Kodak Alaris Group of Companies Employee and Applicant Privacy Notice

Last Updated: August 22, 2023

At Kodak Alaris, we are committed to protecting the personal data of our employees and applicants for employment. We collect and retain personal data only to satisfy legitimate business purposes or as required by law. Kodak Alaris may transfer personal information about its employees and applicants for employment collected in the context of the employment relationship or prospective employment relationship to a parent, affiliate, or unaffiliated service provider (some of whom are located in the United States) as further detailed below. The collection of such personal information and its processing prior to transfer will have been subject to the national laws of the country where it was collected, and any conditions for or restrictions on its transfer according to those laws will be followed and respected.

1. Who we are and how to contact us:

1. Controller. The Kodak Alaris Group is made up of different legal entities, details of which can be found in Exhibit A. This Privacy Notice is issued on behalf of the Kodak Alaris Group so when we mention Kodak Alaris, "we", "us" or "our", we are referring to the relevant company in the Kodak Alaris Group responsible for processing your data. For the purposes of EU GDPR and UK GDPR (and any other relevant legislation where applicable), the Kodak Alaris Group entity by whom you are directly employed is the controller for your data.
2. Contact Details. If you have any questions about this Privacy Notice, including any requests to exercise your applicable legal rights, please contact our DPO at:

DPO, Kodak Alaris Inc.

Email address: DPO@kodakalaris.com

Postal address: 336 Initiative Drive, Rochester, New York 14624, USA

Alternatively, if you are based in the European Union, you can contact our Legal Representative Office at:

Eversheds Sutherland (Germany) Rechtsanwälte Steuerberater Solicitors Partnerschaft

mbB

Postal address: Attention Kodak Alaris EU Rep, Brienner Straβe 12, 80333 Munich, Germany

1. Complaints. You may have the right to make a complaint at any time to an applicable supervisory authority or other regulator for data protection issues. We would, however, appreciate the chance to address your concerns before you approach the supervisory authority or regulator and, so, please contact us in the first instance.

2. How is your personal data collected?

The majority of employee or applicant data is collected directly from you. Examples of where your data is collected include but are not limited to:

Submission of your employment application to Kodak Alaris.
Information you provide during onboarding at the commencement of your employment.
Information about you that you provide directly to your HR representative or another authorized company representative.
Information about you that you submit or update using company HR resources (for example, self-service tools in the Dayforce system).

Additionally, some personal data (such as performance reviews and salary information) will likely be generated during your employment by the company.

3. Information we Collect about you:

1. Personal data, or personal information, means any information about an individual from which that person can be identified. We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:
  1. Identity Data includes name, alias, title, date of birth, gender, your image and voice, and identification documentation.
  2. Contact Data includes address, location, email address, telephone numbers, and preferred language.
  3. Financial Data includes bank account details.
  4. Usage Data includes information about how you use our websites, applications, systems, hardware or other company resources.
  5. Communications Data includes business related communications that contain or otherwise constitute personal data.
  6. Data related to Job Performance includes performance reviews and the data used to prepare them.
  7. Applicant Data includes data commonly found on a resume/ CV, such as your education, past work experiences, and job relevant skills.

1. If you fail to provide personal data. Where we need to collect personal data by law, or under the terms of an employment relationship we have with you (or are trying to establish with you), and you fail to provide that data when requested, we may need to terminate your employment or rescind your offer of employment, or alternatively we may not be able to offer you all of the benefits to which you are entitled. If such a circumstance arises, we will notify you at that time and afford you another opportunity to provide the requested information before any action is taken.

1. Your duty to inform us of changes. It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your employment with us.

4. How we use your personal data

1. We will only use your personal data when the law allows us to. In some territories, we are required by law to inform you of the lawful basis of processing, and we set out such information in the table below. In some instances, we may rely on more than one legal basis.

Most commonly, we will use your personal data in the following circumstances:

To enable and manage your employment by the company.
To enable payroll and benefits participation, and for tax purposes
To enable you to utilize company systems and resources within the scope of your employment.
Where it is necessary for our legitimate interests (or those of a third party) provided your interests and fundamental rights do not override those interests.
Where we need to comply with a legal obligation.
Where you have given your consent.

4.2 Purposes for which we will use your personal data

We have set out below, in a table format, a description of all the ways we plan to use your personal data.

Purpose/Activity	Type of data	Lawful basis for processing
To enable and manage your employment by the company. (or in the case of applicants, to enable and manage your candidacy for employment)	Identity Contact Financial Communications Data related to job performance Applicant Data	Performance of a contract with you. Consent Necessary for our legitimate interests (to maintain an appropriate workforce)
To process and manage payroll and benefits	Identity Contact Financial Communications	Performance of a contract with you.
To file the company’s taxes, apply any applicable tax withholdings, and deliver tax documentation to you	Identity Contact Financial Communications	Performance of a contract with you Necessary to comply with a legal obligation Necessary for our legitimate interests (to keep our records updated)
To administer and enable your use of company systems, including without limitation: access to the company network, email, instant messaging, video conferencing, cloud storage, ERP (if applicable to your role), and HR applications such as Dayforce.	Identity Contact Financial Usage Data Communications	Performance of a contract with you Necessary for our legitimate interests (to provide and manage the resources reasonably necessary or beneficial to the operation of our business)
To carry out day-to-day business activities	Communications	Necessary for our legitimate interests (ensure the continuity of our business)

4.3 Change of purpose

Where legislation requires us to do so, we will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

1. Please note that we may process your personal data without your knowledge or consent, where this is required or permitted by law.

