Privacy and Cookie Notice

This privacy and cookie notice (the “Privacy and Cookie Notice”) applies only to personal data that everplay group plc (“everplay” “we,” “us” and “our”) collects and processes through this website (www.everplaygroupplc.com). everplay respects the privacy rights of users of this website, is committed to protecting the information collected through this website and is the controller responsible for personal data processed under this Privacy and Cookie Notice.

everplay is the parent of a wider group of companies. Each group company is a separate legal entity and an independent controller for any personal data it collects through its own websites, products, services, recruitment activities, or direct interactions with you, and this Privacy and Cookie Notice does not cover that processing. When you visit a group company's website or otherwise deal with that company, please read its privacy policy or notice.

Unless defined herein or the context requires otherwise, terms used in this Privacy and Cookie Notice have the meanings given to them in the General Data Protection Regulation (GDPR) (EU) 2016/679, including the UK GDPR and the Data Protection Act 2018.

Please read this Privacy and Cookie Notice carefully in full. We may change this Privacy and Cookie Notice from time to time in order to reflect any changes in data protection laws or our internal policies. If we make material changes, we will provide you with additional notice. We encourage you to review this Privacy and Cookie Notice regularly to stay informed about our data protection practices.

WHO THIS PRIVACY AND COOKIE NOTICE APPLIES TO?

This Privacy and Cookie Notice applies to you when you access, browse and use our website or interact with us by email and by other means.

For the avoidance of doubt, this Privacy and Cookie Notice does not apply to websites or services operated by third parties (whether or not as those websites or services promote everplay’s products and services or sell related items).

TYPES OF PERSONAL DATA WE PROCESS

“Personal data” means information about an individual from which that person can be identified. It does not include information where an individual’s identity has been removed (anonymous data). Throughout this Privacy and Cookie Notice we use the term “processing” to refer to all activities involving your personal data, including collecting, handling, storing, sharing, accessing, using, transferring, erasing and disposing of it.

We may receive your personal data through various means including:

Direct interactions: As a user of our website, you may provide us with your Identity and Contact Data by email or otherwise. This includes personal data you provide when you give us feedback or contact us.

Automated technologies or interactions: As you interact with our website, we collect Technical Data and Usage Data. We collect this by using cookies and other similar technologies. We may also receive Technical Data if you visit other websites using our cookies.

The personal data we receive about you depends on how you interact with us while using our website. Typically, we process the following kinds of personal data when you use our website:

• Identity and Contact Data includes your name, email address and any personal data provided when contacting us.
• CVs and job applications if you apply for a role through our website. We will only use the information you submit to consider your job application and to administer the recruitment process. Recruitment is governed by a separate privacy notice, which we provide to you at the point of application and which prevails over this Privacy and Cookie Notice in respect of recruitment-related processing.
• Technical Data may include internet protocol (IP) address, browser type and version, time zone setting and location, country and language, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access our website.
• Usage Data includes information about how you use our website such as the services you view or search for, page response times, download errors, length of visits and page interaction information (such as scrolling, clicks and mouse-overs), traffic data, web logs and other communication data and the resources that you access.

We also collect, use and share aggregated data such as statistical or demographic data for various purposes. Aggregated data may be derived from your personal data but is not considered personal data in law as this data does not directly or indirectly reveal your identity. For example, we may aggregate your usage data to calculate the percentage of users accessing our website. However, if we combine or connect aggregated data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this Privacy and Cookie Notice.

We do not collect any special categories of personal data about you (this is personal data that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership; genetic data; biometric data for the purpose of uniquely identifying an individual or data concerning health or sexual orientation).

COOKIES AND SIMILAR TRACKING TECHNOLOGIES

This website uses cookies. We use cookies to personalise content, to provide social media features and to analyse our traffic. In this Privacy and Cookie Notice we use the term “cookies” to refer to cookies and other similar technologies (such as pixels, beacons and Local Storage Objects (LSOs) like HTML5) covered by the Privacy and Electronic Communications (EC Directive) Regulations 2003.

What are cookies?

