Privacy, Cookie & Data Use Policy

Effective: November 2021

This privacy notice (“Notice”) describes how Trinity (“Company,” “we,” and “our”) collects, uses and shares (collectively, “use”) your personal data when you visit our website (regardless of where you visit it from) and tells you about your privacy rights and who protects them.

Important Information

Who is the controller of the personal data to which this policy applies? Trinity Purchasing NV, a Belgian entity (“Trinity”). Trinity is a member of the Avendra Group which is itself a sub-group of Aramark corporation, a public entity traded on the NYSE.

When does this Notice apply? This Notice applies to personal data that we use in relation to our website www.trinitypurchasing.com and any other website or location to which this Notice is posted or linked, unless otherwise indicated (each a “Site”).

How will you use my personal data? We use your personal data only as described in this Notice and only when we have a lawful basis to do so. See the How We Use Your Personal Data section below for details.

Do you share my personal data with others? We do not sell your personal data or share it with anyone except as described in this notice. See the How We Share Your Personal Data section below for details.

Where will my personal data be transferred? Trinity is part of a global group of companies with affiliates and service providers within and outside of the European Economic Area (EEA) and the UK. As such, we may transfer your personal data amongst these parties outside the EEA or UK for purposes consistent with this Notice, including to countries with data protection laws which are not comparable to those within the EEA/UK (as applicable). See the International Data Transfer section below for details on the safeguards applied to these transfers.

What are my rights? Data protection laws give you important rights and choices in relation to your personal data. See the section below on Your Rights for details.

How can I get more information? We have a dedicated privacy compliance team which is responsible for overseeing questions in relation to this privacy policy. If you have any questions about this privacy policy, including any requests to exercise your legal rights, please contact the privacy compliance team using the details set out in the Contact Us section below.

Personal Data We Collect

Personal Data You Give Us. This includes personal data you may provide when you:

• Sign up to our newsletter;
• register for an account on the Site, such as a username or password;
• complete forms or use interactive features of our Site, including your name, postal address, email address and telephone number;
• contact us to report a problem with our Site;
• otherwise contact customer support; or
• otherwise interact with us by phone, email, in person or other means.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

Information from Social Networking Sites. Our Site includes interfaces that allow you to connect with social networking sites (each a “SNS”). If you connect to a SNS through our Site you authorise us to access, use and store the information that you agreed the SNS could provide to us based on your settings on that SNS. We will access, use and store that information in accordance with this Notice. You can revoke our access to the information you provide in this way at any time by amending the appropriate settings from within your account settings on the applicable SNS.

Information We Get from Others. We may also get information about you from other sources; for example, we retain service providers to identify the organisation associated with the IP from which you visit our site, and we may add this to the other information we get from our Site.

Information Automatically Collected. We may automatically log information about you and your computer or mobile device when you access our Site. For example, we may log your computer or mobile device operating system name and version, manufacturer and model, browser type, browser language, screen resolution, the website you visited before browsing to our Site, pages you viewed, how long you spent on a page, access times and information about your use of and actions on our Site. We collect this information about you using cookies. Please refer to the Cookies Policy for more details.

How We Use Your Personal Data

To operate the Site

We use your personal data:

• to operate, maintain, and secure the Site;
• to study how the Site is used and to improve the Site and our other products and services;
• if you register for an account on the Site, to manage and communicate with you regarding your account, including by sending you Service announcements, technical notices, updates, security alerts, and support and administrative messages;
• to better understand your needs and interests, and personalise your experience with the Site;
• to administer promotional activities on the Site; and
• to respond to your requests, questions and feedback.

To send marketing communications
If you request information from us, register for an account on the Site or participate in our surveys, promotions or events, we or our group companies may send you marketing communications if permitted by law, but you will be able to opt out.

To create anonymous data
We may collect anonymous data, including aggregated or anonymous data derived from personal data of our users. We make personal data into anonymous data by excluding information that makes the data personally identifiable to you, and use that anonymous data for our lawful business purposes.

For security, compliance, fraud prevention and safety
We use your personal data as we believe necessary or appropriate to (a) implement and operate security measures designed to protect the Site and your personal data; (b) enforce the terms and conditions that govern the Service; (c) protect our rights, privacy, safety or property, and/or that of you or others; and (d) protect, investigate and deter against fraudulent, harmful, unauthorised, unethical or illegal activity.

To provide a requested service
If you participate in a promotion on the Site or request a service through the Site, we may request personal data that we need to facilitate your participation in the promotion or provide the requested service.

To comply with law
We use your personal data as we believe necessary or appropriate to comply with applicable laws, lawful requests and legal process, such as to respond to subpoenas or requests from government authorities.

With your consent
We will request your consent to use your personal data where required by law, such as where we use certain cookies or similar technologies or would like to send you certain marketing messages. If we request your consent to use your personal data, you have the right to withdraw your consent any time in the manner indicated when we requested the consent or by contacting us.

To share with third parties
We share your personal data with third parties in the limited cases described below.

Information about the legal bases of processing for the purposes above are detailed below:

How We Share Your Personal Data

Affiliates
We may disclose your personal data to our subsidiaries and corporate affiliates for purposes consistent with this Notice. For more information on our affiliates, please refer to our website.

Service Providers
We may employ third party companies and individuals to help us process your personal data as described in this Notice (such as hosting, data storage, website analytics and testing, email delivery and database management services).

Compliance with Laws and Law Enforcement; Protection and Safety
We may disclose information about you to government or law enforcement officials or private parties as required by law, and disclose and use such information as we believe necessary or appropriate as described above to comply with law and for security, compliance, fraud prevention and safety.

