PRIVACY STATEMENT LIBÉMA & IAMHARDSTYLE EVENTS B.V.

Libéma Entertainment B.V. (“Libéma Entertainment”) is a subsidiary of Libéma Exploitatie B.V. (“Libéma”). Libéma, its affiliated companies and IAMHARDSTYLE Events B.V. attach great importance to protecting your privacy. We always process your personal data with due care and in accordance with applicable privacy legislation and our internal Privacy Policy.

In this Privacy Statement, we inform you about how we process your personal data. We reserve the right to amend the contents of this Privacy Statement. The most recent version will be available on our website.

1. WHO IS RESPONSIBLE FOR PROCESSING YOUR PERSONAL DATA?

Libéma Exploitatie B.V. (“Libéma”), with its registered office at Graafsebaan 133, 5248 NL Rosmalen, together with IAMHARDSTYLE Events B.V. (“IAH”), with its registered office at Sutton 2, 7327 AB Apeldoorn, are responsible for the processing of your personal data.

2. FOR WHICH PURPOSES AND ON WHICH LEGAL BASIS DO WE PROCESS YOUR PERSONAL DATA?

Libéma and IAH process your personal data for specific and legitimate purposes and only where they can rely on one of the legal bases provided for in the General Data Protection Regulation (“GDPR”).

For the purposes described below, Libéma and IAH may process, where necessary, your name, address, date of birth, email address, telephone number, bank details and photograph.

PROVISION OF PRODUCTS AND SERVICES OR COOPERATION

Libéma and IAH process your personal data for the sale and provision of their products and services or in connection with a cooperation entered into with you, such as cooperation with influencers, suppliers or sponsors, on the basis of the performance of the agreement concluded with you.

DIRECT MARKETING AND CUSTOMER SATISFACTION RESEARCH

Following the provision of our products and services, we have a legitimate interest in analysing your data within our customer data platform and contacting you with commercial communications concerning similar products and services (“direct marketing”), inviting you to a relationship event and inviting you to participate in a customer satisfaction survey, so that we can continuously improve your customer experience.

You may also subscribe and give your consent to receive our newsletter. With regard to both commercial communications sent to existing customers and the receipt of our newsletter, you may unsubscribe at any time. An unsubscribe link is included at the bottom of every email.

WEBSITE CONTACT FORM

If you complete our contact form on the website, we process your personal data on the basis of your consent in order to contact you.

WEBSITE COOKIES

When you visit our website, you will be shown a cookie banner informing you about the types of cookies used and allowing you to choose whether or not to consent to their use. For further information, please refer to our Cookie Statement.

If you consent to the placement of tracking cookies, we may show you personalised advertisements through media partners. You may withdraw this consent at any time.

MOBILE APP

If you use our mobile app, you may optionally log in. In that case, we process your personal data on the basis of your consent in order to provide you with a more personalised experience during your visit, including personalised recommendations.

When you remove the app from your mobile phone, the personal data stored in the app will be deleted.

RECORDING OF TELEPHONE CALLS

Libéma and IAH reserve the right to record telephone calls. If a telephone call is being recorded, you will be informed of this during the call.

Libéma and IAH will only use these recordings on the basis of their legitimate interest, namely for internal training purposes. The recordings will not be distributed further or provided to third parties.

CCTV SURVEILLANCE

CCTV surveillance is used in designated areas at various Libéma locations, such as entrances, exits and barriers, in order to safeguard the safety and property of our Visitors and staff.

This CCTV surveillance is carried out on the basis of our legitimate interest. Each location clearly indicates the areas in which CCTV surveillance is in use.

PHOTOGRAPHIC AND AUDIOVISUAL MATERIAL

If you apply to act as a model for one of our marketing campaigns, we process your personal data on the basis of our legitimate interest in finding suitable models for our campaigns.

Once you have been engaged as a model for the purpose of taking photographs for one of our marketing campaigns, the processing of your personal data, including the photographs taken, will take place on the basis of your consent. You will sign a release form for this purpose.

It is also possible that photographs and/or audio or video recordings may be made for promotional purposes during your visit to one of our locations. This will be clearly indicated at the relevant location, allowing you to choose whether or not to enter the area in which recordings are being made.

By entering this area, you consent to the use of photographs or recordings in which you are recognisably depicted.

