Privacy Policy

Roti Restaurant Group UK Ltd’s (Roti)

PRIVACY POLICY

Last Updated: October 27th, 2026

Roti Personal Data Protection Policy

1. Introduction and Scope

a. This Personal Data Protection Policy (this “Policy”) sets out Roti Restaurant

Group UK Ltd’s (Roti) obligations when it processes personal data. It also sets out what Roti's employees and contractors (collectively “Roti Personnel”) must do when they handle Roti personal data.

2. What is personal data and what is a data subject?

a. Personal data includes any information about an identifiable living individual.

Various documents may reference 'data subjects,' which is what data protection laws call individuals. An individual is identifiable where:

i. Roti holds clear direct identifiers – such as, name or full postal address;

and/ or

ii. It is reasonably likely that Roti can identify the individual by other

reasonable means. For example, an employee ID number where HR can link this to employee name, or order number, where customer support can link this to a customer’s name or address.

b. Online identifiers – such as cookie IDs and device IDs – are included, as well

as decisions made about individuals and subjective opinions held about people.

c. Sensitive personal data includes (i) any information about health, religion,

sex life or orientation, racial or ethnic origin, political opinions, trade union membership, genetic data or biometric data used to uniquely identify a person (such as fingerprints or facial recognition) (“Special category data”) and (ii) information about criminal convictions, criminal offence data and/or alleged criminal activity.

d. You may collect personal data in a variety of ways, such as through

recruitment of prospective Roti Personnel, correspondence with Roti Personnel or with customers.

3. What is processing?

a. Processing means any use by Roti of personal data. This includes obtaining

or creating personal data, amending it, storing it, sharing it, or even accessing, anonymising or deleting it.

4. What obligations does Roti have?

a. Roti must comply with the UK GDPR, as well as with any applicable UK data

protection laws. Roti’s obligations under the UK GDPR are set out in this Policy.

5. What are my obligations?

All Roti Personnel must comply with this Personal Data Protection Policy and any additional policies which Roti introduces. Failure to comply with this Policy may result in disciplinary action.

6. Core Data Protection Principles

Roti follows these data protection principles when processing personal data:

a. Lawfulness, Fairness and Transparency

Always process personal data in a fair manner – consistent with an individual's reasonable expectations – and lawfully.

Inform individuals how Roti will use their personal data

i. Individuals must understand how their personal data will be collected and used. When developing a new product or activity that will involve personal data, consider how individuals will be informed.

ii. When Roti collects personal data directly from individuals, it should provide notice at the time of such collection.

iii. When Roti collects personal data from another source, it should provide notice within a reasonable period, but no later than a month, after the data was obtained by Roti. If Roti intends to communicate with the individual, or disclose the data to a third party, then the information must be provided no later than that communication or disclosure.

iv. At minimum, the privacy notice must contain the information listed in Annex 1.

v. Roti must ensure that privacy notices are: concise, intelligible, use clear and plain language, which is suitable for the audience; easily accessible; and provided in writing (which can include electronic means), unless the individual asks for the information to be provided orally.

vi. If the purposes for processing personal data change, Roti must provide a further privacy notice before the new processing takes place – contact Roger Singh(rnarula@roti.co.uk) if you think that a purpose for which you process personal data is not already covered by the applicable privacy notice.

Justify all processing

vii. Only process personal data where lawful grounds for processing exist in applicable legislation. These include:

a. The individual has given consent to the processing;

b. The processing is necessary to perform a contract with the

individual, or to take steps at the request of the individual before entering into a contract;

c. The processing is necessary for compliance with a legal

obligation to which Roti is subject;

d. The processing is necessary for Roti’s legitimate interests or

those of a third party, unless the interests of the individual override those interests; or

e. The processing is necessary for the recognised legitimate

interests of:

i. Disclosure where necessary for the performance of a

task carried out in the public interest;

ii. National security, public security and defence;

iii. Responding to an emergency;

iv. Detecting, investigating, preventing or prosecuting

crime; or

v. Safeguarding vulnerable individuals.

