Privacy Notice

We strive to provide you with choices regarding certain personal data uses, particularly around marketing and advertising.

We may use your Identity, Contact, Technical, Usage and Profile Data to form a view on what we think you may want or need, or what may be of interest to you. This is how we decide which products, services and offers may be relevant for you.

You will receive marketing communications from us if you have requested information from us or purchased goods or services from us or if you provided us with your details when you entered a competition or registered for a promotion and, in each case, you have not opted out of receiving that marketing.

You can ask us or third parties to stop sending you marketing messages at any time by checking or unchecking relevant boxes on any email we send to adjust your marketing preferences or by following the opt-out links on any marketing message sent to you or by contacting us at any time.

Where you opt out of receiving these marketing messages, this will not apply to personal data provided to us as a result of a product/service purchase, warranty registration, product/service experience or other transactions.

This section covers the ways in which we collect, hold, use and disclose your personal information in relation to your use of our websites and other social media platforms, systems and applications which belong to or are used by us.

Our websites, platforms, systems and applications are not intended for children and we do not knowingly collect data relating to children

Our website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy notice of every website you visit.

Cookies - we may monitor your use of our websites through the use of cookies and similar tracking technologies. For example, we may monitor how many times you visit, which pages you go to, traffic data, location data and the originating domain name of a user's internet service provider. This information helps us to build a profile of our users and provide more relevant information for our users. Some of this data will be aggregated or statistical, which means that we will not be able to identify you individually.

You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of our websites may become inaccessible or not function properly. You will still be able to purchase products and/or services.

We and third parties such as Google, use cookies or other third-party identifiers to compile data regarding our advertisements. We may also use remarketing to advertise across other websites. For example, Google will show our advertisements across other websites that you are visiting based on your past visits to our website to ensure you receive advertisements that are relevant to you.

For further information on our use of cookies, please see our Cookie Policy.

To enable us and other companies in our group to make credit decisions about you and the organisation(s) you work for, and for fraud prevention and money laundering purposes, we may search the files of credit reference and fraud prevention agencies (who will record the search).

We may disclose information about how you conduct your account to such agencies. Other credit grantors may use this information to make credit decisions about you and the organisations with whom you are financially associated, as well as for fraud prevention, debtor tracing and money laundering purposes. If you provide false or inaccurate information and we suspect fraud, we will record this.

This section covers the ways in which we collect, hold, use, and disclose personal information in relation to our third party due diligence process.

To help us take informed decisions about individuals or companies we consider conducting business with, we use a screening tool to undertake what is called a due diligence process. This involves using publicly available information and personal information provided to us, to identify the potential risks of conducting business with any third party.

We process personal data in the context of the due diligence process to ensure that we only conduct business with trustworthy third parties. Our aim is also to ensure compliance with applicable laws, regulations, and with our own Code of Business Conduct and Ethics.

Which personal data do you process?

The types of personal data we might process about you or the company you work for in the context of the due diligence process include:

1. Your contact details: e.g., your first name, surname, and your email address (to send you our due diligence questionnaire and to communicate with you regarding the completion of our due diligence).

2. In the due diligence questionnaire, we may ask for:

a) the names of notable individuals within your company (i.e., the owners of your company, members of the board of directors, CEO, CFO, and COO).

b) proof of existence and registration (incorporation documents may include personal data such as name, home address, and date of birth).

c) details and copies of relevant licences or permits required to conduct business with us. These may include picture, name, and date of birth. We recommend removing or striking through any personal information not relevant for our verification of your licence or permit.

d) documents to verify your identity, such as a passport, driving licence, or ID card.

e) certifications relating to any criminal convictions, penalties or sanctions made against your company, owners of your company, members of the board of directors, CEO, CFO, and COO.

3. We may use a third party screening tool to screen companies or individuals we are considering conducting business with. This involves checking the information that you provide to us against publicly available information – for example, information included on public registers, sanctions lists, regulatory sources, in the media, and other legal sources (such as published court cases).

