PRIVACY POLICY

Date: May 8, 2025

Why this privacy policy?

Avendra International is a sub-group of the Aramark corporation, a public entity traded on the NYSE. Avendra International comprises legal entities registered in the UK, Ireland, France, Belgium, the Netherlands, Spain and Germany.

This privacy policy is issued on behalf of Pelican Procurement Services Limited, part of Avendra International (“Avendra”, “we” and “our”), the legal entity registered in the UK. Avendra operates its website and is responsible for the collection and storage of personal data through the website. Avendra respects the privacy of every user of this website (you) and informs you below about how personal data is processed on this website.

Please note that this information on data protection applies exclusively to our website https://www.avendra.com/en/uk and not to third-party websites that you can access via hyperlinks from our website.

Data controller

To the extent that the data processing activities relate to Avendra’s business in the UK, the following Avendra member is the data controller:

Contact details of our compliance department responsible for data processing:

Email: gdpr@avendra.com

What personal data is processed?

a) Data processed when visiting our website

The following data is automatically collected when you visit our website:

• Name of retrieved web page
• Date and time of the retrieval
• Browser type/version
• Operating system
• Referrer URL (the previously visited page)
• IP address
• The requesting provider

b) Data processed when you contact us

You can also provide us with the following data if you contact us via the contact forms integrated on our website or by e-mail:

• Your contact data (e.g. your name and e-mail address) in connection with the
• content of your inquiry as you submit it to us

You are not obliged to provide us with the data listed in the aforementioned sections a) and b). Without this data, however, we are not able to provide you with the website with all its functions or to answer your contact request.

For what purpose and on what legal basis is the data processing carried out?

Insofar as data about access to the website and the server log files also includes personal data, we collect and process this data in our legitimate interest within the meaning of Art. 6(1) lit. f Data Protection Regulation (GDPR) (in order to operate and improve the website).

Pelican only uses log data to ensure the technical functionality and security of the website. However, Pelican reserves the right to check the log data retrospectively if there is a justified suspicion of unlawful use on the basis of concrete indications.

If you send us an inquiry about our offer via contact form or e-mail, we process your personal data for the purpose of carrying out pre-contractual measures within the meaning of Art. 6(1) lit. b GDPR (to be able to make you an offer and/or to answer your questions about our offer).

What are cookies and what types do we use?

Cookies are small files that enable specific, device-related information to be stored on your device (computer, smartphone or similar). They are used, among other things, to collect statistical data on website usage and to be able to analyze it for the purpose of improving the website.

You can control the use of cookies via our cookie banner. However, we would like to point out that the use and especially the user comfort of our website will be limited without cookies.

The following cookies are or may be used on our website:

1. Strictly Necessary Cookies

These cookies are used for the essential functions of our websites. They do not collect information about you that could be used for marketing purposes and do not remember where you have been on the internet. This category of cookies cannot be deactivated, as this would impair the function of our website. The following strictly necessary cookies are used:

• Provider: https://www.avendra.com/en/uk
• Name: OptanonConsent
• Purpose: This cookie is set by the cookie compliance solution from OneTrust. It stores information about the categories of cookies the site uses and whether visitors have given or withdrawn consent for the use of each category. This enables site owners to prevent cookies in each category from being set in the users browser, when consent is not given. The cookie has a normal lifespan of one year, so that returning visitors to the site will have their preferences remembered. It contains no information that can identify the site visitor.
• Duration: 1 year

• Provider: https://www.avendra.com/en/uk
• Name: OptanonAlertBoxClosed
• Purpose: This cookie is set by websites using certain versions of the cookie law compliance solution from OneTrust. It is set after visitors have seen a cookie information notice and in some cases only when they actively close the notice down. It enables the website not to show the message more than once to a user. The cookie has a normal lifespan of one year and contains no personal information.
• Duration: 1 year

• Provider: https://www.avendra.com/en/uk
• Name: EST_AMCV_COOKIE_WRITE
• Purpose: This cookie is used to test whether cookies are enabled in the browser. It is a temporary cookie used to determine if the browser accepts cookies.
• Duration: 0

• Provider: https://www.avendra.com/en/uk
• Name: TEST_AMCV_COOKIE_WRITE
• Purpose: This cookie is used to test whether cookies are enabled in the browser. It is a temporary cookie used to determine if the browser accepts cookies.
• Duration: 0

2. Performance Cookies

These cookies allow us to gain insight into various categories of information about visitors to our websites. This information is used to improve the functionality of our website. We may also use third-party analytics tools such as Adobe Analytics to measure traffic and usage trends and understand our users’ audience. The following performance cookies are used:

• Provider: https://www.avendra.com/en/uk
• Name: s_sq
• Purpose: Adobe Site Catalyst cookie, stores information about the previous link clicked within the site
• Duration: 0

