PRIVACY NOTICE

Mercer LLC and its affiliates (we) take the security of your data very seriously and are committed to protecting and respecting your privacy.

What is this notice for?
This privacy notice sets out the basis on which we protect your personal information, the uses to which that information is put, and the ways in which we protect it. This notice also tells you about your privacy rights to the extent that the information that we hold about you constitutes personal data.

1. WHAT INFORMATION DO WE COLLECT?

Information provided by you, your representatives or third parties
We collect information submitted by you in response to the EX Diagnostic Survey.

This information may include personal data or sensitive personal data such as:

• Contact details: name, work email address, current role, phone

2. HOW DO WE USE THE INFORMATION WE COLLECT?
The personal data we collect is used for (1) contacting you in the event we have any questions about the data that you provided, (2) providing you with access to survey results and (3) contacting you in relation to new surveys that may be of interest to you. Your data will always be managed with reference to all applicable laws and regulations.

3. USING YOUR INFORMATION IN ACCORDANCE WITH DATA PROTECTION LAWS
Data protection laws require that we meet certain conditions before we are allowed to use your data in the manner described in this privacy policy. To use your personal data, we will rely on two conditions, depending on the activities we are carrying out:

Consent
We only process your sensitive personal information, e.g. information about your ethnic origin and sexual orientation, where you have provided your explicit consent for us to do so.

See below for your rights on withdrawing consent

Legitimate interests
To use any other personal information that you provide for a purpose described in this privacy policy, we will rely on a condition known as “legitimate interests”. It is in our legitimate interests to collect your personal data as it provides us with information that we need to (1) contact you in the event we have any questions about the data that you provided, (2) provide you with access to survey results and (3) contact you in relation to new surveys that may be of interest to you.

This requires us to carry out a balancing test of our interests in using your personal data (for example, in order to provide you with the information, products and services that you request from us), against the interests you have as a citizen and the rights you have under data protection laws (for example, to not have your data sold to third party marketing companies without your knowledge).

The outcome of this balancing test will determine whether we can use your personal data in the ways described in this privacy policy. We will always act reasonably and give full and proper consideration to your interests in carrying out this balancing test.

If we look to use your personal information for any other purpose not covered in this privacy notice, we will let you know first.

4. HOW LONG WE KEEP YOUR INFORMATION FOR
We will keep the information submitted by your company for at least three years, but no more than 10 years, to allow year on year comparisons to take place in order to track progress across the industry.

5. DISCLOSURE OF YOUR INFORMATION
Survey responses will be analysed by the Mercer entity that you are contracted with and our affiliates Mercer Services Poland SP Z O O and Mercer Consulting (India) Private Limited to produce a report for EX Diagnostic Survey, which will be made publically available. Mercer may also use the data submitted to report to your employer regarding the internal policies in their organisation. All reporting produced by Mercer will be on an aggregated and anonymised basis, which means that no individual will be identifiable in our reports.

Survey responses will be submitted via a platform hosted by Qualtrics and hosted by Qualtrics’ trusted third party data centres in the USA and Canada. Qualtrics will not receive access to information regarding the employer to which survey responses relate, unless we require Qualtrics to provide technical support.

6. SENDING DATA OUTSIDE OF THE EEA
The personal data submitted by you may be sent outside of the EEA.

If we do transfer information outside of the EEA to our staff, Affiliates or suppliers, we will make sure that it is protected in the same way as if it was being used in the EEA. We will use one of these safeguards:

• Transfer it to a non-EEA country with privacy laws that give the same protection as the EEA. Learn more on the European Commission Justice website.
• Transfer it to one of our Affiliates, which is committed to comply with our Binding Corporate Rules. Our Binding Corporate Rules have been approved by the UK data protection regulator (the Information Commissioner’s Office) and sets out a standard as to how we will process personal data within our group companies. Learn more about our Binding Corporate Rules Standards here.
• Put in place a contract with the recipient that means they must protect it to the same standards as the EEA. Read more about this here on the European Commission Justice website.

7. WHAT STEPS DO WE TAKE TO PROTECT YOUR INFORMATION?
We restrict access to your personal information to those employees of ours, our affiliates, and third party service providers who reasonably need it to provide products or services. We have implemented physical, administrative, and technical safeguards to protect your personal information from unauthorised access. However, as effective as our security measures are, no security system is impenetrable. We cannot guarantee the security of these systems, nor can we guarantee that information supplied by you or on your behalf cannot be intercepted while being transmitted over the Internet.

8. WHAT RIGHTS AND OBLIGATIONS DO YOU HAVE WITH RESPECT TO YOUR DATA?
You have a number of rights under data protection law in relation to the way we process your personal data. These are set out below. You may contact us using the details below for our Data Protection Officer (see paragraph 10 below) to exercise any of these rights. We will respond to any request received from you within one month from the date of the request.

Please note that the rights listed below are only exercisable to the extent that it is possible to re-identify you based on the information you have provided and we would only do so at your specific request. We expect the circumstances in which individuals will be re-identifiable based on their survey responses to be extremely limited.

Rights to access your personal information and correct any personal information
You are entitled to find out what personal information we hold on you or to have your personal information updated or changed.

If you want us to stop using your personal information
You have the right to object to our use of your personal information held by us about you.

You can also ask us to delete, remove or stop using your personal information if there is no need for us to keep it, you withdraw your consent if we are using your information based on consent or where you object to the way we process your data. This is known as the “right to erasure” (or “right to be forgotten”).

There may be legal or other official reasons why we need to keep or use your data. But please tell us if you think that we should not be using it.

We may sometimes be able to restrict the use of your data and you have a right to restrict our processing of your information. This means that it can only be used for certain things, such as legal claims or to exercise legal rights. In this situation, we would not use or share your information in other way while it is restricted. This will apply where for example:

• you challenge the accuracy of the personal information held by us;
• you have the right to be forgotten but prefer our processing is restricted instead
• where we no longer need to use the personal information to achieve the purpose we collected it for but you require the information for dealing with legal claims

If you want to object to how we use your data, or ask us to delete it or restrict how we use it, please contact us.

If you want to withdraw your consent
You can withdraw your consent at any time where we are relying on it to use your personal information (for example, to process your sensitive personal information).

Right to transfer your information
You can request to receive your personal information which you have provided to us, in a structured, commonly used and machine readable format that can be easily reused. You can also ask us to pass your personal information in this format to other organisations.

9. CHANGES TO THIS PRIVACY NOTICE
This privacy notice and any document to which it refers are subject to change at any time. If we make material updates to this notice, we make a copy available to you.

10. HOW TO CONTACT US

How to complain
Please let us know if you are unhappy with how we have used your personal information or are not satisfied with our handling of any request by you in relation to your rights. You can contact us at:
Data Protection Office
Mercer Limited
1 Tower Place West
London
EC3R 5BU
You also have the right to complain to the Information Commissioner’s Office. Their address is:

First Contact Team
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
SK9 5AF

Find out more information on their website on how to report a concern.