Common use of Consent to Personal Data Processing and Transfer Clause in Contracts

Consent to Personal Data Processing and Transfer. a) By acceptance of this RSU, the Participant acknowledges and consents to the collection, use, processing, recording, organization, structuring, storage, adaption or alteration, retrieval, disclosure and transfer of personal data as described below and in accordance with the Company Group’s privacy policy. The Company Group Members hold certain personal information, including the Participant’s name, home address and telephone number, date of birth, social security number or other employee tax identification number, employment history and status, salary, nationality, job title, and any equity compensation grants or Shares awarded, cancelled, purchased, vested, unvested or outstanding in the Participant’s favor, for the purpose of managing and administering the Plan (“Data”). b) Before processing the Participant’s data for the purpose of management of an equity incentive plan, the employer will need to issue and send a notification to the Portuguese Data Protection Agency (“CNPD”). In consequence, notification of this data processing to CNPD might be advisable. c) The Company Group Members will transfer Data to any third parties assisting the Company Group in the implementation, administration and management of the Plan. The Company Group Members may also make the Data available to public authorities where required under locally applicable law. These recipients may be located in the United States, the European Economic Area, or elsewhere, which the Participant separately and expressly consents to, accepting that outside the European Economic Area, data protection laws may not be as protective as within. The Participant hereby authorizes the Company Group Members to collect, use, process, record, organize, structure, store, adapt or alter, retrieve, disclose and transfer the Data, in electronic or other form, for the purposes of implementing, administering and managing participation in the Plan, including any requisite transfer of such Data as may be required for the administration of the Plan on behalf of the Participant to a third party with whom the Participant may have elected to have payment made pursuant to the Plan. The Participant may, at any time, review Data, require any necessary amendments to it or withdraw the consent herein in writing or by e-mail contacting the Company through Participant’s local human resources representative. However, withdrawing the consent may affect the Participant’s ability to participate in the Plan and receive the benefits intended by the RSUs. Data will only be held as long as necessary to implement, administer and manage the Participant’s participation in the Plan and any subsequent claims or rights. d) When the transfer of data is made to a non-EU country, CNPD’s authorisation is required, unless it is a country listed by EU as guaranteeing an adequate level of protection. Since data will be transferred to the US, in judgment “Schrems II” of July 16, 2020 (in case C-311/18), the ECJ declared the Commission’s Implementing Decision (EU) 2016/1250 of July 12, 2016 in accordance with Directive 95/46 / EC of the European Parliament and the Council on the adequacy of the EU-US data protection shield (Privacy Shield) invalid with immediate effect, so that data transmissions to the USA cannot therefore be based on the Privacy Shield and require other guarantees, according to Art. 44 et seq. GDPR, to create an appropriate level of data protection.

Consent to Personal Data Processing and Transfer. a) By acceptance of this RSU, the Participant acknowledges and consents to the collection, use, processing, recording, organization, structuring, storage, adaption or alteration, retrieval, disclosure and transfer of personal data as described below and in accordance with the Company Group’s privacy policy. The Company Group Members hold certain personal information, including the Participant’s name, home address and telephone number, date of birth, social security number or other employee tax identification number, employment history and status, salary, nationality, job title, and any equity compensation grants or Shares awarded, cancelled, purchased, vested, unvested or outstanding in the Participant’s favor, for the purpose of managing and administering the Plan (“Data”). b) Before processing the Participant’s data for the purpose of management of an equity incentive plan, the employer will need to issue and send a notification to the Portuguese Data Protection Agency (“CNPD”). In consequence, notification of this data processing to CNPD might be advisable. c) The Company Group Members will transfer Data to any third parties assisting the Company Group in the implementation, administration and management of the Plan. The Company Group Members may also make the Data available to public authorities where required under locally applicable law. These recipients may be located in the United States, the European Economic Area, or elsewhere, which the Participant separately and expressly consents to, accepting that outside the European Economic Area, data protection laws may not be as protective as within. The Participant hereby authorizes the Company Group Members to collect, use, process, record, organize, structure, store, adapt or alter, retrieve, disclose and transfer the Data, in electronic or other form, for the purposes of implementing, administering and managing participation in the Plan, including any requisite transfer of such Data as may be required for the administration of the Plan on behalf of the Participant to a third party with whom the Participant may have elected to have payment made pursuant to the Plan. The Participant may, at any time, review Data, require any necessary amendments to it or withdraw the consent herein in writing or by e-mail by contacting the Company through Participant’s local human resources representative. However, withdrawing the consent may affect the Participant’s ability to participate in the Plan and receive the benefits intended by the RSUsthis RSU. Data will only be held as long as necessary to implement, administer and manage the Participant’s participation in the Plan and any subsequent claims or rights. d) When the transfer of data is made to a non-EU country, CNPD’s authorisation is required, unless it is a country listed by EU as guaranteeing an adequate level of protection. Since data will be transferred to the US, in judgment “Schrems II” of July 16, 2020 (in case C-311/18), the ECJ declared the Commission’s Implementing Decision (EU) 2016/1250 of July 12, 2016 in accordance with Directive 95/46 / EC of the European Parliament and the Council on the adequacy of the EU-US data protection shield (Privacy Shield) invalid with immediate effect, so that data transmissions to the USA cannot therefore be based on the Privacy Shield and require other guarantees, according to Art. 44 et seq. GDPR, to create an appropriate level of data protection.

