Introduction

In this Privacy Statement:

• references to "Goffs" "us", "we" or "our" means, as applicable: Robert J. Goff & Co plc; Goffs Bloodstock Sales Limited; Goffs UK Limited; Goffs Country Property Consultants Limited and its affiliates and subsidiaries;

• references to you or your means any individuals who:

• are employed or engaged by a Customer or who is a Customer (as defined below);

• visit any of our premises, including to attend a sale; or

• visit our Site (as defined below); or

• contact us, either through the Site, when visiting our premises, or as a Customer;

• references to "Customer" means any:

• entity buying or selling, or enquiring about buying or selling, horses through our sales, or using our services in connection with horse sales; or

• individual buying or selling, or enquiring about buying or selling, horses through our sales, or using our services in connection with horse sales;

• references to "Site" means our websites, including https://www.goffs.com/ and

• where we refer to "Data" or "personal data", we use these words to describe personal information that is about you and which identifies you.

Please read this Privacy Statement carefully to understand our treatment and use of your Data.

When Does This Privacy Statement Apply

Goffs is committed to protecting and respecting your privacy.

This Privacy Statement applies to Data that we collect, use and otherwise process about you in connection with:

• your use of our Site;

• when you visit any of our premises, including when attending a sale;

• when you buy or sell horses through our sales, or otherwise use our auction services; and

• when we communicate with you.

You have the right to object to our use of your Data in certain circumstances. A summary of your right to object (along with other rights under data protection law) and the details of who to contact if you want to exercise them can be found below.

Our Site is not intended for children, and we do not knowingly collect Data relating to children.

It is important that you read this Privacy Statement, together with any other supplemental privacy statement or fair processing notice we may provide on specific occasions when we are collecting or processing personal data about you, so that you are fully aware of how and why we are using your Data.

Identity of the Data Controller

For the purposes of data protection law, the Data Controller of your personal data is:

• Goffs Ireland, a private company limited by shares and registered in Ireland (Registered Number 45567) and having its registered office address at Goffs Bloodstock Sales, Kildare Paddocks, Kill, Co Kildare, with respect to personal data we process about you when:

• you visit any of our Irish premises, including when attending one of our Irish sales;

• when you buy or sell horses through our Irish sales, or otherwise use our auction services through our Irish entities;

• when you communicate with our Irish entities; and

when you visit the Site.

• Goffs UK Limited or Goffs Bloodstock Sales Limited (as applicable), with respect to personal data we process about you when:

• you visit any of our UK premises, including when attending one of our UK sales;

• when you buy or sell horses through our UK sales, or otherwise use our auction services through our UK entities; and

when you communicate with our UK entities.

Goffs also shares your personal data between the different entities of the Goffs group (as listed in the definition of "Goffs" above). For example, an employee of Goffs UK Limited may under certain circumstances process personal data relating to one of our Irish sales and vice versa.

We have appointed a Data Protection Officer (“DPO”) who is responsible for overseeing questions in relation to this Privacy Statement. If you have any questions about this Privacy Statement, please contact the DPO using the details set out below.

Name: Ben Norton

Email Address: dpo@goffs.ie

Telephone Number: +353 (0)45 886600

Address: Goffs, Kildare Paddocks, Kill, County Kildare, Ireland

INFORMATION WE MAY COLLECT FROM YOU

The Data we process about you broadly falls into the following categories:

Information that you may provide to us / we may collect from you:

• Contact Information: name, job title, date of birth, gender, postal address, e-mail address and telephone number, the time, date and details of your visit to our Site;

• Information provided voluntarily by filling in forms on our Site: for example by registering an account and by contacting us through the contact us section on our Site. This may include

username and password, and any personal data which you may include when requesting information from us or submitting comments or complaints;

• Information provided voluntarily when you contact us or meet with us: name, telephone number, email address. This may also include certain health information where we carry out pandemic response or control screening;

• CCTV: images captured on CCTV if you visit any of our premises or Goffs sites;

• Photographs and video: we may capture your image and/or audio visual footage of you during a live broadcast or stream, or record audio visual footage of you, when you visit our sales or premises;

• Financial information and account details: details regarding horses or related services purchased or sold, price, payment method and financial account details;

• Marketing preferences: contact information (as described above) which enables us to provide you with relevant marketing materials including our newsletter and catalogues. Including details of your marketing preferences and feedback (including details of any opt-outs or preferences as to method of marketing);

• Technical information: technical information from any device you use to access any digital platforms, our Site or systems or services provided in connection with our business, such as your mail address, your network information which is information from your device such as your IP addresses, internet service providers, location information and device information; and

• Information collected through our use of cookies: Cookies are pieces of information stored directly on the device you are using. Cookies allow us to recognise your device and to collect information such as internet browser type, time spent using the Site and pages visited. Please see our Cookies Policy which can be accessed here: Cookies Policy (goffs.com) for further information.

