Data Privacy Policy

Table of contents
Collect
personal datatransparently& lawfully.

24

A message from the Chief Executive Officer

5

Scope

6

SGS Data Privacy Policy3

A message from theChief Executive Officer
In the context of our business and to operate efficiently, SGS collects
personal data from its customers, suppliers, employees, website users,
job applicants, contractors, shareholders, partners and other third parties.
SGS recognizes that personal data must be treated with caution. We arecommitted to conducting our business in accordance with all relevant dataprotection and privacy laws of the countries in which we operate andin line with the highest standards of ethical conduct.
Protection of personal data is important to every part of our business. It isessential in maintaining trust and is embedded in our promise to our clients,
as well as at the heart of our values, principles, conduct and success.
The introduction of stricter regulations and the digitalization of our services
provide the opportunity to remind our clients and the industry of SGS’s
integrity in one of the most important areas of modern life – the protectionof personal data.
If you have questions or comments about this policy, please contact us atprivacy@sgs.com.

Scope
Frankie Ng
Chief Executive Officer

This SGS Data Privacy Policy applies
to all affiliates and entities of theSGS Group. It defines the conduct
expected of each SGS employee,officer and director when collecting,processing and managing thepersonal data of SGS’s customers,suppliers, employees, candidates,contractors and other third parties.
This policy is founded on threecore commitments:
1. Collect personal data 		transparently and lawfully
2. Respect individual rights
and choices3. Manage personal data
responsibly and securely

4

Personal data refers to any
information which relates to anindividual and may include amongst
others: contact information (name,home and business address, phonenumber(s), email addresses);personal information (date of birth,citizenship, pictures, electronic
identification data, such as cookies,
IP addresses and passwords),
professional and employment
information (education and training),
financial data (tax identification andbank account number).

Employee compliance with thispolicy is non-negotiable. Any
violation of this policy will resultin disciplinary action.
Internal implementation rules,guidelines and training are provided,
as with all the necessary supporting
documentation to ensure adherence
to the SGS Data Privacy Policy.

This policy defines the SGS
standards that apply in the absenceof more stringent rules which may
be mandated by local laws.

5

SGS Data Privacy Policy
Three core commitmentsCollect personal datatransparently & lawfully
Be open about the personal
data that is collected and used
We inform individuals about theuse of their personal data.
When collecting personal data, SGS
informs individuals clearly, honestly
and transparently about the natureof the personal data it collects andwhat it intends to do with it, unless
any laws or secrecy obligations
which SGS is bound to, requires
SGS to not inform such individuals
about the collection and holding of
their personal data.
Use personal data for lawful
and specific purposes only
We collect and process personal
data only if there is a lawful reason
to do so.
SGS collects and processes personal
data only to the extent that either(i) valid and informed consent has
been given or (ii) if it is required bylegitimate SGS business interests,
such as entering into contracts,processing and receiving payments,
carrying out contractual obligations
and complying with statutory orregulatory requirements.
We allow consent to besubsequently withdrawn.
Any consent by individuals to thecollection and use of their personal
data must be given freely and inresponse to clear information by
SGS about the intended use of
the data. Such consent can bewithdrawn anytime by the individual
without undue complications. The
date, content and validity of suchconsent must always be documented.

6We adhere to instructions givenby the data controllers.
In addition to this policy, SGS
complies with the guidelines andinstructions of the client or thirdparty (a data controller) whenprocessing personal data on
their behalf.
Ensure data quality
We collect, store and ensure that
personal data is not excessive,
but proportionate, relevant,
up-to-date and accurate for its
intended purpose.
SGS collects and stores theminimum amount of personal datarequired for the intended initial
purpose for which the data is tobe used.
SGS ensures that personal data
in its possession remains relevant
and proportionate for its intended
purpose.
SGS ensures that all data stored is
up-to-date and accurate. Data is also
corrected and modified as andwhen required.
We may use and engage insecondary usage or further
processing of personal data onlyin the following circumstances.
SGS may use personal data forany secondary purpose or further
processing, if the new purpose iscompatible with the original purpose,or SGS obtains new consent or
establishes a new legal basis forany new purpose.
We store personal data only for
as long as it is really necessary.
Personal data is stored by SGS
only for the period of time requiredfor its intended purpose. Specificretention policies define the periodof time after which such data is tobe deleted, destroyed, de-identified
or anonymized.

