Privacy Statement

1.

WHO ARE WE?

2.

TO WHOM DOES THIS PRIVACY STATEMENT APPLY?

This Privacy Statement (the “Statement”) sets out how the TISE Entities, as joint data controllers, collect, process and retain personal data. 'Personal data' means any information relating to an identified or identifiable natural person.
The Statement does not form part of any contract to provide services.

This Statement applies to you as a:

• casual browser of our website, tisegroup.com (the “Website”);
• subscriber to our market and research material;
• Member or prospective Member of the Exchange;
• Issuer or prospective Issuer for listing on the Exchange;
• user of the TISE Portal;
• shareholder of The International Stock Exchange Group Limited; or
• potential employee of the TISE Entities.

3.

HOW DO WE COLLECT PERSONAL DATA?

4.

WHAT PERSONAL DATA DO WE COLLECT?

Casual browsers of our Website

When you browse our Website we may automatically collect the following:

• technical information, including your Internet Protocol (“IP”) address to help diagnose problems with our server, and to administer our Website. An IP address is a number that is assigned to your computer when you use the internet. Your IP address is also used to help identify you during a particular session and to gather broad demographic data; and
• information about your visit including, for analytical purposes, using the Google Analytics service which collects information such as how often and what pages you visit on the Website and what other sites you used prior to coming to the Website.

4.2

Subscribers to our market and research material

4.3

Members and prospective Members of the Exchange

4.4

Issuers and prospective Issuers for listing on the Exchange

4.5

Users of the TISE Portal

4.6

Shareholders

In addition to the requirements under law for the TISE Entities to maintain records of their shareholders, we may collect, retain and process personal data (including where appropriate your name, postal address, email address and any other relevant information that you provide to us or that we collect) for:

• the processing and payment of dividends, and associated reporting;
• the issuance of circulars to shareholders; and
• routine correspondence and administration purposes.

4.7

Potential Employees

As part of our recruitment process we collect, retain and process personal data (including where appropriate your name, residential address, personal contact details, your CV and any covering letter, previous and relevant work experience, qualifications, skills and any other relevant information that you provide to us or that we collect) for:

• assessing your skills, qualifications and interests against our career opportunities;
• verifying your information and carrying out reference checks and/or conducting background or criminal records checks (where applicable) if you are offered employment;
• communicating with you about the recruitment process and/or your application, including, in appropriate cases, informing you of other potential career opportunities at the TISE Entities; and/or complying with applicable laws, regulations or other legal duties.

5.

HOW WE WILL USE INFORMATION ABOUT YOU?

We will only use your personal information when the law allows us to. Most commonly, we will use your personal information in the following circumstances:

• Where we need to perform an agreement we have entered into with you.
• Where we need to comply with a contractual, legal or regulatory obligation.
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.

We may also use your personal information in the following situations, which are likely to be rare:

• Where we need to protect your interests (or someone else's interests).
• Where it is needed in the public interest, including to prevent fraud.

The situations in which we will process your personal information are listed below.

• The operation of the Exchange under the terms of its licence.
• The operation of the TISE Portal.
• Administering the contract we have entered into with you or where you are a party related to an entity for which we are contracted to provide services.
• Complying with a valid order by a court or other governmental body or applicable law.
• Satisfying any legal or regulatory obligation.
• Business management and planning, including accounting and auditing.
• Making arrangements for the termination of our commercial relationship.
• Dealing with legal disputes involving you.
• To prevent fraud, criminal activity or market abuse.
• To ensure network and information security, including preventing unauthorised access to our computer and electronic communications systems and preventing malicious software distribution.
• To conduct data analytics studies to review and better understand customer retention and attrition rates.
• To undertake the employee recruitment process.

6.

HOW WE USE SENSITIVE PERSONAL DATA

'Sensitive personal data' is referred to under the law as 'Special Category Data'. Special Category Data requires higher levels of protection. We need to have further justification for collecting, storing and using this type of personal information. We may process special categories of personal information in the following circumstances:

• In limited circumstances, with your explicit written consent.
• Where we need to carry out our legal obligations and in line with our data protection policy.
• Where it is needed in the public interest, such as to prevent fraud and in line with our data protection policy.
• During the recruitment process to establish if you have any medical conditions or disabilities for which the Company needs to make reasonable adjustments during the recruitment process.

7.

AUTOMATED DECISION-MAKING

8.

DATA SHARING

We may also need to share your personal information with:

• a court, regulator, government body, applicable authority, enforcement agency or to otherwise comply with the law; or
• the Appeals Committee or Disciplinary Committee of TISEA.

An authorised jurisdiction is (a) the Bailiwick of Guernsey, (b) a Member State of the European Union, (c) any country, any sector within a country, or any international organisation that the Data Protection Commission has determined ensures an adequate level of protection within the meaning of Article 45(2) of the GDPR (or the equivalent article of the former Directive), and for which the determination is still in force, or (d) a designated jurisdiction which is (i) the United Kingdom, (ii) a country within the United Kingdom, (iii) any other country within the British Islands, or (iv) any sector within a country mentioned in (i), (ii) or (iii) (Authorised Jurisdictions).

An unauthorised jurisdiction is a jurisdiction which is not an Authorised Jurisdiction (Unauthorised Jurisdiction).

We may transfer the personal information we collect about you to Authorised Jurisdictions.

9.

STORAGE AND SECURITY OF YOUR PERSONAL DATA

10.

DATA RETENTION

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. Details of retention periods for different aspects of your personal information are available in our retention policy which is available from our Data Protection Officer. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

11.

LINKS TO OTHER WEBSITES

12.

RIGHTS OF ACCESS, CORRECTION, ERASURE AND RESTRICTION

Under certain circumstances, by law you have the:

• Right to data portability: right to request the transfer of your personal information to another party.
• Right of access to your personal information (commonly known as a "data subject access request"). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
• Right to object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes or if data were being processed on grounds of public interest or for historical or scientific purposes.
• Right to rectification of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
• Right to erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing.
• Right to restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
• Right to be notified of rectification, erasure and restrictions.
• Right not to be subject to decisions based on automated processing.

13.

ENQUIRES AND COMPLAINTS

14.

DATA PROTECTION OFFICER

15.

DATA PROTECTION REGISTRATION

• The International Stock Exchange Authority Limited (No 12726); and
• The International Stock Exchange Group Limited (No 12727).

• The International Stock Exchange Group Limited (No 22077); and
• The International Stock Exchange Authority Limited (No 22078).

• The International Stock Exchange Group Limited (No R000101)

16.

CHANGES TO OUR PRIVACY STATEMENT