10.1 General information and joint controllership

We are using a common cloud-based application for managing our business relationships ("CRM Tool") together with our parent company Shure Incorporated located in the USA and some of our Affiliates and partners supporting us in sales and consultancy activities ("Participating Entities"). A current list of the Participating Entities can be requested by sending a request to privacy@shure.com. Each Participating Entity that is located outside the EEA and has access to personal data of a resident of a member state of the European Union is required to sign the Controller to Controller Model Clauses for the transfer of personal data to third countries as provided by the European Commission. In such way all of them need to obey the data privacy principles as outlined in this policy and by applicable data privacy law. For further information, please refer to the section "Transfers of your data to countries outside the EEA".

Data that is entered into the CRM Tool is stored in a cloud and can generally be processed by all Participating Entities which have a legitimate business reason to do so, but processing is limited to persons which require this information for their tasks, namely marketing and sales department on a need-to-know basis.

When processing this data, we and the relevant Participating Entities act as joint controllers in the meaning of Art. 26 GDPR, which is why we have entered into a joint controller agreement with the relevant Participating Entities for the processing relating to the CRM Tool.

This CRM Tool is provided to us by Salesforce Inc. in the U.S. ("Salesforce"), a company that acts as a processor on behalf of the Participating Entities.  

Table of Contents

10.2 What are the purposes of the CRM Tool and legal bases?

Our CRM Tool enables us and the other Participating Entities to facilitate and improve communication with our business partners in compliance with data protection law requirements. It provides us with the opportunity to share important contact details with any person involved in the marketing and sales of Shure products or providing consultancy services or technical support for Shure products that needs to access it. This way, we are able to approach our business partners in a more effective way and at the same time ensure consistency and accuracy of personal data stored about such business contacts.

The legal basis for the processing is our legitimate interest: We and the other Participating Entities have a legitimate interest in effectively managing our B2B contacts and sharing this information with other Shure affiliates and our distribution partners if they have a respective legitimate business interest.

To be able to provide you with direct marketing communication regarding the services and products we offer (including by email newsletter) we obtain your prior consent if required under applicable laws or rely on our legitimate interest in direct marketing if you have not objected to such marketing and if consent is not necessary.

Table of Contents

10.3 Which categories of personal data are processed in relation to the CRM tool?

We enter the following categories of data into the tool: Business contact information like name, company name, business phone number, business email address, business mobile number, employer, description of historic events, management of preferences, created by and modified contact information.

If we provide consultancy services or technical support we may also enter information about your current projects requiring audio equipment (e.g., "equipment of conference room") and - if available - information on the seller you or the company you are working for has bought Shure products from in the past.

Table of Contents

10.4 Which are the sources of our information?

Typically we collect your personal data directly from you (e.g., if you provide us with your business card or send us an email).

In addition, we may also obtain information from your employer or from companies which sell our products to you or to your employer/the company you are working for. In such cases we potentially collect the following categories of data: Business contact information like name, company name, business phone number, business email address, business mobile number, employer and information on the project requiring audio equipment you are currently working on.

Table of Contents

10.5 Which rights do you have?

You in particular have the right to object to the processing of your personal data that is based on our legitimate interest, on grounds relating to your particular situation, at any time and to object to the processing of your personal data for marketing purposes at any time. Please also refer to the section "Information on your rights to object".

Where we rely on your consent to process particular information, you also have the right to withdraw such consent at any time. The withdrawal of your consent does not affect the lawfulness of processing based on consent before its withdrawal.

For further information on your rights please refer to the section "What are your rights and how can you exercise them?"

Table of Contents

10.6 Who is responsible for dealing with the rights I exercise as a data subject?

Each Participating Entity remains responsible for complying with any exercise of your rights as a data subject that relate to the processing of your personal data through our CRM Tool. Therefore, if you would like for example access to your data stored in the CRM Tool or would like to object to marketing you may contact the Participating Entity you usually deal with.

In addition to that, you can always get in touch with our single point of contact for the CRM Tool (please see the section "Single point of contact" for contact details).

Table of Contents

10.7 Who is responsible for providing the information referred to in Articles 13 and 14 GDPR to me?

The information referred to in Articles 13 and 14 GDPR, e.g. purposes of the processing and storage periods, will be provided to you by the entity which has first entered your data in the CRM tool.

In addition to that, you can always get in touch with our single point of contact for the CRM Tool if you have any questions regarding this (please see the section "Single point of contact" for contact details).

Table of Contents

10.8 Single point of contact

If you have any questions, concerns or complaints regarding our CRM Tool and the way we use it, would like to change your marketing preferences or update information we hold about you or have any other privacy related requests, please contact the single point of contact we have established to this end at:

privacy@shure.com

Table of Contents

11.1. General information and the controller of your data

Participation in market research surveys is completely voluntary and you may choose whether or not to participate and therefore disclose personal data. The data requested may include contact information (such as name and email address), demographic information (such as country, occupation, age), information on how you use Shure products and services, feedback to us on our products and services, and your input on future product development and marketing efforts with regard to our products and related services including support.

The controller of the personal data you provide in market research surveys will always be the entity identified to you as controller in the respective market research survey.

