<div>POLICY  </div><div>The Safariland Group, consisting of Safariland, LLC and its affiliated companies, (collectively, “Safariland Group” or the “Company”) maintains data protection policies in jurisdictions that recognize the importance of protecting the privacy of individuals and ensure the security of personal information. It is Safariland Group’s policy to ensure that our compliance with data protection laws and other related legislation and regulations is clear and demonstrable at all times.  </div><div>To meet this objective, Safariland Group shall ensure that appropriate processes are in place to ensure performance to the requirements specified. <div>PURPOSE AND SCOPE  </div>The purpose of this Policy is to ensure that Safariland Group complies with applicable privacy data protection laws and regulations, including, but not limited to, the EU General Data Protection Regulation (GDPR), the Canadian Personal Information Protection and Electronic Documents Act (PIPEDA), and other applicable US federal or state laws. The scope of this Policy includes all activities involving personal data. The handling of personal data shall be conducted in accordance with Safariland Group’s Data Protection Compliance Program (as defined below).  <div>DEFINITIONS  </div><div>GDPR: European Union legislation for the protection of the personal data of EU Citizens. It governs how businesses, wherever located, collect, use and disclosure personal information in the course of commercial business.</div>PIPEDA: Canadian legislation relating to data privacy. It governs how Canadian private sector organizations collect, use and disclose personal information in the course of commercial business.  <div>APPLICABILITY  </div><div>This Policy shall apply to Safariland Group directors and officers, managers and associates regarding relevant aspects of Safariland Group’s business wherever conducted and whenever individuals are acting or appearing to act within their scope of employment or position with the Company. Written procedures shall address the relevant jurisdiction’s legal or regulatory requirements for the business activities of the respective entity.</div>Further guidance is available by contacting the Safariland Group’s Legal &amp; Compliance Department.  <div>RESPONSIBILITIES</div><div><ul><li>The Safariland Group shall administer a Data Protection Compliance Program (“Program”) with the following elements:</li><ul><li>Establish roles and responsibilities for Program oversight;</li><li>Formal written policies and procedures;</li><li>Formal data sharing agreements, as required;</li><li>Data Protection Impact Assessments;</li><li>Risk assessment, monitoring and audits;</li><li>Record keeping and documentation;</li><li>Reporting of violations;</li><li>Documented corrective actions.</li></ul><li>Safariland Group’s Legal &amp; Compliance Department shall be responsible for developing, implementing, maintaining, overseeing and auditing the policies and procedures set forth in the Program.</li><li>Each director and officer, manager, and associate of the Company is individually responsible, by action and supervision as well as continuous review, to ensure strict compliance with this Policy.</li><li>The Vice President, Legal is responsible for furnishing advice with respect to the interpretation and application of this Policy </li><li>Every associate has the affirmative obligation to promptly report in good faith any suspected violations of this Policy. Such reports shall be made to the associate’s manager, the Ethics Helpline, Vice-President, Legal, or other appropriate reporting channels.</li><li>Any confirmed violations of this policy shall be reported to Safariland Group’s Vice-President, Legal. </li></ul></div><div>EXCEPTIONS </div><div>Any exceptions to or deviations from this policy require the prior written approval from the President or the Vice-President, Legal.</div> <div>REFERENCES The following policies and procedures are relevant to this document:</div><div><ul><li>Data Protection Impact Assessment Process</li><li>Personal Data Analysis Procedure</li><li>Legitimate Interest Assessment Procedure</li><li>Information Security Incident Response Procedure</li><li>GDPR Roles and Responsibilities</li><li>Records Retention and Protection Policy</li><li>Policy 224A, Data Protection Policy (UK/EU), General Data Protection Regulation 2016 (GDPR)</li><li>Policy 224B, Data Protection Policy (CA), Personal Information Protection and Electronic Documents Act Policy (PIPEDA) - Canada</li></ul></div>  </div>