Jerónimo Martins

User Terms and Conditions - ServiceNow

These User Terms and Conditions (“Terms”) regulate the operation of the ServiceNow platform (“SN” or “Platform” or “SN Platform”) made available to you by your JM employer company or the JM company that contracts your services and by Jerónimo Martins SGPS, S.A. (together referred to as “Jerónimo Martins” or “JM” and better identified in Annex 1).

This document informs JM associates who access and/or use the Platform (“User” or “Users”) on the

conditions applicable to their use.

Users acknowledge that to access, consult, and use the Platform they must agree to these Terms and warrant that they understand them. Should Users not agree with these Terms, they must refrain from using the Platform and must address their organization’s Human Resource department.

These Terms must be read together with the Platform’s Privacy Policy, as well as the separate terms and conditions of use, privacy policies and cookie policies for each of the digital platforms that can be accessed from SN, if and when applicable.

The Platform also uses cookies placed by ServiceNow (the Platform provider) or its partners, being ServiceNow fully responsible for setting these cookies, in accordance with the information provided in the ServiceNow Cookie Policy.

1. Services and Information Provided

   The SN platform is a corporate solution for JM associates in the three countries: Portugal, Poland, and Colombia. The Platform aims to centralise access to the various digital platforms provided by JM to its associates, as well as to enable interactions of Users with JM and its support services, and may include features specific to each geography. To this end, the Platform provides a range of services and information, which may include:

   • Editing a User profile and the information on it;

     
     

   • Accessing institutional and other relevant information addressed to JM associates;

   • Submission and follow-up of requests of technical support or IT support (service desk);

     
     

   • Reporting breakdowns and submitting requests for maintenance, provision or replacement of office or shop equipment;

   • Submission, management and/or approval of requests, queries or complaints from Users, e.g. requests for information, uniform requests, requests for personal protection elements, requests for certificates or statements, or other requests to JM support areas;

   • Submitting, managing, and approving Users’ statements, as part of anti-corruption procedures, namely on conflicts of interest, visits to suppliers' premises or professional gifts and entertainment;

   • Completing and managing legally required surveys, such as the SAGRILAFT survey (Colombia), or the offboarding survey; and

     The SN Platform is also intended to be used as a portal for access to all other digital platforms related to human resources management made available by JM to all, or to specific universes, of its associates. Please note that access and use of these platforms is subject to consultation and acceptance of the respective terms and conditions of use, privacy policies and cookie policies available on each of the platforms.

     We note, however, that some of the features or platforms may not be available or may be provided differently depending on the geography in which you are located.

     Jerónimo Martins reasonably endeavours to ensure in the best way possible that the information submitted on the Platform is true, correct, accurate, and up to date, as well as the access and the regular operation of the services provided on it. However, in the event of any nonconformity or anomaly detected in the information or the features displayed, Users must contact JM through the available channels, so that we can correct the situation.

     JM reserves the right to update, modify, or suppress the information and/or services provided on the Platform at any time and without notice.

     
     

2. Access to the Platform

   You can access the Platform with your JM credentials assigned to you upon the onboarding process and creation of your User profile. Initially your profile will only contain information about your name, job title and e-mail address, but you may edit it and complete the available information relating to you.

   The User warrants that the data provided are true, accurate, up to date, and authentic, and must keep them permanently up to date.

   You may access the Platform either through the website or by downloading the ServiceNow App from Google Play or the AppStore on any of your electronic devices (e.g. computer, mobile phone or tablet). Alternatively, if you don't have your own device, you can use an accessible device at your company or workplace.

   Should the User decide to access SN by downloading the App, the User acknowledges that the requirements for Android and iOS systems (and other systems on which the mobile application may be made available) may change from time to time; as such the User must download any updates to continue using the ServiceNow App and ensure its best working order. In principle, the App may automatically install improvements, updates or new features; Users who do not wish for this to happen must configure their device settings accordingly.

   If the User forgets the password, they can click the button “Forgot password?”, in which case, after an authentication process, a new password will be generated and sent to the mobile number or email address set out in the User’s profile. The User needs to use a single password to protect their access to the Platform, which must not be the same as any other passwords used to access third-party websites.

   
   

3. User Categories on the Platform

   The access to the Platform, the features provided and the type of actions that can be carried out regarding those features will be differentiated according to the User categories.