Consent to Personal Data Processing and Transfer. a) By acceptance of this RSUthe Option, the Participant acknowledges and consents to the collection, use, processing, recording, organization, structuring, storage, adaption or alteration, retrieval, disclosure and transfer of personal data as described below and in accordance with the Company Group’s privacy policy. The Company Group Members hold certain personal information, including the Participant’s name, home address and telephone number, date of birth, social security number or other employee tax identification number, employment history and status, salary, nationality, job title, and any equity compensation grants or Shares awarded, cancelled, purchased, vested, unvested or outstanding in the Participant’s favor, for the purpose of managing and administering the Plan (“Data”). b) Before processing the Participant’s data for the purpose of management of an equity incentive plan, the employer will need to issue and send a notification to the Portuguese Data Protection Agency (“CNPD”). In consequence, notification of this data processing to CNPD might be advisable. c) The Company Group Members will transfer Data to any third parties assisting the Company Group in the implementation, administration and management of the Plan. The Company Group Members may also make the Data available to public authorities where required under locally applicable law. These recipients may be located in the United States, the European Economic Area, or elsewhere, which the Participant separately and expressly consents to, accepting that outside the European Economic Area, data protection laws may not be as protective as within. The Participant hereby authorizes the Company Group Members to collect, use, process, record, organize, structure, store, adapt or alter, retrieve, disclose and transfer the Data, in electronic or other form, for the purposes of implementing, administering and managing participation in the Plan, including any requisite transfer of such Data as may be required for the administration of the Plan on behalf of the Participant to a third party with whom the Participant may have elected to have payment made pursuant to the Plan. The Participant may, at any time, review Data, require any necessary amendments to it or withdraw the consent herein in writing or by e-mail contacting the Company through Participant’s local human resources representative. However, withdrawing the consent may affect the Participant’s ability to participate in the Plan and receive the benefits intended by the RSUsOption. Data will only be held as long as necessary to implement, administer and manage the Participant’s participation in the Plan and any subsequent claims or rights. d. The contents of the Plan and any of the documents referred to therein (including but not limited to the Grant Notice and the Agreement) When have not been reviewed by any regulatory authority in Hong Kong. Participants are advised to exercise caution in relation to the transfer offer of data Options. If Participants are in any doubt about any of the contents of this Plan, they should obtain independent professional advice. This Plan does not constitute an offer or invitation to the public within the meaning of the Companies (Winding Up and Miscellaneous Provisions) Ordinance (Cap. 32 of the Laws of Hong Kong) (the “Companies Ordinance”) or the Securities and Futures Ordinance (Cap. 571 of the Laws of Hong Kong), and it is made on terms that only the qualifying person (as defined in the Companies Ordinance) to a non-EU country, CNPD’s authorisation whom this invitation has been addressed is required, unless it is a country listed by EU as guaranteeing an adequate level of protectioneligible to apply. Since data will be transferred Options offered in relation to the USPlan may not be offered or sold in Hong Kong by means of any document, except in judgment circumstances which do not result in the document being a “Schrems IIprospectus” as defined in the Companies Ordinance or which do not constitute an offer to the public within the meaning of July 16that Ordinance. No person may issue or possess for the purposes of issue, 2020 (whether in case C-311/18)Hong Kong or elsewhere, any advertisement, invitation or document relating to Options offered in relation to the Plan, which is directed at, or the contents of which are likely to be accessed or read by, the ECJ declared public of Hong Kong (except if permitted to do so under the Commission’s Implementing Decision (EUsecurities laws of Hong Kong) 2016/1250 other than with respect to Options which are or are intended to be disposed of July 12, 2016 in accordance with Directive 95/46 / EC of the European Parliament and the Council on the adequacy of the EU-US data protection shield (Privacy Shield) invalid with immediate effect, so that data transmissions only to the USA cannot therefore be based on the Privacy Shield and require other guarantees, according to Art. 44 et seq. GDPR, to create an appropriate level of data protectionpersons outside Hong Kong.

