LUXEMBOURG PROFESSIONAL SECRECY

RSA Luxembourg S.A. ("RSAL", "we", "our", "us") is an insurance undertaking subject to Luxembourg law.

In order to comply with our professional secrecy obligations (under the Luxembourg Law of 7 December 2015 on the insurance sector), and as a policyholder of RSAL ("you", "your"), you acknowledge, authorise and accept the following types of services we may outsource to External Service Providers (as defined below), the types of information that may be transmitted to such External Service Providers and the countries in which these may be located – as further detailed below.

You acknowledge, authorise and accept the following:

a) We may be required, in your interest and in order to comply with our obligations and efforts to provide services of the highest level, to outsource or entrust certain tasks, activities, functions and/or services (the "Activities") related to the performance of the insurance contract, to external service providers, including our parent company, Royal & Sun Alliance Insurance Limited, reinsurers, legal counsel, auditors, IT service providers, credit institutions, factoring companies, insurance intermediaries or other service providers, intra-group or otherwise, who may or may not be regulated (the "External Service Providers");

b) The External Service Providers are established in countries both inside and outside the European Economic Area (the "Service Providers Countries"), including among others Belgium, Canada, France, Hong Kong, India, the Netherlands, Spain, the United Kingdom and the United States;

c) Activities include, among others, access to global network services, risk modelling, technical assistance, actuarial functions, product development and claims assessment functions, consultancy services for risk engineering, calculation of technical reserves, underwriting of insurance policies and assessment for renewals, as well as administrative and operational assistance;

d) The information concerning you, the insured and the beneficiary(-ies) of your contract and your authorised representative may be communicated by RSAL to an External Service Provider in the context of the Activities (the "Confidential Data"). The Confidential Data includes in particular the description of your activities, and those of the insured and beneficiary(-ies) of your contract and/or your authorised representative(s), their identification data (in particular, for natural persons, first name, surname, date and place of birth, passport or identity document, and, for legal entities, name, company name, date of incorporation), the details of contact persons and/or the authorised representative and, in general, all information relating to your assets and funds that you have provided to RSAL;

e) The transfer and/or disclosure of the Confidential Data to the External Service Providers occurs in your best interest and enables us to comply with our obligations and efforts to provide services of the highest level;

f) RSAL cannot be held liable for any loss, damage or costs resulting from the transmission of the Confidential Data, except in the case of intentional or gross negligence on our part;

g) By agreeing to enter into an insurance contract of RSAL, paying a premium, or otherwise entering into a relationship with us, you declare and confirm to have read the foregoing and instruct, authorize and consent to the transmission of the Confidential Data to the different types of third parties, located in various countries, as detailed above.

This notice relates solely to the RSAL’s professional secrecy obligations under the relevant Luxembourg Law and is not intended to be a notice or meet any obligations under applicable data protection legislation. Please refer to the privacy notice available at https://www.rsainsurance.es/en/support/legal-information/privacy-policy/ for information about how RSAL processes any personal data received.