Karla Otto is made up of different legal entities which trade as “Karla Otto”, all of which are subsidiary undertakings of The Independents Holding Limited in the UK – CRN: 10186775 (together, “Karla Otto Group”).

This Privacy Notice is issued on behalf of Karla Otto Group, so when we mention “Karla Otto”, “Company”, “we”, “us” or “our” in this Privacy Notice, we are referring to the relevant company in Karla Otto Group responsible for processing your data.Karla Otto is part of the group of agencies comprising The Independents Group (together, “The Independents Group”).

Karla Otto respects your privacy and is committed to protecting your personal data. This Privacy Notice will inform you as to how we look after your personal data when you visit our website or interact with us in the course of doing business (including as a client, supplier, business partner, or prospective contact) and tells you about your privacy rights and how the law protects you.

This Privacy Notice applies to:

• Visitors to our website;
• Clients, prospective clients, suppliers, prospective suppliers, business partners and their representatives;
• Any person who communicates with us by phone, email, post, in person, through events or other business interactions; and
• Anyone whose information we process during our day-to-day operations, including for relationship management and marketing.

This Privacy Notice should be read together with any other notices or policies we may provide on specific occasions.

If you have questions about this Privacy Notice, please contact our Group Data Protection Officer and Group General Counsel at DPO@the-independents.com.

If you are in the EEA, UK or Switzerland, you have the right to contact your local data protection supervisory authority, but we would appreciate the chance to address your concerns first.

We keep our Privacy Notice under regular review. Please keep us informed if your personal data changes during your relationship with us.

Our website may include links to third-party websites, plug-ins and applications. Clicking on those links may allow third parties to collect or share data about you. We do not control these third-party sites and are not responsible for their privacy notices. We encourage you to check the privacy policy and notices of every website you visit.

We may collect, use, store, and transfer different kinds of personal data about you, including:

• Identity and Contact Data: Name, employer, job title, business address, email, phone number;
• Business Communications: Information provided in emails, phone calls, business meetings, events or other professional interactions, including correspondence records and notes;
• Profile Data: (if relevant) Preferences, event attendance, interests, feedback, marketing preferences;
• Technical Data: IP address, browser type, operating system, device identifiers, website usage statistics (through cookies/analytics). See our Cookies Policy available on our website for more information;
• Due Diligence Data: For compliance (eg, anti-bribery, sanctions, onboarding or KYC as part of supplier/client screening), only as necessary; and/or
• Other Information: Any personal data you or your organisation provide to us in the course of business.

We do not knowingly collect special category data (such as health, ethnicity etc) or data relating to children, except where you explicitly provide it and consent to its processing.

We do not typically require you to provide personal information to browse our website. In this respect, we only collect personal information that you choose to provide to us, for example if you subscribe for any available updates, newsletters or industry reports from Karla Otto or any other members of The Independents Group, or otherwise interact with us for business reasons.

We also collect non-personally identifiable and aggregated analytics data for internal reporting and improvement.

We may collect data directly from you:

• When you use our website;
• When you contact us through socials or by phone, email or post;
• When you or your employer provide your information to us as a business contact;
• When we exchange business cards, correspond at meetings/events, or engage through professional networks; and/or
• From publicly available sources, such as professional directories, LinkedIn, or your organisation’s website.

We only use your personal data when the law allows us to and for the following purposes:

• To manage our business relationship or communicate with you as a client, supplier, business partner or prospective contact;
• To fulfil requests, respond to inquiries and provide or receive products and services;
• To administer contracts, projects and accounts, including procurement and supply chain management;
• To carry out identity, eligibility, or compliance checks where appropriate;
• To send relevant updates, business communications, service information or market our services (see “Marketing” below);
• For internal record keeping, analytics and to improve our operations and services; and
• To comply with our legal and regulatory obligations.

We usually process your personal data on one or more of the following legal bases under data protection law:

• Performance of a contract;
• Compliance with a legal obligation;
• Our legitimate interests (in managing our business relationships, developing business, direct B2B marketing and running our operations); and/or
• With your consent (where we specifically request it, for example, for certain marketing activities).

