Corporate Asset Solutions – FPN & CBILS Data Protection and Disclosure Declaration

All Employees of Corporate Asset Solutions Limited (CAS) who interact with data subjects are responsible for ensuring that this notice is drawn to the data subject’s attention and their consent to the processing of their data is secured. The personal data we collect from you will be used for the following purposes: • To obtain your contact details to enable us to contact you about the performance of your contract with us. • To assess your financial position and affordability. • To obtain credit references from credit reference agencies. • To arrange insurance on goods – if applicable to the contract you have entered into with us. By consenting to this, you are giving us permission to perform those actions. You may withdraw consent at any time. Your Rights as a Data Subject • You may withdraw your consent at any time • You have the right to access your personal information • You have the right to rectify your personal data • You have the right to have your personal data erased • You have the right to restrict processing • You have a right to lodge a complaint with the Information Commissioner’s Office.

“any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person”. General Data Protection Regulation of May 2018 Special Categories of Personal Data Certain data is classified under the Regulation as ”special categories”: • Racial • Ethnic origin • Political Opinions Religious Beliefs • Trade-union membership • Genetic Data • Biometric Data • Health Data • Data Concerning a natural person’s sex life • Sexual orientation • Other Consent is required for CAS to process both types of personal data, but it must be explicitly given. Where we are asking you for sensitive personal data we will always tell you why and how the information will be used.

In order for us to provide you with services, we need to collect personal data for correspondence purposes and/or detailed service provision. In any event, we are committed to ensuring that the information we collect, and use is appropriate for this purpose, and does not constitute an invasion of your privacy. We may pass your personal data on to Third Party service providers who are contracted to CAS in the course of dealing with you. Our contractors are obliged to keep your details securely and use them only to fulfil the service requested. Once your service need has been satisfied or the case has been closed, they will dispose of the details in line with our firm’s procedures. If we wish to pass your sensitive personal data onto a third party not contracted to provide the service requested, we will only do so once we have obtained your consent, unless we are legally required to do so. How CAS uses your information? CAS will process – that means collect, store and use – the information you provide in a manner that is compatible with the General Data Protection Regulation of May 2018 (GDPR). We will endeavor to keep your information accurate and up to date and not keep it for longer than is necessary. In some instances, the law sets the length of time information has to be kept, but in most cases, we will use our discretion to ensure that we do not keep records outside of our normal business requirements. Our aim is not to be intrusive, and we undertake not to ask irrelevant or unnecessary questions. Moreover, the information you provide will be subject to rigorous measures and procedures to minimise the risk of unauthorised access or disclosure.

(the "Borrower") that personal data shall be used in the following ways: (1) being communicated to each of: i. the Secretary of State for Business, Energy and Industrial Strategy its agents and auditors (the “Guarantor”); ii. the British Business Bank plc, any affiliate of the British Business Bank plc and any of their advisers, agents or contractors including professional advisers and consultants, auditors and advisers carrying out due diligence; iii. processing agents, fund managers, delivery partners and companies providing services to the British Business Bank and its affiliates; and iv. Government departments and Devolved Administrations (including but not limited to the National Audit Office, Office for National Statistics, HM Treasury and the Department for Business, Energy and Industrial Strategy) and other politicians or government members (i.e. ministers) (the “Guarantor Relevant Parties”); (2) being used by the Guarantor and any Guarantor Relevant Parties: (i) for analytical and administrative purposes (including to keep a record of the types of borrowers and/or applicants applying for a Coronavirus Business Interruption Loan (“CBIL”) Scheme facility); (ii) to contact me in connection with the CBIL Scheme; (iii) to make enquiries about the CBIL Application of the Borrower. (iv) to take up references about me and the business; (v) to give information about me and the business to any other party referred to in paragraph (1) above or to any official involved in running or monitoring the CBIL Scheme; and (vi) to evaluate the effectiveness of the CBIL Scheme; and EFG Term Loan Lender Manual 2017 Edition Version 2.0 (3) if a scheme facility is made available to the Borrower by the Lender) being retained by the relevant recipient for a minimum of ten (10) years after the initial drawdown date of such scheme facility: and otherwise being used in accordance with the British Business Bank Privacy Notice found at https://www.british-business-bank.co.uk/privacy-notice/.

I acknowledge that I have the right to request that any personal data held by or on behalf of any of the parties referred to in paragraph (1) above, be verified, amended, deleted or otherwise modified. I acknowledge whilst I have the right to make such requests, the personal data may continue to be used as necessary to administer the Coronavirus Business Interruption Loan Scheme. I acknowledge that any such requests made by me should be addressed to the British Business Financial Services Limited acting as Agent for the Guarantor at the following address, or such other address as may be notified to me by the Lender from time to time: The British Business Bank Steel City House West Street Sheffield S1 2GQ Email: DataProtection@british-business-bank.co.uk.

I acknowledge that I may lodge a complaint with the Information Commissioner if I consider that my rights under (i) the Data Protection Act 2018, (ii) the Privacy and Electronic Communications (EC Directive) Regulations 2003 (SI 2003/2426), (iii) any other United Kingdom or European Union laws (with direct effect) relating to processing of personal data and privacy or (iv) any laws or guidance that replaces them (including the European Union’s General Data Protection Regulation (Regulation (EU) 2016/679)) have been infringed as a result of the processing of Personal Data by the parties referred to in paragraph (1) above.