ACCIDENT FORM

If you are involved in an accident at one of our locations, we may process your personal data, including potentially data concerning your health, in order to deal with the accident appropriately.

With your consent, your personal data will be recorded on an accident form.

3. WHO HAS ACCESS TO YOUR PERSONAL DATA?

Within Libéma and IAH, only authorised personnel have access to your personal data and only where such access is strictly necessary for the performance of their duties.

For the provision of our products and services, we engage suppliers that process your personal data under our responsibility and in accordance with our instructions. These are generally software companies.

We enter into a data processing agreement with each supplier and only work with suppliers that provide appropriate protection for your personal data.

There are situations in which we are required to provide your personal data to a third party that subsequently processes the data for its own purposes. This may, for example, be the case if the police request CCTV footage following an incident or if we need to provide your personal data to our liability insurer for the handling of a personal injury claim.

As a general rule, we process your personal data only within the European Economic Area (“EEA”). If processing outside the EEA is necessary, we will implement appropriate safeguards.

4. HOW DO WE PROTECT YOUR PERSONAL DATA?

Libéma and IAH make every effort to protect your personal data as effectively as possible. In doing so, Libéma and IAH comply with the applicable security standards.

If, despite the security measures taken, a “personal data breach”, also referred to as a “data breach”, occurs and this breach is likely to result in a high risk to your privacy, you will be informed as soon as possible.

5. HOW LONG DO WE RETAIN YOUR PERSONAL DATA?

Libéma and IAH do not retain your personal data for longer than is strictly necessary for carrying out our activities, unless the personal data must be retained for a longer period pursuant to tax legislation.

• After providing our products and services, we retain your personal data for a maximum period of 4 years in order to send you commercial communications concerning similar products and services, unless you object to such processing.

• Personal data that must be retained pursuant to tax legislation is retained for a maximum period of 7 years.

• Following participation in a customer satisfaction survey, we retain your personal data for a maximum period of 4 weeks in order to handle any complaint or question.

• After you complete our contact form, we retain your personal data for 2 weeks in order to deal with your enquiry.

• Recordings of telephone calls are retained for a maximum period of 90 days.

• CCTV footage is retained for a maximum period of 4 weeks and, in the event of a specific incident, for a maximum period of 5 years, corresponding to the limitation period for a damages claim.

• Application data is retained for a maximum period of 4 weeks and, with your consent, for a maximum period of 1 year.

• Photographic and audiovisual material, including the associated release form, is retained for as long as it remains usable.

• Personal data contained in an accident form is retained for a maximum period of 5 years, corresponding to the limitation period for a damages claim.

• Personal data processed on the basis of your consent will be processed for as long as you do not withdraw that consent. After withdrawal of your consent, the personal data will be deleted immediately.

6. WHAT RIGHTS DO YOU HAVE IN RELATION TO THE PROCESSING OF YOUR PERSONAL DATA?

You may exercise the following rights under the GDPR:

• You have the right of access to your personal data. This means that you may request information about which personal data we process about you.

• If you believe that Libéma and IAH hold incorrect personal data about you, you may request that this personal data be corrected.

• You may request that your personal data be deleted from our systems.

• You may request that the processing of your personal data be restricted for the period required to assess your request or objection.

• You may request that we transfer your personal data to a third party.

• You may object to the processing of your personal data where such processing is based on our legitimate interest, including direct marketing.

• If Libéma and IAH process your personal data on the basis of your consent, you may withdraw that consent at any time.

7. HOW CAN YOU SUBMIT A COMPLAINT OR CONTACT US ABOUT THE PROCESSING OF YOUR PERSONAL DATA?

If you have a complaint concerning the processing of your personal data, have any questions, or wish to exercise any of your rights, you can contact us by telephone on 073-5282200 on working days between 09:00 and 17:00, by email at privacy@libema.nl or by email at management@iamhardstyle.com.

We will respond to you as soon as possible. Requests relating to the exercise of your rights will be handled within the applicable period of one month.

You may also submit a complaint to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens.

8. WHAT ABOUT THE USE OF YOUR PERSONAL DATA ON THIRD-PARTY WEBSITES?

Libéma and IAH are not responsible for the processing of your personal data on third-party websites that are not affiliated with Libéma or IAH.

Please refer to the privacy statements of those third parties for further information.