Managing our business relationships with you or your organisation (eg, communications, project administration, procurement, business opportunities, meetings, correspondence)

Types of Data:
Identity, Contact, Business Communications, Profile

Lawful Basis:
Performance of contract; Legitimate interests

Fulfilling a contract, providing or receiving goods/services

Types of Data:
Identity, Contact

Lawful Basis:
Performance of contract; Legitimate interests

Responding to inquiries, support requests, or complaints

Types of Data:
Identity, Contact, Business Communications

Lawful Basis:
Performance of contract; Legitimate interests

Managing accounts, invoicing, payments

Types of Data:
Identity, Contact, Financial

Lawful Basis:
Performance of contract; Legal obligation

Compliance (eg, anti-bribery, sanctions checks, KYC/CDD, regulatory recordkeeping)

Types of Data:
Identity, Due Diligence

Lawful Basis:
Legal obligation; Legitimate interests

Marketing and business development communications to existing or potential clients/suppliers

Types of Data:
Identity, Contact, Profile, Marketing Preferences

Lawful Basis:
Legitimate interests (B2B marketing); Consent (if required)

Website analytics, security, system development

Types of Data:
Technical

Lawful Basis:
Legitimate interests

We may use your Identity and Contact Data, Business Communications and Profile Data to send you information or offers about our services or relevant events. You will receive marketing communications if you have requested information, are an existing or former client/supplier, or have otherwise engaged with us for business, unless you opt-out.

You can withdraw your consent or object to marketing at any time by using any unsubscribe links in marketing emails or by contacting us (see "Contact Details" above).

We may share your personal data with:

• Other companies in Karla Otto Group and/or The Independents Group for the purposes described above;
• External third parties (such as IT providers, business support services, professional advisers, regulatory authorities or those who provide services to us);
• Third parties as part of a business transfer, merger, reorganisation or asset sale; and/or
• Only as otherwise permitted or required by law.

We require all third parties to respect the security of your personal data and to process it lawfully, fairly and in accordance with our instructions.

We may transfer your personal data outside of the UK/EEA in limited circumstances (for example, within our group or to trusted third-party service providers). Where we do, we ensure adequate protection is in place, such as:

• Transfers to countries with adequacy decisions;
• Using approved contracts (SCCs) or UK-approved mechanisms;
• Other safeguards as required by law; and/or
• Contact us for more details about how we safeguard transfers.

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used, accessed, altered or disclosed in an unauthorised way. We also limit access to your personal data to those employees, agents, contractors and authorised third parties who have a business need to know.

We retain your personal data only as long as necessary for the purposes for which it was collected, including for legal, regulatory, tax, accounting or reporting requirements, or to resolve disputes. Details of retention periods are set out in our Data Retention Policy, available on request.

In some circumstances you can ask us to delete your data (see "Your Legal Rights," below).

Under certain circumstances, you have rights under data protection law in relation to your personal data, including:

• Request access;
• Request correction;
• Request erasure;
• Object to processing;
• Request restriction of processing;
• Request the transfer of your data; and
• Withdraw consent at any time (for processing based on consent).

To exercise any of these rights, please contact us at DPO@the-independents.com.

You will not have to pay a fee to access your personal data (or to exercise any other rights), but we may charge a reasonable fee if your request is unfounded, repetitive or excessive.

Legitimate Interest means the interest of our business in conducting and managing our business to enable us to give you the best service/product and the best and most secure experience. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law). You can obtain further information about how we assess our legitimate interests against any potential impact on you in respect of specific activities by contacting us.

Performance of Contract means processing your data where it is necessary for the performance of a contract to which you are a party or to take steps at your request before entering into such a contract.

Comply with a legal obligation means processing your personal data where it is necessary for compliance with a legal obligation that we are subject to.

Personal Data types which we may collect, use, store and transfer:

• Identity Data includes first name, maiden name, last name, username or similar identifier, employer/company and job title marital status, title, date of birth and gender.
• Contact Data includes email address and telephone numbers.
• Technical Data includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access this website.
• Profile Data includes, where applicable, your username and password, your interests, preferences, feedback and survey responses.
• Usage Data includes information about how you use our website.
• Marketing and Communications Data includes your preferences in receiving marketing from us and our third parties and your communication preferences.

Other companies in Karla Otto Group and The Independents Group (acting as joint controllers or processors) and who are based within and outside the EEA and provide IT and system administration services, undertake leadership reporting and/or have access to group-wide databases.

Service providers (acting as processors) based within and outside the EEA who provide various IT and system administration services.

Professional advisers (acting as processors or joint controllers) including lawyers, bankers, auditors and insurers based within and outside the EEA who provide consultancy, banking, legal, insurance and accounting services.

Tax authorities, regulators and other authorities (acting as processors or joint controllers) based within and outside the EEA who require reporting of processing activities in certain circumstances.

You have the right to:

Request access to your personal data (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.

Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.

Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.

Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.

Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios:

• If you want us to establish the data’s accuracy.
• Where our use of the data is unlawful but you do not want us to erase it.
• Where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims.
• You have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.

Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.

Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.