EEA, UK, And Swiss Privacy Disclosures

ADDITIONAL EEA, UK, AND SWISS PRIVACY DISCLOSURES

Effective Date / Last Updated: September 7, 2023

Unless otherwise expressly stated, capitalized terms in these Disclosures have the same meaning as defined in the PRIVACY NOTICE.

Scope of Disclosures

These Additional European Economic Area (“EEA”), United Kingdom (“UK”), or Switzerland Privacy Disclosures supplement the information contained in our PRIVACY NOTICE, and apply only to our processing of your personal data if you are based in the EEA, the UK, or Switzerland.

Controller

Crane Company is the data controller responsible for the collection and use of your personal data.

Personal Data Disclosures

When we use the term “personal data” in these Disclosures, we mean any information relating to an identified or identifiable natural person.

Legal Bases for Processing

We rely on one or more of the following legal grounds to process Personal Data about you, whether it is obtained from you or a third party:

Processing Activity	Purposes of the Processing	Legal Bases for Processing and Corresponding GDPR Provision
Communicate with You	To communicate with you about our services, including to inform you about new services, solicit feedback, respond to inquiries or just keep you up to date with what is going on with Crane and our services. These are also our legitimate interest to process your Personal Data.	Legitimate Interest Art. 6 (1) s 1 (f) GDPR To the extent required for us sending marketing communications to you: Consent Art. 6 (1) s 1 (a) GDPR
Provide You with Services	To provide you with our services. For example, we may use contact information and professional information to provide support while onboarding our services. These are also our legitimate interest to process your Personal Data.	Legitimate Interest Art. 6 (1) s 1 (f) GDPR To the extent that the processing is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract: Performance of a Contract Art. 6 (1) s 1 (b) GDPR
Facilitate Investor Services	To maintain a record of share ownership and facilitate investor services, including investor relation communications. These are also our legitimate interest to process your Personal Data.	Legitimate Interest Art. 6 (1) s 1 (f) GDPR As it relates to us sending you investor email alerts: Consent Art. 6 (1) s 1 (a) GDPR
Review Your Job Application	To assess your application for employment and facilitate the job application process (including interviews, where applicable) as well as to transfer relevant information to your employment record if you are offered and accept a position at Crane.	Performance of a Contract Art. 6 (1) s 1 (b) GDPR or, where applicable, Article 88 (1) of the GDPR in conjunction with the respective provision/s under the applicable national data protection law
Otherwise Operate Our Business	To operate our business, including to: Identify and communicate with customers who may be interested in our services.Optimize customer experience with our services.Remember customers and the choices they have made in relation to our services.Connect with customers about requests and transactions they make on our services and other online services. Diagnose errors and problems with existing service. Develop and test new services. Conduct research and analytics on service usage and activity trends. Deliver marketing communications and advertisements based on customer representative interests and interactions with us. Facilitate business transactions and reorganizations impacting the structure of our business. These are also our legitimate interest to process your Personal Data.	Legitimate interest Art. 6 (1) s 1 (f) GDPR To the extent that the processing is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract: Performance of a Contract Art. 6 (1) s 1 (b) GDPR To the extent required for us (i) sending marketing communications to you or (ii) performing research and analytics: Consent Art. 6 (1) s 1 (a) GDPR
Exercise or Comply with Legal Obligations and Rights	To exercise or comply with legal obligations and rights including to enforce and carry out contracts and agreements and prevent, investigate, to provide notice of fraud or unlawful, or criminal activity, or for the establishment, exercise or defence of legal claims. These are also our legitimate interest to process your Personal Data.	Legitimate interest Art. 6 (1) s 1 (f) GDPR To the extent that the processing occurs for compliance with a legal obligation based on EEA (including Member State)/UK/Swiss law: For compliance with a legal obligation Art. 6 (1) s 1 (c) GDPR

You are generally not required to provide personal data to us, but we do rely on your personal data to provide certain of our services. For example, we need your email address to send you mailings. If you choose not to provide us with your personal data, we may not be able to provide you with a service you request.

Data Retention

We retain personal data about you for as long as is necessary for the purposes set out in these Disclosures, unless a longer period is required under applicable law or is needed to resolve disputes or protect our legal rights.

The criteria used to determine the period for which personal data about you will be retained varies depending on the legal basis under which we process the personal data:

Legitimate Interests	Where we are processing personal data based on our legitimate interests, we generally will retain such information for a reasonable period of time based on the particular interest, taking into account the fundamental interests and the rights and freedoms of data subjects
Consent	Where we are processing personal data based on your consent, we generally will retain the information for the period of time necessary to fulfill the underlying agreement with you, subject to your right, under certain circumstances, to have certain of your data erased (please see the Your Privacy Rights section below)
Contract	Where we are processing personal data based on contract, we generally will retain the information for the duration of the contract plus some additional limited period of time that is necessary to comply with law or that represents the statute of limitations for legal claims that could arise from the contractual relationship
Legal Obligation	Where we are processing personal data based on a legal obligation, we generally will retain the information for the period of time necessary to fulfil the legal obligation
Legal Claim	We may need to apply a “legal hold” that retains information beyond our typical retention period where we face threat of legal claim. In that case, we will retain the information until the hold is removed, which typically means the claim or threat of claim has been resolved.

