Binding Corporate Rules Controller Policy

Align Technology
Data Protection Binding Corporate Rules
Controller Policy

Change Log
9 June 2014

Original

23 April 2019

Updated due to General Data Protection Regulation© 2019 Align Technology, Inc. All rights reserved.

Page 1

Binding Corporate Rules Controller Policy

Contents

INTRODUCTION

3PART I: BACKGROUND AND ACTIONS

4PART II: CONTROLLER OBLIGATIONS

6PART III: APPENDICES

15

Contents© 2019 Align Technology, Inc. All rights reserved.

Page 2

Binding Corporate Rules Controller Policy

INTRODUCTION TO THIS POLICYThis Data Protection Binding Corporate Rules Controller Policy (“Policy”) establishes Align's approach tothe protection and management of personal information globally by Align group members listed atwww.aligntech.com ("Group Members"), when collecting and using that information for their own
purposes.
Scope of this Policy
This Policy applies when we process personal information as a controller and transfer personal
information between Group Members. The standards described in the Controller Policy are worldwide
standards that apply to all Group Members when processing personal information as a controller. As
such, this Policy applies regardless of the origin of the personal information that we process, the country
in which we process personal information, or the country in which a Group Member is established.
Types of personal information within the scope of this Policy
This Policy applies to all personal information that we process as a controller including personal
information processed in the course of business activities, employment administration and vendor
management – such as:Human resources data: including personal information of past and current employees,
individual consultants, independent contractors, temporary staff and job applicants;Customer relationship management data: including personal information relating tophysicians who use our services;

Marketing data: including personal information relating to patients and physicians who wemarket our services to; andSupply chain management data: including personal information of individual contractors andof account managers and staff of third party suppliers who provide services to us.

Our collective responsibility to comply with this Controller Policy
All Group Members and their staff must comply with and respect this Policy when collecting and using
personal information for their own purposes, irrespective of the country in which they are located.
This Policy does not replace any specific data protection requirements that might apply to a business areaor function.
Management commitment and consequences of non-compliance
Align's management is fully committed to ensuring that all Group Members and their staff comply withthis Policy at all times. Non-compliance may cause Align to be subject to sanctions imposed by competent
data protection authorities and courts, and may cause harm or distress to individuals whose personal
information has not been protected in accordance with the standards described in this Policy.
In recognition of the gravity of these risks, staff members who do not comply with this Policy will be
subject to disciplinary action, up to and including dismissal.
Where will this Controller Policy be made available?
This Policy will be published on the website accessible at www.aligntech.com.

© 2019 Align Technology, Inc. All rights reserved.

Page 3

Binding Corporate Rules Controller Policy

PART I: BACKGROUND AND ACTIONSWHAT IS DATA PROTECTION LAW?
Data protection law gives people the right to control how their “personal information”1 is used. When
Align collects and uses the personal information of consumers, physicians, employees and suppliers this iscovered and regulated by data protection law.
Under data protection law, when an organisation collects, uses or transfers personal information for its
own purposes, that organisation is deemed to be a controller of that information and is therefore
primarily responsible for meeting the legal requirements. When, on the other hand, an organisationcollects and/or uses information on behalf of a third party (for example, to provide a service), thatorganisation is deemed to be a processor of the information and the third party will be primarily
responsible for meeting the legal requirements.
HOW DOES DATA PROTECTION LAW AFFECT ALIGN INTERNATIONALLY?
Data protection law does not allow the transfer of personal information to countries outside Europe 2 that
do not ensure an adequate level of data protection. Some of the countries in which Align operates are notregarded by European data protection authorities as providing an adequate level of protection for
individuals’ data privacy rights.
WHAT IS ALIGN DOING ABOUT IT?
In order to comply with the law, Align must take proper steps to ensure that its use of personal
information on an international basis is safe and, hence, lawful. The purpose of this Policy, therefore, is toset out a framework to satisfy the standards contained in European data protection law and, as a result,provide an adequate level of protection for all personal information used and collected in Europe andtransferred from Group Members within Europe to Group Members outside Europe.
Align will apply this Policy globally where Align collects and uses personal information both manually andby automatic means when the personal information relates to consumers, physicians, employees andsuppliers.
This Policy applies to all Group Members and their staff worldwide and requires that Group Members
who collect, use or transfer personal information as a controller must comply with the Rules set out inPart II of this Policy together with the policies and procedures set out in the appendices in Part III of thisPolicy.
For completeness, Group Members must comply with the Data Protection Binding Corporate Rules
Processor Policy when they collect, use or transfer personal information as a processor. Some Group
Members may act as both a controller and a processor and must therefore comply with this Policy andalso the Data Protection Binding Corporate Rules Processor Policy as appropriate.
FURTHER INFORMATION
If you have any questions regarding the provisions of this Policy, your rights under this Policy or any
other data protection issues you can contact Align's Data Protection Officer at the address below who will
either deal with the matter or forward it to the appropriate person or department within Align.
Attention:
Email:
Address:

Data Protection Officer
Privacy@aligntech.com
Align Technology B.V, Arlandaweg 161, 1043 HS Amsterdam, The Netherlands

1 Personal information means any information relating to an identified or identifiable natural person in line with the definition of“personal data” in the General Data Protection Regulation 2016/679.
2 For the purpose of this Policy reference to Europe means the European Economic Area and Switzerland.

© 2019 Align Technology, Inc. All rights reserved.

Page 4

Binding Corporate Rules Controller Policy

The Data Protection Officer is responsible for ensuring that changes to this Policy are communicated to
the Group Members and to individuals whose personal information is collected and used by Align.
If you are unhappy about the way in which Align has used your personal information, Align has a separate
complaint handling procedure which is set out in Part III, Appendix 4.

© 2019 Align Technology, Inc. All rights reserved.

Page 5

Binding Corporate Rules Controller Policy

PART II: CONTROLLER OBLIGATIONSThis Policy applies in all cases where a Group Member collects, uses and transfers personal information
as a controller.
Part II of this Policy is divided into three sections:

Section A addresses the basic principles of European data protection law that a Group Member
must observe when it collects, uses and transfers personal information as a controller.

Section B deals with the practical commitments made by Align to the European data protection
authorities in connection with this Policy.

Section C describes the third party beneficiary rights that Align has granted to individuals underPart II of this Policy.

SECTION A: BASIC PRINCIPLESRULE 1 – COMPLIANCE WITH LOCAL LAW
Rule 1 – Align will first and foremost comply with local law where it exists.
As an organisation, Align will comply with applicable legislation relating to personal information (e.g. in
Europe, the Europe's General Data Protection Regulation 2016/679 and any local law supplementing it asamended or replaced from time to time) and will ensure that where personal information is collected andused this is done in accordance with applicable local law.
Where there is no law or the law does not meet the standards set out by the Rules in this Policy, Align ’s
position will be to collect and use personal information adhering to the Rules in this Policy.
RULE 2 – ENSURING FAIRNESS AND TRANSPARENCY AND USING PERSONAL INFORMATION FOR A
KNOWN PURPOSE ONLY
Rule 2A – Align will explain to individuals, at the time their personal information is collected,
how that information will be used.
Align will ensure that individuals are told in a concise, transparent, intelligible and easily accessible form,
using clear and plain language, (usually by means of a privacy statement) how their personal information
will be used. The information that Align has to provide includes the following (Fair Information
Disclosures):

the identity of the data controller and its contact details;the contact details of the data protection officer;the purposes of the processing for which the personal information are intended as well as thelegal basis for the processing;

where the processing is based on Align's or a third party's legitimate interests, the legitimate
interests pursued by Align or by the third party;

the recipients or categories of recipients of their personal information (if any);where applicable, the fact that a Group Member in Europe intends to transfer personal
information to a third country or international organisation outside of Europe, and the measuresthat the Group Member will take to ensure the personal information remains protected inaccordance with European Union law.