Business Transfers
We may sell, transfer or otherwise share some or all of its business or assets, including your personal data, in connection with a business deal (or potential business deal) such as a merger, consolidation, acquisition, reorganisation or sale of assets or in the event of bankruptcy.

Other
We will get your express opt-in consent before we share your personal data with any third party for marketing purposes.

Third Party Sites

Our Site may contain links to third party websites and features. This Notice does not cover the privacy practices of such third parties. These third parties have their own privacy policies and we do not accept any responsibility or liability for their websites, features or policies. Please read their privacy policies before you submit any data to them.

International Data Transfer

Where we transfer personal data to a country that is not approved under applicable law as providing a level of data protection comparable to the country of origin, we will transfer it subject to safeguards that allow us to conduct the transfer in accordance with applicable data protection laws. Please contact us for further information on the specific mechanism used by us if transferring your personal data out of the EEA or UK (as applicable).

Security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so. If you have reason to believe that the Site or personal data you have shared with us is not secure, please contact us immediately.

Retention

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

Our Notice on Children

Our Site is not directed to children under 16. If a parent or guardian becomes aware that his or her child has provided us with information without their consent, he or she should contact us. We will delete such information from our files as soon as reasonably practicable.

Sensitive Personal Data

We ask that you not send us, and you not disclose, any sensitive personal data (e.g. social security numbers, information related to racial or ethnic origin, political opinions, religion or other beliefs, health, biometrics, genetic characteristics, criminal background or trade union membership) on or through the Site or otherwise to us.

If you send or disclose any sensitive personal data to us when you use the Site, you must consent to our processing and use of such sensitive personal data in accordance with this Notice. If you do not consent to our processing and use of such sensitive personal data, you must not submit such sensitive personal data to our Site.

Your Rights

Data protection laws give you certain rights regarding your personal data. You may ask us to take the following actions in relation to your personal data that we hold:

• Opt-out/Withdraw consent. Stop sending you direct marketing communications. You may continue to receive administrative and other non-marketing emails.
• Access. Provide you with information about our use of your personal data and give you access to it.
• Correct. Update or correct inaccuracies in your personal data.
• Delete. Delete your personal data.
• Transfer. Transfer a machine-readable copy of your personal data to you or a third party of your choice.
• Restrict. Restrict the processing of your personal data.
• Object. Object to our reliance on our legitimate interests as the legal basis for our use of your personal data as described in the Legal Information section.

You can submit these requests by using our contact details in the Contact Us section below. We may request specific information from you to help us confirm your identity and process your request. Applicable law may require or permit us to decline your request. If we decline your request, we will tell you why, subject to legal restrictions. If you would like to submit a complaint about our use of your personal data or response to your requests regarding your personal data, you may contact us or submit a complaint to the data protection regulator in your jurisdiction.

Changes to this Notice

We keep our privacy policy under regular review. This version was last updated in November 2021. We reserve the right to modify this Notice at any time. If we make material changes to this Notice (other than changes to reflect changes in applicable law) you will be notified via e-mail (if you have an account linked to your email address) or another manner through the Site that we believe reasonably likely to reach you (which may include post a new announcement or notice on the Site.

Any modifications to this Notice will be effective upon our posting of the modified Notice (or as otherwise indicated at the time of posting).

Cookie Policy

Our website uses cookies to distinguish you from other users of our website. This helps us to provide you with a good experience when you browse our website and also allows us to improve our site.

A cookie is a small file of letters and numbers that we store on your browser or the hard drive of your computer if you necessary to allow the website to work or alternatively if you agree. Cookies contain information that is transferred to your computer’s hard drive.

We use the following cookies:

• Strictly necessary cookies. These are cookies that are required for the operation of our website. They include, for example, cookies that enable you to log into secure areas of our website, use a shopping cart or make use of e-billing services.
• Analytical or performance cookies. These allow us to recognise and count the number of visitors and to see how visitors move around our website when they are using it. The information gathered may include the number of visitors to our Site, the websites that referred them to our Site, the pages they visited on our Site, what time of day they visited our Site, whether they have visited our Site before, and other similar information. This helps us to improve the way our website works, for example, by ensuring that users are finding what they are looking for easily.
• Functionality cookies. These are used to recognise you when you return to our website. This enables us to personalise our content for you, greet you by name and remember your preferences (for example, your choice of language or region).
• Marketing cookies. These cookies record your visit to our website, the pages you have visited and the links you have followed. We will use this information to make our website and the advertising displayed on it more relevant to your interests. We may also share this information with third parties for this purpose.

We may use both session cookies (which expire once you close your web browser) and persistent cookies (which stay on your computer or mobile device until you delete them) to provide you with a more personal and interactive experience on our Site.

We may use two broad categories of cookies: (1) first party cookies, served directly by us to your computer or mobile device, which we use to recognise your computer or mobile device when it revisits our Site; and (2) third party cookies, which are served by service providers on our Site, and can be used by such service providers to recognise your computer or mobile device when it visits other websites.

You can block cookies by activating the setting on your browser that allows you to refuse the setting of all or some cookies. However, if you use your browser settings to block all cookies (including essential cookies) you may not be able to access all or parts of our website.

The default position we adopt as illustrated on our cookie banner is that all cookies except Strictly Necessary cookies are inactive.

Contact Us

You may send any questions, comments, and questions regarding this Notice to gdpr@aramark.com.

You may also write to us at:

Trinity Purchasing NV
Waversesteenweg 1110 / Chaussee de Wavre 1110
1160 Brussel / 1160 Bruxelles
Belgium

For the Attention of: Communications/Data Privacy