KPN Privacy Statement

May 2022:

KPN B.V. and its group companies (together referred to as ‘KPN’) offer a wide variety of services, including fixed telephony, mobile telephony, internet services and TV. Given the nature of our services, KPN is in possession of certain information about you.

We’re doing everything within our power to connect everyone in the Netherlands to a sustainable future. And you can be confident that your data is safe with us. Accordingly, we are always searching for ways to improve our services and to tailor them as much as possible to your personal needs. To this end, we also rely on models based on Artificial Intelligence (AI).

To provide you with the best service possible, it is important that we know which of KPN’s products and services you use, even if you don’t purchase all your products and services from one KPN brand or division. That is why we link the information in our possession if you purchase one or more services from us, so that we are able to deal with your questions, reports (for example about a fault) and complaints quickly and efficiently.

KPN is happy to provide you with information personally and at times that you need it. This information consists of tips about products that you use, newsletters or interesting offers. We will send you, for example, an e-mail containing a personal offer when your subscription ends or when you can renew your subscription. Or you will receive an SMS message when your credit has been used up, with a reminder to top up, to avoid paying too much. There may be benefits available to you if you purchase several services or products from us. An example of this is KPN Hussel. We will be happy to inform you about these
benefits. This is another reason for us to process your data.

However, when we do process this data, we put your interests first! You have to get something out of it.

Our promise:

• KPN handles your data with care. You can rest assured that your data will be safe with KPN and that we comply with the law.

• We do not look at the content of your communications. We do not monitor any conversations, or look at the content of your SMS messages, e-mails or chats, or keep a record of what websites you visit.

• We do not sell your data to third parties.

• We will notify you about the use of your data and offer you a simple way in which you can view and alter your data and privacy choices.

• You decide what happens to your data. We respect the choices you have made with regard to your privacy.

In this privacy statement we explain, step by step, how we deal with your personal data. We explain what part of your data we process and what influence you can have on this. This privacy statement is divided into various chapters. These are summarized below.

This privacy statement applies to all of your data that KPN processes for the products and services that KPN markets in the Netherlands. This statement applies to all customers who purchase, for example, fixed and mobile telephony, internet, or TV from KPN and to all users of the KPN websites.

1. Who is responsible for processing your data?

All entities that are part of the KPN group have adopted principally the same privacy policy. This means that you always know where you stand. For example, if you are purchasing a service from KPN B.V, or from an entity within the KPN Group, then
the Controller that processes your data is KPN B.V., Wilhelminakade 123, Rotterdam.

2. Summary of the key processing operations

We set out below a general overview of the key data processing operations. The goal of the summary is to present an instant, accurate impression of which of your data we process when you use our telephony, internet and television services. This
summary also sets out the choices you can make yourself for each service.

If you would like more information about a particular subject, just click on the relevant check box to access the corresponding information. If you want to find out more about the choices open to you and how to notify us of your choice, Go to “Right to
Object”. If you want to know what data we have on you, go to "Inspection".

We also process data from you on our websites, in our shops and in our apps. This is not stated in this summary. For a complete picture, we recommend that you read the privacy statement in full. It will also explain to you how we share your data within KPN and what our policy is with regard to sharing your data with third parties.

To be able to process personal data we need a legal basis for doing so. The legal bases we can rely on are as follows:

• Necessary for performing the contract, including, for example, for providing the service, or network planning, management and security

• Compliance with a statutory obligation, e.g. storing of invoices for a period of 7 years for the tax authorities

• Legitimate interest, including, for example, in improving services, providing information about the use of the service, trend analysis, and marketing and sales

• Approval, including, for example, for personalized marketing and sales

3. Making calls with KPN

3.1 Which of your data do we process?

3.1.1 At time of registration, if you contact us

If you take out a subscription with us for a fixed or mobile telephone connection, we process some of your data. We also do this if you register as a customer or participate in a promotion. The data we process includes your name, address, copy of your proof of identity or residence, bank account number, e-mail address, date of birth, what services you buy from us, type of subscription and phone number. It does not matter whether you contacted us by telephone, via our websites or in one of our shops.

If you contact us, your data is registered. For example, we will record a question you ask us by telephone, via our websites or social media. We do this to be able to answer your question and to take the necessary actions to provide you with the right solution. Your data will be similarly registered if you report a fault, file a complaint, or fail to pay an invoice.

We refer to this data as ‘contact data’.

KPN may make sound recordings/transcripts of your conversation with us for the purposes of our staff training. KPN is also required to make these recordings/transcripts to record your wish to change or terminate the services we supply to you.