   When you create your User profile, Jerónimo Martins will assign categories which will define the features to which you will have access.

   
   

4. User’s Use Conditions and Obligations

   To access the Platform, Users need to have internet access and use a compatible device.

   
   

   As a rule, Users need to use the Platform responsibly, prudently, and carefully, and must not disrupt or degrade the continuity, integrity, and quality of its resources and features, and must also refrain from acting in a way that entails damages to JM, other Users or other third parties. When using the Platform and the services and features provided therein, Users undertake to:

   1. Fully read, understand, agree to, and comply with these Terms and the Privacy Policy of the Platform;

   2. Ensure the security and confidentiality of their access data, including their password, and must not disclose them to third parties or browse in a way that allows third parties to decodify and copy them;

   3. Acknowledge and abide by third-party rights, including other Users and JM’s rights, including without limitation in connection with intellectual property rights, as specified below, and personal data protection.

   4. Refrain from acting against the law, including violating the rights of others and/or damaging the good name, image, reputation, and good standing of any persons, whether individuals or companies, including JM and other Users;

   5. Refrain from using the Platform, or any of its features, and from designing or using any technological tools to make available or transmit any type of material that contains or might contain viruses, worms, defects, Trojan horses, or any other item, or computer codes, files, or programs that might interrupt, destroy, or limit the feature or exploit any computer vulnerability of the Platform, and of any equipment, computer system, or communication equipment;

   6. Refrain from designing or using any tools or technological measures, whether through computer programming or the use of pre-existing software, aimed at damaging or fit to damage, modify or delete the Platform or the technology inherent to its proper operation, in whole or in part, as well as any other fit to enable unauthorized access to the Platform or to any of its content and/or services;

   7. Refrain from sending or transmitting messages or content that are illegal, false, misleading, threatening, malicious, abusive, defamatory, libellous, obscene, invasive of privacy, racially, ethically or morally reprehensible, harmful or offensive to human dignity, and any other content that may constitute or encourage conduct that could be considered a criminal offense, tort, or that violates the law;

   8. Act responsibly and always in good faith regarding JM, third parties, including other Users;

   9. Immediately communicate to JM any defect, bug, failure or anomaly they detect when using the Platform, including improper access to or unauthorized use of your User account, improper access to third-party personal data, the unavailability of any feature, or any other anomaly detected.

   10. Should you detect any defect, bug, or anomaly as set out in the previous subparagraph, you must not seek, through such defect, bug or anomaly, to access commercial information, to access, consult or use personal data of other Users, alter the characteristics of the Platform or, in any other way, exploit the defect, bug or anomaly to use the Platform in an irregular, unlawful manner or different to JM’s design.

   The User’s access to or use of the Platform may be limited, suspended, or cancelled by JM, if the User breaches the rules applicable to its use or if JM suspects the breach.

   On the other hand, the breach of these Terms and the provisions of this Clause specifically by the User may entail tort and/or criminal liability and consequently the User’s obligation to pay the damages caused and the application of any other penalty set forth by law.

   The User answers to JM for any damages arising from the breach of these Terms and/or the improper use of the Platform or its features, subject to any criminal penalties or administrative penalties set forth by law.

   
   

5. Intellectual Property Rights

   Users acknowledge that the contents of the Platform are proprietary rights and undertake not to infringe such rights.

   Users notably acknowledge that the Platform, its structure and layout, the selection, organization and display of its content, including the features and the software used on it, as well as the names, brands, logos, and symbols displayed are proprietary rights of JM, pursuant to and to all intents and purposes of the applicable intellectual property laws, or were duly licensed to JM or JM is authorized to use them. To use these elements on the Platform does not grant you, nor can it be construed as granting you permission to use those elements directly or indirectly.

   Users further acknowledge that the Platform may contain a certain content (texts, photographs, images, charts, slogans, drawings, sound, and animation and every other available information) that is protected by copyright, patents, registered trademark rights, commercial secrets, or other intellectual property rights. That content is a proprietary right of Jerónimo Martins or JM has a license to use it.

   JM is tasked with managing the design, layout and display of the Platform, as well as any information, content, and services available on it, for which reason it may, at any time, update, modify or delete any content, services, options or features, as well as modify its display and configuration.

