Harmonic Group GDPR Data Protection Policy

• The offering of goods and services to Data Subjects that are in the EU;
• The monitoring of their behaviour which takes place within the EU.

1. Processed fairly, lawfully and transparently;
2. Collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes;
3. Limited to what is required for the stated purpose or purposes;
4. Accurate, complete and up to date;
5. Retained for not longer than is necessary for the stated purpose or purposes;
6. Kept safe and secure;
7. Provided to a Data Subject on request (please see Section 4); and
8. Not transferred to people or organisations situated in countries without adequate protection.

1. the identity and contact details of Harmonic;
2. the purpose in collecting the Personal Data as well as the legal basis for processing;
3. the legitimate interests of Harmonic or third party and an explanation of those interest (where processing is based on this ground);
4. the persons or categories to whom the Personal Data may be disclosed;
5. details of any transfers out of the EEA, safeguards in place and the means by which to obtain a copy of them;
6. the period for which the Personal Data will be stored;
7. the Data Subject’s right to rectify Personal Data if inaccurate;
8. the Data Subject’s right to the portability of their Personal Data;
9. the Data Subject’s right to withdraw consent; and
10. the Data Subject’s right to lodge a complaint with the applicable local supervisory authority for data protection matters.

Harmonic generally meets these requirements through a Disclosure Notice contained in Harmonic’s Staff Member Manual (in the case of employees and independent contractors of Harmonic) and a summarised disclosure contained in the relevant services agreement (in the case of vendors of Harmonic) or by means of the Disclosure Notice on Harmonic’s website. The Disclosure Notice has been circulated to all Relevant Persons prior to the Data Protection Legislation taking effect.

Harmonic will ensure that all information and communications relating to the processing of Personal Data will be clear, concise, transparent, intelligible, easily accessible and easy to understand using clear and plain language. Harmonic will ensure that these transparency requirements are adhered to at all stages of the collection and processing of Personal Data.

1. where the Data Subject has given consent to the processing;
2. where this is necessary for the performance of the Business Contract;
3. where this is necessary in order to protect the vital interests of the Data Subject or another natural person;
4. where this is necessary for the performance of a task carried out in the interest or in the exercise of official authority vested in Harmonic;
5. where this is necessary for compliance with a legal obligation to which Harmonic is subject (such as the anti-money laundering and anti-terrorist financing obligation to verify identity and retain copies of materials in respect thereof for such period after the relationship terminates as may be required by applicable law); and/or
6. where this is necessary for the purposes of the legitimate interests of Harmonic or a third party and such legitimate interests are not overridden by the Data Subject’s interests, fundamental rights or freedoms.

1. where this is necessary for the performance of the Business Contract;
2. where this is necessary for compliance with a legal obligation to which Harmonic is subject (such as the anti-money laundering obligation to verify identity or the prevention of fraud); and/or
3. where this is necessary for the purposes of the legitimate interests of Harmonic or a third party (such as direct marketing and analysing personal data for quality control, business and statistical analysis, tracking fees and costs, training and related purposes). Such legitimate interests are not overridden by the Data Subject’s interests, fundamental rights or freedoms.

Harmonic will not process Personal Data in a manner that is incompatible with the manner communicated to Data Subjects.

1. Access to IT servers is restricted in a secure location to a limited number of staff;
2. Access to systems is password protected;
3. A back up procedure is in operation;
4. Manual files containing Personal Data, financial information or confidential information are kept in a secure locked location with restricted access to staff; and
5. A strong emphasis is placed on the security of Personal Data when it is held on portable devices.

These safeguards may be provided for by:

1. Standard data protection clauses: the Commission has adopted three sets of model clauses which are available on the Commission’s website (https://ec.europa.eu/info/law/law-topic/data-protection_en);
2. Binding corporate rules: legally binding data protection rules approved by the competent data protection authority which apply within a corporate group;
3. Approved codes of conduct together with binding and enforceable commitments of the Data Controller or Data Processor in the third country;
4. Approved certification mechanisms together with binding and enforceable commitments of the Data Controller or Data Processor in the third country.

