Allegro.eu S.A. — AGM Information 2022

May 13, 2022

Allegro.eu Société anonyme Registered office: at 1, rue Hildegard von Bingen, L-1282 Luxembourg Grand Duchy of Luxembourg R.C.S. Luxembourg: B214.830 (the "Company")

DATA PROTECTION INFORMATION

This data protection notice (the "Data Protection Notice") shall provide information on the categories of Personal Data we collect, how we use it, for which purposes we use it, with whom we share it and which rights you have regarding the Processing of your Personal Data.

• 1. Definitions
  2. Allegro General Meeting - AGM: means an annual meeting is a yearly gathering of a company's interested shareholders.
  3. Personal Data: means any information relating to a natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, or an online identifier.
  4. Processing: means any operation which is performed on Personal Data, such as collection, recording, organizing, structuring, storing, adaptation or any kind of disclosure or other use.
  5. GDPR: means Regulation of the European Parliament and of the Council (EU) 2016/679 of 27 April 2016 on the protection of individuals with regard to the processing of personal data, the free movement of such data, and repealing Directive 95/46/EC.
• 1. Purposes of the Processing Your Personal Data is Processed exclusively in accordance with the GDPR and any complementing or supplementing laws, including the Luxembourg law of 1 August 2018, and all other applicable statutes.
  2. a. We Process your Personal Data for the purpose of holding the AGM. In order to enable you to participate in and vote at the AGM, we Process the number of shares you hold on the relevant record date according to the record date confirmation issued by your depository bank that is safekeeping your shares. Additionally, we Process Personal Data concerning your attendance at the AGM. This includes, for example, your name, address, email address and phone number, if you will attend the AGM in person or if you will be represented by a proxyholder in relation to such proxyholder, and, if applicable, the voting instructions you provided to your proxyholder. The legal basis for this Processing is Art. 6 (1) 1 lit. c GDPR in connection with Art. 5 (3) and Art. 9 of the Luxembourg

law of 24 May 2011 on the exercise of certain rights of shareholders in general meetings of listed companies, as amended, and Art. 450-1 (2) LSC.

• b. Moreover, the above-mentioned Personal Data as well as your voting decisions will be Processed in order to publish the attendance percentage and the voting results of our AGM. The legal basis for this Processing is Art. 6 (1) 1 lit. c GDPR in connection with Art. 11 of the Luxembourg law of 24 May 2011 on the exercise of certain rights of shareholders in general meetings of listed companies, as amended.
• c. In some cases, we may be legally obliged to Process additional Personal Data, notably in connection with any laws applicable to issuers whose securities are listed on a regulated market.
• 1. Disclosure of Personal Data
  2. a. We ensure that your Personal Data is only Processed in accordance with the applicable data protection laws. Therefore, your Personal Data will be disclosed only insofar as reasonably necessary for the purposes set out in this Data Protection Notice. Within the scope of our data processing activities, your Personal Data may be disclosed to authorities in Luxembourg, Poland and to our auditors and legal advisors, notary and/or corporate service providers for the purposes of holding and organizing the AGM. The legal basis for this Processing is Art. 6 (1) 1 lit. c GDPR in connection with Art. 11 of the Luxembourg law of 24 May 2011 on the exercise of certain rights of shareholders in general meetings of listed companies, as amended, and Art. 6 (1) 1 lit. f GDPR.
  3. b. Your Personal Data may be transferred outside the European Economic Area, for example to:
     • Google Cloud Poland sp. z o. o. with its registered office in Warsaw, Poland, in connection with the use of the electronic mail system and the Google Workspace tools.

Allegro.eu always relies on mechanisms ensuring an adequate level of protection, for example by using standard contractual clauses for the transfer of Personal Data to Personal Data processors established in third countries approved by the European Commission. You can receive copies of such clauses from the Company by writing to: dpo@allegro.eu.

1. The detailed periods for the storage of personal data are as follows

Your Personal Data will be retained only for as long as necessary for the purposes for which we have collected it and as long as required by statutory retention provisions and will be deleted afterwards.

Personal Data collected in connection with AGM will in principle be retained for five (5) years from the date the relevant AGM is held. Beyond this, we will retain your Personal Data where

necessary to comply with legal retention obligations under commercial and tax law (in principle ten (10) years), or in connection with the establishment, exercise or defense of legal claims.

1. Your rights in the context of Personal Data processing and how to exercise them We enable you to exercise all rights you may have under the GDPR, i.e. the rights described in Articles 15 to 22 of the GDPR. For a detailed description of each right, please see below.

2. The right of access to Personal Data enables you to be informed by Allegro.eu how your Personal Data is processed by Allegro.eu, including specifically the purposes of and legal grounds for the processing, the scope of Personal Data which is retained, the entities with which your data are shared and the planned time of erasure.

3. You may exercise the right to obtain a copy of your Personal Data in order to receive a copy of your Personal Data which is processed by Allegro.eu.
4. You may exercise the right to rectification of Personal Data if you notice that your Personal Data are incorrect or incomplete. If this is the case, we undertake to remove any potential inaccuracies or errors in the Personal Data being processed and to complete the Personal Data where required.
5. You may exercise the right to erasure of Personal Data if: your Personal Data are no longer necessary in relation to the purposes for which they were collected or otherwise processed by Allegro.eu; you withdraw your consent to Personal Data processing; you object to the processing of your Personal Data and there is no other legal ground for the processing; or your Personal Data have been unlawfully processed. In order to exercise your right to the erasure of data, you have to terminate your agreement first. You will find a detailed description of how to exercise your right to erase Personal Data here.
6. You may exercise the right to restriction of processing of Personal Data if you notice that your Personal Data are incorrect – you may obtain restriction of processing of your Personal Data for a period enabling us to verify the accuracy of the personal data; the processing is unlawful but you oppose the erasure of the personal data; we no longer need your Personal Data but you may require them for the defence or exercise of legal claims; or you have objected to processing of your Personal Data pending the verification whether our legitimate grounds override yours.
7. You may exercise the right to object against the processing of Personal Data for other purposes at any time, on grounds relating to your particular situation, if your data have been processed for the purposes of the legitimate interests pursued by Allegro.eu. Any objection in this respect should be justified.
8. You may exercise the right to withdraw your consent at any time where your Personal Data are processed based on consent, without affecting the lawfulness of processing based on consent before its withdrawal.
9. Please note that you may lodge a complaint in relation to us processing your Personal Data with a supervisory authority, i.e. Commission nationale pour la protection des données (address: 15, Boulevard du Jazz, L-4370 Belvaux; tel.: (+352) 26 10 60 1).
10. 1. Please submit any questions, concerns or comments you have about this Data Protection Notice or any requests concerning your Personal Data by email to dpo@allegro.eu
11. 1. This Data Protection Notice is kept under regular review and may be updated from time to time and you will be notified in writing in case of any changes. This Data Protection Notice was last updated in May 2022.