Shareholders' Privacy Policy

This Privacy Policy applies to the personal data that we collect about you if you are an individual and you are either a current or former shareholder of easyJet plc, or otherwise you currently have, or have previously had, an interest in the shares of easyJet plc, whether that interest is legal or beneficial.

This Privacy Policy explains what personal data we collect about you, how and why we use it, who we disclose it to and how we protect it. It also explains your rights in respect of that personal data.

We are easyJet plc and we are a company registered in England and Wales with registration number 03959649 and registered office at Hangar 89, London Luton Airport, Luton, Bedfordshire, LU2 9PF. We control the ways your personal data are collected and the purposes for which your personal data are used by easyJet plc and we are the “controller” for the purposes of the data protection laws that apply to us, like the European General Data Protection Regulation (GDPR).

When we refer to “personal data” in this Privacy Policy, we mean information that relates to you, for example your name, information about your financial situation or the shares you hold.

The categories of personal data we collect about you, include:

• your name, date of birth, your address and contact details;
• information about your past or present holdings of shares and/or interests in shares in easyJet plc, whether you hold or held these as legal owner or have or had a beneficial interest in them;
• information about how you have in the past exercised, or intend in the future to exercise, your voting rights attached to shares in easyJet plc;
• your bank or building society account details into which dividends and other income or capital returns on your shares have in the past, or should in the future, be paid;
• your attendance at our general meetings; and
• your communications with us.

We collect this information in a variety of ways, including:

• by you providing it to us;
• if you are also an employee of one of our group companies, including easyJet Airline Company Limited, by your employer providing this information to us where this is necessary in the context of your employee share plan;
• by third parties acting on your behalf providing certain of these details to us, such as stock brokers and other agents through whom you may have acquired or disposed of your shares or interest in shares;
• where you exercise your rights in respect of your shares, including by your attendance at general meetings and voting in person or by your casting proxy votes, whether in hard copy form or by submitting electronic instructions via the CREST system;
• from third parties who perform services on our behalf, such as Equiniti Limited, that assist us with the maintenance of our share registers and with the organisation and conduct of our general meetings;
• by third parties like credit reference agencies and fraud detection agencies, as part of our identity and financial crime checking procedures;
• by searches to databases and credit data when we are required to verify your information in accordance with anti-money laundering regulations.

We collect and process personal data about you for the following purposes:

• To comply with our legal and regulatory obligations to which we are subject: for example our obligation to keep required records and file required returns of the shareholdings in easyJet plc, to pay you the amounts due on your shares, to send you information about easyJet plc and to comply with disclosure requirements imposed or enforced by governmental authorities and regulatory agencies, including law enforcement agencies and tax authorities in relation to financial crime.
• Where this is necessary to perform our contract with you and as set out in the memorandum and articles of association of easyJet plc or in any share scheme or plan truste deed or rules.
• To manage our relationship with you, including by meeting with you, communicating with you and answering your queries.
• To fulfill our administrative purposes, including to efficiently administer and manage our shareholders' records and protect our business interests, including the use of your information for legal purposes, so that we can enforce or defend our legal rights and handle legal claims in relation to your shareholdings or interests in shares.
• Where necessary, to disseminate information about easyJet plc’s business, strategy and financial results. Please note that we will only process your information for this purpose when we are required to do so or where there is a duty to the public to reveal it.

We process as little data about you as possible and when we do so, we need to ensure that we rely on one of the following lawful bases, in accordance with data protection laws:

• Where it is necessary to comply with our legal obligations;
• Where it is necessary to perform our contract with you as a shareholder or holder of an interest in shares in easyJet plc;
• Where it is necessary to fulfil our legitimate interests as these are explained in this Privacy Policy;
• In very limited cases, we will seek your consent to process your information; and
• Where this is necessary to protect your vital interests or those of other individuals.

We have legal obligations to collect and process certain information about you, for example to record your details in our statutory register of members, to include your details in our annual returns filed at UK Companies House, to pay amounts due on your shares, to enable you to exercise your rights attached to your shares and to send you certain information. You may also have legal obligations to provide us with certain information about you, for example where we make a statutory demand to ascertain the beneficial ownership of shares.

