DATA PROTECTION & PRIVACY NOTICE

Applicability of this Privacy Notice

This notice describes how ContourGlobal plc and its affiliates (“ContourGlobal”) use information relating to individuals which is submitted through the EthicsLine (as defined below).

  1. General

    ContourGlobal’s EthicsLine (the “EthicsLine”) is a web and phone-based intake system provided by ContourGlobal plc on behalf of ContourGlobal plc, with registered office at 6th Floor, 15 Berkeley Street, London, W1J 8DY, Great Britain and its affiliates (“ContourGlobal”), to its employees, vendors, suppliers and business partners and those of its subsidiaries (“Reporters”) for reporting suspected violations of laws or regulations, or company policies related to financial, accounting, auditing and bribery matters and other matters, as permitted by local laws.

    The EthicsLine is operated by “NAVEX”.

    For more information click here.

    If you are not employed by ContourGlobal and you have chosen to report conduct of a ContourGlobal employee, the ContourGlobal company contracting that individual is the primary entity responsible for protecting your personal information and respecting your data protection rights.

    You can contact NAVEX at any of the details listed on http://contourglobalethicsline.com. If you are unsure which ContourGlobal entity is responsible for your information, or if you have chosen to withhold your identity from ContourGlobal (but not NAVEX) and you wish to exercise your data subject rights.

    You can also contact ContourGlobal using the details at the end of this notice, and your query will be directed to the appropriate ContourGlobal entity for a response.

  2. Use of the EthicsLine

    Use of the EthicsLine is entirely voluntary. You are encouraged to report possible violations directly to your supervisor or manager, or to a representative of the Human Resources, Legal or Compliance Departments, depending on the nature of the possible violation. If you feel that you are unable to do so, you may use the EthicsLine to make your report.

    For more information click here.

    The EthicsLine is a confidential online reporting system that allows you to report suspected violations of law or company policies, as well as other concerns you may have, to ContourGlobal. In certain countries, ContourGlobal may not accept reports through the EthicsLine that relate to certain topics. If your concern pertains to a matter that, under local law, may not be accepted by ContourGlobal through the EthicsLine, you will need to contact your supervisor or local management or a representative of the Human Resources, Legal or Compliance Departments to report the matter.

    Please be aware that the information you supply about yourself, your colleagues, or any aspect of ContourGlobal’s operations may result in decisions that affect others. Therefore, we ask that you only provide information that you believe is true. You will not be subject to retaliation from ContourGlobal for any report of a suspected violation that is made in good faith, even if it later turns out to be factually incorrect. Please be aware, however, that knowingly providing false or misleading information will not be tolerated. The information you submit will be treated as confidential to the extent permitted by law and save where disclosure is necessary in the context of an investigation into a reported concern in which case the information will be handled sensitively. We encourage you to identify yourself in order for us to follow up with questions we may have.

  3. What personal data and information is collected and processed?

    The EthicsLine captures the following personal data and information that you provide when you make a report: (i) your name and contact details (unless the applicable laws in your jurisdiction permit you to report anonymously, and you choose to do so) and whether you are employed by ContourGlobal; (ii) the name and other personal data of the persons you name in your report (management, witnesses, reported person/s) if you provide such information (i.e., description of functions and contact details); and (iii) a description of the alleged misconduct as well as a description of the circumstances of the incident.

    Note that in Spain, the report may not be made anonymously due to legal restrictions; however, your personal information will be treated confidentially to the extent permitted by law and save where disclosure is necessary in the context of an investigation into a reported concern, and will only be disclosed as set in this notice.

    If a report is made about your alleged conduct, NAVEX will in general collect your name, surname, alias or nickname, gender, and (where applicable) title, company, division, and contact information. NAVEX will also collect information about the allegation that is reported, including the nature of the allegation. This may include information about alleged or proven criminal offences, which NAVEX processes on our behalf where permitted by law.

    For more information click here.

    Grounds for processing

    Data protection laws require a valid legal ground to process personal information. We process the information where necessary to:

    • comply with our legal or regulatory obligations (for example, in several countries in the European Union there exists laws relating to the combating of bribery, and other laws that require us to operate whistleblowing hotlines);
    • meet our legitimate interests (see a description of these interests below), provided the processing does not unduly affect your interests or fundamental rights and freedoms;
    • protect the vital interests of the relevant individual or of another natural person; or
    • perform a task carried out in the public interest.

    The legitimate interests referred to above are as follows:

    • to receive, discuss and (where applicable) sanitize the report;
    • to request additional information to substantiate the report;
    • to collate information received in reports and send that information to designated contact persons in the Human Resources or Compliance departments for investigation;
    • to investigate the alleged conduct;
    • to provide feedback to NAVEX and to the individual making a report (where relevant) and make recommendations to ContourGlobal companies; and
    • otherwise to facilitate the raising of concerns about conduct contrary to ContourGlobal’s Code of Conduct or other policies and the investigation of those concerns.

  4. Disclosure of personal information

    Personal information will be disclosed to NAVEX, who receives the information submitted as part of a report.

    In addition, NAVEX may use translation and interpretation sub-contractors for the purpose of delivering the reports to ContourGlobal in English if the reporter made the report in another language.