© 2019 Align Technology, Inc. All rights reserved.

Page 6

Binding Corporate Rules Controller Policy

In addition to the information above, Align shall, at the time when personal information are obtained,
provide individuals with the following further information necessary to ensure fair and transparent
processing:the period for which the personal information will be stored, or if that is not possible, the criteria
used to determine that period;

information about the individuals' rights to request access to, rectify or erase their personal
information, as well as the right to restrict or object to the processing, and the right to data
portability;

where the processing is based on consent, the existence of the right to withdraw consent at any
time, without affecting the lawfulness of processing based on consent before its withdrawal;



the right to lodge a complaint with the competent supervisory authority;

whether the provision of personal information is a statutory or contractual requirement, or arequirement necessary to enter into a contract, as well as whether the individual is obliged toprovide the personal information and of the possible consequences of failure to provide suchinformation;the existence of automated decision-making, including profiling, and, where such decisions may
have a legal effect or significantly affect the individuals whose personal information are collected,
any meaningful information about the logic involved, as well as the significance and theenvisaged consequences of such processing for those individuals.

Where personal information has not been obtained directly from the individuals concerned, Align shallprovide those individuals, in addition to the information above, with the following information:the categories of personal information that are being processed; and

from which source the personal information originates, and if applicable, whether it came frompublicly accessible sources.

This information will be provided when personal information is obtained by Align from the individual or,
if not practicable to do so at the point of collection, as soon as possible after that. In limited cases, Align
may not need to provide the Fair Information Disclosures (for example, because the individual alreadyhas the information, the provision of the Fair Information Disclosures may prove impossible or involve a
disproportionate effort, or where otherwise permitted by law). Where this is the case, Align shall decide
what course of action is appropriate to protect the individual's rights, freedoms and legitimate interests.
Where Align obtains an individual's personal information from a source other than that individual, Align
will provide this information to the individual when their personal information is first recorded or, if it is
to be disclosed to a third party, no later than the time when the data is first disclosed.
Align will follow this Rule 2A unless there is a legitimate basis for not doing so (for example, where it isnecessary to safeguard national security or defence, for the prevention or detection of crime, taxation
purposes, legal proceedings, or where otherwise permitted by law).
Rule 2B – Align will only obtain and use personal information for specified, explicit andlegitimate purposes.
This rule means that Align will identify and make known the purposes for which personal information
will be used (including the secondary uses and disclosures of the information) when such information is
obtained or, if not practicable to do so at the point of collection, as soon as possible after that, unless there
is a legitimate basis for not doing so as described in Rule 2A.

© 2019 Align Technology, Inc. All rights reserved.

Page 7

Binding Corporate Rules Controller Policy

Rule 2C – Align may only collect and use personal information collected in Europe for a different
or new purpose that is incompatible with the purposes state at Rule 2B if Align has a lawful basis
for doing so.
If Align collects personal information for a specific purpose (as communicated to the individual via therelevant fair information disclosure) and subsequently Align wishes to use the information for a different
or new purpose which is incompatible with the original purpose, Align must ordinarily obtain theindividual's consent unless it has an alternative lawful basis for the new use that is consistent withapplicable data protection law.
RULE 3 – ENSURING DATA QUALITY
Rule 3A – Align will keep personal information accurate and up to date.
In order to ensure that the personal information held by Align is accurate and up to date, Align actively
encourages individuals to inform Align when their personal information changes.
Align will take every reasonable step to ensure that personal information that is inaccurate, having regard
to the purposes for which they are processed, is erased or rectified without delay.

Rule 3B – Align will only keep personal information for as long as is necessary.
Personal information will be retained and/or deleted to the extent required by applicable law, regulationand professional standards and in line with Align's Record Retention Policy as updated and amended
from time to time and related procedures.
Rule 3C – Align will only keep personal information which is adequate, relevant and limited towhat is necessary in relation to the purposes for which it is processed.
Align will identify the minimum amount of personal information that is required in order to properly
fulfil its purposes.
RULE 4 – SECURITY AND CONFIDENTIALITY
Rule 4A – Align will always adhere to its IT security policies.
Align will implement appropriate technical and organizational measures to protect personal
information against accidental or unlawful destruction or accidental loss, alteration, unauthorised
disclosure or access, in particular where processing involves transmission of personal information overa network, and against all other lawful forms of processing. Such measures will ensure a level of
security appropriate to the risk.
Align will comply with the requirements contained in the security policies in place within Align asrevised and updated from time to time together with any other security procedures relevant to abusiness area or function. Align will implement and comply with breach notification policies as
required by applicable data protection law. In particular, Align employees shall be under an obligation
to notify without undue delay any personal data breaches to Align's Data Protection Officer and Align’sInformation Security team. Align will notify the supervisory authority where there is a risk to the rights
and freedoms of data subjects and will notify the data subjects where the personal data breach is likely
to result in a high risk to their rights and freedoms. Furthermore, any personal data breaches should be
documented (comprising the facts relating to the personal data breach, its effects and the remedialaction taken) and the documentation should be made available to the supervisory authority on request .

© 2019 Align Technology, Inc. All rights reserved.

Page 8

Binding Corporate Rules Controller Policy

Align will ensure that any staff member who has access to or is involved in the processing of personal
information does so only on instructions from the relevant Group Member and under a duty ofconfidentiality.
Rule 4B – Align will ensure that providers of services to Align also adopt appropriate andequivalent security measures..
European law expressly requires that where a provider of a service to any of the Group Members hasaccess to consumer, physician, employee or supplier personal information (e.g. a payroll provider), strict
contractual obligations, evidenced in writing on the service provider that require it:to act only on Align's documented instructions when processing that information, including withregard to international transfers of the information;to ensure that any individuals who have access to the data are subject to a duty of confidentiality;to have in place appropriate technical and organizational security measures to safeguard the personal
information;

only to engage a sub-processor if Align has given its prior specific or general written authorization,and on condition the sub-processor agreement protects the personal information to substantially thesame standard required of the service provider;to assist Align in ensuring compliance with its obligations as a controller under applicable dataprotection laws, in particular with respect to reporting data security incidents and responding torequests from individuals to exercise their data protection rights;to return or delete the personal information once it has completed its services;

and to make available to Align all information it may need in order to ensure its compliance withthese obligations.

RULE 5 – HONOURING INDIVIDUALS’ RIGHTS
Rule 5 – Align will adhere to the Data Subject Rights Procedure and will be receptive to any
queries or requests made by individuals in connection with their personal information.
Individuals are entitled (by making a written request to Align) to exercise the following rights available
under European Union law:The right of access: This is a right for an individual to obtain confirmation whether Align processes
personal information about them and, if so, to be provided with details of that processing andaccess to the personal information;

The right to rectification: This is a right for an individual to obtain rectification without undue delayof inaccurate personal information Align may process about them;The right to erasure: This is a right for an individual to require Align to erase personal information
about them on certain grounds – for example, where the personal information is no longer
necessary to fulfil the purposes for which it was collected;

The right to restriction: This is a right for an individual to require Align to restrict processing of
personal information about them on certain grounds;

The right to data portability: This is a right for an individual to receive personal information
concerning them from Align in a structured, commonly used and machine-readable format and totransmit that information to another controller, if certain grounds apply;© 2019 Align Technology, Inc. All rights reserved.

Page 9

Binding Corporate Rules Controller PolicyThe right to object: This is a right for an individual to object, on grounds relating to their particularsituation, to processing of personal information about them, if certain grounds apply.

