Data Protection Policy Disclosure UK and EEA

Data Protection Policy Disclosure – UK and EEA

This schedule applies to the delivery of the Services described in the Master Services Agreement, the LMS Terms of Conditions, Crypto‑Services, or any other services provided by any Asset Reality entity.

These Privacy Disclosures for the European Economic Area (EEA) and the United Kingdom (UK) supplement our Privacy Policy—which describes the Personal Data we collect, the sources from which we collect it, the purposes for which we use it, and the limited circumstances under which we share it. These additional disclosures are made in accordance with European and UK law, including the European General Data Protection Regulation (GDPR) and the UK GDPR. Terms not defined here have, unless otherwise indicated, the meanings set forth in our Privacy Policy. If you are based elsewhere in the world, this Disclosure does not apply to you.

Our Legal Basis for Processing Personal Data

The European GDPR and the UK GDPR require us to have a legal basis for processing Personal Data about you. Depending on the Personal Data and the processing activities at issue, the legal bases upon which we rely may include:

• Consent: When you have given us clear consent to process your Personal Data for a specific purpose.
• Contract: When processing your Personal Data is necessary to perform a contract we have with you, or when you have asked us to take specific steps before entering into a contract.
• Legal Obligation: When processing your Personal Data is necessary for us to comply with the law (excluding contractual obligations).
• Public Task: When our use of your Personal Data is necessary to perform a task in the public interest or to exercise official authority vested in the controller.
• Legitimate Interests: When our use of your Personal Data is necessary to pursue our legitimate interests or those of a third party (provided your privacy interests do not override such interests).

To the extent that we rely on your consent, no other legal basis will be invoked. Further details on when and what Personal Data we collect—as well as how and why we use it—are set out in our Privacy Policy and below.

Registering Customers

When you register with us to receive our Services (such as our web‑based services, the LMS Academy, our forum, and our conferences and webinars), we may process:

• Your contact details
• Credit card information (when you make a purchase)
• Professional information (e.g., your role and company name)
• IP address and device information
• Transaction information (e.g., purchase and subscription details or courses you follow)

We ask for this data to create and manage your account, communicate with you about your account, and provide you with the Service. We may rely on your consent, our legitimate interests, and/or the fulfilment of a contractual obligation as the legal basis for processing your Personal Data. Our legitimate interests are to provide you with the Service you have requested and to ensure we deliver it with the appropriate quality.

Providing Our Services

When you use or we provide the Service, we may process:

• Your contact details
• Professional information (such as your role and company name)
• Login and connection information used to enable the Service
• Educational information (when you sign up for the LMS Academy, conferences, or webinars)
• Your IP address and device information
• Forum posts on Asset Reality platforms (where applicable)
• Feedback provided to us
• Customer support interactions

We process this Personal Data to operate or provide the Service, carry out security checks, fulfil our commitments to you, communicate with you about your use of the Service, and generally improve the quality of the Service. We may rely on legitimate interests and/or the fulfilment of a contractual obligation as the legal basis for this processing. Our legitimate interest is to provide you with the Service that you or your company have requested.

Providing the Service to You if You Are an Agent or an End User

For end users of Asset Reality products or services, we may process:

• Your contact details
• Professional information (your role and company name)
• Login and connection information
• Educational information (when you sign up for the Asset Reality Academy, conferences, or webinars)
• Your IP address and device information
• Forum posts (where applicable)

This information is used to create and manage your account, communicate with you about your account, and provide you with the Service. We rely on legitimate interests and/or the fulfilment of a contractual obligation as the legal basis for processing your Personal Data. Our legitimate interest is to provide you with the Service you have requested.

Marketing Operations

We may process your contact details and marketing preferences to provide you with marketing communications if we believe you will be interested in our Service or if you sign up to receive such communications (for example, for webinars and conferences). Marketing activities are carried out based on:

• Your explicit consent or opt‑in (if legally required)
• Otherwise, legitimate interests and/or the fulfilment of a contractual obligation may apply

In some circumstances, we may rely on implied consent (e.g., if you have previously contacted us about our products and Services, subscribed to our Services, or declined to opt out of marketing). For additional details, please see the “Marketing Communications” section in our Privacy Policy.

Addressing Fraud and Security Threats

To prevent and detect fraud and unauthorised access to customer accounts or our Services and systems, we may process:

• Your contact details
• Professional information (such as your role and company name)
• Login and connection information
• Your IP address and device information

We rely on our legitimate interests (to minimise fraud and security issues) and/or the fulfilment of a contractual obligation as the legal basis for using this Personal Data.

Compliance Requirements

To conduct security and identity checks and comply with legal and regulatory requirements (including Know Your Customer [KYC] obligations), we may process:

• Your contact details
• Professional information (e.g., your role and company name)
• Login and connection information
• Your IP address and device information
• Transaction information

This Personal Data is used for identity and credit checks and to meet other compliance obligations. We rely on our legitimate interests and the need to comply with legal obligations as our legal basis.

Analytics

To monitor how customers and users engage with the Asset Reality website and the Service—and to make improvements—we may process:

• Your IP address
• Device information
• Transaction information
• Other user activity data

We rely on your consent (when such Personal Data is collected via non‑essential cookies, if required by law) and our legitimate interests to deliver and improve our products and services. Please refer to our Cookie Policy for further details.

Your Privacy Rights

Subject to applicable law (including relevant exemptions and exceptions), you may have the following rights concerning your Personal Data:

• Right of Access: To be provided with a copy of the Personal Data we process about you.
• Right to Rectification: To require us to modify Personal Data that you believe is inaccurate.
• Right to Erasure (Right to be Forgotten): To request that we delete your Personal Data.
• Right to Restriction of Processing: To ask us to restrict processing of your Personal Data in certain circumstances (e.g., if you contest its accuracy).
• Right to Data Portability: To receive your Personal Data in a structured, commonly used, and machine‑readable format and, in some cases, to transmit that data to a third party.
• Right to Object: To object to the processing of your Personal Data for direct marketing (including profiling) and in certain other situations, such as processing based on our legitimate interests.
• Right to Not Be Subject to Profiling: To avoid decisions based solely on automated processing (including profiling) that produce legal effects or similarly significantly affect you.

These rights do not apply to non‑UK and non‑EEA citizens, nor do they apply to anonymized data or data that does not constitute Personal Data. If you are based in the UK or EEA and wish to exercise any of these rights, please email privacy@assetreality.com with proof of your identity and address, along with details of the right you wish to exercise and the information to which your request relates. (A charge may apply to provide you with a copy of your Personal Data, as permitted by applicable law.) We will respond within 30 days to confirm that we have complied with your request, to ask for further information or an extension of time, or to explain why we are unable to comply.

Supervisory Authority

We hope to resolve any concerns you may have about our use of your Personal Data. However, if we are unable to resolve your query to your satisfaction, you have the right to file a complaint with a supervisory authority:

• United Kingdom: The Information Commissioner’s Office (ICO).
• European Economic Area: The supervisory authority in the member state where you work, normally live, or where the alleged data protection infringement occurred. A list of EEA supervisory authorities is available online.

How to Contact Us

If you have any questions about this Policy or the Personal Data we hold about you, please contact us by email at legal@assetreality.com or by postal mail at:

Data Protection Officer
Asset Reality Ltd
90a High Street
Berkhamsted, Hertfordshire
HP4 2BL
United Kingdom

Last Updated: 28 Feb 2025 | Version: 1.0

‍