b. Purpose Limitation

i. Roti must only process personal data for purposes which are legitimate and which Roti has informed the individual about, as part of the Transparency principle (see section 2.1 above) and in the Record of Processing Activities (see section 2.6 below).

ii. Roti must not process personal data for any incompatible purpose, for example purposes which are very different from the original purpose for processing, would be unexpected, or would have an unjustified impact on individuals.

c. Data Minimization and Accuracy

i. Roti must make sure that personal data is adequate and relevant for the purposes for which it is processed and limited to what is necessary for the purpose of processing. Do not collect more personal data than needed simply because you feel it may turn out to be useful later.

ii. Roti must also ensure that personal data is accurate and, where necessary, kept up to date; and take all reasonable steps to correct or delete inaccurate personal data.

d. Storage Limitation

i. Roti must determine for how long it needs to process personal data for a particular purpose; and only keep personal data for this period. At the end of this period, Roti must securely delete the personal data, or ensure that the data doesn’t allow individuals to be identified.

ii. Specific details about the retention periods that Roti has adopted for its different purposes and processing activities are set out in Roti’s “Data Retention Policy” attached hereto as Exhibit A.

e. Integrity and Confidentiality

i. Roti must keep all the personal data it processes secure, and protected against ‘unauthorised or unlawful processing and accidental loss, destruction or damage’. It does this by implementing various security measures which are listed in Roti’s “Information Security Policy” attached as Exhibit B to this policy; and also implementing the measures which it imposes on its data processors (as described in section 4 below).

ii. Roti must also implement a personal data breach response process so that it can log, remediate and report any data breaches as required by law. A personal data breach is a security incident that results in the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. This means a breach is more than just losing personal data; it includes:

a. Confidentiality breaches (e.g. sending data to the wrong

recipient, phishing attacks);

b. Integrity breaches (e.g. accidental alteration of data); and

c. Availability breaches (e.g. ransomware encryption, accidental

deletion without backup).

Personal data breaches can result from accidents or deliberate acts.

iii. Where a breach is likely to pose a risk to individuals’ rights and freedoms, Roti must notify the relevant data protection authority within 72 hours of becoming aware of the breach. If the breach is likely to result in a high risk to individuals, Roti must also inform affected individuals without undue delay. All personal data breaches, even if they are not reportable, must be recorded.

iv. If you suspect a personal data breach, contact Roger Singh(rnarula@roti.com) (with copy to legal@roti.co.uk).

f. Accountability

i. Privacy by Design and Default: Roti must be able to demonstrate its compliance with this Policy, and with applicable data protection law. Roti must ensure that privacy issues have been considered from an early stage in implementing services and procedures (privacy by

design), and that, by default, only the minimum amount of personal data necessary is being processed (privacy by default). Project owners and teams are responsible for incorporating these principles when planning and delivering new projects or initiatives. Guidance on privacy considerations can be obtained from legal@roti.co.uk.

ii. Data Protection Impact Assessment: In certain cases – i.e. high risk processing - Roti may be required to carry out a data protection impact assessment (“DPIA”). A DPIA is a check conducted on a specific area of Roti’s operations to identify and minimise non- compliance risks. Project owners and teams should consult legal@roti.com at the planning stage of any new project or initiative to determine whether a DPIA is required and to obtain guidance on completing it.

iii. Record of Processing Activities (“RoPA”): Roti is required to keep a formal RoPA.

