Privacy Notice

I. Introduction

Appropriately managing and safeguarding personal data is fundamental to the Evident Corporation and its family of companies’ (“We” or “Evident”).

This Privacy Notice explains how we collect, use and share information, including your personal data, when it’s collected through this website and/or mobile application, linked products, applications, services, websites, sub-sites, widgets, interactive features, forms, mobile site(s) and social media pages offered, owned, or operated by Evident (the “Site(s)”).

If we make changes to this Privacy Notice, we will notify you by revising the Effective Date and, in some cases, we may provide you with more prominent notice (such as sending you a notification or providing you with other disclosures within or in connection with the provision of the Sites). Your access to and use of the Site(s) means you agree to the terms in this Privacy Notice. We encourage you to refer to this Privacy Notice periodically so that you understand our current privacy practices.

This Privacy Notice Explains:

• I.Introduction
• II.Who You Should Contact
• III.Types Of Information We Collect And Use
• IV.Why We Collect And Use Information
• V.Additional Ways We May Collect and Share Your Information
• VI.Recipient Of Your Personal Data
• VII.How Long We Will Keep Your Personal Data
• VIII.Our Use Of Information Technology
• IX.Security
• X.Promotional Mails
• XI.Information Applicable To Residents Of the United States
• XII.Personal Data Subject To European Privacy Laws
• XIII.Personal Data Subject To Japanese Privacy Laws
• XIV.Personal Data Subject to Personal Information Protection Act of Republic of Korea
• XV.Personal Data Subject To Singapore Law
• XVI.Personal Data Subject To Mexican Law
• XVII.Personal Data Subject To Australian Law

II. Who You Should Contact

Attn: Data Protection Officer
Controller: EVIDENT Europe GmbH
Caffamacherreihe 8-10
20355 Hamburg
Germany

Global-privacy@evidentscientific.com

In individual cases, the respective affiliate may be solely or jointly responsible with Evident Corporation. If you have questions relating to a specific jurisdiction we kindly ask you to mention the jurisdiction you are referring to.

Contact us in Japan

Japan-privacy@evidentscientific.com

Contact us in Mexico, Canada or the United States

Americas-privacy@evidentscientific.com

Contact us in Singapore, Korea, Australia or India

Apac-privacy@evidentscientific.com

III. Types Of Information We Collect And Use

Evident collects certain information, including personal data, from and about you.

The term “personal data” means any information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, to a natural person (you). Evidents’ goal is to limit the information we collect to the information needed to support our business.

Summary of the categories of personal data we may collect, where we get it, why we collect it, and with whom we may share it:

Basic Personal Identification: such as salutation, first/last name, address, telephone number, email address, fax number, title, and company name, department and/or title

User Account Information, such as usernames and passwords used to access your account, event/seminar registrations, downloads, subscriptions

Financial Information, such as credit card number, bank account number and/or billing address depending on circumstances

Device Information, such as the type of device you use to access the site(s), your device identification number, IP address or mobile operating system, browser, geo location data (e.g. GPS coordinates – depending on whether switched on), GUID

Browsing Information: browsing time, cookie information, website history, preferences, browser or app information, such as what site you came from and what site you visit when you leave the site(s) or how often you use it

Business Contact Information, supplier master data, order information (order history, invoice information), billing address, postal address and frequency of contact

Marketing Data: marketing campaign data, newsletter data (click rates, opening rates etc.), preferences

Compliance Case Handling: personal data depends on circumstances of the incident reported

IV. Why We Collect And Use Information

Below are examples of ways we use your information collected:

V. Additional Ways We May Collect And Share Your Information

In addition to the methods enumerated above, Evident may collect and share information, including your personal data, through the following methods:

(a) Information From Other Sources

• We engage with current and prospective customers through multiple internet marketing channels and social media services (e.g., Facebook, Instagram, Twitter, LinkedIN). If you contact us on one of our internet marketing channels, request customer service via social media or otherwise direct us to communicate with you via social media, we may contact you via direct message or use other internal or social media tools to interact with you. In these instances, your interactions with us are governed by this Privacy Notice as well as the privacy notice of the social media platform you use. By accessing or logging into our Sites or internet marketing channels via a social media service, any information you provide to us may also become accessible to that service, subject to that service’s privacy notice. For additional information and more details on how you can manage the information provided to us by these social media services, please review the privacy settings applicable to your account with the applicable social media service. Please consult the privacy notice of such services for additional information.

(b) Business Transfers

• Unless otherwise prohibited by law, if Evident merges with, acquires or is acquired by another business entity, it may share your information with any successors to all or part of its business. This may include an asset sale, corporate reorganization or other change of control. If Evident or any of its subsidiaries is sold to or are otherwise acquired by a third party, all Evident’ data assets will become the property of the acquiring party. Such a party will be subject to the consent(s), opt-outs or other customer conditions on data. A change in data ownership may or may not include a notice on the Site(s).

