GEM REAL ESTATE PRIVACY POLICY

This is the privacy policy of GEM Real Estate Holding B.V. (hereafter: “GEM”). GEM
is located at Persijnlaan 14 (2245 CJ) in Wassenaar and is registered in the trade
register of the Chambers of Commerce under number 92288391. GEM processes
personal data. This means that we collect, store, and transmit personal data. GEM is
the data controller for the processing of your personal data. This privacy policy
applies to GEM and its subsidiaries.

1. Contents of the Privacy Policy
This privacy policy explains how GEM processes personal data. It explains for which
purposes and on what legal grounds we process personal data. We also explain to
whom we disclose personal data, how long we retain personal data, and how we
protect them. Furthermore, this privacy policy contains important information about
your rights regarding the processing of your personal data. We recommend that you
read this privacy policy carefully.

2. How do we collect personal data about you?
We may collect personal data about you in various ways:
- Directly from you, for example, when you contact us directly or provide them to
us;
- From third parties who provide them to us, for example, when you work for
these parties;
- From other sources, such as the land registry, the trade register, commercial
databases, and other public sources;
- Directly from you, when you visit our website (GEM.nl);
- Through cookies, see our cookie usage statement.

3. For what purposes do we process personal data?
We process personal data for the following purposes:
- To enter into or perform an agreement with you, for example, to contact you;
- To comply with legal or fiscal obligations;
- To inform you about our activities, for example, by sending you press releases;
- To promote our activities, for example, by sending you newsletters or inviting
you to an event, lunch, or reception;
- To answer your questions and requests or handle your complaints;
- To allow you to use all functionalities of our website and to improve it;
- For the purpose of your job application;
- In case of disputes with GEM.

4. On what legal grounds do we process personal data?
We process personal data if necessary on the following legal grounds:
- Based on a legitimate interest of GEM;
- For entering into and performing an agreement;
- To comply with a legal or fiscal obligation;
- Based on your consent.
If we process your personal data based on your consent, you can always withdraw
this consent. You can contact GEM for this (correspondence address Persijnlaan 14,2245 CJ Wassenaar or by email at info@gem.nl or by phone at +31 (0)70 217 217 0).

5. With whom do we share your personal data?
We sometimes share your personal data with third parties who perform work for us.
This includes, for example, technical managers, maintenance companies, IT service
providers, payroll administration, legal/tax service providers, accountants, appraisers,
recruiters. We may also share your personal data with GEM-affiliated companies. Additionally,
we may have a legal obligation to disclose data. We will ensure that appropriate
measures are taken to protect your personal data when we disclose them to third
parties. These measures may include entering into a data processing agreement.

6. How long do we retain your personal data?
GEM retains your personal data no longer than necessary for the purposes for which
the personal data were collected and processed. Relevant factors in determining the
retention period include compliance with legal and fiscal obligations, limitation
periods, and the duration of disputes.

7. How do we protect your personal data?
We will take the necessary administrative, technical, and organizational measures to
ensure a security level appropriate to the specific risks we have identified. We protect
your personal data against destruction, loss, alteration, unauthorized disclosure of or
access to personal data transmitted, stored, or otherwise processed. We also strive
to keep your personal data accurate and up-to-date. Therefore, we kindly ask you to
notify us of any changes to your personal data (such as a change in your contact
details).

8. What are your rights and how can you exercise them?
You have the right:
- To information about and access to your personal data;
- To rectification of your personal data;
- To erasure of your personal data (“right to be forgotten”);
- To restriction of the processing of your personal data;
- To object to the processing of your personal data;
- To receive your personal data in a structured, commonly used, and machine-
readable format, and to transmit those data to another controller.

These rights may be limited in certain situations. For example, if we have a legal
obligation to process personal data. Before you can exercise these rights, you must
adequately identify yourself so that we can verify your identity.

9. Changes, complaints, and questions
This privacy policy may change, for example, when new developments give rise to it.
The most recent version of this privacy policy is always available on our website:
GEM.nl. We recommend consulting this privacy policy regularly to stay informed of
any changes. You can also request a copy of the most recent version of this policy.
We will send it to you free of charge.
We are happy to assist you if you have a complaint about the processing of your
personal data. You also have the right to file a complaint with the privacy supervisor:
the Dutch Data Protection Authority via the complaint form of the Dutch Data
Protection Authority: https://autoriteitpersoonsgegevens.nl/nl/contact-met-de-autoriteit-
persoonsgegevens/tip-ons If you have questions, comments, or complaints about this privacy policy or the
processing of your personal data, you can contact GEM (correspondence address
Persijnlaan 14, 2245 CJ Wassenaar or by email at info@gem.nl or by phone at +31
(0)70 217 217 0).

10. Language
If a translation of this privacy policy is made, the Dutch text will prevail in case of
differences between the Dutch text and the translation.