PRIVACY POLICY

uppergrass Ltd. (the “data controller”) takes the privacy of your personal information very seriously and is committed to safeguarding your privacy and your personal information, complying with the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003. This Privacy Policy relates to our use, of any personal information we collect from you directly, or indirectly via 3rd party data providers, covering individuals who: • use our products and services; • contact us concerning our products and services; • complete surveys uppergrass ltd. has issued or commissioned; • complete competition entries uppergrass ltd. has issued or commissioned; • are provided to us as part of 3rd party data for inclusion in our future marketing campaigns and where consent has been provided for 3rd party marketing campaigns; This Privacy Policy will explain the following: • what personal information may be collected about you; • how uppergrass Ltd. will use this personal information; • when uppergrass Ltd. may use this personal information to contact you; • how long will uppergrass Ltd. retain your personal information; • how this personal information may be shared with other parties; • how your personal information will be kept secure; • your rights regarding the personal information you provide to us; • the use of cookies on the uppergrass Ltd. websites; • how to contact us. In this policy, personal information means information relating to an identified or identifiable natural person. An identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, and online identifier or to one or more factors specific to his/her physical, physiological, genetic, mental, economic, cultural or social identity. uppergrass. encourages you to review the privacy statements of websites you choose to link to from uppergrass ltd. so that you can understand how those websites collect, use and share your information. uppergrass Ltd. is not responsible for the privacy statements or other content on websites outside of uppergrass Ltd. 1.Information that you provide to us. uppergrass Ltd. collects personal data, as a result of its various group activities. These activities are listed below, together with an explanation of the data collected and the lawful basis for processing. 1. Users of our products and services uppergrass Ltd. collects personal information from you when you use our products or services, including name, email address, postal address, telephone number and job title. We will use this personal information: • To carry out obligations arising from being a registered user of our product and services. The lawful basis for processing your personal information for this purpose will be “Contractual Need”. • To send you personalised communications which you have requested or may be of interest to you. These may include information about publications, webinars, events, surveys, product and service developments, promotions of our associated brands’ products and services. The lawful basis for processing your personal information for this purpose will be “Legitimate Interest”. • uppergrass Ltd. uses automated decision making and profiling to personalise and ensure the communications are relevant to you, with no significant effect on you or your rights. The lawful basis for processing your personal information for this purpose will be “Legitimate Interest”. 2. Individuals contacting us concerning our products and services uppergrass. collects personal information from you when you contact us about our products or services or subscribe to our newsletters, including name, email address, postal address, telephone number and job title. We will use this personal information: • To send you personalised communications which you have requested or may be of interest to you. These may include information about product and service developments, promotions of our associated brands’ products and services.

The lawful basis for processing your personal information for this purpose will be “Legitimate Interest”. Information provided to us by 3rd parties. Uppergrass Ltd. obtains personal data from 3rd party sources. These sources are listed below, together with an explanation of the data collected and the lawful basis for processing. 1. Visitors to our website When someone visits one of our sites (www.uppergrass.com or any of our network of brand specific websites we use a 3rd party service, Google Analytics to collect details of website traffic and visitor information, including browser type, internet service provider, URLs of referring/exit pages, operating system, date/time stamp, information you search for, locale and language preferences, identification numbers associated with your devices, your mobile carrier, and system configuration information. We use the website traffic and visitor information to improve our understanding of the use of the uppergrass Ltd. websites and in order to determine what uppergrass Ltd. services are the most popular. The lawful basis for processing your personal information for this purpose will be “Legitimate Interest”. • uppergrass Ltd. uses automated decision making and profiling to personalise and ensure the communications are relevant to you, with no significant effect on you or your rights. The lawful basis for processing your personal information for this purpose will be “Legitimate Interest”. 2. Individuals provided to us as part of 3rd party data for inclusion in our future marketing campaigns and 3rd party marketing campaigns uppergrass Ltd. obtain personal information from 3rd parties, including name, email address, postal address, telephone number and job title. We will use this personal information: • To combine with information we have captured directly from you to send you personalised communications which may be of interest to you. These may include information about product and service developments, promotions of our associated brands’ products and services. The lawful basis for processing your personal information for this purpose will be “Legitimate Interest”. • To provide this information to others for direct marketing of their product or services by inclusion in uppergrass Ltd.’s commercial dataset. The lawful basis for processing your personal information for this purpose will be “Legitimate Interest”. All individual’s obtained from 3rd parties, for this purpose, will have been provided the opportunity to object to their use of personal information by 3rd parties, by the data provider. We currently receive personal information for our marketing campaigns from different sources. Further information regarding our data providers are available on request: sales@uppergrass.com

