Chart Industries, Inc. Privacy Notice

At Chart Industries, Inc. ("Chart," "we," "our," or "us"), we understand that privacy is an important issue for our customers and suppliers, and users of and visitors to ("you," "your") our websites www.chartindustries.com and chartparts.com (including any sub-domains of those websites) and the other websites that refer to this Privacy Notice ("Websites"). This Privacy Notice ("Notice") provides you with information about the processing of your personal data in connection with the use of our Websites and its functionalities or in the course of a contractual relationship with one of the Chart entities listed below in Annex 1, which may include the transfer of your personal data to and among Chart Industries, Inc. and its affiliates (together "Chart"). This Notice does not apply to Chart employees or job applicants.

1. Controller, EU Representative, and Data Protection Officer

Our Websites are operated by Chart Industries, Inc., with its business address at 2200 Airport Industrial Drive, Suite 100, Ball Ground, GA 30107, USA. Since Chart Industries, Inc. as a company is not residing in the EU, it has appointed Chart Germany GmbH, Am Mooshof 15, 47574 Goch, Germany, as its EU representative for data protection according to Art. 27 of the General Data Protection Regulation ("GDPR").

Chart has appointed Dr. Annette Demmel as its external Data Protection Officer for its German entities, and she can be reached at SPB DPO Services GmbH, An der Buche 4, 13465 Berlin, Germany, annette.demmel@spb-dpo-services.com.

2. Categories of Personal Data

2.1 Website Visitors
We process the following categories of data when you use our Websites:

• Contact information, such as your name, email address, phone number, and any other information that you provide to us when you contact us.
• Log information, such as your IP address, including details of our website request, such as date and time, status and amount of data transferred, information about the browser you are using (browser type and version number), and information about the website that forwarded you to our Websites. Chart stores this data in a log file every time our Websites are visited. Without further information, such as information from an Internet service provider about the Internet subscriber, which Chart usually only receives in cases of a suspected material violation of the law, Chart is generally unable to assign this data to individual, identifiable persons.
• Cookies, which are small text files that are stored on your computer as soon as you access our Websites and save certain settings and data for exchange with our system and potentially third party systems via your browser. For more informaiton about how we use cookies, please review our Cookie Policy https://www.chartindustries.com/cookie-policy and our Cookie Tool.

2.2 Customers
We process the following categories of personal data if you are a Chart customer:

• Contact information, such as first name, middle name (initial), last name, physical home address, phone number, cellular phone number, and personal email address.
• Demographic information, such as date of birth/age, citizenship, and gender.
• Business and employment information, such as job title, job description, employing company, employing department, work address, work email and phone number, work location and country, current work location, previous positions, further information concerning career history, background check information, if any, and professional expertise.
• Payment information, such as cost center, sales history, deductions and rebates applied, and information pertaining thereto.

2.3 Suppliers
We process the following categories of personal data if you are a Chart supplier:

• Contact information, such as first name, middle name (initial), last name, phone number, cellular phone number, and personal email address.
• Demographic information, such as date of birth/age, identification number including identifiers issued by public bodies (passport, driver license, and ID to the extent legally received under applicable local law), citizenship, and gender.
• Business and employment information, such as title, job description, employing company, employing department, work address, work email and phone number, work location and country, current work location, previous positions, further information concerning career history, background check information, if any, and professional expertise.
• Attendance, banking, and payment information, such as time keeping data, time cards, attendance records, cost center information, payment detailed information, such as IBAN, bank identifier code, SWIFT code, credit card information (card holder, number, expiration date, CVV), accident records, background checks, and (professional) licenses issued.
• Internet or other electronic network activity information, such as IP addresses, device type and attributes, computing system attributes, including without limitation, operating system attributes, application attributes, and cookies and similar IDs.

