DATA PRIVACY NOTICEBUSUU LTD., located at: Broadwalk House, 5 Appold Street, EC2A 2A, in London, England (“Company”) isexcited to be part of Chegg, Inc. The Company and Chegg take your privacy seriously and value theprinciple of transparency as it relates to the handling of your Personal Data. This Privacy Notice (the“Notice”) describes:
●
●
●
●
●
●
●

What Personal Data the Company collects about you;
How the Company uses your Personal Data;
To whom the Company discloses your Personal Data;
Any international transfers of your Personal Data;
How the Company safeguards your Personal Data;
Whether the Company engages in automated decision making; andYour rights regarding your Personal Data.

For purposes of this Notice:“Personal Data” means any information concerning an identified or identifiable individual; and“Processing” means any operation with respect to Personal Data, such as collection, retrieval,access, use, disclosure, storage or disposal of Personal Data.
1.

Collection, Use and Disclosure of Your Personal Data:
1.1

Collection. The Company collects Personal Data from you during the employment
application process. Additionally, during your employment, the Company collects
Personal Data from you and from managers, for example, through performance
evaluations. The Personal Data collected includes, but is not limited to, the following:●identification information, such as your name, employee/staff ID, date of birth,
nationality, photo, National Insurance Number (or equivalent national identificationnumber);●contact information, such as your work and home addresses, telephone numbers,
email addresses, and emergency contact details;●

information about your job, such as job title, employment type, category andstatus, work location, department, employment contract, assigned tasks andprojects, weekly hours, supervisor's name, start and end date, and reason forleaving;●job qualifications, such as your education, training, and certifications;●performance and disciplinary information, such as performance reviews,
evaluations and ratings, information about disciplinary allegations, the disciplinary
process and any disciplinary warnings, details of grievances, and any outcome;●information about your compensation and benefits, such as your basic salary,bonus and commission entitlements including restricted stock options, insurance
benefits (including information about you and your dependents that we provide tothe insurer), hours and overtime, tax code, holiday entitlement, accrued salary
information, and information relating to your pension;●

payment information, such as your bank details (for payroll and travel
reimbursement purposes only) and business travel and entertainment data;●

equity compensation information, such as units of stock or directorships held,details of all restricted stock units or any other entitlement to shares of stock
awarded, cancelled, exercised, vested, unvested or outstanding in your favor;●

enterprise device, application and communications information, such as IT systems
usage information related to your use of Company equipment, systems, and otherresources, including login information;•communication details, such as email content, business letter content, businessdocuments, and chat content.

The Company also may collect sensitive (i.e. special category) Personal Data about you,which may include:●

Religious affiliation, to calculate and deduct the legally required church tax whereapplicable;●

Health information, as required by law or as necessary to manage the employment
agreement, including benefits administration, occupational health, disability
accommodation, workers’ compensation, and sick leave;

The Company generally will not transfer sensitive Personal Data outside of the EuropeanUnion (“EU”) or the United Kingdom (“UK”), as applicable, except where an employee’s
supervisor is located outside the EU or UK and has a legitimate, business need to know.
Information provided by you to the Company relating to other people (e.g. your partner,dependents, etc.) will be processed by the Company in accordance with this Notice. You
are responsible for the accuracy of such information and for ensuring that those people
are aware of the nature of the information you have provided and the way in which it
will be processed by the Company.
1.2

●
●

●
●
●
●
●

Use. The Company uses Personal Data, as necessary, for all purposes related to thecreation, administration, and termination of your employment relationship with theCompany. These purposes include, but are not limited to, the following:
For recruitment of new employees;
To administer employee compensation,including, but not limited to, payment ofwages and bonuses and income tax
withholding and reimbursement ofbusiness expenses;To administer employee benefits;
To administer performance appraisals,safety, and travel arrangements;
To administer training of employees;
To administer leaves of absence as
required by law or company policy;
For emergency contact purposes;
2

●
●
●
●
●
●

To administer secure access to Company’s
IT resources worldwide;
To administer access to the physicalfacilities of Company;
To monitor and enforce compliance withinternal policies;
To comply with mandatory government
reporting requirements;
To conduct audits as required by law;
To exercise the Company’s rights underapplicable law and to support any claim,defense, or declaration in a case or before●●●To engage in succession planning;
To provide employee contact information
to current and prospective customers;●
To meet legal and regulatory requirements
including civil discovery in litigation
involving the Company or affiliatedcompanies;

a jurisdictional and/or administrative
authority, arbitration, or mediation panel;
To declare employment to local authorities
for immigration purposes.