   Users are barred from transmitting, communicating, or providing to the public, copying, reproducing, selling, modifying, republishing, downloading, manipulating, or otherwise distributing in any way or media, in whole or in part, the content of the Platform or part of it, without JM’s prior written consent. It is excepted, however, the possibility of printed or computerized reproduction of the Platform and/or its content, as long as it is strictly reserved for personal use, without advertising and/or commercial purposes, in your home, without removing any of the notices referring to the ownership of the Platform and/or the content, and abiding by all the intellectual property rights and any other right that is mentioned. Except for these provisions, any reproduction, representation, use, or modification through any process or on any media of part or the entire Platform without JM’s prior authorization is strictly forbidden and is a counterfeiting offense.

   Save when expressly authorized by JM, Users are barred from carrying out reverse engineering, reverse assembly, or attempting to discover any source code, and from selling, granting, sublicensing, or otherwise transferring any right in or over the Platform.

   
   

6. Security and Operability

   Jerónimo Martins endeavours to but cannot guarantee that the Platform is always secure and free of any type of virus or any other elements harmful to the device or software used to access it.

   In addition, Jerónimo Martins endeavours to, but cannot guarantee that the Platform is available and operating uninterruptedly or that it is always accurate and free of mistakes or failures. For instance, the operation of the Platform may be adversely affected by situations beyond JM's control, such as failures in transmission and telecommunications means between JM and the User, or unauthorized attempts to access or alter content.

   Unauthorized attempts to modify, alter, destroy, or corrupt the information contained in the Platform, to destroy the security conditions or break the authentication system, to install unauthorized software, or to use this system for uses other than those described herein, as well as any other type of criminal activity, are prohibited and will be reported to the proper authorities, and the evidence collected on such activities deemed improper will be delivered to the proper authorities. JM may monitor traffic on the Platform to identify such attempts.

   JM may at any time suspend, block, or terminate the access to the Platform or any of its features regarding all or one or more Users, where:

   1. It is necessary, considering commercial, legal, strategic, or technical aspects;

   2. It is necessary to ensure the technical security of the communication channels, the equipment, or the information;

   3. It is necessary for the management, maintenance, repair, alteration, or upgrading of the systems.

   JM may further terminate the Platform or any of its features, permanently or temporarily, partially or totally, at all times and without notice, to ensure the security of the Platform and access to it.

   
   

7. Limitation of Liability

   The User acknowledges that any access to or use of the Platform is at their own risk and account, and the User is the only one liable for any resulting damage or loss. Within the limits set out in the applicable law in each country, under no circumstances shall Jerónimo Martins be liable for direct or indirect loss of profits, or property or non-property damages, lawful or unlawful, direct or lost profits of the User and/or third parties, including, but not limited to damages for the loss of or damage to personal or non-personal data, damages for breaches of intellectual property rights, or damages caused to the User's computer system and/or equipment resulting from the use of the services, features, content, or information in any way provided through the Platform.

   Except as otherwise provided by the applicable law, in addition to the above, Jerónimo Martins shall under no circumstances be liable, including without limitation, for any damages or losses of any nature that may arise from:

   1. Any inaccuracy, incorrectness, or omission regarding the information on the Platform;

   2. Costs, fees, and taxes associated with the messages and data necessary for the access or use of the Platform;

   3. Mistakes, failures, or installation of the virus or other harmful elements on the devices and/or software used by the User due to access to or use of the Platform and its features;

   4. Access to or impossibility to access the Platform and relevant features, for instance, due to its incompatibility with a certain device or software;

   5. Use of or impossibility to use the Platform and its features, including, in particular, delays, interruptions, mistakes, interference and suspension of communications, omissions, Trojan horses, viruses, bugs, and damages and/or malfunctions;

   6. Suspension or cancellation of your access to the Platform for breaching these Terms;

   7. Access or use delays or blockages caused by deficiencies or Internet crashes or other electronic systems;

   8. Suspension, malfunction, or unauthorized use of the servers on which the Platform is hosted;

   9. Delays, interruptions, incorrect operation, or malfunction of the third-party systems and networks connected to the Platform; and

   10. Unlawful actions by third parties, including unauthorized attempts to access or alter the Platform as set out in Clause 6.

   Jerónimo Martins is not liable for any breach of these Terms by JM arising from or in connection with events beyond JM’s reasonable control (force majeure). If an event of this nature occurs, JM’s obligations arising from these Terms are suspended for the duration of the event.

