Introduction
Solvay recognizes and supports the privacy interests of all persons, and respects these interests when Solvay collects and processes Personal Information. In particular, Solvay respects the privacy of its customers, suppliers and employees and other individuals with whom Solvay has business interactions. In addition to the restrictions and obligations of this Policy, Solvay complies with the applicable national laws that protect the privacy of Personal Information, including the EU General Data Protection Regulation 2016/679), effective on and after May 25, 2018, and all laws and regulations in the jurisdictions in which Solvay conducts its business.
Scope
This Policy applies to:
(1) Personal Information that is collected, maintained, used or otherwise processed by any Global Business Unit, Function/Business Support Activity or Affiliate of Solvay. This Policy is global, applying to all Solvay locations. It is the imperative basis for using Personal Data and can only be replaced by stricter national regulations;
(2) Personal Information in any format, including computerized records and electronic information as well as paper-based files; and
(3) Personal Information that Solvay collects and uses for its own business purposes.
In some cases, Solvay processes Personal Information that belongs to other companies in particular in the framework of Transitional Services Agreements. In these cases, Solvay shall protect the Personal Information in compliance with this Policy, comply with all laws that regulate the information, and use information only as authorized by the data owner as specifically set out in a Transitional Services Agreement.
The terms of this Policy are also intended to apply to agents and contractors that handle and process Personal Information on behalf of Solvay.
Definitions
For purposes of this Policy, the following definitions shall apply:
“Personal Information” (or person’s information) - also called Personally Identifiable Information (PII) or Personal Data- means any information that can be used to identify directly or indirectly a person. It includes any information that enables an individual to be identified either from that piece of data alone, or from that data and other data that is available or likely to be available such as his/her name, home address, email, identification number, salary and benefits information. There is no distinction between Personal Information about an individual in their private, public or work roles, as all are covered by this Policy.
“Processing” means any operation or set of operations which is performed upon Personal Information, whether or not by automatic means, such as collection.
“Sensitive Personal Information” means Personal Information that reveals medical or health conditions, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership or information specifying the sex life or sexual orientation of the individual.
Privacy principles
(1) Collection or use of data - Purposes
Solvay collects and uses the Personal Information to support and further its businesses. Solvay processes Personal Information only for limited, explicit and legitimate purposes and always in accordance with applicable law. The types of information and the purposes for which we collect Personal Information may include:
For Employees
Solvay collects and uses Personal Information as needed for human resources and employment processes from current and prospective employees and independent contractors.
For Customers, Vendors, Suppliers and Subcontractors
Although our customers, vendors, suppliers and subcontractors are mostly companies, Solvay collects Personal Information about individuals who are employed by them. This business contact information and other personal details are used to administer existing and future business arrangements.
Others
Additional Personal Information may be collected, used and disclosed for the purposes for which it was collected and for legal compliance purposes, including regulatory reporting, investigation of allegations of wrongdoing, and the management and defense of legal claims and actions, and compliance with subpoenas, court orders and other legal obligations. For example, we may collect information about individuals that visit our facilities.
Solvay collects this information only in a reasonable and lawful manner.
(2) Privacy notices -Transparency
Where required, Solvay informs individuals about its processing of their information and also makes this information available upon request. In particular, its privacy notices contain:
- the type of information we collect;
- the purposes for which we collect Personal Information;
- the types of parties to whom we disclose Personal Information;
- the privacy and information safeguards we employ; and
- how to access, correct or erase Personal Information (if appropriate).
Solvay also offers transparency with regard to international information transfers. Where possible, privacy notices include information about how Personal Information may be used within the Solvay Group and by third parties, the purposes of such transfers, the potential recipients, and the safeguards that Solvay has put into place to help ensure an adequate level of protection for the transferred information.
(3) Lawfulness and fairness of the processing
Solvay processes Personal Information lawfully and fairly in relation to the individual. This implies that all processing is based on legitimate grounds, such as the necessity of the processing for (i) preparing and/or performance of a contract with the individual, (ii) compliance with a legal obligation imposed on Solvay, (iii) protection of vital interests of the individual, (iv) performance of a task carried out in the public interest, or (v) legitimate interests pursued by Solvay or by a third party except where such interests are overridden by the interests or fundamental rights and freedoms of the individual which require protection of Personal Information.
