EMPIQ PRIVACY NOTICE – Version 8 April 2026

Introduction

This Privacy Notice is provided by EMPIQ BV, a company with limited liability incorporated under the laws of the Netherlands. We have our official seat in Amsterdam and our registered office is at Keizersgracht 62, 1015 CS Amsterdam, the Netherlands. (Trade register number 82912521)

Minors: our services are directed at businesses and professionals. We do not knowingly collect or process personal data of individuals under 16 years of age. In accordance with Article 8 GDPR and the UAVG, if we become aware that personal data of a child under 16 has been provided to us without the consent of a parent or legal guardian, we will delete that data promptly. If you are a parent or guardian and believe your child has provided us with personal data without your consent, please contact us immediately at privacy@empiq.nl.

This Notice describes how we collect, use or otherwise process your personal data and for what purpose we may use your personal data in the context of offering and providing our legal services.

Pursuant to the General Data Protection Regulation (GDPR) - in Dutch: ‘de Algemene Verordening Gegevensbescherming’ (AVG) - we will qualify as controller with respect to the personal data that we process. As a controller we have certain duties and responsibilities regarding our processing activities, and this means that we will only process personal data that are reasonably necessary in connection with the purposes set out in this Notice.

This Notice includes information regarding your rights with respect to the processing of your personal data.

We have not appointed a data protection officer as our processing activities do not meet the mandatory criteria set out in Article 37 of the GDPR.

How do we collect your personal data?

In the context of EMPIQ’s offering and providing legal services, we may collect your personal data in the following ways:

Directly from you:

• Contact details that you provide to us as a representative of our contractual business relationship (e.g., client, supplier, service provider).
• Personal data that you provide to us as an applicant for a job at EMPIQ.
• Personal data that you provide to us when being hired by EMPIQ as an employee or as an independent professional.
• Personal data that you provide to us by filling out a request form on our website (www.empiq.nl).

Indirectly from you:

• your contact details, as provided to us by our client.
• your contact details, as provided to us by our supplier, or our service provider.

Otherwise:

• Information that we automatically collect from your use of our website, e.g., by using cookies or other technologies.

For what purposes do we use your personal data and what is our legal basis for processing?

Explanatory notes to the legal bases for processing:

• We may use your personal data for the performance of a contract in the context of our business relationship and/or in the context of the performance of contracted services
• We may use your personal data for our legitimate interests, to the extent these legitimate interests are not overridden by your interests, fundamental rights, or freedoms.
• We may process your personal data based on your consent only for processing that is completely voluntary, and therefore based on your explicit confirmation (e.g., ticking a box or signing a document), based upon clear and transparent information. Your consent can be withdrawn at any time.
• We may use your personal data to comply with a legal obligation in accordance with applicable law.

With whom do we share your personal data?

• We may share your personal data with our contracted service providers, suppliers and other third-party data processors who act on our behalf and only process personal data in accordance with our prior documented instructions. These recipients are authorised to use personal data only as necessary to provide us with their services. With whom and/or what categories of recipients your Personal data may be shared is described here below.
• Applicants:
• With suppliers who have information on your suitability (e.g., assessment and employment agencies) or provide us with information (e.g., references) at your request, such as current or former employers.
• Employees:
• With administrative bodies or organisations (e.g., social security and pension funds).
• Clients:
• With parties involved in our services (e.g., legal professionals, translation agencies).
• Website users/visitors
• Suppliers that maintain the user statistics of our website.
• Other third parties with whom personal data is shared if visitors have given consent.
• A list of our third-party data processors to whom we disclose personal data – with the associated purpose – can be requested at our operations manager (see contact details under section 7).
• We will only share personal data with third parties that guarantee to implement appropriate security measures to ensure that the processing activities meet the requirements of the applicable Data Protection Legislation and that ensure the protection of your individual rights (see under 8).
• We may share personal data with legal authorities and external advisors as necessary in connection with legal proceedings, and for investigating, detecting, or preventing criminal offences.
• Where we transfer your personal data from the Netherlands to recipients located in countries outside the EEA that are not recognised by the European Commission as having an adequate

jurisdiction, we will do so on the basis of the European Commission’s Standard Contractual Clauses (latest version 4 June 2021). The applicable Standard Clauses set out the rights and obligations for us as a responsible data controller and for the receiving data processing party to ensure appropriate data protection safeguards for the transfer to the receiving party. The Standard Clauses will also include specific technical and organizational measures implemented by the receiving party to ensure that the security of your personal data will be essentially equivalent to the GDPR requirements. Where transfers are made to countries that the European Commission has determined provide an adequate level of data protection (adequacy decisions under Article 45 GDPR), no additional safeguards are required. You have the right to request further information about the international data transfers we make and to obtain a copy of the applicable transfer safeguards. Please contact our operations manager at privacy@empiq.nl to exercise this right.

