Exhibit B
The following provisions shall only apply to Participant if he or she resides in the EEA+:
(a) Data Collected and Purposes of Collection. Participant understands that the Company, acting as controller, as well as the Service Recipient, will process, to the extent permissible under applicable law, certain personal information about Participant, including name, home address and telephone number, information necessary to set up a trading account for Participant and process the Options (e.g., mailing address for a check payment or bank account wire transfer information), date of birth, social insurance number or other identification number, salary, nationality, job title, employment location, details of all Options granted, canceled, vested, unvested or outstanding in Participant’s favor, and where applicable service termination date and reason for termination, any capital shares or directorships held in the Company (where needed for legal or tax compliance), and any other information necessary to process mandatory tax withholding and reporting (all such personal information is referred to as “Data”).
(b) Purpose and Legal Basis of Processing. The Data is collected from Participant and the Service Recipient, for the purpose of setting up Participant’s trading account, implementing, administering and managing the Plan pursuant to the terms of this Agreement. The legal bases (that is, the legal justification) for processing the Data is that it is necessary to perform this Agreement (including to administer and manage the Plan) and is in the Company’s legitimate interests to comply with applicable non-EEA+ laws when performing, administering and managing the Plan, which means the Company is using the relevant Data to conduct and develop its business activities, subject to Participant’s interests and fundamental rights and freedoms. The Data must be provided in order for Participant to participate in the Plan and for the parties to the Agreement to perform pre-contractual steps at Participant’s request, as well as their respective obligations thereunder. If Participant does not provide Data, he or she will not be able to participate in the Plan and become a party to the Agreement.
(c) Transfers and Recipients of Data. Participant understands that the Data will be transferred to and among the Company and the Service Recipient, as well as third-party service providers (E*Trade Financial Corporate Services, Inc. (and certain of its affiliated companies) (collectively, “Service Provider”), and other stock administration providers, brokers, transfer agents, accounting firms, payroll processing firms or tax firms) for the purposes explained above, which are necessary to allow the Company to perform its obligations under this Agreement. Participant understands that the recipients of the Data, including recipients who will set up Participant’s trading account, may be located in the United States and in other jurisdictions outside of the EEA+ where the Company, the Service Recipient, or their Service Provider have operations. The United States and some of these other jurisdictions have not been found by the European Commission to have adequate data protection safeguards. If Company or the Service Recipient transfer Data outside of the EEA+, those transfers will be made solely to the extent necessary to perform pre-contractual steps at Participant’s request or the Agreement, and take necessary actions in connection therewith. In addition, the Company and the Service Recipient will take steps as required and recognized by the European Commission to provide adequate safeguards for the transferred Data, and third-party service providers may commit to do so, such as the European Commission-approved standard contractual clauses. Information about those safeguards can be obtained by contacting Dataprotectionofficer@planet.com.
(d) Data Retention. The Company will hold and use the Data only as long as it is necessary to implement, administer and manage Participant’s participation in the Plan or as required to comply with legal or regulatory obligations, including under tax, exchange control, securities and labor law. This means Data may be retained after Participant’s employment or service is terminated.
(e) Participant’s Rights in Respect of Data. Participant has the right to access (and obtain a copy of) Participant’s Data being processed by the Company and understands why the Company is processing such Data. Additionally, subject to applicable law, Participant is entitled to have any inadequate, incomplete or incorrect Data corrected (that is, rectified). Further, subject to applicable law,
2