Where an individual wishes to exercise any of its data protection rights, Align will respect those rights inaccordance with applicable law and follow the steps set out in the Data Subject Rights Procedure (seeAppendix 1) when dealing with them.
RULE 6 – ENSURING ADEQUATE PROTECTION FOR OVERSEAS TRANSFERS
Rule 6 – Align will not transfer personal information to third parties outside Align without
ensuring appropriate safeguards for the information in accordance with the standards set out by
this Policy
In principle, international transfers of personal information to third parties outside the Align entities are
not allowed without appropriate safeguards being taken, such as signing up to appropriate contractual
clauses that will protect the personal information being transferred in accordance with the standards set
out by this Policy.
Suitable contractual clauses for use where personal information is to be transferred to such third parties
are available from the Data Protection Officer and Align must make use of those contractual clauses in all
such instances.
RULE 7 – SAFEGUARDING THE USE OF SENSITIVE PERSONAL INFORMATION
Rule 7A – Align will only use sensitive personal information if it is absolutely necessary to use it.
Sensitive personal information is information relating to an individual’s racial or ethnic origin, politicalopinions, religious or other beliefs, trade union membership, genetic data, biometric data for the
purposes of uniquely identifying the individual, health data, data concerning sex life or sexual orientationand criminal convictions and offences. Sensitive personal information needs to be handled with additionalcare, in order to respect local customs and applicable local laws. In particular, each Group Member will:

avoid collection of sensitive personal information where it is not required for the purposes forwhich the data is collected or subsequently used; andlimit access to sensitive personal information to appropriate persons (for example, byimplementing measures to mask or make anonymous the information, where appropriate).

Rule 7B – Align will only use sensitive personal information where the individual’s explicit
consent has been obtained unless Align has an alternative legal basis for doing so consistent withthe applicable law of the country in which the personal information was collected.
In principle, individuals must explicitly agree to the collection and use of their sensitive personal
information by Align unless Align has an alternative legal basis for doing so consistent with the applicablelaw of the European country in which the personal information was collected. This permission to use
sensitive personal information by Align must be specific, freely given, informed, unambiguous andexplicitly. Individuals do have the right to refuse to give consent. Where Align is reliant upon an
individual's explicit consent to use sensitive personal information, Align acknowledges the right of anindividual to withdraw their consent.
RULE 8 – LEGITIMISING DIRECT MARKETING
Rule 8 – Align will allow individuals to opt out of receiving marketing information.
All individuals have the data protection right to object free of charge to the use of their personal
information for direct marketing purposes and Align will honour all such opt out requests.

© 2019 Align Technology, Inc. All rights reserved.

Page 10

Binding Corporate Rules Controller Policy

RULE 9 – AUTOMATED INDIVIDUAL DECISIONSRule 9 – Align will respect individuals' rights not to be subject to a decision based solely on
automated processing, including profiling, that produces legal effects or similarly significantly
affects them.
No evaluation of or decision about an individual which produces a legal effect or similarly significantly
affects them can be based solely on the automated processing of personal information unless measures
are taken to protect the legitimate interests of individuals. Align will only take such decisions where
they are:•necessary for entering into, or performing, a contract between a Group Member and that
individual;•

authorized by applicable law (which in the case of personal information about EU individuals,
must be EU or Member State law); or•

based on the individual's explicit consent.

In the first and third cases above, Align will implement suitable measures to protect the individual's
rights and freedoms and legitimate interests, including the right to obtain human intervention, toexpress his or her view and to contest the decision.
Align will not make automated individual decisions about individuals using their sensitive personal
information unless they have given explicit consent under Rule 7 or another lawful basis applies.
Rule 10 – DATA PROTECTION IMPACT ASSESSMENTS AND PRIVACY BY DESIGN AND DEFAULT
Rule 10A - Align will carry out data protection impact assessments where processing is likely toresult in a high risk to rights and freedoms of individuals and consult, where required by law,with data protection authorities.
Where required by applicable data protection laws, Align will, prior to the processing, carry out dataprotection impact assessments (DPIAs) whenever the processing of personal information, particularly
using new technologies, is likely to result in a high risk to the rights and freedoms of indi viduals. A DPIA
will contain at least the following:•

A systematic description of the envisaged processing operations and the purposes of theprocessing;•An assessment of the necessity and proportionality of the processing operations in relation to the
purposes;•

An assessment of the risks to the privacy rights of individuals;•

The measures envisaged to address the risks, including safeguards, security measures andmechanisms to ensure the protection of personal information and demonstrate compliance withapplicable data protection laws.

Where the DPIA indicates that the processing would still result in a high risk to individuals, Align willconsult with the competent supervisory authority where required by applicable data protection laws.
Rule 10B - Align will apply data protection by design and by default when designing andimplementing new products and systems.
When designing and implementing new products and systems which process personal information,
Align will apply data protection by design and by default, where required by applicable data protection© 2019 Align Technology, Inc. All rights reserved.

Page 11

Binding Corporate Rules Controller Policy

laws. This means implementing appropriate technical and organizational measures that:•Are designed to implement the data protection principles in an effective manner and to integrate
the necessary safeguards in order to protect the rights of individuals and meet the requirements
of applicable data protection laws; and•Ensure that, by default, only personal information which are necessary for each specificprocessing purpose are collected, stored, processed and are accessible; in particular, that bydefault personal information is not made accessible to an indefinite number of people without
the individual's intervention.

SECTION B: PRACTICAL COMMITMENTS
Rule 11 – COMPLIANCE
Rule 11 – Align will have appropriate staff and support to ensure and oversee privacy compliancethroughout the business.
Align has appointed a Data Protection Officer to oversee and ensure day-to-day compliance with thisPolicy, whose ultimate reporting line feeds into the Chief Executive Office and the Board of Directors. The
Data Protection Officer is supported by Align's network of cross-functional local Privacy Champions
within the Legal Department throughout offices worldwide, who advise on and receive notice of local
privacy issues and help to raise privacy awareness. Local Privacy Champions will escalate matters ofprivacy compliance up to the Data Protection Officer, as and when this is appropriate.
In addition to its Data Protection Officer and Privacy Champions, Align operates several working groups
that comprise key stakeholders across various global departments. These working groups, including
Align’s Security Council and Align’s Security and Privacy Funnel Group define the overall direction andstrategy of Align's privacy practices in consultation with the Data Protection Officer and Align's Board of
Directors.
RULE 12 – TRAINING
Rule 12 – Align will provide appropriate training to staff who have permanent or regular accessto personal information, who are involved in the collection of personal information or in thedevelopment of tools used to process personal information in accordance with the Privacy
Training Programme attached as Appendix 2.
RULE 13 – RECORDS
Rule 13 – Align will maintain a record of the processing activities that it conducts in accordancewith European data protection laws.
Align will maintain a record of the processing activities that it conducts in accordance with applicabledata protection laws. These records should be kept in writing (which may be in electronic form) and Align
will make these records available to competent supervisory authorities upon request. The Data
Protection Officer is responsible for ensuring that such records are maintained.
RULE 14 – AUDIT
Rule 14 – Align will comply with the Data Protection Binding Corporate Rules Policy Audit
Protocol set out in Appendix 3.

© 2019 Align Technology, Inc. All rights reserved.

Page 12

Binding Corporate Rules Controller Policy

RULE 15 – COMPLAINT HANDLING
Rule 15 – Align will comply with the Data Protection Binding Corporate Rules Policy Complaint
Handling Procedure set out in Appendix 4.
RULE 16 – CO-OPERATION WITH DATA PROTECTION AUTHORITIESRule 16 – Align will comply with the Data Protection Binding Corporate Rules Policy Cooperation Procedure set out in Appendix 5.
RULE 17 – UPDATES TO THE POLICY
Rule 17 – Align will comply with the Data Protection Binding Corporate Rules Policy Updating
Procedure set out in Appendix 6.
RULE 18 – CONFLICTS BETWEEN THIS POLICY AND NATIONAL LEGISLATION
Rule 18A – Align will ensure that where it believes that the legislation applicable to it prevents itfrom fulfilling its obligations under the Policy or such legislation has a substantial effect on its
ability to comply with the Policy, Align will promptly inform the Data Protection Officer unlessotherwise prohibited by a law enforcement authority.

