eKinnex Software Privacy Policy –Ergotron, Inc.
Effective as of July 26, 2021

Ergotron eKinnex Privacy Policy
Ergotron, Inc. (“Ergotron”) recognizes and respects the privacy of our services’ users. It is Ergotron’s
policy to comply with all applicable privacy and data protection laws. This commitment reflects the value
we place on earning and keeping the trust of our customers, business partners, employees and others
who share their Personal Information with us.
This eKinnex Software Privacy Policy (this “Policy”) describes how Ergotron protects your privacy when
we collect and use Personal Information when using our eKinnex SaaS software solution, as may be
onboarded on material you may be using within the framework of your professional occupation (“eKinnex
Software”). Unless stated otherwise, as used in this Policy, the term “Personal Information” means
information that identifies you personally as a natural person, directly or indirectly, in particular in
combination with other information available to us such as an identification number, location data, online
identifier or one or more factors specific to your identity as a natural person. Ergotron adheres to thehighest ethical standards in gathering, using, and safeguarding customer’s Personal Information. This
Policy applies, to all personal data processing performed for the use of eKinnex Software, performed by
Ergotron’s business units as well as by our service providers, where any of those parties are either
located within or outside the European Union.
By using an eKinnex Software or providing Personal Information to us, you understand the principles forour collection, use and disclosure of your Personal Information as described in this Policy. If you do notagree with the terms therein, you must not provide your Personal Information, and we may not be able tocommunicate with you or provide certain products or services to you.

Scope of this Policy
Ergotron provides the eKinnex Software to its corporate customers (“Customers”), which subsequently
will make the eKinnex Software available to its personnel. For the major part, the Personal Informationcollected through the use of the eKinnex Software and hosted on its SaaS infrastructure is performed by
Ergotron, as a data processor acting on behalf of Customers, themselves acting as data controllers. In
order to safeguard your privacy, Ergotron enters into a Data Protection Addendum with its Customers.
More information may be available directly from the Customer which employs you.
In addition, Ergotron may also be collecting and processing your Personal Information for the purpose of
improving its services, including the eKinnex Software. When performing those activities, Ergotron will be
acting solely as a data controller without the involvement of the Customer.
This Policy addresses how Ergotron uses your Personal Information in these different frameworks.

Information We Collect
Information we may request includes:•

When acting on behalf of our Customers (“Processor”): your company name, your company
address, your email address, your telephone number(s), login/password to access the eKinnex
Software, use of the hardware to which the eKinnex Software is linked, including its geolocation;oWith regard to geolocation, when using the eKinnex Software as a mobile application,
you will be asked to consent prior to such use. You may withdraw such consent at any
time or uninstall the mobile application at any time.

•When acting as a controller (“Controller”): technical information pertaining to the functioning of theeKinnex Software.

When We Collect Information
Examples of when we may ask you to provide Personal Information include, but are not limited to, whenyou:•

Register to eKinnex Software services and create an account (Processor);•

Use eKinnex Software in the course of your job position (Processor & Controller);•

Ask us to provide you with our support and maintenance services (Processor);•

Contact us, notably in relation with the above (Processor & Controller).

Personal Information may be collected by Ergotron and/or by our third-party service providers acting on
our behalf and under our instructions in providing you with our products or services.

Why We Collect Information
We collect your Personal Information in order to conduct our business functions and operate the services
contracted by our Customers, which include the following:•

providing you with our products and services as well as support in relation thereto (Processor);o•customizing and improving any of our products or services and performing statistical analysis(Controller);o•Legal basis : Legitimate interest - allowing Ergotron to better understand end users’
needs, habits and preferences to improve your experience

complying with a legal requirement or court order (Controller); ando•Legal basis : Legitimate interest - providing you with the eKinnex Software further to theagreement executed between Ergotron & its Customers

Legal basis : Necessary for compliance with legal obligations

defending in, initiating or resolving disputes or legal proceedings and performing or enforcing theagreements to which Ergotron, or one of our business units, is a party (Controller).
oLegal basis : Legitimate interest - allowing Ergotron to enforce or defend its rights

We may otherwise collect, use or disclose your Personal Information, where the collection, use or
disclosure is in accordance with this Policy or any agreement you enter into with us; or required or
authorized by applicable law, including without limitation applicable privacy and data protection laws,
including (EU) Regulation 2016/679 of 27 April 2016 (“GDPR”).

