This China Privacy Schedule supplements our General Privacy Notice and applies where the Personal Information Protection Law of the People’s Republic of China, together with applicable PRC data protection, cybersecurity and data security laws, applies to our processing of personal information.

For the purposes of this Privacy Schedule, “personal information”, “sensitive personal information”, “processing” and “personal information processor” have the meanings given under applicable PRC law.

Otherwise, unless defined herein, capitalised terms in this Privacy Schedule shall be as defined in our General Privacy Notice.In particular, “Agency” and “Agency Group” refer to the specific agency, legal entity or group of entities responsible for the relevant processing, as described in the General Privacy Notice.

The personal information processor responsible for your personal information will usually be the Agency Group entity with which you or your organisation has a relationship, or which operates the relevant website, event or service.

You may contact us at: DPO@the-independents.com

Please see our General Privacy Notice for details of the relevant local entity or representative. Where required by PRC law, other details will be provided separately.

We may process the following categories of personal information:

Category 1: Identity and contact information
Examples: Name, employer, job title, business address, email address, telephone number, social media/professional profile details

Category 2: Business communications
Examples: Emails, messages, meeting notes, call notes, event interactions and professional correspondence

Category 3: Profile and relationship information
Examples: Preferences, event attendance, interests, feedback, marketing preferences and relationship management notes

Category 4: Technical and usage information
Examples: IP address, browser type, device identifiers, website usage data, cookie and analytics information

Category 5: Compliance information
Examples: Information used for sanctions, anti-bribery, KYC, onboarding, supplier/client screening and related checks

Category 6: Financial and transaction information
Examples: Invoicing details, payment information, purchase order details and transaction records

Category 7: Other information
Examples: Information you or your organisation provide to us in the course of business

We process personal information by electronic and, where necessary, manual means for the following purposes:

• managing our business relationship with you or your organisation;
• communicating with you;
• providing or receiving services;
• administering contracts, projects, accounts, procurement and payments;
• organising and managing events;
• conducting compliance, sanctions, anti-bribery, KYC and onboarding checks;
• sending business updates, invitations and marketing communications, where permitted;
• maintaining and improving our website, systems, services and operations;
• managing group administration, reporting and internal business operations;
• protecting our business, systems, staff, clients and partners;
• managing corporate transactions, reorganisations or integrations; and
• complying with legal, regulatory, tax, accounting and reporting obligations.

We do not usually seek to collect sensitive personal information from business contacts.

Where we need to process sensitive personal information, we will do so only where there is a specific purpose and sufficient necessity, and where required by PRC law we will obtain your separate consent.

Sensitive personal information may include information such as identification documents, financial account information, precise location data, health information, biometric information or other information treated as sensitive under PRC law.

We may share or entrust processing of your personal information with the categories of recipients described in our General Privacy Notice, including:

• Agency Group and The Independents Group companies;
• IT, hosting, CRM, email, marketing and system administration providers;
• event partners and business partners;
• professional advisers, including lawyers, auditors, insurers and accountants;
• compliance screening providers;
• regulators, courts, public authorities and law enforcement bodies; and
• parties involved in corporate transactions, reorganisations or integrations.

Where required by PRC law, we will provide additional details and/or obtain separate consent before sharing your personal information with another independent personal information processor.

Because we are part of an international group, your personal information may be transferred outside Mainland China to Agency Group entities, The Independents Group entities, clients, business partners and service providers in other jurisdictions, including the UK, EEA, United States, Hong Kong, Singapore, Japan, Korea, Switzerland, UAE and other countries in which we, our group companies, clients or service providers operate.

Where required by PRC law, we will implement an appropriate cross-border transfer mechanism, which may include:

• obtaining your separate consent;
• conducting a personal information protection impact assessment;
• entering into the PRC standard contract for cross-border transfer of personal information;
• completing a security assessment where required; and/or
• applying other lawful transfer mechanisms recognised under PRC law.

Where required by PRC law, we will provide additional details of overseas recipients, including their name or category, contact details, country or region, processing purposes, processing methods, categories of personal information, retention period and how you may exercise your rights.

The table set out in the Appendix to this Privacy Schedule provides an overview of the categories of overseas recipients to whom personal information may be transferred. Where PRC law requires more specific details of named overseas recipients, these will be provided separately or on request, as required by applicable law.

We retain personal information only for the period necessary for the purposes described in this Privacy Schedule and our General Privacy Notice, unless a longer retention period is required or permitted by law.

When personal information is no longer required, we will delete it, anonymise it or otherwise handle it in accordance with applicable PRC law and our retention policies.

We do not use your personal information to make decisions based solely on automated processing that produce legal or similarly significant effects on you, unless we notify you separately and do so in accordance with applicable law.