   
   

8. Guarantees

   Except if otherwise expressly specified in these Terms, the Platform, its content, and its features are displayed “as are” and “as available” and as permitted by applicable law with no type of express or implied guarantee, including without limitation marketability, fit for certain purposes, fulfilment of the User’s requirements and/or expectations, non-infringement guarantees or guarantee of uninterrupted services, all of which are expressly disclaimed.

   
   

9. Contacts

   Should the User have any question, suggestion, complaint, or comment on the Platform, the User may communicate with JM by contacting its JM employer/contracting company through the phone number or the email address provided in the landing page of the SN Platform.

   
   

10. Amendments to the Terms

    Jerónimo Martins reserves the right to amend, add, update, or delete these Terms, in whole or in part, at any time, without notice and effective immediately. The amendments or updates are announced and published on the Platform.

    
    

11. Applicable law [and jurisdiction]

    These Terms as well as any disputes against JM are subject to the law applicable in the User’s country (Portugal, Poland, or Colombia), according to the JM member with which the User has a contractual relationship.

    [Subject to any mandatory legal provision that cannot be derogated by the parties, in the event of any dispute arising from and/or in connection with the interpretation and/or the application of the Terms set out herein, regarding the features, information, and services provided on the Platform, in Portugal, the Lisbon District Court, in Poland, the proper Court in Poznan or in Colombia, the Colombian ordinary jurisdiction, as permitted under the law of the country of the entity with which the User has a contractual relationship, shall have jurisdiction.

    
    

12. Final provisions

    These Terms are the entire agreement between the User and Jerónimo Martins as regards their subject-matter, and are supplemented regarding any issue on which they are silent, by the Privacy Policy of the Platform.

    Should any provision of these Terms be declared null and void, illegal, invalid, or unenforceable for any reason, such nullity, illegality, invalidity or unenforceability shall not affect the validity of the other Terms Clauses, which shall remain in full force and effect, and applicable.

    
    

    3rd October 2022

    
    

    ANNEX 1 – JM Group Companies

    
    

    COMPANY	HEAD OFFICE ADDRESS	TAX/IDENTIFICATION NUMBER
    Jerónimo Martins, SGPS, S.A.	Rua Actor António Silva, 7 1649-033 Lisboa, Portugal	500100144
    Escola de Formação Jerónimo Martins, S.A.	Rua Actor António Silva, 7 1649-033 Lisboa, Portugal	508309905
    Hussel Iberia - Chocolates e Confeitaria, S.A.	Rua Actor António Silva, 7 1649-033 Lisboa, Portugal	502430362
    JMR - Prestação de Serviços para a Distribuição, S.A.	Rua Actor António Silva, 7 1649-033 Lisboa, Portugal	502814381
    Jerónimo Martins - Agro-Alimentar, S.A.	Rua Actor António Silva, 7 1649-033 Lisboa, Portugal	513074953
    Jerónimo Martins -Restauração e Serviços, S.A.	Rua Actor António Silva, 7 1649-033 Lisboa, Portugal	505479044
    Jerónimo Martins Serviços, S.A.	Rua Actor António Silva, 7 1649-033 Lisboa, Portugal	503881872
    João Gomes Camacho, S.A.	Rua do Poço Barral, nºs 6 e 8, 9000-155 Funchal, Portugal	511001304

    Lido Sol II – Distribuição de Produtos Alimentares, S.A.	Caminho do Poço Barral, nº 61, 9000-155 Funchal, Portugal	511081383
    Pingo Doce – Distribuição Alimentar, S.A.	Rua Actor António Silva, 7 1649-033 Lisboa, Portugal	500829993
    Recheio Cash & Carry, S.A.	Rua Actor António Silva, 7 1649-033 Lisboa, Portugal	500145415
    Santa Maria Manuela, S.A.	Rua Actor António Silva, 7 1649-033 Lisboa, Portugal	515755028
    Seaculture - Aquicultura, S.A.	Rua Actor António Silva, 7 1649-033 Lisboa, Portugal	513944974
    Terra Alegre Lacticínios, S.A.	Avenida das Indústrias, nº 17, 7300-877 Portalegre, Portugal	513147489
    Best Farmer – Actividades Agro-Pecuárias, S.A.	Rua Actor António Silva, 7 1649-033 Lisboa, Portugal	513684484
    Recheio Masterchef, Lda.	Rua Actor António Silva, 7 1649-033 Lisboa, Portugal	502897279
    Friedman - Sociedade de Investimentos Mobiliários e Imobiliários, Lda.	Rua Dr. Brito da Câmara, nº 20, 1º, 9000-039 Funchal, Portugal	511151969
    Outro Chão - Agricultura Biológica, Lda.	Rua Actor António Silva, 7 1649-033 Lisboa, Portugal	515926906