    For more information click here.

    The following NAVEX sub-contractors may have access to your personal data:

  5. International Transfers of Personal Information

    Some data protection laws restrict the transfer of personal information. Laws in the EEA, for example, require additional compliance steps for sending personal information abroad. These compliance steps help ensure that the same level of protection is applied to personal information once it leaves the EEA.

    EthicsLine and the database in which the personal data and information that you may report is stored, is located on servers hosted and operated in the United States by NAVEX.

    As NAVEX and the EthicsLine are based in the United States, ContourGlobal companies in the EEA will transfer personal information outside of the EEA to the United States. For example, for the purpose of processing and investigating your report and subject to the provisions of local law, the personal data and information you provide may be accessed, processed and used by the relevant personnel of ContourGlobal, including Human Resources, Finance, Legal, Compliance, management, external advisors (e.g. legal advisors), or, in limited circumstances, by technical staff at NAVEX. Those individuals may be located in the United States, the United Kingdom or elsewhere.

    For more information click here.

    Personal data and information you provide may also be disclosed to the police and/or other enforcement or regulatory authorities. The relevant bodies that receive and process personal data can be located in the US or in another country that may not provide the level of data protection available in the EU.

    The United States is not regarded by the European Commission as providing an adequate level of data protection. Therefore, where your information is transferred outside of the EEA, care is taken to ensure that the transfer is subject to appropriate safety measures (which may be contractual in nature) in accordance with data protection laws. NAVEX has entered into contractual commitments with ContourGlobal to secure the information you provide in accordance with applicable law. NAVEX is committed to maintaining stringent privacy and security practices including those related to notice, choice, onward transfer, security, data integrity, access, and enforcement.

  6. Retention

    The personal data you provide will be kept as long as necessary to process your report, or, if applicable, as long as necessary to initiate sanctions or to meet our legal or financial needs.

    Thereafter, personal data will be kept in accordance with ContourGlobal’s data retention policy.

  7. Special Country Regulations

    Throughout much of the European Union and surrounding areas, reports may be limited in topics, generally to concerns about accounting, auditing, bribery, competition law, discrimination and harassment and environment, health, hygiene, and safety matters. Further, some countries restrict reports such that only employees in key or management functions may be the subject of a report.

    For more information click here.

    Any issues or concerns relating to topics not permitted by law to be reported via the EthicsLine should be reported directly to your Manager or Supervisor or a representative of the Human Resources, Legal or Compliance Departments (compliance@contourglobal.com) as appropriate for the subject matter of the possible violation. In some countries, anonymous reports may not be permitted under the law except under extremely restrictive circumstances.

  8. Your rights and contact information

    You may have the following rights under data protection laws:

    • Right of subject access: The right to make a written request for details of personal data about you held by ContourGlobal and a copy of that personal data.
    • Right to rectification: The right to have inaccurate information about you rectified.
    • Right to erasure ('right to be forgotten'): The right to have certain personal data about you erased.
    • Right to restriction of processing: The right to request that your personal data is only used for restricted purposes.
    • Right to object: The right to object to the use of personal data, including the right to object to marketing.
    • Right to data portability: The right to ask for personal data you have made available to us to be transferred to you or a third party in machine-readable formats.
    • Right to withdraw consent: The right to withdraw any consent you have previously given us to handle your personal data. If you withdraw your consent, this will not affect the lawfulness of ContourGlobal’s use of your personal data prior to the withdrawal of your consent.

    These rights are not absolute: they do not always apply and exemptions may be engaged. We may, in response to a request ask you to verify your identity and to provide information that helps us to understand your request better. If we do not comply with your request, we will explain why.

    To exercise any of these rights, or if you have any other questions about our use of your information, please email us at privacy@contourglobal.com.

    For more information click here.

    If you are unhappy with the way we have handled your information you have a right to complain to your local data protection regulator.

    • In Austria, your local regulator is the Austrian Data Protection Authority, whose website is available at http://www.dsb.gv.at
    • In Bulgaria, your local regulator is the Commission for Personal Data Protection, whose website is available at http://www.cpdp.bg
    • In France, your local regulator is the Commission Nationale de l’Informatique et des Libertés, whose website is available at http://www.cnil.fr
    • In Italy, your local regulator is the Garante per la protezione dei dati personali, whose website is available at http://www.garanteprivacy.it
    • In Luxembourg, your local regulator is the Commission Nationale pour le Protection des Données, whose website is available at http://www.cnpd.lu
    • In Poland, your local regulator is the Office of Personal Data Protection, whose website is available at http://giodo.gov.pl
    • In Romania, your local regulator is the National Supervisory Authority for Personal Data Processing, whose website is available at http://www.dataprotection.ro
    • In Slovakia, your local regulator is the Office for Personal Data Protection, whose website is available at http://www.dataprotection.gov.sk
    • In Spain, your local regulator is the Agencia Española de Protección de Datos, whose website is available at http://www.agpd.es
    • In the UK, your local regulator is the Information Commissioner, whose website is available at https://ico.org.uk.

    If you have any questions about this privacy notice, or our privacy related practices, you can contact: privacy@contourglobal.com.