7. Individual Rights

a. Roti must deal promptly with requests from individuals to exercise their data

protection rights. If you receive a request from an individual, please forward it to [privacy@Roti.com].

b. Individuals have the following rights:

i. Access: to obtain (i) confirmation whether Roti processes their

personal data; (ii) a copy of the personal data (in a commonly-used electronic form, if the request is made electronically); and (iii) provision of supporting explanatory information.

ii. Portability: to request that their personal data is "ported" (i.e.

transferred) to a specified third party, or to the individual themself, in a machine-readable and structured format (e.g. CSV files). There are exemptions – for example, this only applies to personal data which has been provided by the individual or collected automatically from the individual, which is held in digital format, and which Roti processes with the individual’s consent or to fulfil a contract with that individual.

iii. Rectification: to request correction of inaccurate personal data.

iv. Objection: to object to: (i) processing for direct marketing purposes;

(ii) profiling based on direct marketing; and/or (iii) processing based on Roti’s legitimate interests or recognised legitimate interests.

v. Erasure (a.k.a. the "right to be forgotten"): to request that personal data

is erased in certain situations, for example, where: (i) the processing is based on consent and the consent is later withdrawn; or (ii) the individual has validly exercised a right to object and wishes the data to be erased.

vi. Restriction: to request that personal data is "restricted" (i.e. block/

pause) whilst complaints (for example, about accuracy) are resolved, or if the processing is unlawful but the individual objects to erasure.

c. These rights may be limited, for example if fulfilling the request would reveal

personal data about another person, or if a data subject asks us to delete information which we are required by law or have compelling legitimate interests to keep. If the data subject has unresolved concerns, they also have the right to make a complaint to us and to the Information Commissioner. Information on how individuals can exercise this right is available by contacting Roti via the contact details below.

d. Individuals also have rights not to be subject to decisions taken solely on the

basis of automated processing of personal data of an individual (i.e. no human involvement in the decision) which produce legal effects, or have similarly significant effects, unless taking such decisions is permitted by law. There are limited exceptions to this. Roti does not use any solely automated individual decision-making technology.

Time frames

e. The GDPR provides that Roti must "provide information on action taken on a

request under Articles 15 to 22 to the data subject without undue delay and in any event within one month of receipt of the request". The time limit starts when Roti has received a request or when Roti receives information it has requested to verify the identity of the requester or clarify the request.

f. The “month” starts that day and runs until the same day of the following

month (i.e. 20th to 20th). If the second month does not contain that date, then the last date of the month is taken as the relevant date (relevant for periods starting on the 29, 30, or 31st of the month). By way of example:

• If a request is received on 5th March, the time limit starts from the same day and this gives the organisation until and including 5th April to comply with the request, at the latest; and

• If the request is received on 31st August, given the following month is shorter and there is no corresponding date, the date for response, at the latest, is the last day of the following month, 30th September.

g. Finally, where the last day of the month is a public holiday, or the weekend,

then the month ends at the end of the next working day after the public holiday or weekend. However, no allowance is made for any public holidays which occur in the middle of the one-month period (i.e. if there is a public holiday during the second week of the one-month period the deadline to respond is not affected).

h. In extraordinary circumstances the deadline for responding to a request can

be extended by a maximum of two months. Roti Legal is responsible for determining if an extension is necessary, please contact them legal@roti.co.uk if you think the deadline should be extended. Where an

extension is necessary, the requestor should be informed of this as soon as possible, and no later than the end of the initial thirty-day deadline.

i. Exceptions to these individual rights terms may be made only where permitted by law and where a compelling business interest exists. Exceptions must be approved in advance by Roti Legal (legal@roti.co.uk).

8. Sharing Personal Data with Third Parties and International Transfers

a. Data processors are other organisations which process personal data on

behalf of a controller. Roti may appoint processors to help it process personal data (e.g. a payroll provider).

b. When appointing any data processor to collect, store or use personal data on

Roti’s behalf, Roti must:

i. Before Engagement: Ensure that the data processor provides

satisfactory assurances about their data protection practices; and

ii. On Engagement: The data processor is required to adhere to specified

data processing terms; and

iii. Post Engagement: Confirm on an appropriate periodic basis (as

determined by Roti Information Security that the assurances provided before engagement about their data protection practices remain valid.

c. Where Roti transfers personal data to data processors or data controllers

which are based outside the UK (which includes data processors accessing the personal data from outside the UK e.g. in order to provide IT support services), a data transfer safeguard must be put in place unless that country has been approved by UK regulations. Contact Roti Legal if you suspect that personal data is being transferred outside the UK, for example, as part of your team’s activities, a project you are involved in or a system that you use.

