1. Scope

Protecting the security and privacy of your personal data is important to Idox plc and all its group companies (the "Idox Group"). Therefore, the Idox company referred to under corporate information on the website ("Idox") operates this website in compliance with applicable laws on data privacy protection and data security. My Funding Central is an Idox funding solution created by the Idox Group. Idox Group is the controller and is responsible for your personal data in this privacy statement.

This Privacy Policy covers the collection, use and disclosure of information through our websites. Throughout this Privacy Policy we'll refer to our corporate website and any other Idox group brand websites or subdomains and country-level domain variants that link to this Privacy Policy collectively as our "Site".

This Privacy Policy provides an explanation as to what happens to any personal data that you provide to us, or that we collect from you. We describe our use of your personal information, where your personal information is stored, how long we will retain your personal information, our use of third-party processors and our policy on the sharing of your personal information.

In order to prevent unauthorised access or disclosure, we have put in place suitable physical, electronic and managerial procedures to safeguard and secure the personal data we collect.

• We are considerate about the personal information we ask you to provide and the personal information that we collect about you through the operation of our services.
• We store personal information only for as long as we have a reason to keep it.
• We aim for full transparency on how we gather, use, and share your personal information.
• Idox acknowledges the rights of individuals to whom the personal data relates and ensures that these rights can be exercised in accordance with the Data Protection Legislation.

Idox's processing of personal data and privacy is in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679) as it forms part of domestic law in the United Kingdom by virtue of section 3 of the European Union (Withdrawal) Act 2018 (including as further amended or modified by the laws of the United Kingdom or a part of the United Kingdom from time to time) ("GDPR").

In this policy, "Data Protection Legislation" refers to the GDPR, and the Data Protection Act 2018 to the extent that it relates to the processing of personal data and privacy and all applicable Law about the processing of personal data and privacy.

In the above statement, 'Law' means any law, subordinate legislation within the meaning of Section 21(1) of the Interpretation Act 1978, bye-law, enforceable right within the meaning of Section 2 of the European Communities Act 1972, regulation, order, regulatory policy, mandatory guidance or code of practice, judgement of a relevant court of law, or directives or requirements with which Idox is bound to comply.

2. Our legal basis for processing your personal data

We will only use your personal data when the Data Protection Legislation allows us to do so. Most commonly, we will use your personal data in the following circumstances:

• We need to use the information to perform a contract with you;
• The processing is necessary for your legitimate interests, Idox Group's legitimate interests or the legitimate interests of a third party, where there is no disadvantage to you.
• We have asked for your specific consent to use your personal data and you have given us that consent;
• We have legal obligations, which requires us to process your personal data; or

Please note that we may process your personal data for more than one legal basis depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific legal basis we are relying on to process your personal data.

3. Information we collect

We may collect, use, store and transfer different types of personal data about you, including:

• Identity data (your name, your contact details and your email address);
• Technical data (internet protocol (IP) address, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access this website);
• Usage data (information about how you use our website and products);
• Marketing data (your preferences in receiving marketing communication from us and our third parties and your communication preferences);
• Login timestamp;
• Logout timestamp;
• Each search (including search criteria) that you perform. This is timestamped;
• Each fund that you view, timestamped;
• Each news item that you view, timestamped;
• Each report that you download;
• Email alert activity including tracking links that you clicked upon and when an email has been opened;. and
• Any other information you disclose to us when you contact us.

We may also use this data in aggregate form (i.e. where an individual user is not identified) in order to measure usage so that we can identify where the site or the content can be improved.

4. How we use your personal information

We will only use your personal data when the Data Protection Laws allow us to. Most commonly, we will use your personal data in the following circumstances:

• To communicate with you about offers and promotions offered by Idox, solicit your feedback, or keep you up to date on Idox and our products and services;
• To deliver our services to you in accordance with the Terms and Conditions
• To contact you with information about your subscription with us;
• To respond to customer enquiries;
• To personalise your experience using our Sites, provide content recommendations and serve relevant advertisements;
• To monitor and analyse trends and better understand how users interact with our Sites, which helps us improve our services and make them easier to use; and
• To monitor and protect the security of our services, fight spam, and protect the rights and property of Idox.

We do not use automated decision making.

5. Marketing communications

5.1 What information do we collect about you?

When you opt-in to receive marketing communications from us, we will ask you to provide us with the minimum information needed to facilitate your request, including:

• your name;
• email address;
• company;
• country;
• phone number and
• your preferred communication method (email, phone or direct mail).

5.2 How is your information collected?

We collect personal information about you either directly from you, or via a third-party mailing list (please see section 5.5 for further information).

5.3 Why is your information used for marketing?

We process your personal information for marketing purposes to update you from time to time on topical developments which we believe will be of interest to you, invite you to related events, and grow our business through the publication of promotional material.

5.4 What is our legal basis for processing personal data for marketing communications?

We only send marketing communications to you if you have given us your consent to such marketing.