Rule 18B – Align will ensure that where there is a conflict between the legislation applicable to it
and this Policy which is likely to have a substantial adverse effect on the guarantees provided forin this Policy, the Data Protection Officer will make a responsible decision on the action to takeand will report the problem to the data protection authority with competent jurisdiction in caseof doubt.
RULE 19 – GOVERNMENT REQUESTS FOR DISCLOSURE OF PERSONAL INFORMATION
Rule 19 – If a Group Member receives a legally binding request for disclosure of personal
information by a law enforcement authority or state security body it must comply with theGovernment Data Request Procedure set out in Appendix 7.

© 2019 Align Technology, Inc. All rights reserved.

Page 13

Binding Corporate Rules Controller Policy

SECTION C: THIRD PARTY BENEFICIARY RIGHTS
1. Application of this Section C
This Section C applies where personal information of individuals (namely, consumers, physicians,
employees and suppliers) are protected under European data protection laws (including the General Data
Protection Regulation). This is the case when:•those individuals’ personal information are processed in the context of the activities of a Group
Member (or its third party processor) established in Europe;•a non-European Group Member offers goods and services (including free goods and services) tothose individuals in Europe; or•a non-European Group Member monitors the behaviour of those individuals, as far as their
behaviour takes place in Europe.

2. Entitlement to effective remedies
When this Section C applies, individuals have the right to pursue the remedies set out in paragraph 3 ofthis Section C in the event their personal information is processed by Align in breach of the following
provisions of this Policy:•

Parts II Section A (Basic Principles) of this Controller Policy;•

Rules 15 (Complaints Handling), 16 (Cooperation with Data Protection Authorities), 19 (Conflicts
between this Policy and national legislation) and 20 (Government requests for disclosure of
personal information) under Part II Section B (Practical Commitments) of this Controller Policy;
and•Part II Section C (Third Party Beneficiary Rights) of this Controller Policy.

3. Individuals’ third party beneficiary rights
When the individual has a right to an effective remedy under paragraph 2 of this Section C, individuals
may exercise the following rights:
Complaints: Individuals may make complaints to a European Group Member in accordance with
Appendix 4 and/or to the European supervisory authority (i) of his or her habitual residence; (ii)of his or her place of work; or (iii) where the alleged infringement occurred;Proceedings: Individuals may bring proceedings against Align Technology B.V. in accordance with
Appendix 4: (i) either in the courts of the Netherlands (being the jurisdiction of Align Technology
B.V.); (ii) the jurisdiction of the Group Member located in Europe from which the personal
information was transferred; or (iii) the jurisdiction in Europe of his or her habitual residence; toenforce compliance by Align with this Policy and the appendices; and/orLiability: Individuals may seek appropriate redress from Align Technology B.V. in accordancewith Appendix 4 including the remedy of any breach of this Policy by any Group Member outside
Europe and, where appropriate receive compensation from Align Technology B.V. for any
material or non-material damage suffered as a result of a breach of this Policy by a Group
Member in accordance with the determination of a court or other competent authority.

Transparency: Individuals also have the right to obtain a copy of the Policy and the unilateraldeclaration entered into by Align in connection with the Policy.

In the event of a claim being made in which an individual has suffered damage where that individual candemonstrate that it is likely that the damage has occurred because of a breach of this Policy, Align has
agreed that the burden of proof to show that a Group Member outside Europe is not responsible for thebreach, or that no such breach took place, will rest with Align Technology B.V.

© 2019 Align Technology, Inc. All rights reserved.

Page 14

Binding Corporate Rules Controller Policy

PART III: APPENDICESAPPENDIX 1
DATA SUBJECT RIGHTS PROCEDURE© 2019 Align Technology, Inc. All rights reserved.

Page 15

Binding Corporate Rules Controller Policy

Data Protection Binding Corporate Rules Controller Policy/Data Protection Binding Corporate
Rules Processor Policy
Data Subject Rights Procedure
1. Introduction
1.1.

When Align collects uses or transfers personal information for Align's own purposes, Align isdeemed to be a controller of that information and is therefore primarily responsible for meeting
the requirements of data protection law.

1.2.

Where Align acts as a controller, individuals whose personal information is collected and/or usedin Europe3 have certain data protection rights which they may exercise by making a request to
Align.

1.3.

In addition, individuals whose personal information is collected and/or used in Europe by
Align acting as a controller and transferred between Align entities under the Align Data
Protection Binding Corporate Rules Controller Policy will also benefit from these rights and such
requests will be dealt with in accordance with the terms of this Data Subject Rights Request
Procedure ("Procedure").

1.4.

This Procedure explains how Align deals with a data subject rights request relating topersonal information which falls into the categories in sections 1.2 and 1.3 above (referred to as“valid request” in this Procedure).

1.5.

Where a data subject rights request is subject to European data protection law because it ismade in respect of personal information collected and/or used in Europe, such a request will be
dealt with by Align in accordance with this Procedure, but where the applicable European dataprotection law differs from this Procedure, the local data protection law will prevail.

2. Individuals' Rights
2.1.

Align must assist individuals to exercise the following data protection rights, consistent with therequirements of applicable data protection laws:(a)

The right to access: This is a right for an individual to obtain confirmation whether acontroller processes personal information about them and, if so, to be provided withdetails of that personal information and access to it. The process for handling this type ofrequest is described further in paragraph 8 below.

(b)

The right to rectification: This is a right for an individual to obtain rectification without
undue delay of inaccurate personal information a controller may process about them.
The process for handling this type of request is described further in paragraph 6 below;(c)

The right to erasure: This is a right for an individual to require a controller to erase
personal information about them on certain grounds – for example, where the personal
information is no longer necessary to fulfil the purposes for which it was collected. The
process for handling this type of request is described further in paragraph 6 below.

(d)

The right to restriction: This is a right for an individual to require a controller torestrict processing of personal information about them on certain grounds. The process
for handling this type of request is described further in paragraph 6 below.

(e)

The right to object: This is a right for an individual to object, on ground relating to his or
her particular situation, to a controller's processing of personal information about them,
if certain grounds apply. The process for handling this type of request is describedfurther in paragraph 6 below.

3 In this policy Europe means the EEA plus Switzerland.

© 2019 Align Technology, Inc. All rights reserved.

Page 16

Binding Corporate Rules Controller Policy(f)

The right to data portability: This is a right for an individual to receive personal
information concerning them from a controller in a structured, commonly used andmachine readable format and to transmit that information to another controller, if
certain grounds apply. The process for handling this type of request is described further
in paragraph 7 below.

2.2.

The request does not need to be made in writing.

2.3.

No fee will be applied unless in accordance with local applicable law.

2.4.

Align must deal with a valid request without undue delay and in any case within one (1) month of
its receipt (or such shorter period as may be stipulated under local law). That period may be
extended by a further two (2) months where necessary, taking into account the complexity andnumber of requests. Align will inform the individual of any such extension within one (1) monthof receipt of the request, together with reasons for the delay.

2.5.

Align is not obliged to comply with a data subject right request unless Align is supplied with suchinformation which it may reasonably require in order to confirm the identity of the individual
making the request and to locate the information which that person seeks.

3. Procedure
3.1.

3.2.

Receipt of a data subject rights request where Align is a controller of the personal information
requested
3.1.1.