We may use your first name and surname and, to the extent available to us, other personal data such as middle name, alias(es), email address, date of birth, gender, job title, employer, address details, country of citizenship, and, exceptionally, social security number or tax ID (using the latter numbers only, to the extent allowed by the applicable laws).

The screening tool shows records of the company searched, as well as the individuals affiliated with that company, such as its CEO or CFO, if such information is publicly available.

Who has access to my personal data?

Access to personal data within Oxford Instruments

Your personal data will be available within the Oxford Instruments legal entity you do business with, as well as the compliance function of its parent company, Oxford Instruments plc. Within those companies, we limit access to your personal data: your personal data will only be available to those who have a business need to access it, and only to the extent necessary to meet the purposes specified above. The individuals within Oxford Instruments who have access to your personal data have been trained in data protection and data handling and are subject to contractual confidentiality obligations.

We also use technical measures to safeguard your personal data, such as firewalls, encryption technology, and secure servers.

Access to your personal data by third parties

The personal information we collect is intended for our internal business process of deciding whether to enter into a business relationship with you or the company you work for. But we do also use a third party screening tool.

We may have to share your personal data with third parties (See ‘Disclosure of your personal data’ above) for the purposes set out in the table above. Where third parties are given access to personal data, we will take the appropriate security measures to safeguard this information. For example, if your personal data is transferred to a recipient in a country outside the European Economic Area that does not provide an adequate level of protection for personal data, we will provide for appropriate safeguards (for example, a contract encompassing the standard data protection clauses adopted by the European Commission).

We may occasionally need to undertake additional screening by outsourcing to a specialist third party company. If required, we may also share personal data with our professional advisors, for example in the event of a dispute or legal matter. We may also need to disclose information to governmental and regulatory bodies and other third parties under applicable law (for example, to comply with a court order or a request from a regulator).

Information about the appropriate safeguards we take to enable the transfer of personal data can be obtained by emailing privacy@oxinst.com

For how long do you retain personal data?

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

Local laws may require that we keep personal information about you for a certain period of time. For example, in the UK we are required to keep your personal data (including Contact, Identity, Financial and Transaction Data) for a period of six years. Personal data may be retained longer if legal or regulatory requirements so dictate, or if such longer retention is required in case of a (potential) legal dispute.

Your Rights

The specific rights you have under applicable data protection laws depends on which laws are applicable to you as an individual. Please click on the country specific tabs below to find out more about your rights, or contact us at privacy@oxinst.com

This section applies to our processing of personal data of individuals in the EEA, UK and Switzerland pursuant to the retained EU law version of the General Data Protection Regulation (EU) 2016/679 in the UK and the Data Protection Act 2018 (“UK GDPR”), the General Data Protection Regulations (EU) 2016/679 (“EU GDPR”), the Swiss Federal Data Protection Act (“FDPA”), and other applicable local legislation in these territories, and supplements our general privacy statement above.

Some of our Internal Third Parties and External Third Parties are based outside the European Economic Area (EEA), Switzerland and/or the UK so their processing of your personal data will involve a transfer of data outside these territories.  We comply with applicable legal requirements to safeguard your personal data transferred outside of the these territories.

If you are located in the EEA, Switzerland or the UK, under certain circumstances, you may have rights under the applicable data protection laws in relation to your personal data, such as:

• Request access to (and/or a copy of) your personal data (commonly known as a "data subject access request”) to check its lawful processing;
• Request correction of the personal data that we hold about you to correct any incomplete or inaccurate data;
• Request erasure of your personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law;
• Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing. You also have the right to object where we are processing your personal data for direct marketing purposes;
• Request restriction of processing of your personal data for example: (a) if you want us to establish the data's accuracy; (b) where our use of the data is unlawful (but you do not want us to erase it); (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it;
• Request the transfer of your personal data to you or to a third party in a structured, commonly used, machine-readable format;
• Withdraw consent at any time to our processing your personal data, noting this will not affect the lawfulness of any processing carried out before you withdraw your consent and if you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

If you wish to exercise any of the rights set out above, please contact us.