A cookie is a small text file which is placed onto your device (e.g. computer, smartphone or another electronic device) when you use our website. Cookies are widely used to make websites work, or work more efficiently, as well as to provide information to the owners of the site.

• First party cookies are cookies set by the website you’re visiting. Only that website can read them. In addition, a website might potentially use external services, which also set their own cookies, known as third-party cookies.
• Persistent cookies are cookies saved on your computer and that are not deleted automatically when you quit your browser, unlike a session cookie, which is deleted when you quit your browser. They will remain on your device for a pre-defined period of time or until they are deleted.

How do we use cookies?

We use cookies on our website as they help to distinguish you from other users. This helps us to provide you with a good experience when you browse our website and also allows us to improve our website. Some of the information will be aggregated or statistical, which means that we will not be able to identify you individually.

What type of cookies we use?

Necessary Cookies. These cookies are strictly necessary for our website to function and cannot be switched off. You can set your browser to block or alert you about these cookies, but some parts of our website will not work as a result.

Name	Domain	Provider	Purpose	Duration	Type
_cfuvid	everplaygroupplc.com	Cloudflare	Set by Cloudflare to support rate-limiting and Web Application Firewall (WAF) rules. It is a session-only cookie and is not used for cross-session tracking, profiling, or marketing.	Session	HTTP Cookie
__cf_bm	everplaygroupplc.com	Cloudflare	Supports Cloudflare Bot Management to distinguish humans from bots.	1 day	HTTP Cookie
__cf_bm [x11]	hubspot.com hs-analytics.net hsappstatic.net hs-banner.com hscollectedforms.net hsforms.com hs-scripts.com hubspotusercontent.com hubspotusercontent-eu1.net hubspotvideo.com	Cloudflare	Supports Cloudflare Bot Management on HubSpot-served resources.	1 day	HTTP Cookie
_cfuvid	hubspot.com	Cloudflare	Tracks users across sessions on HubSpot-served resources to maintain session consistency.	Session	HTTP Cookie
AWSALB [x2]	polaris.brighterir.com sirius.brighterir.com	Amazon Web Services	Application Load Balancer cookie used to map a session to a back-end target for performance and routing.	7 days	HTTP Cookie
AWSALBCORS [x2]	polaris.brighterir.com sirius.brighterir.com	Amazon Web Services	Application Load Balancer cookie used to maintain session-to-target mapping for cross-origin requests.	7 days	HTTP Cookie
CookieConsent	everplaygroupplc.com	Everplay Group	Stores the user's cookie consent state for the current domain	1 year	HTTP Cookie
XSRF-TOKEN [x2]	polaris.brighterir.com sirius.brighterir.com	Brighter IR (Laravel)	Prevents cross-site request forgery by binding form submissions to the user’s session.	5 days	HTTP Cookie
laravel_session [x2]	polaris.brighterir.com sirius.brighterir.com	Brighter IR (Laravel)	Identifies the user’s session instance on the investor-relations platform.	5 days	HTTP Cookie
cookietest	everplaygroupplc.com	Everplay Group	Determines whether the user’s browser accepts cookies; required for site functionality.	Session	HTTP Cookie

Analytical Cookies. These analytical cookies are used to understand how visitors interact with the website. These cookies help provide information on metrics including the number of visitors, bounce rate and traffic source.

Name	Domain	Provider	Purpose	Duration	Type
__hstc	everplaygroupplc.com	HubSpot	Main HubSpot tracking cookie. Stores domain, first visit, last visit, current visit and session count.	180 days	HTTP Cookie
hubspotutk	everplaygroupplc.com	HubSpot	Identifies a unique visitor; passed to HubSpot on form submission and used to deduplicate contacts.	180 days	HTTP Cookie
__hssrc	everplaygroupplc.com	HubSpot	Indicates whether the visitor has restarted their browser; used to detect new sessions.	Session	HTTP Cookie
__hssc	everplaygroupplc.com	HubSpot	Session counter. Stores domain, view count and session start timestamp; controls increment of __hstc.	1 hour	HTTP Cookie
hs-cta-interactions#cta	.everplaygroupplc.com	HubSpot	Collects statistics on the visitor's visits to the website, such as the number of visits, average time spent on the website and what pages have been read.	Persistent	IndexedDB

Performance Cookies. These cookies allow us to understand and analyse the key performance indexes of the website which helps in delivering a better user experience for our visitors.