If any employee or subcontractor of Align receives any data subject right request from anindividual, they must pass the communication to Align’s Data Protection Officer andCustomer Service immediately (or to Align’s Human Resources if it involves a current,
previous, or potential employee, intern, or contractor) upon receipt indicating the dateon which it was received together with any other information which may assist theapplicable department to deal with the request.

3.1.2.

The request does not have to be official or mention data protection law to qualify as a data
subject rights request.

Initial steps
3.2.1.

Customer Service (or Human Resources) will pass any requests to Align’s Data
Protection Officer to make an initial assessment of the request to decide whether it is avalid request and whether confirmation of identity, or any further information, is
required.

3.2.2.

Align’s Data Protection Officer will then contact the individual in writing to confirm
receipt of the data subject rights request, seek confirmation of identity or further
information, if required, or decline the request if one of the exemptions applies (forexample, because Align can demonstrate that the individual has made a manifestly
unfounded or excessive request).

4. Exemptions to the requests made to Align as a controller
4.1.

A valid request may be refused on the following grounds;
4.1.1.

Where the request is made to a European Group Member and relates to the use orcollection of personal information by that entity, if the refusal to provide the informationis consistent with the data protection law within the jurisdiction in which that entity is
located, or

4.1.2.

Where the request does not fall within section 4.1.1 because it is made to a nonEuropean Align entity and the refusal to provide the information is consistent with the© 2019 Align Technology, Inc. All rights reserved.

Page 17

Binding Corporate Rules Controller Policy

exemptions to the right of subject access under current EU data protection laws, or
4.1.3.

if, in the opinion of Align compliance with a subject access request would: (a)prejudice the essential business interests of Align (which includes management planning,
management forecasting, corporate finance or negotiations with a data subject); (b) it isnecessary to do so to safeguard, national or public security, defence, the prevention,
investigation, detection and prosecution of criminal offences; or (c) for the protection of
the data subject or of the rights and freedoms of others; or4.1.4.

if the personal information is held by Align in non-automated form and is not or will not
become part of a filing system; or4.1.5.

where the personal information does not originate from Europe has not been processedby any European Group Member, and the provision of the personal information requires
Align to use disproportionate effort.

5. Requests for access to personal data ("subject access requests")
5.1.

An individual is entitled to make a request to a controller to require it to provide the following
information concerning processing of their personal data:(a)Confirmation as to whether the controller holds and is processing personal information
about them;(b)

If so:
 the purposes of the processing; the categories of personal data concerned;
 the recipients or categories of recipient to whom the personal data have been or will be
disclosed, in particular recipients in third countries or international organisations; where possible, the envisaged period for which the personal data will be stored, or, if
not possible, the criteria used to determine that period;
 the existence of the right to request from the controller rectification or erasure of
personal data or restriction of processing of personal data concerning the data subject
or to object to such processing; the right to lodge a complaint with a supervisory authority; where the personal data are not collected from the data subject, any available
information as to their source;the existence of automated decision-making, including profiling, and, where suchdecisions may have a legal effect or significantly affect the individuals whose personal
information are collected, any meaningful information about the logic involved, as wellas the significance and the envisaged consequences of such processing for thoseindividuals.

(c)Information about the individual's right to request rectification or erasure of theirpersonal information or to restrict or object to its processing;(d)Information about the individual's right to lodge a complaint with a competent dataprotection authority;© 2019 Align Technology, Inc. All rights reserved.

Page 18

Binding Corporate Rules Controller Policy(e)Information about the source of the personal information if it was not collected from theindividual;(f)

Details about whether the personal information is subject to automated decision-making
which produces legal effects concerning the individual or similarly significantly affects
them; and(g)

Where personal information is transferred from Europe to a country outside of Europe, theappropriate safeguards that Align has put in place relating to such transfers in accordancewith European data protection laws.

5.2.

An individual is also entitled to request a copy of their personal information from the controller.
Where an individual makes such a request, the controller must provide that personal information
to the individual in intelligible form.

5.3.

Subject access requests made to Align where Align is a processor of the personal information
requested

5.4.

5.3.1.

When Align processes information on behalf of a client (for example, to provide aservice) Align is deemed to be a processor of the information and the client will be
primarily responsible for meeting the legal requirements as a controller. This meansthat when Align acts as a processor, Align's clients retain the responsibility to comply
with applicable data protection law.

5.3.2.

Certain data protection obligations are passed to Align in the contracts Align has with its
clients and Align must act in accordance with the instructions of its clients andundertake any reasonably necessary measures to enable its clients to comply with their
duty to respect the rights of individuals. Individuals often make subject access requests
directly to an Align entity in its capacity as a processor and so in those cases, that entity
must transfer such request promptly to the relevant client. Unless instructed to do so by
a client, Align is not obliged to refer the individual to contact the client directly but may
explain who has responsibility to deal with a request as a matter of good practice. Alignmust only respond to the request (by providing the information requested or applying
an exemption in accordance with applicable data protection law) if authorised by theclient to do so.

The search and the response
5.4.1.

Customer Service (or Human Resources) will coordinate with Information
Technology and the relevant departments to conduct a search of all relevant
electronic and paper filing systems.

5.4.2.

Customer Service (or Human Resources) may refer any complex cases to the Data
Protection Officer for advice, particularly where the request includes information
relating to third parties or where the release of personal information may prejudicecommercial confidentiality or legal proceedings.

5.4.3.

The information requested will be collated into a readily understandable format(internal codes or identification numbers used at Align that correspond to personal
information shall be translated before being disclosed). A covering letter will be
prepared by Customer Service (or Human Resources) which includes the information
required to be provided in response to a subject access request.

6. Requests for rectification, erasure, restriction or objection
6.1.

If a request is received in relation to rectification, erasure, restriction, portability or objection
where Align is the controller for that personal information, such a request must be considered
and dealt with as appropriate by the local legal and compliance officer.

© 2019 Align Technology, Inc. All rights reserved.

Page 19

Binding Corporate Rules Controller Policy

6.2.

If a request is received advising of a change in an individual’s personal information where Align isthe controller for that personal information, such information must be rectified or updated
accordingly if Align is satisfied that there is a legal ground for doing so.

6.3.

When Align rectifies, erases, restricts, or anonymises personal information, either in its capacity
as controller or on instruction of a client when it is acting as a processor, Align will notify theother Align entities or any sub-processor to whom the personal information has been disclosed
accordingly so that they can also update their records.

6.4.

If the request made to Align as a controller is to restrict or cease processing that individual's
personal information (for example because the rights and freedoms of the individual are
prejudiced by virtue of such processing by Align, or on the basis of other compelling legitimate
grounds), the matter will be referred to the Data Protection Officer to assess.

7. Right to data portability
7.1.

If an individual makes a data subject request to Align acting as controller to receive the personal
information that they have provided to Align in a structured, commonly used and machinereadable format and/or to transmit directly such information to another controller (where
technically feasible), Align's Privacy Council will consider and deal with the request appropriately
in accordance with applicable data protection laws (and ensuring that the rights and freedoms ofothers are not adversely affected) insofar as the processing is based on that individual's consent
or on the performance of, or steps taken at the request of the individual prior to entry into, acontract.

8. Questions about this Procedure
8.1.

All queries relating to this Procedure are to be addressed to the Data Protection Officer.

© 2019 Align Technology, Inc. All rights reserved.

Page 20

Binding Corporate Rules Controller Policy

APPENDIX 2DESCRIPTION OF ALIGN'S PRIVACY TRAINING PROGRAMME© 2019 Align Technology, Inc. All rights reserved.