In the absence of an adequacy decision or of appropriate safeguards a transfer or a set of transfers may take place on the basis of so-called “derogations” which allow transfers in specific cases, such as based on consent, for the performance of a contract, for the exercise of legal claims or for important reasons of public interest.

In the normal course of business (for back-up or servicing purposes) it may be necessary for Harmonic to transfer Personal Data for processing to the following: (i) certain third parties whose involvement is necessary to carry out all or part of Harmonic’s duties and obligations contemplated under the Business Contract and in accordance with Harmonic’s internal procedures. Examples of such third parties would be in the case of the Personal Data of an employee/independent contractor transferred by Harmonic to a payroll services provider; (ii) an agent, delegate, subcontractor or other representative of Harmonic (which may or may not be an affiliate of Harmonic) appointed by Harmonic pursuant to authority contained in the Business Contract. Any such entity in (i) or (ii) shall be a “Permitted Processor”. As part of normal business dealings between Harmonic and the Permitted Processor Harmonic will transmit Personal Data to such Permitted Processor. Certain Permitted Processors may be located outside the EEA and so Personal Data may be stored on servers outside the EEA. Any transmission of data by Harmonic outside the EEA shall be in accordance with the conditions of the Data Protection Legislation. Subject to applicable provisions of the Data Protection Legislation, the Personal Data shall not be shared by Harmonic with third-parties other than Permitted Processors.

In certain circumstances Harmonic and/or Permitted Processors may be legally obliged to share Personal Data and other financial information with respect to the Business Contract with their local regulatory or governmental authorities (including but not limited to tax authorities) or courts (each an “Authority”) and the local receiving Authority may, in turn, exchange this information (through automatic reporting, information exchange or otherwise in accordance with applicable laws and regulations) with foreign Authorities including Authorities located outside the EEA.

Where Harmonic is processing their Personal Data the Data Subject will have the right to access such Personal Data and the following information:

1. the purpose of the processing;
2. the categories of Personal Data concerned;
3. the persons or categories of persons to whom the Personal Data may be disclosed, in particular recipients in third countries or international organisations;
4. the envisaged period for which the Personal Data will be stored, or, if not possible, the criteria used to determine that period;
5. the existence of the right to request from Harmonic rectification or erasure of the Personal Data or restriction of processing of Personal Data concerning the Data Subject or to object to such processing;
6. the right to lodge a complaint with the applicable local supervisory authority for data protection matters;
7. where the Personal Data is not collected for the Data Subject, any available information as to their source;
8. the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the Data Subject.

Where Personal Data is transferred to a third country or an international organisation, the Data Subject shall have the right to be informed of the appropriate safeguards pursuant to Article 46 relating to the transfer.

The right to obtain a copy of the Personal Data undergoing processing will not adversely affect the rights and freedoms of others.

Harmonic will not charge a fee for complying with the Data Subject’s access request unless it can be demonstrated that the cost will be excessive, in which case the fee must be reasonable.

The information must be provided without delay and within one month, but where requests are complex Harmonic will be able to extend the deadline for providing the information to three months. However, Harmonic must still respond to the request within a month, explaining why the extension is necessary.

A request to Harmonic may be made in electronic format as well as by written request.

Given the specific nature for which Harmonic uses the Personal Data it collects, this is not likely to be applicable to the Data Subjects of Harmonic.

Where processing has been restricted, such Personal Data shall, with the exception of storage, only be processed with the Data Subject’s consent. Harmonic will inform the Data Subject before the restriction of processing is lifted.

Harmonic shall no longer process the Personal Data unless Harmonic demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the Data Subject or for the establishment, exercise or defence of legal claims.

Data Subjects shall have the right to object to the processing of Personal Data for direct marketing purposes at any time. Where the Data Subject objects to processing for direct marketing purposes, the Personal Data shall no longer be processed for such purposes.

1. The provisions of the Data Protection Legislation;
2. The approach Harmonic takes to ensure compliance with its obligations; and
3. Recent developments and guidance in the area.