MARKETING – R&M do share marketing communications with prospective clients and leads, only where they have opted-in to this form of communication or where we have a legitimate interest in the processing of this data.

OPTING OUT – R&M do not rely on consent as a legal basis for processing Personal Data other than in prospect or lead marketing. To ask us or our third parties who support us in this marketing to stop sending marketing messages at any time, please get in touch with us at marketing@reedmackay.com
or write to us at the following address:

Marketing Department
Nexus Place
25 Farringdon Street
London EC4A 4AF

Please note, this opt-out right will not apply to Personal Data provided to us as a result of a
product/Service purchase, interest, warranty registration, product/Service experience or other transactions.

CALL RECORDINGS – R&M may record your calls with us for the purpose of training and monitoring.

Callers will be made aware of this at the start of the call, and any call records will only be retained for 3 months, after which they will be permanently deleted.

COOKIES – Browser settings can refuse all or some (non-essential) browser cookies, or provide alerts when websites set or access cookies. If cookies are disabled or refused, please note that some parts of our websites or technology may become inaccessible or not fully functional. For more information about the cookies we use, please see our cookies policy.

4. DISCLOSURES OF PERSONAL DATA

We share Personal Data with the parties set out below only to the extent necessary, to support the purposes set out in the table in paragraph 3 above.

Sub-Processors are the third parties we contract with in order to support us in the provision of our Services to your organisation. This includes the third parties we use to power our tools such as our online travel and meeting booking tools. All third parties are engaged in line with GDPR Article 28 provisions to ensure your Personal Data is protected to the same level by our Sub-Processors as it is by ourselves, and that they only use Personal Data for specific, instructed purposes.
Please see the next section, International Transfers, to understand how we remain compliant when transferring your Personal Data internationally. For the avoidance of doubt this does not include
Travel Service Providers.

To see a list of our sub-processors, please submit a request to privacy@reedmackay.com.

Travel Service Providers are the third parties who provide the travel services directly to yourselves.

R&M engages with them on your behalf as our Client’s authorised agent in order to facilitate the provision of Services. Service Providers are categorised as the following:

• Parties that provide travel services and with whom R&M makes bookings on our Client’s behalf, including airlines, hotels, rail and other ground transport that our Clients choose to travel with;

• Parties that facilitate or process bookings (whether electronically or otherwise) made by R&M on
our Client’s behalf for travel services, including on-line booking tools or other external software and travel agents; or

• Parties that process applications to assist or enhance a person’s ability to receive the benefit of
the Services, including passport and visa agencies, currency convertors, travel information services and other similar agencies.

Travel Service Providers are independent Controllers of Personal Data and have direct obligations to yourselves regarding the processing and security of your Personal Data, and in giving effect to your
Individual Rights. R&M always acts in these circumstances as Processor on our Client’s behalf. We are
not responsible for the acts or omissions of such service providers.

THIRD-PARTY LINKS

Our website or use of our technology or Services may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share Personal Data. We do not control these third parties and are not responsible for how they process Personal Data.

5. INTERNATIONAL TRANSFERS

As a Processor for our Clients, and in the provision of a global service, we share Personal Data among the entities within R&M’s operational control (please see these entities listed below under Group Entities), with our local TMC Partners and with third party sub-processors. This will involve transferring Personal Data outside the UK and the European Economic Area (EEA).

We ensure the same degree of protection is afforded to all Personal Data by ensuring at least one of the following safeguards is implemented:

• We will only transfer Personal Data to countries that have been deemed to provide an adequate level of protection for Personal Data by the ICO or the European Commission.

•In the absence of an adequacy decision, we will implement the necessary transfer tools of Standard Contractual Clauses or the UK International Data Transfer Agreement (or
Addendum) with additional supplementary measures as needed with our sub-processors who store and process data in the US and other third countries using appropriate encryption tools, in compliance with the recent Schrems II decision.

6. DATA SECURITY

R&M operates as part of a global business and our Clients’ Personal Data will be processed by our international entities as set out in paragraphs 4 and 5 above. However, we store all Personal Data in the UK.

We have put in place appropriate security measures to prevent against the accidental, unauthorised
or unlawful access, loss, alteration, or disclosure of Personal Data. In addition, we only permit access to your Personal Data to those employees, agents, contractors and other third parties on a need-to-know basis. They will only process Personal Data on our instruction, and they are subject to a duty
of confidentiality.

We have put in place procedures to deal with any suspected Personal Data breach and will notify our
Clients and any applicable regulator of a breach where we are legally required to do so.

7. DATA RETENTION
HOW LONG WILL PERSONAL DATA BE PROCESSED? – We will only retain Personal Data for as long as is necessary to fulfil the purpose for which it was processed, including for the purposes of satisfying
any legal, accounting, or reporting requirements.

To determine the appropriate measures for retention for Personal Data, we consider the amount, nature, and sensitivity of the Personal Data, the potential risk of harm from unauthorised use or disclosure of Personal Data, and the purposes for which we process Personal Data.

