EEA/UK/CH Supplemental Privacy Statement

Scope of this Supplemental Statement

This Supplemental Privacy Statement (“Supplemental Statement”) contains additional or different information provided to persons in the European Economic Area, the United Kingdom, and Switzerland .

Unless defined specifically in this Supplemental Statement, capitalized terms shall have the meanings set forth in the Website Privacy Policy.

If you are located in the European Economic Area (EEA), the EU General Data Protection Regulation may apply to the processing of your personal data. If you are located in the United Kingdom, the UK General Data Protection Regulation may apply to the processing of your personal data. If you are located in the EEA or the United Kingdom, references to the “GDPR” below are references to the General Data Protection Regulation as it applies in the country where you are located. If you are located in Switzerland, the provisions of the Swiss Federal Data Protection Act (the “FDPA”) may apply to you, and references to the GDPR below shall be interpreted analogously for the purposes of applying the FDPA.

Controller

TheBookingRoom Group Ltd., 15 Birkmyre Road, Glasgow, G51 3JH, Scotland, UK, operates the Site and is the controller of any personal data collected or otherwise processed on or through the Site.

Purposes and Legal Bases for Processing

We process your personal data on several different legal bases, as follows:

1. Based on Necessity to Enter Into or Perform a Contract with You based on Art. 6(1)(b) of the GDPR.  We need to process your personal data to enter into an agreement with you or a legal entity you represent including our website terms and conditions, or take steps at your request prior to entering into a contract including to manage our job application process, to perform contractual obligations, to respond to related questions and requests from you, or provide customer support.
2. Based on Legitimate Interests per. Art. 6(1)(f) of the GDPR.  We process personal data from you

• for security and safety including of our information technology connected to the Site, and the users of the Site;
• to detect and prevent fraud;
• to protect and defend the rights or property of others, or our own rights and interests;
• to manage our job application process;
• manage our business operations and relationships with you and third parties;
• identify prospective customer contacts for follow-up by sales and market products and services to you
• to administer and enforce our contractual and legal rights;
• to give effect to a merger, acquisition, financing due diligence, reorganization, bankruptcy, receivership, sale of company assets, or transition of service to another provider;
• Based on Compliance with Legal Obligations per Art. 6(1)(c) of the GDPR.  We may need to process your personal data to comply with relevant laws, regulatory requirements and to respond to lawful requests, court orders, and legal process.
• Based on Your Prior Consent per Art. 6(1)(a) of the GDPR for placing cookies or using other tracking technologies on your device (subject to certain exceptions) or sending marketing communications to you. Detailed information on our use of cookies and other tracking technologies and our marketing communications to you are set forth below.

Cookies Used on the Site

The Site makes use of cookies and other tracking technologies. Cookies are small text files downloaded by your Internet browser and stored on the device you use to access the Site (e.g., your desktop computer, tablet or smartphone). Depending on their purpose, cookies log specific user-related information such as your user preferences, authentication information, security parameters, data concerning the device you access the Site with and statistical information regarding your use of the Site. Where necessary during your visit of the Site or when revisiting the Site, your Internet browser transmits the cookies including the contained information back to the servers they were initially downloaded from or created by. The analysis and processing of such information allows us to ensure the functionality of the Site, improve your online experience and optimize the structure and content of the Site.

The cookies we use can be categorized as follows:

Strictly Necessary Cookies	These are cookies that are required for the operation of the Site or of certain parts thereof. They either serve the sole purpose of carrying out network transmissions or are strictly necessary in order for us to provide an online service explicitly requested by you.
Analytical/Performance Cookies	These cookies allow us to carry out web analytics or other forms of audience measuring such as recognizing and counting the number of visitors and seeing how visitors move around the Site. This helps us to improve the way the Site works, for example, by ensuring that users are easily finding what they are looking for.
Functionality Cookies	These cookies are used to recognize you when you return to the Site. This enables us to personalize our content for you, greet you by name and remember your preferences (for example, your choice of language or region). Loss of the information in these cookies may make our services less functional but would not prevent the Site from working.

Detailed information about the cookies used on the Site can be found here.

You may influence the scope and extent to which we use cookies when you visit our Site. In particular, you may prevent cookies from being stored on your device by adjusting the respective settings on your Internet browser. For more information on how to do so in the settings of your particular Internet browser, please see the following information:

• Internet Explorer:  https://privacy.microsoft.com/en-us/internet-explorer-ie11-preview-privacy-statement 
• Chrome:  https://www.google.com/intl/en/chrome/browser/privacy/ 
• Firefox:  https://support.mozilla.org/en-US/products/firefox/protect-your-privacy 
• Safari:  http://www.apple.com/privacy/manage-your-privacy/ 

However, please be aware that this might render certain functions of our Site inoperable or more difficult to use. Depending on the Internet browser you use, you might also be able to specifically reject third-party cookies. In this context, please note, however, that third parties might still have access to your personal data to the extent that such information is logged by first-party cookies.

