Privacy Notice for Shareholders

We share personal information with a number of trusted third parties who work with us to help deliver our services, in order to fulfil our legal obligations or at your request. Such third parties include:

• Computershare, as our Registrar, who manages our share register;
• other members of WH Smith Group, as necessary to operate our business;
• payment providers who help us manage dividend and other payments to our shareholders;
• solicitors and professional service firms who provide us with legal support in relation to our services or any litigation;
• service providers who help operate our IT and back office systems;
• regulators who regulate how we operate, these include the Financial Conduct Authority, the London Stock Exchange, HMRC and the Information Commissioner's Office;

In addition to the above, we will share your personal information:

• if the law requires or permits disclosure, or there is a duty to the public to share or disclose your personal information e.g. for the purpose of verifying shareholdings or contacting shareholders about matters relating to the company, their shareholding or a related exercise of rights;
• with any third party at your request or with your consent;
• with any individual or company to whom we propose to transfer our obligations and rights in relation to the administration of our share register; and
• with any other person that requires access to or receipt of your personal information in connection with or as a result of any agreement we may have with or concerning you, or our arrangements with you.

We may use your personal information to help us to detect and prevent fraud, fight financial crime and meet our regulatory responsibilities. This may involve checking public registers (e.g. the electoral roll or registers of county court judgments, bankruptcy orders or repossessions), conducting online searches from websites and other information sharing platforms and using databases managed by credit reference agencies and other reputable organisations. This will help us verify your identity and carry out tracing exercises. We may also share your information and undertake searches with third party organisations such as public bodies, credit reference agencies, fraud prevention agencies and our regulators (which include the FCA, and ICO).

If you give us false or inaccurate information and we suspect fraud, we will record this to prevent further fraud and money laundering.

We generally only keep personal information for as long as is reasonably required for the reasons explained in this privacy notice. We do keep certain records - which may include personal information - for more extended periods e.g. after you have sold your shareholding, if we need to do this to meet legal, regulatory, tax or accounting needs.

It is important to ensure that the personal information we hold about you is accurate and up‐to‐date, and you should let us know if anything changes, for example if you move home or change your phone number or email address. You can contact our registrar Computershare at The Pavilions, Bridgwater Road, Bristol BS99 6ZZ or via the Computershare Investor Services website at: http://www.investorcentre.co.uk.

Some of the organisations we share information with may be located outside of the European Economic Area ("EEA"). We will always take steps to ensure that any transfer of information outside the EEA is carefully managed to protect your privacy rights:

• transfers within the WH Smith Group will be covered by an agreement entered into by members of the WH Smith Group (an intra-group agreement) which contractually obliges each member to ensure that your personal information receives an adequate and consistent level of protection wherever it is transferred within the Group;
• where we transfer your data to non-WH Smith Group members or other companies providing us with a service, we will obtain contractual commitments and assurances from them to protect your personal information;
• we will only transfer personal information to countries which are recognised as providing an adequate level of legal protection or where we can be satisfied that alternative arrangements are in place to protect your privacy rights; and
• any requests for information we receive from law enforcement or regulators will be carefully validated before personal information is disclosed.

You have a right to ask us for more information about the safeguards we have put in place as mentioned above. To learn more, please see below.

You have the following rights in relation to your personal information:

• the right to be informed about how your personal information is being used;
• the right to access the personal information we hold about you;
• the right to request the correction of inaccurate personal information we hold about you;
• the right to request the erasure of your personal information in certain limited circumstances;
• the right to restrict processing of your personal information where certain requirements are met;
• the right to object to the processing of your personal information;
• the right to request that we transfer elements of your data either to you or another service provider; and
• the right to object to certain automated decision making processes using your personal information.

We may ask you for proof of identity when making a request to exercise any of these rights. We do this to ensure we only disclose information where we know we are dealing with the right individual.

We may not always be able to do what you have asked, for example if it would impact the duty of confidentiality we owe to others, or if we are otherwise legally entitled to deal with the request in a different way.

To exercise any of the above rights, or if you have any questions relating to your rights, please contact us by using the details set out in the "Contacting us" section below. More information about your legal rights can be found on the Information Commissioner’s website at: https://ico.org.uk/your-data-matters/.

If you are unhappy with the way we are using your personal information you can also complain to the UK Information Commissioner’s Office or your local data protection regulator. We are here to help and encourage you to contact us to resolve your complaint first.