3. Purpose and Legal Basis of the Processing

3.1 Website Visitors
Your personal data will be processed for the purpose of enabling you to use the Websites. In addition, we process your personal data to prevent and correct malfunctions of the Websites, as well as to optimize your use of the Websites. The legal basis for this processing is an agreement concerning the use of our Websites and our legitimate interest in its trouble-free operation pursuant to Art. 6 para. 1 b) and Art. 6 para. 1 f) of the GDPR. For the legal and processing purposes of the services provided by third party service providers whose tools are embedded into this Website please refer to Chart's Cookie Tool. If you contact us, we will process your personal data in order to answer your request or otherwise communicate with you. The legal basis for this processing is to answer your inquiry pursuant to Art. 6 para. 1 b) GDPR.

3.2 Customers

• If you are a direct customer of a Chart entity, we process your personal data for the performance of the contract we entered into with you pursuant to Art. 6 para. 1 b) GDPR.
• If you contact us with an inquiry, we process your personal data to answer and administer your inquiry pursuant to Art. 6 para. 1 b) GDPR.
• For customer relationship administration purposes, including administration of customer contracts, sales and discount histories, we are processing your personal data pursuant to Art. 6 para. 1 b) GDPR.
• For customer relationships, customer data trending, analysis, and reporting, i.e. sales history and intensity of contact through marketing activities, if applicable, we are processing your personal data, to pursue our legitimate interests in accordance with Art. 6 para. 1f) GDPR in enhancing customer relationships.
• For recordkeeping purposes, including but not limited to accounting, commercial, document management and other similar services we are processing personal data in accordance with Art. 6 para. 1c) GDPR for compliance with legal obligations we are subject to.
• For reporting purposes, including but not limited to financial information and financial background checks, corporate compliance, regulatory and/or export compliance, investigations, anticorruption screening, operation of whistle blowing hotlines, and other such processing in relation to the above-mentioned services in accordance with Art. 6 para. 1f) GDPR to pursue our legitimate interests.
• For litigation, handling complaints, consultancy and advisory services, internal audits, and third party due diligence, we are processing personal data to pursue our legitimate interests in defending our legal porision in accordance with Art. 6 para. 1f) GDPR.
• For marketing activities, including but not limited to advertising, marketing, public relations, reputation, branding, event organization, and similar processing activities, where you or your company are already a customer we are processing your personal data to pursue our legitimate interests in accordance with Art. 6 para. 1f) GDPR to provide you with interesting information about our company and our products. At times we may ask that you provide consent for certain marketing activities and customer satisfaction surveys. Whenever we ask for your consent and you provide it to us, we then process your personal data on this basis pursuant to Art. 6 para. 1a) GDPR, which you may revoke at any time with effect for the future.

