King Communications Privacy Notice Last updated:  2025 Next review: 28 August 2026 King Communications Limited a company registered in Ireland with company number 512674. Our registered address is located at Main Street, Killeshandra, Co Cavan, Ireland (“us”, “we”, or “our”), operates the kingcommunications.ie website and provide managed services to the Vodafone Group. In partnership with Vodafone, we have built a retail channel offering a comprehensive range of advanced voice, data, broadband and TV services to residential and corporate customers. (the “Platform” or “Service”). King Communications respects your privacy. We handle your personal data responsibly and are committed to safeguarding your personal data. We act in your best interests and are transparent about personal data processing. This Privacy Notice describes how King Communications handles your personal data: how we receive, why and how we process, and how we safeguard personal data. We tell you what rights you have, how to exercise those rights and how to contact us if you have questions or concerns. We tell you how to contact our data protection regulator. This Notice applies only to personal information, not to de-identified or aggregate information or other information that cannot identify you. Access to and use of King Communications or Services are subject to the King Communications Terms of Service and User Code of Conduct. Certain elements of the Platform or Service may operate under separate or additional terms of practice different from or in addition to those described in this Notice; in those cases, you will be provided with separate notice and information relevant to your use of those parts of the Platform or Service. Please read this Notice carefully. Also, please read our Cookie Notice, which tells you how we use cookies and other similar tracking technologies. We regularly review and update this Notice, so we recommend visiting this page occasionally. If we communicate with you, we may notify you of significant changes to privacy practices or processing activities on your personal data. We will notify you before any significant changes to personal data processing begin, such as if we plan to use automated processing or artificial intelligence for decision making. This Notice applies to any personal information we collect through the Platform or Services, associated with:

• our (potential) customers, contractors, clients, suppliers and other commercial relations.
• visitors to our websites and applications.
• recipients of information from us.
• all other people in contact with us.

Contact us at  [email protected]. You can contact our Data Protection Officer for any questions about this Privacy Notice: Name: Conor Hendley Email: [email protected] You have the right to lodge a complaint with a data protection supervisory authority. The relevant authorities include: Our competent supervisory authority in the EU is the Irish Data Protection Commission, 6 Pembroke Lane, Dublin 2, D02 X963 https://www.dataprotection.ie/en. In the UK, it is the Information Commissioner’s Office, www.ico.org.uk. Summary of Terms and Principles  King Communications observes applicable privacy and data protection law in the markets we serve when processing personal data. This includes EU and UK General Data Protection Regulation (“GDPR”), GDPR variations in the European Economic Area, and other data protection law as required.   Generally, personal data are data that can be directly or indirectly traced back to, and identify, a natural person, commonly referred to as a “data subject.” Personal data processing can refer to anything we might do with personal data, such as collecting, recording, organizing, structuring, storing, updating, or modifying, retrieving, consulting, using, providing by transmission, distributing, making available, aligning, combining, shielding, deleting, or destroying. King Communications observes core principles when processing personal data. The data:

• are processed lawfully, properly, and transparently.
• are processed only for the purpose for which they were collected (purpose limitation).
• are processed as little as possible (data minimization).
• are processed correctly (accuracy of data).
• will not be kept longer than necessary (storage and retention limitation).
• are transferred internationally under applicable international regulations.
• are processed with safeguards in technical and organizational controls to address security, integrity, and confidentiality; and
• are processed in systems, programs and services with privacy and security by design.

Collection And Processing  King Communications may be a personal Data Controller or a personal Data Processor, or both, depending upon the nature of the processing and the commercial relationship associated with that processing. A data controller, alone or jointly with others, determines the purposes and means of the processing of the relevant personal data.  A data processor processes the relevant personal data based on the instructions of the data controller. In applicable data protection law, King Communications may be a Data Discloser (Data Exporter) or a Data Receiver (Data Importer). A discloser/exporter sends personal data to a receiver/importer for processing or onward transfer for processing. A processor receives personal data for processing or onward transfer for processing. What personal data might we process? King Communications may process:

• personal data that you provide to us, such as:
  • identity information and personal details.
  • contact details.
  • details as described in a curriculum vitae or employment history.
• personal data obtained through means of communication and interaction, such as our browsing our website, receiving newsletters, and sending and receiving emails:
  • identity information and personal details
  • contact details.
  • information about the device with which you visited our website, such as an IP address.
  • your browsing activity on our website, such as:
    • which data/web pages you have viewed.
    • how you navigated the website.
    • whether you opened a newsletter or email and which parts did you click.
    • dates and times of your visit to the website.
    • operating system you are using.
    • Internet address of the website to which a link is made.
    • geo-location.
    • data sent to us; or
    • data downloaded from the website.
• Personal data obtained from other sources:
  • data available from common public sources.
  • data obtained from the official public sources.
  • data available on public business websites.
  • data obtained from commercial sources that are authorized to share personal data; or
  • data obtained from your employer or client.