Sharing Personal Information
As a Controller or a Processor, Ergotron will not sell or otherwise provide Personal Information to any
third party for marketing purposes without your express consent.
Ergotron may share your Personal Information with other Ergotron business units. When doing so, theseother Ergotron business units will use your Personal Information in a manner consistent with the purposes
for which it was originally collected and only as permitted under this Policy and all applicable privacy anddata protection laws.
Ergotron may also share your Personal Information with third parties we hire to perform support services
for us. These third parties are required to use the Personal Information we share with them only toperform services on our behalf and under our instructions, in particular to treat your Personal Information

as strictly confidential. In some cases, Ergotron may share your Personal Information with third parties
who act as partners with us to provide products and services to our customers. If we do so, we will require
our business partners to use the Personal Information we share with them in a manner consistent with the
purpose for which it was originally collected (or to which you subsequently consented) and only as
permitted under this Policy and all applicable privacy and data protection laws.
In certain, limited circumstances, where permitted by applicable law, we may share or transfer Personal
Information to unrelated third parties. For example, we may provide Personal Information to a third party(i) at your request; (ii) to comply with a legal requirement or court order; (iii) to investigate a possible
crime, such as identity theft; (iv) in connection with the sale, purchase, merger, reorganization, liquidation
or dissolution of Ergotron or an Ergotron business unit; or (v) under similar circumstances. If such an
event occurs, we will take appropriate steps to protect your Personal Information.

Overseas Transfers and Disclosures
Some of your Personal Information may be transferred, stored, processed or used outside of the U.S.A.
and/or outside of the European Union by Ergotron or by third-party service providers. This may happen if
other Ergotron entities or venture partners are overseas, if we outsource certain activities overseas or if
transactions, information, services or products have an overseas connection.
Your Personal Information may also be disclosed to third-party service providers which may store your
Personal Information in the U.S.A. and European Union, and such other countries in which those partiesor their, or our, computer systems may be located from time to time, where it may be used for the
purposes described in this Policy.
Where required by applicable privacy and data protection laws, we take steps in order to ensure any
overseas transfer of Personal Information is performed in compliance with the appropriate organizational
and technical means (including e.g. EU Commission’s model clauses for data transfers or European
Commission’s adequacy decisions). Where such parties are located overseas, you may have rights toenforce such parties’ compliance with applicable privacy and data protection laws.

Retention of Personal Information
Ergotron may retain the Personal Information collected in the performance of services related to eKinnex
Software as long as necessary to provide the services, products you request or as mandated or permitted
by applicable law (e.g., statute of limitations). If your Personal Information is no longer necessary for
purposes for which it is processed and we have no legal obligation to retain that Personal Information, we
will remove it from our systems and destroy all record of it.

Choices about Your Personal Information
Review and Request Changes to Your Personal Information
You may use your account to access, correct, or view certain Personal Information we have collected andwhich is associated with your account. To review or request changes to any of your Personal Information,please contact us as described in the “Contacting Us” section below.
Marketing Communications
To unsubscribe from our marketing emails, please click the unsubscribe link included in the footer of ouremails. You also may submit a request to us as described in the “Contacting Us” section below.

YOUR RIGHTS – EUROPEAN UNION AND THE UNITED KINGDOM ONLY
Where GDPR applies to the data processing we implement on our own behalf or on behalf of ourCustomers (e.g. you are an individual employed by a Customer in a country in the European Union or in
the United Kingdom), the following applies to you. When Ergotron acts as a Controller, you may exercise
those rights directly with us. When Ergotron acts as a Processor, you may exercise those rights with therelevant Customer which employs you.

