GDPR & Data Subject Rights

• Right of access \u2014 obtain confirmation that we process your data, a copy of that data, and information about how it is processed.
• Right to rectification \u2014 correct inaccurate or incomplete data.
• Right to erasure (\u201cright to be forgotten\u201d) \u2014 request deletion where processing is no longer necessary or consent is withdrawn, subject to legal retention obligations.
• Right to restriction \u2014 limit how we process your data in specific circumstances.
• Right to data portability \u2014 receive your data in a structured, commonly used, machine-readable format and transmit it to another controller.
• Right to object \u2014 to processing based on legitimate interest or for direct marketing.
• Rights related to automated decision-making \u2014 request human review of decisions with legal or similarly significant effect.
• Right to withdraw consent \u2014 at any time, without affecting the lawfulness of processing before withdrawal.
• Right to lodge a complaint \u2014 with your local supervisory authority.

Send your request to dpo@vantacontainers.com or write to our EU representative in Rotterdam. Please include:

1. The right you wish to exercise.
2. Sufficient information to identify you (typically the email address linked to your Vanta account).
3. Any relevant order numbers or reference numbers.
4. Where possible, a scan of a government-issued ID (redacted). We use this only to verify identity and delete it after verification.

We acknowledge every request within 72 hours and provide a substantive response within 30 calendar days. Complex or high-volume requests may be extended by up to two additional months, in which case we will notify you and explain the reason.

Requests are handled free of charge unless they are manifestly unfounded or excessive, in which case we may charge a reasonable administrative fee or refuse the request (with a written explanation of your right to appeal).

To protect your data we must verify the identity of the requester. For account holders we typically send a confirmation link to the registered email. For third-party requests (e.g. via an authorized agent), we require written authorization and proof of the agent's identity.

When your data is transferred outside the EEA, UK, or your home country, we rely on the European Commission's Standard Contractual Clauses (2021) or an equivalent lawful transfer mechanism, together with supplementary safeguards where required. Details of our transfer mechanisms are available on request.

Data Protection Officer: dpo@vantacontainers.com

EU representative (Art. 27 GDPR): Vanta B.V., Wilhelminakade 173, 3072 AP Rotterdam, Netherlands \u00b7 eu-rep@vantacontainers.com

UK representative: Vanta UK Ltd., 1 Aldgate Square, London EC3N 1AF \u00b7 uk-rep@vantacontainers.com

You have the right to lodge a complaint with the supervisory authority in the EU/EEA member state or country of your habitual residence, place of work, or of the alleged infringement. A directory is maintained by the European Data Protection Board at edpb.europa.eu. In the UK, contact the Information Commissioner's Office at ico.org.uk.

Our lead supervisory authority for cross-border processing is the Dutch Autoriteit Persoonsgegevens (AP).

As a controller (and, for certain services, a processor), we maintain records of processing activities including categories of data subjects and data, purposes, recipients, retention periods, and security measures. Extracts are available to supervisory authorities on lawful request.

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours of becoming aware, and notify affected individuals without undue delay where the risk is high. Report suspected incidents to security@vantacontainers.com.

Business customers acting as controllers of personal data processed by Vanta on their behalf may request our standard Data Processing Addendum (DPA), which incorporates the 2021 Standard Contractual Clauses and lists our sub-processors. Email dpo@vantacontainers.com to receive a copy.