Privacy statement for GatesConnect™

Gates Corporation (“Gates”), a Delaware Company, headquartered at 1144 Fifteenth St., Suite
1400, Denver, Colorado 80401, is committed to protecting and respecting any personal
information you share with us. Gates will be acting as a “data controller” for the processing
activities described in this statement, which means that we define the purposes and the means for
these processing activities.

This privacy statement concerns the processing with respect to Gates’ global customer order
management in GatesConnect™ and explains the reason for the processing, the way we collect,
handle and ensure protection of all personal data provided in GatesConnect™, how that
information is used and what rights can be exercised in relation to personal data. The supplier
declares that its employees, whose data has been made available, have been informed about this
statement.

Gates is committed to respecting privacy regulations and data protection rights. For general
information on the processing of personal data by Gates, please first read the Gates Global
Internal Privacy Principles and the Gates Industrial Europe SARL Privacy Policy, found here:
https://www.gates.com/gb/en/utility/privacy-policy.

Gates collects personal data in GatesConnect™ with the following purposes:

• Performance, settlement, and/or conclusion of customer orders;
• Sales and administrative reasons; and
• Receiving services.

Personal data collected in this context may become part of the database in GatesConnect™ with
the purpose to centrally gather, evaluate and report supplier data.

Only data necessary for the above purposes is collected and processed, namely: name (first and
last) of contact persons at the customer company, phone numbers, e-mail (function and title but
this is not mandatory), and company details (such as company name, street, postal code, town,
country). No special categories of personal data are collected (such as health data, racial or
ethnic origin, political opinions, religious or philosophical beliefs, sexual orientation).

Gates only keeps the data for as long as necessary with regard to the purpose(s) of the processing
of personal data and only relevant Gates employees have access to the data. Gates will not share
personal data with third parties.

Gates will apply adequate security measures to protect personal data to any type of harm, such as
unauthorized access or disclosure, loss, theft or damage. If data transfers take place outside of the
EEA, Gates takes appropriate steps to ensure the protection of personal data, in particular by an
intragroup data transfer agreement.

According to the EU General Data Protection Regulation (GDPR) 2016/679, data subjects in the
European Union are entitled to data subject rights such as the right to access, rectification,
erasure.

• Suppliers can access, change or update their information directly in GatesConnect™ or
   by contacting Customer Service or other Gates point of contact.
• Suppliers can exercise their other rights (e.g., access, erasure) by contacting
   privacy@gates.com or via post to:

  Data Privacy Team
  Gates Corporation
  1144 Fifteenth Street, Suite 1400
  Denver, Colorado 80202
  

• Specifically for our German entities, we have appointed a Data Protection Officer, to be
   contacted via DPO-Gates@data-elements.de.