The Process by Olana (collectively, the "company," "we," "us," or "our") is committed to safeguarding the privacy of visitors to our website (collectively, the "website"), contacts for our clients and prospective clients, contacts for suppliers of goods and services to the company, candidates for employment or engagement, and any other individuals about whom the company obtains personal information (each, "you"). Please read the following statement, which sets out the principles governing the company's use of personal information that we may obtain about you, to understand how the company collects, uses, and otherwise processes your personal information as well as the rights that you have in relation to our processing of that information (the "privacy policy"). In this privacy policy, "personal information" means information that (either in isolation or in combination with other information held by the company) enables you to be identified or recognized. With respect to California residents, references to "personal information" in this privacy policy mean information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household, subject to certain exceptions set forth in the California Consumer Privacy Act (the "CCPA"). The company will not sell or disclose personally identifiable information about you to unaffiliated third parties except in accordance with this privacy policy.

COLLECTION OF INFORMATION

Although you are not required to provide any personal information on the public areas of our website, you may choose to do so by completing certain contact or marketing forms. Should you do so, we may, for example, keep a record of your name, email address, and any other information you voluntarily provide to us.

Additionally, we may collect the following categories of personal information from you in the course of business, including through your use of the Website, when you contact or request information from us, when we provide services to you, or when we receive services from you. If you choose not to provide such information, you may not be permitted to access certain Company Website features, content or services.

Identification data, such as name, gender, title, job title, or address.

Contact information, including your phone number(s), your email address, and your social media account or handle where appropriate.

Financial data, such as bank account information and invoicing details.

Event registration or mailing list data, such as dietary requirements (which may reveal information about your health or religious beliefs), preferences and interests, subscriptions, downloads, and username/passwords.

Job applicant data, such as identification data and contact information, resumé and other data provided

by you or third parties (e.g. recruiters) on our website, online recruitment portal (where applicable) or offline in connection with job openings, which may be subject to additional local requirements.

Legal and regulatory compliance data as required for purposes such as know your client, anti-money laundering, and market abuse regulations requirements, or as part of our client onboarding process, which may include passport or other identification data, date of birth, home address, and other due diligence data.

Other service data, such as personal information relevant to the provision or receipt of services, in relation to any of your employees, customers or vendors, and client feedback.

Cookie and device data, such as information about your visit to our website, IP address, the URLs of the websites and pages you visit (before, during and after your visit to the Company Website) and the times and dates of such visits, information about the computer hardware and software you use, device identifier, location and time zone setting, even when you are not logged in. Also, the Company may place "cookies" on your computer to recognize you on return visits to enable the Company to enhance your browsing experience, as well as to collect additional information about you. As further described below, you may adjust your browser settings or use other means to prevent cookies from being placed on your computer, but doing so may result in reduced functionality and a less personalized browsing experience.

We may supplement the information that you provide to us with information that we receive or obtain from other sources, such as from our staff or personnel, clients, professional advisers, partners, and agents of the Company, third parties with whom we interact, and publicly available sources.

USE OF INFORMATION

We may use your personal information for the following purposes:

Administration of client and vendor relationships – We use identification data, contact details, financial data, and other service data, including for the processing of invoices, the updating of client records, and the management of our vendor relationships. This is necessary to perform our contract with you.

Addressing client inquiries/feedback – We use identification data, contact details, and other service data for this purpose. This process is necessary to perform our contract with you. It may also be necessary for our legitimate interests to establish or maintain a relationship with you; it is also in your interest to receive a response from us when you contact us.

Sending relevant marketing messages and inviting you to events/seminars – We use identification data, contact details, cookie and device data, and mailing list data to communicate with you by way of email alerts and post to provide you with

information about our events, seminars, or services that may be of interest to you. This processing is necessary for our legitimate interest to send you tailored marketing messages, client newsletters, and invitations to relevant events and seminars.

Improving our website – We use cookie and device data to improve the functionality and user-friendliness of our website. This is necessary for our legitimate interests to constantly monitor and improve our online presence and services to you.

Keeping our website and IT systems and processes safe – We use identification data, contact details, financial data, cookie and device data, and other service data. This is necessary to perform our contract with you and to ensure the security and confidentiality of your data. It is also necessary for our legitimate interests to prevent illegal activities, including fraud, which could harm you and us.

Complying with legal or regulatory inquiries/requests – We use identification data, contact details, financial data, cookie and device data, and legal and regulatory compliance data (including for anti-money laundering or fraud detection purposes, statutory returns and fulfillment of the Company's ethical obligations). This is necessary for the purpose of complying with legal requirements that apply to the Company.

Recruitment – Personal information about job applicants is collected and processed for purposes of screening, identifying, and evaluating candidates for positions; record-keeping related to hiring processes;

analyzing the hiring process and outcomes; and conducting background checks, where and to the extent permitted by applicable law, which may also be subject to relevant local recruitment privacy policy. If you are hired by the Company, this data will be transferred to our employee record files for the purpose of your employment. This is necessary in order to take steps at the request of the job applicant in the context of recruitment prior to entering into a contract. In addition, job applicant data and legal and regulatory compliance data may be used as necessary to comply with legal, regulatory, and corporate governance requirements.

