Business Use

Vendor Privacy Notice
The Procter & Gamble Company] ("P&G") and its subsidiaries may process the personal data ofmembers and representatives of your company when managing its relationship with you. In somecircumstances, for examples as when conducting vetting for antibribery purposes, it may process thedata of your organization’s representatives, owners or principal officers as further detailed in the noticeprovided in the antibribery due diligence survey (if applicable). Please provide a copy of this notice toany individuals within your organization whose personal data is expected to be processed by P&G during
onboarding or for the purposes of managing this commercial relationship.
The personal data that P&G will process includes:
•••
•
•
•

Personal details (e.g., name, date of birth);
Contact details (e.g., professional email address or phone number);Job-related data (e.g., position);
Location, (e.g., the country, city or office in which they are located);
Financial and banking information (e.g., bank account number for setting up in our systems tobe able to make payments)
Any other information that the individual voluntarily provides during the course of the vetting
and or commercial relationship.

With respect to processing the personal data of your organization’s representatives, P&G has alegitimate interest in processing this data for the purposes of commencing and maintaining therelationship with your organization. The purposes for which this data will be processed include:
••
•
•

•
•
•

Creation of vendors in our systems;
Onboarding of your organization;
Review of invoices and making payments;
Communicating with your representatives as necessary in the course of the relationship, e.g.
o Commercial interaction, e.g. bidding, negotiation, contract negotiations, etc
o Technical interaction, e.g. specifications, service descriptions, Scope of Work, KPIs, etc.
o Daily Operation, e.g. exchange of pricing, supply chain and technical information,
volumes, planning parameters and others.
o Business related interaction on multiple organizational levels
Conducting due diligence on relevant risk areas such as privacy, antibribery, sanctions,information security, responsible sourcing, etc.
Compliance with laws, regulations and Company policies regarding antibribery, child labor,
anticorruption, sanctions, export controls, human rights and other corporate governance andstewardship requirements
Compliance with all legal, regulatory, judicial, tax or governmental requirements

With respect to the personal data P&G collects for purposes of performing due diligence and vetting
vendors, P&G has a legitimate business interest in performing these vetting processes in order tocomply with applicable legal obligations and will process personal data in order to perform these vetting
processes. The personal data will be processed only to conduct necessary background checks and toperform vetting related to compliance with third party risk areas such as antibribery, sanctions, privacy,information security and others. This vetting may be required, in order for P&G to consider andBusiness Use

determine, among other factors, whether to retain, or continue to retain, your company as supplier orbusiness partner and also to determine any appropriate contracts and controls.
P&G will share this personal data with the service providers that support our systems and processes
including with our vetting partners, in order for those partners to run appropriate checks for sanctions
and politically exposed persons, as well as to assess privacy or security controls.
If the individual whose personal data is processed by P&G is located outside of the United States (e.g. inthe EEA, UK or Switzerland) their data may be transferred to jurisdictions outside the jurisdiction inwhich it was collected, including to the United States.
P&G and its service providers/partners may retain the personal data for the duration of our relationshipwith your organization in accordance with Procter & Gamble’s Record Retention limits.
Subject to applicable law, the individuals whose personal data P&G processes may have certain rights
with respect to their data, such as rights of access, rectification, erasure, and portability, as well as theright to request restriction of processing or object to P&G’s processing.
If an individual has any questions or concerns about P&G’s processing of their personal data, or wishes
to exercise their rights under applicable data protection law, they may contact P&G’s Data Protection
Officer at pgprivacyofficer.im@pg.com. The individuals whose data P&G processes also have the right tolodge a complaint with the relevant supervisory authority in their jurisdiction.