How do we secure your personal data?

We have taken appropriate technical and organisational security measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, and unauthorised access. The measures ensure the confidentiality of your personal data, and the maintenance of the integrity and availability of your personal data.

Measures include events logging of user activities on data processing systems, restricted access to networks and systems, ensuring automatic back up of personal data and its availability in the event of a security incident.

Unfortunately, no data storage system or data transmission can be guaranteed to be 100% secure. If you have reason to believe that your interaction with us is no longer secure, please notify us immediately (see contact details under 8).

Personal data breaches: In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Autoriteit Persoonsgegevens without undue delay and, where feasible, within 72 hours of becoming aware of the breach, in accordance with Article 33 GDPR. If the breach is likely to result in a high risk to your rights and freedoms, we will also communicate the breach to you without undue delay, in accordance with Article 34 GDPR, unless we have implemented appropriate technical and organisational protection measures (such as encryption) that render the data unintelligible to any unauthorised person, or we have taken subsequent measures that ensure the high risk is no longer likely to materialise.

How long do we retain your personal data?

We will not retain your personal data for any longer period than necessary or permitted by law to fulfill the purposes for which your personal data was obtained. The criteria for determining our retention periods include:

• The duration of our ongoing business relationship with you
• where we provide services and/or carry out a contract with you and/or your employer
• where you are lawfully included in our mailing list and have not unsubscribed
• Where we have a legitimate interest in processing the personal data for the purposes of operating our business and fulfilling our obligations with you and/your employer
• In compliance with legal obligations to which we are subject in the Netherlands we have statutory retainment periods:
• 7 years after the end of the relevant tax year: to keep your personal data for payroll, salary administration and tax requirements.
• A minimum period of 5 years after the end of the employment contract: to keep your employment contract.
• A minimum period of 2 years after the end of the employment contract: to keep employment related records.
• A limited period of 4 weeks after the recruitment period: for applicants that are not hired (if the applicant has consented to keep the personal data set longer: a maximum of 12 months)
• Protecting our legal position
• To preserve evidence during any applicable limitation period under Dutch law (any period during which any person could bring a legal claim against us in connection with your personal data, or to which your personal data are relevant for defending our interests in the context of judicial proceedings).
• Client and supplier contact data: retained for the duration of the business relationship and for a period of 7 years thereafter, to comply with legal obligations (including tax and accounting requirements) and to establish, exercise, or defend legal claims.
• Website usage and analytics data (cookies): retained in accordance with the cookie retention periods set out in section 10.2 above (up to 2 years for Google Analytics cookies).
• Correspondence and support records: retained for 3 years following the end of the relevant matter or relationship, to provide support and to establish, exercise, or defend legal claims.

What are your rights and how can you exercise them?

Under the Data Protection Legislation, you have the following rights that you may exercise in the context of our processing your personal data:

• The right of information about the personal data that we process about you. This includes the right to request access to, or receive copies of, your personal data, together with information regarding the nature, purposes of processing and with whom we have shared your personal data.
• The right to request rectification of any inaccuracies in your personal data.
• The right to request, on legitimate grounds:
• The erasure of your personal data and/or the right to be forgotten
• Restriction of processing of your personal data (e.g., for direct marketing purposes)
• The right to have your personal data transferred to another organisation in a structured, commonly used and machine-readable format, to the extent applicable (the right to portability).
• The right to object to processing of your personal data.
• Where processing of your personal data is based on consent, the right to withdraw your consent to such processing (this does not affect the lawfulness of any processing prior to the date of such withdrawal).
• The right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you (Article 22 GDPR). Where we carry out automated decision-making, you have the right to obtain human intervention, express your point of view, and contest the decision. We do not currently make decisions based solely on automated processing that produce legal effects or similarly significantly affect you.

Our contact details

If you wish to exercise any of your rights, you can reach us by contacting our operations manager at privacy@empiq.nl.

If you are not satisfied with the way we respond to your request, please let us know.

If you feel your rights have been violated, you may file a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens: Postbus 93374, 2509 AJ Den Haag, the Netherlands | Telephone: +31 (0)70 888 8500 | Website: https://www.autoriteitpersoonsgegevens.nl. You may also lodge a complaint with the supervisory authority in the EU member state of your habitual residence, place of work, or place of the alleged infringement.