Welcome to the website of Broccoli B.V., Julianaplein 8, 5211 BC ’s-Hertogenbosch, registered with the Chamber of Commerce under number 85620793, hereinafter also referred to as: "Broccoli" or "we" or "us"). Broccoli's main goal is to make the world greener and healthier. We bring entrepreneurs and investors together. Through our platform, companies can use their equity capital for healthy growth.

From 25 May 2018, any company processing personal data of European citizens must comply with the General Data Protection Regulation (hereinafter: “GDPR"). The protection of your personal data is important to us. With this Privacy Statement Broccoli is providing you with more information about how we implement the GDPR and what we do with your personal data.

The Privacy Statement was last amended on 29 March 2022.

Essentially, personal data is data that can directly or indirectly identify a natural person. Broccoli only collects and processes personal data where there is a legal basis for doing so. This is primarily data that you provide to us yourself. Depending on the relationship, we collect and process the following personal data:

• identity data (such as first name, surname, date of birth, place/country of birth, nationality/nationalities, marital status);
• contact details (such as address, telephone number, e-mail address);
• bank and payment data (such as account holder, bank account number / IBAN, bank identification code);
• data about job title and work situation (such as self-employed, employed); data on assets (such as source of assets, bank account balances, debts, other financial data);
• other data (such as IP address, login data, navigation behaviour);
• (copy of) identity card or passport. Specifically for employees and job applicants, we collect and process curriculum vitae, work experience, educational information, (copy of) certificates, diplomas and references.

• (potential) investors, private or business;
• (potential) entrepreneurs;
• ultimate beneficiaries of the (potential) business investors or (potential) entrepreneurs;
• visitors to our website;
• contact persons for business partners and business associates;
• employees and applicants.

As described further in our Cookie Policy, we use cookies to automatically store information about the users of our website. For further information, please refer to our Cookie Policy published on our website: Cookie Policy

The website may contain buttons for Social Media such as LinkedIn, Facebook, Twitter or Instagram. This Privacy Statement does not apply to these Social Media. The use of Social Media is your own responsibility. We recommend that you read the privacy statements of these Social Media carefully so that you know what happens to your data. Many Social Media providers are located outside the European Union and transfer your personal data outside the European Union. As a result, your personal data may not be protected to the same standard as within the European Union.

Broccoli may only process your personal data if there is a legal basis for doing so. We process your personal data on the basis of at least one of the following legal grounds:

• if this is necessary for the execution of an agreement;
• if the processing is necessary in order to comply with a legal obligation;
• if we have a legitimate interest in doing so;
• if you have given us permission to process your personal data.

For what purposes does Broccoli process your personal data? Broccoli currently processes your personal data for the following purposes, amongst others:

• to execute agreement(s) entered into;
• to reduce risks, for example by verifying that the data of entrepreneurs who want to start a sharefunding campaign is correct and/or that the authorised persons are acting;
• to comply with legal obligations, e.g. for the identification and verification of business associates;
• if you have given us permission to process your personal data.

We may have to provide data to regulators or other (government) agencies. This includes the Dutch Authority for the Financial Markets (AFM) or DNB, but also the Netherlands Tax & Customs Administration.

If you are an investor, your data will be shared with the company you are investing in so that it can fulfil its obligations to you. In addition, your data may be shared with other financiers with whom the company has or wishes to enter into a funding relationship, such as the bank. This information will only be disclosed to other financiers at the time of the company's default or if it is necessary for agreements concerning bank account applications, subordination, change of rank, creditors' arrangement and/or other arrangements.

Your personal details may also be shared with advisers investigating whether Broccoli's business operations comply with legislation and regulations. Only personal data that is relevant for this purpose is thereby shared. Broccoli will not sell your personal data to third parties without your permission.

As part of our services, we may share your data with other parties if this is necessary for their specific services. These include other service providers (e.g. IT suppliers or administration and payment providers). We conclude processing agreements with these parties in line with the statutory provisions. In this, we record the agreements specifically about the processing of the personal data they acquire. This includes security, but also that these parties are not allowed to process the data for their own purposes.

