MARI Employee Privacy Notice

We are committed to protecting the personal data of those individuals whose data we collect and process.

What is this Privacy Notice about?

This Privacy Notice describes how AE EventsCo Holdings LLC and its affiliates and subsidiaries (collectively, "MARI" or "we") collect, process, transfer, share, and retain personal data of employees. MARI is committed to securing and protecting employee personal data.

Definitions

For purposes of this Notice, the following terms have the meanings set out below. Where a jurisdiction's law defines a term differently, the local definition governs with respect to data subject to that jurisdiction's law. These terms are used as defined below regardless of capitalization.

Employee is anyone who has an employment relationship with any MARI entity. The term “Employee” (whether capitalized or not) does not include contractors.

Personal Data means any information relating to an identified or identifiable natural person.

Identifiable means the ability to determine a specific natural person, directly or indirectly, by reference to one or more data elements, as a name, identification number, location data, online identifier, or factors specific to that person's physical, physiological, genetic, mental, economic, cultural, or social identity.

Sensitive Personal Data is a subset of personal data and means categories of personal data that are subject to heightened legal protection under applicable law, which may include (depending on jurisdiction) data revealing racial or ethnic origin, health data, genetic or biometric data, criminal history data, data concerning a person's sex life or sexual orientation, trade union membership, religious or philosophical beliefs, or political opinions, as well as other categories designated as sensitive, special, or similar under local law (such as government identification numbers, financial account information, or precise geolocation data).

Process (regardless of verb tense) means any operation or set of operations performed on personal data, whether or not by automated means, including collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

Who does this notice cover?

This Notice covers all individuals employed by AE EventsCo Holdings LLC and any company of which it owns a majority share, whether directly or indirectly. This includes employees of all MARI business units, such as Action Sports, Arts & Entertainment, Barrett-Jackson, Bucket Listers, Collect-a-Con, Frieze, Tennis, and TodayTix. It also covers employees in companies that may be acquired by MARI in the future, once the acquisition is complete.

This Notice includes former employees, as MARI will continue to process information about former employees as may be required by law and necessary for business operations. It also covers job applicants who have accepted a position with MARI and are in the process of onboarding.

This Notice is intended to cover MARI employees globally; some practices described here may not apply to you, depending on your location. This Notice may be supplemented by a local notice where required by law or to reflect local or regional practices.

This Notice does not cover contractors, job applicants (except those in the process of onboarding), nor anyone else who is not an employee. There are separate notices for these groups:

• For job applicants and job prospects – Job Applicant Privacy Notice
• For individual customers, such as event attendees – locate the privacy notice posted on the website for the event, service, or product
• For contractors and all others – MARI Privacy Notice

What personal data might we collect from employees?

Because the list below applies across all of MARI's operations, some data elements may not apply to your specific situation. Please contact your HR business partner with any questions.

• Name, including given, family, middle, and any suffix
• Identification numbers (in whole or in part), such as an employee ID number, tax identification number, social security/insurance number, or other government-issued identification number, including national identification cards, driver's licenses, visas, and passports
• Work contact information, including phone numbers, email address, mailing address, assigned work site and work location
• Home contact information, including home address, home phone numbers, personal mobile phone numbers, and personal email addresses
• Basic identifying information, such as date of birth and gender
• Work experience, education and job history, language skills, other skill categories, licenses, certifications, awards, and memberships in trade or professional associations
• Information about your job, including job title, department, job function, job type, role type (onsite, hybrid, remote), job classification/grade, employment contract, and cost center
• Information about your employer entity, including company name, location, and country of incorporation
• Organizational chart information, such as identification of your supervisor, assistant, and/or direct reports
• Information required for badges, such as a photograph and authorization to access certain locations
• Compensation and benefits information, including marital status, identification data for beneficiaries and dependents, and information related to specific benefits programs
• Training, continuing education, development, and performance review information
• Talent planning information
• MARI computer, network, and communications information and logs, including username/login credentials, passwords, and information you store, send, submit, or receive through MARI networks and systems
• Time collection and allocation information
• Work assignments and work product connected to you, such as documents identifying you as author and tasks assigned to you
• Visitor information, including time, date, and location of visits, and vehicle information for parking purposes
• Event registration information, such as attendance, food preferences, and travel arrangements
• Information about your work preferences, such as travel and location preferences
• Information you voluntarily share in MARI systems, such as a nickname, photographs, and interests
• Emergency contact information, which may include information about non-employees, such as family members or friends you identify as an emergency contact
• Other data required to support HR applications, payroll, and travel and expense administration, including bank and credit card account information