Name	Domain	Provider	Purpose	Duration	Type
hubspot-modern-theme	static.hsappstatic.net	HubSpot	Used by the websites hosting framework to manage or apply themes and layouts across pages.	Persistent	HTML

Marketing Cookies. These cookies allow us to track visitors across the website.

Name	Domain	Provider	Purpose	Duration	Type
__ptq.gif	everplaygroupplc.com	hubspot.com	Sends data to the marketing platform Hubspot about the visitor's device and behaviour. Tracks the visitor across devices and marketing channels.	Session	Pixel
HUBLYTICS_EVENTS_53	everplaygroupplc.com	static.hsappstatic.net	Collects data on visitor behaviour from multiple websites, in order to present more relevant advertisements. This also allows the website to limit the number of times that visitors are shown the same advertisement.	Session	HTML

Control your cookie settings

The first time you visit this website, you will be displayed with a banner providing you with information about cookies and linking to this Privacy and Cookie Notice, informing you about consent to the placing of cookies on your device.

Unless you have adjusted your browser settings so that it will refuse cookies, our systems will issue cookies each time you access the website. In the cookie preference banner you can manage your preferences to allow or refuse the storing of cookies per category. Please note that if you disable certain categories of cookies you may be unable to access certain parts of the website or use certain functionality.

You can delete all cookies that are already on your device by clearing the browsing history of your browser. This will remove all cookies from all websites you have visited. Be aware though that you may also lose some saved information (e.g. saved login details, site preferences).

For more information on the legislation regarding cookies, please see the Information Commissioner’s Office (ICO) website - https://ico.org.uk/for-the-public/online/cookies.

If you would like to find out more about cookies and other similar technologies in general, please visit http://www.allaboutcookies.org.

HOW WE USE YOUR DATA?

The table below identifies, for each activity that we carry out with your personal data, the categories of data involved and the lawful basis on which we rely under the UK GDPR. A "lawful basis" is the legal ground that permits us to use your personal data.

Purpose / activity	Type of data	Legal basis for processing
Running and delivering the website to you	Technical Data; Usage Data	Our legitimate interests (Art. 6(1)(f)) in operating and maintaining the website.
Replying to enquiries you send us by email or post	Identity and Contact Data; the content of your message	Our legitimate interests (Art. 6(1)(f)) in answering enquiries about our business. Where your enquiry relates to a contract, we also rely on Art. 6(1)(b) (steps taken at your request before entering a contract).
Directing job applicants to the right group company’s recruitment process (our Careers page links to vacancies at our subsidiaries)	Identity and Contact Data; any CV or application information you choose to submit	The recruitment process itself is run by the relevant group company under its own recruitment privacy notice, which is provided to you at the point of application and which prevails over this Privacy and Cookie Notice in relation to recruitment.
Understanding how visitors use the website so we can improve it	Technical Data; Usage Data; pseudonymous identifiers set by analytics cookies	Your consent (Art. 6(1)(a) UK GDPR and Reg. 6 PECR), captured through our cookie banner. You can withdraw your consent at any time.
Keeping the website and our systems secure	Technical Data; security cookies set by Cloudflare and Amazon Web Services	Our legitimate interests (Art. 6(1)(f)) in the security and integrity of the website.

WITH WHOM DOES EVERPLAY SHARE MY INFORMATION?

We may need to disclose your personal data to the parties set out below, in connection with the activities described in the table above. We share personal data only where it is necessary to do so, and only with parties who are required to keep it confidential and to use it solely for the purposes for which we share it.

Service providers: Third parties who provide products or services to us - including professional advisers, IT and infrastructure suppliers, hosting and content delivery providers, recruitment partners, and other service providers acting under contract with us.

Group companies: Other companies in the everplay group, where this is necessary for internal administrative purposes (for example, to direct an enquiry or job application to the right company). Each group company remains a separate controller for its own processing under its own privacy notice.