9. Training

Roti must, and does, provide training on this Policy and Roti’s other data protection- related policies, procedures and obligations to all Roti Personnel.

10. Audits and Monitoring

Roti audits compliance with this Policy and other data protection-related policies; and will implement appropriate corrective actions to rectify any non-compliance. If you think that this Policy is not being complied with in any way at Roti, please contact legal@roti.co.uk.

11. Updates of the Policy

Roti Legal is responsible for communicating changes to this Policy, and will also provide a brief explanation of the reasons for any notified changes to this Policy.

12. Publication and Final Provisions

Roti will publish this Policy and any other amendments to it www.roti.co.uk/privacy.

Contact: You can raise any questions or concerns in relation to this Policy by contacting: legal@roti.co.uk You should also contact Roti Legal if you think you need an exception to a rule in this Policy.

Effective date: March 1, 2026

ANNEX 1

1. Information which must be provided to individuals when collecting their personal

data directly from them:

a) The identity and the contact details of Roti;

b) The purposes and the legal basis for the processing;

c) The legitimate interests of Roti, where applicable;

d) The recipients or categories of recipients of the personal data;

e) Any international data transfers, including the location of any recipients and the

existence or absence of relevant transfer regulations or the safeguards relied on(and how to obtain details of those methods);

f) Data retention periods;

g) Their rights under data protection rules;

h) The process available to individuals to withdraw any consent;

i) Whether the individual is obliged to provide the personal data and the possible

consequences of failure to provide such data; and

j) The existence of solely automated decision-making, including profiling which is

subject to the requirements under Art 22C UK GDPR, and the logic involved.

2. Information which must be provided to individuals when collecting their personal

data from another source:

a) All of the information stated in paragraph 1 of this Annex 1 above;

b) The categories of personal data obtained from the third party; and

c) The sources of the personal data - information must be as precise as possible

(e.g. identify whether this source is a private or public source; and the type of organisation / industry / sector).

ANNEX 2 - HR

1. Grounds for processing personal data

Roti HR can collect and process personal data where it is necessary for the purposes set out in the Employee Privacy Notice (Exhibit C).

If using consent as a ground for processing you should keep in mind that it must be presented clearly and separately from any other terms (e.g. not incorporated into the employment contract). Consent must also be freely given, specific and give separate options for different types of processing. In addition, it should be as easy to withdraw as to give consent.

In an employment context it can be hard to prove that consent has genuinely been "freely given". Therefore, where possible, you should avoid relying on consent for processing Roti Personnel data. In addition, if you rely on consent and Roti Personnel decide to withdraw it you won't be able to process their data anymore.

2. Transparency

Roti has prepared a privacy notice for Roti Personnel. This is available on the [name of the portal where this document will be accessible].

3. Data quality

Roti Personnel can correct their personal data using ADP. HR should take reasonable additional steps to check data – for example by prompting individuals to check that their personal data is accurate on a periodical basis.

Template version Date 0.1 August 12, 2026

EXHIBIT A

Data Retention Policy

Personal Data Retention Policy

1. INTRODUCTION

This Personal Data Retention Policy sets out the periods for which Roti Restaurant Group UK Ltd ("Roti") will retain personal data following its collection or the end of the relationship with the data subject. This Policy forms part of Roti's overall data protection compliance framework and should be read in conjunction with the Personal Data Protection Policy.

2. SCOPE AND APPLICATION

This Policy applies to all personal data processed by Roti, including data relating to employees, contractors, customers, suppliers, and other third parties. The retention periods specified below represent the maximum period for which data will be retained unless a longer period is required by law or where a legitimate business reason exists.