Consent to Personal Data Processing and Transfer. a) By acceptance of this RSUOption, the Participant acknowledges and consents to the collection, use, processing, recording, organization, structuring, storage, adaption or alteration, retrieval, disclosure and transfer of personal data as described below and in accordance with the Company Group’s privacy policy. The Company Group Members hold certain personal information, including the Participant’s name, home address and telephone number, date of birth, social security number or other employee tax identification number, employment history and status, salary, nationality, job title, and any equity compensation grants or Shares awarded, cancelled, purchased, vested, unvested or outstanding in the Participant’s favor, for the purpose of managing and administering the Plan (“Data”). b) Before processing the Participant’s data for the purpose of management of an equity incentive plan, the employer will need to issue and send a notification to the Portuguese Data Protection Agency (“CNPD”). In consequence, notification of this data processing to CNPD might be advisable. c) The Company Group Members will transfer Data to any third parties assisting the Company Group in the implementation, administration and management of the Plan. The Company Group Members may also make the Data available to public authorities where required under locally applicable law. These recipients may be located in the United States, the European Economic Area, or elsewhere, which the Participant separately and expressly consents to, accepting that outside the European Economic Area, data protection laws may not be as protective as within. The Participant hereby authorizes the Company Group Members to collect, use, process, record, organize, structure, store, adapt or alter, retrieve, disclose and transfer the Data, in electronic or other form, for the purposes of implementing, administering and managing participation in the Plan, including any requisite transfer of such Data as may be required for the administration of the Plan on behalf of the Participant to a third party with whom the Participant may have elected to have payment made pursuant to the Plan. The Participant may, at any time, review Data, require any necessary amendments to it or withdraw the consent herein in writing or by e-mail contacting the Company through Participant’s local human resources representative. However, withdrawing the consent may affect the Participant’s ability to participate in the Plan and receive the benefits intended by the RSUsthis Option. Data will only be held as long as necessary to implement, administer and manage the Participant’s participation in the Plan and any subsequent claims or rights. d) When the transfer of data is made to a non-EU country, CNPD’s authorisation is required, unless it is a country listed by EU as guaranteeing an adequate level of protection. Since data will be transferred to the US, in judgment “Schrems II” of July 16, 2020 (in case C-311/18), the ECJ declared the Commission’s Implementing Decision (EU) 2016/1250 of July 12, 2016 in accordance with Directive 95/46 / EC of the European Parliament and the Council on the adequacy of the EU-US data protection shield (Privacy Shield) invalid with immediate effect, so that data transmissions to the USA cannot therefore be based on the Privacy Shield and require other guarantees, according to Art. 44 et seq. GDPR, to create an appropriate level of data protection.

Consent to Personal Data Processing and Transfer. a) By acceptance of this RSUOption, the Participant acknowledges and consents to the collection, use, processing, recording, organization, structuring, storage, adaption or alteration, retrieval, disclosure and transfer of personal data as described below and in accordance with the Company Group’s privacy policy. The Company Group Members hold certain personal information, including the Participant’s name, home address and telephone number, date of birth, social security number or other employee tax identification number, employment history and status, salary, nationality, job title, and any equity compensation grants or Shares awarded, cancelled, purchased, vested, unvested or outstanding in the Participant’s favor, for the purpose of managing and administering the Plan (“Data”). b) Before processing the Participant’s data for the purpose of management of an equity incentive plan, the employer will need to issue and send a notification to the Portuguese Data Protection Agency (“CNPD”). In consequence, notification of this data processing to CNPD might be advisable. c) The Company Group Members will transfer Data to any third parties assisting the Company Group in the implementation, administration and management of the Plan. The Company Group Members may also make the Data available to public authorities where required under locally applicable law. These recipients may be located in the United States, the European Economic Area, or elsewhere, which the Participant separately and expressly consents to, accepting that outside the European Economic Area, data protection laws may not be as protective as within. The Participant hereby authorizes the Company Group Members to collect, use, process, record, organize, structure, store, adapt or alter, retrieve, disclose and transfer the Data, in electronic or other form, for the purposes of implementing, administering and managing participation in the Plan, including any requisite transfer of such Data as may be required for the administration of the Plan on behalf of the Participant to a third party with whom the Participant may have elected to have payment made pursuant to the Plan. The Participant may, at any time, review Data, require any necessary amendments to it or withdraw the consent herein in writing or by e-mail contacting the Company through Participant’s local human resources representative. However, withdrawing the consent may affect the Participant’s ability to participate in the Plan and receive the benefits intended by the RSUsthis Option. Data will only be held as long as necessary to implement, administer and manage the Participant’s participation in the Plan and any subsequent claims or rights. d) When the transfer of data is made to a non-EU country, CNPD’s authorisation is required, unless it is a country listed by EU as guaranteeing an adequate level of protection. Since data will be transferred to the US, in judgment “Schrems II” of July 16, 2020 (in case C-311/18), the ECJ declared the Commission’s Implementing Decision (EU) 2016/1250 of July 12, 2016 in accordance with Directive 95/46 / EC of the European Parliament and the Council on the adequacy of the EU-US data protection shield (Privacy Shield) invalid with immediate effect, so that data transmissions to the USA cannot therefore be based on the Privacy Shield and require other guarantees, according to Art. 44 et seq. GDPR, to create an appropriate level of data protection.

