Itron Global Employee Privacy Policy

Itron, Inc., its subsidiaries, and affiliated companies ("Itron," "we" or "us") value the importance of protecting your privacy and personal information. This Itron Global Employee Privacy Policy ("Policy") describes how Itron collects, uses, and shares employee personal information, protects employee privacy, and take steps to comply with applicable global privacy and data protection laws.

1. ACKNOWLEDGEMENT
Acknowledgement of this Policy is required prior to your disclosure of any personal information to Itron.

Please review this policy carefully.

2. SCOPE OF THE POLICY
This Policy applies to all Employee Personal Information defined herein as personal information collected and/or processed by Itron such as name, address, telephone number or email address, work experience, national identification numbers, and references of any potential employee (including applicants), contractor, and/or employee of Itron ("Employee").

This Policy applies to your interaction with Itron's talent acquisition, employment support, and benefit websites operated by or on behalf of Itron ("Services") and to Itron employment related processes such as training, performance evaluations, and employee management functions or offerings ("Processes").

Services are intended for use by persons aged 16 or older. Itron does not seek to collect personal information about children under the age of 16, except as provided by a parent or legal guardian for benefits purposes. No information should be submitted or posted on Itron's websites by users under the age of 16.

While browsing Services, you may be able to access the websites of third parties through a hyperlink. Itron assumes no responsibility for the privacy practices at third-party websites and recommends you review the privacy statements/notices on all websites before sharing your personal information.

3. INFORMATION WE COLLECT
3.1 Information You Provide to Us
During the course of conducting its business and complying with applicable laws and regulations, Itron must collect data, including Employee Personal Information, from you. For example, Itron collects information when you:

• Register online for an account on Itron career portals and other Services;
• Apply for a job through Itron recruitment Processes;
• Request Human Resources support; or
• Engage in other employment processes, such as on-boarding.

The types of information Itron may collect include:

• Name;
• Contact information;
• Employment history;
• Education history;
• Date of birth;
• National Identification number;
• Username;
• Email address;
• Postal address;
• Phone number;
• Characteristic information (i.e. race, age, gender); and

In addition, Itron will collect information:

• Provided during the job application and on-boarding process;
• In correspondence regarding payroll, benefits, and expenses data;
• About emergency contacts you provide;
• Through submission of attendance records of holidays, sickness, and other absences;
• For recruitment purposes including inclusion and diversity monitoring;
• Non-identifying aggregate information (inferences) may be collected and reviewed to analyze trends or preferences for its business processes and operations including, for example, managing company assets, reporting; and
• Regarding career history (e.g., training records, performance measures, disciplinary and grievance records).

3.2 Additional Information We Collect
3.2.1 Health Information
When necessary, Itron may collect information regarding an employee's health. Itron uses employee health information to comply with required health, safety, and compliance obligations.

3.2.2 Background Checks
Itron conducts background checks as part of its regular employment practices.

3.2.3 Drug Testing
Itron may require drug tests for new and current employees per customer contracts and contractors

3.2.4 Biometrics
Itron may, in certain limited circumstances and in the interest of physical security, engage in fingerprint or other form of biometric authentication to provide secure access.

3.2.5 CCTV
Itron may, in certain circumstances and in the interest of security, engage in Closed Caption Television recording at facilities. CCTV signage is posted where applicable.

3.3 Information We Collect Automatically When You Use Our Services or Networks
When you access or use our Services or while on the Itron network systems, Itron may automatically collect information about you, including:

Log Information: log information about your Internet use, including the type of browser you use, access times, pages viewed, your IP address, and the page you visited before navigating to our Services.

Device Information: information about the computer or mobile device you use to access our Services, including the hardware model, operating system and version, unique device identifiers, and mobile network information.

Network Information: technical data, such as access logs and emails and network traffic containing malware signatures, to protect its network and the confidential and proprietary information on its network against attack or unauthorized access.

4. USE OF EMPLOYEE PERSONAL INFORMATION
Itron only collects Employee Personal Information that it needs to accomplish its legitimate business purposes or fulfill contractual obligations.