How long will you retain my personal information? We will retain and process your personal information as long as is needed to provide the product or service that you’ve elected to receive from us. For personal information used by us for our own direct marketing purposes, we will retain the data whilst accurate or responsive and if not, no longer actively use after 5 years. Personal information obtained from 3rd parties for uppergrass ltd. dataset will be recompiled on a regular basis to ensure the data is fresh and relevant. How is my personal information kept secure? uppergrass Ltd. is committed to protecting the security of your personal information. We will use a variety of security technologies and procedures to protect your personal information from unauthorised access, use or disclosure. Although we will do our best to protect your personal information, we cannot guarantee the security of your data transmitted to our site; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access. uppergrass Ltd. secures the personal information you provide on computer servers in a controlled, secure environment, protected from unauthorised access, use or disclosure. uppergrass Ltd. ensures personal information is protected through the use of encryption, such as the Secure Socket Layer (SSL) protocol, when transmitted to other websites. We aim to have all our websites using SSL protocol. What are my choices with my personal information? uppergrass Ltd. is committed to providing you with control on how your data is used and processed. You can review, edit or delete your personal information by contacting us directly at sales@uppergrass.com, or by telephone using the number under the Contact Us section of our website www.uppergrass.com. Your rights concerning your personal information are: • you can ask about the personal information we hold about you and we will show you, free of charge; • you can request your personal information is corrected and we will update the details and inform you when completed, free of charge; • you can object to your data being processed and we will stop processing your data once no longer required for performance of contract or legal obligations, free of charge; • you can object to receiving direct marketing communications from us and we will stop all communications by channel (email, post,) or within certain subject areas, free of charge. In addition, any direct marketing communications you receive from us will always include a clear, simple method to ‘opt-out’ of future communications by channel. • you can ask for your personal information to be erased, once no longer required for performance of contract or legal obligations, which we will complete bar keeping the minimal personal details to ensure we do not contact you again, free of charge; Any request by you to no longer use your personal information by 3rd parties for commercial data information, will be completed within 5 working days. Your right to lodge a complaint with ICO You have the right to lodge a complaint with the Information Commissioner Office (www.ico.org.uk) How we use cookies on the uppergrass Ltd. Websites uppergrass Ltd. use “cookies” to help personalise and enhance your online experience when visiting our website. A cookie is a text file that is placed on your hard disk by a Web page server. Cookies cannot be used to run programs or deliver viruses to your computer. Cookies are uniquely assigned to you, and can only be read by a web server in the domain that issued the cookie to you. You can control the use of cookies at the individual browser level. If you elect not to activate the cookie or to later disable cookies, you may still visit our Websites, but your ability to use some features or areas of the website may be limited. For instructions on how to control, disable or delete cookies for your browser, please visit www.aboutcookies.org. For more information on the use of cookies on our website please see the uppergrass Ltd. Cookie Policy. Changes to this Policy uppergrass Ltd. will occasionally update this Privacy Policy to reflect company and customer feedback. uppergrass Ltd. encourages you to periodically review this policy to be informed of how uppergrass Ltd. is protecting your information. Contact Us uppergrass Ltd. welcomes your comments regarding this Privacy Policy or about uppergrass Ltd.’s privacy practices. Please contact us by email at sales@uppergrass.com , or telephone at: 01275 848254 If you wish to change how we process your data or update your marketing communication preferences, then please let us know.