If you do not provide us with the information necessary to enable us to comply with our legal obligations, you may not be recognised as a valid shareholder of easyJet plc and you may not be entitled to exercise or enjoy some or all of your rights attached to your shares in easyJet plc and we may not be able to fulfil our other obligations to you.

We will share your personal data with subsidiaries of easyJet plc and our group companies, where this is necessary for our business operations, for example, where they help us comply with our legal obligations and to manage our relationship with you or where they offer employee share plans to their employees.

We will also share your personal data with Equiniti Limited (“Equiniti”) and other Equiniti Group entities such as Equiniti Financial Services Limited, ProSearch Asset Solutions Limited and Equiniti India Private Limited who act as our registrars and help us organise and hold our general meetings and provide our services to you.

We will also share part of your personal data with other suppliers of easyJet plc who provide services and process data on our behalf, for example professional advisors, service and software suppliers and payment service providers. Other parties with whom we will share your data include fraud detection and fraud prevention agencies, credit reference agencies and market research agencies. In addition, we will share your personal data with third parties where we are legally required to do so, when we receive a valid official disclosure request for example by government bodies and regulatory agencies and we will also share information with courts or parties to legal proceedings in the context of these proceedings. In such case, please note that we will not have control over how these parties may use your data.

Overseas processing

Personal data will be shared with members of the Equiniti Group outside of the European Economic Area (EEA) and the European Union (EU), including Equiniti India Private Limited which is based in India, for the purposes described in this Privacy Policy. For these transfers we utilise Model Clauses recognised by the European Commission.

Personal data will also be shared outside of the EEA and EU for the purposes of contacting you via email via our email service provider. For these transfers, we utilise Model Clauses recognised by the European Commission.

If you would like to obtain a copy of the Model Clauses used to share personal data, please contact our Data Protection Officer using the details provided in section 11 below.

Please note that information protection laws do vary from country to country. In particular, the law of the country in which you are resident or domiciled may offer a higher standard of protection than the laws in the United Kingdom and/or those other countries in which we store and use the personal data we collect. Our transfer of personal data to other countries could result in that personal data being available to governments and other authorities in those countries under their laws.

Personal data will not be retained for longer than necessary for us to achieve the purpose for which we obtained your personal data. We will then either securely delete it or anonymise it so that it cannot be linked back to you. We review our retention periods for personal data on a regular basis.

We will retain your personal data for as long as you hold shares or an interest in shares in easyJet plc and for a period of up to 12 years following your last entry on our register or completion of our services e.g. payment of unclaimed dividends for the reasons noted below:

• To respond to enquiries and complaints;
• To demonstrate that your instructions were carried out properly; and
• To maintain records to meet rules and regulatory requirements that are applicable to the services we provide to you.

We may retain your data for longer than 12 years if we cannot delete it for legal, regulatory or technical reasons. We can also keep it for research or statistical purposes. If we do so, we will make sure that your privacy is protected and only use it for those purposes.

We understand how important your personal data is to you and we take its security very seriously.

We safeguard your personal data across all our computer systems, networks, websites and offices as much as possible through appropriate procedures and technical security measures (including strict encryption, anonymisation and archiving techniques).

We also use secure ways of communicating with you such as when collecting your personal data or providing your account information:

• online through the use of ‘‘https’’ and other security and encryption protocols. This is indicated by a lock icon on the bottom of the web browser, or the address will include the letters https in the top left-hand corner; and
• by telephone we will always ask you security questions to confirm your identity before we discuss matters relating to your account(s).

Where you have been given (or where you have chosen) a password or unique identifier (PIN) which enables you to access your Plan details, you are responsible for keeping this password/PIN confidential, along with any username. We will never ask for your full password or PIN, and you must not divulge your full password to us or anyone else. We recommend that any password or PIN you set is not easily guessable, and changed frequently (at least once a month).

Because we cannot guarantee the confidentiality of personal data sent on the internet you should never send your login details via email.