Page 21

Binding Corporate Rules Controller Policy

Data Protection Binding Corporate Rules Controller Policy/Data Protection Binding Corporate
Rules Processor Policy
Privacy Training Programme
Training on Align's Data Protection Binding Corporate Rules Controller Policy and Data Protection
Binding Corporate Rules Processor Policy (together the "BCR") is based upon the existing programme ofinternal compliance within the Align Technology, Inc. group of companies (“Align”).
Align trains employees on the basic principles of data protection, confidentiality and information security
and, in this connection, Align has developed mandatory electronic training courses, supplemented by live
training where appropriate, to be taken by employees. These courses are designed to be both informative
and user-friendly, generating interest in the topic. Attendance of the course is monitored and enforced by
Human Resources with escalation reports of non-compliance ultimately submitted to the Board of
Directors.
The programme provides that all employees, including new hires and contractors, whose role will bringthem into contact with personal data are required to complete the training as part of their induction
programme, as part of regular refresher training, and when necessary based on changes in the law or as
part of mitigation measures. Supplemental, in-person training may be provided (as necessary) to those
employees whose role requires them to access sensitive personal data.
Privacy training for Align employees
Align’s privacy training comprises part of the mandatory employee training process that employees mustcomplete as a condition of their employment. Align's Data Protection Officer and Information Security
team have overall responsibility for the development of the training course and collaborate with Human
Resources for implementation. Align's Data Protection Officer and Information Security team review thetraining from time to time to ensure that it addresses all relevant aspects of the BCR and to ensure thatthe training is appropriate for individuals who have permanent or regular access to personal information,
who are involved in the collection of personal information or in the development of tools to process
personal information.
New employees are educated as part of the induction process. Existing employees must also undertake
refresher training on data protection annually.
Summary of the training
Align’s privacy-related training courses are:A.

Course name: Privacy at Align
Course Description: This course provides a broad overview of Align’s privacy program, policies,
procedures, and expectations, including the BCR.
Target Audience: All pertinent current employees and contractors including newhires.
Course Objectives: At the end of the course, employees should be able to:Define privacy terms;Protect the personal information of individuals whose personal information
Align maintains;

Identify potential threats to personal information and the protections in place
within Align to safeguard such data;

Understand and comply with data protections laws, rules, and regulations in© 2019 Align Technology, Inc. All rights reserved.

Page 22

Binding Corporate Rules Controller Policy

accordance with the requirements in the BCR; andB.

Identify and report suspected or actual loss of personal information.

Course name: Global Information Security
Course Description: This course instructs employees on how to secure Align’s personal
information.
Target Audience: All pertinent current employees and contractors, including new hires.
Course Objectives: At the end of this course, employees should be able to:

Understand why data protection is important to Align;Comprehend how and when to secure Align’s people, information, assets andfacilities;Comply with information security expectations internally, when acting as avendor and when appointing third party vendors to act on Align's behalf;Distinguish confidential data from public data; andKnow where to go for assistance.

© 2019 Align Technology, Inc. All rights reserved.

Page 23

Binding Corporate Rules Controller Policy

APPENDIX 3
DATA PROTECTION BINDING CORPORATE RULES POLICY AUDIT PROTOCOL© 2019 Align Technology, Inc. All rights reserved.

Page 24

Binding Corporate Rules Controller Policy

Data Protection Binding Corporate Rules Controller Policy/Data Protection Binding Corporate
Rules Processor Policy
Audit Protocol
1. Background
1.1.

The purpose of the Data Protection Binding Corporate Rules Processor Policy and Data
Protection Binding Corporate Rules Controller Policy (together the “Policies") is to safeguard
personal information transferred between Align group members ("Group Members").

1.2.

The Policies require approval from the data protection authorities in the European Member
States from which the personal information is transferred. One of the requirements of the dataprotection authorities is that Align audits compliance with the Policies and satisfies certain
conditions in so doing and this document describes how Align deals with such requirements.

2. Approach
2.1.

Overview of audit

2.1.1.

Align’s Data Protection Officer will be responsible for ensuring independent audits are performedthat fully address the Policies. Align’s Data Protection Officer will be responsible for ensuring that
any issues or instances of non-compliance are brought to the attention of Align’s VP, Corporate
and Legal Affairs, and General Counsel and that any corrective actions are taken to ensurecompliance take place.

2.1.2.

To the extent that Align acts as a processor, audits of Align's compliance with the commitments
made in the Data Protection Binding Corporate Rules Processor Policy may also be carried out by
or on behalf of Align's clients in accordance with the terms of the contract Align has with its
clients in respect of such processing, and such audits may also extend to any sub-processors
acting on Align's behalf in respect of such processing.

2.1.3.

One of the roles of Align’s Data Protection Officer is to provide guidance about the collection anduse of personal information subject to the Policies and to assess the collection and use of personal
information by Group Members for potential privacy-related risks. The collection and use of
personal information with the potential for a significant privacy impact is, therefore, subject todetailed review and evaluation on an on-going basis. Accordingly, although this Audit Protocol
describes the formal assessment process adopted by Align to ensure compliance with the Policies
as required by the data protection authorities, this is only one way in which Align ensures thatthe provisions of the Policies are observed and corrective actions taken as required.

2.2.

Timing and Scope of Audit

2.2.1.

Audit of the Policies will take place at least annually or at the instigation of Align’s Data
Protection Officer, executive management, or the Board of Directors. The scope of the audit
performed will be decided by Align’s Data Protection Officer in conjunction with Align’s Internal
Audit Department in light of contemporaneous factors for that year, such as processing in a given
field (for example, human resources data); areas in which any complaints are received; areas of
specific or new risk for the business; areas of current regulatory focus (such as data subject's
rights or specific forms of processing); and/or areas of focus for Align's internal audit teams(such as procurement practices).

2.2.2.

To the extent that a Group Member processes personal information on behalf of a third party
controller, audit of the Data Protection Binding Corporate Rules Processor Policy will take place
as required under the contract in place between that Group Member and that third party
controller. Where a third party controller on whose behalf Align processes personal information
exercises its right to audit Align for compliance with the Data Protection Binding Corporate Rules
Processor Policy, the scope of the audit shall be limited to the data processing facilities andactivities relating to that controller.

© 2019 Align Technology, Inc. All rights reserved.

Page 25

Binding Corporate Rules Controller Policy

2.3.

Auditors

2.3.1.

Audit of the Policies will be undertaken by Align’s Internal Audit Department, but reliance on
work performed by other accredited internal/external auditors may be determined by Align’s
Legal Department. Align’s Data Protection Officer or Internal Audit Department will manage andprovide quality assurance of audit work performed by others.

2.3.2.

In the event that a third party controller on whose behalf Align processes personal
information exercises its right to audit Align for compliance with the Data Protection Binding
Corporate Rules Processor Policy, such audit may be undertaken by that controller or byindependent, accredited auditors selected by that controller as stipulated in the contract between
Align and that controller.

2.4.

Report2.4.1.

Findings of audits of compliance with the Policies will be reported to the Data Protection
Officer and, if necessary, to the Senior Counsel, Litigation and Regulatory and/or the GeneralCounsel. Any material audit findings will be reported to the Board of Directors. In addition, Align
will:
(a)

disclose the results of any audit of Align's compliance with the Policies to a competent
European data protection authority; and(b)disclose the results of any audit of Align's compliance with the Data Protection Binding
Corporate Rules Processor Policy to any controller on whose behalf Align processes
personal information;

In each case, Align shall make such disclosure only upon request, in accordance with applicablelaw, and with respect for the confidentiality and trade secrets of the information provided.
2.4.2.

Align’s Data Protection Officer will be responsible for liaising with the European data protection
authorities for the purpose of providing the information outlined in section 2.4.1.

2.4.3.