4.1 Legal Basis for Processing
Itron processes Employee Personal Information:

• As necessary for the performance of our employment contract with an employee;
• As necessary for legitimate business purposes including:
  • Payroll processing,
  • Provision of employee benefits,
  • Fraud prevention,
  • Management of its workforce, and
  • For other purposes that are disclosed (or otherwise reasonably apparent) to its employees at the time of collection;
• As necessary for compliance with a legal obligation to which Itron is subject; or
• As necessary for the safety or security of our employees and assets.

Itron will keep and use Employee Personal Information to enable it to run its business and manage its relationship with the employee effectively, lawfully, and appropriately, during the recruitment process, while the employee is working for Itron, at the time employment ends, and thereafter as necessary.

Itron will notify its employees if it intends to use Employee Personal Information for a materially different purpose.

4.2 DISCLOSURE OF EMPLOYEE PERSONAL INFORMATION
Itron may disclose Employee Personal Information to third parties and service providers that assist Itron in processing the data and accomplishing the business purpose for which it was collected. This includes certain 'business purposes' as defined by the California Consumer Privacy Act (Cal. Civ. Code 1798.140(d)). For instance, Itron shares Employee Personal Information with payroll processing vendors and employee benefits administrators.

Itron may share Employee Personal Information:

• With payroll processing vendors and employee benefits administrators;
• To respond to lawful requests by public authorities responsible for public safety, law enforcement, or national security;
• In connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business by another company; or
• Between and among Itron and our current and future parents, affiliates, subsidiaries, and other companies worldwide under common control and ownership.

4.3 Do Not Sell
Except as stated herein, Itron does not rent, sell, or otherwise permit access by third parties to databases containing Employee Personal Information. Other than as described in this Policy, Itron will not disclose Employee Personal Information unless required to do so by law or in the good faith belief that such action (1) is required by law, (2) protects and defends the rights or property of Itron, or (3) is part of a transfer of assets to a successor in interest.

5. INTERNATIONAL DATA TRANSFERS
5.1 EU-U.S. Privacy Shield Framework
Itron may transfer Employee Personal Information among its worldwide locations to more efficiently or effectively accomplish the business purpose for which that Employee Personal Information was collected. Itron takes steps to protect Employee Personal Information when it is transferred to or from another country and in accordance with applicable law.

For purposes of this section, "Itron" refers only to Itron, Inc., the Itron entity that may receive in the U.S. and process Employee Personal Information from the European Union ("EU").

For its processing of Employee Personal Information received in the United States of America ("U.S.") from the EU ("EU Data"), Itron adheres to the EU-U.S. Privacy Shield Framework Principles designed by the U.S. Department of Commerce and the European Commission (the "Principles") to support transatlantic commerce. For more information about the Principles, please visit the Department of Commerce's Privacy Shield Website at https://www.privacyshield.gov.

In compliance with the Principles, Itron commits to resolve complaints about our collection or use of your personal information. EU individuals with inquiries or complaints regarding our Privacy Shield policy should contact Itron at:

Itron has further committed to refer unresolved Privacy Shield complaints to JAMS, an alternative dispute resolution provider located in the United States. If you do not receive timely acknowledgment of your complaint from us, or if we have not addressed your complaint to your satisfaction, please visit https://www.jamsadr.com/eu-us-privacy-shield for more information or to file a complaint. The services of JAMS are provided at no cost to you. Under certain conditions specified by the Principles, you may also be able to invoke binding arbitration to resolve your complaint. Itron is subject to the investigatory and enforcement powers of the FTC.

Itron may share EU Data with a third-party service provider that processes the data solely on Itron's behalf for the legitimate business purposes previously discussed. In the context of an onward transfer, Itron has responsibility for the processing of personal information it receives under the Privacy Shield and subsequently transfers to a third party acting as an agent on its behalf. Itron shall remain liable under the Principles if its agent processes such personal information in a manner inconsistent with the Principles, unless Itron proves that it is not responsible for the event giving rise to the damage.

6. SECURITY OF PERSONAL INFORMATION
Itron takes reasonable physical, technical, operational, and administrative measures and contractually requires our suppliers to help protect Employee Personal Information from loss, misuse, unauthorized access, disclosure, alteration, and destruction. Access to Employee Personal Information is limited only to those with a business 'need-to-know' based on their assigned job role, and access controls utilized within the systems used to store and process this data. Since the Internet is not completely secure, we cannot fully warrant or ensure the security of the personal information you provide.

