RENT THE RUNWAY, INC.
PRIVACY NOTICE
This Privacy Notice (the “Notice”) is provided as an annex to the Plan. This Notice is intended to provide information about the collection and processing of the Participant’s personal information by the Company. Capitalized terms used but not defined in this Notice shall have the same meanings assigned to them in the Plan.
(a) Data Collection and Usage. The Company collects, processes and uses certain personal information about the Participant, including, but not limited to, the Participant’s name, home address, telephone number, email address, date of birth, social insurance number, passport or other identification number, salary, nationality, job title, and details of all Awards granted under the Plan or any other entitlement to options, restricted stock, restricted stock units and other stock-based awards awarded, canceled, exercised, vested, unvested or outstanding in the Participant’s favor (“Data”), for purposes of implementing, administering and managing the Plan. The Company is the controller of such Data. The legal basis, where required, for the processing of Data is that the processing is contractually necessary for the performance of the Plan.
(b) Stock Plan Administration Service Providers. The Company transfers Data to Shareworks and certain of its affiliates, which is assisting the Company with the implementation, administration and management of the Plan. The Company may select a different service provider or additional service providers and share Data with such other provider serving in a similar manner. The Participant may be provided with separate terms and data processing practices with Shareworks, as such agreement is contractually required to implement stock options under the Plan.
(c) International Data Transfers. The Company and Shareworks are based in the U.S., which means that it will be necessary for Data to be transferred to, and processed in, the U.S. The Participant’s country or jurisdiction may have different data privacy laws and protections than the U.S. The Company’s basis for the transfer of Data, where required, are standard contractual clauses.
(d) Data Retention. The Company shall hold and use Data only as long as is necessary to implement, administer and manage the Participant’s participation in the Plan, or as required to comply with legal or regulatory obligations, including under tax, exchange control, labor and securities laws. This period may extend beyond the period of the Participant’s employment with the Company. When the Company no longer needs Data for any of the above purposes, it shall cease processing it in this context and remove it from all of its systems used for such purposes to the fullest extent practicable.
(e) Data Subject Rights. The Participant may have a number of rights under data privacy laws in his or her jurisdiction. Depending on where the Participant is based, such rights may include the right to (i) request access to or copies of Data the Company processes, (ii) rectify incorrect Data, (iii) delete Data, (iv) restrict the processing of Data, (v) request the portability of Data, (vi) lodge complaints with competent authorities in the Participant’s jurisdiction, and/or (vii) receive a list with the names and addresses of any potential recipients of Data. To receive clarification regarding these rights or to exercise these rights, the Participant can contact his or her local human resources representative.
(f) Further Information and Contact. For further information, including if relevant, the appropriate supervisory authority for lodging complaints, the Participant can consult Human Resources or Legal.