(c) Third Party Marketing

• Unless prohibited by law, including the European Privacy laws, we may share your information with third parties that provide products or services we believe may interest you. These third parties may use your information for their own marketing purposes or the marketing purposes of others. This may include the delivery of internet-based advertising.

VI. Recipient Of Your Personal Data

We share certain data between our Evident Group companies.

We may also share personal data with third parties such as: IT Service Providers, Consultancy Firms, Document destruction, Public Institutions, Suppliers and Others.

If your data is transferred to countries outside the European Economic Area “EEA” which may have different data protection standards than your country of residence, please note that data processed in a foreign country may be subject to foreign laws and accessible to foreign governments, courts, law enforcement, and regulatory agencies. However, we will endeavour to take reasonable measures to keep up an adequate level of data protection also when sharing your personal data with such countries.

VII. How Long We Will Keep Your Personal Data

We will retain your Personal Data only as long as necessary to provide you with the products, services and programs you request, our essential business purposes, such as maintaining the performance of the services and programs, making data-driven business decisions about new features and offerings, complying with our legal obligations and resolving disputes. When we have no justifiable business need to process your Personal Data, we will either delete or anonymize it.

The criteria, used to determine our retention periods include:

• The length of time we have an ongoing relationship with you and provide services or programs to you (for example, for as long as you have a profile/account with us or keep using the services/programs, or have a contract with us);
• Whether there is a legal obligation to which we are subject; or
• Whether retention is advisable in light of our legal position (such as in regard to applicable statues of limitations, litigation or regulatory investigations).

VIII. Our Use Of Information Technology

This section describes the various types of technologies we may use when you interact with our Site(s), and your choices regarding those technologies:

(a) Cookies, Pixel Tags, and Flash Cookies

• We collect certain information, including personal data, by automated means, using technologies such as cookies, pixel tags, browser analysis tools, server logs. Cookies are small text files that websites send to your computer or another connected device to uniquely identify your browser or to store information or settings in your browser. Cookies allow us to recognize when you return to the Site(s). They also help us provide a customized experience and enable us to detect certain kinds of fraud. The types of technology used by Evident may change over time as technology evolves. Some of these technologies are essential for the provision of the Site(s), such as account access/authentication. To learn more about the cookies we use, click here.

(b) Interest-Based or Online Behavioral Advertising

• Evident uses third-party advertising companies to serve interest-based advertisements. These companies compile information from various online sources to match user profiles with ads we believe will be most relevant, interesting and timely based on that users profile.

(c) Social Network New Tech Advertising Programs

• Evident has relationships with several social networks. These companies have specific interest-based ads programs that match people that have shown an interest in Evident through our Site(s) or other services within their profiles (such as on Facebook and LinkedIN). This matching allows us to deliver relevant, interest-based ads on those companies’ networks.

IX. Security

Evident is committed to maintaining appropriate organizational, technical, and physical controls to protect the personal data entrusted to us. These controls protect personal data from anticipated threats and hazards as well as unauthorized access and use. Evident will strive to provide security that is proportional to the sensitivity of the personal data being protected, with the greatest effort being focused on protecting sensitive personal data, like financial or medical data, that could result in substantial harm or inconvenience if it got into the wrong hands.

X. Promotional Emails

If we send you any promotional emails, and you no longer would like to receive such emails, please follow the “unsubscribe” instructions on those emails, if available. Your email address will be removed from our marketing list. Please allow us a reasonable period of time in order to satisfy your request.

XI. Information Applicable To Residents Of the United States

(a) California Residents

• California residents have certain additional rights regarding our use and disclosure of personal information, if applicable to Evident. For purposes of this section XII only, the term “personal information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household, as further defined by the California Consumer Privacy Act of 2018.