Right to Access Personal Information
You are entitled to access Personal Information that we hold about you. If you request access to your
Personal Information, in ordinary circumstances we will give you access to your Personal Information.
However, there may be some legal or administrative reasons to deny access. If we refuse your request toaccess your Personal Information, we will provide you with reasons for the refusal where we are requiredby law to give those reasons.

Right to Correct Personal Information
You can access and correct some of your Personal Information through our web sites by contacting us
via telephone or email using the details provided below.
We take all reasonable steps to ensure that any Personal Information we collect and use is accurate,complete and up-to-date. To assist us in this, you need to provide true, accurate, current and complete
Personal Information about yourself as requested, and properly update the Personal Information provided
to us to keep it true, accurate, current and complete. Please tell us, by contacting us in any of the ways
specified in this Policy, if any change occurs in the Personal Information you provided us or, if you believethat your Personal Information is inaccurate or incomplete, and we will correct the information.

Right to Restrict Our Use of Personal Information
You have the right to ask us to place a restriction on our use of your Personal Information if one of thefollowing applies to you:•

You contest the accuracy of the information that we hold about you, while we verify its accuracy;•

We have used your information unlawfully, but you request us to restrict its use instead of erasingit;•

We no longer need the information for the purpose for which we collected it, but you need it todeal with a legal claim; or•

You have objected to us using your information, while we check whether our legitimate grounds
override your right to object.

Right to Object to Our Use of Personal Information
You have the right to object to our use of your Personal Information where our reason for using it is basedon our legitimate interests or your consent (rather than when the reason for using it is to perform an
obligation due to you under a contract with us).

Right to Request Deletion of Personal Information
You can ask us to delete your Personal Information if:•

We no longer need it for the purposes for which we collected it;•

We have been using it with no valid legal basis;•

We are obligated to erase it to comply with a legal obligation to which we are subject;•

We need your consent to use the information and you withdraw consent;•

You object to us processing your Personal Information where our legal basis for doing so is ourlegitimate interests and there are no overriding legitimate grounds for the processing.

However, this right is not absolute. Even if you make a request for deletion, we may need to retain certain
information for legal or administrative purposes, such as record keeping, maintenance of opt-out
requirements, defending or making legal claims, or detecting fraudulent activities.

If you do exercise a valid right to have your Personal Information deleted, please keep in mind that
deletion by third parties to whom the information has been provided might not be immediate and that thedeleted information may persist in backup copies for a reasonable period (but will not be available toothers).

Right to Make a Complaint
If you have any concerns or complaints regarding our processing of your Personal Information, pleasecontact us as described in the “ Contacting Us” section below and we will do our best to answer any
question and resolve any complaint to your satisfaction.
If you are not satisfied with our answer or the way we process your personal information pursuant to thisPolicy, you may also have the right to lodge a complaint with a data protection authority or the competentcourt. If you reside within the European Union, a list of national data protection authorities can befound here. The website for United Kingdom’s data protection authority can be found here.

Limitations on the Collection, Use and Disclosure of Personal
Information
To the extent required by applicable European law, whenever Ergotron collects Personal Information
while performing eKinnex Software related services, Ergotron will:•

Collect, use, disclose and transfer your Personal Information only with your consent whenrequired, depending on the sensitivity of the Personal Information, legal requirements, direct
marketing by third parties and other factors. You have the right to withdraw your consent at any
time without affecting the lawfulness of the processing based on consent before its withdraw;•

Collect your Personal Information only for specific, limited and legitimate purposes. This
information we collect will be relevant, adequate and not excessive for the purposes for which it iscollected;•

Process your Personal Information in a manner consistent with the purpose for which it was
originally collected or to which you have subsequently consented;•

Take commercially reasonable steps to ensure that your Personal Information is reliable for its
intended use, accurate, complete, and, where necessary, and subject to your updates, kept upto-date;•

Not use your Personal Information for direct marketing purposes by Ergotron without giving you
an opportunity to “opt-out”; and,•Take appropriate measures, by contract or otherwise, to provide adequate technical andorganizational protection for Personal Information that we collect and use, and for Personal
Information that is disclosed to a third party or transferred to another country, including transfers
within Ergotron.