Where we use automated tools, analytics or profiling in connection with our services, we will do so in accordance with applicable law. Where PRC law applies, you may have the right to request an explanation of automated decision-making and to refuse decisions made solely by automated decision-making where such decisions have a significant impact on your rights and interests.

Subject to applicable PRC law, you may have the right to:

• know and decide about the processing of your personal information;
• restrict or refuse processing;
• access and copy your personal information;
• correct or supplement inaccurate or incomplete personal information;
• request deletion of your personal information;
• withdraw consent where processing is based on consent;
• request an explanation of our personal information processing rules; and
• request transfer of your personal information where applicable legal conditions are met.

To exercise your rights, please contact: DPO@the-independents.com

We may need to verify your identity before responding to your request.

Updated: April 2026

Cross-border transfers of personal information:

Agency Group companies and The Independents Group entities outside Mainland China

UK, EEA, United States, Hong Kong, Singapore, Japan, Korea, Switzerland, UAE and other jurisdictions where group entities operate

Purpose of Transfer:
Group administration, business relationship management, service delivery, reporting, finance, legal, compliance, IT support, management oversight and internal operations

Categories of Personal Information:
Identity and contact information, business communications, profile and relationship information, technical and usage information, compliance information, financial and transaction information and other relevant business information

Processing Method:
Access, storage, use, organisation, analysis, transmission, hosting, support and reporting

Retention Period:
As described in our General Privacy Notice, this Privacy Schedule and our applicable retention policies; generally for as long as necessary for the relevant business, legal, compliance, contractual or operational purpose

How to Exercise Rights:
DPO@the-independents.com

IT, hosting, cloud, CRM, email, collaboration and system administration providers

UK, EEA, United States, Hong Kong, Singapore and other jurisdictions depending on the provider and system used

Purpose of Transfer:
Hosting, storage, IT support, system administration, cybersecurity, CRM management, email communications, collaboration tools and business continuity

Categories of Personal Information:
Identity and contact information, business communications, technical and usage information, profile and relationship information and other information stored in relevant systems

Processing Method:
Hosting, storage, access, transmission, support, maintenance, security monitoring and troubleshooting

Retention Period:
For the duration of the relevant service and thereafter as required by contract, law or applicable retention policy

How to Exercise Rights:
DPO@the-independents.com

Clients, brands, event partners, production partners and business partners

Relevant client or partner jurisdictions, which may include the UK, EEA, United States, Hong Kong, Singapore, Japan, Korea, UAE and other event or project locations

Purpose of Transfer:
Delivering services, managing campaigns, events, productions, collaborations, guestlists, logistics, reporting, client communications and business relationships

Categories of Personal Information:
Identity and contact information, business communications, profile and relationship information, event or project information, logistics information and other information relevant to the specific service

Processing Method:
Access, use, transmission, organisation, analysis, reporting and project administration

Retention Period:
For the duration of the relevant project, event, campaign or business relationship and thereafter as required for legal, contractual, audit, reporting or dispute purposes

How to Exercise Rights:
DPO@the-independents.com

Event, travel, hospitality, logistics and production service providers

Event, travel or production destination countries and provider locations, which may include the UK, EEA, United States, Hong Kong, Singapore, Japan, Korea, UAE and other jurisdictions

Purpose of Transfer:
Event administration, travel booking, accommodation, transport, hospitality, access control, security, production support and related logistics

Categories of Personal Information:
Identity and contact information, travel information, passport or identification details where necessary, accommodation details, event attendance, dietary/accessibility information where relevant and other logistics information

Processing Method:
Access, use, transmission, booking, coordination, storage and support

Retention Period:
For the duration of the relevant booking, event, travel, production or logistics purpose and thereafter only as required for legal, audit, security, insurance or dispute purposes

How to Exercise Rights:
DPO@the-independents.com

Finance, accounting, payment, banking and professional services providers

UK, EEA, United States, Hong Kong, Singapore, Switzerland and other jurisdictions depending on the provider

Purpose of Transfer:
Payments, invoicing, accounting, audit, tax, banking, legal, insurance, compliance and professional advisory services

Categories of Personal Information:
Identity and contact information, financial and transaction information, invoices, payment details, purchase order information, tax/accounting information and relevant business communications

Processing Method:
Access, use, storage, transmission, review, reporting, audit and professional advice

Retention Period:
For the period required for payment, accounting, tax, audit, legal, regulatory and dispute purposes, in accordance with applicable law and our retention policies

How to Exercise Rights:
DPO@the-independents.com

Compliance screening, sanctions, anti-bribery, KYC and onboarding providers

UK, EEA, United States and other jurisdictions depending on the provider

Purpose of Transfer:
Supplier/client screening, sanctions checks, anti-bribery checks, onboarding, compliance, risk management and regulatory recordkeeping