In addition, Align has agreed that where any Group Member is located within the jurisdiction of adata protection authority based in Europe, that that data protection authority may audit thatGroup Member for the purpose of reviewing compliance with the Policies, in accordance with theapplicable law of the country in which the Group Member is located, or, in the case of a Group
Member located outside Europe, in accordance with the applicable law of the European country
from which the personal information is transferred under the Policies (which, when Align acts as
a processor on behalf of a third party controller, will be determined by the place of establishmentof the controller) on giving reasonable prior notice and during business hours, with full respect tothe confidentiality of the information obtained and to the trade secrets of Align, and inaccordance with the Binding Corporate Rules: Cooperation Procedure. Align’s Data Protection
Officer will also be responsible for liaising with the European data protection authorities for thispurpose.

© 2019 Align Technology, Inc. All rights reserved.

Page 26

Binding Corporate Rules Controller Policy

APPENDIX 4
DATA PROTECTION BINDING CORPORATE RULES POLICY COMPLAINT HANDLING PROCEDURE© 2019 Align Technology, Inc. All rights reserved.

Page 27

Binding Corporate Rules Controller Policy

Data Protection Binding Corporate Rules Controller Policy/Data Protection Binding Corporate
Rules Processor Policy
Complaint Handling Procedure
1. Introduction
1.1.

The Data Protection Binding Corporate Rules Controller Policy ("Controller Policy") and theData Protection Binding Corporate Rules Processor Policy ("Processor Policy") (together the"Policies") safeguard personal information transferred between the Align group members("Group Members"). The content of the Policies is determined by the data protection
authorities in the European Member States from which the personal information is transferredand one of their requirements is that Align must have a complaint handling procedure in place.
The purpose of this Complaint Handling Procedure is to explain how complaints brought by anindividual whose personal information is processed by Align under the Policies are dealt with.

2. How individuals can bring complaints
2.1.

Individuals can bring complaints in writing under the Policies by contacting Align's
Customer Service Department or by emailing privacy@aligntech.com. These are the contact
details for all complaints made under the Policies whether Align is collecting and/or using
personal information on its own behalf or on behalf of a client.

3. Who handles complaints?
3.1.

Complaints where Align is a controller

3.1.1.

Align's Data Protection Officer will handle all complaints arising under the Controller Policy inrespect of the collection and use of personal information where Align is the controller of that
information. Align's Data Protection Officer, working in conjunction with Customer Service, will
liaise with the applicable member/s of the Privacy Working Group, who represent relevant
various business and support units, to deal with the complaint. Members of the Privacy Working
Group will function as the Departmental Contacts to investigate the complaint and coordinate a
response.

3.1.2.

What is the response time?
Unless exceptional circumstances apply, Customer Service will acknowledge receipt of acomplaint to the individual concerned within 5 working days. It will investigate and make a
substantive response within one month. If, due to the complexity of the complaint and numberof requests, a substantive response cannot be given within this period, Customer Service willadvise the complainant accordingly and provide a reasonable estimate (not exceeding two
additional months) for the timescale within which a response will be provided.

3.1.3.

When a complainant disputes a finding
If the complainant disputes the response of the Departmental Contact or Customer Service (orthe individual or department within Align tasked by the Data Protection Officer with resolving
the complaint) or any aspect of a finding, and notifies Align accordingly, the matter will bereferred to the Data Protection Officer who will review the case with another representative of
the Legal Department and advise the complainant of his/her decision either to accept theoriginal finding or to substitute a new finding. The Data Protection Officer will respond to thecomplainant within three months of the referral. As part of the review the Data Protection
Officer may arrange to meet the parties in an attempt to resolve the complaint.
If the complaint is upheld, the Data Protection Officer will arrange for any necessary steps to betaken as a consequence.

© 2019 Align Technology, Inc. All rights reserved.

Page 28

Binding Corporate Rules Controller Policy

3.1.4.

Complaint to a data protection authority
Individuals whose personal information is collected and/or used and in accordance with
European data protection law also have the right to complain to a European data protection
authority and/or to lodge a claim with a court of competent jurisdiction and this will apply where
they are not satisfied with the way in which any complaint made to Align has been dealt with.
Individuals entitled to such rights will be notified accordingly as part of the complaint handlingprocedure.

3.1.5.

Proceedings before a national court
If an individual wishes to commence court proceedings against Align, on the basis that a
European Group Member has processed personal information in breach of the Policies or inbreach of applicable data protection laws, then he or she may commence proceedings against that
European Group Member in the European territory:(a)in which that European Group Member is established; or(b)of his or her habitual residence.

3.2.

Complaints where Align is a processor

3.2.1.

Where a complaint arises under the Processor Policy in respect of the collection and use of
personal information where Align is the processor in respect of that information, Align willcommunicate the details of the complaint to the client promptly and will act strictly in accordancewith the terms of the contract between the client and Align if the client requires Align to deal withthe complaint.

3.2.2.

When a client ceases to exist
In circumstances where a client has disappeared, no longer exists or has become insolvent, andno successor entity has taken its place, individuals whose personal information is collected
and/or used in accordance with European data protection law and transferred between Group
Members on behalf of that client under the Processor Policy have the right to complain to Alignand Align will deal with such complaints in accordance with sections 3.1.1 to 3.1.3 of thisComplaint Handling Procedure. In such cases, individuals also have the right to complain to a
European data protection authority and/or to lodge a claim with a court of competentjurisdiction and this includes where they are not satisfied with the way in which their complaint
has been resolved by Align. Individuals entitled to such rights will be notified accordingly as
part of the complaint handling procedure.

© 2019 Align Technology, Inc. All rights reserved.

Page 29

Binding Corporate Rules Controller Policy

APPENDIX 5
DATA PROTECTION BINDING CORPORATE RULES POLICY CO-OPERATION PROCEDURE© 2019 Align Technology, Inc. All rights reserved.

Page 30

Binding Corporate Rules Controller Policy

Data Protection Binding Corporate Rules Controller Policy/Data Protection Binding Corporate
Rules Processor Policy
Co-operation Procedure
1. Introduction
1.1.

This Co-operation Procedure sets out the way in which Align will co-operate with the European4
data protection authorities in relation to the Data Protection Binding Corporate Rules Controller
Policy and the Data Protection Binding Corporate Rules Processor Policy (together the“Policies").

2. Co-operation Procedure
2.1.

Where required, Align will make the necessary personnel available for dialogue with a European
data protection authority in relation to the Policies.

2.2.

Align will actively review and consider:(a)any decisions made by relevant European data protection authorities on any dataprotection law issues that may affect the Policies; and(b)

the views of the European Data Protection Board as outlined in its published guidance on
Binding Corporate Rules for data controllers and Binding Corporate Rules for dataprocessors.

2.3.

Subject to applicable law and respect for the confidentiality and trade secrets of the information
provided, Align will provide upon request copies of the results of any audit of the Policies to arelevant European data protection authority.

2.4.

Where any Align group member ("Group Member") is located within the jurisdiction of a dataprotection authority based in Europe, Align agrees that that particular data protection authority
may audit that Group Member for the purpose of reviewing compliance with the Policies, inaccordance with the applicable law of the country in which the Group Member is located, or, inthe case of a Group Member located outside Europe, in accordance with the applicable law of theEuropean country from which the personal information is transferred under the Policies (which,when Align acts as a processor on behalf of a third party controller, will be determined by theplace of establishment of the controller) on giving reasonable prior notice and during businesshours, with full respect to the confidentiality of the information obtained and to the trade secretsof Align.

2.5.

Align agrees to abide by a decision of the applicable data protection authority where a right toappeal is not exercised on any issues relating to the interpretation and application of the Policies.

4 References to Europe for the purposes of this document includes the EEA and Switzerland© 2019 Align Technology, Inc. All rights reserved.

