1. Purpose of this statement

This privacy statement (this Statement) explains how and why DCC plc (DCC) and certain of its subsidiaries (each, a DCC Company) process personal information (called Personal Data under applicable data protection law and in this Statement) that we collect from or that are provided to us by people and organisations with whom we have contact as part of our business activities, including through our main website, www.dcc.ie (our Main Website) and our graduate website, www.dccgraduateprogramme.com (our Graduate Website) (our Websites).

This Statement does not cover how the principal subsidiaries and joint ventures of DCC process Personal Data. Where relevant, those DCC Companies and joint ventures will issue separate statements on how they process Personal Data.

2. Who we are

DCC is a company registered in Ireland under number 54858. Our registered office is at DCC House, Leopardstown Road, Foxrock, Dublin 18, Ireland. DCC is the controller of and is responsible for your Personal Data. Consistent with our core values of Integrity and Partnership, we are committed to protecting and using fairly any Personal Data that we hold.

3. Terms we use in this Statement

This section explains three terms that we use in the rest of this Statement.

• Legitimate Interests means the interests of DCC and DCC Companies in conducting their business activities. When we process your Personal Data based on our Legitimate Interests, we consider and balance any potential impact on you and your data protection rights. We will not use your Personal Data for activities where our interests are overridden by the impact on you unless we have your consent or are otherwise required or permitted by law. You have certain rights when we process your Personal Data on this basis. For more on your data subject rights please see section 8 of this Statement.
• Performance of a Contract means processing your Personal Data where it is necessary for the performance of a contract to which you or an organisation with which you are connected is a party.
• Comply with Legal Obligations means processing your Personal Data where it is necessary for compliance with a legal or regulatory obligation that applies to DCC or a DCC Company.

4. When do we process Personal Data?

We may process your Personal Data:

• If you visit our Websites. Please see section 4.1 of this Statement for more on this.
• If you are a prospective, current or former employee of DCC, including an applicant to or member of our graduate programme. Please see section 4.2 of this Statement for more on this.
• If you are a person who holds shares in DCC. Please see section 4.3 of this Statement for more on this.
• If we deal with you, or an organisation with which you are connected, in the course of our business activities. Please see section 4.4 of this Statement for more on this.

4.1. If you visit our Websites

4.1.1. What Personal Data do we process about visitors to our Websites?

We process Personal Data about visitors to our Websites. This may include:

• The name of the domain and host from which you access the internet.
• The internet protocol (IP) address of the computer you are using.
• The browser software you are using.
• The operating system you are using.
• The date and time at which you access our Websites.

DCC and DCC Companies will also collect and process information about your interaction with our Websites using cookies. For more information on how we use cookies, please see section 10 of this Statement.

If you register for the alert service on our Main Website you will need to provide the following information:

• Name.
• Email address.
• Job title.
• Country where you are based.

If you express an interest in applying to our graduate programme on our Graduate Website you will need to provide the following information:

• Name.
• Email address.
• Telephone number.
• Summary of your education.

4.1.2. What is the legal basis for this processing?

We rely on the following legal grounds for this processing:

Legitimate Interests, for example:

• Providing access to our Websites and enabling their use.
• Protecting the security and integrity of our Websites, IT systems and other systems.
• Providing, improving, monitoring and testing the effectiveness of our Websites.
• Ensuring the content on our Websites is presented in an effective, accessible and user-friendly format.
• Monitoring metrics such as numbers of visitors, traffic data and demographic patterns.
• Keeping users informed of developments in our business, where users have registered for the alert service on our Main Website.
• Managing our graduate programme, where graduates have expressed an interest in applying to our graduate programme through our Graduate Website.

4.1.3. When do we share your Personal Data?

We may disclose some or all of the Personal Data we collect from you to certain trusted third parties, in accordance with contractual arrangements we have in place with them, including:

• Suppliers and service providers who assist in the operation of our graduate programme.
• IT service providers.

4.2. If you are a prospective, current or former employee of certain DCC Companies

4.2.1. What Personal Data do we process about prospective, current or former employees of DCC Companies?

We process Personal Data about prospective, current and former employees of certain DCC Companies. This may include:

• Name.
• Qualifications and career history.
• Contact information such as home addresses and who to contact in an emergency involving existing employees.
• Rewards and benefits information, including so that we can manage pension obligations for former employees and their beneficiaries.
• Special category Personal Data, for example on illness, disability or dietary requirements.