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it.

We may also contact you to ask you for further information in relation to your request to speed up our response.

If you wish to exercise any of these rights, you should therefore:

• put your request in writing to us at privacy@oxinst.com;
• include proof of your identity and address (for example, a copy of your driving licence or passport, and a recent utility or credit card bill); and
• specify the nature of your request, including any account or reference numbers where applicable.

If you wish us to stop processing your personal data for direct marketing purposes, you should:

• email us at privacy@oxinst.com with a header that says 'Unsubscribe' or click the appropriate link in an email you have received from us;
• provide us with enough information to identify you; and 

• if your objection is not to direct marketing in general, but to direct marketing by a particular channel (for example, email, mail or telephone) or from a particular Oxford Instruments business unit, please specify the channel or business unit you are objecting to.

If you receive emails from different product lines sold by different Oxford Instruments’ business units, please use the opt-out functionality in each email to be sure you are unsubscribed from all.

The supervisory authority applicable for personal data processing pursuant to the UK GDPR  is the Information Commissioner's Office (ICO) (www.ico.org.uk).

The details of the relevant supervisory authorities for personal data processing pursuant to the EU GDPR is available here. 

The relevant supervisory authority for personal data processing pursuant to the FDPA is the Swiss Federal Data Protection and Information Commissioner (DPIC) (www.edoeb.admin.ch)

Representatives

Our legal entities located outside the UK who offer goods and services to data subjects within the UK have each appointed a UK representative for the purposes of the UK GDPR. Our legal entities located outside the EU who offer goods and services to data subjects within the EU have each appointed an EU representative for the purposes of the EU GDPR.

Oxford Instruments GmbH is the appointed EU representative for: Oxford Instruments plc, Oxford Instruments Industrial Products Limited, Oxford Instruments Nanotechnology Tools Limited, Andor Technology Limited, Oxford Instruments Overseas Marketing Limited, Oxford Instruments Asylum Research, Inc., Oxford Instruments X-Ray Technology, Inc., Bitplane AG, and FemtoTools AG.

Oxford Instruments plc is the appointed UK representative for: Oxford Instruments Asylum Research, Inc., Oxford Instruments X-Ray Technology Inc., Bitplane AG, WITec Wissenschaftliche Instrumente und Technologie GmbH, First Light Imaging SAS, and FemtoTools AG.”

This section applies to our processing of personal data of individuals in China pursuant to the Chinese Personal Information Protection Law (the “PIPL”), and supplements our general privacy statement above (“Chinese Data”).

We do not rely on legitimate interests as a lawful basis to process your personal data in China – the other lawful bases listed in the table above on how we process your personal data apply to our processing of your personal data in China.

Your financial data may be considered sensitive personal data under the PIPL. We process such data by strictly following applicable Chinese law and only for the following purposes:

• Manage payments, fees and charges;
• Collect and recover money owed to us;
• Provide customer service; or
• Carry out repairs.

If it is necessary for us to transfer personal data in case of a merger, division, dissolution, declaration of bankruptcy, or other reasons, we will notify you of the name and contact information of the recipient. The recipient shall comply with this privacy statement when processing Personal Data.

We are a global group of companies, and we use cross-border Internal Third Parties and External Third Parties to help us run our businesses. For purposes as described in this privacy statement above, we may transfer your personal data to Internal Third Parties and External Third Parties outside of China.

We will use lawful cross-border transfer mechanism to transfer your personal data overseas and adopt necessary measures to ensure the overseas recipients can provide the same level of protection as required under applicable Chinese law.

In case a security incident occurs, we will take remediation actions immediately and notify relevant government authorities and affected employees, when required by applicable law.