Sensitive Personal Data

Depending on local requirements and law, MARI may also collect the following categories, which are treated as sensitive personal data where applicable:

• Self-identification information you may voluntarily provide, such as race and ethnicity, gender identity, sexual orientation, veteran status, and disability information (which will only be processed consistent with applicable law)
• Geolocation data collected from company-issued or company-managed devices
• Health data, such as allergies, injuries, maternity, and illness related to workplace management, safety issues, claims, accommodations, leaves of absence, and other administration obligations
• Criminal history data for pre-employment or role-based screening, where permitted by local law
• Allegations of misconduct where relevant to whistleblower claims and internal investigations
• Citizenship information, as may be required by law (e.g., for immigration, right-to-work, or export control screening)

In countries that impose special protections on sensitive personal data, MARI will only process such data as required by law or, where providing the data is entirely optional, with your explicit consent.

How do we collect employee personal data?

MARI may obtain your personal data directly from you or indirectly, such as from prior employers, recruitment agencies, public records sources, and other third parties.

For what purposes do we use employee personal data?

• Managing your employment, including:
  • Compensation and benefits administration
  • Payroll administration, including deductions and contributions
  • Career development, performance feedback, and progression
  • Rewards and recognition
  • Time collection and allocation
  • Travel and expense reimbursement, including corporate card administration
  • Training
  • Relocations, letters of assignment, visas, licenses, and other right-to-work authorizations
  • Tax reporting and withholdings
  • Maintenance of employee biographies, CVs, and similar information
  • Email systems and organizational charts
• Talent planning
• Conducting regular business operations, including:
  • Research, and design and development of products, services, and event offerings
  • Managing events and attendance at events
  • Analyzing costs and expenses, including salary and travel/expense data
  • Sharing business contact information with customers, event partners, venues, and business partners as needed to support MARI's events
• Responding to situations involving a risk to health or safety, including emergencies at events and venues
• Managing communications and notices to employees
• Conducting employee engagement surveys and charity campaigns
• Managing labor and employee relations, including grievance proceedings
• Planning and providing health and safety programs and services, including workers' compensation processing
• Reporting and statistical analysis, including global headcount, demographics, and reporting required by applicable law (e.g., right-to-work screening, health and safety reporting)
• Managing physical security, including access controls, facility access and safety, and disaster preparedness — relevant to venue and event operations
• Managing and securing digital technology systems, including access controls, intrusion and insider threat monitoring, log creation and analysis, helpdesk support, and data backup/recovery
• Ensuring compliance with applicable laws and regulations
• Responding to questions or concerns submitted through MARI’s reporting channels
• Performing audits and compliance reviews
• Evaluating and reporting conflicts of interest
• Conducting and managing internal and external investigations
• Prosecuting and defending claims in litigation, arbitration, or regulatory proceedings
• Responding to law enforcement and government inquiries
• Protecting intellectual property rights
• Business planning, including mergers, acquisitions, and divestitures
• As required or expressly authorized by applicable law or regulation

For these purposes, MARI will may use any of the personal data it processes, as appropriate for the purpose.

The legal basis for processing is:

• as necessary to perform a contract as by be required related to employment;
• as required by local legal obligations; and
• in furtherance of a legitimate business interest.

On limited occasions where withholding consent would in no way negatively impact your work or career opportunities, we may rely on your consent for processing and, in such circumstances, we will seek your explicit consent. For example, if there is a Company event involving free t-shirts, we may ask for your shirt size. If you choose not to provide your size, you would either not get a shirt or might get one in the wrong size. To the extent we seek your consent, you are able to withdraw that consent by contacting us as indicated at the bottom of this Notice. Note that your withdrawal of your consent is only for future processing and it may have consequences, such as your inability to participate in certain optional opportunities.

Where do we store your personal data?

Because MARI operates across multiple countries, we may transfer your information between MARI entities or across borders to accomplish the purposes described above, including transfers to service providers in other countries. These countries include, at a minimum: Australia, France, Germany, Hong Kong, South Korea, Spain, the United Arab Emirates, the United Kingdom, and the United States, in addition to jurisdictions where MARI operates events or engages service providers.

MARI relies on available legal mechanisms to enable lawful cross-border transfer of personal data, including the EU Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, and other approved transfer mechanisms as required under applicable law (including PIPL cross-border transfer mechanisms where relevant to specific engagements). MARI has entered into the SCCs, including the UK Addendum, for its entities located outside the US.

