or other identifiable data, and participants will be informed in advance where such processing takes place.
Third country	A country outside the European Economic Area (EEA). Transfers of personal data to third countries are subject to specific safeguards under the GDPR, such as Standard Contractual Clauses, adequacy decisions, or other mechanisms to ensure an adequate level of protection.
Third-party platform	External service providers used to support training, communication, certification, or analytics (e.g. Microsoft Teams, survey tools). These platforms may process personal data according to their own privacy policies. ECS ensures that such third parties meet required data protection standards.

Annex 2 – Cookie inventory

The following cookies are used on the ECS website and may be set either by ECS or third-party platforms integrated with our services.

Cookie Name	Domain	Path	Type	Category
__cf_bm	.www.corporatesolutions.euronext.com	/	First-party	Necessary
_cfuvid	.www.corporatesolutions.euronext.com	/	First-party	Necessary
__cf_bm	.hubspotusercontent-na1.net	/	Third-party	Necessary
__cf_bm	.hubspotusercontent-eu1.net	/	Third-party	Necessary
__cf_bm	.hs-banner.com	/	Third-party	Necessary
__cf_bm	.hsadspixel.net	/	Third-party	Necessary
__cf_bm	.hs-analytics.net	/	Third-party	Necessary
__cf_bm	.usemessages.com	/	Third-party	Necessary
__cf_bm	.hubspot.com	/	Third-party	Necessary
_cfuvid	.hubspot.com	/	Third-party	Necessary
__cf_bm	.hsforms.com	/	Third-party	Necessary
_cfuvid	.hsforms.com	/	Third-party	Necessary
__cf_bm	.hsforms.net	/	Third-party	Necessary
_ga	.euronext.com	/	First-party	Analytics
_gid	.euronext.com	/	First-party	Analytics
bcookie	linkedin.com	/	Third-party	Advertising
li_gc	linkedin.com	/	Third-party	Advertising
lidc	linkedin.com	/	Third-party	Advertising
CLID	www.clarity.ms	/	Third-party	Analytics
MUID	.bing.com	/	Third-party	Advertising
MR	.c.bing.com	/	Third-party	Advertising
SRM_B	.c.bing.com	/	Third-party	Advertising
SM	.c.clarity.ms	/	Third-party	Necessary
MUID	.clarity.ms	/	Third-party	Advertising
MR	.c.clarity.ms	/	Third-party	Advertising
ANONCHK	.c.clarity.ms	/	Third-party	Necessary
ajs_anonymous_id	.euronext.com	/	First-party	Analytics
_gat	.euronext.com	/	First-party	Analytics
hs_cookie_cat_pref	.euronext.com	/	First-party	Necessary
ajs_user_id	.euronext.com	/	First-party	Analytics
hubspotutk	.euronext.com	/	First-party	Analytics
__hssc	.euronext.com	/	First-party	Analytics
__hssrc	.euronext.com	/	First-party	Analytics
__hstc	.euronext.com	/	First-party	Analytics

Note: Cookie deployment may vary depending on user location, device type, and the user’s consent preferences. Users can manage their cookie settings at any time via the cookie banner or browser settings.

Annex 3 – Cookie removal instructions

As part of our commitment to privacy and compliance with the GDPR, here is how to remove cookies from your browser:

Google Chrome:

Open Chrome and click the three-dot menu in the top-right corner.
Select “Settings”.
Under “Privacy and security,” click “Clear browsing data.”
Select the time range to remove cookies.
Check “Cookies and other site data.”
Click “Clear data.”

Mozilla Firefox:

Open Firefox and click the menu button (three horizontal lines) in the top-right corner.
Select “Settings”.
In the sidebar, click “Privacy & Security.”
Under “Cookies and Site Data,” click “Clear Data.”
Check “Cookies and Site Data.”
Click “Clear.”

Safari:

Open Safari and click “Safari” in the top menu.
Select “Settings”.
In Preferences, click “Privacy”.
Click “Manage Website Data.”
Select the websites and click “Remove,” then “Done.”

Please note that the above instructions may vary slightly depending on the browser version you are using. If you are using a different browser, we recommend referring to the browser’s documentation or support website for specific instructions.

Annex 4 – List of Euronext Corporate Solutions Group Companies

This privacy statement shall be applicable to the following Euronext Corporate Solutions Group companies:

Euronext Corporate Solutions BV, with the corporate registration number 68034970 located at Beursplein 5, 1012 JW, Amsterdam, the Netherlands ;
Euronext Corporate Solutions France S.A.S., with the corporate registration number 444 325 286 R.C.S. Courbevoie located at 14 place des Reflets, CS30064, 92054 Paris la Défense Cedex, France ;
Euronext Corporate Solutions Germany GmbH, with the corporate registration number District Court of Frankfurt HRB 129135 located at Bockenheimer Landstraße 23, Frankfurt am Main, Germany ;
Euronext Corporate Solutions Italy S.r.l., with the corporate registration number MI-2621729 located at Piazza degli Affari 6, 20123 Milano, Italy ;
Euronext Corporate Solutions UK Limited, with the corporate registration number 5682866 located at 11th Floor CARGO Building, 25 North Colonnade, London E14 5HS, United Kingdom ;

This Privacy Statement shall not apply to the personal data collected and processed by the following companies. For more information, please read their privacy policies. The privacy policies of those companies are available to:

ComplyLog	complylog.com/privacy-policy/
iBabs	Privacy Statement - iBabs
Company Webcast	Companywebcast \| Privacy statement PDF
IR.Manager	IR.Manager Factsheet

Country	Legal Entity	Supervisory Authority	Authority website
Netherlands	Euronext Corporate Solutions B.V.	Autoriteit Persoonsgegevens	autoriteitpersoonsgegevens.nl
France	Euronext Corporate Solutions France S.A.S.	Commission nationale de l'informatique et des libertés (CNIL)	cnil.fr
Germany	Euronext Corporate Solutions Germany GmbH	Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI)	bfdi.bund.de
Italy	Euronext Corporate Solutions Italy S.r.l.	Garante per la protezione dei dati personali	garanteprivacy.it
Sweden	Euronext Corporate Solutions Sweden AB	Integritetsskyddsmyndigheten (IMY)	imy.se
United Kingdom	Euronext Corporate Solutions UK Limited	Information Commissioner's Office (ICO)	ico.org.uk

Euronext Corporate Solutions B.VPrivacy statement website