Page 31

Binding Corporate Rules Controller Policy

APPENDIX 6
DATA PROTECTION BINDING CORPORATE RULES POLICY UPDATING PROCEDURE© 2019 Align Technology, Inc. All rights reserved.

Page 32

Binding Corporate Rules Controller Policy

Data Protection Binding Corporate Rules Controller Policy/Data Protection Binding Corporate
Rules Processor Policy
Updating Procedure
1. Introduction
1.1.

This Data Protection Binding Corporate Rules Updating Procedure sets out the way in which
Align will communicate changes to the Data Protection Binding Corporate Rules Controller Policy("Controller Policy") and to the Data Protection Binding Corporate Rules Processor Policy("Processor Policy") (together the "Policies") to the European5 data protection authorities, data
subjects, its clients and to the Align group members ("Group Members") bound by the Policies.

2. Material changes to the Policies
2.1.

Align will communicate any material changes to the Policies as soon as is reasonably practical to
the Dutch data protection authority and to any other relevant European data protection
authorities.

2.2.

Where a change to the Processor Policy materially affects the conditions under which Alignprocesses personal information on behalf of any client under the terms of its contract with Align,
Align will also communicate such information to any affected client. If such change is contrary to
any term of the contract between Align and that client, Align will communicate the proposedchange before it is implemented, and with sufficient notice to enable affected clients to object.

2.3.

If an affected client objects to the proposed change before it is implemented, Align will escalate
the objection to the Data Protection Officer to consider, discuss with the affected client andresolve. If the Data Protection Officer cannot resolve the objection to the satisfaction of theaffected client, then Align may choose not to implement the change or, alternatively, the affectedclient may terminate Align's data processing in accordance with the terms of its contract.

3. Administrative changes to the Policies
3.1.

Align will communicate changes to the Policies which are administrative in nature(including changes in the list of Group Members) or which have occurred as a result of a changeof applicable data protection law in any European country, through any legislative, court orsupervisory authority measure to the Dutch data protection authority and to any other relevant
European data protection authorities at least once a year. Align will also provide a brief
explanation to the Dutch data protection authority and to any other relevant data protection
authorities of the reasons for any notified changes to the Policies.

3.2.

Align will make available changes to the Processor Policy which are administrative in nature(including changes in the list of Group Members) or which have occurred as a result of a changeof applicable data protection law in any European country, through any legislative, court orsupervisory authority measure to any client on whose behalf Align processes personal
information.

4. Communicating and logging changes to the Policies
4.1.

Align will communicate all changes to the Policies, whether administrative or material in nature,to the Group Members bound by the Policies without undue delay and to the data subjects who
benefit from the Policies via www.aligntech.com. The Policies contain a change log which sets out
the date each Policy is revised and the details of any revisions made.

4.2.

Align's Data Protection Officer will maintain an up to date list of the changes made to the Policies,
the list of Group Members bound by the Policies and a list of the sub-processors appointed by

5 References to Europe for the purposes of this document includes the EEA and Switzerland© 2019 Align Technology, Inc. All rights reserved.

Page 33

Binding Corporate Rules Controller Policy

Align to process personal information on behalf of its clients. This information will be available
on request from Align.
5. New Group Members
5.1.

Align's Data Protection Officer will ensure that all new Group Members are bound by the Policies
before a transfer of personal information to them takes place.

© 2019 Align Technology, Inc. All rights reserved.

Page 34

Binding Corporate Rules Controller Policy

APPENDIX 7
GOVERNMENT DATA REQUEST PROCEDURE© 2019 Align Technology, Inc. All rights reserved.

Page 35

Binding Corporate Rules Controller Policy

Data Protection Binding Corporate Rules Controller Policy
Government Data Request Procedure
1. Background
1.1.

Align’s Binding Corporate Rules: Government Data Request Procedure sets out Align's procedure
for responding to a request received from a law enforcement or other government authority orstate security body (together the "Requesting Authority") to disclose personal information
processed by Align (hereafter "Data Disclosure Request").

1.2.

Where Align receives a Data Disclosure Request, it will handle that Data Disclosure Request inaccordance with this Procedure. If applicable data protection law(s) require a higher standard ofprotection for personal information than is required by this Procedure, Align will comply withthe relevant requirements of applicable data protection law(s).

2. General principle on Data Disclosure Requests
2.1.

2.2.

As a general principle, Align does not disclose personal information in response to a Data
Disclosure Request unless either:(a)

it is under a compelling legal obligation to make such disclosure; or(b)taking into account the nature, context, purposes, scope and urgency of the Data
Disclosure Request and the privacy rights and freedoms of any affected individuals, there
is an imminent risk of serious harm that merits compliance with the Data Disclosure
Requests in any event.

For that reason, unless it is legally prohibited from doing so or there is an imminent risk ofserious harm, Align will notify and cooperate with the competent data protection authorities (andwhere it processes the requested personal information on behalf of a client, the client) in order toaddress the Data Disclosure Request.

3. Handling of a Data Disclosure
3.1.

Receipt of a Data Disclosure Request

3.1.1.

If an Align Group Member receives a Data Disclosure Request, the recipient of the request must
pass it to Align's Data Protection Officer immediately upon receipt, indicating the date on which it
was received together with any other information which may assist Align's Data Protection
Officer to deal with the request.

3.1.2.

The request does not have to be made in writing, made under a Court order, or mention dataprotection law to qualify as a Data Disclosure Request.

3.2.

Initial steps

3.2.1.

Align's Data Protection Officer will carefully review each and every Data Disclosure Request on acase-by-case basis. Align's Data Protection Officer will liaise with the legal department as
appropriate to deal with the request to determine the nature, context, purposes, scope andurgency of the Data Disclosure Request, as well as its validity under applicable laws, in order to
identify whether action may be needed to challenge the Data Disclosure Request.

4. Notice of a Data Disclosure Request
4.1.

Notice to the client

4.1.1.

Where Align is processing personal information on behalf of a client, after assessing the nature,© 2019 Align Technology, Inc. All rights reserved.

Page 36

Binding Corporate Rules Controller Policy

context, purposes, scope and urgency of the Data Protection Request, Align will notify andprovide the client with the details of the Data Disclosure Request prior to disclosing any personal
information, unless legally prohibited or where an imminent risk of serious harm exists thatprohibits prior notification.
4.2.

Notice to the competent Data Protection Authorities

4.2.1.

Align will also put the request on hold in order to notify and consult with the competent Data
Protection Authorities, unless legally prohibited or where an imminent risk of serious harm
exists that prohibits prior notification.

4.2.2.

Where Align is prohibited from notifying the competent Data Protection Authorities andsuspending the request, Align will use its best efforts (taking into account the nature, context,
purposes, scope and urgency of the request) to inform the Requesting Authority about its
obligations under applicable data protection law and to obtain the right to waive this prohibition.
Such efforts may include asking the Requesting Authority to put the request on hold so that Aligncan consult with the competent Data Protection Authorities, which may also, in appropriate
circumstances, include seeking a court order to this effect. Align will maintain a written record of
the efforts it takes.

5. Transparency reports
5.1.

If, despite having used its best efforts, Align is not in a position to notify the competent Data
Protection Authorities, Align commits to preparing an annual report (a “Transparency Report”),
which reflects to the extent permitted by applicable laws, the number and type of Data Disclosure
Requests it has received for the preceding year and the Requesting Authorities who made thoserequests. Align shall provide this report to the lead data protection authority which authorized its
BCR (and any other data protection authorities that the lead authority may direct) once a year.

6. Bulk transfer
6.1.

In no event will any group member transfer personal information to a Requesting Authority in a
massive, disproportionate and indiscriminate manner that goes beyond what is necessary in a
democratic society.

© 2019 Align Technology, Inc. All rights reserved.

Page 37