Specifically, our Client Personal Data held in profiles and travel bookings/history is retained for the duration of the contract with the Client organisation unless otherwise instructed by that organisation.

Requests to remove profiles may come as part of the regular or one-off automatic profile maintenance feeds provided by some of our Clients, may be requested through the portal, or viatravel consultants who  have the ability to delete profiles.

Management Information (MI) data, which would include travel details (including traveller names but
not passport etc.), is retained for a period of 5 years (rolling) irrespective of the currency of our Client’s contract (i.e. this data will exist for 5 years beyond the last travel date).

Similarly, Transaction History, which would include travel details (including traveller names but not passport etc.), is retained for a minimum of 7 years to comply with legal obligations.

Call recordings are retained for 3 months.

Personal Data that is no longer required is deleted permanently from information systems and any hard copies are securely destroyed.

By law we are required to keep basic information about our customers (including Contact, Financial and Transactional Data) for 7 years after they cease being customers for tax purposes.

In some circumstances we may anonymise Personal Data (so that it can no longer be associated with an individual) for research or statistical purposes in which case we may use this information indefinitely without further notice.

8. LEGAL RIGHTS

You can submit an Individual Rights request for any of the following   to privacy@reedmackay.com

As a Processor of Personal Data on behalf of our Clients, R&M can only give effect to Individual Rights requests on the instruction of our Clients. We will need to verify your request with your organisation, and obtain their permission to give effect to these rights as a Processor:

• Request access to Personal Data (commonly known as a “data subject access request”).
This enables individuals to receive a copy of the Personal Data held about them and to
check that the data is being lawfully processed.

• Request correction of the Personal Data that we hold about an individual. This enables individuals to have any incomplete or inaccurate data we hold about them corrected, though we may need to verify the accuracy of the new data provided to us.

• Request erasure of Personal Data. This enables individuals to ask us to delete or remove
Personal Data where there is no valid reason for us continuing to process it. Note, however, that we may not always be able to comply with the request of erasure for specific legal reasons which will be notified to the requestor, if applicable, at the time of the request.

• Request the transfer of Personal Data. This will typically be requested at the corporate level should your organisation be changing your Service. Upon our Client’s request, we will provide the data in a structured, commonly used, machine-readable format. Note this right only applies to information held on electronic media which was initially provided to us in
order to perform a contract with your organisation.

Please note, Clients and individuals are able to update or delete certain Personal Data items included in their profile through an interface from our Client’s HR system, through direct access to their profile, or via a travel consultant/agent.

Where this is not possible or applicable, or an individual wishes to exercise any of the other rights set out above, please contact us at
privacy@reedmackay.com. In capacities where we process your Personal Data as Processor (as described in paragraph 3 above), on behalf of our Client, the Controller, we will notify the Controller of the request without undue delay and support them in responding to it.

In our capacity as a Controller of your Personal Data (as an employer, and for specific Client communications and Service improvements), we will be able to address your Individual Rights requests directly.

Additional to the rights listed above, you may also request the following:

• Object to processing Personal Data where we are relying on a legitimate interest (or that of a third party) and you feel the processing impacts on your fundamental rights and freedoms. In some cases, we may demonstrate that we have compelling legitimate grounds to process the information which override these rights and freedoms.

• Request restriction of processing Personal Data. This enables you to ask us to suspend the processing of Personal Data in the following scenarios: (a) to establish the data’s accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to
establish, exercise or defend legal claims; or (d) you have objected to our use of the data
but we need to verify whether we have overriding legitimate grounds to use it.

• Withdraw consent at any time where we are relying on consent to process Personal Data. However, this will not affect the lawfulness of any processing carried out before
withdrawal of consent. If consent is withdrawn, we may not be able to provide certain
services. We will advise if this is the case at the time consent is withdrawn.

NO FEE USUALLY REQUIRED – Individuals will not have to pay a fee to access their Personal Data (or
to exercise any of the other rights).

However, we may charge a reasonable fee if the request is
repetitive or excessive. Alternatively, we may refuse to comply with the request in these circumstances.

WHAT WE MAY NEED – We may need to request specific information from the individual, or the employer or travel sponsor to help us confirm the individual’s identity and ensure their right to access the Personal Data (or to exercise any of the other rights). This is a security measure to ensure that Personal Data is not disclosed to any person who has no right to receive it. We may also ask for further information in relation to the request to speed up our response.

TIME LIMIT TO RESPOND – We aim to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if the request is particularly complex or a number of requests have been made. In this case, we will notify requestors of this and keep them updated.

8. FURTHER INFORMATION

Please direct any questions about how we process personal information to our Data Protection Officer, who is contactable at privacy@reedmackay.com. We hope that we will be able to address any questions or concerns.

However, individuals also have the right to make a complaint at any time
to their local Supervisory Authority. Please see below the contact information for the Supervisory Authority in your region: