EEA+ Supplemental Data Protection Law Disclosures

KLA Corporation (KLA) provides to residents of the European Economic Area, Switzerland and the United Kingdom (EEA+) the following disclosures to supplement the Website Privacy Policy and Cookie Policy.

Data Controller: The data controller is KLA Corporation located at 1 Technology Drive, Milpitas, CA 95035 in the United States. You can contact our representative, KLA GmbH in the EU via email at privacy@kla.com, by mail: KLA GmbH, Moritzburger Weg 67, D-01109, Dresden, Germany.   Attention: EU Privacy Representative or by telephone:  +49 351-82802-0. For the UK, KLA’s authorized representative is SPTS Technologies Limited, 1 Ringland Way, Newport NP18 2TA, Tel: 01633 414000. Attention: UK Privacy Representative.

Legal Bases for Processing: Legal bases for the processing of your personal data by KLA are: 

1. performance of a contract, where we have entered into a contract with you and need to process your personal data to fulfill our contractual obligations to you (Art. 6 (1) lit. b GDPR/UK GDPR), 
2. our legitimate interests (Art. 6 (1) lit. f GDPR/UK GDPR) for the transfer of your personal data within the group of companies which are the following: for internal administrative and support purposes, 
3. compliance with a legal obligation to which KLA is subject (Art. 6 (1) lit. c GDPR/UK GDPR), for example if we are required by law to disclose personal data to law enforcement agencies, or governmental authorities, 
4. our legitimate interests for the purposes of exercising our legal rights or defending legal claims, 
5. our legitimate interests (Art. 6 (1) lit. b GDPR/UK GDPR) for the transfer of your personal data in connection with a transfer of all or part of our organization or assets which are the following: the orderly transition of all or part of our business, 
6. our legitimate interests to protect and defend the rights or property of us or third parties, including enforcing agreements, policies and terms of use, and in an emergency including to protect the safety of our employees or any person which are the following: to protect the property, rights, and safety of any person and to prevent fraud. 

Recipients in Third Countries: The personal data that we collect or receive about you may be transferred to and processed by recipients that are located inside or outside the EEA+ and which are not recognized from an EEA+ law perspective as providing for an adequate level of data protection. When interacting with our site or contacting KLA, you transfer personal data to the United States. And KLA may transfer your personal data to our affiliates and business partners in countries and regions where KLA has operations (locations). To the extent your personal data are transferred to countries that do not provide for an adequate level of data protection from an EU, Swiss or UK law perspective, we will base the respective transfer on appropriate safeguards (Art. 46 GDPR/UK GDPR), such as standard data protection clauses adopted by the European Commission. You can ask for a copy of such appropriate safeguards by contacting us as set out in the contact section. 

Period of Data Storage: Your personal data will be retained for as long as necessary to provide you with the services requested, which in most cases does not exceed 4 years after our business relationship with you has ended. When KLA no longer needs to use your personal data to comply with contractual obligations, we will remove it from our systems and records and/or take steps to properly anonymize it so that you can no longer be identified from it, unless we need to keep your information, including personal data, to comply with statutory retention periods e.g., for tax purposes for a legally prescribed time period thereafter, or if we need it to preserve evidence within statutes of limitation. 

Data Subject Rights: Under applicable law, you may have the following rights in relation to your personal data. These may be limited under applicable data protection law.

1. Right to request from us access to personal data: You have the right to confirm with us whether your personal information is processed, and if it is, to request access to that personal information including the categories of personal information processed, the purpose of the processing and the recipients or categories of recipients. You have the right to obtain a copy of the personal data undergoing processing.  However, this is not an absolute right and the interests of other individuals may restrict your right of access. 
2. Right to rectification: You have the right to obtain from us rectification of inaccurate or incomplete personal information concerning you. Depending on the purposes of the processing, you may have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
3. Right to erasure of your personal data (right to be forgotten):  You have the right to ask us to erase personal data concerning you.
4. Right to restriction of processing: In limited circumstances, you have the right to request that we restrict processing of your personal data.
5. Right to data portability: You may have the right to receive personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and you may have the right to transmit that personal data to another entity without hindrance from us.
6. Right to withdraw consent: If you have declared your consent for any personal data processing activities, you can withdraw this consent at any time with future effect. Such a withdrawal will not affect the lawfulness of the processing prior to the consent withdrawal. You can exercise your rights by contacting us as set out in the contact section.

Failure to Provide Personal Data: Where we are required by law to collect your personal data, or we need to collect your personal data under the terms of a contract we have with you, and you fail to provide that personal data when we request it, we may not be able to perform the contract we have or are trying to enter into with you. This may apply where you do not provide the personal data we need in order to provide the services you have requested from us. In this case, we may have to cancel the provision of the relevant services to you, in which case we will notify you. 

Questions: If you have any questions, please contact privacy@kla.com. If you would like to submit a request about personal data that we may have about you, please complete the Privacy Request Form.

You also have the right to lodge a complaint with a supervisory authority. Please contact privacy@kla.com for contact details for the appropriate supervisory authority. 

---

Last Modified and Effective Date: July 20, 2022