5.5 How long do we use your personal data for marketing?

We keep your personal data for marketing purposes for as long as you want to receive marketing form you. If you decide to opt-out of our marketing communications, or withdraw consent, we will no longer use your personal data for this purpose.

5.6 How do we use information about you for marketing?

We will use your personal information to:

• Communicate with you to provide you with information about Idox Group products, services, events, promotions or other insights; and
• invite you to select your communication preferences and topics you would like to receive information about which may be provided by other Idox Group companies.

The types of communications we may send you include:

• Product Updates;
• Newsletter;
• Whitepaper and Intelligence including reports, blogs, guides and surveys;
• Exhibition and Event;
• Video, Podcast and Webinar;
• Promotional Offer;
• Idox Company Updates; and
• Communications from another part of the Idox group, providing you have opted in to do so.

Preferred topics:

• Public Sector and Government;
• Grants and Funding;
• Electoral Management;
• Compliance;
• Engineering Information Management;
• Facilities Management;
• Hospital Management;
• Sexual Health;
• Social Care; and
• Transport.

5.7 Third party mailing lists

We may from time to time use personal information provided by third party providers such as Oscar Research. This data will be used in accordance with the provider's data transparency policy. All email communications using third party data will reference the data source and provide a link to that provider's policy/ transparency policy.

5.8 Personalised and tailored communications

In our email communications we may use web beacons that track your IP address (until you opt-in to receive communications you remain anonymous), to help us identify and monitor how visitors interact with our brand (e.g. website visits, content downloads, emails opened, social media engagement and which forms they've filled in).

We may also use tracked hyperlinks in our email broadcasts, which help us monitor which parts of our emails our audience are most interested in. We may use this data to develop future communications and promotions which we hope will be more relevant to you. The information we collect is used to help us segment our database by profiling our customers using marketing automation tools.

We use this information to identify audiences and to target future messages according to your preferences and personal experiences which enables us to deliver personalised, tailored and targeted content and messages that match your specific wants and needs.

5.9 Right to withdraw consent

You have the right to withdraw your consent to Idox Group's marketing communications at any time. To do so, please contact us at privacy@idoxgroup.com.. Once we have received notification that you have withdrawn your consent, we will no longer send you the relevant marketing materials.

6. Your rights in relation to your personal data

When processing your data, you are entitled to the following rights:

• Right to be informed;
• Right of access;
• Right to rectification;
• Right to erasure (Right to be forgotten);
• Right to restrict processing;
• Right to data portability; and
• Right to object to processing.

Insofar as the processing of your personal data pursuant to Art. 6 para. 1 lit.(a) is carried out on the basis of your consent or (f) GDPR to safeguard legitimate interests, you have the right under Art. 21 GDPR to object to the processing of such data at any time without needing a reason. We will then no longer process this personal data unless we can prove compelling reasons worthy of protection to continue processing. These must outweigh your interests, rights and freedoms, or the processing must serve to assert, exercise or defend legal claims.

To exercise any of the above rights at any time, please email: privacy@idoxgroup.com

6.1 How long do we retain your personal information?

We may retain your personal data as long as you are registered to use the Site. You may close your account by either clicking on the opt-out link provided in one of our communications or email privacy@idoxgroup.com.

In some cases, there are legal requirements to keep personal data for a minimum period, for example if it must be retained by court or tribunal order or where Idox is under a contractual obligation to retain it. If there is no such legal requirement, Idox will only keep the personal data for so long as it is necessary for the purposes for which it was collected, or as expressly consented. If we no longer need your personal information, we will delete or de-identify it. Even if we delete your personal data, it may persist on backup or archival media for an additional period of time for legal, tax or regulatory reasons, or for legitimate and lawful business purposes.

6.2 Supervisory authority

Under Art. 77 GDPR, you have the right to complain to the supervisory authority if you believe that the processing of your personal data is not lawful. For example, you can contact the supervisory authority responsible for our company:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113
Fax: 01625 524510

In principle, however, you can contact any data protection supervisory authority of your choice located in Europe.

7. Sharing information

We may share your personal data with the following third parties:

• Service providers based who provide IT and system administration services;
• Professional advisers including lawyers, bankers, auditors and insurers who provide consultancy, banking, legal, insurance and accounting services;
• Third party payment providers (Stripe); and
• HM Revenue & Customs, regulators and other authorities based who require reporting of processing activities in certain circumstances.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

7.1 Business transfers

As we develop our business, we might sell or buy businesses or assets. In the event of a corporate sale, merger, reorganisation, dissolution or similar event, personal data may be part of the transferred assets. You acknowledge and agree that any successor to or acquirer of Idox Group (or its assets) will continue to have the right to use your personal data and other information in accordance with the terms of this Privacy Policy.

7.2 Parent companies, subsidiaries and affiliates

We may also share your personal data within the Idox Group which includes our Idox-branded subsidiaries and/or affiliates globally, if and to the extent this is necessary for answering or otherwise complying with your requests and will be bound to maintain that personal data in accordance with this Privacy Policy.