6.1 Retention
Itron retains Employee Personal Information as long as is necessary to accomplish the purpose of the processing, to meet its legitimate business interests, or to comply with a legal obligation.

6.2 Training
Itron provides its employees appropriate training regarding its data protection policies.

7. MANAGING YOUR DATA
If you are an Itron Employee and a resident of a country or state that provides you with the right to (1) request a copy of the Employee Personal Information Itron holds about you; (2) request correction of any inaccuracies within such data; or (3) delete the Employee Personal Information, then you may submit such requests via our request web form. Itron will use reasonable efforts to supply, correct, or delete information that we hold about you in accordance with applicable laws.

7.1 GDPR
If you are an Itron Employee and resident of the EU where the General Data Protection Regulation (EU) 2016/679 ("GDPR") applies, you have a right to:

• Request a copy of the Employee Personal Information about you that Itron holds;
• Request Itron correct your Employee Personal Information if you believe it is not accurate, complete, or up to date; or
• Request Itron to delete your Employee Personal Information if:
  • It is no longer necessary for the purposes for which we obtained it;
  • You have withdrawn your consent, and we have no other legal basis for the processing;
  • You have validly objected to our processing of your personal information;
  • Itron has unlawfully processed your personal information; or
  • Itron must delete your personal information to comply with a legal obligation.

7.2 California Privacy Rights
The California Consumer Privacy Act ("CCPA") protects a California resident's right to their Employee Personal Information with exceptions. This applies to Employee Personal Information collected within the past twelve months. If you are an Itron Employee and California resident, Itron may have collected, used, and shared, for business purposes, Employee Personal Information about you as described in this Policy.

Itron does not discriminate against the exercising of these rights.

Itron does not sell Employee Personal Information.

Exercising your rights under CCPA:

• You have the right to request, twice in a 12-month period, that Itron disclose to you your Employee Personal Information that Itron has collected during the past 12 months.
• You have the right to request that Itron delete your Employee Personal Information with exceptions, such as when the deletion of information conflicts with Itron's compliance with a legal obligation.

If you would like to exercise your right under CCPA to access or delete, please submit this CCPA Request Form. The Itron privacy team will examine your request and respond to you as quickly as possible.

Please note that Itron may retain and use aggregated and de-identified personal information that does not identify you or any individual; Itron may also retain information as needed in order to comply with legal obligations.

7.3 Automated processing
Itron does not make decisions about individuals based solely on automated processing, including profiling, (i.e., without human involvement) that have a legal or similarly significant effect on the individuals.

7.4 Account Self-Service
You may update, correct, or delete information maintained by Itron for third-party service provider accounts by logging into those accounts and selecting "Deactivate" account under My Account Options or via our request web form; this does not include Itron network access accounts. For all other accounts, please email Privacy@itron.com. Itron will make good faith efforts to respond to your request within thirty (30) days. Please note that Itron may retain certain information, as required by law or for legitimate business purposes, for limited periods of time.

8 COMPLAINTS
Employees with concerns or complaints regarding Itron's processing of their Employee Personal Information should raise the concern or complaint first with their direct supervisor. If their direct supervisor is not able to address or resolve their concern or complaint, they should notify Itron's Privacy department using the information in the "Contact" section below. In the case of unaddressed or unresolved concerns or complaints, employees have a right to notify the supervisory authority in the country in which they are employed.

9 CONTACT
Itron has designated its Global Privacy Officer with primary responsibility for overseeing Itron's Employee Personal Information privacy practices, implementing this Policy, and advising Itron regarding compliance with applicable data protection laws.

For CCPA specific requests please submit the CCPA Request Form. For all other requests regarding data deletion, complaints, or other inquiries — please fill out our web form.

Additional questions can be sent be email or mail to the Global Privacy Officer at: privacy@itron.com or

10 CHANGES TO THIS NOTICE
Itron may change or update this Policy from time to time. If material changes are made, Itron will notify you by email or by revising the "Last Updated" date.