Information we receive from other sources

• ID: we may receive personal data from third parties that we use to carry out identity checks on you as part of our anti-money laundering obligations, including proof of ID and proof of address.

Please note that if you do not provide us with certain Data, we may not be able to provide you with any information you request or be able to interact or contract with you.

Information About Third Parties

In the course of enquiring about or participating in our sales, visiting our premises, using the Site or otherwise communicating with us, you may provide us with personal data relating to third parties. For example you may provide us with the name and contact details of your employees, customers, owners, service providers and/or any other third parties relevant for these or other purposes.

We will use this personal data in accordance with this Privacy Statement. If you are providing personal data to us relating to a third party, you confirm that you have the consent of the third party or are otherwise permitted to share such personal data with us and that you have made the information in this Privacy Statement available to the third party.

How do we Process your Data

The personal data we collect from you or through our systems helps us manage our relationship with you, comply with our legal obligations, and conduct our business (i.e. the sale/ purchase of a horse).

Under data protection law we can only use your personal data if we have a proper reason to do so (this is also known as a legal basis). Examples of where we have a legal basis include when:

we have your consent;

• it is necessary to enter into or perform a contract with you or your employer where you are acting on behalf of a corporate entity (or to take steps at your request prior to entering into that contract);

• it is necessary to comply with our legal obligations;

• it is necessary in order to protect your vital interests; or

• it is in our legitimate interests.

Where we rely on our legitimate interests we mean our:

• pursuit of our commercial activities and objectives, or those of a third party;

• improvement and development of our business operations and service offering, or those of a third party; or

• protection of our business, reputation, shareholders, employees and customers, or those of a third party.

The purposes of processing, and the legal basis we rely on for processing your personal data, are detailed below. Sometimes, these activities are carried out by third parties (see “Sharing of Personal Data” section below).

For some processing activities, we consider that more than one lawful basis may be relevant – depending on the circumstances.

What will Goffs use my data for?

Special Category Personal Data

We may also collect certain sensitive personal data (including any special categories of personal data) from you. This may include information concerning your current physical medical condition or disability information we collect when we carry out health screening checks when you visit our premises.

When we process your sensitive personal data, we will rely on either of the following legal bases:

• your explicit consent; or

• one or more of the other legal bases set out in the table above and the use is necessary for reasons of public health and to ensure compliance with our health and safety obligations under employment law.

Marketing

If you subscribe to our newsletter, you will be added to our mailing list. If you change your mind about receiving the newsletter you can unsubscribe by clicking the link contained in the newsletter or contacting the DPO.

Sharing of Personal Data

We may share your Data with:

• Goffs Group: We share information between Goffs group companies for any purposes set out in this Privacy Statement. This may be in circumstances where a Goffs entity will process personal data on behalf of another Goffs entity (as a processor), or where Goffs entities share your personal data for their own joint or independent purposes (as controllers).

• Service Providers: We use third party service providers who work for us in the provision of our services, including e.g. IT service providers, or third parties who assist us with our direct marketing activity.

In providing the services, your Data will, where applicable, be processed by the service provider on our behalf.

We will check any third party that we use to ensure that they can provide sufficient guarantees regarding the confidentiality and security of your Data. We will have written contracts with them which provide assurances regarding the protections that they will give to your Data and their compliance with our data security standards and international transfer restrictions.

• Third Party Websites: We share details of sales that have been made through Goffs with certain third parties, such as Weatherbys, for publication by said third party websites. Such sales information may include Customer personal data.

• Professional Advisors: Including accountants, lawyers and other professional advisers that assist us in carrying out our business activities.

• Consignors: when using a consignor, we may share your personal data with your consignor (for example, where you are the horse owner and we issue your entry receipt).

• Disclosures to Authorities: In certain circumstances, we share and/or are obliged to share your Data with third parties. These third parties include regulatory authorities; financial institutions; revenue and tax authorities (including in other countries); police, public prosecutors; and relevant industry bodies.

Where these organisations use your personal data as a “Data Controller” (rather than processing your personal data only on our behalf and on our instructions) – they will have their own privacy statements which you should read, and they have their own responsibilities to comply with applicable data protection law.