    Ovinos da Tapada – Agropecuária, Lda.	Quinta Tapada dos Frades, 6230 471 Fundão, Portugal	516266578
    Jeronimo Martins Polska, S.A.	Ul. Żniwna 5, Kostrzyn, Poland	KRS 0000222483
    Jeronimo Martins Drogerie i Farmacja, Sp. Z o.o.	Ul. Żniwna 5, Kostrzyn, Poland	KRS 0000322116
    Jeronimo Martins Colombia, S.A.S.	Calle 100, No. 7 – 33, piso 11, Bogotá, Colombia	900480569-1

    
    

    Jerónimo Martins

    
    

    
    

    Privacy Policy - ServiceNow

    
    

    As part of the use of the ServiceNow platform (“SN” or “Platform” or “SN Platform”), the Jerónimo Martins Group companies acting as controller of your personal data (“Jerónimo Martins”, “JM” or “We”) may process the data of its associates, as well as other individual external service providers (e.g. temporary workers, lawyers, outsourcing, civil contracts) (“Associate” or “Associates”) for different purposes. This Privacy Policy (“Policy”) informs you of the terms on which JM processes your personal data, notably what data we collect, how and why we process them, who we disclose them to and how we protect your privacy.

    The Jerónimo Martins Group, i.e. each of the companies that make part of it, adopt the conducts and implement the necessary arrangements to ensure compliance with the personal data laws applicable to the processing of your data and/or are in force in the country where the Platform is available: Portugal, Poland, and Colombia.

    Using and browsing the Platform presuppose that you have read and are aware of this Policy, which must be read together with the Platform’s User Terms and Conditions, of which it is an integral part.

    The Platform also uses cookies placed by ServiceNow (the Platform provider) or its partners, being ServiceNow fully responsible for setting these cookies, access and processing the information collected through these or similar technologies, in accordance with the information provided by the ServiceNow Cookie Policy.

    
    

13. Who is the data controller of your personal data?

    The Jerónimo Martins Group company that employs you or contracts your services and provides you access to the SN is the controller of your personal data pursuant to the personal data protection laws applicable in the relevant country.

    Within the context and for the purposes of this Policy, the following are members of and make up the Jerónimo Martins Group:

    • In Portugal: (i) Jerónimo Martins, SGPS, S.A.; (ii) Recheio Cash & Carry, S.A., (iii) Jerónimo Martins Serviços, S.A., (iv) Recheio Masterchef, Lda., (v) JMR – Prestação de Serviços para a Distribuição, S.A., (vi) Escola de Formação Jerónimo Martins, S.A., (vii) Lido Sol II – Distribuição de Produtos Alimentares, S.A., (viii) Friedman – Sociedade de Investimentos Mobiliários e Imobiliários, Lda., (ix) João Gomes Camacho, S.A., , (xi) Terra Alegre Lacticínios, S.A., (xii) Pingo Doce – Distribuição Alimentar, S.A., (xiii) Best Farmer – Actividades Agro-Pecuárias, S.A., (xiv) Seaculture – Aquicultura, S.A., (xv) Jerónimo Martins – Agro-Alimentar, S.A.; Santa Maria Manuela Turismo, S.A., Jerónimo Martins – Restauração e Serviços, S.A., Hussel - Chocolates e Confeitaria, S.A., Outro Chão – Agricultura Biológica, Lda., Ovinos da Tapada – Agropecuária, Lda.

    • In Poland: (xvi) Jeronimo Martins Polska SA; (xvii) Jeronimo Martins Drogerie i Farmacja Sp. z o.o.;

    • In Colombia: (xviii) Jeronimo Martins Colombia SAS.

