Version of 17 August 2026

This privacy statement explains what information we collect about you, the purposes for which we use it and with whom we share it. It also sets out your rights regarding your information and whom you can contact for more information or with any questions.

This privacy statement applies to Metropolis, whose registered office is located at Avenue des Communautés 110, B-1200 Brussels.

We are committed to protecting your privacy and to handling your information in an open and transparent manner.

This privacy statement sets out how we collect, process, store and protect information about you when:

• we provide services to you or to our clients;
• you use our website; or
• we carry out any other activity that is part of the operation of our business, as described in more detail below.

When we refer to “our website” or “this website” in this statement, we mean the specific web pages of Metropolis whose address begins with “https://metropolis.info”.

This privacy statement also contains information about when we share your personal data with other third parties (for example, our service providers).

In this privacy statement, your information is sometimes referred to as “personal data” or “personal information”. This means any information that directly or indirectly identifies you. We may also refer collectively to the handling, collection, protection and storage of your personal information as the “processing” of that personal information.

In the course of (i) providing services to you or to our clients, (ii) our marketing and recruitment campaigns and events, and (iii) carrying out checks in connection with our services (or discussing services we might provide), we will collect or obtain personal data about you. We may also collect personal data about you when you use our website.

We may collect or obtain such data because:

• you give it to us (for example, in a form on our website);
• other people provide it to us (for example, your employer or adviser, or third-party service providers we use to help run our business);
• it is publicly available; or
• we observe or infer it from the way you interact with us or with others. For example, to improve your experience when you use our website and to make sure it works efficiently, we (or our service providers) may use cookies (small text files stored in a user’s browser) and web beacons, which may collect personal data. You will find more information on how we use cookies and other tracking technologies, and on how you can control them, in our cookie notice.

The personal data we collect or obtain may include:

• basic information: name; age; date of birth;
• country of residence;
• gender;
• lifestyle and social circumstances (for example, your hobbies);
• family circumstances (for example, your marital status and dependants);
• employment and education information (for example, your degree, expected graduation date, CV, previous or current school, the organisation you work for and your job title);
• financial and tax information (for example, payment details, your income and your tax residence);
• IP address;
• browser type and language;
• access times;
• details of complaints;
• details of how you use our products and services;
• details of how you like to interact with us, and other similar information; and
• any other personal information you may provide to us in order to benefit from our services.

We do not seek to collect so-called “sensitive” personal data (special categories within the meaning of the GDPR). If you provide such data to us spontaneously, we only process it to the extent necessary to handle your request, or where the law requires us to do so.

The types of personal data we collect may vary depending on the nature of the services we provide to you or to our client, or on how you use our website.

Where our client provides us with personal data about you, we make reasonable efforts to include in the contract with the client clauses requiring it to comply with privacy laws and regulations applicable to that information; this may include, for example, the client having informed you of the collection (and of other matters) and having obtained any consent necessary for us to process that information as described in this privacy statement.

We understand the importance of protecting children’s privacy. Our website and services are not designed for or intentionally aimed at children. It is not our policy to intentionally collect or store information about children.

We are required by law to set out in this privacy statement the legal grounds on which we rely to process your personal data.

We therefore use your personal data for the purposes described above because:

• we have obtained your consent to do so;
• of legal and regulatory obligations to which we are subject (for example, keeping records for regulatory or tax purposes, or providing information to a public body or law-enforcement authority);
• we are performing a contract with you;
• we need to exercise, establish or defend legal claims;
• the information is necessary to provide our services to you or to our client;
• of our legitimate interests in the effective delivery of our services to you or to our client, provided those interests are not overridden by yours; and
• of our legitimate interests in the effective and lawful operation of our business (such as, but not limited to, preventing fraud, making sure complaints are investigated, protecting our commercial interests, and evaluating, developing or improving our services or products), provided those interests are not overridden by yours.

Where we are legally required to obtain your explicit consent before sending you certain marketing materials, we will only send you those materials if we have obtained that consent from you.

If you no longer wish to receive marketing materials from us, you can use the unsubscribe function in those communications.

In connection with one or more of the purposes described in the “How do we use information about you?” section above, we may disclose details about you to:

• other members of Metropolis;
• third parties that provide services to Metropolis;
• competent authorities (including courts and authorities that regulate us or our clients);
• your employer and/or its advisers;
• your advisers;
• organisations that help us reduce the incidence of fraud; and
• other third parties that reasonably need access to personal data about you for one or more of the purposes described in the “How do we use information about you?” section above.

We may also have to disclose your personal data where required:

• by law;
• by a regulatory body;
• or in the course of legal proceedings.

We may share non-personal, de-identified and aggregated information with third parties for several purposes, including:

• data analysis;
• research;
• submissions;
• thought leadership; and
• promotional purposes.

We use a range of physical, electronic and managerial measures to keep your personal data secure, accurate and up to date. These measures include:

• education and training of relevant staff, so that they are aware of our privacy obligations when handling personal data;
• administrative and technical controls restricting access to personal data on a need-to-know basis;
• technological security measures, including firewalls, encryption and anti-virus software; and
• physical security measures, such as staff passes required to access our premises.

Although we apply appropriate security measures once we have received your personal data, the transmission of data over the internet (including by e-mail) is never completely secure. We strive to protect personal data, but we cannot guarantee the security of data transmitted to us or by us.

We will retain your personal data on our systems for the longest of the following periods:

• as long as necessary for the relevant activity or services;
• any retention period required by law; or
• the end of the period during which litigation or investigations might arise in connection with the services.

You have various rights in relation to your personal data. In particular, you have the right to:

• obtain confirmation that we process your personal data and request a copy of the personal data we hold about you;
• ask us to update the personal data we hold about you, or to correct personal data you consider incorrect or incomplete;
• ask us to delete the personal data we hold about you, or to restrict the way in which we use it;
• withdraw your consent to the processing of your personal data at any time (to the extent that such processing is based on consent);
• receive a copy of the personal data about you that you have provided to us, in a structured, commonly used and machine-readable format, and have that personal data transmitted to another party (to the extent that the processing is based on consent or on a contract); and
• object to our processing of your personal data.

To exercise any of your rights, or if you have any other questions about our use of your personal data, please e-mail contact@metropolis.info.

You can also use these contact details if you wish to make a privacy-related complaint to us.

If you wish to exercise your rights as set out above, please note that, in case of reasonable doubt about your identity, we may need proof of identity in order to deal with your request.

If you are not satisfied with the way we have handled your personal data, or with any privacy-related question or request you have addressed to us, you have the right to lodge a complaint with the data protection authority (“DPA”) of your jurisdiction. If you would like to be directed to the competent data protection authority, please contact us as indicated above.

We may amend or update this privacy statement from time to time.

To inform you of changes to this privacy statement, we will update the revision date at the top of this page. The amended or updated privacy statement will apply from that revision date. We therefore encourage you to review this statement periodically to stay informed about how we protect your information.

With your consent (Article 6(1)(a) GDPR), we use advertising pixels — Meta Pixel, LinkedIn Insight Tag and Google Ads — which collect browsing data on our public pages for campaign measurement and targeted advertising. These partners process this data for their own purposes. The list of cookies involved and how to withdraw your consent are described in our cookie notice.