Privacy Policy

American Racing Challenger Team USA, LLC

Effective Date: November 4, 2026

Last Updated: November 4, 2026

American Racing Challenger Team USA, LLC ("ARC") respects the privacy of individuals who interact with ARC and its programs, activities, and initiatives.

This Privacy Policy explains how we collect, use, disclose, store, and otherwise process personal information in connection with ARC's operations and activities, including:

• ARC Club: Membership applications, subscriptions, payments, membership benefits, hospitality, events, and member communications.
• Games, Contests and Prize Promotions: Entries, drawings, competitions, giveaways, sweepstakes, and other promotional activities, including drawings in which participants may win sailing equipment, apparel, Code Zero gear, or other prizes.
• Team Activities and Events: Sailing activities, hospitality, team events, fundraising initiatives, and other activities involving ARC, its team, or its representatives.
• Websites and Digital Activities: ARC websites, online forms, registration platforms, email communications, social media activities, and other digital interactions.
• Sponsors and Commercial Partnerships: Activities involving ARC sponsors, commercial partners, suppliers, and other organizations associated with ARC and its programs.

ARC activities may take place in the United States, including Florida, and in Italy, including Naples, as well as other locations.

This Privacy Policy is intended to address applicable privacy and data protection laws, including, where applicable, the European Union General Data Protection Regulation (Regulation (EU) 2016/679, the "GDPR"), applicable Italian data protection laws, and applicable United States privacy laws.

This Privacy Policy applies to members, prospective members, event attendees, participants in games and promotional activities, guests, website users, and other individuals who provide personal information to ARC or whose personal information is otherwise collected in connection with ARC activities.

This Policy also applies to customers and prospective customers using ARC's online shop, including individuals who browse products, create accounts, place orders, make payments, request customer support, or seek returns or refunds.

Certain activities, including individual games, contests, prize promotions, or events, may be subject to additional terms, conditions, official rules, or privacy notices. Those additional terms will supplement this Privacy Policy and will be made available where appropriate.

The entity responsible for determining the purposes and means of processing personal information (the "Controller" under the GDPR) is:

Legal Entity: American Racing Challenger Team USA, LLC.

Address: 125 High Street, Suite 1704, Boston, MA 02110, USA

Email: info@teamarcusa.com

References in this Privacy Policy to ARC mean the above entity and, where appropriate, individuals authorized to administer ARC's activities on its behalf.

Where required by applicable law, ARC will identify any additional or joint controllers, appoint an EU representative, or provide the contact details of a Data Protection Officer.

The categories of personal information we collect may include:

a. Identification and Contact Information. Name, mailing address, email address, telephone number, country of residence, and other contact details.

b. Membership Information. Membership category, subscription status, membership history, benefits selected, preferences, and records of participation in ARC Club activities.

c. Payment and Transaction Information. Subscription amounts, billing information, payment history, transaction records, and related information. Payment card details may be processed by third-party payment providers. We do not intend to retain complete payment card details where those details can be handled securely by the relevant provider.

d. Event, Hospitality and Activity Information. Event registrations, guest details, attendance records, hospitality arrangements, sailing opportunities, dietary requirements, accessibility requests, and other information reasonably necessary to organize or deliver a particular activity.

e. Game, Contest and Prize Promotion Information. If you participate in an ARC game, contest, drawing, sweepstakes, giveaway, or other promotional activity, we may collect:

• Your name and contact information;
• Your email address, telephone number, and mailing or delivery address;
• Information submitted through an entry or registration form;
• Information necessary to determine eligibility, verify an entry, and administer the promotion;
• Records of entries, drawing results, winner selection, and prize acceptance;
• Information necessary to notify winners and arrange prize delivery;
• Information required for tax, regulatory, or other legal reporting obligations, where applicable; and
• Other information reasonably necessary to administer the relevant promotion.

f. Communications and Preferences. Correspondence, inquiries, feedback, communication preferences, and preferences relating to membership benefits, events, and ARC activities.

g. Website and Technical Information. Where applicable, IP address, device and browser information, website usage data, and information collected through cookies or similar technologies.

h. Information Provided by Others. We may receive information about you from an authorized representative, a guest or host, ARC personnel, an event organizer, a sponsor, or a service provider where reasonably necessary to administer an ARC activity or deliver a benefit.

i. Shop and Customer Information. If you use the ARC online shop, we may collect products viewed or purchased, cart and order details, account credentials or account identifiers, billing and shipping details, delivery instructions, returns, refunds, customer-service correspondence, and transaction or fraud-prevention information. Payment-card details are generally collected and processed by the payment provider; ARC should not receive or retain full card numbers or security codes unless expressly necessary and lawfully secured.