4.5 Special Categories of Personal Data.

Under the EU GDPR and UK GDPR, Special Categories of Personal Data include details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, genetic information, and biometric information utilized to identify a specific natural person. In order for us to comply with local legal requirements and administer certain benefits schemes (such as health and wellness benefits) it may be necessary for us to collect and process certain Special Category Personal Data. Such Special

Category Personal Data will only be processed to the extent necessary for the purpose of carrying out the obligations and exercising specific rights of Kodak Alaris or you within the scope of the employment relationship, and only to the extent required by or permissible under appliable law. Additionally, we may collect information about criminal convictions and offences to conduct background screenings or in furtherance of managing our employment relationship with you, provided we will only do so in jurisdictions where it is permissible to do so, and will comply with any additional legal requirements that may be applicable to the access to and use of such data.

5. Disclosures of your personal data

We may share your personal data with the parties set out below for the purposes set out in the table above.

Internal Third Parties.
- We may share your personal data amongst Kodak Alaris Group companies.
Third parties to whom we may choose to sell, transfer or merge parts (or the whole) of our business or our assets.
- If a change happens to our business, then the new owners may use your personal data in the same way as set out in this Privacy Notice.
Other External Third Parties.
- We may share your personal data with third-party service providers that we utilize to provide IT systems, HR related services (such as outsourced payroll administration or benefits), or other services to the company.
- We may share your personal data with Public authorities in connection with a lawful request made by such authorities, including to meet national security or law enforcement requirements.
- We may share your personal data with Professional advisers acting as processors including lawyers (but not limited to), bankers, auditors and insurers based in who provide consultancy, banking, legal, insurance and accounting services.
- We may share your personal data with HM Revenue & Customs in the UK, and/or equivalent regulators and other authorities outside of the UK who require reporting of processing activities in certain circumstances.
We require all third parties to respect the security of your personal data and to treat it in accordance with the law.

6. International transfers

1. We share your personal data within the Kodak Alaris Group. This may involve transferring your data outside the UK and European Union. In order to ensure the protection of personal data shared amongst members of the Kodak Alaris Group, we have implemented an intragroup data transfer agreement that incorporates specific contract terms approved for use in the UK and/or the European Union which give personal data substantially similar protection to what it has in the UK and/or European Union.
2. Many of our External Third Parties are based outside the UK and the European Union so their processing of your personal data may involve a transfer of data outside the UK and European Union. Whenever we transfer your personal data out of the UK and European Union, and UK GDPR or EU GDPR rules apply, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

The country to which we will transfer your personal data has been deemed to provide an adequate level of protection for personal data.

Establishment of specific contract terms approved for use in the UK and/or the European Union which give personal data substantially similar protection to what it has in the UK and/or European Union.

1. Please contact us if you want further information on the specific mechanism used by us when transferring your personal data out of the UK or the European Union.

7. Data security

We have put in place appropriate security measures designed to protect your personal data from being accidentally lost, used or accessed in an unauthorised way, altered, or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. However, please note that no method of transmission over the internet or method of electronic storage is 100 percent secure, and therefore we cannot guarantee the absolute security of personal information.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

8. Data retention

1. We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.
2. To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements. Details of retention periods for different aspects of your personal data are available in the relevant section or our retention policy which you can request from us by contacting us.
3. In some circumstances, by law we have to keep certain information about our employees or applicants for a specified applicable statutory period, which may include retention of such information even after the end of an individual’s employment with Kodak Alaris.
4. In some circumstances you can ask us to delete your data: see your legal rights below for further information.
5. In some circumstances we will anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

9. Your legal rights

1. Where we are legally obliged to do so, we honour those rights that are afforded to you by law. Please check your local data protection legislation to determine which rights may be available to you.
2. For residents of the UK or European Union, please see Section 10 to find out more about the following rights which may apply to you in connection with the UK GDPR and EU GDPR:

Request access to your personal data.
Request correction of your personal data.
Request erasure of your personal data.
Object to processing of your personal data.
Request restriction of processing your personal data.
Request transfer of your personal data.
Right to withdraw consent.
Other

If you wish to exercise any of the GDPR rights set out above, or any other privacy rights you may be afforded by law, please contact us using the information in Section 1.2 above.