The Company may also use your Personal Data to facilitate administrative functions,including, but not limited to, the management and operation of information technology
and communications systems, risk management and insurance functions, budgeting,financial management and reporting, strategic planning, and the maintenance oflicenses, permits and authorizations applicable to the Company’s business operations.
These uses are necessary for the Company to: (1) fulfill its obligations under its
employment agreement with you, such as to administer payroll; (2) are required tofulfill the Company’s legal obligations, such as to accommodate a disability; or (3) arenecessary for the Company to pursue its legitimate interests, such as to evaluate job
performance or to arrange business travel.
Please understand that if you do not provide your Personal Data, the Company may not beable to provide you with employment or with other certain benefits. For example, theCompany requires your national insurance number (or equivalent) to process payroll. In
general, you are obligated to provide the Personal Data, except where we indicate thatcertain information is voluntary at the point of collection.
1.3

Disclosures. Due to business requirements or contractual or statutory obligations, theCompany may need to disclose your Personal Data to Authorized Third Parties (definedbelow) for the purposes described above. The Company will provide your Personal Data
to an Authorized Third Party (as a data processor) only subject to a data processing
agreement that complies with applicable law.
The Company generally will not disclose your Personal Data to any other third parties unlessthe disclosure is required by law (for example, to tax authorities), is necessary to protect
your health or safety or the health or safety of third parties, is of business contact
information for the purpose of developing and maintaining business relationships, and inother limited circumstances where disclosure is legally permitted or required.
“Authorized Third Parties” include third-party service providers under written contract
with the Company or any of its affiliated companies and acting under the Company’s
direction and instructions, such as auditors, administrative service providers,background check providers, recruiting agencies, travel agencies, and any other entity
providing services to the Company.

2.

International Transfers of Personal Data:

Because the Company is part of a multinational corporation, some of your Personal Data may betransferred to Chegg, Inc. (the “Parent Corporation”) located at 3990 Freedom Circle, Santa Clara, CA3

95054 in the United States as an independent controller of your Personal Data The Parent Corporationwill use your Personal Data for the purposes described above related to your employment with theCompany; to facilitate administrative functions and information technology operations; and to manage
business operations. Only a limited number of the Parent Corporation’s employees with a need to know
to perform their job responsibilities will be permitted access to your Personal Data.
The Parent Corporation has agreed to use Standard Contractual Clauses approved by the European
Commission and Standard Contractual Clauses approved by the UK’s Information Commissioner’s Officeto ensure an adequate level of protection for the transfer of Personal Data to the Parent Corporation.
You can obtain a copy of the Standard Contractual Clauses used to transfer your Personal Data bysubmitting a request to Privacy@chegg.com
For questions or concerns regarding any transfer of your Personal Data to the Parent Corporation, you
may contact Chegg, Inc. by emailing Privacy@Chegg.com. The Company and the Parent Corporation may
transfer your Personal Data to Authorized Third Parties, located outside the EU or UK, for the purposes
described above. Before transferring your Personal Data from the EU or UK directly to any Authorized
Third Party located in the United States or elsewhere outside the EU or UK, the Company, or the Parent
Corporation on its behalf, will, where required, execute Standard Contractual Clauses approved by theEuropean Commission or Standard Contractual Clauses approved by the UK’s Information
Commissioner’s Office to ensure an adequate level of protection for the transfer of your Personal Data to
those entities outside the EU or UK. You can obtain a copy of the relevant Standard Contractual Clausesby contacting the email above.
3.

Security Measures for, and Retention of, Personal Data:

The Company has implemented reasonable and appropriate administrative, physical, and technicalsafeguards for your Personal Data. For example, your Personal Data will be stored on a secure serverwhen in electronic form and in physically secure areas when in paper form. Technical and physicalcontrols restrict access to your Personal Data to employees of the Company with a need to know. The
Company will retain your Personal Data throughout the employment relationship and as long thereafter
as is required by applicable law.
4.

No Automated Decision Making:

The Company does not make any decisions concerning your employment only by automated means.
5.

Your Rights With Respect to Your Personal Data:

Pursuant to applicable law, you have the right to, in most instances: (a) request access to your Personal
Data; (b) request rectification of your Personal Data; (c) request erasure of your Personal Data; (d)withdraw your consent to the processing of your Personal Data; (e) request restriction of processing ofyour Personal Data; (f) request data portability; and (g) object to the processing of your Personal Data.
●

More on the right of access: Your right to access your Personal Data includes your right to receive acopy of all, or a portion, of your Personal Data in the Company’s possession as long as the Company
providing your Personal Data would not adversely affect the rights and freedoms of others.

●

More on the right to data portability: Subject to certain limitations, the right to data portability
4allows you to obtain from the Company, or to ask the Company to send to a third party, a copy ofyour Personal Data in electronic form that you provided to the Company in connection with theperformance of your employment agreement or with your consent.
●More on the right to withdraw consent: If the Company requests your consent to process yourPersonal Data and you do consent, you may use the contact information above to withdraw yourconsent. Any withdrawal shall not affect the lawfulness of processing based on consent before its
withdrawal, and the Company will continue to retain the information that you provided us before
you withdrew your consent for as long as allowed or required by applicable law.

●

More on the right to object: You have the right to object to the processing of your Personal Data
based solely on the Company’s or the Parent Corporation’s legitimate interests. If you do object inthese circumstances, the processing of your Personal Data will be stopped unless there is anoverriding, compelling reason to continue the processing or the processing is necessary to establish,
pursue or defend legal claims.

●How to exercise these rights: You can exercise these rights or for questions and concerns, contact theCompany at: hr@busuu.com

The Company will respond to such requests in accordance with applicable data protection law. If you
believe that your Personal Data has been processed in violation of applicable data protection law, youhave the right to lodge a complaint with the data protection authority where you live, where you work,or where you believe the violation occurred. The Parent Corporation also has a data protection officer
who can be contacted as follows: felix.wittern@fieldfisher-tech.com.

5