Respect individual rights& choices

when required by applicable 		laws, or if SGS can demonstratethat it is authorized to sendsuch communication for 		
legitimate business purposes(ii) No longer receive any marketing
communication if a specificpreference setting, an opt-out
or an objection to use such data
for marketing purposes has
been received by SGS

Respect the rights of the individual
We respond to all requests made byindividuals in connection with theirpersonal data.
SGS recognizes the rights ofindividuals to:(i)Request access to and receive
a copy of their personal data 		processed by SGS(ii) Request the update or
rectification of inaccurate orincomplete personal data(iii) Request the erasure of their 		
personal data(iv) Object to or request restriction
on the processing of their 		
personal data(v) Request the portability of theirpersonal data(vi) Withdraw consent given to SGS
for the collection and processingof their personal data (without
it affecting the lawfulness of any
processing administered prior tothe withdrawal)
SGS will honor such requests,withdrawal or objection as required
under applicable data protection
rules within a reasonable period oftime. These rights are not always
absolute: they do not always apply,and exemptions may be exercised.
If SGS does not comply with therequest, an explanation is provided.
Respect the choices of theindividual
We inform individuals in clear
and plain language when using
their personal data for marketing
purposes.
SGS respects the choice of its
existing and prospective
customers to:(i) Only receive marketing
communication from SGS
if explicit and specific priorconsent has been provided,

Safeguard the use of sensitive
personal data
We use sensitive personal data only
when it is absolutely necessary.
SGS recognizes the particularsensitivity of certain categories
of personal data that require ahigher level of protection. Sensitive
personal data includes information
regarding an individual’s physical/
mental health or disability, biometricand genetic data, religious andpolitical opinions, racial or ethnic
origin, trade union and similar
memberships, gender identity orexpression, sexual orientation,
criminal records and any otherinformation protected specifically by
the relevant applicable privacy laws.
SGS collects and processes
sensitive personal data only when it
is absolutely necessary and in either
one of the following circumstances:(i)

Explicit consent to use the 		sensitive data has been givenby the individual(ii) The use of the sensitive
personal data is necessary
for SGS to comply with
employment laws, otherstatutory obligations such as 		for the purposes of preventativeor occupational medicine, for theassessment of the working
capacity of an employee or 		to protect the vital interest 		of the specific individual (suchas in a medical emergency) or
any other circumstances
permitted by applicable data 		privacy laws(iii) SGS implements appropriate 		procedures and safeguards torestrict access to sensitive data
to only approved individuals, andprevent its unauthorized access,use and dissemination

Manage data responsibly& securely
Take appropriate security measures

We adhere to appropriate technicaland organizational security measures
to protect personal data.
SGS implements proper
security measures to ensure
the confidentiality, integrity andavailability of personal data and toprevent the risk of unauthorized
or unlawful access, alteration,destruction, or disclosure of suchdata. These protection measures
are based on impact assessmentsthat consider the risk to the specificindividual whose personal data is
to be stored by SGS into account.
These measures include it security
and organizational procedures thatare adapted to the data processing
type and the nature of the data
to be protected.
We notify affected individuals andlocal authorities in the event of
personal data breaches.
SGS promptly informs individualsof any privacy breach that hascompromised their personal data
and reports such incidents to therelevant authorities, when requiredby applicable laws.
We ensure that our suppliers andpartners also adopt appropriate andequivalent security measures.

Ensure adequate protection forinternational transfers
We take steps to ensure theprotection of personal data before
its transfer.
SGS transfers personal data acrossnational boundaries within the SGS
group or outside the SGS group only
when (i) this is justified for businesspurposes and (ii) safeguards exist
to ensure that personal data willcontinue to be protected with thesame level of protection requiredin the jurisdiction of origin as aminimum requirement.
Minimize risk impact toIndividuals
We conduct a data protection impact
assessment if the data processing
is likely to present a high risk toindividuals.
In order to eliminate or reducerisk, SGS conducts personal data
impact assessments to identify therisks that personal data processing
may cause to the privacy rights ofindividuals.
Personal data impact assessments
are integral to the developmentof new services or business
opportunities and acquisitions
by SGS.

SGS requires suppliers or subcontractors to fully comply with SGS
data privacy policy, applicable dataprotection and privacy laws, as wellas maintain appropriate technical andorganizational security measures
to secure the protection ofpersonal data.
We ensure that our employees
maintain the confidentiality inpersonal data processing.
SGS restricts access to personal
data to employees who are required
to perform specific tasks in relation
to such data.
Relevant awareness andconfidentiality training is in place
to ensure that personal data is notshared or disclosed to unauthorized
persons, including SGS employees
who do not require access topersonal data.

7© SGS Société Générale de Surveillance SA. (2023) SGS23-515

SGS.COM