Common use of Description of the Transfer Clause in Contracts

Description of the Transfer. Data subjects The personal data transferred concern the following categories of data subjects: • Named user of the Sedex Advance platform • Named contact for a Member or Affiliate Audit Company • Named contact for a site or facility to be assessed or audited • Named Affiliate Audit Company, verifier, assistant or other individual involved in conducting an assessment, audit or verification • Individual identified in an audit report • Individual identified in a Self Assessment Questionnaire (SAQ) module • Any other individuals about whom data is provided to Sedex by the Member or Affiliate Audit Company for use in conjunction with the Service Purposes of the transfer(s) The transfer is made for the following purposes: • To deliver, operate or receive the Service • To provide notifications, reminders and operational communications • To provide newsletters, product announcements, briefings and other relevant communications • To allow a Member to assess compliance with its labour, health and safety, business ethics, environmental and other standards • To allow a Member to assess its suppliers, and its suppliers’ sites and facilities • To allow an Affiliate Audit Company to conduct audits and manage the audit process • To validate the certification and accreditation held by an Affiliate Audit Company, verifier, assistant or other individual involved in conducting an assessment, audit or verification • To monitor, evaluate and improve the quality of data processed by the Sedex Advance Platform Categories of data The personal data transferred concern the following categories of data: • Personal data relating to the Data Subjects, including title, name, business email address, business telephone number and business address Recipients The personal data transferred may be disclosed only to the following recipients or categories of recipients: • To the Data Importer’s responsible employees, consultants, professional advisers, sub-contractors or suppliers and any third parties engaged by the Data Importer to perform obligations in connection with this Agreement Sensitive data (if appropriate) The personal data transferred concern the following categories of sensitive data: • None Data protection registration information of data exporter (where applicable) Additional useful information (storage limits and other relevant information) Contact points for data protection enquiries Data importer Data exporter

Description of the Transfer. (To be completed by the parties) Data subjects The personal data transferred concern the following categories of data subjects: • Named user of the Sedex Advance platform • Named contact for a Member or Affiliate Audit Company • Named contact for a site or facility to be assessed or audited • Named Affiliate Audit Company, verifier, assistant or other individual involved in conducting an assessment, audit or verification • Individual identified in an audit report • Individual identified in a Self Assessment Questionnaire Farfetch Customers who make purchases using xxxxxxxx.xx and xxxxxxxx.xxx/xx websites and data importer’s cross-border payment service system (SAQ“Payment System”) module • Any other individuals about whom data is provided to Sedex by the Member or Affiliate Audit Company for use in conjunction with the Service Purposes of the transfer(s) The transfer is made for the following purposes: • To deliver, operate or receive enable Data Importer to enforce the Service • To provide notifications, reminders payments done through data importer’s Payment System against Farfetch Customers which do not comply with the terms and operational communications • To provide newsletters, product announcements, briefings and other relevant communications • To allow a Member to assess compliance with its labour, health and safety, business ethics, environmental and other standards • To allow a Member to assess its suppliers, and its suppliers’ sites and facilities • To allow an Affiliate Audit Company to conduct audits and manage the audit process • To validate the certification and accreditation held by an Affiliate Audit Company, verifier, assistant or other individual involved in conducting an assessment, audit or verification • To monitor, evaluate and improve the quality conditions of data processed by the Sedex Advance Platform importer’s Payment System. Categories of data The personal data transferred concern the following categories of data: • Personal data relating The registered email address of the User (provided that such User has given explicit consent to Party A for sharing the Data SubjectsUser’s email address to Party B), including titlename and telephone of the recipient, name, business email shipping address, business telephone in case of chargeback, User’s name and phone number to Baitiao Service Provider (provided that the User has given explicit consent to Party A for sharing such personal sensitive information to Party B), only if such personal data is necessary for data importer to perform its obligations under the Agreement on Cross-border Foreign Exchange Payment between data exporter and business address data importer. Recipients The personal data transferred may be disclosed only to the following recipients or categories of recipients: • To the Data Importer’s responsible employees, consultants, professional advisers, sub-contractors or suppliers Baitiao Service Provider for providing Baitiao Payment and any third parties engaged by the Data Importer Baitiao Instalment to perform obligations in connection with this Agreement Users Sensitive data (if appropriate) The personal data transferred concern the following categories of sensitive data: • None Not applicable Data protection Protection registration information of data exporter (where applicable) Registered at the Information Comissioner’s Office (ICO), in the United Kingdom, under the registry number Z3100721 Additional useful information (storage limits and other relevant information) Data Importer to store the personal data transferred to the extent of time strictly necessary to pursue the abovementioned purpose and to delete the personal data after such time period elapses. Contact points for data protection enquiries enquires Data importer Data exporterexporter Farfetch Group Privacy Team xxxxxxx@xxxxxxxx.xxx