We will seek to collect only personal information reasonably necessary for the purposes described in this Privacy Policy.

j. Marketing, Consent and Preference Records. We may collect whether you have subscribed to or unsubscribed from ARC communications, the date, time, source, form and wording/version of a consent or preference, email delivery and engagement information made available by our email service provider, and records needed to honor suppression and opt-out requests. We may also collect cookie choices and consent records.

We do not intend to collect special categories of personal data under the GDPR, such as health information, unless necessary for a specific purpose, such as accommodating an accessibility request or safely administering an activity. Where special category data is processed, we will identify and satisfy an applicable legal condition under Article 9 of the GDPR, where required.

We may collect personal information:

• Directly from you when you apply for membership, subscribe, make a payment, enter a game or promotion, register for an event, or communicate with us.
• From an authorized representative or another individual who provides information on your behalf.
• From ARC Team USA and its authorized personnel, where relevant to administering ARC activities.
• From service providers, event organizers, hospitality providers, sponsors, and other organizations involved in delivering ARC activities.
• Automatically through our websites or digital services, where applicable.
• From other sources where permitted by applicable law.

This may include information collected through the ARC website, online shop, Mailchimp-hosted landing pages and forms, email links, pixels, cookies, analytics tools, advertising platforms and embedded third-party content, depending on the services and settings ARC actually uses.

For example, we may receive order and payment status from the shop platform or payment processor, delivery status from shipping providers, and email subscription, delivery, bounce, unsubscribe or engagement records from Mailchimp.

Where we obtain personal data from a source other than you and the GDPR requires it, we will provide the information required by Article 14 of the GDPR, subject to applicable exceptions.

We use personal information only where we have an appropriate legal basis and for specified, explicit, and legitimate purposes.

Depending on the circumstances, our legal bases under Article 6 of the GDPR may include:

a. Performance of a Contract. Processing necessary to establish and administer memberships, process subscriptions, provide membership benefits, coordinate event participation, and perform our obligations under applicable membership or activity terms.

b. Administration of Games and Promotions. Processing necessary to receive and administer entries, verify eligibility, conduct random drawings or other winner selection procedures, notify winners, verify prize claims, arrange prize delivery, and comply with the applicable official rules.

c. Legitimate Interests. Processing necessary for our legitimate interests, where those interests are not overridden by your rights and freedoms. These interests may include managing and improving ARC's programs, coordinating with ARC Team USA, maintaining appropriate business records, protecting our systems and property, preventing fraud, handling disputes, and communicating relevant program information.

d. Legal Obligations. Processing necessary to comply with applicable legal, tax, accounting, regulatory, promotional, or other legal obligations.

e. Consent. Processing based on your consent, where consent is the appropriate legal basis, including certain optional marketing activities, non-essential cookies, promotional photography where required, or disclosures to sponsors for their independent marketing purposes where consent is required.

For marketing by email, ARC will identify the applicable legal basis and comply with the electronic marketing laws that apply to the recipient. Where consent is required, consent will be separate, specific, informed, unambiguous and freely given. A person may enter a promotion without consenting to unrelated marketing where the promotion's entry method and applicable law permit that arrangement. ARC will not treat entry information, a pre-ticked box, silence, or acceptance of these terms alone as consent to marketing.

f. Other Permitted Bases. Where applicable, processing may be necessary to protect vital interests or for another lawful basis recognized by applicable law.

We will determine the appropriate legal basis for each processing activity. Where we rely on legitimate interests, we will consider the interests and fundamental rights of the individuals concerned.

