This privacy notice is relevant where you are an individual and are a current or former registered shareholder of Devro plc (Devro). It makes you aware of how and why your personal data will be used, namely for the purposes of managing your shareholding in Devro, and how long it will usually be retained. It provides you with certain information that must be provided under data protection laws.

If you have any questions about this privacy notice, please contact us, as set out under paragraph 12.

We will comply with data protection law which states that the personal information we hold about you must be:

• Used lawfully, fairly and in a transparent way.
• Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes.
• Relevant to the purposes we have told you about and limited only to those purposes.
• Accurate and kept up to date.
• Kept only as long as necessary for the purposes we have told you about.
• Kept securely.

In connection with your shareholding in Devro we will collect, store, transfer, and use the following categories of personal information about you:

• Name
• Address
• Gender
• Shareholder reference number
• Contact details such as your phone and email address (and including where applicable any power of attorney details)
• Bank account details
• Details of shares held
• Voting instructions

We do not knowingly collect any "special categories" of more sensitive personal information or information about criminal convictions and

We collect personal information from you, the shareholder:

• When you provide it to Devro, Computershare or other third parties engaged to carry out services on our behalf (see paragraph 8 for more details);
• When you provide it to an agent which you use to trade in Devro shares;
• When you exercise rights attached to your shares, e.g. voting;
• If you register for any of Computershare’s online services.

We will use the personal information we collect about you when the law allows us to. We have set out below a description of the ways we plan to use your data and the legal bases we rely on to do so:

If you do not provide information when requested, which is necessary for us to register or maintain your shareholding, you may not be able to hold shares in Devro.

We do not use automated decision-

We will only share your personal information with third parties where required by law, where it is necessary for the purposes of managing your shareholding or where we have another legitimate interest in doing so including:

• Computershare Investor Services PLC, who are engaged as our share registrar. Computershare Investor Services PLC, other Computershare entities (Computershare) maintains the Devro shareholder register and processes shareholders’ personal information on our
• Third party technology providers which provide our IT software and
• Payment providers who help us manage dividend and other payments to our
• Regulatory agencies or government bodies, such as the Financial Conduct Authority, the London Stock Exchange, HMRC etc.
•  Third parties exercising their statutory right to inspect or receive a copy of our shareholder
• All our third-party service providers are required to take appropriate security measures to protect your personal information in line with our policies. We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions.

Transferring information outside the EEA

• Some of our service providers may process personal information about you outside the European Economic Area (EEA) but only if they have first provided appropriate safeguards.
• Please contact us if you want further information on the specific mechanism used by us when transferring your personal data out of the EEA, as set out under paragraph 12.

We will retain your personal information for as long as reasonably required to achieve the purposes for which it was collected. Your record in the shareholder register will be maintained while you are a shareholder of Devro.

If you cease to hold Devro shares, your information will be kept for a period of up to 10 years following the last update to your record on the shareholder register, or for as long as is necessary to resolve any outstanding matters relating to your shareholding or to meet legal, regulatory or tax requirements.

Under certain circumstances, by law you have the right to:

• Request access to your personal information. This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
• Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you
• Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing.
• Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground.
• Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing
• Request the transfer of your personal information to another
• Withdraw consent where we are relying on consent as a lawful basis to process your personal information.

If you wish to exercise any of the rights set out above, please contact us in writing as set out under paragraph 12. We will endeavour to respond to you within one month of receipt of your request. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

We reserve the right to update this privacy notice at any

The Data Protection Support Team (the DPST) is responsible for advising and overseeing this Privacy Notice and is contactable by e-mail on dpst@devro.com if you have any queries or comments. If you are dissatisfied with the response to any query or comment you receive from the DPST, please contact The Company Secretary, Devro plc, Gartferry Road, Moodiesburn, Chryston, G69 0JE.

You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection

If you believe that a breach of your privacy has occurred, we encourage you to contact the Data Protection Support Team using the contact details in section 11 above to discuss your concerns.

You also have the right to make a complaint at any time to the relevant supervisory authority for data protection issues, which in the UK is The Information Commissioner’s Office (“ICO”). Contact details for the ICO are as follows:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113
Fax: 01625 524510