Notice for Asure Software Inc. Swiss – US and EU – US Privacy Shield

Asure Software, Inc.
Privacy Notice for the EU-U.S. Privacy Shield Framework and Swiss-U.S. Privacy Shield Framework

Effective as of May 7, 2018

Asure Software has certified certain of our services, for which we act as a data processor, under the EU-U.S.
Privacy Shield Framework and the Swiss-U.S. Privacy Shield Framework. Asure Software has certified to the
Department of Commerce that it adheres to the Privacy Shield Principles. To learn more about the Privacy
Shield program, and to view our certification, please visit
https://www.privacyshield.gov/.

Scope: Asure Software, Inc. commits to submit to the principles of the EU-U.S. Privacy Shield Framework and
Swiss-U.S. Privacy Shield Framework all personal data that constitutes European End User Data (defined
below) submitted by Asure Software’s customers in reliance on the Privacy Shield to the following cloud based
services: Time and attendance and workforce management product offerings, online meeting room and space
management product offerings, and payroll and other human capital management (HCM) services. Product
names include Resource Scheduler®, Meeting Room Manager®, and Asure Force, and OccupEye®.

Data processed: Asure is a leader in helping global organizations optimize their workforce and workspace
utilization through SaaS-based cloud technology and other solutions. In this capacity, Asure may obtain and
process on behalf of our corporate customers (“Clients”) certain personal information about our Clients’
employees, representatives, consultants, contractors, agents, or other end users in the European Union and
Switzerland who are authorized to use our Enterprise Products and Services (“European End User Data”).
European End User Data can include names, email addresses, biometric data, employee identifiers (as
specified by Clients), photographs, billing addresses, residency data, national identifiers, position and
compensation information, and birth dates.

Purposes of data processing: Asure Software processes European End User Data for the purpose of
providing Asure’s services to our Clients. To fulfill these purposes, Asure Software may access the European
End User Data to provide the services, to correct and address technical or service problems, or to follow
instructions of the Asure Software Client who submitted the data, or in response to contractual requirements.

Inquiries and complaints: If you believe Asure Software maintains European End User Data about you in one
of the services within the scope of our Privacy Shield certification, and you have any inquiries or complaints,
you should first contact your employer or the other entity which is our Client, as such entity is the
controller/owner of your data. You may also direct any inquiries or complaints concerning our Privacy Shield
compliance to us at infosecteam@asuresoftware.com. Asure Software will respond within 30 days. If you have
an unresolved privacy or data use concern that we have not addressed satisfactorily, Asure has committed to
cooperate with the panel established by the EU Data Protection Authorities to serve as our independent dispute
resolution body for the Framework. We are also subject to the investigatory and enforcement powers of the
Federal Trade Commission with respect to the Framework.

Liability for onward transfer of personal data to third parties: Asure Software uses a limited number of
third-party service providers to assist us in providing our services to Clients. These third party providers provide
cloud data storage services and perform database monitoring and other technical operations. These third
parties may access, process, or store personal data in the course of providing their services. Asure Software
maintains contracts with these third parties restricting their access, use and disclosure of personal data in
compliance with our Privacy Shield obligations, and Asure Software remains responsible for these third parties
that process such information on our behalf, unless we prove that we are not responsible for the event giving
rise to the damage.

Your rights to access, to limit use, and to limit disclosure: European End Users have rights to access
personal data about them, and to limit use and disclosure of their personal data. With our Privacy Shield
certification, Asure Software has committed to respect those rights. Because Asure Software personnel have
limited ability to access data our Clients submit to our services, if you wish to request access, to limit use, or to
limit disclosure, please either contact your employer (our Client) directly or provide the name of the Asure
Software Client who submitted your data to our services. If you contact us, we will refer your request to that
Client, and will support them as needed in responding to your request.

In compliance with the Privacy Shield Principles, Asure commits to resolve complaints about our collection or
use of your personal information. EU and Swiss individuals with inquiries or complaints regarding our Privacy
Shield policy should first contact Asure by email: at: asuresoftware@infosecteam.com or by telephone at 888-
323-8835, Attn: Privacy Officer.

Asure has further committed to refer unresolved Privacy Shield complaints to the EU DPA’s and the Swiss
Federal Data Protection and Information Commission (FDPIC), as applicable. If you do not receive timely
acknowledgment of your complaint from us, or if we have not addressed your complaint to your satisfaction,
please contact the EU DPA of your home country (a full list of DPAs is available here) or the Swiss Federal
Data Protection and Information Commission for more information or to file a complaint. The services listed
above are provided at no cost to you.

U.S. Federal Trade Commission enforcement and binding arbitration: Asure Software’s commitments
under the Privacy Shield are subject to the investigatory and enforcement powers of the United States Federal
Trade Commission and or the Department of Transportation. In addition, under certain conditions, more fully
described on the Privacy Shield website, European and Swiss End Users may invoke binding arbitration for
non-monetary issues when other dispute resolution procedures have been exhausted.

Compelled disclosure: Asure Software may be required to disclose personal information in response to lawful
requests by public authorities, including to meet national security or law enforcement requirements.

Last Updated: May 7, 2018