We may use personal information for the following purposes:

• Establishing, administering, renewing, and managing memberships.
• Processing subscriptions and maintaining financial and transaction records.
• Communicating about membership status, benefits, events, hospitality, sailing opportunities, and team activities.
• Receiving and administering entries in games, drawings, contests, sweepstakes, and other promotional activities.
• Verifying participant eligibility and compliance with applicable official rules.
• Conducting random drawings or other winner selection procedures.
• Notifying winners, verifying prize claims, and arranging prize delivery.
• Maintaining records of promotional activities and complying with applicable reporting requirements.
• Organizing and delivering membership benefits, events, and other experiences.
• Coordinating with ARC Team USA and relevant personnel.
• Providing customer service and responding to inquiries.
• Sending relevant program news, fundraising information, and promotional communications where permitted by law.
• Maintaining security, preventing fraud, enforcing applicable terms, and managing legal claims.
• Complying with applicable legal obligations.
• Other purposes disclosed when information is collected and permitted by applicable law.

Sending marketing emails only where permitted by applicable law and in accordance with the recipient's preferences and any required consent. Administrative messages about an entry, drawing, winner notification, order, payment, delivery, membership or event are distinct from marketing messages.

If we intend to process personal information for a materially different purpose, we will provide any required additional information and obtain consent where required.

ARC will not make subscription to marketing communications a condition of entering a prize promotion unless the specific entry mechanic has been reviewed and approved for the relevant jurisdictions. Where a promotion offers a separate no-marketing method of entry, entries received by each permitted method will have an equal chance of winning, subject to the Official Rules.

We may disclose personal information to the following categories of recipients, to the extent reasonably necessary for the purposes described in this Privacy Policy.

a. ARC Team USA and Authorized Personnel. We may share relevant information with ARC Team USA and its authorized representatives and personnel involved in administering ARC activities or delivering membership benefits.

b. Service Providers. We may disclose information to providers supporting membership management, payment processing, website hosting, communications, information technology, event registration, hospitality, promotional administration, and related services. Where required by applicable law, we will enter into appropriate data processing agreements and impose relevant confidentiality, security, and data protection obligations.

These providers may include: (i) Mailchimp, operated by The Rocket Science Group LLC, for email marketing, mailing-list management, signup forms and landing pages, and related campaign reporting; (ii) the provider hosting and maintaining ARC's website; (iii) the platform operating the online shop; (iv) payment processors; (v) cookie-consent, analytics and advertising technology providers; and (vi) shipping, customer-support and IT providers. The particular providers depend on the services ARC has configured. Providers processing personal information on ARC's behalf are authorized to use it only to provide services to ARC and in accordance with applicable contractual and legal restrictions. Some providers may separately process limited information as independent controllers for their own security, legal or service purposes, as described in their privacy notices.

c. Event, Activity and Promotion Partners. We may disclose relevant information to venues, event organizers, hospitality providers, sailing activity organizers, promotion administrators, prize fulfillment providers, and other participating organizations where necessary to arrange or deliver a particular activity or benefit.

d. Sponsors and Commercial Partners. ARC may have sponsors and commercial partners associated with ARC Team USA and its activities. ARC does not routinely disclose identifiable entrant, member, customer or newsletter-subscriber information to sponsors for their own independent marketing purposes. If ARC proposes to make such a disclosure, it will provide a separate notice and obtain consent or identify another lawful basis where permitted by applicable law, and will provide any required opt-out or objection rights.

If ARC decides to disclose identifiable personal information to sponsors or commercial partners for their own marketing, promotional, or other independent purposes, ARC will first assess the applicable legal requirements. Where consent is required, we will obtain it before making the disclosure. Where another legal basis is relied upon, we will provide the required transparency, respect applicable rights and objections, and ensure the processing is otherwise lawful.

We will not treat membership, event registration, or participation in a game or drawing alone as blanket consent to independent sponsor marketing.

e. Game and Prize Promotion Administration. In connection with a particular game, drawing, contest, or prize promotion, we may disclose relevant information to independent promotion administrators, prize suppliers, manufacturers, delivery providers, verification agents, and other organizations involved in administering the promotion or providing the prize.

Where a sponsor or prize supplier is involved, we will limit disclosure to information reasonably necessary for the relevant purpose, unless a separate lawful basis applies.

