Privacy Notice for Participants

This Privacy Notice explains how Man Group plc, together with its subsidiaries and its affiliates which are identified in the table in Section 12 below (referred to collectively as “Man”, “we”, “us” or “our”), collects and uses Personal Data about you in relation to Man deferred share, fund and cash plans (the “Plans”) and their administration, in accordance with applicable law and regulation.

This Privacy Notice applies to current and former employees and partners of Man who hold either unvested or vested and unexercised deferred share, fund or cash awards granted under the Plans (each an “Award”).

Capitalised terms used in this Privacy Notice are defined in Section 14.

This Privacy Notice does not form part of your contract with Man. Please regularly check this page to review any updates we might make.

The Personal Data that we Process is collected or created from a variety of sources as follows:

In order to carry out the Processing activities set out at Section 2(C) below, and where relevant to our relationship, the types of Personal Data that we process include:

We share your Personal Data with Man Group staff and entities within Man Group for the purposes described above.

In addition, we may disclose your Personal Data in accordance with applicable law and regulation to:

• Governmental, legal, regulatory, tax or similar authorities, ombudsmen, central and/or local government agencies; and/or law enforcement officials (if mandated by law and regulation or if required for the protection of our legitimate interests);
• anti-fraud services in relation to data on known or suspected fraudulent activity;
• third party service providers who process Personal Data on behalf of Man in the provisions of activities in the ordinary course of business, including but not limited to: nominee account administration, fund administration and Employee Benefit Trust administration;
• third parties to whom you request us to send your Personal Data;
• third party Processors (such as payment services providers and banks);
• our professional advisers (such as our auditors, accountants, financial advisers and lawyers);
• any relevant party, claimant, law enforcement agency or court, to the extent necessary for the establishment, exercise or defence of legal rights in accordance with applicable law and regulation;
• any relevant party for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including safeguarding against and the prevention of threats to public security in accordance with applicable law and regulation; and
• any relevant third party acquirer(s), in the event that we sell or transfer all or any relevant portion of our business or assets (including in the event of a reorganisation, dissolution or liquidation) or the assets or business of our funds.

We do not share your Personal Data with others for marketing purposes unless you agree to this.

Due to the international nature of Man Group’s activities and the service providers we use, your Personal Data may be collected, transferred and stored in any country worldwide, including but not limited to countries in which Man conducts its business activities. Some of these countries may not have been deemed by the relevant data regulators to have the same level of protection as countries in respect of which EEA, the United Kingdom, Swiss, Jersey or Guernsey data protection law applies.

We ensure that such transfers are protected by appropriate safeguards or are otherwise permitted under applicable law. Where we transfer your Personal Data to a country outside of the EEA, the United Kingdom, Switzerland, Jersey or Guernsey, this can be done in the following ways:

• The country to which the Personal Data is transferred may be approved under the adequacy decisions of the relevant supervisory authority;
• The recipient may have agreed to standard contract clauses that require them to protect the Personal Data;
• The recipient uses Binding Corporate Rules which are approved by relevant supervisory authorities and require them to protect the Personal Data; or
• In other circumstances, the law may permit us to otherwise transfer your Personal Data outside of the EEA, the United Kingdom, Switzerland, Jersey or Guernsey.

You may obtain more details of the safeguards in place to protect your Personal Data when it is transferred outside the EEA, the United Kingdom, Switzerland, Jersey or Guernsey, including a copy of such safeguards by contacting us via the details provided in Section 9.

Man Group uses artificial intelligence (AI) to support its operations. AI tools assist staff with tasks such as research, streamlining business processes, preparing meeting records (including action items and key decisions), supporting compliance with legal and regulatory requirements, and enabling internal training. AI is not used to make automated decisions about individuals.

Some third-party services we use also incorporate AI functionality. For example, video conferencing tools may be used to record meetings and use AI to transcribe and summarise meetings.

Where personal data is processed in connection with AI, we rely on our legitimate interests in improving operational efficiency and productivity, and in managing our business effectively. Records created using AI may form part of our business records and may be used for governance, audit, and compliance purposes, and may be disclosed in response to regulatory requests or in connection with legal proceedings.

Personal data processed using AI is retained in accordance with our retention policies (see Section 6).

Some of the third-party AI services we use may process personal data outside the United Kingdom, EEA, Switzerland, Jersey or Guernsey. Where this occurs, we ensure appropriate safeguards are in place in accordance with Section 4.