      
      

      
      

14. What are personal data?

    ‘Personal Data’ means any information of any nature and regardless of the media (e.g., physical document, sound, or image) relating to an identified or identifiable natural person (‘data subject’). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

    
    

15. Which personal data do we collect?

    As part of the use of the Platform, Jerónimo Martins collects and processes the personal data required for the processing purposes listed in Paragraph 4 of this Policy. We note, however, that depending on the geography in which you are located, some of the features of the Platform may not be available or may be made available in a different way, which will have consequences in terms of the personal data processed and the corresponding processing purposes. You can find more detailed information on the personal data processed in your geography, and the corresponding processing purposes, legal basis and retention periods in the table attached as Annex 1 to this document.

    These data are directly collected from data subjects, through their engagement with the Platform and as part of the performance of the contractual relationship and JM’s Human Resource management, as detailed in the information to employees on personal data processing, made available by your JM employer or the JM company contracting your services. Additionally, in some cases, your data may also be collected indirectly, through the communication between SN and the other digital platforms that can be accessed using this platform and that communicate with it, such as the SAP SuccessFactors platform. Please note that these digital platforms are subject to separate Privacy Policies, which must also be read and understood by the Associate.

    We will specifically process the following categories of personal data, which include, namely, the types of personal data provided bellow:

    
    

    CATEGORY	PERSONAL DATA COLLECTED
    Identification data	Name, identification number, gender, nationality, date of birth
    Contact data	(Personal and/or professional) email address, (personal and/or professional) telephone number, address, postal code, city, and country of residence
    Family status data	Marital status, composition, and identification of the household (name, ID, relationship and date of birth)
    Employment status data	Name of employer, department and/or business unit, workplace, job title, employment status (e.g. employee, agent, consultant, trainee, services provider), employee ID number, type of contract
    Forms Data	Depends on the Form in question. For more detailed examples of the personal data processed in relation to the different forms, please see the table attached as Annex 1 to this document.
    Platform use data	Platform activity logs

    Certain personal data listed herein must be provided on the Platform. Should you fail to provide them or provide insufficient data, you cannot use the Platform or certain of its features, as applicable. If that is the case, you will be duly informed that you are required to provide the data upon their collection, including through the display of a red star next to the relevant field.

    Moreover, the use of some features provided on the Platform (i.e., the ID of an emergency contact or the household) requires the Associate to disclose third-party personal data to Jerónimo Martins. In that instance, the Associate undertakes to notify the third-party data subjects that their personal data will be shared with JM and to secure their consent to share the data.

    Jerónimo Martins assumes that the data collected were inserted and/or authorized by the data subject, are true, updated, and accurate.

    
    

16. For what purposes and on what bases do we process your personal data?

    Your personal data identified in Paragraph 3 of this Policy will be processed, as part of the use of the Platform and under applicable law, for the purposes and the legal bases mentioned in the table attached as Annex 1 to this document.

    In case JM companies implement any other SN features (e.g. other types of forms) which may imply other personal data processing activities not mentioned in Annex 1, all the information about the said data processing activities, namely their purposes, legal bases and retention periods, will be provided in the means through which personal data are collected (e.g. within the respective forms).

    
    

17. For how long do we store your personal data?

    
    

    JM processes and stores personal data in strict compliance with applicable laws, according to the purposes for which such data are collected.

    The data will therefore be stored and kept only for the adequate period and strictly as necessary for the purposes for which they were collected, except if (i) there is a specific legal requirement to store the data for a certain period, (ii) the data need to be stored for a longer period to uphold any rights and interests in a court or administrative offense proceedings, up to six months after the transit in res judicata of the relevant ruling, or (iii) the right to opposition, the right to erasure, or withdrawal of consent is exercised within the legal limits.

    Notably and save for the exceptions listed above:

    
    

    • Personal data processed to maintain the Associate’s profile will be stored for a maximum of one (1) year from termination of the contractual/employment relationship;

    • Personal data collected through the SN Platform’s forms and enquiries will be maintained for a maximum of one (1) year from termination of the contractual/employment relationship.

      You can find more detailed information on all applicable retention periods in the table attached as

      Annex 1 to this document.

18. Data subjects’ rights

    
    

    Under applicable law, you may at any time and for free (except if the request is unfounded or excessive for being repetitive, for instance), exercise the rights listed below.

    You may do so in writing, through the contacts provided in the landing page of the Platform or through the contacts included in Section 10, below.