Legal Basis for Processing Your Personal Information
The legal basis for collecting and using your Personal Information will depend on the Personal
Information concerned and the specific context in which we collect it, which is discussed below. We
primarily use your information to authenticate your right to use the eKinnex Software.

NOTICE TO NEVADA RESIDENTS
Nevada law allows Nevada residents to opt-out of the sale of certain types of personal information.
Subject to several exceptions, Nevada law defines “sale” to mean the exchange of certain types of
personal information for monetary consideration to another person. We do not currently sell personal
information as defined in the Nevada law. However, if you are a Nevada resident, you still may submit averified request to opt-out of sales and we will record your instructions and incorporate them in the future
if our policy changes. Opt-out requests may be sent Privacy@ergotron.com.

NOTICE TO CALIFORNIA RESIDENTS
The California Consumer Privacy Act (“CCPA”) requires that we provide California residents with a
privacy policy that contains a comprehensive description of our online and offline practices regarding thecollection, use, disclosure, and sale of personal information and of the rights of California residents
regarding their personal information. This section of the Privacy Policy is intended solely for, and isapplicable only as to, California residents. If you are not a California resident, this does not apply to you
and you should not rely on it.
The CCPA defines “personal information” to mean information that identifies, relates to, describes, isreasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with aparticular California resident or household. Personal information does not include publicly available,
deidentified or aggregated information. For purposes of this “ Notice to California Residents” section,references to “Personal Information” are to this definition as distinguished from how we use that phrase inother portions of this Policy.
Your rights under the CCPA may be dependent upon the capacity in which we are acting. When acting on
behalf of our Customers, we act as a “service provider” under the CCPA and our collection of Personal
Information is done on behalf of our Customers. When acting on our own behalf, we act as a “business”
under the CCPA and our collection of Personal Information is done on our own behalf.

Right to Know about Personal Information Collected, Disclosed, or Sold
If you are a California resident, you have the right to request that we disclose what Personal Information
we have collected about you in our capacity as a business under the CCPA. This right includes the rightto request any or all of the following:
1. Specific pieces of Personal Information that we have collected about you;
2. Categories of Personal Information that we have collected about you;
3. Categories of sources from which the Personal Information was collected;
4. Categories of Personal Information that we sold (if applicable) or disclosed for a businesspurpose about you;
5. Categories of third parties to whom the Personal Information was sold (if applicable) or disclosed
for a business purpose; and6. The business or commercial purpose for collecting or, if applicable, selling Personal Information.
The CCPA defines “sell” to mean selling, renting, releasing, disclosing, disseminating, making available,transferring, or otherwise communicating orally, in writing, or by electronic or other means, a California
resident’s Personal Information to another business or a third party for monetary or other valuable
consideration.
Collection of Personal Information
Collectively acting in our service provider and business capacities, we currently collect and, in the 12months prior to the Effective Date of this Privacy Policy, have collected the following categories of
Personal Information about California residents directly from them:•

Identifiers (name, email address and account name)•

Unique personal identifier (assigned drawer access PIN)•

Telephone number•

Geolocation

•Professional or employment-related information (company name and address)

In addition to the purposes stated in the “ Why We Collect Information” section above, we collected theabove Personal Information for the following business or commercial purposes:•

Maintaining or servicing accounts•

Processing or fulfilling orders and transactions•

Providing customer service•

Providing access to the eKinnex Software•

Verifying customer information•

Detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity,and prosecuting those responsible for that activity•

Debugging to identify and repair errors that impair existing intended functionality•

Undertaking internal research for technological development and demonstration•

Undertaking activities to verify or maintain the quality or safety of a service or device that is
owned, manufactured, manufactured for, or controlled by us, and to improve, upgrade, or
enhance the service or device that is owned, manufactured, manufactured for, or controlled by us

Disclosure or Sale of Personal Information
In the 12 months preceding the Effective Date of this Privacy Policy, we disclosed the Personal
Information described above to cloud service providers for the purpose of storing and processing theinformation in order to provide the subject service. We also disclosed the Personal Information to our enduse customer in our capacity as a processor/service provider. We did not sell the Personal Information
described above to any third parties in the 12 months preceding the Effective Date of this Privacy Policy.
We do not knowingly collect or sell the Personal Information of minors under 16 years of age.

