Privacy Policy

This Policy applies to all personal data collected during your interactions with EX ANTE BV, including:

• your use of our website (www.ex-ante.be including associated subdomains);
• your use of the Ex Ante Legal Research Platform ("Platform") and associated services ("Service");
• your use of the Ex Ante Word Add-in ("Add-in"), a Microsoft Word add-in that provides access to the Platform from within Microsoft Word.

We may collect, store, and otherwise process personal data about you or, if you are a company, about your employees/representatives ("your personal data").

This Policy describes:

(i) how we collect, handle, and store your personal data; (ii) which rights you may exercise with regard to your personal data; (iii) which measures we take to protect and secure your data.

EX ANTE BV respects your privacy and acts at all times in accordance with applicable legislation, including but not limited to:

(i) the General Data Protection Regulation 2016/679 of 27 April 2016 ("GDPR"); (ii) the Belgian Privacy Act of 30 July 2018; (iii) the ePrivacy Directive 2002/58/EC of 12 July 2002, including future amendments; (iv) (future) national legislation implementing the GDPR ("Privacy Legislation").

We are EX ANTE BV, a private limited liability company established at Damstraat 144, 1800 Vilvoorde, Belgium ("Ex Ante" or "we/us").

Ex Ante develops and provides the Ex Ante Legal Research Platform ("Platform"), the associated service ("Service"), the Ex Ante Word Add-in, and owns the Website.

Under the Privacy Legislation, Ex Ante acts as the controller of your personal data. This means we are responsible for and exercise control over your personal data.

We process personal data only where necessary for specific, legitimate purposes. Depending on your interaction with Ex Ante, we may process the following data:

• Website usage: We collect data via cookies for the purpose of website optimisation.

• Use of the Ex Ante Word Add-in: When using the Add-in, we process data necessary to provide access to the Platform from within Microsoft Word, including authentication data (such as username or email address) and usage data (such as search queries and selected documents). The Add-in communicates with our servers exclusively via secure connections (HTTPS/SSL). No data is shared with Microsoft beyond what is technically required for the operation of the Add-in within the Microsoft 365 environment.

• Direct marketing: With your consent, we collect your name, company (where applicable), job title, and email address for newsletters and updates. You may unsubscribe at any time via the link at the bottom of our emails or by contacting us.

• Prospective business relationships: When you express interest in our services, we collect contact details such as name, company, job title, email address, telephone number, country, preferred language, and social media accounts, on the basis of consent or legitimate interest. We retain this data for a maximum of one year after the last contact.

• Existing client relationships: Where your employer is a client, we receive data in order to manage access to the Platform and the Add-in. In that case, your employer acts as the controller and we act as the processor. For support or general enquiries, we do act as controller. The retention period is one year after termination of the contract with the employer.

We process personal data on the following legal bases:

• Consent: For marketing purposes or upon explicit request.

• Performance of a contract: For the provision of our services to clients and users, including the operation of the Add-in.

• Legitimate interest: Where necessary for our business operations, such as direct communication with (prospective) clients or the improvement of our services. Ex Ante always carries out a balancing test between its interests and the fundamental privacy rights of the data subject.

• Legal obligation: Where processing is required by a legal obligation to which we are subject.

We retain personal data for as long as necessary for the purpose for which it was collected, unless a longer retention period is required by law. We apply the following guidelines:

• Data of prospective clients: maximum one year after last contact.
• Data of existing clients and users of the Platform or Add-in: one year after termination of the contract.
• Data processed for marketing purposes: until consent is withdrawn or a deletion request is submitted.

Upon expiry of the retention period, data is securely deleted or anonymised.

Data is only shared where necessary for our services or legal obligations. We may share data with the following parties:

• Service providers: Such as cloud providers, IT service providers, and marketing agencies, who are contractually bound by the GDPR and act solely on our instructions.

• Microsoft: The Add-in operates within the Microsoft 365 platform. Technical usage data may be processed by Microsoft in accordance with the Microsoft Privacy Statement. Ex Ante does not actively share personal data with Microsoft beyond what is necessary for the technical operation of the Add-in.

• Public authorities: Where required by law.

• Mergers and acquisitions: In the event of a transfer of our business, data may be transferred accordingly. Data subjects will be informed in advance.

We never sell your personal data to third parties.

Where data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, such as:

• Adequacy decisions by the European Commission;
• Standard Contractual Clauses (SCCs);
• Binding Corporate Rules;
• Certification mechanisms as applicable under the relevant data protection legislation.

You have the following rights with regard to your personal data:

• Right of access (Art. 15 GDPR): You may request whether and which data we process about you, and request a copy.
• Rectification (Art. 16 GDPR): You may have inaccurate or incomplete data corrected or supplemented.
• Erasure (Art. 17 GDPR): You may request the deletion of your data. Certain services may then no longer be available to you.
• Objection (Art. 21 GDPR): You may object to certain processing activities, in particular processing based on legitimate interest or for direct marketing purposes.
• Restriction (Art. 18 GDPR): You may request that processing of your data be temporarily restricted.
• Data portability (Art. 20 GDPR): You may request to receive your data in a structured, commonly used, and machine-readable format, or to have it transferred to another controller.
• Withdrawal of consent: Where processing is based on your consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out prior to withdrawal.

You may exercise these rights by contacting us as described in section 10. We will respond to your request within 30 days.

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, loss, or misuse. These measures include, among others:

• encrypted communications via HTTPS/SSL for all data transfers, including via the Add-in;
• access controls based on the need-to-know principle;
• regular evaluation and updating of our security measures.

In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you in accordance with applicable legislation.

For questions, comments, or to exercise your rights as a data subject, please contact us at:

EX ANTE BV Damstraat 144, 1800 Vilvoorde, Belgium Email: info@ex-ante.be Website: www.ex-ante.be

If you are dissatisfied with the way in which we handle your data, we invite you to contact us first so that we can seek a solution together.

You also have the right to lodge a complaint with the competent supervisory authority:

Data Protection Authority (DPA) Drukpersstraat 35, 1000 Brussels, Belgium Email: contact@apd-gba.be Website: www.dataprotectionauthority.be

You may also contact the supervisory authority of the Member State where you habitually reside or work.