Public authorities and law-enforcement bodies: Regulators and other authorities with jurisdiction over us - including the Information Commissioner's Office, the Financial Conduct Authority, HM Revenue & Customs, and, where applicable, courts and law-enforcement agencies. We will disclose personal data to these bodies where we are required to do so by law, where we are ordered to do so by a court of competent jurisdiction, or to comply with any other agreement we have with you, or to protect the rights, property or safety of our staff, our users or others.

Counterparties to corporate activity: If we acquire or merge with another business, restructure, sell all or part of our business, or carry out a similar corporate transaction, we may need to disclose your personal data to the counterparty and to its professional and other advisers in the course of the transaction. Any such disclosure will be made on a confidential basis and only to the extent necessary for the purposes of the transaction.

We do not sell your personal data, and we do not share it for the purposes of cross-context behavioural advertising.

INTERNATIONAL DATA TRANSFERS

There are circumstances in which we, or our service providers, may need to process your personal data outside the United Kingdom. Where we transfer personal data outside the United Kingdom, we ensure that appropriate safeguards are in place to give your data a level of protection essentially equivalent to that provided under the UK GDPR. In practice, we rely on one of the following mechanisms:

• a UK adequacy regulation, where the UK Government has formally recognised that the destination country provides an adequate level of protection for personal data;
  
• the UK Extension to the EU–US Data Privacy Framework, where the recipient is certified under it; or
• the International Data Transfer Agreement issued by the Information Commissioner's Office, or the European Commission's Standard Contractual Clauses together with the UK International Data Transfer Addendum, supplemented by additional technical and organisational measures where a transfer-impact assessment indicates these are necessary.

For further information, including details of the specific legal mechanism we use for a particular transfer, or to request a copy of the relevant safeguard, please contact us at: dataprotection@everplaygroupplc.com.

SECURITY

We take the security of your personal data seriously. We have technical and organisational measures in place that are designed to prevent your personal data from being lost, misused, altered, or accessed by anyone who has no proper reason to do so. These measures include encryption of data in transit, access controls, firewall-protected systems, secure hosting environments, and supplier due-diligence on the third parties we work with. We follow generally accepted industry standards and review our safeguards regularly to make sure they remain appropriate to the data we hold.

Access to your personal data within everplay is limited to those people who have a genuine business need to process it. Anyone who handles your personal data on our behalf - whether one of our employees or a service provider - does so under our instructions and is subject to obligations of confidentiality and to security obligations equivalent to those imposed on us by Article 32 of the UK GDPR.

If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office without undue delay, and we will inform affected individuals as soon as reasonably practicable.

DATA RETENTION

We keep your personal data only for as long as we need it for the purposes described in this Privacy and Cookie Notice. There is no single retention period that applies to all the personal data we hold - how long we keep your data depends on what it is, why we collected it, and whether the law requires us to retain it for a particular period.

In setting our retention periods, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process the data and whether we can achieve those purposes through other means, the need to be able to deal with any complaint, dispute or legal claim that may arise, and any applicable legal or regulatory requirements.

In broad terms, that means:

Server log files are retained for a short period sufficient to ensure the security and proper operation of the website and may be kept for longer where a specific event (for example, a security incident) requires further investigation.

Email or postal enquiries are retained for as long as is reasonably necessary to deal with your enquiry. Where the enquiry concerns or develops into a contractual or commercial relationship, we may retain the correspondence for the period required by applicable accounting and tax law.

Job applications received through our website are passed to the relevant group company that runs the recruitment process; that company is responsible for retaining your application data in accordance with its own recruitment privacy notice.

Cookies and similar technologies are retained for the durations set out in the ‘Cookies and similar tracking technologies’ section of this Privacy and Cookie Notice.

Records of consent and cookie preferences are retained for as long as is necessary to evidence your consent.

Records that we are required to keep to meet legal, regulatory or accounting obligations, or to deal with complaints, disputes or legal claims are retained for the period required by the relevant law or, where there is no fixed period, for as long as is reasonably necessary in light of any limitation period that may apply.