Table of Contents

11.2 What are the purposes for market research and legal bases?

The Shure entity collecting the information from you (the controller of your data) will process the personal data you provide in these market research surveys in order to help the Shure group of companies to develop new products and services and to improve marketing and support by learning how Shure products and services are used by our customers and by gathering general customer feedback.

Your responses to market research questions and information will in particular be used to detect trends by analyzing aggregated data. Furthermore, your responses and information about how you connected to the survey will be used to administer the survey and may be also used to communicate with you about the survey and to provide you with incentives for completing it. In addition, your responses and information about how you connected to the survey may also be evaluated for future market research, including for the decision whether you are the person to ask to participate in a specific future market research study.

The legal basis are the respective controller's legitimate interests: It has a legitimate interest in gathering customer feedback and opinions provided by customers on a voluntary basis in order help the Shure group of companies to develop new products and services and to improve its marketing and support.

To be able to contact you and ask you whether you would like to participate in market research (including by email) we obtain your prior consent if required under applicable laws or rely on our legitimate interest in conducting market research if you have not objected to such contacts and if consent is not necessary.

The information you provide in market research surveys will be stored for the time necessary for the respective purpose of the survey but for no longer than four years after the survey has been conducted. In case we have obtained your consent in order to contact you about market research and you withdraw your consent or if you request us to delete your personal data, we will anonymize the information you have provided to us in market research surveys in the past. We will, however, continue to store your former consent (if any) for a certain time (typically two more years) for reasons of proof.

Table of Contents

11.3 Do we share and disclose your data?

The Shure entity acting as data controller will not disclose any personal information you provide in the context of market research to any third party, including other Shure Group entities.

The controller will, however, engage service providers, in particular in order to provide a survey software platform (creation and distribution of surveys, analysis and reports on survey data, management of information on respondents who complete surveys). The controller may also hire a service provider for limited services such as packaging, mailing and delivering products. The respective service providers are engaged as data processors which only process personal data on the controller's behalf. Furthermore, they only receive the information they need to deliver the respective services. For further information see section "Service Providers", for potential transfers of data to service providers in countries outside the EEA see section "Transfers of your data to countries outside the EEA".

Table of Contents

11.4 Which rights do you have?

You in particular have the right to object to the processing of your personal data that is based on our legitimate interest, on grounds relating to your particular situation, at any time and to object to the processing of your personal data for marketing purposes at any time. Please also refer to the section "Information on your rights to object" and for California residents please see the section "Important Rights for CA Residents".

Where we rely on your consent to contact you in order to contact you regarding participation in further market research, you also have the right to withdraw such consent at any time. The withdrawal of your consent does not affect the lawfulness of processing based on consent before its withdrawal.

For further information on your rights please refer to the section "What are your rights and how can you exercise them?" and for California residents please see the section "Important Rights for CA Residents"

Table of Contents

12.1 Service Providers

We provide access to or share your personal data with selected third parties who perform services on our behalf. Such parties might be concerned with the delivery of our products to you, data-hosting, collection of debts, analytics, etc. (see list below). We have signed with such providers contracts obliging them to obey at least the same data privacy rules as Shure does. They act only as so-called data processors on our behalf and subject to our instructions. We disclose your data to the following categories of service providers:

• Shipping and payment service provider (shipping and payment), Germany, UK, Netherlands;
• Customer administration (collection of debts), Germany, UK;
• Contact form provider (handling customer contact), USA;
• IT service providers (hosting service), Germany; Ireland, Singapore, USA;
• Provider of CRM-tool (Switzerland, USA);
• Newsletter service provider (handling of newsletters), USA;
• Provider of website analytics tools (website analytics), USA, please see also the section "Website Analytics");
• Map, location-based service providers, USA, China;
• Survey software platform (creation and distribution of surveys, analysis and reports on survey data, management of information on respondents who complete surveys), USA;
• Provider of content delivery network, USA
• Provider of communication platform, USA
• Packaging, mailing and delivery of products, USA, China, Germany, UK, Russia, Dubai, Hongkong, Japan, Singapore, Mexico.

For transfers to service providers in non-EEA countries please refer to the section "Transfers of your data to countries outside the EEA".

Table of Contents

12.2 Affiliates

We will share your personal data with other entities of the Shure global group (affiliates as mentioned below) for the purposes as described in this privacy policy. However, all affiliates within the Shure group have signed the Controller to Controller Model Clauses for the transfer of personal data to third countries as provided by the European Commission. In such way all Shure entities need to obey the data privacy principles as outlined in this policy and by applicable data privacy law. For further information please refer to the section "Transfers of your data to countries outside the EEA".

We also may disclose your personal data to trusted third parties who assist us in conducting our business, or servicing you and the fulfillment of your order, so long as those parties agree to keep this information confidential. We may disclose your personal data to the following categories of third parties:

• For joint management of B2B contacts with our trusted distribution partners (for details refer to section "Managing our B2B contacts");
• For the shipping of goods to postal service providers;
• To external auditors in the event of audits or investigations, if there is a legal requirement or legitimate business interest to do so;
• In the event that we are subject to a merger or acquisition to the new owner of the business, if legitimate under applicable laws;
• If we are required to do so by law, statute, regulation, or professional standard, or to respond to a subpoena, search warrant, or other legal request, in response to law enforcement authority or other government official request.

For transfers to third parties in non-EEA countries please refer to the section "Transfers of your data to countries outside the EEA".

Table of Contents