Supplemental EEA+ Privacy Notice - MicroVision

Last updated January 9, 2024

We, MicroVision, Inc., address this Supplemental EEA+ Privacy Notice to individuals who are citizens or residents of the European Economic Area (EEA), United Kingdom (UK) and Switzerland only who visit any website we operate that includes a link to this notice.

1. What laws apply?

If you are located in the EEA, the EU General Data Protection Regulation applies to the processing of your personal data. If you are located in the UK, the UK General Data Protection Regulation applies to the processing of your personal data. References to the “GDPR” are references to the General Data Protection Regulation as it applies in the country where you are located. If you are located in Switzerland, the provisions of the Swiss Federal Data Protection Act (the “FDPA”) apply to you, and references to the GDPR below shall be interpreted analogously for the purposes of applying the FDPA.

2. Who is the data controller and whom can I contact?

MicroVision, Inc. is located at 18390 NE 68th St., Redmond WA 98052. Our EU DPO is Thorsten Ihler (dpo (at) microvision.com).

To exercise any of the rights or choices below (or any other rights under applicable law), please contact us at privacy (at) microvision.com. Kindly note that any requests sent through the aforementioned email will be distributed to members of the MicroVison’s Privacy Team based on their need to know, and subsequently forwarded to the DPO.

3. What lawful bases of processing do we rely on?

We rely on the following legal bases to process your personal data, as appropriate:

Necessary for us to perform a contract with you or take steps at your request prior to entering into a contract per Article 6(1)(b) GDPR (“Contract Performance Legal Basis”);
Necessary for us to comply with an applicable legal obligation per Article 6(1)(c) GDPR (“Legal Obligations Legal Basis”);
Necessary for us to realize a legitimate interest based on an assessment of that interest and your privacy and other fundamental interests per Article 6(1)(f) GDPR (“Legitimate Interest Legal Basis”); or
According to your consent per Article 6(1)(a) GDPR (“Consent Legal Basis”). In these cases, you can withdraw your consent at any time with future effect by contacting our DPO or the MicroVision’s privacy team as identified above.

The following table outlines the legal basis and, where applicable, the legitimate interests pursued with respect to each purpose for which we process personal data.

Personal Data Categories	Purposes of Use or Disclosure	Legal Basis and Legitimate Interest
Name and surname, email address and physical address/location, date of birth, IP address, gender, cookie ID	Responding to your inquiry or considering your request	Legitimate Interest Legal Basis—namely, to provide you and our other users with a good experience.
When submitting job applications to us: information about your education, age, work and military history, citizenship or legal work eligibility status, and other information relevant to specific jobs for which you wish to apply. Please see our Job Applicant Privacy Notice	Evaluating your job application	Consent with respect to collecting personal data you submit to us in your job application. Legitimate Interest Legal Basis with respect to evaluating your job application—namely, to determine whether it is in our interests to extend an offer to you.
Name and surname, email address and physical address/location, date of birth, IP address, gender, cookie ID	Filling your orders, and maintaining, securing, customizing and improving our Website	If we are contractually obligated to perform the processing based on the terms of a contract, Contract Performance Legal Basis. Otherwise, we process your personal data on the Legitimate Interest Legal Basis—namely, to improve our services and communications so that we can continue to provide high quality offerings to you and others.
Name and surname, email address and physical address/location, date of birth, IP address, gender, cookie ID	To send and tailor our promotional communications to you	Where legally required, Consent Legal Basis if we have obtained your consent to market to you. When consent is not required under national law, Legitimate Interest Legal Basis, if you have not objected to our marketing and for the purpose of increasing use of our products and services.
Name and surname, email address, IP address, cookie ID	Maintaining our IT systems with infrastructure backups and testing, and operating, evaluating and improving our business	Legitimate Interest Legal Basis—namely, to maintain and improve our IT systems so that we can continue to provide high quality offerings to you and others, to administer and enforce our contractual and legal rights, and to manage our business operations and relationships with third parties. Operating, evaluating and improving our business in other ways, including through analysis and research
Name and surname, email address and physical address/location, date of birth, IP address, gender, cookie ID	To exercise our legal rights, defend and advance our legal interests, comply with applicable laws such as data protection laws, and protect against fraudulent, harmful and illegal activity	If we are legally obligated to perform the processing (such as to disclose personal information to a law enforcement authority with authorization under criminal law), Legal Obligations Legal Basis. If we are contractually obligated to perform the processing, Contract Performance Legal Basis. In all other cases, Legitimate Interest Legal Basis—namely, to exercise our legal rights, defend and advance our legal interests, and protect against fraudulent, harmful and illegal activity.