3.3 Suppliers

• If you are a direct supplier for a Chart entity, we process your personal data for the performance of the contract we entered into with you pursuant to Art. 6 para. 1b) GDPR.
• If you contact us with an inquiry, we process your personal data to answer and administer your inquiry pursuant to Art. 6 para. 1 b) GDPR.
• To execute the contractual relationship with your company, including but not limited to the administration of procurement and commercial management, we process your personal data to pursue our legitimate interests in managing the contractual relationship with your company pursuant to Art. 6 para. 1f) GDPR.
• For recordkeeping purposes, including but not limited to accounting, billing, payment as well as commercial document management, and other similar services, we process your personal data in accordance with Art. 6 para. 1c) GDPR for compliance with legal obligations we are subject to.
• We process your personal data to obtain consultancy and advisory services, as well as Chart’s conduct of similar efforts to pursue our legitimate interests according to Art. 6 para. 1 f) GDPR to maintain our business.
• To provide access, including but not limited to the granting of access to Chart facilities by issuing access cards, transponders and/or other means, if applicable, as well as administration efforts pertaining thereto, along with the granting of access to onsite infrastructure, such as machinery and laboratories, if applicable, which comprises the processing of access information and/or documentation by Chart’s systems, and may include the processing of personal data for work place safety and health purposes, i.e. through incident reports, if applicable, as well as similar requirements, which may vary depending on the location and possible insurance requirements applicable, in accordance with Art. 6 para. 1c) GDPR for compliance with legal obligations we are subject to as well as to pursue our legitimate interests pursuant to Art. 6 para.1 f) GDPR in maintenance of a safe and non-disruptive work environment.
• We process personal data in the course of providing IT infrastructure access, if applicable, which includes but is not limited to the provision of software, hardware and/or file management support through Chart’s IT departments and help desks, and/or other competent departments, to pursue our legitimate interests pursuant to Art. 6 para. 1 f) GDPR in maintaining a defect free IT infrastructure.
• We process your personal data to conduct corporate compliance and other commercially relevant activities, including but not limited to audits, regulatory and/or export control compliance as well as conducting legal tasks such as investigations and anticorruption screening pursuant to Art. 6 para. 1 c) GDPR for compliance with legal obligations we are subject to.
• >For litigation, handling complaints, consultancy and advisory services, internal audits, and third party due diligence, we process personal data to pursue our legitimate interests in accordance with Art. 6 para. 1f) GDPR to defend our business.
• At times we may ask that you provide consent for certain data processing activities. Whenever we ask for your consent and you provide it to us, we then process your personal data on this basis pursuant to Art. 6 para. 1a) GDPR, which you may revoke at any time with effect for the future.

4. Transfer of Your Personal Data

Your personal data may be transferred and stored in the US and other countries outside of the EU and/or European Economic Area ("EEA") where Chart’s subsidiaries, services providers and business partners are located. Chart enters into data processing agreements with its service providers and business partners, whenever personal data is processed. A complete list of countries where Chart entities are located can be found in Annex 1. As some of the Chart entities and service providers that Chart shares your personal data with are located outside of the EU and/or the EEA, Chart puts in place data transfer agreements based on the applicable EU Standard Contractual Clauses or relies on other available data transfer mechanisms. You may request a copy and/or information of these mechanisms by contacting globaldataprivacy@chartindustries.com. The transfer of personal data among the Chart entities is based on the EU Standard Contractual Clauses, which are incorporated into Chart’s Intragroup Data Transfer and Processing Agreement. You may request a copy of the EU Standard Contractual Clauses by contacting globaldataprivacy@chartindustries.com.

5. Recipients of Your Personal Data

5.1 Affiliates and Subsidiaries
We may share your personal data among the Chart entities. A complete list of Chart entities can be found in Annex 1. Your personal data is only accessible to employees of Chart, who within their job responsibility execute the purposes listed above and have a need to process your personal data in this regard.

5.2 Third Parties
We may share your personal data with third party service providers to assist with the purposes listed above, such as IT service providers to maintain IT systems, payment administration, banks, insurance companies, and telecommunication companies. Employees of these third party service providers may receive access to your personal data. However, Chart shares your personal data only with trusted service providers pursuant to contractual agreements that include appropriate safeguards to protect your personal data. It is specified that, upon formal request, your personal data may be transmitted to the authorities. Chart does not sell your personal data

We may share your personal data with third parties such as law enforcement or other government agencies to comply with law or legal requirements, to enforce or apply our Terms of Use and other agreements, and to protect our rights and the property and safety of Chart, our employees, and other Websites users.

If we, or some or all of our assets, are acquired by another entity, including through a sale or in connection with a bankruptcy, we will share your personal data with that entity.

6. Retention Periods

Chart retains personal data only for as long as necessary to fulfil the stated purpose for which the personal data was processed and thereafter for retention periods that are: (i) mandated by law; (ii) for preserving, resolving, defending or enforcing our legal/contractual rights; or (iii) needed to maintain adequate and accurate business and financial records. We will delete personal data as soon as the respective purpose for its use no longer exists and no requirement to retain it for any of the purposes described above remains.

Cookies that Chart places are in place for the duration specified in the applicable cookie policy. Please refer to Chart's cookie policy and Chart's Cookie Tool for further information on the deletion of cookies used by our business partners.