3. RETENTION PERIODS BY DATA CATEGORY

4. SUPPLEMENTARY PROVISIONS

A. Legal Holds

Personal data subject to a legal hold, litigation, or regulatory investigation must be retained regardless of the retention periods above, until such matters are concluded.

B. Data Subject Requests

Where a data subject exercises their right to erasure ('right to be forgotten'), personal data will be deleted in accordance with their request, unless an exception applies (e.g., legal obligation, legal hold).

C. Anonymisation & Aggregation

Where feasible, Roti may anonymise or aggregate personal data at the end of the retention period to allow continued use for business intelligence without retaining identifiable information.

D. Secure Deletion

Upon expiry of the retention period, personal data must be securely deleted or rendered permanently non-identifiable in accordance with Roti's Information Security Policies.

5. RESPONSIBILITIES

All Roti Personnel are responsible for adhering to retention periods in this Policy. Department managers are accountable for ensuring personal data held by their teams is reviewed regularly and deleted in compliance. Data processors must implement equivalent retention arrangements in their data processing agreements.

6. REVIEW & UPDATES

This Policy will be reviewed annually and updated as required to reflect changes in law, regulation, or business needs.

For queries about this Policy, contact: legal@roti.com

Effective Date: August 2026

Data Category Retention Period Legal/Business Reason

Payment & Transaction Records 6 years Tax purposes; fraud investigation; dispute

EXHIBIT B

Information Security Policy

1. INTRODUCTION

This Information Security Policy sets out Roti Restaurant Group UK Ltd's ("Roti") approach to protecting its information assets and systems. The policy applies to all staff, contractors, and third parties processing information on behalf of Roti, including customer data, financial records, employee information, and operational systems.

2. PURPOSE AND SCOPE

The purpose of this policy is to:

Protect Roti's information from unauthorized access, theft, misuse, or damage

Ensure compliance with UK GDPR and data protection obligations

Maintain customer trust and business continuity

Minimize operational, financial, and reputational risks

3. CORE SECURITY PRINCIPLES

A. Confidentiality

Information is only accessible to authorized personnel. Access is restricted on a need-to-know basis.

B. Integrity

Information is accurate, complete, and has not been altered without authorization.

C. Availability

Information systems are available and operational when needed for business functions.

4. ACCESS CONTROL

A. User Accounts and Passwords

All system access requires a unique username and password. Passwords must be at least 8 characters and changed every 90 days. Passwords must not be shared, written down, or used for multiple systems. Staff are responsible for keeping passwords confidential.

B. System Access

Access to systems and data is based on job role and the principle of least privilege (only access what is needed). Line managers are responsible for approving user access requests. When staff leave or change roles, all access must be revoked immediately.

C. Remote Access

Staff working remotely must use secure, password-protected connections. Sensitive data must not be accessed or stored on personal devices. Personal Wi-Fi networks should not be used for business systems.

5. DATA PROTECTION AND HANDLING

A. Personal Data

Customer and employee data must be protected at all times. Data must only be collected where necessary, stored securely, and deleted when no longer required. Data should never be discussed in public areas.

B. Encryption

Sensitive data in transit must be encrypted (e.g., HTTPS connections). Payment card data must be encrypted at rest and in transit.

C. Document Disposal

Physical documents containing sensitive information must be securely shredded or destroyed. Digital files should be permanently deleted (not just moved to trash).

6. DEVICE AND SYSTEM SECURITY

A. Computers and Laptops

Computers must be locked when left unattended. Automatic screen locks should activate after 10 minutes of inactivity. Antivirus and anti- malware software must be kept updated.

B. Mobile Devices

Mobile devices (phones, tablets) used for work must have a strong PIN or password. Devices must be kept secure and not left unattended. Lost or stolen devices must be reported immediately.

C. Updates and Patches

All software and operating systems must be kept up to date. Security updates must be installed promptly.

