Where we share your personal data with internal or external third parties as set out above, this may involve transferring your personal data outside the jurisdictionwhere Mirabello is established and outside the European Economic Area. We will transfer your personal data in accordance with standard contractual clauses(European Commission: Model contracts for the transfer of personal data to third countries) to ensure your personal data is transferred securely and in compliancewith data protection legislation, including the GDPR.

We will ensure that appropriate security measures are taken against unlawful or unauthorized processing of personal data, and against accidental loss of, ordamage to, personal data. Such measures shall include (a) encrypting the personal data we process, (b) ensuring the ongoing confidentiality, integrity, availabilityand resilience of the processing systems and services that we use; (c) ensuring that the availability of and access to personal data can be restored in a timelymanner after an accident; (d) regularly assessing and evaluating the effectiveness of the technical and organizational measures adopted; and (e) carrying out a dataprotection impact assessment prior to implementing a new set of processing operations. All personal data is stored in a secure environment and we have physicaland electronical data access controls in place whereby access is granted only to persons authorized to access the data on a need to know basis, all of whom arebound by confidentiality obligations not to disclose any personal data. We have data integrity controls in place. Please contact us ondata@mirabelloconsultancy.com for further details with respect to our technical and organizational security measures. No method of transmission of data is onehundred percent (100%) secure and absolute security cannot be guaranteed. We shall only store your data as long as this is strictly necessary for the purposes forwhich it was collected. Retention of most data shall not exceed 10 years from the date of termination or completion of our services (in case we did not enter into acontract from the date of the data collection). This period of retention enables us to use the data for the defense of any potential legal claims (taking into accountthe applicable limitation periods prescribed at law) as well as to comply with our legal obligations such as applicable accounting and tax laws. Whenever and to theextent possible, we anonymize the data we hold about you when it is no longer necessary to identify you from the personal data which we hold about you.

You are entitled to exercise the following rights:

7.1. Right to Access Information: You have the right to request information as to whether or not your personal data is being processed by us as well asinformation as to how and why it is processed. You may send an email to data@mirabelloconsultancy.com requesting information as to the personal data which weprocess. You shall receive one copy free of charge via email of the personal data which is undergoing processing. We may charge a reasonable fee, if your request isclearly unfounded, repetitive or excessive in which case we may also refuse to comply with your request in these circumstances.

7.2. Right to object: You may ask us not to process your personal data for marketing purposes and your data will no longer be processed for such purposes.

7.3. Right to withdraw consent: You have the right to withdraw your consent to this Notice, and the processing practices described herein, at any time by sendingan email to data@mirabelloconslutancy.com. This will not however affect the lawfulness of processing which we carried out on the basis of such consent before itswithdrawal. Withdrawal of consent may affect or impact the possibility of us providing you with the services.

7.4. Right to rectification:  You have the right to obtain rectification of any inaccurate personal data about you that we have processed, update any data which isout-of-date and the right to have incomplete personal data completed, including by means of a supplementary statement.

7.5. Right to erasure: You have the right to obtain the erasure of personal data we have concerning you when your personal data is no longer required where:You withdraw your consent to us processing your personal data;Your personal data no longer needs to be processed; orYour personal data has been unlawfully processed.

7.6. Right to Restriction of Processing: You have the right to restrict our processing activities where:

• You contest the accuracy of this personal data, for a periodenabling us to verify the accuracy of the same personal data;

• Our processing is deemed unlawful, and you oppose the erasure of your personal data and requestrestriction of its use instead;

• We no longer need your personal data for the purposes stated in this Notice, but you require it for the establishment, exercise ordefense of legal claims; or you have objected to our processing pending the verification whether the legitimate grounds of our processing activities overrode thosepertaining to you.

7.7. Right of Data Portability: As from 25 May 2018, you shall have the right to receive your personal data in a structured and machine-readable format andtransmit this data to another controller.

We welcome any comments, complaints and queries in relation to data protection. As indicated above you may contact us at data@mirabelloconsultancy.com andwe shall try our best to deal with any issue or concern you may have. If we fail to address your concerns, you have the right to lodge a complaint with the dataprotection authority in the jurisdiction where you or Mirabello is based and where Mirabello is based and/or represented outside the European Economic Area withthe Swiss Federal Data Protection and Information Commissioner (FDPIC) at www.edoeb.admin.ch/edoeb/en/home/the-fdpic/contact.html, as the relevant nationalsupervisory authority on data protection matters for us.

I hereby confirmthatthe information provided in this Internal Due Diligence, iscorrect,completeand notmisleading in any way. I hereby acknowledgemy obligation to informMirabello immediately of any changestothe information I have provided and know that if I intentionally provide wrong or incorrect information or falsify thisFormAthismay be prosecuted asacriminal offence underapplicable laws. I agreethat in case I intentionally provide wrong or incorrect information or falsify this Internal Due Diligence, I willindemnify Mirabelloagainstall losses, liabilities,actions, proceedings,claims,costsand expenses incurred orthreatened against Mirabellocaused by my actions.