Consent to Personal Data Processing and Transfer. a) By acceptance of this RSUthe RSUs, the Participant acknowledges and consents to the collection, use, processing, recording, organization, structuring, storage, adaption or alteration, retrieval, disclosure and transfer of personal data as described below and in accordance with the Company Group’s privacy policy. The Company Group Members hold certain personal information, including the Participant’s name, home address and telephone number, date of birth, social security number or other employee tax identification number, employment history and status, salary, nationality, job title, and any equity compensation grants or Shares awarded, cancelled, purchased, vested, unvested or outstanding in the Participant’s favor, for the purpose of managing and administering the Plan (“Data”). b) Before processing the Participant’s data for the purpose of management of an equity incentive plan, the employer will need to issue and send a notification to the Portuguese Data Protection Agency (“CNPD”). In consequence, notification of this data processing to CNPD might be advisable. c) The Company Group Members will transfer Data to any third parties assisting the Company Group in the implementation, administration and management of the Plan. The Company Group Members may also make the Data available to public authorities where required under locally applicable law. These recipients may be located in the United States, the European Economic Area, or elsewhere, which the Participant separately and expressly consents to, accepting that outside the European Economic Area, data protection laws may not be as protective as within. The Participant hereby authorizes the Company Group Members to collect, use, process, record, organize, structure, store, adapt or alter, retrieve, disclose and transfer the Data, in electronic or other form, for the purposes of implementing, administering and managing participation in the Plan, including any requisite transfer of such Data as may be required for the administration of the Plan on behalf of the Participant to a third party with whom the Participant may have elected to have payment made pursuant to the Plan. The Participant may, at any time, review Data, require any necessary amendments to it or withdraw the consent herein in writing or by e-mail contacting the Company through Participant’s local human resources representative. However, withdrawing the consent may affect the Participant’s ability to participate in the Plan and receive the benefits intended by the RSUs. Data will only be held as long as necessary to implement, administer and manage the Participant’s participation in the Plan and any subsequent claims or rights. d. The contents of the Plan and any of the documents referred to therein (including but not limited to the Grant Notice and the Agreement) When have not been reviewed by any regulatory authority in Hong Kong. Participants are advised to exercise caution in relation to the transfer offer of data RSUs. If Participants are in any doubt about any of the contents of this Plan, they should obtain independent professional advice. This Plan does not constitute an offer or invitation to the public within the meaning of the Companies (Winding Up and Miscellaneous Provisions) Ordinance (Cap. 32 of the Laws of Hong Kong) (the “Companies Ordinance”) or the Securities and Futures Ordinance (Cap. 571 of the Laws of Hong Kong), and it is made on terms that only the qualifying person (as defined in the Companies Ordinance) to a non-EU country, CNPD’s authorisation whom this invitation has been addressed is required, unless it is a country listed by EU as guaranteeing an adequate level of protectioneligible to apply. Since data will be transferred RSUs offered in relation to the USPlan may not be offered or sold in Hong Kong by means of any document, except in judgment circumstances which do not result in the document being a “Schrems IIprospectus” as defined in the Companies Ordinance or which do not constitute an offer to the public within the meaning of July 16that Ordinance. No person may issue or possess for the purposes of issue, 2020 (whether in case C-311/18)Hong Kong or elsewhere, any advertisement, invitation or document relating to RSUs offered in relation to the Plan, which is directed at, or the contents of which are likely to be accessed or read by, the ECJ declared public of Hong Kong (except if permitted to do so under the Commission’s Implementing Decision (EUsecurities laws of Hong Kong) 2016/1250 other than with respect to RSUs which are or are intended to be disposed of July 12, 2016 in accordance with Directive 95/46 / EC of the European Parliament and the Council on the adequacy of the EU-US data protection shield (Privacy Shield) invalid with immediate effect, so that data transmissions only to the USA cannot therefore be based on the Privacy Shield and require other guarantees, according to Art. 44 et seq. GDPR, to create an appropriate level of data protectionpersons outside Hong Kong.