7.3 Employees, independent contractors and service providers

We ensure that all employees understand their individual responsibility relating to the requirements of the Data Protection Legislation. Employees are provided with appropriate training, instruction and supervision so that duties are carried out effectively and consistently. Employees will only be given access to personal data that is appropriate for the effective completion of their duties and tasks.

We may engage service providers and contractors that act on behalf and under the instructions of Idox to perform certain business-related functions. These service providers will only be provided with appropriate and minimal information for the duties/tasks to be undertaken. Idox requires that all such service providers endorse the principles set out under the Data Protection Legislation and adopt adequate technical and organisational security measures to ensure the processing of personal data only as instructed by Idox and for no other purposes.

8. Where information is stored

We use appropriate technical, organisational and administrative measures to protect any personal information we process about you. All personal information collected from you is stored on servers in the United Kingdom and other countries within the European Economic Area ("EEA").

With regards to Engineering Document Management customers (only), your personal information may be transferred outside of the EEA and stored on servers in the US. It may also be processed by staff operating outside the EEA who work for us or a member of our group.

We will protect your personal information in accordance with this Privacy Statement wherever it is processed.

9. Cookies

On occasion, we may gather information about your computer to provide statistical information regarding the use of our Site. Similarly, we may gather information about your general internet use by using a cookie file. This information helps us improve our Site and the services that we provide to you.

Idox uses cookies and other tracking technologies like web beacons to help us identify and track visitors, usage, and access preferences for our Site, as well as track and understand email campaign effectiveness and deliver targeted ads.

Such information will not identify you personally – it is statistical data about our visitors and their use of our Site. This statistical data does not identify any personal details whatsoever. Examples of statistical information that we collect automatically:

Log information: when you visit our Site, we collect information that web browsers, mobile devices, and servers typically make available, such as the browser type, IP address, unique device identifiers, language preference, referring site, the date and time of access, operating system, and mobile network information.

Usage information: We collect information about your usage of our Site. For example, we collect information about your page views, referring/exit pages, duration of your visit, along with information about the type of device you used to access our Site. We use this information to perform statistical analyses of user behaviour and characteristics in order to measure interest in, and use of, the various areas of the Site. You cannot be identified from this information.

Location information: We may determine the approximate location of your device from your IP address. We collect and use this information to, for example, calculate how many people visit our Site from a geographic region.

For more information about the cookies used on our Site, see our Cookie Statement.

For more information about the use of cookies and other online advertising technologies, please visit www.allaboutcookies.org. For more information about how you can exercise your choices in regard to online advertising, please visit www.aboutads.info.

10. Children's online privacy

We do not knowingly collect personal data from children. Please do not supply any personally identifiable information for a person under the age of 13 through any of our sites. If you are under the age of 13 and believe you have already provided personally identifiable information through the site, please have your parent or guardian contact us immediately at privacy@idoxgroup.com so that we can remove such information from our records.

11. How to access, correct, update or delete personal information

Marketing communications: You may at any time review or update your preferences or opt-out of any marketing mailing list for which you previously asked us to include you by clicking 'Preferences' or 'Unsubscribe' in any marketing email communication that we have sent to you or sending us an email at privacy@idoxgroup.com.

However, if you want to delete or receive a copy of the personal information we hold about you in our systems, you will need to email your request to privacy@idoxgroup.com

Telemarketing: We want to make it as easy as possible for you to opt-out of receiving telemarketing calls. You have the option to either email us at privacy@idoxgroup.com or phone us on +44 333 011 1671 where we will invite you to leave a voicemail. Voicemail messages are picked up every working day and we will respond to your request within two working days.

12. Links to other sites

This site contains links to other sites. We do not control the information collection of sites that can be reached through link s from our sites. If you have questions about the data collection procedures of linked sites, please contact those organisations directly.

13. How to contact us

If you have any questions, comments or concerns regarding this Privacy Policy, please contact:

Idox Software,
Unit 5, Woking 8,
Forsyth Road,
Woking, Surrey
GU21 5SB, UK
T: +44 333 011 1200
E: privacy@idoxgroup.com

When contacting us via email or when using a contact form, we will only use the data provided by you (e.g. email address, name, phone number) to answer your request. We will delete the data accumulated during this process if there is no legal requirement or contractual obligation to retain this data. In operating our Site, we may collect and process the following data about you:

• Details of your visits to our Site and the resources that you access, including, but not limited to, traffic data, location data, weblogs, IP address, operating system, access times, what browser you are using and other communication data.
• A number of Sites within our group of companies are tracked using Google Analytics (see Cookies).
• Information that you provide by filling in forms on our Site, such as when you register for information or make a purchase.
• Information provided to us when you communicate with us for any reason.

14. Changes to this statement

We may change this Privacy Statement from time to time. If we make any changes, we will post these on this page and change the "Last Updated" date below. We encourage you to check this Privacy Statement frequently to stay informed of the latest modifications.

Policy statement version: 1.0
Last updated: 31 July 2023