1. California residents’ legal rights: If you are a California resident, California law may provide you with additional rights regarding our use of your personal information. To learn more about your California privacy rights, please see our Notice at Collection, which is available at https://kodakalaris.sharepoint.com/sites/Intranet/legal/Policies/CPRA%20Notice%20at%20Collecti on%20-%20Employees%20and%20Applicants.pdf.
2. Residents of other US States: If you are a resident of another US State, the laws of the state in which you reside may grant you additional rights, including without limitation: (i) the Virginia Consumer Data Protection Act, (ii) the Colorado Privacy Act (with effect from July 1, 2023), (iii) the Connecticut Data Privacy Act (with effect from July 1, 2023), and (iv) the Utah Consumer Privacy Act (with effect from December 31, 2023).
3. Kodak Alaris will not sell any personal data covered by this policy (including, “covered information” as defined in Nevada Revised Statutes Chapter 603A) to any third party.
4. If you are resident in France, you also have the right to define instructions on your personal data after your death.
5. Please note that certain of the abovementioned rights are not absolute rights and there may be certain limitations which will apply in the circumstances. Please refer to the data protection legislation applicable in your country or state for further details.
6. If you wish to exercise any of the rights set out above, or any other privacy rights you may be afforded by law, please contact us.
7. No fee usually required. You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.
8. What we may need from you. We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
9. Time limit to respond. We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month. In this case, we will notify you and keep you updated.

10. Legal Rights under the EU GDPR and UK GDPR

The rights you are afforded under law differ depending on the applicable legislation in your country (or state).

Where UK GDPR or EU GDPR apply, your rights include the following:

To request access to your personal data (commonly known as a "data subject access request"), enabling you to receive a copy of the personal data held about you and to check that it is being lawfully processed.

To request correction of the personal data held about you, enabling you to have any incomplete or inaccurate data held about you corrected, though it may be necessary to verify the accuracy of the new data you provide.

To request erasure of your personal data, enabling you to ask for the deletion of your personal data where there is no good reason for the continuation of processing. This includes the right for you to ask for the deletion or removal of your personal data where you have successfully exercised your right to object to processing (see below), where your information may have been processed unlawfully or where erase of your personal data is required to comply with local law. Note, however, that it may not always be possible to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.

To object to processing of your personal data where reliance is based on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. Where this right applies, you also have the right to object to processing of your personal data for direct marketing purposes. In some cases, it may be possible to demonstrate a compelling legitimate ground to process your information which overrides your rights and freedoms.

Request restriction of processing of your personal data. This enables you to ask for the suspension of the processing of your personal data in the following scenarios:

To establish the data's accuracy.
Where use of the data is unlawful but you do not want it erased.
Where you need the data to be held even if no longer required, as you need it to establish, exercise or defend legal claims.
You have objected to the use of your data but it is needed to verify whether there is an overriding legitimate grounds for it to be used.

Request the transfer of your personal data to you or to a third party. You have the right for your personal data to be provided to you, or a third party you have chosen, in a structured, commonly used, machine-readable format. Note that this right only applies to automated information for which you initially provided consent for use or where the information is used to perform a contract with you.

Withdraw consent at any time where consent is relied on to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to offer you all of the benefits to which you are entitled. You will be advised if this is the case at the time you withdraw your consent.

If you are resident in France, you also have the right to define instructions on your personal data after your death.

Please note that the abovementioned rights are not absolute rights and there may be certain limitations which will apply in the circumstances. Please refer to the data protection legislation applicable in your country or state for further details.

Exhibit A

Kodak Alaris Group Entities

Entity Name

Country

Primary Address

Kodak Alaris Holding Limited

UK

Part Second Floor of Westside Two, Westside, London Road, Apsley, Hemel Hempstead, Hertfordshire,

HP3 9TD, United Kingdom

Kodak Alaris Limited

UK

Part Second Floor of Westside Two, Westside, London Road, Apsley, Hemel Hempstead, Hertfordshire, HP3 9TD, United Kingdom

Kodak Alaris Inc.

USA

336 Initiative Drive

Rochester, NY 14624

Kodak Alaris Germany GmbH

Germany

Augsburger Strasse 712

70329 Stuttgart

Kodak Alaris France SAS

France

Immeuble METROSUD,

1 Boulevard Hippolyte Marques, 94200 Ivry-Sur-Seine, France

Kodak Alaris Mexico S.A. de C.V.

Mexico

Amado Nervo #2200 Edificio BIO 1, Planta Baja

Jardines del sol

45050 Zapopan, Jalisco, México

Kodak Alaris Operations Canada Inc.

Canada

67 Yonge Street, Suite 701, Toronto, Ontario M5E 1J8

Kodak Alaris Management Shanghai Co., Ltd.

China

1st Floor and part of the 2nd Floor 1510 Chuanqiao Road

Pudong District, Shanghai, China

Kodak Alaris Imaging Equipment (Shanghai) Co., Ltd

China

1st Floor and part of the 2nd Floor 1510 Chuanqiao Road

Pudong District, Shanghai, China

Kodak Alaris Singapore Pte. Ltd.

Singapore

Income@Raffles

16 Collyer Quay, #13-08

Singapore 049318

Kodak Alaris Japan Kabushiki-Kaisha

Japan

Part of the 1st Floor and part of the 7th Floor

Surugadai Kanda Chiyoda-ku Building 2-9

Tokyo, Japan 101-0062

Kodak Alaris Australia Pty Limited

Australia

Suite 78, Waterman Business Centre, Chadstone Shopping Centre, Level 2

1341 Dandenong Road, Chadstone,

Vic 3148