We apply appropriate contractual, technical, and organisational safeguards to protect personal data processed in connection with AI.

Your rights in relation to personal data processed using AI are the same as for any other processing we carry out. Please refer to Section 8 or contact our Data Protection team using the details in Section 11 for further information

How long we hold your Personal Data will vary. The retention period will be determined by various criteria, including the purposes for which we are Processing your Personal Data (as it will need to be kept for as long as is necessary for such purpose), legal and regulatory obligations (which may set a minimum and maximum period for which we have to keep your Personal Data) and our internal policies, which take into consideration the purpose for which we hold the Personal Data.

We have extensive controls in place to maintain the security of our information and information systems. Appropriate controls (such as restricted access) are placed on our computer systems. Physical access to areas where Personal Data is gathered, processed or stored is limited to authorised staff. We operate layers of safeguards and defences designed to ensure that Man is able to operate safely. Amongst other things, such controls are designed to detect, respond and recover in case of any adverse events that may arise.

You have a number of legal rights in relation to the Personal Data that is held about you by us, including:

• You have a right to obtain certain information regarding the Processing of the Personal Data and to access your Personal Data.
• If your Personal Data is inaccurate or incomplete, you have the right to request corrections to it.
• In certain circumstances, you have the right to receive some Personal Data in a structured, commonly used and machine-readable format.
• You have the right to ask us to transfer some of your Personal Data to other organisations, where this is technically feasible. Please note that this right only applies to Personal Data which you have provided to us.
• You have a right to ask us to erase or “restrict” your Personal Data in some circumstances. Please note that there may be circumstances where you ask Man to erase your Personal Data but we are nevertheless legally entitled to retain it.
• Where we Process your Personal Data because the Processing is in our, or a third party’s, legitimate interests, then you may object to this Processing. Please note that there may be circumstances where you object to, or ask Man to restrict its Processing of your Personal Data but we are legally entitled to continue Processing your Personal Data or to refuse that request.
• In the limited circumstances in which we have asked for your consent to Process your Personal Data for a specific purpose, you may withdraw your consent at any time. Once we have received notification that you have withdrawn your consent, we will no longer process your Personal Data for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.

These rights may be limited, for example, if fulfilling your request would reveal Personal Data about another person, or if you ask us to delete information which we are required by law and regulation to keep or have compelling legitimate interests in keeping.

You also have a right to complain to a supervisory authority for data protection. This may either be the supervisory authority in the place of your habitual residence, your place of work, or the place where you consider that there has been a breach of data protection law.

To exercise any of these rights, please use the contact details provided in Section 11.

Inform us of any changes to your Personal Data
It is important that the Personal Data we hold about you is accurate and current. Please keep us informed by using the contact details provided in Section 11 if your Personal Data changes during your working relationship with us.

Inform your spouse, partner or other family member that we hold their Personal Data
Where you have elected to transfer some of your Man shares to your spouse, partner or other family member on vesting of your Awards, some of the Personal Data we hold in relation to your participation in the Plans will include the Personal Data of your spouse, partner or other family member.

You must inform your spouse, partner or other family member that Man Processes their Personal Data as well as the purpose for which we Process it.

If you have a concern about how we handle your personal data, you can make a complaint. Any complaint will be acknowledged within 30 days and acted on without undue delay.

To make a complaint, please contact us by:

• Email on complaints@man.com; or
• Post to Complaints, Man Group, Riverbank House, 2 Swan Lane, London EC4R 3AD.

Please include your contact details, a description of the issue, and any relevant reference numbers or supporting information.

If you are not satisfied with our response to your complaint, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO). You can find details about how to do this on the ICO website at https://ico.org.uk/concerns/ or by calling their helpline on 0303 123 1113.

For electronic communications, please contact:

All written communications should be directed to:

Man Group
Data Protection
Riverbank House
2 Swan Lane
London EC4R 3AD
United Kingdom

You can find out more information about your rights by contacting the EEA data regulator in your jurisdiction, or the jurisdiction of the relevant Controller which in Ireland is the Data Protection Commission (website at dataprotection.ie), or the UK’s Information Commissioner’s Office (website at https://ico.org.uk) , the Swiss Federal Data Protection and Information Commissioner (website at https://edoeb.admin.ch/) the Jersey Office of the Information Commissioner (https://jerseyoic.org) or the Guernsey Office of the Data Protection Commissioner (website at https://dataci.gg).