    
    

    	DATA SUBJECTS’ RIGHTS
    Right of access	Right to obtain confirmation as to which of your personal data are being processed, to request access to them, to obtain information about the processing, and a copy of the personal data being processed. In this case, JM reserves the right to charge a reasonable fee considering the administrative costs.
    Right to rectification or update	The right to request the rectification or the update of your personal data that are inaccurate or has changed from the moment of its collection, or request that any incomplete personal data be completed.
    Right to erasure	The right to obtain the erasure of your personal data, including any links, copies or reproductions of such data, in certain cases, including if your personal data is no longer necessary for the purpose for which they were collected or processed, or if you oppose their processing and there are no overriding legitimate interests to justify it, and provided that there are no valid bases for storing them (e.g. their storage is necessary to comply with a legal obligation to which JM is subject).
    Right to restriction of processing	The right to request the restriction of personal data processing in certain cases, including if the processing is unlawful and you oppose the erasure of the data, by requesting the suspension of the processing or the restriction of the scope of the processing to certain data categories or processing purposes.
    Right to portability (except in Colombia)	The right to receive the personal data provided to us in a commonly used and machine-readable format or to request the direct transmission of those data to another entity that becomes the new controller of your personal data, if your data are processed by automated means and is based on your consent or the performance of an agreement.
    Right to opposition	The right to oppose at any time and for reasons in connection with your specific situation, the processing of your data based on the pursuit of the controller’s legitimate interests or compatibility of the initial processing with further processing, including profiling. Or the right to oppose the processing of your

    	personal data for direct marketing purpose at any time, which includes profiling for such purpose.
    Right to withdraw consent	The right to withdraw your consent for the processing of data collected on the basis of your consent, through the above means, or, if you gave your consent on the Platform, you can withdraw it on the Platform, on the “My profile” page. The withdrawal of your consent does not however affect any processing carried out until such date based on any consent previously provided.

    
    

    Subject to any other administrative or court appeal, the data subject is further entitled to submit a complaint to the proper supervisory authority pursuant to the law1, should you consider that your data is not being lawfully processed by JM pursuant to the applicable law and this Policy.

    
    

19. When do we share data with third parties?

    
    

    As part of the Platform and relevant features’ availability and management, Jerónimo Martins engages third parties or other companies that make part of the Jerónimo Martins Group, who have access to and process the personal data of its Associates under data processor agreements executed between them and JM and according to the latter’s instructions for such purposes. These data processors perform services such as maintenance, support, management of logs and other platform use data, assistance to the back-office activity and some other activities.

    JM ensures that its data processors provide sufficient guarantees to implement appropriate technical and organizational measures, so that the processing of your personal data meets the requirements of applicable law and ensures the security and protection of the rights of its Associates.

    We may also convey your data to other Jerónimo Martins Group companies, in accordance with our legitimate interests or your consent (the latter, in the case of Colombia), when this is necessary for the purposes described above, including the analysis and macro management of the Jerónimo Martins Group’s internal organization (e.g. human resources, compliance).

    Lastly, JM can also convey personal data of Associates to third-party entities, when such data communications are necessary or adequate (i) under applicable law, (ii) to comply with legal

    
    

    1 Such authorities would in principle be the Comissão Nacional de Proteção de Dados (CNPD) in Portugal, the Urzad Ochrony Danych Osobowych (UODO) in Poland and the Delegatura para la Protección de Datos Personales de la Superintendencia de Industria y Comercio in Colombia.

    obligations or court orders, (iii) to reply to requests of public or government authorities, notably data protection supervisory authorities, or (iv) if you gave your consent.

    
    

20. In what circumstances do we transfer data to third countries?

    
    

    Jerónimo Martins seeks to ensure that the processing if your personal data in Portugal and in Poland takes place entirely in the European Economic Area (“EEA”). However, exceptionally and where strictly necessary to ensure the maintenance and support of the Platform, we may transfer your personal data to third countries (not belonging to the European Union or the EEA) for which there is an adequacy decision of the European Commission, or subject to appropriate safeguards provided by law, including data protection Standard Contractual Clauses. In addition, as part of our exchange of information for the macro management of Jerónimo Martins Group’s human resources, we can further communicate your data to companies of the Group based in countries outside the EEA, such as Jeronimo Martins Colombia SAS (seated in Colombia) by adopting adequate safeguards.

