### The policy transfer surrounding the DPF EU-USA: Flo complies with the EU–US DPF, the UK Extension to the EU–US DPF and Swiss–US DPF (collectively, the “**DPFs**”) when it transfers personal data to its US group company. We have certified to the U.S. Department of Commerce that, on reliance of the DPFs, we adhere to the DPF Principles when processing personal data of individuals within the EU, UK and/or Switzerland. For onward transfers, Flo is responsible for processing personal data it receives under the DPFs, and then transfers to a third party acting on Flo’s behalf. Flo remains liable under the DPFs if those third parties process personal data in a way that is not in compliance with the DPFs, unless Flo can prove that we are not responsible for the cause of any damage.