Kodak Supplier Record-Keeping
This Record serves as Appendix to the Data Processing Agreement
This Appendix also serves as the Appendix to the Standard Contractual Clauses attached as Schedule 1,
if those are used to authorize cross-border data transfers as indicated below.
ANNEX I
A. LIST OF PARTIES
Eastman Kodak Company as Data Exporter or Transferor
Name: Eastman Kodak Company
DPO:

Kodak Privacy Office

Address: Eastman Kodak Company, Privacy Office, 13th Floor, Building 7, 343 State Street, Rochester, NY 14650
Address 2: Kodak GmbH, Data Privacy, Kesselstrasse 19, 70327 Stuttgart, Germany
Contact person’s name, position, and contact details: privacy@kodak.com or https://www.kodak.com/go/eearesidents
Kodak Information Security Contact: CISO-Mail@kodak.com
Kodak Contact for Data Breach Reporting: CISO-Mail@kodak.com
Supplier as Data Importer or Transferee
Name:
DPO:
Address
Contact person’s name, position, and contact details:
Supplier Information Security Contact:
B. DESCRIPTION OF THE PROCESSING AND TRANSFER
Categories of data subjects whose personal data are processed and/or transferred☐ Consumer customers☐ Prospective consumer customers, website visitors☐ Professionals☐ Commercial customers (e.g., company employees)☐ Prospective commercial customers, B2B leads, trade show attendees☐ Job Applicants

Page 1/4

☐ Employees, contractors, dependents/family☐ Suppliers☐ OtherCategories of personal data are processed and/or transferred☐ Individual contact information (names, addresses, email addresses, etc.)☐ Unique identifiers (government identification numbers, customer numbers, etc.)☐ Information pertaining to consumer transactions (purchase details, etc.)☐ Information pertaining to commercial transactions☐ Human resources data
☐ Customer relationship information (demographic data, preferences etc.)☐ Online and technical information (device data, IP addresses, sensor data etc.)☐ Inferred or derived information (analytics data, propensities etc.)☐ Video and/or audio recordings☐ Data in connection with[e.g., online advertising targeting, compliance hotline, etc.)☐ Sensitive data – see below☐ Other
Sensitive data processed and/or transferred (if applicable)☐ Government-issued identification numbers, national identification numbers☐ Financial account numbers, including payment card data and insurance account numbers☐ Health data, medical information or genetic information☐ Biometric data
☐ Consumer reports, employee background screening reports, investigation reports or credit reports☐ Online account access information, including usernames, passwords, security questions/answers☐ Precise geolocation data
☐ Contents of a person’s communications (unless the Supplier is the intended recipient of the communication)☐ Data related to criminal convictions or offenses or allegations of crimes☐ Special categories of data that reveal race or ethnicity, political opinions, religious or philosophical beliefs, tradeunion membership, health, or sex life or sexual orientation
Additional information about the processing – indicate if the personal information includes:☐ EEA or UK Personal Data
☐ Personal Information subject to the CA Privacy Law☐ Protected Health Information subject to HIPAA [Add Business Associate Agreement]☐ Other:[e.g., specially regulated data]
Nature of the processing
Provide a brief overview of the Services and the purposes for which the Personal Information will be processed:
Physical Location of the Personal Information
Indicate where the processing is carried out and where the Kodak Data are stored:
The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period☐ Kodak Information will be deleted automatically upon termination of the Agreement☐ Kodak Information will be deleted upon termination of the Agreement if requested by Kodak☐ Kodak Information will be retained after termination for[period]
Indicate data retention rules and controls that exist to prevent further Processing of the Kodak Data by theSupplier and the Subprocessors (if any).
Maximum Retention periods, if applicable:
Category of Personal Data

PurposeRetention PeriodPage 2/4

Restricted Data Transfers☐ Data are not transferred
Purpose(s) of the data transfer
The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis).
☐ One-off☐ Continuous or Periodic☐ Ad hoc, as needed for the processing activity☐ Other:
Basis for the transfer of EEA Personal Data:☐ Standard Contractual Clauses attached as Schedules 1 and 2.
☐ Supplier has approved set of Binding Corporate Rules for Data Processors.
☐ Other basis:
For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing
See Annex 3 below.
C. COMPETENT SUPERVISORY AUTHORITY FOR RESTRICTED TRANSFERS
Restricted Transfer

Competent Supervisory Authority & Governing Law

EEA Transfers

Country where Controller is located.

Swiss Transfers

Federal Data Protection & Information Commissioner (FDPIC) – Switzerland

UK Data Transfers

Information Commissioner (ICO) – United Kingdom

ANNEX II - TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL
MEASURES TO ENSURE THE SECURITY OF THE DATA
Description of the technical and organisational measures implemented by the data importer(s) (including any relevantcertifications) to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of theprocessing, and the risks for the rights and freedoms of natural persons.
Supplier should either attach its standard security schedule or else provide a link to where security information is posted online. The
Supplier’s program must meet or exceed the requirements in the Information Security Requirements for Kodak Data.
Supplier’s information security program is described on Supplier’s website at [URL].
ANNEX III – LIST OF SUBPROCESSORS
Kodak has authorised Supplier’s use of the subprocessors listed at [URL]. OR:
Kodak has authorised Supplier’s use of the following subprocessors:
Subprocessor
Name

Subprocessor
Address

Description ofthe Services

Categories of PI

Location of theProcessing(list all)Transfer
Mechanism (ifEEA Data)

Page 3/4

Page 4/4