  • 1.You may request a copy of the following: (1) The categories of personal information we collected about you; (2) The categories of sources from which the personal information is collected; (3) The business or commercial purpose for collecting or selling (if applicable) the personal information; (4) The categories of third parties with whom we share personal information; and (5) The specific pieces of personal information we have collected about you. To submit a request for this information, you may email us at Global-privacy@evidentscientific.com.
  • 2.You may request that we (and our service providers) delete your personal information. Note that deletion requests are subject to certain limitations, for example, we may retain personal information as permitted by law, such as for tax or other record keeping purposes, to maintain an active account, to process transactions and facilitate customer requests, and for certain other internal business purposes described in this Privacy Notice. To submit a request for deletion, you may email us at Global-privacy@evidentscientific.com.
  • 3.You may request to opt-out of the sale of your personal information by emailing Global-privacy@evidentscientific.com. Please see below for the categories of personal information we may have sold about you in the preceding 12 months.
  • 4.We will not discriminate against you for exercising your rights under this section.
  • 5.As set forth above, California law requires us to identify, prior to the collection of your personal data, what information Evident has “sold” about you. Please be assured that Evident does not sell or rent your information to third parties purely for our profit, to data brokers, or in any way other than those intended to improve your online experiences and the relevance of offers made to you through Evident and elsewhere. Instead, there are instances where Evident has shared personal information in order to provide our customers with personalized services or customized offers to improve your online experiences through our services or elsewhere. We do this in ways that are intended to extend the Evident experience to our customers in a variety of environments. Depending on the circumstances and the contractual obligations in place, this sharing may be a “sale” under applicable law and you may have the right to request that we stop such sharing as more fully set forth below. This sharing includes:
    • identifiers such as a real name, alias, postal address, unique personal identifier (such as a device identifier; cookies, beacons, pixel tags, mobile ad identifiers and similar technology; customer number, unique pseudonym, or user alias; telephone number and other forms of persistent or probabilistic identifiers), online identifier, Internet Protocol address, email address, account name, and other similar identifiers;
    • commercial information, including records of services purchased, obtained, or considered, and other purchasing or consuming histories or tendencies;
    • Internet and other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding your interaction with websites, applications or advertisements; and
    • inferences drawn from any of the information identified above to create a profile about you reflecting your preferences and characteristics.

  Evident may require proof of California residence before responding to any request made under this section. You may authorize another person (your “agent”) to submit a request on your behalf by emailing Global-privacy@evidentscientific.com. Shortly after you (or your agent) submit a request, we will contact you (via email at the email address provided during submission of your request) with instructions on how to verify the request before we fulfill it. We will verify your identity by asking you to log in to your account if you have one with us. Or if you do not, we may ask for your email address, the order number of a recent order you placed with us or the last four digits of a credit or debit card used on our Site(s). We will aim to complete your requests as soon as reasonably practicable and consistent with any applicable laws.

  If you have an account with us, you may also see certain personal information (such as certain profile and transaction information) directly through your account profile page after logging in to a Site. Please note that changes you make on your account profile page through one of our Sites may not always be reflected on other Sites operated by us.

(b) Shine the Light Law - Direct Marketing

You have the right to request information from Evident once per calendar year regarding the manner in which Evident shares certain categories of your personal information with third parties, for the third parties' direct marketing purposes. California Civil Code § 1798.83 provides you with the right to submit a request to Evident at its designated address and receive the following information:

• 1.The categories of personal information Evident’ disclosed to third parties for the third parties' direct marketing purposes during the preceding calendar year;
• 2.The names and addresses of third parties that received such information; and
• 3.If the nature of a third party's business cannot be reasonably determined from the third party's name, examples of the products or services marketed.

You are entitled to receive a copy of this information in a standardized format and the information will not be specific to you individually. Evident’ designated email address for such a request is Global-privacy@evidentscientific.com.

To learn more about managing your privacy and to know your choices concerning interest-based ads, you may visit the Network Advertising Initiative's opt-out page at http://www.networkadvertising.org/managing/opt_out.asp or www.aboutads.info/choices.

XII. Personal Data Subject To European Privacy Laws

If you are located in the European Union, the United Kingdom, Switzerland and/or your personal data is otherwise subject to the General Data Protection Regulation or comparable European Data Protection Legislation (collectively referred to as “European Privacy Laws”), this section provides additional information about your rights and how Evident processes your personal data.

Evident is the controller of personal data submitted by you or otherwise collected when you use the Site(s). We process such information within the Site(s) solely in the processor’s role and, depending on the scope of your activity, you may be the data controller.

(a) Rights to Control Your Personal Data

• You may have certain rights with regard to your personal data under European Privacy Laws. If you would like to request a copy of your personal data being held by us, request that your personal data is deleted, request to update and/or correct your personal data, or request that we provide a copy of your personal data to another data controller, please contact us. We will aim to respond to your request within one calendar month of receipt of your request. Where we are unable to do so within the calendar month, we will notify you of the soonest practicable time within which we can respond to your request (and within three months from the date of your request). There are certain exemptions and restrictions of these rights under the European Privacy Laws that enable personal data to be retained, processed or withheld from access and we will inform you of these restrictions if they apply. We use your Personal Data as described in the chart above.

(b) Sharing your personal data

• We share your personal data with third parties to help us use your personal data, as described in the Privacy Notice.

(c) Tracking Tools (“Cookies”)

• We use cookies as described in our Cookie Notice. You may choose to block or delete cookies but doing so will cause the Site(s) to not operate correctly.

