ENVIRONMENTAL SYSTEMS DESIGN PRIVACY POLICY

Last Updated: May 29, 2020; Re-Reviewed: July 14,2020

Your privacy is important to Environmental Systems Design, Inc. (“ESD”, “we” or “us”). We
developed this Privacy Policy to describe how we collect, use, disclose, and otherwise process
your Personal Information. If you have any questions or comments regarding this Privacy
Policy, please contact us at privacy@esdglobal.com.

1. What is Personal Information?
“Personal Information” is information that, either alone or in combination with other
information, identifies you. When we combine other information (i.e., information that does not,
on its own, identify you) with your Personal Information, we treat the combined information as
Personal Information.

2. Application of this Privacy Policy to the ESD Site and Services

This Privacy Policy describes how ESD processes Personal Information that it collects when:

•  You use ESD-operated websites that link to this Privacy Policy, including esdglobal.com
  (collectively, the “Site”); and
• We receive Personal Information when you use ESD services as published on the Site
  (collectively, the “Services”).

Throughout this Privacy Policy, we describe how our data processing and privacy practices vary
between our Site and the Services.

3. How We Collect and Use Personal Information

A. Personal Information Collected via the Site

If you are a user of our Service (a “Customer”) or otherwise visit our Site, we collect the
following type of information through your use of the Site:

• Contact and Account Information: We collect Personal Information that you provide
  when you contact us for inquiries relating to the Services or retain us for the Services,
  such as your name, e-mail address, phone number, and payment information. We process
  this Personal Information only as necessary to provide the Services to you or for our
  legitimate interests in providing the Services that meet your needs and expectations. For
  example, we use this information to contact you, bill you for your use of the Services;
  respond to your inquiries regarding the Services; and for other purposes related to the
  reasons for which you provide your Personal Information.
  We may use your email address to contact you from time to time in furtherance of our
  legitimate interests in providing you with information regarding the Services, such as
  updates on new features. If we send marketing emails, we will strive to comply with
  applicable laws.
• IP Address and Header Information: We automatically collect certain information
  when you visit our Site, such as IP address and information such as browser type,
  operating system, language, screen resolution, referring URL, etc. provided to our web
  server by your browser (“Header Information”). We have a legitimate interest in using
  such information for systems administration purposes, information security and abuse
  prevention, and to track user trends.
• Traffic Data: We use analytics tools such as Google Analytics to generate useful
  insights about our Site’s visitors’ use of the Site. We use the analytics data to further our
  legitimate interest in analyzing the effectiveness of our Site, so we can improve our Site’s
  look, function, and content.

4. How We Use Cookies and Similar Technology

To help operate the Site, enhance your experience, and collect information about online activity,
we place small data files on your device known as “cookies,” or we use similar technologies
(e.g., pixel tags, web beacons, local shared objects). Cookies and similar technologies enable us
to personalize the Site, and help make our Site load faster (through “load balancing” technology).

Most browsers provide you with the ability to block, delete or disable these technologies. If you
choose to reject cookies or similar technologies, some features of our Site may not be available
or some functionality may be limited or unavailable. Please review your browser manufacturer’s
help pages for assistance with changing your settings.

5. To Whom We Disclose Personal Information
We will not disclose your Personal Information except as set forth in this Privacy Policy or with
your consent.

This section describes to whom we disclose Personal Information, and for what purposes:

• Service Providers. We employ other companies and people to perform tasks on our
  behalf to assist us in providing the Site and the Services. For example, we use SalesForce
  to host our Applicant Portal and collect job applications, and we use Google Analytics to
  help us analyze the effectiveness of our Site. Other examples include billing, technical
  assistance, and customer service. Our agents subscribe to the same level of privacy
  protection as we do.
• Companies Involved in Mergers and Acquisition Transactions. In some cases, ESD
  may choose to buy or sell assets. In these types of transactions, user data (including
  Personal Information) is typically one of the business assets transferred. Moreover, if
  ESD, or substantially all of its assets, were acquired, user data would be one of the assets
  that is reviewed and transferred or acquired by a third party.
• Law Enforcement, Government Agencies, and Courts: We may disclose Personal
  Information at the request of law enforcement or government agencies or in response to
  subpoenas, court orders, or other legal process to establish, protect, or exercise our legal
  or other rights or to defend against a legal claim or as otherwise required or allowed by
  law, or to protect the rights, property, or safety of a Customer or any other person. We
  may also disclose Personal Information to investigate or prevent a violation by you of any
  contractual or other relationship with us or your illegal or harmful activity.