For the ARC Team Kit Draw described in the Official Rules, Code Zero is the prize sponsor/supplier only. ARC does not provide Code Zero with entrant names, email addresses, country, profile responses, mailing addresses or other entrant data for the draw. If a winner's delivery details must be provided to Code Zero or another fulfillment provider to ship a prize, ARC will disclose only the information necessary for that delivery and will explain this in the applicable promotion notice and rules.

f. Legal and Protective Disclosures. We may disclose information where necessary to comply with applicable law, legal process, or lawful requests; protect the rights, property, or safety of ARC, ARC Team USA, members, participants, or others; investigate suspected fraud or misconduct; or establish, exercise, or defend legal claims.

g. Organizational Changes. Information may be disclosed in connection with a reorganization, transfer, or other organizational transaction, subject to applicable law and appropriate safeguards.

We do not intend to sell member or participant lists or provide personal information to third parties for payment. Any future sale or sharing of personal information will be subject to applicable law and any required notices, choices, or consents.

Participation in an ARC game, drawing, contest, giveaway, sweepstakes, or other prize promotion may require the submission of personal information.

We may use that information to:

• Record and administer entries;
• Verify eligibility and compliance with the applicable official rules;
• Conduct the drawing or other winner selection procedure;
• Contact selected winners;
• Verify the identity and eligibility of selected winners;
• Confirm acceptance of a prize;
• Arrange shipment, delivery, or collection of a prize;
• Comply with tax, regulatory, and other legal obligations; and
• Maintain records of the promotion and its results.

The personal information required for entry will be identified in the applicable entry form or promotion materials.

For the ARC Team Kit Draw, the entry form asks for email address, first name, last name, country and the response to "What describes you best?". The form should clearly distinguish information required to administer the draw from any optional subscription to ARC marketing. ARC may use entry information to administer the draw and send entry-related, eligibility, winner and prize-delivery communications; this does not by itself subscribe an entrant to marketing.

Where a participant is selected as a winner, additional information may be required to verify eligibility, confirm the prize, and arrange delivery. We will not require information that is unnecessary for those purposes.

Winner Announcements and Publicity. Depending on the applicable official rules and legal requirements, ARC may be required or permitted to identify or publish certain information about winners, including a winner's name, general location, or other limited identifying information.

Where a separate publicity release or consent is required, ARC will obtain it separately. Participation in a promotion will not automatically constitute consent to unrelated publicity, advertising, photography, or marketing activities.

Marketing. Entry into an ARC game or promotion will not automatically enroll a participant in ARC marketing communications or authorize ARC to share the participant's personal information with sponsors for their independent marketing purposes. Where required, separate consent will be obtained.

If a promotion's entry mechanic includes a newsletter subscription, ARC will describe that mechanic accurately in the Official Rules and signup form and will obtain any marketing consent required by the laws applicable to the entrant. The marketing consent control, if used, should be separate, specific, affirmative, not pre-selected, and recorded with its wording and timestamp. ARC should not represent that consent is optional if the form technically prevents entry without it.

Promotion-Specific Rules. Each promotion may be subject to separate official rules or terms and conditions identifying eligibility requirements, entry procedures, drawing dates, prizes, winner selection, notification procedures, and other relevant conditions.

We may send administrative communications necessary to operate memberships, events, activities, and promotions, including subscription confirmations, payment notices, event information, entry confirmations, winner notifications, and information about benefits.

We may also send communications about ARC activities, ARC Team USA developments, fundraising initiatives, and related opportunities, subject to applicable law.

Where consent is required for electronic marketing, we will obtain it before sending the relevant communications. Where another legal basis is permitted, we will comply with applicable requirements, including any right to object or opt out.

You may opt out of promotional email communications by following the unsubscribe instructions provided or contacting us at the address in Section 17.

ARC uses Mailchimp for certain email and landing-page activities. If you subscribe through a Mailchimp form, Mailchimp may process your email address, name, country, signup source, consent status, date/time of signup, list or tag assignment, email delivery information, unsubscribe requests and campaign engagement information on ARC's behalf. ARC may use tags or segments to distinguish promotion entrants from other subscribers and to manage communications. Every marketing email will include an unsubscribe mechanism. ARC will maintain suppression records so that an unsubscribe is respected and will not re-add an unsubscribed address to marketing lists without a new lawful basis or valid consent.

Withdrawing marketing consent or opting out will not affect the lawfulness of processing carried out before withdrawal, nor prevent necessary administrative or transactional communications.

Where our websites or digital services use cookies, pixels, analytics, or similar technologies, these technologies may collect information about your device and interactions with our services.