4.2.2. What is the legal basis for this processing?

We rely on the following legal grounds for this processing:

Legitimate Interests, for example:

• Considering applications for employment in DCC, including on our graduate programme.
• Supporting existing employees in the development of their careers.

Performance of a Contract, for example:

• Paying salaries and other employment benefits.
• Administration of pension schemes for current and former employees and their beneficiaries.

Comply with Legal Obligations, for example:

• Paying taxes.
• Meeting health and safety obligations.

Consent, where we process special category Personal Data, for example on illness, disability or dietary requirements.

4.2.3. How do we share your Personal Data?

We may disclose some or all of the Personal Data we collect from you to certain trusted third parties in accordance with contractual arrangements we have in place with them, including:

• Suppliers and service providers to whom we outsource certain employment- and pension-related services, including recruitment consultants, payroll providers, pension advisors and insurance brokers and providers.
• IT service providers.

4.3. If you are a person who holds shares in DCC

4.3.1. What Personal Data do we process about people who hold shares in DCC?

We process Personal Data about people who are current and former shareholders of DCC. This may include:

• Name.
• Contact information such as home address and email address.
• Details of shareholdings, including changes made over time.
• Information to allow us to make payments, such dividends.
• Special category Personal Data, for example on disability or dietary requirements in connection with attendance at DCC general meetings.

4.3.2. What is the legal basis for this processing?

We rely on the following legal grounds for this processing:

Comply with Legal Obligations, for example:

• Maintaining an up-to-date share register.
• Issuing notices of general meetings.

Performance of a Contract, for example:

• Paying dividends.

Legitimate Interests, for example:

• Changing the service providers who have contact with shareholders.
• Changing how we communicate with shareholders.

Consent, where we process special category Personal Data, for example:

• Ensuring access to information for shareholders with disabilities.
• Where shareholders attending DCC general meetings advise us of special dietary requirements.

4.3.3. How do we share your Personal Data?

We may disclose some or all of the Personal Data we collect from you to certain trusted third parties in accordance with contractual arrangements we have in place with them, including:

• Suppliers and service providers to whom we outsource relevant services, including our share registrars.
• IT service providers.

4.4. If we deal with you, or an organisation with which you are connected, in the course of our business activities

4.4.1. What Personal Data do we process if we deal with you, or an organisation with which you are connected, in the course of our business activities?

We process Personal Data about people we deal with in the course of our business activities. This may include:

• Name.
• Employer.
• Role or job title.
• Contact details, including address, email address and phone number.
• Details of visits to DCC and correspondence, communications and connections with our employees.
• Special category Personal Data, for example on disability or dietary requirements in connection with meetings at our premises.
• Publicly-available information.
• Information which is provided to us by you or by an organisation with which you are connected.

4.4.2. What is the legal basis for this processing?

We rely on the following legal grounds for this processing:

Legitimate Interests, for example:

• Entering into a contractual relationship with the organisation with which you are connected.
• Managing and administering your or your organisation's business relationship with us.
• Carrying out due diligence.

Performance of a Contract, for example:

• Executing the purchase of a new business.

Comply with Legal Obligations, for example:

• Meeting health and safety obligations.

Consent, where we process special category Personal Data, for example:

• Where visitors to our premises advise us of special dietary requirements.

4.4.3. How do we share your Personal Data?

We may disclose some or all of the Personal Data we collect from you to certain trusted third parties in accordance with contractual arrangements we have in place with them, including:

• Suppliers and service providers to whom we outsource support services.
• IT service providers.

5. Personal Data that you provide to us

It is your responsibility to ensure that all Personal Data you provide to us are complete, accurate, up-to-date, and not misleading.

You may provide Personal Data to us about yourself or about other people. If you provide us with Personal Data about another person, you must ensure that you are entitled to disclose the Personal Data of that other person to us and that we may process that Personal Data in accordance with this Privacy Statement without having to take any further steps. It is your responsibility to ensure that the person concerned is aware of the content of this Privacy Statement.