If you are located in China, under certain circumstances, you may have rights under the applicable data protection laws in relation to your personal data, such as:

• Request access to (and/or a copy of) your personal data (commonly known as a "data subject access request”) to check its lawful processing;
• Request correction of the personal data that we hold about you to correct any incomplete or inaccurate data;
• Request erasure of your personal data where there is no good reason (e.g. the processing purpose has been achieved, is impossible to achieve, or it is no longer necessary to achieve the processing purpose) for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or in violation of applicable local law, where you have withdrawn your consent (if we rely on consent to process your personal data) or where we are required to erase your personal data to comply with applicable Chinese law;
• Object to processing of your personal data where you want to object to our processing of your personal data. You also have the right to object where we are processing your personal data for direct marketing purposes;
• Request restriction of processing of your personal data for example: (a) if you want us to establish the data's accuracy; (b) where our use of the data is unlawful (but you do not want us to erase it); (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it;
• Request an explanation from us of the rules on data processing;
• Withdraw consent at any time to our processing your personal data, noting this will not affect the lawfulness of any processing carried out before you withdraw your consent and if you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

If you wish to exercise any of the rights set out above, please contact us.

We endeavour to respond to legitimate requests in a timely manner. Occasionally it may take us longer if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it.

We may also contact you to ask you for further information in relation to your request to speed up our response.

If you wish to exercise any of these rights, you should therefore:

• put your request in writing to us at PrivacyCN@oxinst.com;
• include proof of your identity and address (for example, a copy of your driving licence or passport, and a recent utility or credit card bill); and
• specify the nature of your request, including any account or reference numbers where applicable.

If you wish us to stop processing your personal data for direct marketing purposes, you should:

• email us at PrivacyCN@oxinst.com with a header that says 'Unsubscribe' or click the appropriate link in an email you have received from us;
• provide us with enough information to identify you; and 

• if your objection is not to direct marketing in general, but to direct marketing by a particular channel (for example, email, mail or telephone) or from a particular Oxford Instruments business unit, please specify the channel or business unit you are objecting to.

If you receive emails from different product lines sold by different Oxford Instruments’ business units, please use the opt-out functionality in each email to be sure you are unsubscribed from all.

To contact us about data privacy matters in China, you can email us at PrivacyCN@oxinst.com.

The data protection authority in China for Chinese Data is the Office of the Central Cyberspace Affairs Commission (www.cac.gov.cn).

This section applies to our processing of personal data of individuals in Brazil pursuant to Brazilian data protection law, Federal Law No. 13,709/2018 Lei Geral de Proteção de Dados Pessoais (the “LGPD”), and supplements our general privacy statement above (“Brazilian Data”).

Our privacy notice explains what personal data (which includes Brazilian Data) we collect, and how and why we use it. We only process Brazilian Data when we have a legal basis for the processing, such as in order to fulfil a contract with you, where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests, or where we need to comply with a legal or regulatory obligation. Generally, we do not rely on your consent as a legal basis for processing your personal data other than in relation to some direct marketing communications to you from ourselves and/or third parties. You have the right to withdraw consent to that form of marketing at any time by contacting us.

As noted in our privacy notice, we may share Brazilian Data for the purposes set out above with Internal Third Parties and External Third Parties as set out in the Schedule. As permitted by the LGPD, we may also share Brazilian Data in connection with the sale of business assets or as required by law.

Brazilian Data may be processed outside of Brazil in countries which may not have equivalent privacy or data protection laws but will be processed with appropriate safeguards in place in compliance with the LGPD.

We retain Brazilian Data for as long as the information is needed for the purposes set forth above and for any additional period that may be required or permitted by law.

We respect the rights of Brazilian residents to access, correct and request erasure or restriction of their personal data as required by LGPD. Subject to some limitations as provided by LGPD, this means:

• you have a right to know if we hold personal data about you and the right to access that personal data;
• you have the right to ask us to correct or update incomplete, inaccurate or outdated information;
• you have the right to ask us to anonymise, block or eliminate any unnecessary or excessive personal data, or any personal data processed in non-compliance with LGPD;
• you have the right to data portability, in accordance with national authority regulations;
• you have the right to receive information about who we share your personal data with; and
• if we are processing your personal data on the basis of your consent, you also have the right withdraw your consent and be informed of your right to do so and its consequences, and request that we delete your personal data, subject to our rights to retain personal data as provided by LGPD.