Categories of Personal Information:
Identity and contact information, employer/company information, role/title, due diligence information, screening results and relevant compliance information

Processing Method:
Access, screening, matching, review, storage, reporting and transmission

Retention Period:
For as long as necessary for compliance, legal, audit, regulatory, risk management and dispute purposes

How to Exercise Rights:
DPO@the-independents.com

Professional advisers, regulators, courts, public authorities and law enforcement bodies

Relevant jurisdictions depending on the matter

Purpose of Transfer:
Legal advice, audit, insurance, regulatory compliance, litigation, investigations, enforcement, reporting and protection of rights

Categories of Personal Information:
Relevant categories of personal information necessary for the relevant legal, regulatory, audit, insurance, investigation or dispute purpose

Processing Method:
Access, use, disclosure, transmission, review, storage and professional analysis

Retention Period:
For as long as required or permitted by applicable law, professional obligations, regulatory requirements, litigation hold, audit or dispute purposes

How to Exercise Rights:
DPO@the-independents.com

Parties involved in corporate transactions, reorganisations, integrations, investments or asset sales

Relevant jurisdictions depending on the transaction

Purpose of Transfer:
Due diligence, transaction planning, corporate integration, restructuring, investment, merger, acquisition or asset sale

Categories of Personal Information:
Identity and contact information, business communications, financial and transaction information, contractual information, compliance information and other information relevant to the transaction

Processing Method:
Access, review, analysis, disclosure, storage, transmission and integration planning

Retention Period:
For the duration of the transaction process and thereafter as required for legal, regulatory, audit, corporate recordkeeping or dispute purposes

How to Exercise Rights:
DPO@the-independents.com

The Independents Group entities outside Mainland China

UK, EEA, United States, Hong Kong, Singapore, Japan, Korea, Switzerland, UAE and other jurisdictions where group entities operate

Purpose of Transfer:
Group administration, business relationship management, service delivery, reporting, finance, legal, compliance, IT support, management oversight and internal operations

Categories of Personal Information:
Identity and contact information, business communications, profile and relationship information, technical and usage information, compliance information, financial and transaction information and other relevant business information

Processing Method:
Access, storage, use, organisation, analysis, transmission, hosting, support and reporting

Retention Period:
As described in our General Privacy Notice, this Privacy Schedule and our applicable retention policies; generally for as long as necessary for the relevant business, legal, compliance, contractual or operational purpose

How to Exercise Rights:
DPO@the-independents.com

IT, hosting, cloud, CRM, email, collaboration and system administration providers

UK, EEA, United States, Hong Kong, Singapore and other jurisdictions depending on the provider and system used

Purpose of Transfer:
Hosting, storage, IT support, system administration, cybersecurity, CRM management, email communications, collaboration tools and business continuity

Categories of Personal Information:
Identity and contact information, business communications, technical and usage information, profile and relationship information and other information stored in relevant systems

Processing Method:
Hosting, storage, access, transmission, support, maintenance, security monitoring and troubleshooting

Retention Period:
For the duration of the relevant service and thereafter as required by contract, law or applicable retention policy

How to Exercise Rights:
DPO@the-independents.com

Clients, brands, event partners, production partners and business partners

Relevant client or partner jurisdictions, which may include the UK, EEA, United States, Hong Kong, Singapore, Japan, Korea, UAE and other event or project locations

Purpose of Transfer:
Delivering services, managing campaigns, events, productions, collaborations, guestlists, logistics, reporting, client communications and business relationships

Categories of Personal Information:
Identity and contact information, business communications, profile and relationship information, event or project information, logistics information and other information relevant to the specific service

Processing Method:
Access, use, transmission, organisation, analysis, reporting and project administration

Retention Period:
For the duration of the relevant project, event, campaign or business relationship and thereafter as required for legal, contractual, audit, reporting or dispute purposes

How to Exercise Rights:
DPO@the-independents.com or, where appropriate, the relevant client or partner identified to you

Event, travel, hospitality, logistics and production service providers

Event, travel or production destination countries and provider locations, which may include the UK, EEA, United States, Hong Kong, Singapore, Japan, Korea, UAE and other jurisdictions

Purpose of Transfer:
Event administration, travel booking, accommodation, transport, hospitality, access control, security, production support and related logistics

Categories of Personal Information:
Identity and contact information, travel information, passport or identification details where necessary, accommodation details, event attendance, dietary/accessibility information where relevant and other logistics information

Processing Method:
Access, use, transmission, booking, coordination, storage and support

Retention Period:
For the duration of the relevant booking, event, travel, production or logistics purpose and thereafter only as required for legal, audit, security, insurance or dispute purposes

How to Exercise Rights:
DPO@the-independents.com