6. How long do we keep your Personal Data?

We will keep your Personal Data for the longer of the following two periods:

• Any period required for the Performance of a Contract or to Comply with Legal Obligations.
• For as long as it is relevant to and useful for the purpose for which they were originally collected.

7. Transfers of personal data

In certain circumstances we may transfer your Personal Data outside the European Economic Area. We only transfer your Personal Data where the EU Commission has decided that the third country in question ensures an adequate level of protection in line with EU data protection standards or where there are other safeguards in place to protect your Personal Data. If you would like to find out more about the safeguards that we have in place to govern the transfer of your Personal Data you can contact us at dataprotection@dcc.ie.

8. Your rights

You have a number of rights regarding access to and control of your Personal Data, including:

• Right of Access: You have the right to know what type of Personal Data DCC holds about you and to obtain a copy of these Personal Data.
• Right to Complain: You have the right to lodge a complaint regarding the processing of your Personal Data to the Data Protection Commission.
• Right of Erasure: In certain circumstances you may request that we delete the Personal Data that we hold about you.
• Right to Object: Where we rely on our Legitimate Interests to process your Personal Data, you have a right to object to this. We will not continue to process your Personal Data unless we can demonstrate an overriding Legitimate Interest in this.
• Right to Portability: You may request us to provide you with certain Personal Data which you have given us in a structured, commonly-used and machine-readable format and you may request us to transmit your Personal Data directly to another data controller where this is technically feasible.
• Right to Rectification: You have the right to have any inaccurate Personal Data which we hold about you updated or corrected.
• Right to Restriction: You have the right to request that DCC stops using your Personal Data in certain circumstances including if you believe that the Personal Data we hold about you are inaccurate or that our use of your Personal Data is unlawful. If you validly exercise this right, we will store your Personal Data and will not carry out any other processing of them until the issue is resolved.

Please bear in mind that your rights in relation to your Personal Data are not absolute and that we must be cognisant of other legal and regulatory obligations.

You can exercise your rights in relation to your Personal Data by contacting dataprotection@dcc.ie. We may request that you provide proof of your identity for security reasons and in order to prevent the unauthorised disclosure or misuse of Personal Data. We will only charge you for requests to access your Personal Data where they are unreasonable, unfounded or excessive. If, after contacting us, you are still not satisfied with our response, you have the right to lodge a complaint with the Data Protection Commission. Please see www.dataprotection.ie for more on this.

9. Changes to this Statement

We may amend this Statement on occasion, in whole or part, at our sole discretion. Any changes will be effective immediately. You should check this page from time-to-time and take note of any changes we make, as they will be binding on you. We will include the effective date on each version of this Statement that we issue.

If at any time we decide to use your Personal Data in a manner significantly different from that described in this Statement, or as otherwise disclosed to you at the time they are collected, we will notify you by e-mail or by telephone, and you will have a choice as to whether or not we use your Personal Data in the new manner.

10. Cookies and web beacons

We may collect information about your computer, including, where available, your IP address, operating system and browser type, for system administration and to collate aggregate information about how you browse our Websites. We use Google Analytics on our Websites. Google Analytics uses cookies and web beacons in connection with the services it provides.

Information about your general Internet use may be obtained by using a cookie file which is stored on the hard drive of your computer. Cookies contain information that is transferred to your computer’s hard drive. Web beacons may also be used. These facilitate the transfer of data from our Websites to the Google Analytics website. Cookies and web beacons help us to improve our Websites. They may be used to enable us to:

• Estimate usage numbers, patterns and related activity.
• Store information about how you accessed and use our Websites and your preferences, and so allow us to customise our Websites according to your individual interests.
• Recognise you when you return to our Websites.

Information collected may be transmitted to and stored by Google on servers in the United States. Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google’s behalf. You may refuse to accept cookies by activating the relevant setting on your browser. However, if you select this setting you may be unable to access certain parts of our Websites or be unable to avail of some services we provide. Unless you have adjusted your browser setting so that it will refuse cookies, cookies will issue when you log on to our Websites.

11. Contact

If you have any questions or concerns, please contact us on dataprotection@dcc.ie.