Marketing Communications to You

With your consent, we may periodically send promotional emails about new products, special offers or other information which we think you may find interesting using the email address which you have provided. From time to time, we may also use your information to contact you for market research purposes. We may contact you by email, phone or mail.  

In addition, if you are located in a jurisdiction where a double opt-in procedure is used (e.g., Germany), we verify the authorized use of an email address by sending an email to such address asking for confirmation. Only upon such confirmation will we send newsletters or similar information to the confirmed email address.

When requesting to receive newsletters or similar information, you explicitly declare your consent to our processing of your personal data for this purpose. You are under no obligation to provide such consent and, if you choose to do so nonetheless, you may withdraw your consent at any time, with future effect and for any or no reason by contacting us at privacy@tbrglobal.com or by following the unsubscribe link contained in any email communication sent to you.

Recipients of Your Personal Data

We disclose your personal data to the following third parties for the following purposes, as required or permitted by applicable law:

Who Is your Personal Data Disclosed To?	What Is the Purpose Underlying the Disclosure?
Wholly owned subsidiaries of TheBookingRoom Group Ltd. located in the European Economic Area, the UK and Switzerland	To coordinate and improve local marketing and user support activities in the local jurisdiction
Third-party providers of web analytics and solutions found here.	To assist us in the operation or improvement of the Site and to enhance our products and services
Other third parties consistent with applicable legal requirements	To provide requested services and comply with legal obligations to which we are subject

Data Transfers to Recipients Outside of the EEA/UK/CH

TheBookingRoom Group Ltd. is located in the UK and is governed by UK law. Your personal data will be transferred to, stored, and processed internationally. 

To ensure an adequate level of protection of your personal data, we enter into data processing and data transfer agreements with our affiliated companies and third-party service providers outside of the EEA/UK/CH that incorporate the provisions of the Standard Contractual Clauses approved by the EU Commission or implement other appropriate safeguards with them. You can ask for a copy of such appropriate safeguards by contacting us at privacy@tbrglobal.com.

How Long We Keep Your Personal Data

We have implemented appropriate retention periods for your personal data collected or otherwise processed on or through the Site as set forth in our records management policy. Personal data processed in the context of a contract with you will be retained by us for the term of the contract and for a reasonable time afterwards as might be required to determine and settle any related claims. Where our processing of your personal data is based on legitimate interests or the compliance with legal obligations, it will be deleted as soon as the underlying purpose has expired. Personal data processed based on your consent will be deleted if and when you withdraw such consent.

Your Rights Regarding the Processing of Your Personal Data

Under applicable law, you may have the following rights in relation to your personal data. These may be limited under applicable data protection law.

(i) Right to request from us access to personal data: You have the right to confirm with us whether your personal data is processed, and if it is, to request access to that personal data including the categories of personal data processed, the purpose of the processing and the recipients or categories of recipients. You have the right to obtain a copy of the personal data undergoing processing. However, this is not an absolute right and the interests of other individuals may restrict your right of access. 

(ii) Right to rectification: You have the right to obtain from us rectification of inaccurate or incomplete personal data concerning you. Depending on the purposes of the processing, you may have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

(iii) Right to erasure of your personal data (right to be forgotten): You have the right to ask us to erase personal data concerning you.

(iv) Right to restriction of processing: In limited circumstances, you have the right to request that we restrict processing of your personal data.

(v) Right to data portability: You may have the right to receive personal data concerning you, which you have provided to us, in a structured, commonly used, and machine-readable format and you may have the right to transmit that personal data to another entity without hindrance from us.

(vi) Right to object: Under certain circumstances you may have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data, by us and we can be required to no longer process your personal data.

Moreover, if your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing. In this case your personal data will no longer be processed for such purposes by us.

You may exercise the above mentioned rights by contacting us at privacy@tbrglobal.com.

You also have the right to lodge a complaint with a supervisory authority, but we encourage you to first contact us with any questions or concerns. You may view a list of supervisory authorities in the EEA, UK and Switzerland and their respective contact information here: 

• EEA: https://edpb.europa.eu/about-edpb/board/members_en
• United Kingdom: https://ico.org.uk/global/contact-us/

Switzerland: https://www.edoeb.admin.ch/en/contact-2 

Do You Have to Provide Personal Data?

There is no law or contract stating that individuals in the EEA/UK/CH have to use our services or products or apply for a job with us. We will try to tell you what personal data we need from you to provide certain services or products or a certain level of quality of services or products to you. In those cases, if you do not provide the personal data that we request from you, we will not be able to provide you with the services or products, or level of quality of services or products, that you request from us. We may also be unable to process your job application if you choose to apply. An exception applies if and to the extent that you want to enter into or perform a contract with us on or through the Site. In that case, providing us with your related personal data is necessary for us to be able to enter into the contract with or provide any contractual services to you. 

Effective Date and Changes

This Supplemental Statement is effective October 15, 2025. We may make changes, including material changes, to this Supplemental Statement from time to time. You should review the Supplemental Statement each time you visit our Site to learn of any changes.

If you have any questions or suggestions regarding this Supplemental Statement, please contact us at privacy@tbrglobal.com.