6. Personal Information Transferred from the EU or Switzerland

ESD complies with the EU-US Privacy Shield Framework and Swiss-US Privacy Shield
Framework (collectively, “Privacy Shield”) as set forth by the US Department of Commerce
regarding the collection, use, and retention of personal information from European Union (the
“EU”) member countries and Switzerland. ESD has certified to the Department of Commerce
that it adheres to the Privacy Shield Principles of Notice, Choice, Accountability for Onward
Transfer, Security, Data Integrity and Purpose Limitation, Access, and Recourse, Enforcement
and Liability. A violation of our commitment to Privacy Shield may be investigated by the
Federal Trade Commission and/or the United States Department of Commerce. If there is any
conflict between the policies in this Privacy Policy and the Privacy Shield Principles, the Privacy
Shield Principles shall govern. To learn more about the Privacy Shield program, and to view our
certification page, to the extent available, please visit https://www.privacyshield.gov.

In compliance with the Privacy Shield Principles, ESD commits to resolve complaints about your
privacy and our collection or use of personal information about you. Persons from the EU or
Switzerland who have inquiries or complaints regarding this Statement should first contact us
via: email at: privacy@esdglobal.com.

ESD has committed to refer unresolved privacy complaints under the Privacy Shield Principles
to JAMS, an alternative dispute resolution provider located in the United States. If you do not
receive timely acknowledgment of your complaint, or if your complaint is not satisfactorily
addressed, please visit https://www.jamsadr.com/eu-us-privacy-shield for more information and
to file a complaint.

These recourse mechanisms are available at no cost to you. Damages may be awarded in
accordance with applicable law.

Please note that if your complaint is not resolved through these channels, under limited
circumstances, a binding arbitration option may be available before a Privacy Shield Panel.

In cases of onward transfer to third parties of data of EU or Swiss individuals received pursuant
to the Privacy Shield, ESD is potentially liable.

7. Your Data Subject Rights

A. Your Rights as a Customer of ESD

As a controller of the Personal Information collected by or through the Site, we take steps to help
ensure that our Customers are able to exercise their rights regarding their Personal Information in
accordance with applicable law.

If you would like to access, amend, erase, or object to or restrict the processing of Personal
Information collected via the Site, you may submit a request to privacy@esdglobal.com. We
will promptly review all such requests in accordance with applicable laws.

Depending on where you live, you may have a right to lodge a complaint with a supervisory
authority or other regulatory agency if you believe that we have violated any of the rights
concerning your Personal Information. We encourage you to reach out to us at
privacy@esdglobal.com, so we have an opportunity to address your concerns directly before you
do so.

8. Children’s Personal Data.

The Site is not intended to children under the age of sixteen (16). If we learn that we have
collected Personal Information of children, and if we do not have a lawful basis to process such
Personal Information under applicable law, we will promptly take steps to delete such Personal
Information.

9. Retention of Personal Information

We will retain your Personal Information for the period necessary to fulfill the purposes for
which your Personal Information has been collected as outlined in this Privacy Policy unless a
longer retention period is required by law.

10. How We Protect the Confidentiality and Integrity of Your Personal Information

We have implemented security measures to protect user information from loss, misuse and
alteration. We use industry-standard practices such as encrypted storage, firewalls and password
protection systems to safeguard the confidentiality of Customers’ personal information. We take
steps to help ensure our employees and contractors are aware of their information security
obligations, and we restrict employee and contractor access to Personal Information. Despite
these efforts to store Personal Information in a secure operating environment that is not available
to the public, we cannot guarantee the security of Personal Information during its transmission or
its storage on our systems. Further, while we attempt to ensure the integrity and security of
Personal Information, we cannot guarantee that our security measures will prevent third-parties
such as so-called hackers from illegally obtaining access to Personal Information. We do not
warrant or represent that Personal Information about you will be protected against, loss, misuse,
or alteration by third parties.

11. Links to Third Party Websites
Our Site may contain links to third party websites. Please be aware that we are not responsible
for the privacy practices of third party websites you choose to visit. If you provide any
information directly to parties other than us, different rules may apply to the use or disclosure of
that information. We encourage you to investigate and ask questions before disclosing your
personal information to third parties.

12. Changes to this Privacy Policy
We may revise and update this Privacy Policy from time to time and will post the updated
Privacy Policy to the Site. You can tell when changes have been made to the Privacy Policy by
referring to the “Last Updated” legend on top of this page. If these changes are material (i.e.,
changes we believe you will find important), we will provide notice to you by email or by
posting notice of the changes on our Site. Where required by applicable law, we will obtain your
consent. UNLESS OTHERWISE INDICATED, ANY CHANGES TO THIS PRIVACY
POLICY WILL APPLY IMMEDIATELY UPON POSTING TO THE SITE.

13. Contacting Us

If there are any questions regarding this Privacy Policy you may contact us using the information
below:

E-mail: privacy@esdglobal.com
233 South Wacker Drive

Suite 5300

Chicago, IL 60606

+1 (312) 372-1200