7. EMAIL AND COMMUNICATIONS SECURITY

Sensitive or confidential information should not be sent via email unless encrypted. Be cautious of phishing emails (suspicious links, sender addresses, or requests for passwords). If unsure about an email, contact the sender via another method to verify.

8. THIRD-PARTY AND VENDOR SECURITY

All vendors and contractors processing data on behalf of Roti must comply with this policy and have appropriate data protection measures in place. Contracts must include data protection and confidentiality clauses. Roti periodically reviews vendor security practices.

9. INCIDENT RESPONSE AND BREACH REPORTING

A. Security Incidents

A security incident includes unauthorized access, data theft, system compromise, malware infection, or suspected data breaches. All security incidents must be reported immediately to management and the legal team.

B. Breach Notification

If a breach of personal data is suspected, Roti will assess the risk and notify affected individuals and regulatory authorities within 72 hours if required by law.

10. STAFF RESPONSIBILITIES

All Roti staff must:

Keep passwords confidential and change them regularly

Lock computers and devices when unattended

Not share login credentials or access with colleagues

Be cautious of phishing emails and suspicious links

Report security incidents or concerns immediately

Not store sensitive data on personal devices or unsecured locations

Complete security training as required

11. SECURITY TRAINING AND AWARENESS

Roti provides security awareness training to all staff. All personnel must complete initial training and regular refresher training. Training covers data protection, phishing awareness, password security, and incident reporting.

12. MONITORING AND AUDIT

Roti monitors system access and logs to detect unauthorized access or suspicious activity. Periodic security audits are conducted to assess compliance with this policy. Staff may be subject to security checks to ensure compliance.

13. NON-COMPLIANCE

Failure to comply with this policy may result in disciplinary action, up to and including termination of employment. Serious breaches may be reported to law enforcement.

14. POLICY REVIEW

This policy is reviewed annually and updated as required to reflect changes in technology, threats, or regulatory requirements.

For questions about this policy, contact: legal@roti.co.uk

Effective Date: August 2026

EXHIBIT C

Employee Privacy Notice

1 Introduction

This Employee Privacy Notice explains how Roti Restaurant Group UK Ltd (Roti) collects, uses, and protects your personal data as an employee. It applies to all current and prospective employees, workers, and contractors. This notice is provided in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Your personal data is important to us. We are committed to being transparent about what data we collect, why we collect it, and how we use it.

2 1. Data Controller

Roti Restaurant Group UK Ltd is the Data Controller responsible for your personal data. If you have questions about this notice or your personal data, please contact:

Roti Legal Team Email: legal@roti.co.uk Address: 12 New Fetter Lane, London, EC4A 1JP

3 2. What Personal Data Do We Collect?

We collect personal data from you in the following categories:

Identity & Contact Information: Full name, date of birth, address, telephone number, email address, emergency contacts

Employment Information: Job title, department, manager name, employment contract, salary and benefits, working hours, performance reviews, training records, absence records

Tax & Payroll Data: National Insurance number, tax code, bank details, payroll records, pension contributions, Student Loan information

Health & Safety Data: Health and safety incident reports, workplace injury records, sickness absence records, occupational health assessments, reasonable adjustments

Disciplinary & Grievance Records: Conduct issues, disciplinary warnings, grievance complaints, investigation records, meeting minutes

Right to Work Documentation: Passport details, visa information, work permits, identity verification documents

Background Check Information: Criminal record information (where appropriate), professional references, qualification verification

HR System Data: Records held in our HR system (ADP), including personal preferences, career history, and HR-related information

Monitoring & Security Data: CCTV footage at workplace premises, system access logs, IP addresses, device information

Communication Data: Email and messaging records (where relevant to employment or business purposes)

4 3. Lawful Basis for Processing

We only process your personal data where we have a lawful basis to do so under the UK GDPR. The lawful bases we rely on are:

Contractual Necessity: Data needed to fulfil your employment contract and perform your duties (e.g., salary, job title, working hours).