In addition, where consent of an individual for the collection, use, or disclosure of Personal Information is required by law, contract or agreement, Solvay must receive such consent prior to the processing or transfer of the Personal Information.
(4) Sensitive information
There are certain types of Personal Information that Solvay considers to be particularly sensitive and for which Solvay provides additional and appropriate privacy protection and confidentiality. Solvay will only collect and use this Sensitive Personal Information where there is a legal basis, or where the individual’s consent has been obtained or where there are compelling business reasons if legally permitted.
(5) Accuracy of information
Solvay employs reasonable means to keep Personal Information reasonably accurate, complete, and up- to-date, as needed for the purposes for which it was collected.
(6) Information disclosure
Internal Disclosure
In general, Personal Information may be shared within Solvay, where legally permitted for reasonable and appropriate corporate purposes. However, even within Solvay, access to Personal Information is restricted to those employees, agents, or contractors who need access to carry out their assigned functions.
External Disclosure
Disclosure of Personal Information beyond the employees, agents, or contractors of Solvay, may be made only as permitted or required by law or legal process, or pursuant to an agreement, business necessity, or with the consent of the individual. In particular:
Employees
Solvay may disclose Personal Information about workers and employees to a range of third parties who provide its employees with services, such as payroll or benefits management.
All Individuals
Personal Information may always be disclosed in connection with legal compliance initiatives, in response to a government request for information or as part of the due diligence, negotiation and completion of a sale or transfer of all or part of our businesses.
(7) The location of Personal Information and international transfer
Personal Information may be stored and processed at Solvay national, regional or global headquarters, at the locations of a Solvay Affiliate or of our service providers, at one or more of our international data centers and in the cloud via our service providers and always in accordance with the applicable laws.
The international footprint of Solvay involves a large number of transfers of Personal Information between different Solvay entities, as well as to third parties located in various countries. Solvay endeavors to ensure that appropriate safeguards are implemented to secure such information transfers in conformity with applicable laws.
(8) Protecting Personal Information
To help protect the confidentiality of Personal Information, Solvay employs security safeguards appropriate to the sensitivity of the information. These safeguards include reasonable administrative, technical and physical measures to protect the confidentiality and security of Personal Information against anticipated threats and unauthorized access to the Personal Information. Solvay also maintains an effective Data Protection & Privacy incident and breach management program. When required by applicable law, Solvay will report Personal Information breaches to the relevant authority and/or to inform the affected person.
(9) Access and Correction - Rights of individuals
Solvay shall generally provide individuals upon request with an opportunity to examine their own Personal Information, confirm the accuracy and completeness of their Personal Information, and have their Personal Information updated, if appropriate. Solvay provides individuals with a reasonable opportunity to object to the collection, use, and disclosure of their Personal Information.
(10) Retention
Solvay endeavors not to retain the Personal Information longer than is allowed under applicable laws.
Responsibilities/Accountabilities
It is the responsibility of all employees to assist in the protection of Personal Information, by acting in accordance with this Policy. Each employee is also responsible for helping to ensure that the Personal Information Solvay holds is accurate and up-to-date.
Solvay has established a Data Protection & Privacy Office which is responsible for coordinating the Solvay privacy compliance efforts as well as for deploying effective communication and training related to this Policy. Where required by national law, Solvay will appoint Data Protection Officers at national or local levels.
It is the responsibility of each Global Business Unit, Function/Business Support Activity or Affiliate of Solvay, and of every employee to ensure compliance with this Policy when processing Personal Information and to report to the Data Protection & Privacy Office any non-compliance or violation.
The Data Protection & Privacy Office is responsible for defining and updating this Policy.
Any violation of this Policy may result in appropriate actions, including disciplinary actions, mitigation actions and discontinuation of business relations, subject to and in conformance with applicable laws.