1.1. This privacy policy (the “Privacy Policy“) sets out:

• the Personal Data which CT Holdings and Services Limited (“CTHS”) will collect in relation to a Participant’s representatives (we refer to this as “Participant Personal Data“); and
• how CTHS will use, store and process Participant Personal Data.

1.2. In the UK, the Data Protection Act 2018 (“DPA or “data protection law“) governs the collection and use of personal data. In this Privacy Policy the terms “personal data”, “processing” “controller”, “processor” and “data subject” will have the meanings given in the DPA.

1.3 CTHS will keep this Privacy Policy under regular review and reserves the right to change it at any time on notice to the Participants. CTHS will notify Participants of any changes to this Privacy Policy by email if:

• CTHS is making substantial changes; or
• CTHS proposes to use personal data in a different way than as described in this Privacy Notice.

Non-substantial updates to this Privacy Notice will be notified to Participants by posting details on the STAR Website.

1.4 In this Privacy Policy “Participant’s Representatives” in relation to each Participant means:

• the corporate representative appointed by such Participant for purposes of correspondence;
• the representatives of such Participant’s operational team and senior management to whom Disputes will be referred;
• any other individual representative of such Participant; and
• any individual agent for such Participant with whom STAR or any other Participant is expected to deal.

1.5 For the purposes of data protection law, CTHS is the controller of Participant Personal Data that is processed for the purposes of the STAR initiative. However, each Participant is a controller in its own right of the personal data relating to their respective Representatives and such Processing will be governed by that Participant’s privacy policy.

2.1 CTHS will collect, from each Participant, Participant Personal Data, including the name, address, telephone number and email contact details for each Participant Representative, for use by CTHS and/or other Participants. Each Participant will promptly update STAR on any changes to the personal data in relation to its Representatives notified to STAR.

2.2 Each Participant must obtain all necessary authority from each of its Representatives for the communication of the relevant Participant Personal Data to STAR for use in accordance with this Privacy Policy (as amended from time to time in accordance with its terms), and undertakes to keep each of its Representatives informed as to how their personal data may be used.

2.3 STAR does not require any “special category” personal data (as defined under data protection law) for STAR purposes, and accordingly requests each Participant not to communicate (and to procure that none of its Representatives communicate) to CTHS any personal details revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation or commission (or alleged commission) of any offence or proceedings for any offence committed (or alleged to have been committed) by such Participant Representative or the disposal of such proceedings or sentence in such proceedings.

2.4 In addition to collecting Participant Personal Data directly from Participants, CTHS may collect personal data in the following ways:

• CTHS may monitor or record any communications with any Participant Representative to improve its services and/or for security and/or regulatory purposes.
• STAR may make recordings of meetings, which shall involve the collection of personal data about those who have attended the meeting (including any expression of opinion) and about any third parties about whom an opinion is expressed. This is being carried out for the purposes of ensuring minutes are accurate and to verify the accuracy of what has been said at meetings. CTHS will permit the Chair and Deputy Chair to access the recordings for these purposes or where required for legal reasons or regulatory purposes. CTHS will retain the recordings for a period of 6 months (subject to any open matter/ ongoing investigation, litigation or audit that requires a specific recording to be retained for longer).

2.5 If any application to become a Participant of STAR is rejected, CTHS may retain personal data relating to any individual who would have been a Participant Representative had the application been successful. This personal data will normally be retained for no more than 6 months, unless there is a specific need to retain the personal data for longer.

3.1 Data protection law requires that CTHS meets certain conditions before STAR is allowed to use any Participant Personal Data. CTHS relies on a condition known as “legitimate interests” in order to process the Participant Personal Data for specified purposes. For example, it is in CTHS’s legitimate interests to Process Participant Personal Data where it is required by CTHS in connection with the following purposes (together the “STAR Purposes“):

• giving notice to each Participant of notices required or permitted to be given pursuant to the Participation Agreement;
• organising and administering working groups, events open to Participants and distributing communications to Participants;
• managing user access permissions in respect of the STAR website; and
• as otherwise required for the proper operation of STAR in accordance with the Participation Agreement.

3.2 CTHS also uses personal data to meet its legal obligations, for example to hold necessary information as part of CTHS’s data protection impact assessments and compliance programme record-keeping obligations.

