Data Collection and Usage. The Company collects, processes and uses personal data about the Grantee, including but not limited to, the Grantees name, home address, email address and telephone number, date of birth, social insurance number, passport or other identification number, salary, nationality, job title, any shares or directorships held in the Company, details of all awards, rights or any other entitlement to shares awarded, canceled, exercised, vested, unvested or outstanding in the Grantees favor, which the Company receives from the Grantee or the Grantees employer. In order for the Grantee to participate in the Plan, the Company will collect his or her personal data for purposes of allocating Shares and implementing, administering and managing the Plan. The Companys legal basis for the processing of the Grantees personal data is based on the necessity for Companys performance of its obligations under the Plan and pursuant to the Companys legitimate business interests. In those jurisdictions where the Grantees consent to the processing of the Grantees personal data is required, the Grantee expressly and explicitly consents to the collection, processing and transfer practices as described herein.
Stock Plan Administration and Service Providers. The Company may transfer the Grantees data to one or more third party stock plan service providers based in the United States (U.S.), which may assist the Company with the implementation, administration and management of the Plan. Such service provider(s) may open an account for the Grantee to receive and trade Shares. The Grantee may be asked to acknowledge, or agree to, separate terms and data processing practices with the service provider(s).
International Data Transfers. The Grantees personal data will be transferred from the Grantees country to the U.S., where the Company and its service providers are based. The Companys legal basis for the transfer of the Grantees data to the U.S. is the Grantees consent (where required) or the Companys participation in a privacy shield agreement and/or adequate agreements.
Data Retention. The Company will use the Grantees personal data only as long as necessary to implement, administer and manage the Grantees participation in the Plan or as required to comply with legal or regulatory obligations, including under tax and securities laws. When the Company no longer needs the Grantees personal data, which will generally be seven (7) years after the Grantee participates in the Plan, the Company will remove it from its systems. If the Company keeps the data longer, it would be to satisfy legal or regulatory obligations and the Companys legal basis would be relevant laws or regulations.
Voluntariness and Consequences of Consent Denial or Withdraw. The Grantees participation in the Plan and his or her grant of consent, if required, if purely voluntary. The Grantee may reject participation in the Plan or withdraw the Grantees consent, if applicable, at any time. If the Grantee rejects participation in the Plan, does not consent, if applicable, or withdraws his or her consent, if applicable, the Grantee may be unable to participate in the Plan. This would not affect the Grantees existing employment or salary; instead, the Grantee merely may forfeit the opportunities associated with the Plan.
Data Subject Rights. The Grantee understands that he or she may have a number of rights under data privacy laws in the Grantees jurisdiction. Depending on where the Grantee is based, such rights may include the right to (i) request access or copies of personal data processed by the Company, (ii) rectification of incorrect data, (iii) deletion of data, (iv) restrictions on processing of data, (v) portability of data, (vi) lodge complaints with competent authorities in the Grantees jurisdiction, and/or (vii) receive a list with the names and addresses of any potential recipients of the Grantees personal data. To receive clarification regarding these rights or to exercise these rights, the Grantee can contact his or her local human resources department.