3.1.2 Use of the service

If you use our telephony services, KPN will process technical data connected with this use and that is necessary to transport telephone traffic over our network. Examples are:

• the date, time and duration of a connection, your own telephone number and the telephone number of the party you call, technical identification data, your SIM card number (IMSI), your mobile device number (IMEI), and the number of signals that your telephone sends out;

• location data necessary to ensure that you can use our telephony services at all times and to transport your telephone traffic across our network. This location data indicates the transmission mast with which your mobile device or tablet is in communication.

So we do not process the content of the communication.

This technical data (except for location data) is included on your itemized invoice. We call all this technical data ‘consumption data’.

On the non-itemized ‘front page’ of our invoices we specify for example the number of minutes of call time and number of SMS messages you have sent, and the total sum owed. This data we call ‘usage data’.

3.2 What do we do with your data?

3.2.1 Service

The first reason for KPN to process your data is to be able to supply you with our services. We need to process your data to deal with your requests, to set up connections, to expand connections, to send invoices or answer questions about these, or deal with fault reports, or complaints. Unless we process your data, we cannot supply you with our services.

3.2.2 Carrying out a risk analysis and credit registration, and provide credit

If you apply for a new mobile telephone subscription or credit, KPN will carry out a risk analysis. For this, KPN will construct, in collaboration with other providers of public telecommunications services, a database of contracting parties. This database
contains a list of contracting parties that have been disconnected (or whose contract has been terminated ) because of nonpayment. This database is used by KPN and the other providers to make the right choices regarding acceptance of applications for telecommunication services. Stichting Preventel is responsible for this database. You can find more information at https://www.preventel.nl/.

As soon as we receive a request for a new telephone subscription or a renewal, your data will also be forwarded to Experian, a company credit report supplier. This also happens if you send in a credit application. All data pertaining to your payment history will also be shared with Experian. Experian processes this data under its own responsibility for analyses of credit worthiness, fraud prevention, debt collection and data quality validation. Experian can use this data to make an accurate risk analysis. If, as a result of payment arrears, you have ever had a contract terminated, this information may have consequences
for other contracts that involve financial and other obligations. This applies to mobile telephony subscriptions entered into after January 1, 2010 and to fixed line subscriptions entered into after May 1, 2016.

KPN Finance B.V. will provide you with non-revolving credit for a term of one or two years for the purchase of a mobile telephone. For this purpose KPN needs to process additional data.

KPN requests the following information directly from you or via controlling parties:

a) Name and full address
b) Date of birth
c) Valid proof of identity (photo will be rendered unidentifiable and BSN [citizen service] number will be crossed
out)
d) Database of telecom payment default (via Preventel)
e) Fraud detection system (to check if there is any history of non-payment/fraud, etc.)
f) Bank account number (you have to make a one-off pin payment of €0.01, so we can check your financial
situation)
g) Register of insolvencies
h) Credit rating (by Experian)

To comply with statutory obligations in the supply of credit, as from May 1, 2017 KPN will process this customer data.

For credit under €250 the following data will be processed:
Before entering into a contract, we will process a shielded copy of your proof of identity. We also ask you to transfer €0.01, which will give us additional certainty.
During the term of the contract KPN will undertake periodic checks for the purposes of guaranteeing integrity. If a customer appears on a sanctions list, KPN will terminate the contract and de Nederlandsche Bank (DNB) will be notified accordingly.
In that case, the data which we forward to DNB is as follows:

• Personal data, place and date of birth

• The nature and amount of the sum payable on demand

• The action taken by KPN

• The number of the applicable sanctions regulation

In the case of credit between €250 and €1,000, the following data of yours will also be processed:

So that KPN can act responsibly in supplying credit, it makes use of:

a. Data concerning the total of registered credit advances in the Central Credit Registration System of the Central Credit Registration Office BKR (CKI)

b. Data concerning payment arrears in credit contracts in the CKI

c. The result of the Telecom Income and Expenses Test

BKR will inform KPN about the total amount of registered credit payments and limits you have. They also let us know whether any current payment arrears in credit contracts have been registered against your name. If KPN has supplied you with credit, this credit will be registered in the CKI. If you do not comply with your payment obligations, KPN will report this to BKR, pursuant to Article 12 section 1 (under a and b) of the BKR Regulations.

To carry out the Telecom Income and Expenses Test, KPN will ask you to provide the following information:

• Family composition

• Net monthly income

• Monthly household expenses

If you want to know more, read the Telecom Credit Code on https://www.kpn.com/gespreidbetalen.