YOUR RIGHTS AS A DATA SUBJECT

Under the UK GDPR and the Data Protection Act 2018, you have a number of rights in relation to the personal data we hold about you. In summary, you have:

The right of access - ask us for a copy of your data. You can ask us to confirm whether we are processing personal data about you and, if we are, to give you a copy of that data along with information about how we use it.

The right to rectification - ask us to correct your data. If any of the personal data we hold about you is wrong or incomplete, you can ask us to correct it.

The right to erasure - ask us to delete your data. Sometimes called the "right to be forgotten". You can ask us to delete or remove your personal data where there is no good reason for us to keep using it; where you have successfully objected to our processing; where the processing was unlawful; or where we are required to delete the data to comply with the law. We are not always able to act on a request for deletion - for example, where we need to keep the data to comply with a legal obligation, to defend a legal claim, or to protect the rights of others. If we cannot comply with your request, we will tell you why.

The right to restrict processing - ask us to limit how we use your data. You can ask us to suspend our use of your personal data in certain circumstances, including: where you want us to check whether the data is accurate; where you consider our use of the data to be unlawful but do not want us to delete it; where you need us to keep the data so that you can establish, exercise or defend a legal claim, even though we no longer need it ourselves; or where you have objected to our use of the data and we are checking whether we have valid grounds to continue.

The right to data portability - ask us to transfer your data. Where we use your personal data on the basis of your consent or in the performance of a contract with you, and where the processing is automated, you can ask us to provide that data to you (or to a third party you nominate) in a structured, commonly used and machine-readable format.

The right to object - object to how we use your data. You can object to our use of your personal data where we rely on our legitimate interests as the reason for using it, on grounds relating to your situation. You also have an absolute right to object at any time to your data being used for direct marketing. If you object on legitimate-interest grounds, we will stop using your data unless we can demonstrate compelling reasons that override your interests, rights and freedoms, or that we need to continue using it to establish, exercise or defend a legal claim.

The right to withdraw consent. Where we rely on your consent for a particular use of your personal data, you can withdraw that consent at any time. Doing so will not affect the lawfulness of anything we did with your data before you withdrew consent, and it will not affect any other reason we may have for using it.

The right not to be subject to automated decision-making. You have the right not to be subject to decisions that have a legal or similarly significant effect on you and that are made solely by automated means. We do not use your personal data to make decisions about you solely by automated means, including profiling, where those decisions would have a legal or similarly significant effect on you.

Exercising your rights

To exercise any of your rights, please contact us at: dataprotection@everplaygroupplc.com or write to us at 3 Red Hall Avenue, Paragon Business Park, Wakefield, West Yorkshire, WF1 2UL.

We may need to ask you for some additional information to confirm your identity before we act on your request - this is to protect you against unauthorised disclosure of your personal data. We will respond to you within one calendar month. If your request is particularly complex, or if you have made several requests, we may extend this period by a further two months, in which case we will inform you within the first month.

If you are not satisfied with how we have handled your personal data or your request, you have the right to complain to the Information Commissioner's Office, the UK supervisory authority for data protection, at ico.org.uk. We would, however, appreciate the chance to address your concerns first, so please do contact us before approaching the ICO.

LINKS TO OTHER WEBSITES

Our website contains links to third-party websites - for example, the websites of our group companies, the websites of our service providers, and other online resources we think may be of interest to you. Where you follow such a link, you will leave our website and visit a site that we do not operate or control. Each third-party site is responsible for its own content and for its own handling of personal data, which will be governed by that site's privacy notice and not by ours. We encourage you to read the privacy notice of any site before you submit any personal data to it.

Some third-party services (including the third-party cookies described in the ‘Cookies and similar tracking technologies’ section of this Privacy and Cookie Notice) may collect or receive information about you when you interact with content embedded on our website or follow a link from it. Please refer to the ‘Cookies and similar tracking technologies section’ for further detail on the third-party technologies and how you can control them.

If you encounter anything that looks suspicious - for example, a link that appears to have been tampered with, content that purports to come from us but does not, or any other activity connected to our website that gives you cause for concern - please tell us as soon as possible.

 12 June 2026