We may also access and/or disclose your Data:

• in the event that we sell or buy any business or assets, we may disclose your personal data to the prospective seller or buyer of such business or assets;

• if we or substantially all of our assets are acquired by a third party (or are subject to a reorganisation within our corporate group), personal data held by us may be one of the transferred assets; and

• if required to do so by law or in good faith and belief that such action is necessary to: (a) conform with the law or comply with legal process served on us; (b) protect and defend our rights or property including, without limitation the security and integrity of our network and systems; or (c) act under exigent circumstances to protect the personal safety of users of our services or members of the public.

Transfers Outside the United Kingdom and the European Economic Area

Your Data may be transferred, stored and processed in one or more countries outside the European Economic Area (“EEA”) or the United Kingdom ("UK"), for example, when one of our service providers use employees or equipment based outside the EEA or the UK.

For transfers of your personal data between the UK and the EEA, for example where Goffs' group companies internally share your personal data, we rely upon the adequacy arrangements that exist between the EEA and the UK pursuant to the EU adequacy decision and the UK adequacy regulations.

For transfers of your personal data to third parties in territories outside of the EEA and the UK where adequacy arrangements are not in place, we take additional steps in line with data protection law. We have put in place adequate safeguards with respect to the protection of your privacy, fundamental rights and freedoms, and the exercise of your rights, e.g. we establish an adequate level of data protection through standard data protection clauses as set out by the UK Government and the European Commission respectively.

If you would like to see a copy of any relevant provisions, please contact the DPO (see “Contact Us” section below).

How Long Will We Use Your Data For?

We will keep your personal data for as long as it is necessary to fulfil the purposes for which it was collected as described above, including for the purposes of satisfying any legal, accounting, or reporting requirements. This may mean that some personal data is held for longer than other personal data for

example so that we can use historic sales information (which may contain personal data) to respond to queries such as those pertaining to horse genealogy or to handle claims made against us.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

Where we collect health screening data in connection with our pandemic response, we retain that personal data for one month following your visit to our premises.

If you would like further information about our data retention practices, please contact us (see the “Contact Us” section below).

Links To Other Websites

Our Site may, from time to time, contain links to and from other websites and web platforms. In addition, third parties’ websites may also provide links to our Site. If you follow a link to any of those websites or web platforms, this may allow third parties to collect or share personal data about you. Please note that those websites and web platforms have their own privacy policies and that we do not accept any responsibility or liability for those policies. We encourage you to read the privacy policy of every website you visit.

Security

We will use appropriate technical and physical security measures to protect your personal data which is transmitted, stored or otherwise processed by us, from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access.

Access is only granted to Data on a need-to-know basis to those people whose roles require them to process your personal data. In addition, our service providers are also selected carefully and required to use appropriate protective measures.

As effective as modern security practices are, no physical or electronic security system is entirely secure. The transmission of information via the internet is not completely secure. Although we will do our best to protect your Data, we cannot guarantee the security of your Data transmitted to our Site. Any transmission of Data is at your own risk. Once we receive your Data, we will use appropriate security measures to seek to prevent unauthorised access. We will continue to revise policies and implement additional security features as new technologies become available.

Your Rights

You may have various rights under data protection law in your country such as the Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation; “GDPR”) in the European Union. However, in certain circumstances, these rights may be restricted. In particular, your rights may be restricted where this is necessary: (i) for the prevention, detection, investigation and prosecution of criminal offences, and/or (ii) in contemplation of or for the establishment, exercise or defence of a legal claim or legal proceedings (whether before a court, tribunal, statutory body or an administrative or out-of-court procedure).

Subject to the above, your rights under data protection law (including the GDPR) may include:

Complaints

If you are unhappy about any aspect of the way we collect, share or use your personal data, please let us know using the contact details below.

You also have a right to complain to your relevant data protection authority. In particular:

• For individuals based in Ireland, the Office of the Data Protection Commissioner at Canal House,

Station Road, Portarlington, Co. Laois by telephone at 1890 25 2231 and/or by email to info@dataprotection.ie; and

• For individuals based in the UK, the Information Commissioner's Office (ICO) who can be contacted on 0303 123 1113, or please see ico.org.uk.

Changes To Our Privacy Statement

We reserve the right to change this Privacy Statement at any time at our sole discretion. If we make changes, they will be posted on our Site so that you can see what information we gather, how we might use that information and in what circumstances we may disclose it.

Contact Us

Questions, comments and requests regarding this Privacy Statement and the information we hold are welcome and should be addressed to dpo@goffs.ie or alternatively you can write to us at Data Protection Officer, Goffs Bloodstock Sales at Kildare Paddocks, Kill, County Kildare. You can alternatively give us a call on +353 (0)45 886600.