3.2.3 Planning, management, our network security, spam filter/virus scan

KPN is responsible for the telecommunications network that carries the telephone traffic. We are responsible for maintaining, planning and improving the network and management, such as routing traffic, resolving faults and monitoring peak load and overload. The analysis of network use provides us with essential information concerning the use of and load on our network. This information enables us to expand and improve our network in a focused way. KPN processes your fixed and mobile data for this technical and statistical analysis. The results of the analysis will be reported in anonymized form within
KPN so that the data is no longer traceable to individuals. We concern ourselves with the quality of the services, not with the content of your communications.

KPN is responsible for securing our network and your connection to this network, by applying advanced techniques (such as firewalls, spam filters and virus scanners) to protect against security breaches, viruses, spam and malware.

Conforming with statutory requirements
In some circumstances KPN is required by law to provide your data to third parties. For example, we must provide your data to the competent authorities for any criminal investigation and – at your request – to other providers to block the numbers
you have called on your invoice.

3.2.4 Improving services, informing you of opportunities to use the products and services you have purchased, trend analyses

KPN processes your personal and usage data to improve our services and to inform you about opportunities to use the products and services you have purchased from us, unless of course you have made an objection to this. Your consumption data is also used for this purpose, but only if you have given your consent.

KPN uses statistical analyses to research trends in the market. We use the information obtained from these analyses in order to evaluate our products and services, as well as our processes, and to update them in line with new developments. We do not use these research results for marketing and sales activities focused specifically on you. For these, we use your personal and usage data, unless you have made an objection. Your consumption data can also be used for this purpose, but only if you have given your consent.

3.2.5 Marketing and sales activities, supply to third parties

KPN processes your personal and usage data for marketing and sales activities (even for a period of two years following termination of the contract) and for the benefit of KPN's own services, unless you have notified us that you object to this. We may also process your consumption data for our marketing and sales activities, but only if you have given your consent.

Your data is processed by KPN for the purposes of making offers and to inform you of the options for using the products or services you have purchased from us. If you are not yet a customer of KPN, we will be happy to inform you about the options offered by KPN. We will only do so if you have given your consent. We can share this information with you by letter,
telephone or digitally (e.g. via SMS or e-mail), unless you have notified us that you object to being approached by letter, SMS, e-mail or telephone. You can indicate this separately.

KPN will not supply your data to third parties for marketing, sales, or similar commercial activities. Insofar as data is supplied to third parties for activities like this, this is not for sales purposes, and will only happen in an anonymized and aggregated form.

If you are a customer of ING, KPN will share information with ING about sim card replacements that KPN undertakes on your behalf, in order to protect both you and ING against fraud. In supplying this data to ING, KPN will have regard to your privacy
by shielding as much privacy-sensitive data in the reports as possible.

No mobile information will be shared with third parties/affiliates for marketing/promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

3.2.6 Debt collection, Assignment of claims

For the purposes of enforcing payment of our invoices, we engage third parties such as debt collection agencies. If you are disconnected due to non-payment, we may assign our claims to such third parties. In such a case we share all data with such parties as they require in order to be able to enforce payment. The debt collection agency processes your personal data under its own responsibility.

3.2.7 Telephone directories and subscriber information services

KPN processes your contact details (name, full address and telephone number) for the purposes of issuing electronic and printed telephone directories and offering subscriber information services. We will do so only if you have indicated that your telephone number may be published in a telephone directory and/or be obtainable from a subscriber information service. In such a case, KPN is required by law to share your data with other publishers of telephone directories and subscriber information services within the European Union (EU). This means that this data is made 'public'.

You may choose an 'unlisted number', also referred to as a 'confidential number'. This means that the telephone number will not be published in a telephone directory and cannot be obtained from a subscriber information service. You can also choose not to include the number in a directory, but for it to be available from a subscriber information service. If you have an ‘unlisted number’ this does not mean that your data cannot be used for trend analyses and marketing and sales activities. If you do not wish for your data to be used for trend analyses and marketing and sales activities, then you must indicate this
separately. In the section headed “Contact”, you can read about the choices available to you and how you can notify us of those choices.

You can notify us again if you change your mind. For more information about where you can submit your requests for registration, change of registration, or deletion, also check ‘Contact’.

3.2.8 Caller ID

It is standard practice for KPN to show your number to the called party. If you do not wish for your telephone number to be visible to others, you can block your caller ID (on a one-off basis) per individual call. You can also block your caller ID permanently. You can find out how to do this under 'Contact'.

If you dial the emergency number 112 your telephone number will always be disclosed, even if you have blocked your caller ID. KPN is required to do so by law.

