Privacy statement

1. Information Collection
2. Technical, Physical, and Organizational Safeguards
3. Manner Of Collection and Limitations on Use
4. Lawful Processing
5. Protection of Sensitive Personal Data and Sensitive Identification Data
6. Electronic Monitoring
7. Disclosure of Personal Data Outside the Country of Origin
8. Marketing
9. Compliance with Policy
10. Exceptions to Policy
11. Concerns and Appeals
12. Registrations with National Data Protection Authorities

INTRODUCTION:

Quantinuum, a company incorporated under the laws of the Cayman Islands, and its subsidiaries (the “Company”, “our”, “us”, or “we”) is committed to safeguarding the privacy of personal information (or similar terms such as “personal data” as defined in applicable privacy laws) provided to it and in respect of any natural person(s), including but not limited to, clients, suppliers, partners and website visitors (“you” or “your”) in accordance with the EU General Data Protection Regulation (Regulation 2016/679) (“GDPR”) and any other applicable data privacy laws. The Company is the data controller of any personal information provided to it when you visit or use any of our websites (the “Sites) or use products or services that we offer.If in the process of providing services to clients, Quantinuum processes personal information as a data processor, meaning that we process the data solely on the instructions of our clients, who determine the purpose and means of processing and exercised overall control of the data. Therefore, if you have questions or wish to exercise your rights relating to your personal data, you may need to contract the client (and controller) on whose behalf the processing of your data is carried out. If we receive a request from you relating to data controlled by a client, we will pass the request to the appropriate client (and controller) where permitted by applicable privacy law.

PURPOSE:

This Quantinuum Data Privacy Policy and Website Privacy Statement (the “Policy”) establishes uniform, global guidance regarding how the Company generally intends to Process and protect Personal Data. The Policy explains how we collect, share, and use your personal information collected and how you can exercise your privacy rights. Note that, by using our Sites, you are consenting to Quantinuum collecting and processing your personal information in accordance with this Policy, as it may be amended from time to time. If you do not agree to these terms, do not use the Sites. This Policy should not be construed as a guarantee of action by the Company or as creating contractually binding promises. To the extent that Law or contractual provisions impose stricter requirements than the guidance set forth below, the Company will comply with the more restrictive Law or contractual provisions. Adherence to this Policy may be limited to the extent required to respond to legal, governmental or regulatory requirements, or where expressly permitted by Law.This Policy does not replace or supersede any other privacy statement, privacy policy, or other notice or agreement addressing the processing by the Company of Personal Data issued or otherwise made available to Data Subjects, but rather, shall be read in conjunction with such statements, policies, notices or agreements; provided, however, that in the event of a conflict between such statements, policies, notices or agreements and this Policy, the provisions of the former shall govern.

If you are a California resident, please see our CCPA/CPRA Privacy Notice below to learn about your rights under the California Consumer Privacy Act and California Privacy Rights Act.

If you are a Virginia resident, please see our Virginia Privacy Notice below to learn about your rights under the Virginia Consumer Data Privacy Act. If you are a resident of the European Union or United Kingdom, then you have additional privacy rights which are explained below in the EU/UK Privacy Rights Notice.

SCOPE OF POLICY

This Policy applies to the processing of Personal Data of the Company’s customers, suppliers and end users of Company’s products and services worldwide in addition to users of the Sites.

APPLICABILITY:

LOCATION(S): ALL

BUSINESS UNIT(S): ALL

DISTINCTIONS: Applies to the Company, its operating units, direct and indirect subsidiaries and joint ventures where the Company has a controlling interest. This includes all Employees, sub-contractors, third party employees and Company resource and Sites users.

APPLICABLE LAW

The Company processes Personal Data in compliance with Law, this Policy, contractual obligations and any privacy policy, privacy statement or other notice or agreement addressing processing of Personal Data. The requirements in this Policy apply except where a particular jurisdiction’s Law and/or contractual obligations impose more detailed or stricter requirements relating to the Processing of Personal Data, in which case that Law or those contractual obligations will apply and take precedence.