• Provider: https://www.avendra.com/en/uk
• Name: s_nr30
• Purpose: Adobe Analytics site tracking.
• Duration: 1 month
• Provider: https://www.avendra.com/en/uk
• Name: s_cc
• Purpose: This cookie is associated with the Adobe Site Catalyst. It determines whether cookies are enabled in the web browser.
• Duration: 0

• Provider: https://www.avendra.com/en/uk
• Name: s_fid
• Purpose: This cookie name is associated with the analytics service provided by Adobe's Site Catalyst product suite. It is a new cookie introduced in 2013 as a 'fallback' visitor identifier where the s_vi cookie normally used for this purpose is blocked. It contains a randomly generated, unique id.
• Duration: 1 year

3. Advertising Cookies: NONE

4. Analytics Cookies: NONE

5. Other Cookies:

The following cookies are used:

• Provider: hsforms.net
• Name: __cf_bm
• Purpose: This is a CloudFoundry cookie
• Duration: 0

• Provider: youtube.com
• Name: __Secure-xxxxxxx
• Purpose: YouTube is a Google owned platform for hosting and sharing videos. YouTube collects user data through videos embedded in websites, which is aggregated with profile data from other Google services in order to display targeted advertising to web visitors across a broad range of their own and other websites.
• Duration: 5 months

• Provider: hsforms.com
• Name: __cfuvid
• Purpose: This domain is owned by Hubspot. The company provides a range of online marketing and sales technology and services.
• Duration: 0

• Provider: youtube.com
• Name: VISITOR_INFO1_LIVE
• Purpose: This cookie is used as a unique identifier to track viewing of videos
• Duration: 5 months

• Provider: youtube.com
• Name: YSC
• Purpose: YouTube is a Google owned platform for hosting and sharing videos. YouTube collects user data through videos embedded in websites, which is aggregated with profile data from other Google services in order to display targeted advertising to web visitors across a broad range of their own and other websites.
• Duration: 0

• Provider: youtube.com
• Name: VISITOR_PRIVACY_METADATA
• Purpose: YouTube is a Google owned platform for hosting and sharing videos. YouTube collects user data through videos embedded in websites, which is aggregated with profile data from other Google services in order to display targeted advertising to web visitors across a broad range of their own and other websites.
• Duration: 5 months

• Provider: hsforms.com
• Name: __cf_bm
• Purpose: This is a CloudFoundry cookie
• Duration: 0

• Provider: assets.adobedtm.com
• Name: AMCVS_xxxxxAdobeOrg
• Purpose: This is a pattern type cookie name associated with Adobe Marketing Cloud. It stores a unique visitor identifier, and uses an organisation identifier.
• Duration: 0

• Provider: everesttech.net
• Name: everest_session_v2
• Purpose: This domain is owned by Adobe. The main business activity is: Advertising
• Duration: 0

• Provider: assets.adobedtm.com
• Name: AMCV_xxxxxAdobeOrg
• Purpose: This is a pattern type cookie name associated with Adobe Marketing Cloud. It stores a unique visitor identifier, and uses an organisation identifier to allow a company to track users across their domains and services.
• Duration: 1 year
• Provider: everesttech.net
• Name: everest_g_v2
• Purpose: This domain is owned by Adobe. The main business activity is: Advertising
• Duration: 1 year

• Provider: dpm.demdex.net
• Name: dpm
• Purpose: This domain is owned by Adobe Audience Manager. The main business activity is online profiling for targeted marketing.
• Duration: 5 months

We use non-essential function, performance and advertising cookies only with your consent (Art. 6(1) lit. a GDPR), which you can give when you first visit the website using our cookie banner. Subsequent adjustments and changes to your cookie settings are possible at any time via the cookie banner.

With regard to the use of cookies that are absolutely necessary and any data processing that takes place in this context, the legal basis is our legitimate interest in providing you with a functioning website (Art. 6(1) lit. f GDPR).

Embedding YouTube videos

We have embedded videos on our website that are stored on https://www.youtube.com/ (YouTube) and can be played directly from our website, provided that you have consented to the setting of advertising cookies by means of settings in the cookie banner (see also “What are cookies and what types do we use?”). You can deactivate the advertising cookies at any time via the settings in the cookie banner and thus revoke your previously granted consent. Your revocation of consent does not affect the lawfulness of the processing carried out until the revocation.

Furthermore, the videos are all embedded in “privacy-enhanced mode”, which means that no data about you as a user is transmitted to YouTube if you do not play the videos. Only when you play the videos, the data mentioned in the following paragraph will be transferred. We have no influence on this data transmission.

