Privacy Notice for Suppliers, Service Providers, and Visitors

General Information

1. This Privacy Notice is addressed to:

• a. VeriFone, Inc. and its direct and indirect parent and subsidiary companies listed here (collectively, "Verifone", "Company", or "we"), suppliers and service providers who are individuals (such as self-employed persons);
• b. the representatives, employees, or contact persons of our suppliers and service providers who are legal entities; and
• c. visitors to our facilities.

2. This Privacy Notice outlines the context in which we process your personal data and explains your rights and obligations.

What information do we have about you?

3. We obtain your personal information either directly from you or through the supplier or service provider for whom you work.

4. We may collect various types of personal data about you, including:

• a. your personal information (e.g., first name, last name, email address, address, phone number, identification document, video recording);
• b. information about your employer (e.g., name of your company and your title, position); and
• c. any other information necessary for the purposes of managing our relationship.

5. Additionally, for our suppliers and service providers who are individuals (such as self-employed persons), we may collect the following types of personal data, including:

• a. certain financial information (e.g., bank account details).

6. Additionally, for any person from our suppliers and service providers who have access to our computer systems, we may collect the following types of personal data, including:

• a. information regarding your function at Verifone (e.g., position, business unit, location, time zone, cost center, supervisor/manager);
• b. work-related information (e.g., work order number, identification number, start date and end date, status of any required training, billing rate, and amount);
• c. your electronic identification data where required for the purpose of delivering products or services to our company (e.g., login, passwords, badge number and photograph, IP address, online identifiers/cookies, logs, access and connection times, and CCTV footage or other video surveillance (only if legally permitted and where clearly indicated)); and
• d. certain compliance-related information (e.g., records of required training).

7. If you intend to provide us with personal data about other individuals (e.g., your colleagues), you must provide a copy of this Privacy Notice to them directly or through your employer.

For which purposes do we use your personal data, and why is this justified?

8. Legal basis for the processing:

9. We will not process your personal data without a proper legal basis. Therefore, we will only process your personal data if:

• a. the processing is necessary to take pre-contractual steps with you or to perform our contractual obligations towards you (or the supplier or service provider for whom you work);
• b. it is necessary to comply with our legal or regulatory obligations (e.g., conducting supplier due diligence or exercising our audit rights);
• c. it is necessary for our legitimate interests and does not unduly affect your interests or fundamental rights and freedoms. Please note that, when processing your personal data on this basis, we always seek to maintain a balance between our legitimate interests and your privacy. Examples of ‘legitimate interests' are data processing activities performed:
  • i. to benefit from cost-effective services (e.g., we may opt to use certain platforms offered by suppliers or service providers to process data),
  • ii. to offer our products and services to our customers,
  • iii. to prevent fraud or criminal activity, misuse of our products or services, and to protect the security of our IT systems, architecture, and networks,
  • iv. enable the acquisition of all or part of our business or assets by a third party,
  • v. to meet our corporate and social responsibility objectives;
• d. we have obtained your prior consent; and/or
• e. we are otherwise permitted or required by law to do so.

Purpose of the processing

10. We always process your personal data for a specific purpose and only process the personal data which is relevant to achieve that purpose. In particular, we process your personal data to:

• a. manage our suppliers and service providers;
• b. organize offers, implement tasks in preparation of, or to perform existing engagement contracts;
• c. monitor our facilities to ensure compliance with applicable policies and laws;
• d. grant you access to our facilities and/or certain technologies to allow you to perform services;
• e. manage our technology resources (e.g., cyber-risk management, infrastructure management, and business continuity);
• f. preserve our economic interests and ensure compliance (e.g., complying with our policies and legal requirements, tax and deductions, managing alleged cases of misconduct or fraud, conducting audits);
• g. preserve our legal interests (e.g., enforcing or defending our legal rights);
• h. archiving and record-keeping;
• i. billing and invoicing; and
• j. any other purposes imposed by Verifone applicable laws and governmental authorities.

11. You are under no obligation to provide Verifone with your personal data. However, if you fail to provide personal data when requested, which is necessary for us to manage our relationship with you or your employer as a service provider or supplier (e.g., information necessary to evaluate your qualifications or meet our regulatory and legal obligations), we may not be able to retain your services.

Who has access to your personal data and to whom are they transferred?