Legal Obligation: Data required by law (e.g., tax information, right to work checks, health and safety records, statutory leave records).

Legitimate Interests: Data needed for our legitimate business interests, including: HR administration, payroll management, performance management, workplace health and safety, security, investigation of complaints, and communication with employees.

Consent: For certain types of data (e.g., diversity monitoring, optional questionnaires), we may ask for your explicit consent. You can withdraw consent at any time.

Vital Interests: In rare cases, we may process data to protect your vital interests or those of others.

Public Task: Where processing is necessary for a task carried out in the public interest.

5 4. Special Category Data (Sensitive Data)

Some of your personal data is special category data, which is afforded additional protection under the UK GDPR. This includes:

Health data: Occupational health assessments, disability information, sickness records, medical information.

Criminal Records: Any criminal conviction data (where applicable to your role).

We only process special category data where permitted by law, such as for employment law compliance, health and safety, or where you have given explicit consent.

6 5. How We Use Your Data

We use your personal data for the following purposes:

Administration of your employment, including payroll, benefits, and tax compliance

Performance management, including appraisals and development reviews

Recruitment, training, and career development

Compliance with legal obligations (tax, health and safety, employment law)

Workplace health, safety, and wellbeing

Disciplinary and grievance procedures

Investigation of complaints or misconduct

Security and protection of Roti assets and staff

Communication with you regarding your employment

Analytics and business planning (in anonymised or aggregated form)

Monitoring and improving our HR processes and policies

7 6. How Long Do We Keep Your Data?

We keep your personal data for the period necessary to fulfil the purposes for which it was collected. Specific retention periods are:

8 7. Who Do We Share Your Data With?

We only share your personal data with third parties where necessary and permitted by law. Recipients may include:

HR Service Providers: Our HR management system (ADP) processes payroll, leave, and employment data on our behalf.

Payroll & Tax Authorities: HMRC, pension providers, and other statutory bodies as required by law.

Professional Advisors: Accountants, lawyers, and consultants (under confidentiality obligations).

Government Bodies: Where required by law (e.g., health and safety enforcement, employment tribunals).

Emergency Services: In genuine emergencies where necessary to protect health or safety.

Workplace Providers: Property managers, security providers, and occupational health providers.

All third-party recipients are bound by confidentiality obligations.

9 8. Your Rights

Under the UK GDPR, you have the following rights:

Right of Access: You can request a copy of your personal data. Submit to legal@roti.uk.co. We respond within 30 days.

Right to Rectification: You can request correction of inaccurate data. Update information via ADP.

Right to Erasure: You can request deletion of your data, except where we have legal obligations.

Right to Restrict Processing: You can request we limit how we use your data.

Right to Data Portability: You can request your data in a portable, machine-readable format.

Right to Object: You can object to certain types of processing.

Rights Regarding Automated Decision-Making: You have rights concerning decisions made solely by automated means.

To exercise these rights, contact legal@roti.uk.co.

10 9. Complaints

If you are unhappy with how we handle your data, you can:

Raise a concern with Roti Legal: legal@roti.co.uk

Lodge a complaint with the Information Commissioner's Office (ICO) at www.ico.org.uk

11 10. Automated Decision-Making

We do not use automated decision-making to make decisions that significantly affect you, such as dismissal or denial of benefits. Any decisions affecting your employment will be made by humans.

12 11. How We Protect Your Data

We implement appropriate technical and organisational security measures to protect your data. These measures are detailed in our Information Security Policy.

13 12. Updating Your Personal Data

You can update much of your personal data directly via ADP (our HR management system). Promptly inform your manager or HR of any changes to your personal information.

14 13. Changes to This Notice

We may update this privacy notice to reflect changes in law or our practices. We will notify you of material changes.

15 14. Contact Us

Roti Legal Team Email: legal@roti.co.uk Address: 12 New Fetter Lane, London, EC4A 1JP

Effective Date: August 2026

Data Category Retention Period Reason