In all cases, in addition to the purposes and legal bases, we consider the amount, nature and sensitivity of the personal data, as well as the potential risk of harm from unauthorized use or disclosure of your personal data.

Descriptions in the Cookie Notice

Additional descriptions on the processing in connection with cookies or similar technologies, including on the purposes, categories of personal data, retention, legal basis, and recipients can be found in the Cookie Notice. The remainder of these Disclosures shall apply to the related processing activities.

International Data Transfers

We may transfer personal data about you among us and to our subsidiaries or affiliates, as well as to the categories of third parties identified in the Our Disclosure of Personal Information section of the PRIVACY NOTICE and to the entities identified in Descriptions on Processing Activities Regarding Cookies section of our Cookie Notice. Personal data may be transferred to, stored and processed in a country other than the one in which it was collected, including, but not limited to, the United States and any (other) country in the world. A country to which personal data is transferred may not provide the same level of protection for personal data as the country from which it was transferred.

We may transfer personal data about you outside of the EEA, UK, or Switzerland and when we do so, we rely on appropriate or suitable safeguards recognized under the GDPR including adequacy decisions, and standard contractual clauses.

Adequacy Decisions

We may transfer personal data about you to countries, territories or one or more specified sectors within a country that the European Commission has or competent authorities in the UK or Switzerland have deemed to adequately safeguard personal data. You can find a current list of these adequacy decisions here.

Standard Contractual Clauses

The European Commission has adopted Standard Contractual Clauses, which provide safeguards for personal data transferred outside of the EEA, UK, or Switzerland. We may use these Standard Contractual Clauses (with UK and Swiss amendments, as may be required) when transferring personal data from a country in the EEA, UK, or Switzerland to a country outside of the EEA, UK, or Switzerland that has not been deemed to adequately safeguard personal data. You can request a copy of our Standard Contractual Clauses by contacting us as set forth in the Contact Us section of this PRIVACY NOTICE.

Other Grounds

Where appropriate, we may transfer personal data from a country in the EEA, the UK, or Switzerland to a country outside of the EEA, the UK, or Switzerland also on the grounds of one of the derogations provided for specific situations by the GDPR. These derogations may especially apply in case you consent to a proposed transfer or in relation to a transfer which is necessary for (i) the establishment, exercise or defense of legal claims, or (ii) the performance of a contract of a Crane Affiliate with you or concluded in your interest.

Your Privacy Rights

You have the following rights in relation to your personal data (subject to certain limitations at law):

Access	The right to obtain (i) confirmation as to whether or not personal data concerning you is being processed, and, where that is the case, (ii) access to the personal data as well as information relating to its processing, and (iii) obtain a copy of personal data about you.
Rectification	The right to correct or update any personal data about you that is inaccurate or incomplete.
Restriction of Processing	The right to require us to limit the purposes for which we process your personal data if the continued processing of the personal data in this way is not justified, such as where the accuracy of the personal data is contested by you.
Erasure	The right to request the deletion or erasure of personal data about you without undue delay if the continued processing of that personal information is not justified, such as where the personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed. We may reject such as request, in particular, where the processing is necessary for compliance with a legal obligation (such as retention obligations) or for the establishment, exercise or defense of legal claims
Portability	The right to obtain a copy of personal data about you which you have provided to us in a structured, commonly used and machine-readable format and the right to transmit that personal data to another controller, where the processing is based on consent or the performance of a contract.
Objection to Processing	You also have the right to object to any processing based on our legitimate interests where there are grounds relating to your particular situation. There may be compelling reasons for continuing to process your personal data, and we will assess and inform you if that is the case. You can object to marketing activities for any reason.

Please note that if the exercise of these rights may limit our ability to process personal data, we may not be able to provide our services to you, or otherwise engage with you going forward.

Right to Withdraw Consent

Where we rely on your consent for processing of your personal data, you also have the right to withdraw your consent to such processing, subject to certain limitations at law.

Submitting Requests

To submit a request, please contact us as set forth in the Contact Us section of this PRIVACY NOTICE. We may need to verify your identity before processing your request, which may require us to obtain additional personal data from you. In certain circumstances, we may decline a request to exercise the rights described above.

Right to Lodge a Complaint

If you have any complaints regarding our privacy practices, you have the right to lodge a complaint with a data protection authority (i.e., supervisory authority), in particular, at your usual residence, place of work or place of the alleged infringement. An overview of the supervisory authorities in Germany and the EEA may be found here and here. If you are based in the UK or Switzerland, your local data protection authorities are the UK Information Commissioner’s Office (https://ico.org.uk/global/contact-us/) and the Swiss Federal Data Protection and Information Commissioner (the “FDPIC”, https://www.edoeb.admin.ch/edoeb/en/home/the-fdpic/contact/address.html).