3.2.9 Itemization of invoices

For itemized invoices, the telephone number of the called party may be included in the invoice for the calling party, unless there is an agreement with the contract holder of the called party that its number will be shielded on the invoices of other customers. In line with statutory provisions, this shielding means that the last four digits of the number will not be readable. You can find out how to request this 'B-number block' under the section headed 'Contact'.

KPN collaborates with other telecommunications providers to also shield your number on their invoices. But unfortunately, we cannot guarantee that your blocked number will never appear on the invoices of other providers.

3.2.10 Nuisance calls

If someone disturbs you with nuisance calls, you can report this to us. You can request us in writing to supply the contact details of the party from whose number the nuisance or malicious calls are made. If you make nuisance calls to someone, that other party can report this to us and make the same request.

You can send such a request to the address stated under "Contact”. In this request you have to give the following data: a) your name, full address and postcode, b) the number to which the call has been made, c) a description of the nature and severity of the nuisance as a result of the annoying or malicious calls and d) an indication of the dates and times of the calls. If the identity of the caller is known to KPN, we notify the person in writing that you regard such calls as a nuisance and we urge them strongly to stop. Should this warning not help, then KPN will, as a last resort, give you the telephone number,
name and address of the caller. The caller whose information has been disclosed in this way will be notified of the fact.

3.2.11 Device insurance

KPN collaborates with Chubb to offer the Device Insurance service. For this purpose, KPN sends your customer data to Chubb, such as your name, address and contact information, KPN-ID and information about your subscription and device. KPN has agreed terms with Chubb to ensure that Chubb respects your privacy. You can read about how Chubb deals with your personal data in Chubb’s privacy statement at chubb.com.

If you file a claim with Chubb, KPN will receive such information about the claim as is necessary for invoicing purposes. If you receive a replacement device from Chubb, Chubb will send us the IMEI number of your new device. We need the IMEI number to be able to provide our telephony services. If you change, cancel, or have terminated your device insurance via Chubb, we will be notified of this by Chubb. We process this information so that your subscription data remains complete and to be able to accurately invoice you.

3.3 For how long do we keep your data?

KPN will not keep your data for longer than permitted by law and which is necessary for the purposes for which we use your data. The length of time that your data is kept depends on its nature and why it has been processed. Therefore the retention period may differ from one objective to another.

If you have a subscription with KPN, your personal data will in any event be kept for the duration of your subscription. We keep your non-itemized invoices for a maximum of seven years. We are required by law to keep your invoices this long for tax reasons. We keep your itemized invoices and your call data for invoicing purposes for a maximum period of six months. We keep consumption data that we process to ensure that you are contactable on your cell phone for a maximum period of two weeks for network purposes. Even if you do not communicate actively.

3.4 What do we do with your data when the retention period ends?

When the retention period ends, your personal data will be deleted or anonymized. By anonymizing your data, we ensure that all possible features that could identify you are removed. What is left is statistical data that cannot be linked to you personally in any way whatsoever. This statistical data is important for us, because it provides us with information about how our products and services are used.

4 Your rights (Inspection, Correction, Objection)

4.1 Inspecting your data

You have the right to inspect your personal data. This means you can request to see which of your personal data has been registered and for what purposes we use this data.

There are several ways of doing this. If you want information about the calls you have made or films and other on-demand items you have ordered, we refer you in the first instance to the “MijnKPN” dashboard on our websites (under “your data”) and to the MijnKPN app. Here you will find not only your personal data, but also your itemized invoice.

On certain matters we give you the option of indicating whether you wish for your data to be processed, for example for carrying out analyses or to be contacted for commercial purposes such as offers. You can find a clear summary of the choices you have indicated to us on the MijnKPN’ dashboard on our websites (under ‘your data’) and on the MijnKPN app. You can see here not only what choices we have registered but we also enable you to easily change those choices at any time.

If you cannot find the information you are looking for via our websites or on our app, you can send us a letter with a request for inspection. Include your name, address, fixed and/or mobile telephone number and a shielded copy (without passport photo and BSN number) of a valid identity document. You can send the letter to the address indicated below under the heading “Contact”. We will reply to you within four weeks.

4.2 Correcting your data

You have the right to alter your personal data if they are not correct. For this, contact us as stated under 'Contact'. We will give you a written reply within four weeks.

4.3 Right to object, permission to process your data

4.3.1 Objection to KPN processing your personal data

You can object to the processing of your personal data by KPN for purposes other than those necessary to perform a contract or to comply with any legal obligation. So, for example, you can object to the use of your personal data for analysis, marketing and sales activities. You can do this via the “MijnKPN” dashboard on our websites (under the heading “your data”) or on the MijnKPN app. You can vary your choice at any time.