If you wish to exercise your rights, please send an email to privacy@oxinst.com or you can write to us at Attention: Group Data Privacy Manager, Tubney Woods, Abingdon, Oxon OX13 5QX, UK.

The data protection authority in Brazil for Brazilian Data is the Autoridade Nacional de Proteção de Dados or the “ANPD”.

This section applies to residents within certain states of the USA and supplements our general privacy statement above.

Effective Date: 1^st January 2023

Last Updated: 1^st January 2022

If you are located in the states of Colorado, Connecticut, Virginia and Utah you have specific rights.

You have the right to:

• Confirm whether we process your personal information.

• Access and delete certain personal information.

• Data portability.

• Opt-out of personal data processing for targeted advertising and sales.

• Correct inaccuracies in your personal information, taking into account the information's nature processing purpose.

• Opt-out of profiling in furtherance of decisions that produce legal or similarly significant effects.

To exercise any of these rights please send an email to privacyUS@oxinst.com, FAO: Legal Counsel or call the following toll-free number: 800-447-4717. To appeal a decision regarding a consumer rights request send an email addressed to the Oxford Instruments Group Data Privacy Manager at privacy@oxinst.com within 7 days of the date of the decision.

Nevada provides its residents with a limited right to opt-out of certain personal information sales. Residents who wish to exercise this sale opt-out rights may submit a request to this designated address: privacyUS@oxinst.com, FAO: Legal Counsel or call the following toll-free number: 800-447-4717. However, please know we do not currently sell data triggering that statute's opt-out requirements.

If you are located within the state of California, the following is applicable to you and is in compliance with the California Privacy Act of 2018 (CCPA) and the California Privacy Rights Act (CPRA) 2022.

Our website collects information that identifies, relates to, describes, references, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer, household, or device ("personal information"). Personal information does not include:

• Publicly available information from government records.

• Deidentified or aggregated consumer information.

• Information excluded from the CCPA's scope, like:

• health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA), clinical trial data, or other qualifying research data;

• personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FCRA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA), and the Driver's Privacy Protection Act of 1994.

In particular, our website has collected the following categories of personal information from consumers within the last twelve (12) months:

Our website obtains the categories of personal information listed above from the following categories of sources:

• Directly from you. For example, from forms you complete or products and services you purchase.
• Indirectly from you. For example, from observing your actions on our website or where you have published a paper.
• From our third-party service providers that help us provide products and services.
• From third parties who interact with us in connection with the services we perform.

Use of Personal Information

We may use or disclose the personal information we collect for one or more of the following purposes:

• To fulfil or meet the reason you provided the information. For example, if you share your name and contact information to request a price quote or ask a question about our products or services, we will use that personal information to respond to your inquiry. If you provide your personal information to purchase a product or service, we will use that information to process your payment and facilitate delivery. We may also save your information to facilitate new product orders or process returns.

• To provide, support, personalize, and develop our website, products, and services.

• To create, maintain, customize, and secure your account with us.

• To process your requests, purchases, transactions, and payments and prevent transactional fraud.

• To provide you with support and to respond to your inquiries, including to investigate and address your concerns and monitor and improve our responses.

• To personalize your website experience and to deliver content and product and service offerings relevant to your interests, including targeted offers and ads through our website, third-party sites, and via email or text message (with your consent, where required by law).

• To help maintain the safety, security, and integrity of our website, products and services, databases and other technology assets, and business.

• For testing, research, analysis, and product development, including to develop and improve our website, products, and services.

• To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.

• As described to you when collecting your personal information or as otherwise set forth in the CCPA or the CPRA.

