4.1. Service providers

We provide access to or share your personal data with selected third parties who perform services on our behalf. Such parties might be concerned with data-hosting, managing and processing your application, etc. (see list below). We have signed with such providers contracts obliging them to obey at least the same data privacy rules as Shure does. They act only as so-called data processors on our behalf and subject to our instructions. We disclose your data to the following categories of service providers:

• IT service providers (hosting service), Germany, Ireland, Singapore, USA;
• Application management (provider of application management tool), USA

For transfers to service providers in non-EEA (European Economic Area) countries please refer to the section "Transfers of your data to countries outside the EEA ".

4.2. Affiliates

We will share your personal data with other entities of the Shure global group (affiliates as mentioned below) for the purposes as described in this privacy policy (in particular to centralise our HR administration and management processing operations in an efficient manner for the benefit of our staff). However, all affiliates within the Shure group have signed the Controller to Controller Model Clauses for the transfer of personal data to third countries as provided by the European Commission. In such way all Shure entities need to obey the data privacy principles as outlined in this policy and by applicable data privacy law. For further information please refer to the section "Transfers of your data to countries outside the EEA ".

Affiliates including its branches as described herein can be found here.

4.3. Third parties

We also may disclose your personal data to trusted third parties, in particular to those who assist us in managing your application, so long as those parties agree to keep this information confidential. We may disclose your personal data to the following categories of third parties:

• To personnel providers and recruitment agencies who are engaged in certain applications;
• To external auditors in the event of audits or investigations, if there is a legal requirement or legitimate business interest to do so;
• In the event that we are subject to a merger or acquisition to the new owner of the business, if legitimate under applicable laws;
• If we are required to do so by law, statute, regulation, or professional standard, or to respond to a subpoena, search warrant, or other legal request, in response to law enforcement authority or other government official request.

5. Transfers of your personal data to countries outside the EEA

We may transfer personal data to service providers, affiliates or other third parties located outside the European Economic Area ("EEA"). In such cases we ensure prior to the transfer that the European Commission has decided that the third country ensures an adequate level of protection (Art. 45 GDPR, e.g. Switzerland) or that the transfer is either subject to appropriate safeguards, for example by entering into so-called standard data protection clauses of the European Union with the recipient (Art. 46 GDPR). In specific situations we might also ask for your explicit consent to the transfer (Art. 49 GDPR).

You may also receive an overview of third country recipients and a copy of the appropriate or suitable safeguards in place. Please use the details provided in the section "Who controls the processing of your personal data" to request such data.

6. For how long do we keep your personal data?

We store your data as long as it is necessary for the recruitment process or as long as we have a legitimate interest in continued storage. In all other cases, we delete your personal data with the exception of such data that we are required to retain for the purpose of contractual or statutory (e.g., taxation or commercial law) retention periods (e.g., invoices). We keep your personal data for the following periods of time:

If your application is successful, we will keep your data for the duration of your employment with us plus 2 years from the end of our employment relationship or plus any period we are required by statute or contractual obligation to keep the data.

If your application is not successful, we will delete your data within 6 months after your consideration for the job or you have let us know that you are no longer interested in an employment with us, unless you have agreed that we are allowed to keep your data for potentially suitable other vacancies in which case we will delete your personal data as soon as your consent expires or is withdrawn. We will, however, keep your consent log for an additional 4 years in order to be able to provide prove of the fact that you have provided your consent.

For candidates residing in the United States of America, we will keep your personal data in order to consider you for potentially suitable other vacancies. As soon as you notify us that you want us to delete your personal data, we will do as such without undue delay.

7. What are your rights and how can you exercise them?

You have the following rights during the application process and after you were notified that your application was not successful. If you have accepted a job offer of and started working for Shure, Shure will notify you about the respectively applicable privacy regulations.

• Right of access: You have the right to obtain confirmation from us as to whether or not your personal data is being processed and a right to access your personal data that is being processed by us.
• Right of rectification: You also have the right to obtain without undue delay the rectification of any inaccurate personal data relating to you and to have any of your personal data that is incomplete completed. In case we have transferred your personal data to third parties, we will inform them about this rectification and completion if required by law.
• Right to erasure ('right to be forgotten'): You have the right to obtain the erasure of your personal data from us without undue delay and we have the obligation to erase your personal data without undue delay if one of the following grounds applies:
  • your personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
  • the processing of your personal data is based solely on your consent and you have withdrawn your consent;
  • you have objected to direct marketing;
  • you have objected to the processing that is based on our legitimate interest on grounds that relate to your particular situation and there are no overriding legitimate grounds for the processing;
  • your personal data have been unlawfully processed;
  • o your personal data have to be erased for compliance with a legal obligation.

  In case we have transferred your personal data to third parties, we will inform them about this erasure if required by law.

  Please keep in mind that there are limitations to your right to erasure. We are for example not allowed to erase data that we are legally obliged to store (namely due to statutory retention periods). Also, your right to erasure does not apply if we need to store the data for the establishment, exercise or defence of legal claims.

• Right to restriction of processing: You have the right to restrict our processing of your personal data where
  • you contest the accuracy of the personal data until we have taken sufficient steps to correct or verify its accuracy;
  • the processing is unlawful but you do not want us to erase the data;
  • we no longer need your personal data for the purposes of the processing, but you require them for the establishment, exercise or defence of legal claims; or
  • you have objected to processing based on our legitimate interest (see below) pending verification as to whether we have compelling legitimate grounds to continue processing.

  Where personal data is subjected to restriction in this way, we will only process it with your consent or to a very limited extent, e.g. for the establishment, exercise or defence of legal claims.

• Rights to object: You have the right to object to the processing of your personal data that is based on our legitimate interest, on grounds relating to your particular situation, at any time. You also have the right to object to the processing of your personal data for marketing purposes at any time. Please also refer to the section "Information on your rights to object".
• Right to Data portability: Where we rely on your consent or the fact that the processing is necessary for the performance of a contract to which you are party as the legal basis for processing, and that personal data has been provided by you and is processed by automated means, you have the right to receive all such personal data which you have provided to us in a structured, commonly used and machine readable format, and also to require us to transmit it to another controller where this is technically feasible.
• Right to withdraw consent: Where we rely on your consent to process particular information and you have provided us with your consent to process data, you have the right to withdraw such consent at any time. The withdrawal of your consent does not affect the lawfulness of processing based on consent before its withdrawal.
• Right to lodge a complaint with the Supervisory Authority: You have the right to lodge a complaint with a Supervisory Authority. You can appeal in particular to the Supervisory Authority, which is competent for your place of residence or your state or to the (lead) Supervisory Authority which is competent for us.

You may exercise your rights by contacting us via the contact details supplied in the section "Who controls the processing of your personal data?". Please ensure for this purpose that a clear identification of your person is possible for us.

8. Changes to this privacy policy

We reserve the right to amend this privacy policy at any time to reflect changes in the law, our data collection and use practices, or advances in technology. We will make the amended privacy policy available on our websites.