For this, contact us as stated under 'Contact'

4.3.2 Consent to process your call and location data and data concerning viewing pattern

Some data is used only if you have given your consent. This involves privacy sensitive data that is not necessary for the performance of a contract or to comply with any legal obligation. This includes using your call data to offer you a subscription
that best suits your needs or for processing data about your viewing pattern to provide you with personal viewing advice. In such cases we will always seek your consent in advance before we use your data for such purposes. If you not wish your data
be used for these purposes, do not give us your consent. This does not influence the use of our services.

If you previously gave your consent for us to process your sensitive data for the purposes mentioned above, you can withdraw that consent at any time. You can do this via the “MijnKPN” dashboard on our websites (under the heading “your data”) or on the MijnKPN app. You can alter your choice at any time.

You can also contact us for this, as stated under 'Contact'.

4.3.3 Objection to your data being shared within KPN

If you not want KPN to share your data with other KPN brands or divisions or do not want your data to be combined so we can check whether your address is eligible for KPN Compleet, you can object to this. You can do so via the MijnKPN dashboard on our websites (under the heading “your data”) or on the MijnKPN app. You can alter your choice at any time.

Here too, you can contact us as stated under 'Contact'. You should indicate clearly in the letter what uses of your data you object to. Do you only object to your data being shared? Or do you object to use of your data by KPN, or both? We will give you a written reply within four weeks after sending us this objection.

4.3.4 Objection to being approached

You can object to being approached by KPN or you can withdraw your consent for purposes other than those necessary to perform a contract or to comply with any legal obligation. So, for example, you can object to being approached for sales
activities.

You can object to any of the following forms of approach individually:
- approach in writing
- approach via SMS/e-mail
- telemarketing
- approach via TV

You can do this via the “MijnKPN” dashboard on our websites (under the heading “your data”) or on the MijnKPN app. You.can also unsubscribe by following the instructions in the mails that we send you or by indicating at the end of a telephone call
that you no longer wish to be called by KPN. You can vary your choice at any time. Would you prefer to contact us? You will find how to do so under the section headed 'Contact'.

KPN will process your objection as soon as possible. However, it may take some time before your objection has been processed into all files. During this time you may still be approached.

4.4 Right to be forgotten

In some situations you have the right to have your personal data erased. You have; for example, previously given yourexpress consent to KPN for the use of your data, but you now withdraw that consent. KPN will then erase your data. KPN cannot always honor a request for erasure of your data. Sometimes we are under a statutory or other obligation to store your data, for example, if the personal data is still needed for the purposes for which it was obtained.

4.5 Right to data portability

You have the right to receive your personal data held by KPN. In this way you can easily forward it to another supplier of the same kind of service. You can also request KPN to forward this data directly to another organization.

5 Contact

Right to inspection, correction, erasure and data portability
KPN Customer Reactions (quoting “GDPR Rights")
Postbus 58800
1040 JA Amsterdam
(Netherlands)

rechtenavg@kpn.com

For verification purposes, please add your name, address, fixed and/ mobile phone
number, and a shielded copy of your proof of identity to your request.

Objection to the use of your data for analyses, marketing www.kpn.com/uwgegevens

Objection to being approached in writing

KPN (quoting 'GDPR')
Postbus 2547 3500 GM
Utrecht
www.kpn.com/uwgegevens

Objection to being approached by email/SMS

If you are a business customer, SMS “STOP” to 1683
Call 0800-0402 for fixed telephony
Call 0800-0105 for mobile telephony
www.kpn.com/uwgegevens

Objection to being approached by telephone

Call 0800-0402 for fixed telephony
Call 0800-0105 for mobile telephony
www.kpn.com/uwgegevens

Correcting a BKR registration

KPN Risk Control
Postbus 13500
9700 EG Groningen

Deletion of data from telephone directory/subscriber information file

Call 0800-0402

Go to your Mijn KPN account on our website and select ‘Thuis bellen’

Blocking Caller ID Permanent blocking

Call 0800-0402 for fixed telephony
Call 0800-0105 for mobile telephony
Blocking per call: key in *31* before dialing the required number

Reporting nuisance phone calls

Call 0800-0402

Request for previous version of Privacy Statement
KPN Customer Reactions (stipulating “request for previous privacy statement”)

Postbus 58800
1040 JA Amsterdam
(Netherlands)

Data Protection Officer Mr J. Jongenelen
Email to: privacyofficer@kpn.nl