INFORMATION SHARING

We may share your personal information with the following categories of recipients:

To use certain services on our website, payment card information may be requested. We may ask you for credit card, debit card, or other payment information. By submitting your payment information through our websites, to the extent permitted by applicable law, you expressly consent to the sharing of your information with third-party payment processors, and other third-party service providers;

Vendors that will process your personal information on our behalf and under our written instructions to carry out their services during the course of our business, such as IT service providers, financial institutions, customer relationship management

databases and other cloud-based solutions, third- party companies providing us with business analytics and statistics to assist with our marketing campaigns, and third-party venues in which we may host events and seminars. We contract with such vendors to ensure that they only process your personal information under our instructions and ensure the security and confidentiality of your personal information by implementing the appropriate technical and organizational measures for such processing;

Any law enforcement, regulatory, or government agency requesting personal information in connection with any inquiry, subpoena, court order, or other legal or regulatory procedures, with which we would need to comply. We may also share personal information to establish or protect the Company's legal rights, property, or safety, or the rights, property, or safety of others, or to defend against legal claims;

Any third party connected with business transfers; we may transfer your personal information to third parties in connection with a reorganization, restructuring, merger, acquisition, or transfer of assets of the Company, provided that the receiving party agrees to treat your personal information in a manner consistent with this Privacy Policy.

We are not responsible for the data policies or procedures or content of any linked websites. We recommend that you check the privacy and security policies of each website you visit.

TRANSFERS OF INFORMATION

Your personal information may be transferred to or shared across our integrated computer networks with one or more Company offices and our affiliated offices in the United States, or carefully selected service providers that the Company may engage to host the Company Website or to provide other services that may not be subject to data protection laws similar to those prevailing in the jurisdiction in which such information is provided to or received by us. All of our offices adhere to the same procedures with respect to your personal information, including this Privacy Policy, and the Company will require all such service providers to use the information solely to provide the specified services, and otherwise to conform to the requirements of this Privacy Policy.

Your Rights

If you are a California resident, you have the following rights, subject to certain exceptions as set forth in the CCPA:

Right to access personal information. You have the right to receive the specific pieces of your personal information we have collected about you in the 12 months preceding your request.

Right to data portability.You have the right to receive a copy of your electronic personal information in a readily-usable format.

Right to know.You have the right to receive information from us regarding the categories of personal information we collected, the sources from which we collect personal information, the purposes for which we collected and shared personal information, the categories of any personal information we sold as well as the categories of third parties to whom such personal information was sold, and the categories of personal information that we disclosed for a business purpose in the 12 months preceding your "right to know" request.

Right to request deletion.You have the right to request the deletion of the personal information that you provided to us. Please note that in certain instances we may not be able to process your request, such as (i) due to the existence of a legal obligation, (ii) to detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities, or (iii) in order to complete a transaction for which your personal information was collected.

Right to non-discrimination. You have the right to be free from discrimination by us as a result of you exercising your rights under the CCPA.

If you wish to exercise these rights, you must submit a request by emailing [Company email address]. The CCPA requires us to verify requests we receive when one is seeking to exercise certain of the rights listed above. We may ask you to provide certain information in order for us to verify your request.

Note that certain of the rights set forth above do not apply until January 1, 2021 for job applicants, employees, partners, and contractors, and when personal information is transmitted in business-to-business written or verbal communications or transactions relating to due diligence, or providing or receiving a product or service to or from another business, and the personal information concerns an employee, owner, director, officer or contractor of that business.

The Company has collected the following types of personal information about California residents in the last 12 months:

CATEGORY

Examples of Personal Information in this Category

IDENTIFIERS AND PERSONAL INFORMATION.

Name, mailing address, email address, phone numbers, online identifier, Internet Protocol address, Social Security number, driver's license number, passport number, or other similar identifiers, education, employment history, bank account number, credit or debit card number, other financial information, medical information, and health insurance information.

PROTECTED CHARACTERISTICS.

Age, gender, demographic group, citizenship, marital status, medical condition, physical or mental disability, and sexual orientation, and veteran or military status.

INTERNET OR OTHER SIMILAR NETWORK ACTIVITY.

Browsing history, search history, information on a consumer's interaction with a website, application, or advertisement.

PROFESSIONAL OR EMPLOYMENT- RELATED INFORMATION.

Current or past job history or performance evaluations.

Sources of Personal Information Collected. We obtain the categories of personal information listed above from the following categories of sources: directly from you, such as when you complete forms, indirectly from you, such as observing your actions on our website, and from publicly available sources.

Disclosures for a Business or Commercial Purpose. In the preceding 12 months, the Company has disclosed the types of personal information listed above to its service providers for business purposes.

No Sale of Personal Information. In the preceding 12 months, we have not sold any personal information.

SECURITY

We have implemented technical and organizational security measures in an effort to safeguard the personal information in our custody and control. Such measures include, for example, limiting access to personal information only to staff and authorized service providers on a need-to-know basis for the purposes described in this Privacy Policy, as well as other administrative, technical, and physical safeguards.