To whom might we disclose your personal data?

MARI limits access to employee personal data on an as-needed basis. HR and payroll professionals have access to personal data relevant to their areas of responsibility. A limited number of individuals have broader access due to responsibilities for worldwide HR systems. Managers and supervisors have access to work-related information about their teams, but not to all personal data.

Personal data is used by and shared among MARI's operating companies, subsidiaries, divisions, and event properties worldwide for the purposes identified above. We may also share your business contact information with customers, venues, event partners, and business partners to support regular operations.

MARI may also share personal data with third parties on an as-needed basis, including trusted service providers, consultants, and contractors granted access to MARI facilities or systems, and with government agencies as required by law. MARI will only share personal data outside the MARI group of companies to:

• Allow service providers MARI has retained to perform services on our behalf, such as HR information systems, payroll providers, benefits administrators, training providers, professional development providers, and recruiting services. These providers are contractually restricted from using or disclosing information except to perform services for MARI or comply with legal requirements.
• Comply with legal obligations, such as tax and regulatory obligations, and respond to court proceedings or legitimate law enforcement requests.
• Investigate suspected or actual legal, policy, or compliance violations.
• Prevent physical harm and protect employee and event attendee safety.
• Support the acquisition, sale or transfer of all or a portion of MARI’s business or assets.

How do we protect employee personal data?

The security and confidentiality of your employee personal data is critical to our business operations. We use commercially reasonable security measures to protect employee personal data. We use a variety of administrative, physical, and technological solutions to protect your personal data from unauthorized access, loss, or misuse. These controls are outlined in our company IT policies and procedures.

How long do we retain employee personal data?

MARI retains employee personal data for the length of your employment and any additional period required by applicable law, regulation, court or administrative proceedings, or audit requirements. Contact your HR business partner for specific retention periods.

MARI may otherwise retain data required for legitimate business or legal purposes, including: (a) working files related to customers, events, venues, partners, and other work-related matters that may incidentally reference you; (b) data saved in shared storage areas, subject to applicable retention schedules; (c) data subject to an active investigation, proceeding, or audit; and (d) data MARI is required to retain under contractual, legal, regulatory, or audit obligations.

What are your legal rights and choices about your employee personal data?

Your personal data is important to MARI's global HR management. Unless contrary to local law or collective bargaining agreements, collection and use of your personal data as described in this Notice is generally required for your employment, to pay you, and to comply with legal obligations such as tax and compliance requirements.

Depending on your location, local law may require MARI to obtain your specific consent for collection, use, or disclosure of personal data in certain circumstances. Where required, MARI will request such consent by appropriate and permitted means.

MARI takes reasonable steps to ensure your employee personal data remains accurate, complete, and current, and may periodically ask you to confirm or update it.

Many employees have direct access to most of their employee personal data through MARI HR systems and can access, correct, change, delete, or copy it directly. Upon request, MARI may grant reasonable access to employee personal data that is otherwise inaccessible. Employees without direct access, or seeking additional access, should contact their local HR business partner. For requests related to employee personal data outside of HR data, contact dataprivacy@marigrp.com.

There may be legal or other reasons why a request for access, correction, change, deletion, or copy will be denied, in whole or in part.

Residents of France, Germany, Spain, and other EU countries: You have the right to request access to, correction of, or erasure of your employee personal data; to seek restriction of or object to processing of certain employee personal data; and to seek data portability in certain circumstances. To make such a request, use the contact methods at the end of this Notice. You also have the right to lodge a complaint with your national or state data protection authority (supervisory authority). You can find contact information for the EU data protection authorities at https://www.edpb.europa.eu/about-edpb/our-members_en.

UK residents: If you have a complaint about how MARI has handled your employee personal data, you may submit a complaint using the contact methods below. We will endeavor to acknowledge receipt within 30 days, may request additional information to verify your identity or clarify the scope of your complaint, and will keep you updated on the investigation and its outcome without undue delay. If you are not satisfied with the outcome, you have the right to complain to the Information Commissioner's Office (ICO), which can be contacted at https://ico.org.uk/.

Residents of the United States: MARI collects Social Security Numbers where required by law, such as for tax and payroll purposes, and will take appropriate care to protect confidentiality, limit collection, restrict access on a need-to-know basis, apply appropriate technical safeguards, and ensure proper disposal.