• To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by us about our website users/consumers is among the assets transferred.

We will not collect additional categories of personal information or use the personal information we collected for materially different, unrelated, or incompatible purposes without providing you notice.

Sharing Personal Information

We may share your personal information by disclosing it to a third party for a business purpose. We only make these business purpose disclosures under written contracts that describe the purposes, require the recipient to keep the personal information confidential, and prohibit using the disclosed information for any purpose except performing the contract. In the preceding twelve (12) months, we have disclosed personal information for a business purpose to the categories of third parties indicated in the chart below.

Your Rights and Choices

The CCPA and the CPRA provides consumers (California residents) with specific rights regarding their personal information. This section describes your CCPA and CPRA rights and explains how to exercise those rights.

Right to Know and Data Portability

You have the right to request that we disclose certain information to you about our collection and use of your personal information over the past 12 months (the "right to know"). Once we receive your request and confirm your identity we will disclose to you:

• The categories of personal information we collected about you.

• The categories of sources for the personal information we collected about you.

• Our business or commercial purpose for collecting that personal information.

• The categories of third parties with whom we share that personal information.

• If we disclosed your personal information for a business purpose a list identifying the personal information categories that each category of recipient obtained.

• The specific pieces of personal information we collected about you (also called a data portability request).

Right to Delete or Correct

You have the right to request that we delete or correct any inaccuracies in your personal information that we collected from you and retained, subject to certain exceptions. Once we receive your request and confirm your identity, we will review your request to see if an exception allowing us to retain the information applies. We may deny your deletion request if retaining the information is necessary for us or our service provider(s) to:

Complete the transaction for which we collected the personal information, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, fulfill the terms of a written warranty or product recall conducted in accordance with federal law, or otherwise perform our contract with you.

Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.

Debug products to identify and repair errors that impair existing intended functionality.

Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.

Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 <em>et. seq.</em>).

Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information's deletion may likely render impossible or seriously impair the research's achievement, if you previously provided informed consent.

Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us.

Comply with a legal obligation.

Make other internal and lawful uses of that information that are compatible with the context in which you provided it.

We will delete or deidentify personal information not subject to one of these exceptions from our records and will direct our service providers to take similar action.

We may deny your correction request if responding to the request proves impossible or involves disproportionate effort, or you improperly seek to correct accurate information.

Exercising Your Rights to Know, Delete or Correct

To exercise your rights to know, delete or correct described above, please submit a request by either:

• Calling us at 800-447-4717

• Emailing us at privacyUS@oxinst.com, FAO: Legal Counsel

Only you, or someone legally authorized to act on your behalf, may make a request to know or delete related to your personal information.

You may only submit a request to know twice within a 12-month period. Your request to know or delete must:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative, which should include three pieces of identification such as passport, driver’s licence and social security number. If you are not able to provide all of these documents we will discuss with you alternate methods of identification.

• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you.

You do not need to create an account with us to submit a request to know, delete or correct. However, we do consider requests made through your password protected account sufficiently verified when the request relates to personal information associated with that specific account.

We will only use personal information provided in the request to verify the requestor's identity or authority to make it and we will delete it immediately following verification of your identification.

Response Timing and Format

We will confirm receipt of your request within ten (10) business days. If you do not receive confirmation within the 10-day timeframe, please contact the Group Data Privacy Manager by email at privacy@oxinst.com or by mail to Tubney Woods, Abingdon, Oxon OX13 5QX, UK.

We endeavor to substantively respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time (up to another 45 days), we will inform you of the reason and extension period in writing.

If you have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option.

Any disclosures we provide will only cover the 12-month period preceding our receipt of your request. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Marketing Opt-Out

If you receive direct marketing from any Oxford Instruments company and you wish to opt out of receiving further communications, please submit a request to us by visiting the following internet web page link:

https://oxinst.com/opt-out

Non-Discrimination

We will not discriminate against you for exercising any of your CCPA or CPRA rights. Unless permitted by the CCPA or the CPRA, we will not:

• Deny you goods or services.

• Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.

• Provide you a different level or quality of goods or services.

• Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

However, we may offer you certain financial incentives permitted by the CCPA or the CPRA that can result in different prices, rates, or quality levels. Any CCPA/CPRA-permitted financial incentive we offer will reasonably relate to your personal information's value and contain written terms that describe the program's material aspects. Participation in a financial incentive program requires your prior opt-in consent, which you may revoke at any time.

Other California Privacy Rights

California's "Shine the Light" law (Civil Code Section § 1798.83) permits users of our website that are California residents to request certain information regarding our disclosure of personal information to third parties for their direct marketing purposes. To make such a request, please send an email to privacyUS@oxinst.com, FAO: Legal Counsel or write to us at: Oxford Instruments America Inc, 300 Baker Street, Suite 150, Concord, MA 01742, FAO: Legal Counsel.

Changes to Our Privacy Policy

We reserve the right to amend this privacy policy at our discretion and at any time. When we make changes to this privacy policy, we will post the updated notice on the website and update the notice's effective date. Your continued use of our website following the posting of changes constitutes your acceptance of such changes.

Contact Information

If you have any questions or comments about this notice, the ways in which we collect and use your information described here, your choices and rights regarding such use, or wish to exercise your rights under law, please do not hesitate to contact us at:

Toll-Free Phone: 800-447-4717

Email: privacyUS@oxinst.com

Postal Address:

Oxford Instruments America Inc

Attn: Legal Counsel

300 Baker Street

Suite 150

Concord

MA 01742

If you need to access this policy in an alternative format due to having a disability, please email privacyUS@oxinst.com, FAO: Legal Counsel or call the toll-free number 800-447-4717.

Effective Date : January 2023

This section applies to our processing of personal data of individuals in Japan (“Japanese Data”) pursuant to the Japanese Act on the Protection of Personal Information (the “APPI”) and supplements our general privacy statement above.

Our privacy notice explains what personal data (which includes Japanese Data) we collect, and how and why we use it. We only process Japanese Data for the purposes specified in the table in “How we use your personal data” section of our privacy notice.

Some of our Internal Third Parties and External Third Parties are based outside Japan, the European Economic Area (EEA) and/or the UK. We will transfer personal data for Internal Third Parties and External Third Parties located outside Japan, the European Economic Area (EEA) and/or the UK by ensuring that the transferee has established an adequate personal information protection system as required by the APPI.

We do not collect any Sensitive Personal Information (Yo-hairyo-kojin-joho) about you (this includes details about race, creed, social status, medical history, and criminal record).

If you are located in Japan, under certain circumstances, you may have certain rights under the APPI in relation to your personal data, such as the right to:

• Request access to (and/or a copy of) your personal data;
• Request notification of the purpose of use of your personal data;
• Request correction, addition and/or deletion of your personal data held by us to correct any incorrect data;
• Request suspension of the processing of your personal data or erasure of your personal information when (a) your personal data is used beyond the purpose of use, (b) your personal data is used in a way that may encourage or lead to illegal or unjust activities, (c) it is not necessary to use your personal data, or (d) processing of your personal data may harm your rights or legitimate interests; and
• Request cessation of the transfer of your personal data when (a) your personal data is transferred inside/outside Japan without complying with the Act on the Protection of Personal Information of Japan, (c) it is not necessary to use your personal data, or (d) processing of your personal data may harm your rights or legitimate interests.

If you wish to exercise your rights, please send an email to privacy@oxinst.com or you can write to us at Attention: Group Data Privacy Manager, Tubney Woods, Abingdon, Oxon, OX13 5QX, UK

The data protection authority in Japan for Japanese Data is the Personal Information Protection Commission or the “PPC” (https://www.ppc.go.jp/en/index.html).

This section applies to the collection, holding, use and disclosure of personal information for our Australian activities (Australian Data) in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) and supplements our general privacy statement above.