We may use strictly necessary technologies to operate and secure our websites. We will seek consent before using non-essential cookies or similar technologies where required by applicable law, including applicable Italian and EU rules.

You may be able to manage cookie preferences through our website or your browser settings. Disabling certain technologies may affect website functionality.

Where required, ARC will display a cookie banner or consent-management interface before setting or accessing non-essential cookies or similar technologies. The interface should provide a genuine choice to accept or reject non-essential technologies, allow users to change or withdraw their choice, and record consent where required. Strictly necessary technologies may be used without consent where the law permits. Browser settings alone may not provide all available choices.

Cookies and trackers on ARC's site include:

• cc_cookie - ARC
• _ga - Google Analytics
• ga[ID] - Google Analytics
• _fbp - Meta
• _fbc - Meta -
• lastExternalReferrer / lastExternalReferrerTime (browser local storage) - Meta
• _ttp - TikTok
• tt_enable_cookie - TikTok
• ttcsid / ttcsid[ID] - TikTok

Online Shop and Payments

When you browse or purchase through the ARC online shop, ARC and the relevant shop platform may process account, browsing, cart, order, billing, delivery, payment-status, returns, refund and customer-service information to operate the shop, fulfill orders, prevent fraud, provide support and meet legal obligations. Payment details are generally entered directly into a payment provider's checkout and processed by that provider. ARC may receive transaction identifiers, payment status, limited payment-method details and billing information, but should not receive full payment-card details unless the checkout configuration specifically provides for that and appropriate safeguards are in place. The shop platform, payment provider and shipping provider may each have their own privacy terms.

ARC activities may involve the United States, Italy, and other countries. Personal information may therefore be accessed from, stored in, or transferred between these and other countries where ARC, ARC Team USA, or its service providers operate.

Where the GDPR applies, transfers of personal data outside the European Economic Area ("EEA"), including transfers to the United States, will be made in accordance with Chapter V of the GDPR.

Depending on the recipient and the circumstances, an international transfer may rely on:

• An applicable European Commission adequacy decision, including the EU-U.S. Data Privacy Framework where the recipient is appropriately certified and the transfer falls within its scope.
• Appropriate safeguards, such as the European Commission's Standard Contractual Clauses, together with any supplementary measures required by applicable law.
• Another transfer mechanism or derogation expressly permitted by the GDPR.

Where required, we will assess the protection available in the destination country and implement appropriate safeguards. Information about the applicable transfer mechanism and how to obtain a copy of relevant safeguards will be made available as required by law.

Transfers from the United States to Italy or other countries will also be handled in accordance with applicable data protection laws.

Mailchimp, the website host, shop platform, payment processors, analytics providers and other vendors may store or access information in countries outside the country where you are located. ARC will identify the relevant transfer mechanism and safeguards for each restricted transfer where required. Do not assume that a vendor's general statement about security or global operations, by itself, establishes a valid GDPR transfer mechanism.

We use reasonable administrative, technical, and organizational measures designed to protect personal information against unauthorized access, loss, misuse, alteration, or disclosure.

These measures are intended to be appropriate to the nature of the information and the risks associated with its processing. We expect service providers handling personal information on our behalf to maintain appropriate safeguards.

No method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security.

Where required by applicable law, we will notify affected individuals and relevant supervisory or regulatory authorities of a personal data breach.

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including membership administration, provision of benefits, event administration, promotion administration, prize fulfillment, financial and accounting records, dispute resolution, legal claims, and compliance with legal obligations.

Retention periods will depend on the nature of the information, the relevant purpose, and applicable legal requirements.

ARC will apply separate retention periods to (i) promotion entry and winner records, (ii) marketing subscriber records, (iii) unsubscribe/suppression records, (iv) shop orders and financial records, and (v) cookie and consent logs. Marketing suppression information may be retained in a limited form for as long as necessary to ensure that ARC honors an unsubscribe. ARC should set and periodically review actual retention periods in Mailchimp, the shop platform and other systems rather than retain all information indefinitely.

For example:

• Membership information may be retained for the duration of membership and a reasonable period afterward to address administrative, financial, and legal matters.
• Game and promotion entry information may be retained for the duration of the promotion and any additional period reasonably necessary to verify results, deliver prizes, address disputes, and comply with applicable legal obligations.
• Winner and prize fulfillment records may be retained for longer periods where required for tax, accounting, or regulatory purposes.