We endeavor to take all reasonable steps to protect your personal information, but cannot guarantee the security of any data you disclose online. Please note that email is not a secure medium and should not be used to send confidential or sensitive information. By providing information online, you accept the inherent security risks of providing information over the Internet and will not hold us responsible for any breach of security, unless it is due to our negligence or willful default.

COOKIES

Our website uses certain tags, log files, web beacons, and similar tracking technologies from third parties (collectively, "cookies"), of which you should be aware.

Cookies are text files containing small amounts of information that can be downloaded to your device when you visit a website. Cookies enable us to analyze how the Company Website is used and to monitor site performance, so we can create the best user experience. We may also use cookies to personalize language settings and to provide social media features.

In addition to the cookies used by the Company and our service providers, some cookies are placed by third parties such as Google Analytics, as described below.

By using the Company's Website, you agree to the use of cookies for the following purposes:

Essential Cookies: these are essential in order to enable you to move around the Company's Website and use its features, such as accessing secure areas of the website.

Performance and Analytics Cookies: Google Analytics ("Analytics") is Google's free web analytics tool that helps us understand how our visitors engage with our website. Analytics collects information anonymously and, much like examining footprints in sand, it reports website trends without identifying individual visitors. Analytics uses its own set of cookies to track visitor interactions. These cookies are used to store information, such as what time the current visit occurred, whether the visitor has been to the site before, and what site referred the visitor to the web page. Google Analytics customers can view a variety of reports about how visitors interact with their website so they can improve their website and how people find it. A different set of cookies is used for each website, and visitors are not tracked across multiple sites. Analytics customers are obliged to notify users of their use of analytics software. To disable this type of cookie, some browsers will indicate when a cookie is being sent and allow you to decline cookies on a case-by-case basis. In addition to declining cookies, you can also install the Google Analytics Opt-out Add-on in your browser, which prevents Google Analytics from collecting information about your website visits. You can also opt out by clicking here.

Functionality Cookies: they remember the choices you make, such as language options or your current region. These cookies help to make your visit more personal and are deleted automatically when you close your browser or the session expires.

You can block or disable cookies on your device at any time by indicating this in the preferences or options menus in your browser. You can also delete the cookies that are stored on your device. However, blocking, disabling, or deleting cookies may limit your ability to view all the pages of the Company Website or use online services that require registration. You may opt out of Google's use of cookies by visiting their Ad Settings page. You may also opt out of a third-party vendor's use of cookies at the Network Advertising Initiative opt-out page. You can find more information about cookies at www.allaboutcookies.org and www.youronlinechoices.com.

INFORMATION RETENTION

We will only retain your personal information for as long as necessary for the purposes for which that information was collected as set out in this Privacy Policy or for longer as

required under any applicable legal, regulatory, accounting, or reporting requirements. Should you opt out or no longer wish to receive marketing messages from us, we will securely delete your personal information from the relevant mailing list(s).

ADDITIONAL SERVICES

From time to time, the Company may offer additional services through the Company Website. In some cases additional services may be subject to alternative terms of use (as identified by the Company), and your use of any such services will constitute your acceptance of such alternative terms of use. Unless otherwise stated, such alternative terms of use shall apply to supplement this Agreement and in the context of any conflicting terms, this Agreement shall govern with respect to the Company Website, content and services, excepting only those services which are expressly covered, and then only to the extent so expressly covered, by such alternative terms.

UNSUBSCRIBE

We may send you direct marketing messages including by way of email alerts and postal mail. If you no longer wish to receive our email alerts, to be part of a mailing list, or to receive any marketing communications, you can opt-out of such communications at any time by clicking on the unsubscribe link in the relevant communication or contacting us at [Company email address].

NOTIFICATION OF CHANGES

We may occasionally update this Privacy Policy as our services and privacy practices change, or as required by applicable legal or regulatory requirements. Where it is practicable, we will notify you by email of any significant changes. However, the last update date is posted below, and we encourage you to review this Privacy Policy periodically to be informed of how we use your personal information.

DATA RELATING TO CHILDREN

Our Website is designed for those 18 years of age and older. We do not knowingly collect information from anyone under the age of 13 (or such other age as may be restricted under local law). If we are made aware that we have received such information, or any information in violation of our policy, we will use reasonable efforts to locate and remove that information from our records.

CROSS BORDER TRANSFERS

Our website is maintained in the United States. If you are visiting from the regions with laws governing data collection and use that may differ from those in the United States, please note that you may be transferring your information to the United States and in other countries around the world. You freely and specifically give us your consent to export and use your information within the United States and in other countries as specified in this Privacy Policy. You understand that data stored in the United States may be subject to lawful requests by the courts or law enforcement authorities in the United States.

If you are situated in the EU, whenever we transfer your personal data to processors outside of the EU, we ensure appropriate and suitable safeguards are used in such transfer. We may use specific contracts approved by the European Commission which give personal data the same protection it has in the EU.