Our privacy statement explains the kind of personal information (which includes Australian Data) we collect, and how and why we collect and hold it. We only use and disclose Australian Data for the purposes specified in the table in “How we use your personal data” and disclose your personal information in accordance with the "Disclosure of your Personal Data" section of our privacy statement.

When the law authorises or requires us to collect information

We may collect your personal information:

• because we are required or authorised by an Australian law or court or tribunal order to collect that information; and

• we will tell you if collection is required or authorised by law, and if so, provide you with details of the law, court, or tribunal order.

What happens if you do not give us your personal information?

You have the option of engaging with us anonymously or under a pseudonym. However, if you chose to interact with us under anonymity or under a pseudonym, this may affect our ability to deliver our products or services to you. Please let us know at the earliest time practicable whether you want to interact with us under these conditions.

Sharing outside of Australia

In order to run our business, we may need to share some of your personal information with organisations (for example, our related entities and service providers) that are located outside Australia. Some of these organisations are located in Brazil, China, the European Economic Area, Switzerland, United Kingdom, Japan, USA.

We currently use cloud service providers, for example, Microsoft 365 and SAP CRM, and other electronic or networked systems, to store your personal information. As such systems can be accessed from various countries through an internet connection, it is not practicable to know in which country your personal information may be held. We may also need to share your personal information overseas if we sell, transfer or disclose our database of personal information to an actual or potential successor or purchaser located outside of Australia.

You consent to the disclosure of your information outside of Australia

Before we disclose your personal information to an organisation that is located outside of Australia, we are required to take reasonable steps to ensure that such an organisation does not breach the Privacy Act (in particular, Australian Privacy Principle 8.1). Whilst we will take steps to ensure that the organisation does not breach the Privacy Act in respect of your personal information disclosed to it, it is not always possible to ensure that the organisation will comply. We do not take any responsibility for the actions of such overseas third party recipients of your personal information. By agreeing to this Policy, you are agreeing that your personal information may be disclosed overseas and that Australian Privacy Principle 8.1 will not apply to that disclosure. This means that you will not have recourse against us under the Privacy Act in the event that an overseas recipient of your personal information breaches the Privacy Act.

Your rights to the personal information we collect and hold about you

You have the right to ask us:

• to give you the personal information we hold about you;

• to correct the personal information we hold if it is incorrect;

• to give you a copy of this Policy, in a form that suits you (for example, hardcopy or email); and

• not to use your personal information for direct marketing assessment purposes, including pre-screening.

Access to your personal information

If you want access to the personal information we hold about you, please send us an email to privacyAU@oxinst.com.

In some cases, a nominal administration fee may be charged to cover the cost of providing the personal information.

Correcting your personal information

If at any time you wish to change personal information we hold about you that is inaccurate or out of date, please send us an email to privacyAU@oxinst.com and we will amend this record.

In some situations, we may not agree to a request to correct personal information we hold about you, however if this occurs, we will inform you of our reason for not agreeing to the request.

If at any time, you believe on reasonable grounds that you have been a victim of fraud, you may request us not to use or disclose your personal information.

What happens when we no longer need your personal information?

We’ll only keep your information for as long as we require it for our business functions or activities as set out in this Policy. We are also required to keep some of your personal information for certain periods of time under law.

When we no longer require your personal information, we’ll ensure that it is destroyed or de-identified.

We may need to retain your personal information after our relationship has ended, however, we will not retain identifiable personal information longer than reasonably necessary and permitted by law.

Complaints

If we become aware of any concerns or problems concerning our privacy practices, we will take such issues seriously and work to address these concerns.

If you have any queries about this Policy, or have a problem or complaint, please send us an email to privacyAU@oxinst.com.

If your complaint remains unresolved, you may refer the matter to the Office of the Australian Information Commissioner. Its contact details are:

The Office of the Australian Information Commissioner GPO Box 2999

Canberra ACT 2601

Phone: 1300 363 992

Website: www.oaic.gov.au