When personal information is no longer reasonably necessary, we will delete it, anonymize it, or otherwise dispose of it in accordance with applicable law and our retention practices.

Depending on your location and applicable law, you may have rights concerning your personal information.

Where the GDPR applies, these rights may include:

• Access: Request confirmation of whether we process your personal data and obtain access to it.
• Rectification: Request correction of inaccurate or incomplete personal data.
• Erasure: Request deletion of personal data in circumstances provided by law.
• Restriction: Request restriction of processing in certain circumstances.
• Data portability: Receive certain personal data in a structured, commonly used, machine-readable format and, where technically feasible and legally applicable, request its transfer to another controller.
• Objection: Object to processing based on our legitimate interests on grounds relating to your particular situation.
• Marketing objection: Object at any time to processing for direct marketing, including related profiling.
• Withdrawal of consent: Withdraw consent at any time where processing is based on consent. Withdrawal does not affect processing carried out lawfully before withdrawal.
• Complaint: Lodge a complaint with a competent data protection supervisory authority, including in an EU Member State where you live, work, or where an alleged infringement occurred.

These rights are subject to applicable legal conditions and exceptions. For example, we may need to retain certain information to comply with legal obligations or establish, exercise, or defend legal claims.

Where applicable US privacy laws provide additional rights, including rights to know, access, correct, delete, or opt out of certain processing, we will honor those rights as required by law.

To exercise a right, contact us using the details in Section 17. We may need to verify your identity and will respond within the period required by applicable law. Where we cannot fulfill a request, we will explain the reason where required.

You will not be discriminated against for exercising privacy rights available to you under applicable law.

Depending on the state where you reside and whether a particular state law applies to ARC, you may also have rights to appeal a denial of a privacy request, opt out of targeted advertising, sale or sharing of personal information, and limit certain uses of sensitive personal information. Where applicable, ARC will recognize legally valid browser-based opt-out preference signals, such as Global Privacy Control, and will provide the required method for submitting requests. ARC does not sell personal information for money. Whether use of third-party advertising or analytics technologies constitutes "sharing," "targeted advertising" or a similar regulated activity depends on the technologies and configuration ARC actually uses.

Unless otherwise specified in the applicable official rules or activity terms, ARC membership programs, games, contests, and promotional activities are intended for adults.

The ARC Team Kit Draw is limited to eligible legal residents of the 50 United States and the District of Columbia who are at least 18 years old, except that residents of Alabama and Nebraska must be at least 19, as stated in the Official Rules. ARC will use the eligibility information collected for that promotion to administer and verify eligibility. The promotion is not directed to children.

We do not knowingly collect personal information directly from children under 13 through membership applications or promotional activities in circumstances where such collection is not permitted.

Children may participate in certain events or activities as guests or family members of a member. In those circumstances, we may process information reasonably necessary to arrange and safely administer the activity, subject to applicable law and any required parental or guardian authorization.

Where personal information is provided about a guest or another individual, the person providing it should have appropriate authority to do so. We will provide privacy information directly to that individual where required by applicable law.

We do not currently intend to use personal information to make decisions based solely on automated processing, including profiling, that produce legal effects or similarly significant effects on individuals.

The selection of winners in a game or prize drawing may involve a random selection process. Such a process is used to administer the promotion in accordance with its official rules and is not intended to make decisions producing legal or similarly significant effects outside the promotion itself.

If our practices change and the GDPR applies, we will provide the required information and ensure that any such processing complies with applicable legal requirements.

We may update this Privacy Policy to reflect changes in ARC's operations, programs, activities, information practices, service providers, sponsor relationships, or applicable law.

The updated policy will be made available through the relevant ARC website or otherwise provided to affected individuals, with a revised "Last Updated" date.

Where a change materially affects how we process personal information, we will provide additional notice and obtain consent where required by applicable law before implementing the relevant change.

For questions about this Privacy Policy, requests concerning personal information, or other privacy matters, please contact:

American Racing Challenger Team USA

Legal Entity: American Racing Challenger Team USA, LLC.

Address: 125 High Street, Suite 1704, Boston, MA 02110, USA

Email: info@teamarcusa.com

EU Representative, if required:

This will be provided as required.

Where applicable, you may also lodge a complaint with the competent data protection supervisory authority in the relevant EU Member State.