(d) Contact us

• You may access, download, change, or modify your personal data by contacting us. You may also exercise your right to prevent us from sharing your personal data at any time by contacting us as described above in the “Who You Should Contact” section.

(e) Submit a Complaint to a Supervisory Authority

• You have the right at all times to submit a complaint to a data protection supervisory authority, in case you feel that the processing of your personal data, as described in this Notice, infringes with the law. You may find a list of the supervisory data protection authorities in Europe here: https://edpb.europa.eu/about-edpb/board/members_en.

(f) Legal Basis

Evident has the following legal basis for processing your Personal Data:

Type of Personal Data	Legal Basis
Information you provide to us	Evident exercising its rights and performing its obligations in connection with any contract we make with Controller (Article 6 (1) (b) General Data Protection Regulation). Compliance with Evident’ legal obligations (Article 6 (1) (c) General Data Protection Regulation).
Information we collect automatically	Legitimate interests pursued by Evident (Article 6 (1) (f) General Data Protection Regulation). Evident has assessed that these legitimate interests are not overridden by the data protection interests or fundamental rights of any individuals. Compliance with Evident’ legal obligations (Article 6 (1) (c) General Data Protection Regulation).

If you have questions about or need further information concerning the legal basis on which we collect and use your Personal Data, please contact us at Global-privacy@evidentscientific.com.

XIII. Personal Data subject to Japanese Privacy Laws

Please refer to the “Supplementary Information on the Handling of Personal Information subject to the Act on the Protection of Personal Information of Japan Handling of Personal Information” of Evident Group linked below, to the extent not covered in this Privacy Notice, regarding the matters related to our handling of your personal information (including procedures related to requests for disclosure, correction, deletion, etc. of personal information based on the Act on the Protection of Personal Information of Japan).

Handling of Personal Information: Privacy | Evident (evidentscientific.com)

The personal information handling business operators in Japan are as follows:

XIV. Personal Data Subject to Personal Information Protection Act of Republic of Korea

If you are a citizen of the Republic of Korea and/or your personal data is otherwise subject to Personal Information Protection Act, Credit Information Use and Protection Act, Act on Promotion of Information and Communications Network Utilization and Information Protection or other comparable Korean Data Protection Legislation (collectively referred to as “PIPA Laws”), this section provides additional information about your rights and how to processes your personal data.

(a) Rights to Control Your Personal Data

You may have the following rights in relation to the processing of his or her own personal information.

• 1.The right to be informed of the processing of such personal information;
• 2.The right to determine whether or not to consent and the scope of consent regarding the processing of such personal information;
• 3.The right to confirm whether or not personal information is being processed and to request access (including the provision of copies; hereinafter the same applies) to such personal information;
• 4.The right to suspend the processing of, and to request correction, deletion, and destruction of such personal information;
• 5.The right to appropriate redress for any damage arising out of the processing of such personal information through a prompt and fair procedure. If you would like to request a copy of your personal data being held by us, request that your personal data is deleted, request to update and/or correct your personal data, or request that we provide a copy of your personal data to another data controller, please contact us. We will respond to your request within ten business days upon the receipt of your request. We are entitled to limit or deny your request when your request is prohibited or limited by PIPA Laws; or when your request may cause damage to the life or body of a third party, or unjustified infringement of property and other interests of any other person. We will notify you the causes within ten business days.

(b) Sharing Your Personal Data

We do not share your personal data unless you give us a prior consent for marketing and/or promotional purposes.

(c) Destruction of Data

Evident destroys your personal data without delay after the purpose of collecting and using personal information is achieved or after the retention period expires. However, in the case of personal information that needs to be preserved in accordance with relevant laws and internal regulations, it is moved to a separate storage space after the purpose of collection and use is achieved, and it is stored and destroyed according to each retention basis and period. Your personal data shall not be used for any purpose other than the purpose corresponding to each retention basis. When destroying personal information, hard copies containing any personal data shall be shredded, and personal information stored in electronic file form shall be completely deleted using technical methods to prevent any recovery and reproduction.

(c) Contact Us

You may access, download, change, or modify your personal data by contacting us. Please email us at: global-privacy@evidentscientific.com

XV. Personal Data Subject To Singapore Law

You may contact our data protection officer for executing your rights in line with Part 5 of the Personal Data Protection Act 2012 at: apac-privacy@evidentscientific.com.

XVI. Personal Data Subject To Mexican Law

You can contact our data protection officer responsible for Mexico under Americas-privacy@evidentscientifc.com – please mention that your request relates to Mexico.

XVII. Personal Data Subject To Australian Law

See separate privacy statement above “For the Local Policy Statement”

History of revision