By visiting the website, YouTube receives the information that you have accessed the corresponding subpage of our website. In addition, the data listed in the section “Data processed when visiting our website” is transmitted. This happens regardless of whether YouTube provides a user account through which you are logged in or whether no user account exists. If you are logged in to Google, your data will be directly assigned to your account. If you do not want the assignment to your profile on YouTube, you must log out before activating the button. YouTube stores your data as usage profiles and uses them for the purposes of advertising, market research and/or designing their website to meet the needs of its users. Such an analysis is carried out (also for users who are not logged in) in particular for the provision of tailored advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles. To exercise this right, please contact YouTube.

For more information on the purpose and scope of data collection and processing by YouTube, please refer to YouTube’s privacy notice. There you will also find further information on your rights and setting options for protecting your privacy: https://policies.google.com/privacy .

Adobe Analytics

This website also uses Adobe Analytics, a web analytics service provided by Adobe Systems Software UK Limited. By using the Adobe Analytics web analysis tool, we measure the reach and use of our website to improve its design, functionality and offer. In addition to data on usage and click behavior (including visitor origin, page views, length of stay per page), information about the content accessed and the type of browser and device used is also stored. Cookies are also used (please see “What are cookies and what types do we use?”).

We only use this cookie-based service on our website with your prior consent. You can give this consent either on your first visit via the consent banner or at any time in the cookie settings and adjust or revoke it with effect for the future.

The data stored by Adobe Analytics will be deleted as soon as you withdraw your consent or the data is no longer needed for the above-mentioned purposes. This is the case after 24 months at the latest.

Further information on the purpose and scope of data collection and its processing by Adobe as well as your rights and setting options to protect your privacy can be found here: https://www.adobe.com/uk/privacy.html

To whom do we transfer your personal data and where are these recipients located?

As part of the provision of our website, we work with IT service providers who support us in the creation, operation and further development of the website and keep the website and its content stored on their servers. Furthermore, we use the tool of an IT service provider to analyze pseudonymous usage data (for more information on how we analyze usage data, see the section "What are cookies and what types do we use?"). The service providers we use in connection with the provision and operation of our website process personal data of the website users shared with them for this purpose as our data processor within the meaning of Art. 4(8) GDPR. We have therefore concluded data processing agreements with the service providers to protect your data.

Some of the aforementioned service providers with whom we cooperate are located in countries outside the European Economic Area (EEA), so that a so-called data transfer of your personal data takes place. Some of the service providers are located in countries whose laws do not guarantee a level of data protection comparable to the European data protection laws, this applies in particular to the United States of America (USA). In the event of a data transfer to such a country, we take additional appropriate safeguards to ensure the protection of your personal data, e.g. by agreeing the Standard Contractual Clauses of the European Commission with the respective service providers. If you would like more information on this, in particular a copy of the safeguards we use, please contact us at gdpr@avendra.com.

How long do we store personal data?

We store your personal data for as long as is necessary for the purposes for which it was collected. The retention or storage periods result from business requirements and relevant laws.

Stored personal data will be deleted if you revoke any consent you have given us to process it, if the data is no longer necessary for the fulfillment of the purpose for which it was processed, or if its processing is inadmissible for other legal reasons.

Your rights as a data subject

As a data subject of our data processing, you have certain rights, which we inform you about below:

(a) Right of access: You have the right to request a copy of the personal data collected about you.

(b) Right to rectification: You have the right to request that inaccurate personal data concerning you be completed or rectified if it is inaccurate or incomplete.

(c) Right to erasure: If certain grounds exist (e.g., the data is no longer necessary for the purposes for which it was collected), you may request the erasure of data relating to you.

(d) Revocation of consent: If we have obtained your consent to process your personal data in relation to a specific data processing process, you may revoke this consent for the future and prevent further data processing, unless another legal ground for permission is relevant. This right of revocation does not affect data that we process for other legal reasons. Your revocation does not affect the lawfulness of the processing carried out on the basis of the consent until revocation.

(e) Right to restrict processing: You may request the restriction of the processing of certain personal data for the duration of a complaint procedure or for specific other reasons.

(f) Right to data portability: You may request that we electronically transfer your personal data that you have provided to us and which we still hold to another data controller.

(g) Right to lodge a complaint: You may also lodge a complaint with the competent data protection authority if you believe that the processing of your personal data violates data protection laws. Pelican is supervised by the following data protection authority:

The most effective and efficient way to contact the ICO regarding queries or complaints is by means of the webform.

Please note that there are exceptions to the above rights and that you may not be able to exercise them fully in every situation.

Up-to-dateness of this privacy policy

Pelican reserves the right to modify this privacy policy at any time and with future effect. It is therefore recommended that you read this privacy policy again at regular intervals.

***