3.3 Where CTHS is relying on “legitimate interests”, CTHS will ensure that the collection and processing of Participant Personal Data:

• is kept to a minimum with regards to the amount of data collected and the extent of any processing;
• will not be overly intrusive; and
• will be proportionate in order to meet STAR’s legitimate interests, as above.

3.4 All other Participants will have the right to access and use Participant Personal Data for the purposes of the STAR initiative, including resolution of disputes, and to give notices to any other Participant in accordance with the Servicing Agreement.

3.5 CTHS will only disclose Participant Personal:

• to other Participants in connection with the Servicing Agreement (see paragraph 4 above);
• to personnel of TeX, TISA or Criterion who are assisting CTHS in the delivery of STAR;
• to CTHS’s advisers and third parties providing IT, administrative and professional services to CTHS. Before sharing Personal Data with any such third party, CTHS will require such third party to undertake to process such personal data only in accordance with CTHS’s instructions and to provide guarantees in respect of the technical and organisational security measures protecting its data processing activities; and/or
• where CTHS is lawfully permitted or under a legal obligation to disclose, for example under a court order or pursuant to a regulatory request, or to bring or defend legal proceedings.

4.1 CTHS will not transfer, Process or store Participant Personal Data in a country outside the UK or the EEA unless:

• there has been a finding by the European Commission (or in the case of transfer from the UK by the United Kingdom Government) that such recipient country ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data transferred to such country;
• CTHS has first put in place appropriate contractual arrangements which meet the requirements of data protection law (such as the relevant EU Standard Contractual Clauses approved by the European Commission or Standard Contractual Clauses approved by the ICO); or
• CTHS has first put in place appropriate measures as may be agreed from time to time by the Participants affected by the proposed transfer (each Participant acting on behalf of its Participant Representatives) and CTHS.

5.1 Under data protection law, Participant Representatives have the following data subject rights in relation to their personal data:

• the right to have personal data rectified if inaccurate/incomplete;
• the right to object to processing, including the right to object to direct marketing;
• the right to have personal data erased or removed, and where the personal data has been made public, that other controllers processing the personal data also erase links to, or copy or replication of, such personal data;
• the right to restrict the processing of personal data;
• the right of data portability, namely, to obtain and reuse personal data for each Participant Representative’s own purposes across different services;
• the right to not be subjected to automated decision making (including profiling) where it produces a legal effect or a similarly significant effect; and
• the right to bring a civil action if there is a breach of data protection law.

5.2 Each Participant Representative has the right to request access to, and receive a copy of, the personal data held about them.

5.3 To exercise a data subject right under the data protection law, each Participant Representative should make a request in writing to STAR’s Company Secretary at Dakota House, 25 Falcon Court, Preston Farm Business Park, Stockton-on-Tees, TS18 3TY, UK.

6.1 In the unlikely event that any or all of the operations of CTHS are sold or otherwise transferred to another entity (the “Transferee“), the Participant Personal Data may be transferred to the Transferee for its continued use, storage and processing in accordance with this Privacy Policy.

7.1 We will keep Participant Personal Data for as long as we have a relationship with you, and for a period of twenty-eight (28) days thereafter. We will only retain Participant Personal Data after this time if we are required to do so to comply with the law, or if there are outstanding claims or complaints that will reasonably require Participant Personal Data to be retained.

8.1 CTHS has implemented various technical and organisational measures designed to protect personal data against unauthorised or unlawful processing. The systems we use to store personal data are compliant with ISO27001 and we ensure that third party data storage providers also meet this standard.

9.1 If any Participant, or any Participant Representative, has any queries in relation to this Privacy Policy, they should contact the CTHS Company Secretary on 0044 (0)1642 666989 or at the address set out in Paragraph 5.3.

9.2 If any Participant, or any Participant Representative, is not happy with the way in which personal data is held or Processed by CTHS, or if any Participant, or any Participant Representative is not satisfied with CTHS’s handling of any request in relation to the rights of data subjects, CTHS request that in the first instance a complaint is made to the CTHS Company Secretary at the contact details set out above. However, any Participant, or Participant Representative, always has the right to complain regarding data protection matters to the ICO. The ICO is the UK’s independent body set up to uphold information rights. More about the ICO (including how to make a complaint) can be found on its website (https://ico.org.uk/).