Why do we process personal data? King Communications may process your personal data for the following purposes:

• to inform you about our products and services.
• to contact you about newsletters, but only if you have opted in.
• to measure the use of the website.
• to manage, secure, adapt and improve the website and related technologies.
• to verify your identity.
• for marketing purposes.
• for commercial contract purposes, such as your use or your employer’s use of our Platform or Services; or
• for employment recruitment and selection.

By what legal means do we process personal data? King Communications may process your data:

• if you have given us permission to process personal data for one or more specific purposes. We are transparent and inform you so you can grant or remove consent with genuine choice and control.
• if the processing is necessary for the performance of an agreement to which you are a party, or to take measures at your request prior to the conclusion of an agreement.
• if the processing is necessary for our legitimate interest or of a third party unless your rights and interests outweigh either our or the third-party’s legitimate interest.
• if processing is necessary to comply with a legal obligation.
• if the processing is necessary to protect your vital interests or those of another natural person.
• if the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.

Your Rights  You have rights.  You can ask us by any means, but sometimes under certain restrictions or conditions, to:

• provide access to personal data.
• restrict or object to processing.
• rectify errors or erase personal data; or
• receive a portable copy of personal data.

You can complain to a supervisory authority that is the data protection regulator. You may exercise these rights by submitting your request in writing or by phone to us, adjusting preferences in our consent manager, myConsentChoice, or by sending an email to [email protected]. We are required to verify your identity before your request can be met. Unless explicitly stated otherwise below, we will respond to your request without undue delay, and within one month. In principle, your requests will be processed electronically (and will therefore be replied to by email), unless this is not possible, or you request otherwise. In principle, we will not charge you for request processing, unless your requests are excessive, manifestly unfounded or if you request additional copies when exercising your right of access, and charges are subject to applicable data protection law. Viewing and/or modifying data You can ask us at any time, by any means, to indicate which categories of your personal data we hold or are processed, for which purposes, from which data source, and what retention period(s) is(are) applied. In addition, you can ask us at any time to complete, correct, or delete your data. We will correct inaccurate personal data we have about you. If we have changed your personal data, we will notify you accordingly. Limit the processing of your data You can ask us to temporarily restrict, object to or withdraw consent to the processing of your personal data. We will tell you if we cannot honor your request and explain why. Ask to transfer personal data You can ask us to provide to you or a third party your personal data in a structured, common, and machine-readable form. Right to be forgotten You can ask us to delete your personal data. We will tell you if we cannot honour your request and explain why. Exercising your rights does not affect processing that has already taken place unless incorrect data has been used in previous processing and it can be reprocessed with correct data. Automated Decision-making: We do not carry out any decision-making, including profiling, which produces legal or similarly significant effects on you. Cookie Notice:  Cookies And Tracking Technologies  King Communications uses cookies and tracking technologies on our websites. In this Cookie Notice, we inform you about our cookies practices, a listing of cookies that are always enabled and others that are enabled after consent, their purpose and details such as classification, provider/domain, and retention period before expiry – please see Appendix A – Cookies and Browser Storage at the end of this Privacy Notice. Cookies are small pieces of information that are stored on your computer to provide control for current functions while browsing our websites, for recognition of preferences on subsequent visits to our websites, and for third-party features. We use some cookies as strictly necessary components of our websites.  We use other cookies in functional, analytical, and marketing categories only when you provide consent directly with myConsentChoice or when your browser provides preference information to myConsentChoice in the browser session. You will be prompted with myConsentChoice when visiting our websites. You can accept or reject all optional cookies or manage preferences within the consent manager. You can change your preferences to grant or withdraw consent at any time. Retention Periods: We retain personal data for no longer than is necessary for the purposes for which it is processed. Retention periods vary depending on the type of personal data and the purposes of processing and are defined in our Data Retention Policy. Children’s Data: Our services are not directed to, and we do not knowingly collect personal data from, individuals under the age of 16. Consent Expiry We remember your consent preferences for 30 days. You can change your consent preferences at any time by clicking on the Manage Consent link from our website’s footer. You can then adjust the available preference sliders to ‘On’ or ‘Off’ and save by clicking ‘Save Choices.’ You may need to refresh your page for your settings to take effect. The data sent by us and linked to cookies, user-identifiers (e.g., User-IDs) or advertising-identifiers are automatically deleted after the third-party expiry period. Monthly deletions for expired cookies and tracking technologies are processed automatically. Google Processing If you have given your consent, Google Analytics and Google Tag Manager, a web analysis service of Google Ireland Limited (“Google”) is then enabled on our websites. The use includes the “Universal Analytics” operating mode. This makes it possible to assign data, sessions, and interactions across multiple devices to a pseudonymous user ID and then analyse activities across devices. Google may transfer to and process consent-granted personal data in the United States. However, as IP anonymisation (IP masking) is activated on our websites, your IP address will be shortened by Google in advance within member states of the European Union or in other signatory states per the Agreement on the European Economic Area. The IP address transmitted by your browser as part of our use of Google Analytics is not combined with other data from Google. Further information on terms of use and data protection can be found at: https://www.google.com/analytics/terms/de.html or https://policies.google.com/?hl=en.   Purposes of Google Processing Google will use personal data provided to evaluate your use of our websites, to compile reports on website activity and other services related to website use. Legal Basis of Google Processing Consent is the legal basis for Google Analytics. Recipients or Categories of Recipients Google is the recipient of the collected data and is an independent controller. You can also prevent Google from collecting the data generated by the cookie and relating to your use of the website (including your IP address) and from processing this data by Google by downloading and installing the Browser Add-on. Opt-out cookies will prevent future collection of your data when you visit our website. To prevent Universal Analytics from collecting data across different devices, you must opt-out on all systems used. If you click here, the opt-out cookie will be set:  Disable Google Analytics.   Use of Cloudflare King Communications use services provided by Cloudflare, Inc. (“Cloudflare”) to enhance the security and performance of our website. Cloudflare acts as a content delivery network (CDN) and security service that helps us protect against malicious traffic, distributed denial-of-service (DDoS) attacks, and other cyber threats. When you visit our website, your requests are routed through Cloudflare’s network. As part of this process, Cloudflare may process the following information:

• IP address
• System configuration information
• Website traffic data and security logs
• Cookies necessary for security and load balancing (e.g., to detect malicious visitors and manage network traffic)

Purpose of processing:

• Protecting our website from cyberattacks and abuse
• Optimising loading times and overall performance
• Ensuring secure and reliable access to our website

Third Parties and International Transfers King Communications may engage third parties who process personal data as part of our Platform or Services. These third-party sub-processors act on our instruction under contract and under the same purposes and lawful bases set out in this privacy statement. These may be:

• Vodafone Ireland
• Payment processors
• IT Providers
• professional advisers such as auditors and legal counsel

King Communications remains accountable for personal data processing of our sub-processors as described in the Privacy Notice and under applicable data protection law. We enter service agreements that include data processing addendums. The addendums include requirements of US States, EU standard contractual clauses (SCC), UK international data transfer agreements or addendums (IDTA) or other contractual clauses and schedules as required by applicable data protection law. The third party is a joint controller if we and the third party jointly define the purposes and means of processing. The third party is an independent controller if the third party defines the purposes and means of processing separately from us.  The controller distinctions can vary depending upon data protection processing purposes and processing activities. International Transfers King Communications may conduct business internationally. We may need to transfer your personal data to third parties established outside of designated areas of applicable data protection law, such as transfers outside the European Economic Area as described in the GDPR. All international data transfers are subject to applicable data protection law. We follow the guidance and directives of those regulations, including the use of adequacy decisions by competent data protection supervisory authorities, SCCs, IDTAs and other contractual measures, and industry accepted technical and organisational measures. We have measures that apply across all processing and ones tailored for distinct personal data processing purposes and processing activities. We will only transfer your personal data if an appropriate level of protection is in place. Data Protection and Controls King Communications follows internal policy and applicable data protection legislation in its data protection compliance program. Also, Personal Information Management System (PIMS) in place. Those management systems include industry accepted physical, administrative, organisational, and technical measures to maintain security, integrity, and confidentiality. Measures and controls include:

• administrative controls for policy, guidelines and procedures, training, governance, periodic audit reviews and regularly testing, assessing, and evaluating the effectiveness of technical and organisational measures.
• administrative controls for contractual practices such as confidentiality agreements, data processing agreements, SCCs, IDTAs and specific mechanisms for certain countries
• measures for ensuring ongoing confidentiality, integrity, availability and resilience of processing systems and services.
• measures for ensuring data minimisation.
• measures for allowing data portability and ensuring erasure.
• physical security controls where personal data are processed.
• technical security controls
• user identification and authorisation
• conditional and role-based access
• pseudonymisation and data encryption at rest, in processing and in transit, when applicable and feasible
• system configuration, including changes to default configurations.
• device controls, monitoring, auto management controls
• events logging and monitoring.
• data disposition controls
• we do not store personal data for longer than is necessary, according to internal policy or after statutory periods associated with the purpose of the processing.

Contacting Us or a Data Protection Authority  You can contact us by any means to enquire, comment, exercise rights, disclose a suspected or adverse data event such as a personal data breach, or complain. If you suspect that there has been a breach of the security of your or others’ personal data that may expose those data to loss, compromise or unlawful processing, please contact us at [email protected]. If you do not agree with our handling of your personal data, you can also submit a complaint to the proper authorities for your jurisdiction: For EU/EEA, contact the Irish Data Protection Commissioner at  https://forms.dataprotection.ie/contact. For other relevant EEA judicial authorities. Contact details can be found at https://www.edpb.europa.eu/about-edpb/about-edpb/members_en. For UK, contact the Information Commissioner’s Office at https://www.ico.org.uk. Complaints can be submitted at https://www.ico.org.uk/make-a-complaint.

Appendix A – Cookies and Browser Storage

This appendix forms part of our Privacy Notice and provides a detailed list of cookies and browser storage technologies used on our website(s). It includes the name, provider, purpose, type, expiry, and legal basis for each technology. This list is reviewed and updated regularly to ensure accuracy. Strictly Necessary Cookies

Cookie Name	Provider	Purpose	Type	Expiry	Legal Basis
_cfuvid	Cloudflare	Identifies individual clients behind a shared IP address and applies security settings on a per-client basis.	First-party Persistent	Session	Legitimate Interest / Security
cf_clearance	Cloudflare	Confirms the visitor has passed a security challenge, allowing access to the site.	First-party Persistent	Variable	Legitimate Interest / Security
AEC	Google	Ensures requests in a browsing session are made by the user, not malicious sites.	Third-party Persistent	6 months	Legitimate Interest / Security
SEARCH_SAMESITE	Google	Helps prevent cross-site request forgery (CSRF) attacks.	Third-party Persistent	6 months	Legitimate Interest / Security
HSID	Google	Contains encrypted Google account ID and login data to verify user identity and prevent fraud.	Third-party Persistent	2 years	Legitimate Interest / Security
SID	Google	Contains encrypted Google ID and login info for authentication and security.	Third-party Persistent	2 years	Legitimate Interest / Security
SIDCC	Google	Security cookie to protect user data from unauthorized access.	Third-party Persistent	1 year	Legitimate Interest / Security

Functionality Cookies

Cookie Name	Provider	Purpose	Type	Expiry	Legal Basis
APISID	Google	Stores user preferences and profile information for Google services.	Third-party Persistent	2 years	Consent
SAPISID	Google	Used to store user preferences and profile information for Google services.	Third-party Persistent	2 years	Consent
SSID	Google	Stores session state for Google services.	Third-party Persistent	2 years	Consent
DV	Google	Stores user preferences for Google services.	Third-party Persistent	Session	Consent
NID	Google	Stores user preferences for Google search results and services.	Third-party Persistent	6 months	Consent

  Analytics Cookies

Cookie Name	Provider	Purpose	Type	Expiry	Legal Basis
OTZ	Google	Used for analytics and to measure website traffic and performance.	Third-party Persistent	1 month	Consent

  Marketing Cookies

Cookie Name	Provider	Purpose	Type	Expiry	Legal Basis
__Secure-3PSID	Google	Builds a profile of website visitor interests to show relevant ads across the web.	Third-party Persistent	2 years	Consent
__Secure-1PSID	Google	Used for targeting purposes to build a profile of visitor interests for personalized ads.	Third-party Persistent	2 years	Consent