If our contact with you results in the conclusion of a contract, Chart may be required to store your personal data for a period of six to ten years in accordance with statutory retention periods.

If you have provided us with personal data for which you have given your consent, Chart will store your personal data, unless you revoke your consent, in which case Chart will delete your data within four weeks of receipt of the withdrawal of consent.

7. Statutory and Contractual Requirements

You may choose not to provide us with personal data or to provide incomplete data, (e.g., by disabling cookies). However, in such cases, we may not be able to provide you with all the functionalities of our Websites. Additionally, we may not be able to further engage in, or continue a contractual relationship with you or your company or provide information to you or your employer because certain administrative and statutory obligations require your personal data. For example, if you block cookies, you may not be able to use all functions offered on our Websites or other services offered as a result. If you decide not to give your consent, for example, in connection with a newsletter subscription, Chart may not be able to provide you with the information requested.

8. Security

Chart takes cyber security very seriously and maintains reasonable technical, organizational, and physical safeguards to protect personal data against accidental or unlawful destruction, loss, disclosure, alteration, or use.

9. No Automated Decision-making or Profiling

Except for the data processing described in Chart's Cookie Tool, which may constitute profiling under the GDPR, we do not use your personal data for automated decision-making or profiling.

10. Websites of Third Parties

The Websites may contain hyperlinks to and from other websites of third parties. If you use one of these hyperlinks, we are unable to assume any responsibility or liability for the content of third parties websites or their compliance with data protection law.

11. Children’s Privacy

Our Websites are intended for individuals 16 years of age and older. The Websites are not directed at, marketed to, nor intended for, children under 16 years of age. Chart does not knowingly collect any information, including personal data from a child under the age of 16. If you believe that we have inadvertently collected personal data from a child under the age of 16, please contact us at the address below and we will use reasonable efforts to delete the child’s information from our databases.

12. Your Rights

If you are a resident of the European Union or United Kingdom, you may contact us in writing at our business address above or via email at globaldataprivacy@chartindustries.com in order to exercise the following rights to the extent provided by law:

• Right to access to your personal data in order to check and verify your personal data;
• Right to receive a copy of your personal data;
• Right to request that we complete, correct or delete your personal data, or refrain from or restrict the collection, processing or disclosure of your personal data; this also includes the right to have incomplete or incorrect data rectified by supplementary information;
• Right to object to the processing of your personal data whenever the basis of the processing is our legitimate interest pursuant to Art. 6 para. 1f) GDPR;
• You can request to receive your personal data in a structured, common and machine-readable format and, provided that you have acquired the corresponding intellectual property rights or other rights required, have this data transferred to another controller as long as you have consented to the processing, or the processing is necessary in order to fulfill a contractual relationship with you or for the execution of pre-contractual measures.

In cases where we have asked for your consent to process your personal data, you are free to refuse to give consent and you can withdraw your consent at any time. In addition, you have a right to file a complaint with the regulatory authorities for data protection in connection with the processing of your personal data.

California Residents: Residents of California have certain additional rights as more fully explained in our California Privacy Notice. Chart primarily provides services directly to businesses and not to individual consumers. Chart does not intentionally interact with or collect information about individual consumers outside of the business-to-business ("B2B") context. Thus, references to "website visitors", "customers" and "suppliers," described in this Notice only include individuals interacting with us in connection with our B2B functions, such as due diligence of another business or providing or receiving a good or service to or from another business. Only consumers acting in such a B2B capacity are permitted to use our Websites or provide information to us.

13. Changes to this Notice

Chart reserves the right to amend this Notice at any time with effect for the future. The current version will be effective when posted on the Websites. Please check this Notice periodically for updates. When required, we will notify you of any changes to this Notice. When required under applicable law, we will seek affirmative consent from you before making material changes to the way we handle personal data previously collected from you.

(January 2023)

Annex 1

Chart entities