Security concerns
If you ever receive a communication from us by post, email or by phone that you are concerned is not genuine, please contact us using the contact details below.

You must immediately inform us if you become aware, or suspect, that someone else has knowledge of your account details.

If you have any concerns about the security of your own personal computers and mobile devices, we suggest you read the advice of Get Safe Online, which can be accessed at www.getsafeonline.org.

The GDPR and other data protection laws give you specific rights that allow you to understand and to an extent control the way we process your personal data.

Right to access, correct and delete your personal data

You have the right to receive a copy of the personal data we hold about you and to receive information about how we process such data.

We try to ensure that the personal data we hold is accurate and up-to-date. If you suspect that we hold inaccurate or incomplete information about you, please let us know so that we can update and complete our records. Please also make sure that you notify us when there is a change that could affect the personal data we hold about you, for example when your contact details change.

Under certain circumstances, you have the right to request that we delete your data. Please note that we will delete or anonymise your data when we no longer need this for the purposes explained in this Policy.

Additional rights

Under certain circumstances, you may also have the following rights:

Right to data portability: According to the GDPR, where the processing of your data is based on consent or on a contract and the processing is carried out by automated means, you have the right to receive such data in a structured, commonly used, machine-readable format.

Right to restriction of processing: in certain circumstances, you may request that we not process your data, but only store it. You may request restriction of processing where:

• You contest the accuracy of your data that we hold, until we have corrected it or verified its accuracy;
• Where the processing is unlawful but you request that we do not delete the data;
• Where we no longer need your data but you require them for litigation purposes; or
• Where you have objected to the use of your data, until we verify whether we have grounds to continue using your data.

Right to withdraw consent: As explained above, in most cases we do not rely on your consent for the processing of your data. If at any point we seek your consent for the use of your data, you will have the right to withdraw consent at any time. We will respect your choice and stop further processing your data, however, any use of your data before you withdraw consent will not be affected.

Right to object: You may consider that you have reasons to object to the use of your personal data when such use is only based on our legitimate interests as these are described in this Policy. Before using your data for legitimate interests, we have balanced these interests against your rights and freedoms. However, if you consider that you have grounds to object to the use of your data, you can explain to us your particular situation and we will individually review your request.

Rights in relation to automated decision making: Please note that we do not take decisions about you based solely on automated processing.

You can exercise your above rights by contacting our Group Data Protection Officer to the address contained in section 11 below.

If you have a concern in relation to the way we process your personal data and satisfy your data protection rights, and if you believe this is not in accordance with data protection laws, you have the right to lodge a complaint with a data protection authority. In the UK, the relevant authority is the Information Commissioner’s Office (ICO) and you can report a concern through their website https://ico.org.uk/concerns/ or by calling their helpline on 0303 123 1113.

We review our use of your personal data regularly. In doing so, we can change what personal data we collect, how we keep it and/or what we do with it. As a result, we can change this Privacy Policy from time to time to keep it relevant and up to date.

We will endeavour to alert you to these changes so that you can check you are happy with them before proceeding any further. Please look out for notices from us alerting you to these changes, via websites or other timely communications. If you see such an alert, please take a moment to ensure that you’re happy with any changes. However, we will also tell you of the changes where required by law to do so.

By continuing to use our products and services, you will be bound by this Privacy Policy.

This Privacy Policy was issued on 25 May 2018. If you require copies of previous versions of this Privacy Policy, please contact our Data Protection Officer using the contact details noted below.

If you have any questions, comments and feedback regarding this Privacy Policy and how we process your personal data, as well as if you wish to exercise your data protection rights, please contact our Group Data Protection Officer at:

easyJet Group Data Protection Officer
Hangar 89
London Luton Airport
Luton, Bedfordshire
LU2 9PF
United Kingdom

For any other questions about your shareholding and related services, please contact us via Equiniti Registrar's helpline on 0371 384 2030 (+44 121 415 7047 if calling from overseas). Lines are open between 8.30am and 5.30pm Monday to Friday excluding public holidays in England & Wales.