    When transferring data to third countries subject to adequate safeguards, JM will implement additional measures to ensure that the personal data enjoy a level of protection essentially equivalent to that existing in the European Union.

    In Colombia we may transfer your data to third countries deemed by the Colombian supervisory authority to provide adequate levels of data protection, such as Portugal and Poland, or based on the adoption of adequate safeguards under the law, such as entering into international data transfer agreements with recipients and obtaining the necessary authorizations from the proper supervisory authority. The above reservations and conditions shall apply to the transfer of data to other countries.

    You can request additional information regarding any transfer of your data to third countries, as well as the appropriate safeguards and supplementary measures adopted as part of such transfers, by means of a written request sent to the email address provided in Section 10, below.

    
    

21. What security measures are in place?

    
    

    Jerónimo Martins endeavours to protect your personal data against accidental or unlawful destruction, loss, and alteration, as well as against unauthorized disclosure or access. For such purpose, we have in place a range of technical and organizational measures to ensure the security and confidentiality of the processing of the personal data carried out by JM and/or companies engaged by it, including:

    1. Physical access control measures - unauthorized persons cannot gain access to facilities, buildings, or rooms where systems that process and/or use personal data are located;

    2. System access control measures - in order to avoid access to the data processing systems by unauthorized persons, several levels of access authorization are implemented, and access to the systems is always made through a unique user identifier (user ID). Additionally, the Platform is protected by firewalls and updated antivirus software, and constant and periodic updates and patches of the security systems are also ensured;

    3. Data access control measures - persons with access to the data processing systems can only access the personal data for which their right of access has been configured on a need-to-know basis and pursuant to the information classification policy in place, and cannot read, copy, modify, or remove the data without a specific authorization to do so. Additionally, all personal data will be stored in secure Data Centres with strict surveillance, access control procedures, and frequently tested technological security measures;

    4. Data input control measures – it is possible to retrospectively review if and who accessed,

       modified, or removed data stored on the Platform’s data processing systems (log system);

       
       

    5. Availability control measures – your personal data are protected against accidental or unauthorized destruction or loss through regular backup processes, uninterrupted power supply, and the adoption of disaster recovery and business continuity policies and procedures;

    6. Data separation control measures – personal data collected for different purposes and, when stored in the Cloud, from different organizations, are stored and processed separately, in such a way that only JM and its data processors have access to your personal data;

    7. Organizational security measures – JM Associates’ personal data are processed by its data processors strictly in accordance with JM’s instructions, and every employee, contractual partner, or service provider contributing to the availability and operation of the Platform are contractually bound to abide by the confidentiality of the information and the personal data they process as part of their duties.

    We note, however, that Employees are responsible for ensuring that the devices under their responsibility used to access the Platform are adequately protected against computer viruses, worms, spyware, ransomware or any other malware. Associates should further be aware that if they fail to adopt adequate security measures (for example, the secure configuration of the browser, updated antivirus software, the use of a firewall, use of exclusively licensed software), the risk of personal data

    and passwords being accessed by unauthorized third parties is increased. Furthermore, Associates should avoid using shared devices (e.g. airports, hotel receptions, internet cafes or company devices not intended for exclusive use) and, in such cases, make sure passwords are not saved and the session is logged out when the task is terminated.

    Should any defect, bug or anomaly be detected on the Platform, Associates must immediately communicate it to JM and not seek, through such defect, bug or anomaly, to access commercial information, personal data of other users, alter the characteristics of the Platform or, in any other way, exploit the defect, bug or anomaly to use the Platform in an irregular, unlawful manner or different to JM’s design.

    
    

22. Contact us

    
    

    Should you have any doubt or wish to obtain more information on how Jerónimo Martins processes your personal data, or should you wish to exercise the rights vested in you by applicable law as data subject and, particularly those mentioned in this Policy, you may contact:

    • In Portugal, the DPO, at the email address: dpo.portugal@jeronimo-martins.com

    • In Poland, the DPO, at the email address: dpo.polska@jeronimo-martins.com

    • In Colombia, the Privacy department, at the email address: servicioalcliente@tiendasara.com

      
      

23. Changes to our Privacy Policy

JM reserves the right to at any time change or update this Privacy Policy. Any such changes shall be duly reflected and published on the Platform and/or communicated to the Associates through the contacts provided.

3rd October 2022

Annex 1- Purposes, legal basis, and retention periods