In principle, we will keep your data within the European Union. It is possible, however, that in the course of providing services, your data may be processed outside the European Union if one of our service providers is located there. If this happens, we will do this in line with the strict rules that apply. We will ensure that there is an agreement with the other party that is in line with the standards approved by the European Commission at that time.

Broccoli takes appropriate technical and organizational measures to protect your data against loss and unauthorized processing. Our employees are obligated to confidentiality and may not disclose your personal data without lawful reason.

Furthermore, Broccoli does not retain your Personally Identifiable Information (PII)* longer than necessary for the purposes for which it is collected, such as accurately maintaining your investment in the shareholder registry of the venture you invested in. If a request is made to delete your PII, we adhere to the mandatory retention period of five years, as required by applicable laws and regulations.

*PII includes all information about a person that Broccoli maintains, including (1) data that can be used to identify or trace a person's identity, such as name, date and place of birth, and gender; and (2) any other information that is linked or linkable to a person, such as financial and employment information.

Most of the information we have about you is visible in your profile on our sharefunding platform, Broccoli. This also offers you the opportunity to amend certain information. Certain information such as your personal details, bank account details or account holder cannot be changed in principle. But the e-mail address and home address can.

You have the right to know what personal data about you is processed by Broccoli. If your personal data is incorrect, you have the right to ask us to amend it.

You have the right to be removed in certain cases. In the event of a request to be forgotten, we will first check what data is necessary for us to be able to guarantee the continued provision of services or necessary because we are processing your data on the basis of a legal obligation.

In certain cases you have the right to ask Broccoli to restrict the use of your personal data or to temporarily ‘freeze’ its use.

In certain cases you have the right to object to Broccoli processing your personal data. Broccoli may process personal data because of a legitimate interest on Broccoli’s part. You may believe that your personal circumstances outweigh Broccoli's legitimate interest in being allowed to use your personal data. You then have the right to complain and to invoke your right to object.

You have the right to ask Broccoli to transfer your personal data directly to you. This applies to personal data that we have processed with your consent or on the basis of a contract with you. We will transfer your personal data to the extent technically possible. This is called ‘data portability’.

Broccoli wants to automate processes so that they are faster and easier for you. We do this by automating them. The computer then decides the outcome of the question using the rules and information we have entered. This kind of automated decision process does not involve any humans. You have the right to object to the automated decision-making process. You can then ask for a person to look at your investor test.

If you wish to exercise (one of) the above rights, you can contact Broccoli by e-mail at [email protected]. We will inform you within one month after receipt of your request about the handling of the request.

Every marketing communication from Broccoli offers you the opportunity to set your e-mail preferences so that we no longer contact you for specific messages. You can also unsubscribe completely from our communications. You will then no longer receive relevant marketing messages. However, we will continue to send you messages if these concern your agreement with Broccoli, your agreement with the entrepreneur or general information about our services or organisation.

Our website contains hyperlinks to other websites, including third party websites. When you click on the hyperlink, you will leave the Broccoli website and enter the website of another party. Broccoli has no control over third party websites linked by hyperlinks. A different privacy policy applies to the use of these third party websites. Broccoli accepts no responsibility or liability whatsoever for (the working and/or content of) third party websites. The Broccoli Privacy Statement only pertains to (personal) data collected via the Broccoli website or otherwise by Broccoli. We therefore recommend that you read the privacy policies of the other websites carefully so that you know how they handle your personal data.

If you are not satisfied with the processing of your personal data or with the information provided to you about this, please let us know by e-mail at [email protected]. If you are still not satisfied with the handling of your complaint, you can file a complaint with the Dutch Data Protection Authority.

This Privacy Statement may be expanded or amended in the future. All changes will be published on our website.

If you have any questions or other requests as a result of the above, you can contact Broccoli by e-mail at [email protected]. We will inform you about the handling of your question or request within one month after receipt.

In the event of any conflict between the English and Dutch versions of this privacy statement, the Dutch version shall prevail.

's-Hertogenbosch, 29 March 2022