Right to Request Deletion of Personal Information
If you are a California resident, you have the right to request that we delete the Personal Information
about you that we have collected in our capacity as a business under the CCPA. However, per the CCPA,
we are not required to comply with a request to delete if it is necessary for us to maintain the Personal
Information in order to, for example, complete a transaction, detect security incidents, comply with a legal
obligation, or otherwise use the Personal Information, internally, in a lawful manner that is compatible withthe context in which you provided the information.

How to Submit a Request to Know or Delete
You may submit a request to know or delete through our interactive webform available here or by calling
us at 1-800-888-8458.
If you submit a request to delete online, you may be asked to confirm separately that you want your
Personal Information deleted.

Our Process for Verifying a Request to Know or Delete
If we determine that your request is subject to an exemption, we will notify you of our determination. If wedetermine that your request is not subject to an exemption, we will comply with your request uponverification of your identity and, to the extent applicable, the identity of the California resident on whose
behalf you are making such request. We will verify your identity either to a “reasonable degree ofcertainty” or a “reasonably high degree of certainty” depending on the sensitivity of the Personal
Information and the risk of harm to you by unauthorized disclosure or deletion as applicable.

For requests to access categories of Personal Information and for requests to delete Personal Informationthat is not sensitive and does not pose a risk of harm by unauthorized deletion, we will verify your identity
to a “reasonable degree of certainty” by verifying at least two data points that you previously provided tous and which we have determined to be reliable for the purpose of verifying identities.
For requests to access specific pieces of Personal Information or for requests to delete Personal
Information that is sensitive and poses a risk of harm by unauthorized deletion, we will verify your identity
to a “reasonably high degree of certainty” by verifying at least three pieces of Personal Information
previously provided to us and which we have determined to be reliable for the purpose of verifying
identities. In addition, you will be required to submit a signed declaration under penalty of perjury statingthat you are the individual whose Personal Information is being requested.

Right to Opt-Out of Sale of Personal Information
If you are a California resident, you have the right to direct businesses to stop selling your Personal
Information. We do not sell Personal Information as it is defined in the CCPA.

Right to Non-Discrimination for the Exercise of a California Resident’s
Privacy Rights
We will not discriminate against California residents if they exercise any of the rights provided in the
CCPA as described in this section “ Notice to California Residents.”.

Authorized Agents
If you are submitting a request on behalf of a California resident, please submit the request through oneof the designated methods discussed above. After submitting the request, and if the request is not subject
to an exemption or exception, we will require additional information to verify your authority to act on behalfof the California resident.

Data Disclosure to Third Parties
We do not disclose Personal Information obtained through our eKinnex Software to third parties for theirdirect marketing purposes. Accordingly, we have no obligations under California Civil Code § 1798.83.

Changes to this Policy or our Privacy Statements
We reserve the right to update or modify this Policy at any time and without prior notice by posting therevised version of this Policy on our Ergotron web sites.

Accessibility
We are committed to ensuring this Policy is accessible to individuals with disabilities. If you wish toaccess this Policy in an alternative format, please contact us as described below.

Contacting Us
If you would like to contact us for any reason regarding our privacy practices and/or would like todiscontinue our use of your personal information, please write to us at the following address:

Outside of the European Union:
Ergotron, Inc.
Attention: Legal Department
1181 Trapp Road
St. Paul, MN 55121
Privacy@ergotron.com

Within the European Union or theUnited Kingdom:
Ergotron Europe
Attention: Privacy
Beeldschermweg 3 3821 AH
Amersfoort UT 3821 AH

Netherlands
PrivacyEU@ergotron.com