Additional information for individuals in the USA

This ’07 Additional information for individuals in the United States of America’ section applies solely with respect to California, Colorado, Connecticut, Utah and Virginia residents. This section should be read together with and explicitly deviates from and/or supplements the other sections in the Privacy Notice. In case of any conflict between this section and the other sections in the Privacy Notice, this section will prevail for California, Colorado, Connecticut, Utah and Virginia residents.

What information do we collect? For the purpose of this section, the term personal data refers to the terms personal data and personal information as defined in the applicable U.S. state consumer privacy law of California, Colorado, Connecticut, Utah and Virginia (“U.S. privacy laws”). Below you will find an overview of the categories of personal data that we may process of you. We do not process any sensitive personal data as outlined in the U.S. privacy laws. For a more detailed overview, please see section “01 What information do we collect” in the Privacy Notice.

• Identifiers.

• Customer records information.

• Characteristics of certain protected classifications.

• Geolocation data.

• Financial information.

• Internet or other electronic network activity information.

What are the sources of collection? Your personal data will be collected from the following sources:

• prospects;

• (former) business contacts;

• publicly available sources, such as social media and the internet;

• our website;

• information provided by you;

• governmental organizations.

Do we sell and/or share your information? We do not sell, which includes disclosing or making available personal information to a third party, any of your personal data in exchange for monetary or other valuable consideration or share, which includes disclosing or making available personal information to a third party, for cross-context behavioral advertising as defined in the U.S. privacy laws.

What are your rights? Individuals reside in California, Colorado, Connecticut, Utah and Virginia have in accordance with and depending on the specific the U.S. privacy laws the following rights regarding your personal data processed by us in the prior twelve (12) months:

• Right to know – you have the right to request disclosure and receive a copy of: the categories and/or personal data that we have collected about you; the categories of sources related to the personal data we have collected about you; the purpose for which we use your personal data; the categories of third parties with whom we disclose your personal data; and the categories of personal data that we sell or disclose to third parties. You can invoke this right up to twice (2) a year, free of charge.

• Right to delete – subject to certain exceptions, you have the right to request us to delete your personal data we collected from you, including the third parties to whom we send your personal data.

• Right to correct – you have the right to request us to correct inaccurate personal data that we have about you.

• Right to limit – you have the right to request us to only use and/or disclose your sensitive personal data only to what is necessary and proportionate in order to achieve the purpose required.

• Right to appeal – you have the right to appeal in the event of denial of your above-listed rights.

Individuals may also exercise its individual right by the assistance of an authorized agent.

Exercising any of your individual privacy rights will not result in any discriminatory adverse treatment towards you.

How to exercise your rights? All individual rights can be exercised by means of sending an email to info@teamgullit.com or a letter to Team Gullit, attn. Legal Department, Keesomstraat 10E, 1821BS Alkmaar, the Netherlands. We request you to include the following information when exercising your individual right: full first and last name, a description of your request, and if applicable, proof of authorization in the event of any request send by an authorized agent.

Upon the submission of a request wherein you exercise your individual right, you will first receive an acknowledgement of receipt from us within ten (10) business days. Subsequently, we might request additional information in order to identify you and/or respond properly to any individual right exercised. We will handle all individual right exercised under the California Privacy Rights Act without undue delay and in any event within forty-five (45) calendar days of receipt of the request. However, it might be possible that we need more time given the complexity of the individual right exercised. In that event we will inform you, as soon as possible and at least within forty-five (45) calendar days after receipt of your request, that we need up to a maximum of forty-five (45) calendar days of additional time, which results in a response from us within a maximum period of ninety (90) calendar days after receipt of your request. In deviation of the aforementioned sentences, requests made related to the right to limit or the right to know of sensitive personal data will be handled without undue delay and in any event within fifteen (15) business days of receipt of the request.