12. We will never share/transfer your personal data to third parties other than those indicated in this Privacy Notice. In the course of our activities and for the purposes listed in this Privacy Notice, we may transfer or disclose the personal data we collect to third-party contractors, subcontractors, and their subsidiaries and affiliates. Third parties support the Verifone Network in providing its services and help provide, run, and manage IT systems. Examples of third-party contractors we use are providers of identity management, website hosting and management, data analysis, data backup, security, and cloud storage services. The servers that power and facilitate our IT infrastructure are located in secure data centers around the world, and personal data may be stored in any one of them. The third-party providers may use their own third-party subcontractors that have access to personal data (sub-processors). It is our policy to use only third-party providers that are bound to maintain appropriate levels of security and confidentiality, to process personal information only as instructed by Verifone, and to flow those same obligations down to their sub-processors.

13. Such recipients are obligated to protect the confidentiality and security of your personal data.

14. In certain limited circumstances, your personal data may be accessed by or transferred to law enforcement, regulatory bodies, or judicial authorities. This will occur only when required by law.

15. Your personal data may be transferred to, and processed in, countries other than the country in which you are resident. These countries may have data protection laws that are different from the laws of your country (and, in some cases, may not be as protective). However, we have taken appropriate safeguards to ensure that your personal data will remain protected in accordance with this Privacy Notice. If you are located in the European Economic Area, which is the EU Member States plus Iceland, Liechtenstein, and Norway, where we transfer your personal data to other countries, we rely on:

• a. European Commission adequacy decisions, which acknowledge that the non-EEA countries listed here have national laws that protect personal data to a substantially similar standard required by European Union law;
• b. the European Commission's 2021 Standard Contractual Clauses, which require non EEA recipients of personal data to continue to protect the personal data they receive to the standard required by European Union law;
• c. International data transfer agreement and the international data transfer addendum to the European Commission's standard contractual clauses for international data transfers; or
• d. other lawful data transfer mechanisms or derogations from data transfer restrictions, including an intra-group data transfer agreement in respect of transfers within Verifone Group.

16. When we transfer your personal data to an external company in a country that does not offer adequate protections, we will make sure to protect your personal data by (i) requiring that the third party apply the level of protection required under the applicable local data protection laws, (ii) requiring that the third party act in accordance with our written instructions and our policies and standards and, (iii) unless otherwise specified, only transferring your personal data on the basis of an appropriate contractual mechanism (such as the standard contractual clauses approved by the European Commission).

17. You may request additional information in relation to such cross-border transfers and obtain a copy of the adequate safeguard put in place by Verifone as described in the section titled "Who can I contact if I have any questions or concerns?".

How do we protect your personal data?

18. We take data protection and privacy seriously. We maintain appropriate organizational, technical and physical safeguards designed to protect personal data against accidental, unlawful or unauthorized destruction, loss, alteration, access, disclosure or use. Because submissions of information over the Internet are never entirely secure, we cannot guarantee the security of information you submit via the Internet and such submissions are made at your own risk.

19. We may request that you confirm the personal data we hold about you. You are invited to inform us whenever there is a change in your personal circumstances so we can update your personal data.

How long do we store your personal data?

20. We will only retain your personal data for as long as necessary to fulfill the purpose for which it was collected, or to comply with legal or regulatory requirements, or to protect against legal claims.

What are your rights?

21. Your rights are based primarily on the data protection law of the country in which you are located, and may be limited by regulatory requirements or our lawful basis for processing.

22. You may have one or more of the following rights: (1) to be informed whether we process your personal data and what data is processed; (2) to request correction of processed data, if it is incorrect or incomplete; (3) to oppose the processing and to restrict the processing of your personal data; (4) to ask for the deletion of your personal data; and (5) to request the transfer of your personal data to a third-party.

Who can I contact if I have any questions or concerns?

23. In any case, and in addition to any rights you may have, you may file a complaint with the competent data protection authority in your country. If you have any questions about how your personal data is processed (including if you are unsure of which Verifone entity is the controller), or if you want to exercise one of your rights, please contact privacy@verifone.com and we will consider your request in accordance with applicable data protection laws. To help protect your privacy and maintain security, we may take steps to verify your identity before granting you access to the information.

You can also request to exercise your rights under applicable data protection laws by completing an on-line form available here.

How will you be informed of the changes to our Privacy Notice?

24. You will be informed of any changes or additions to the processing of your personal data through updates to this Privacy Notice available on our website. To assist you, this Privacy Notice has an effective date as shown at the top of the document.