4. Where is your personal data processed and on what basis do we transfer personal data across borders?

We rely on service providers in the United States, Germany and the UK. We take measures to ensure that service providers in the United States are Data Privacy Framework (DPF) program certified pursuant to the EU-U.S. DPF and, as applicable, the UK Extension to the EU-U.S. DPF, and/or the Swiss-U.S. DPF or that they otherwise provide an adequate level of data protection by entering into appropriate data transfer agreements based on Standard Contractual Clauses and performing data protection assessments of data transfer arrangements as appropriate. Data transfer agreements are accessible upon request by contacting us at the details shown further above.

5. Do you have to provide personal data?

You are not legally required to provide us with your personal data, but if you do not provide us with personal data that we reasonably need to provide our website, process your orders or evaluate your job application, you may not be able to fully use our site, make orders or be considered for a job posting. If you do not allow us to collect information through cookies and similar technology, some parts of our website may not work properly or be as tailored to you as they could otherwise be, but they will still generally be usable. We will inform you of personal data that we reasonably need to fulfil the purposes in our privacy notices, such as by marking certain fields as mandatory on online forms requesting personal data from you.

6. Your Rights

In the EEA, Switzerland and the UK you have the following rights, subject to the conditions under the GDPR and/or local data protection law:

(a) To object, on grounds relating to your particular situation, to the processing of your personal data by us. This includes the right to object to our processing of your personal data for direct marketing and the right to object to our processing of our personal data where we are performing a task in the public interest or pursuing our legitimate interests or those of a third party. If we process your personal data based on our legitimate interests or those of a third party, or in the public interest, you can object to this processing, and we will cease processing your personal data, unless the processing is based on compelling legitimate grounds or is needed for legal reasons. Where we use your personal data for direct marketing for our own products and services, you can always object and opt out of future marketing messages using the unsubscribe link in such communications.

(b) To obtain from us confirmation as to whether your personal data is being processed, and, where that is the case, to request access to details about how we process your personal data and copies of the personal data.

(d) To ask us to erase your personal data to the extent it is not required for legally required purposes.

(e) To request restriction of processing of your personal data, in which case, it would be marked and processed by us only for certain purposes.

(f) To receive your personal data which you have provided to us in a structured, commonly used and machine-readable format and you have the right to transmit the personal data to another entity without hindrance from us.

(g) To lodge a complaint with a supervisory authority (only for EEA, UK and Switzerland).

(h) To withdraw your consent per Article 6(1)(a) GDPR at any time with future effect by contacting us at privacy (at) microvision.com.

(i) In some jurisdictions such as France and Portugal, you also have the right to provide us with guidelines as to the processing of your personal data after your death.

You may view a list of supervisory authorities in the EEA, UK and Switzerland and their respective contact information here:

Jurisdiction	Data protection authority’s website
EEA	https://edpb.europa.eu/about-edpb/about-edpb/members_de
United Kingdom	https://ico.org.uk/global/contact-us/
Switzerland	https://www.edoeb.admin.ch/edoeb/en/home/the-fdpic/contact.html

To exercise your rights under applicable privacy law, to raise a privacy concern, or to make a data-related request, please submit your request to privacy (at) microvision.com. Any requests to exercise your privacy rights or make a data-related request must be in writing and include your name and address and any other information that may identify you. For certain requests, you must also provide information that we reasonably request from you so that we can verify your identity.

MicroVision, Inc.

18390 NE 68th St.,

Redmond WA 98052

EU DPO: Thorsten Ihler (dpo (at) microvision.com).

E-Mail: privacy (at) microvision.com

Phone at (425)-936-6847