Description of the Transfer. Data subjects The personal data transferred concern the following categories of data subjects: • Named user of the Sedex Advance platform • Named contact for a Member or Affiliate Audit Company Auditor • Named contact for a site or facility to be assessed or audited • Named Affiliate Audit Companyauditor, verifier, assistant or other individual involved in conducting an assessment, audit or verification • Individual identified in an audit report • Individual identified in a Self Assessment Questionnaire (SAQ) module • Any other individuals about whom data is provided to Sedex by the Member or Affiliate Audit Company Auditor for use in conjunction with the Service Purposes of the transfer(s) The transfer is made for the following purposes: • To deliver, operate or receive the Service • To provide notifications, reminders and operational communications • To provide newsletters, product announcements, briefings and other relevant communications • To allow a Member to assess compliance with its labour, health and safety, business ethics, environmental and other standards • To allow a Member to assess its suppliers, and its suppliers’ sites and facilities • To allow an Affiliate Audit Company Auditor to conduct audits and manage the audit process • To validate the certification and accreditation held by an Affiliate Audit Companyauditor, verifier, assistant or other individual involved in conducting an assessment, audit or verification • To monitor, evaluate and improve the quality of data processed by the Sedex Advance Platform Categories of data The personal data transferred concern the following categories of data: • Personal data relating to the Data Subjects, including title, name, business email address, business telephone number and business address Recipients The personal data transferred may be disclosed only to the following recipients or categories of recipients: • To the Data Importer’s responsible employees, consultants, professional advisers, sub-contractors or suppliers and any third parties engaged by the Data Importer to perform obligations in connection with this Agreement Sensitive data (if appropriate) The personal data transferred concern the following categories of sensitive data: • None Data protection registration information of data exporter (where applicable) Additional useful information (storage limits and other relevant information) Contact points for data protection enquiries Data importer Data exporter

Description of the Transfer. (To be completed by the parties) Data subjects The personal data transferred concern the following categories of data subjects: • Named user Customers and employees of the Sedex Advance platform • Named contact for a Member or Affiliate Audit Company • Named contact for a site or facility to be assessed or audited • Named Affiliate Audit Company, verifier, assistant or other individual involved in conducting an assessment, audit or verification • Individual identified in an audit report • Individual identified in a Self Assessment Questionnaire (SAQ) module • Any other individuals about whom data is provided to Sedex by the Member or Affiliate Audit Company for use in conjunction with the Service importer customers Purposes of the transfer(s) The transfer is made for the following purposes: • To deliver, operate or receive So that data importer may perform services as specified in the Service • To provide notifications, reminders and operational communications • To provide newsletters, product announcements, briefings and other relevant communications • To allow a Member to assess compliance with its labour, health and safety, business ethics, environmental and other standards • To allow a Member to assess its suppliers, and its suppliers’ sites and facilities • To allow an Affiliate Audit Company to conduct audits and manage the audit process • To validate the certification and accreditation held by an Affiliate Audit Company, verifier, assistant service agreement or other individual involved in conducting an assessment, audit or verification • To monitor, evaluate and improve order documents between the quality of data processed by the Sedex Advance Platform parties Categories of data The personal data transferred concern the following categories of data: • Personal data relating to the Data SubjectsName, including title, name, business email address, business postal address, telephone number and business address fax number(s), IP address, usernames and related account information, job title, employer, payment details Recipients The personal data transferred may be disclosed only to the following recipients or categories of recipients: • To the Data Importer’s responsible employees, consultants, professional advisers, Employees and agents of data importer and sub-contractors or suppliers and any third parties processors engaged by the Data Importer data importer to perform obligations in connection with this Agreement requested services for data exporter Sensitive data (if appropriate) The personal data transferred concern the following categories of sensitive data: • None Data protection registration information of data exporter (where applicable) [to be provided by Customer, where applicable] Additional useful information (storage limits and other relevant information) Data importer subjects transferred personal data to the following basic processing activities: Collection, recording, organization, storage, retrieval, consultation, disclosure by transmission, and other processing in order to contact and liaise with customers and customer employees, enable such individuals to create and access accounts to operate our services, and to validate credentials provided to confirm the authenticity of web-services to enable data importer to perform requested services. Personal data is retained by data importer until the termination of the governing service agreement between the parties or until appropriately requested by a data subject; subject to the data retention requirements specified in data importer’s public privacy notice governing its certificate services (located at xxxxx://xxx.xxxxxxxxxxx.xxx/privacypolicy.aspx and updated from time to time). Contact points for data protection enquiries Data importer Data exporterinquiries

Description of the Transfer. Data subjects The personal data transferred concern the following categories of data subjects: • Named user of the Sedex Advance platform • Named contact for a Member or Affiliate Audit Company Auditor • Named contact for a site or facility to be assessed or audited • Named Affiliate Audit Companyauditor, verifier, assistant or other individual involved in conducting an assessment, audit or verification • Individual identified in an audit report • Individual identified in a Self Assessment Questionnaire (SAQ) module • Any other individuals about whom data is provided to Sedex by the Member or Affiliate Audit Company Auditor for use in conjunction with the Service Purposes of the transfer(s) The transfer is made for the following purposes: • To deliver, operate or receive the Service • To provide notifications, reminders and operational communications • To provide newsletters, product announcements, briefings and other relevant communications • To allow a Member to assess compliance with its labour, health and safety, business ethics, environmental and other standards • To allow a Member to assess its suppliers, and its suppliers’ sites and facilities • To allow an Affiliate Audit Company Auditor to conduct audits and manage the audit process • To validate the certification and accreditation held by an Affiliate Audit Companyauditor, verifier, assistant or other individual involved in conducting an assessment, audit or verification • To monitor, evaluate and improve the quality of data processed by the Sedex Advance Platform Categories of data The personal data transferred concern the following categories of data: • Personal data relating to the Data Subjects, including title, name, business email address, business telephone number and business address Recipients The personal data transferred may be disclosed only to the following recipients or categories of recipients: • To the Data Importer’s responsible employees, consultants, professional advisers, sub-contractors or suppliers and any third parties engaged by the Data Importer to perform obligations in connection with this Agreement Sensitive data (if appropriate) The personal data transferred concern the following categories of sensitive data: • None Data protection registration information of data exporter (where applicable) Additional useful information (storage limits and other relevant information) Contact points for data protection enquiries Data importer Data exporter)