Residents of California: If you are an employee who is a resident of California, you have the following rights:

• Right to know about the personal data we have collected about you and how it is used and shared;
• Right to delete personal data collected from you (with some exceptions);
• Right to opt-out of the sale or sharing of your personal data;
• Right to not be discriminated against for exercising your privacy rights;
• Right to correct inaccurate personal data if we have incorrect personal data about you; and
• The right to limit the use and disclosure of sensitive personal data collected, however, this right does not apply as we do not collect sensitive personal data.

To exercise your rights, please use one of the methods identified at the bottom of this Notice. Please provide your name, a way for MARI to contact you, information about your relationship with MARI, and details of the action you would like MARI to take. MARI will investigate and, where necessary, verify your identity before responding. Be aware that your rights (including those enumerated elsewhere in this Notice) may be limited by other applicable legal rights and obligations.

Also, under the California Shine the Light Law, California residents may annually request information shared with other businesses for their own direct marketing use in the prior calendar year (also described as personal data that is sold or exchanged for something of value). We do not share the personal data of our employees for direct marketing purposes unrelated to the provision of benefits, nor do we sell employee personal data or exchange it for something of value. Nonetheless, if you have any questions about our practices related to the California Shine the Light Law, you can use any applicable method in the “How can you contact us section?” to ask for this information.

Residents of Australia: Each MARI entity in Australia is an "APP entity" regulated under the Privacy Act 1988 (Cth) ("Australian Privacy Act"). References to MARI in this Notice extend to Australian subsidiaries with respect to their collection, handling, and disclosure of employee personal data about Australian residents. Where an Australian MARI subsidiary discloses employee personal data to an overseas recipient for reasons described in this Notice, it will take reasonable steps to ensure the overseas recipient does not breach the Australian Privacy Act.

Australian residents may email dataprivacy@marigrp.com to access, correct, or update their employee personal data, ask questions about MARI's privacy practices, or make a complaint. If MARI takes more than 30 days to respond, or if you are dissatisfied with the outcome, you may raise a complaint to the Office of the Australian Information Commissioner (OAIC), which can be contacted at https://www.oaic.gov.au/.

Residents of Hong Kong: MARI's Hong Kong operations are subject to the Personal Data (Privacy) Ordinance (PDPO). You have rights to request access to and correction of your employee personal data held by MARI. Requests may be submitted using the contact details below. If we are unable to resolve your concern, complaints regarding our handling of employee personal data may be raised with the Office of the Privacy Commissioner for Personal Data (PCPD), which can be contacted at https://www.pcpd.org.hk/.

Residents of South Korea: MARI's South Korean operations are subject to the Personal Data Protection Act (PIPA). You have the right to request access to, correction of, deletion of, or suspension of processing of your employee personal data. Where required by PIPA, MARI will obtain separate consent for the collection or transfer of Sensitive Personal Data (as defined in PIPA as "sensitive information," including health and criminal history data) and for cross-border transfers. If we are unable to resolve your concern, complaints may be directed to the Personal Data Protection Commission (PIPC), which can be contacted at https://pipc.go.kr/eng/index.do.

Residents of the United Arab Emirates: MARI's UAE operations are subject to applicable UAE data protection law, including Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) and, where applicable, free-zone data protection regimes (e.g., DIFC or ADGM, if relevant to your employing entity). You may have rights to access, correct, or request erasure of your employee personal data, subject to applicable exceptions. Requests may be submitted using the contact information at the bottom of this Notice.

What obligations do you have?

Employees who provide information about family members and others: For emergency contact purposes, benefits coverage, and beneficiary identification, you may choose to provide MARI with information about family members and others connected to you. Before providing that information, you must ensure you have the legal authority to do so, including obtaining consent, if that is required under applicable law. If you provide information as the legal representative of a minor, your choice to provide it represents consent that MARI may collect, process, and transfer that information for the purposes set out in this Notice.

All employees: All employees are obligated to adhere to MARI policies and procedures and to comply with this Notice and applicable law in handling the employee personal data of other employees and former employees.

How will we keep this notice up to date?

This Notice may be amended from time to time as needed to reflect changes in MARI's practices and policies. Notice of amendments will be given by posting in Bob or the HR system used by your direct employer. Employees who do not have access to Bob or an alternative HR system may request a copy of the Notice from their Human Resources ("HR") representative.

What is the effective date of this notice?

This Notice was last modified as of the effective date printed at the top. This Notice replaces and supersedes any prior applicable privacy notices, including ones that may have been issued by predecessor owners of any MARI entities.

How can you contact us?

If you have a question, concern, or complaint about your employee personal data, how it is handled, or which MARI entity is the data controller for your employee personal data, contact: