Sberbank CIB (UK) Limited 85 Fleet Street, 4th Floor, EC4Y 1AE, United Kingdom Phone +44 0 207 583 3257 Fax +44 0 207 822 0779

August 2021 Sberbank CIB (UK) Ltd Privacy Information Notice

1. Data Privacy according to UK GDPR

Sberbank CIB (UK) Limited is aware of its obligations under the Data Protection Act 2018 and the UK General Data Protection Regulation, referred to jointly as “UK GDPR” and is committed to processing your data securely and transparently.

This privacy information notice sets out, in line with the UK GDPR, the types of data that we hold on you to provide corporate finance, investment banking services and market trade operations to its’ clients, we may collect and process personal data relating to individuals associated with corporate clients (which include individuals and representatives/contacts from corporate clients), counterparties, suppliers, distributors and other business partners). It also sets out how we use that information, how long we keep it for and other relevant information about your data.

2. Data controller details

Sberbank CIB (UK) Ltd is a data controller, meaning that it determines the processes to be used when using your personal data. Our contact details are as follows: Sberbank CIB (UK) Ltd, 85 Fleet Street, London, EC4Y 1AE, United Kingdom. Email: [email protected], Telephone: 0207 583 3257.

3. Data protection principles

In relation to your personal data, we will:

 process it fairly, lawfully and in a clear, transparent way  collect your data only for reasons that we find proper for the course of your employment in ways that have been explained to you  only use it in the way that we have told you about  ensure it is correct and up to date  keep your data for only as long as we need it  process it in a way that ensures it will not be used for anything that you are not aware of or have consented to (as appropriate), lost or destroyed

4. The information we collect, hold and process about you:

We may collect the following types of personal data from you, your directors, officers or employees,

Page 1 of 7

Sberbank CIB (UK) Limited 85 Fleet Street, 4th Floor, London EC4Y 1AE, United Kingdom Phone +44 0 207 583 3257 Fax +44 0 207 822 0779

your beneficial owners (if applicable) and any person or organisation you have appointed to act on your behalf in relation to our services, for example, as part of client or service provider onboarding process:

 full name;  permanent residential address;  e-mail addresses;  telephone and facsimile contact numbers;  nationality and citizenship;  date of birth;  passport information such as passport number and date of expiry;  employment status;  profession or occupational information;  educational information;  utility bills;  tax information such as tax identification numbers and country of residency or domicile for tax purposes;  and  financial information such as income sources

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your business relationship with us.

5. Types of Data and Main Purposes of Data we Process

Processing purposes Legal basis

Client and counterparty relationship  Legal obligation

management and account administration  Legitimate interests to manage (including management of invoices) operations and third party relationships and to keep our records Transaction processing, registering of trades,  Legalupdated obligation monitoring and reporting activities (e.g.  Performing of a contract management of client orders receipt,  Legitimate interests to provide transmission, execution of clients orders, its services and manage compliance with reporting obligations under business operations Mifid II) Undertaking client due diligence checks for the  Legal obligation prevention, detection, investigation and  Legitimate interests to prevent and prosecution of financial crimes (including but not investigate fraud, money laundering, limited to money laundering, terrorism financing, market abuse, insider dealing and fraud and other financial crimes) in any other crimes and to verify the clients jurisdiction, identity verification, government /counterparties’ identity in order sanctions screening and due diligence checks to protect our business.

Page 2 of 7

Sberbank CIB (UK) Limited 85 Fleet Street, 4th Floor, London EC4Y 1AE, United Kingdom Phone +44 0 207 583 3257 Fax +44 0 207 822 0779

Compliance with applicable local or foreign law,  Legal obligation regulation, policy, voluntary codes, directive, judgement or court order, as well as any contractual obligation pursuant to agreements between any member of Sberbank CIB (UK) Ltd and any authority, regulator or enforcement agency or body or any request coming from said entities, which it is subject to and co- operating with regulators and law enforcement bodies Communicating with (including corporate  Legitimate interests of the company marketing materials, market research and to manage third party relationships, marketing related data processing) the client, make suggestions and counterparty and related parties from time to recommendations about services time about products, services, events offered by that may be of interest, to develop its Sberbank CIB (UK) Ltd or Sberbank group products and services and grow its companies and other communications such as business. research and insights that may be of interest to the client/counterparty and related parties. Monitoring and recording of communication  Legal obligation and activity, including telephone calls, emails  Legitimate interests for provision of and premises security access controls administration and IT services, network and premises security, to prevent fraud and criminal activity. Recruitment management, personnel  Legal obligation management, career management and training  Performing of a contract provisions (including staff onboarding and offboarding, performance review, payroll and expenses management); management of personnel account dealing and outside business interests) Vendor management including vendor  Performing of a contract selection, vendor screening/assessment,  Legitimate interests to manage onboarding, offboarding, contract third party relationships and to keep our records updated

6. How we collect information

You may provide us with personal data when you apply to us to perform our services, by entering into a contract with us and/or filling in a client application form (in paper or on our website) or by corresponding with us by:

 phone;  e-mail;

Page 3 of 7

Sberbank CIB (UK) Limited 85 Fleet Street, 4th Floor, London EC4Y 1AE, United Kingdom Phone +44 0 207 583 3257 Fax +44 0 207 822 0779

 post; or  by any other electronic means

We may also receive personal data (e.g. financial or tax information) from third parties with whom we work closely and who are entitled to share that information (e.g. credit agencies, search information providers, business partners, banking and related service providers, analytics providers, public sources or any other service providers), but in each case, as permitted by applicable law.

Our website is for information purposes only. We do not use any form of cookies and do not collect or process personal information via this website. In particular, we do not gather any data regarding your logging IP address or session information.

7. The consequences of not providing some types of personal data

Where we need to collect personal data by law, or under the terms of a contract we have with you and you fail to provide that personal data when requested, we may not be able to perform the contract we have or are trying to enter into with you. We will only use personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we plan to use the personal data provided to us for other purposes than those described above, we will provide information about that processing at the time of collection.

8. How we share your personal information

We may provide personal data about you to any Sberbank group companies or third parties for processing transactions, payments or settlements, or in connection with the provision of products and services. Below are the group companies with whom we may share your personal details: Sberbank CIB’s offices located in , , New York, USA and , Cyprus.

We will only do this where permitted by applicable law.

We may have to provide personal data to regulatory, judicial, tax and supervisory authorities to meet our legal obligations, subject to applicable law. Personal data may also be passed to law enforcement agencies if we identify or suspect criminal activity.

We may provide personal data to our service providers and agents (including their sub-contractors). This includes (but is not limited to) organisations that host our IT systems and data, our legal advisors and accountants. Where we engage with a supplier or agent to process client and related parties' information on our behalf, we will undertake due diligence, monitoring and assurance activities to ensure that the personal data is appropriately protected, and contractual clauses will be agreed between the parties to ensure that data protection and confidentiality is maintained in accordance with the requirements of applicable law. In addition, we may disclose personal data in the event we

Page 4 of 7

Sberbank CIB (UK) Limited 85 Fleet Street, 4th Floor, London EC4Y 1AE, United Kingdom Phone +44 0 207 583 3257 Fax +44 0 207 822 0779

sell or transfer all or a portion of our business or assets (including in the event of a reorganisation, dissolution, or liquidation).

9. Data transfer outside of the UK

We may transfer to and store the personal data we collect in countries other than the country in which the personal data was originally collected, including countries outside of the United Kingdom. Those countries may not have the same data protection laws as the country in which the personal data was provided. When we transfer personal data to other countries, we will protect the personal data as described in this Privacy Notice and comply with applicable legal requirements providing adequate protection for the transfer of personal data to countries outside of the United Kingdom. . This includes entering into the Data Transfer Agreements and Data Processing Agreements between relevant parties or ensuring that data importer(s) have implemented Binding Corporate Rules.

10. Retention of personal data

We retain personal data for as long as necessary to fulfil the purposes for which we collect it, except if required otherwise to retain the personal data for longer for legal, regulatory and fraud prevention purposes.

We regularly review our records to ensure that we only retain your Personal Data for as long as is necessary for the purposes set out in this Privacy Information Notice.

We may also retain information about you:

 at the end of your legal contract with us  where your application to become our client is declined by us, or  where you decide not to proceed with entering into a legal contract with us

Please note that where we no longer need your Personal Data, we will dispose of it in a secure manner.

11. Security and storage of information

The security and storage of your personal data are very important to us. To securely protect your personal data, we implemented appropriate technical and organisational security measures, which include both physical and technical security safeguards and a governance model that ensures that adequate policies, procedures and controls are in place.

Page 5 of 7

Sberbank CIB (UK) Limited 85 Fleet Street, 4th Floor, London EC4Y 1AE, United Kingdom Phone +44 0 207 583 3257 Fax +44 0 207 822 0779

12. Your rights in relation to your data

The law on data protection gives you certain rights in relation to the data we hold on you, subject to applicable law. These rights are:

 the right to be informed. This means that we must tell you how we use your data, and this is the purpose of this privacy notice  the right of access. You have the right to access the data that we hold on you. To do so, you should make a data subject access request.  the right for any inaccuracies to be corrected. If any data that we hold about you is incomplete or inaccurate, you are able to require us to correct it  the right to have information deleted. If you would like us to stop processing your data, you have the right to ask us to delete it from our systems where you believe there is no reason for us to continue processing it  the right to restrict the processing of the data. For example, if you believe the data we hold is incorrect, we will stop processing the data (whilst still holding it) until we have ensured that the data is correct  the right to portability. You may transfer the data that we hold on you for your own purposes  the right to object to the inclusion of any information. You have the right to object to the way we use your data where we are using it for our legitimate interests  the right to regulate any automated decision-making and profiling of personal data. You have a right not to be subject to automated decision making in way that adversely affects your legal rights.

Where you have provided consent to our use of your data, you also have the unrestricted right to withdraw that consent at any time. Withdrawing your consent means that we will stop processing the data that you had previously given us consent to use. There will be no consequences for withdrawing your consent. However, in some cases, we may continue to use the data where so permitted by having a legitimate reason for doing so.

Also subject to applicable law, you have the right to receive a copy of your personal data in a structured, commonly used, machine-readable format, including a right to have that personal data transmitted to another organisation.

If you wish to exercise any of the rights explained above, please contact our Data Privacy Manager by email: [email protected] or by telephone: 0207 583 3257. In order to exercise these rights we will require proof of identity.

13. Electronic mail containing personal data

You and your authorised agents may, from time to time, send personal data to us electronically. We are not responsible for the way in which you or your agents handles personal data. Where possible, we insist

Page 6 of 7

Sberbank CIB (UK) Limited 85 Fleet Street, 4th Floor, London EC4Y 1AE, United Kingdom Phone +44 0 207 583 3257 Fax +44 0 207 822 0779

that you or your agent communicate using secure encrypted e-mail or using encrypted files.

When we communicate personal data with you or your agent through electronic means, we will ensure that it is done so securely using either encrypted files or secure messaging.

14. Making a complaint

Sberbank CIB (UK) Ltd is committed to working with individuals to obtain a fair resolution of any complaint or concern about privacy. If, however, individuals believe that we have not been able to assist with their complaint or concern, they have the right to make a complaint to the data protection authority, for more information please visit www.ico.org.uk.

15. How to contact us

Below are the contact details for any complaints or any access, correction or other requests in respect of the personal data we hold about individuals:

Data Privacy Manager Sberbank CIB (UK) Ltd 85 Fleet Street London EC4Y 1AE UK

Email: [email protected]

16. Changes to our Privacy Information Notice

We may change, modify or adjust this Privacy Information Notice from time to time. However, we will not reduce your rights under this Privacy Information Notice. Any changes we may make to our Privacy Information Notice in the future can be found on our website http://sberbank- cib.co.uk/docs/Privacy_Policy.pdf Copies are also available from us by post. Please contact us if you require a copy.

Page 7 of 7