Privacy Rules
for Customer,
Supplier andBusiness
Partner Data
Contact details
Philips Privacy Officec/o Philips International BV, Amstelplein 2, 1096 BC, the Netherlands.
E-mail: Philips_Privacy_Office@philips.com

The most recent online version of the Privacy Rules for Customer, Supplier and Business Partner
Data can be found here.

Page 1

Copyright© Koninklijke Philips Electronics N.V., 2012
Amsterdam, the Netherlands
All rights reserved. Reproduction in whole or in part is prohibitedwithout the written consent of the copyright owner.

Version history
Date

Updated sections

VersionFebruary 19, 2009

Initial version

1.0

May 6, 2009

Revised version

1.1

July 16, 2012

Final version

2.0

Page 2

Introduction
Philips General Business Principles express Philips commitment to strive to protect the Personal
Data of Philips Customers, Suppliers and Business Partners. These Rules indicate how thiscommitment shall be implemented. For the privacy rules applicable to Employee personal data,
refer to the Privacy Rules for Employee Data.

Article 1 – Scope, Applicability and Implementation
Scope

1.1

These Rules address the worldwide Processing of Personal Data
of Philips Customers, Suppliers and Business Partners by or on
behalf of Philips in its role as a Data Controller. These Rules do
not address the Processing of personal data of Philips Employees.

Electronic andpaper-based
Processing

1.2

These Rules apply to the Processing of Personal Data by electronicmeans and in systematically accessible paper-based filingsystems.

Applicability of
local law andthese Rules

1.3

Individuals keep any rights and remedies they may have underapplicable local law. Where these Rules provide more protection
than applicable local law or provide additional safeguards, rights
or remedies for Individuals, these Rules shall apply.

Sub-policies andnotices

1.4

Philips may supplement these Rules through sub-policies andnotices that are consistent with these Rules.

Compliance
Accountability

1.5

These Rules are binding on Philips. The Responsible Executive
shall be accountable for her business organization’s compliancewith these Rules. Philips Staff must comply with these Rules.

Effective date

1.6

These Rules enter into force as of August 17, 2012 (EffectiveDate). They are published on the General Business Principles
Internet site.

Rules supersede
prior policies

1.7

These Rules supersede all Philips privacy policies and notices thatexist on the Effective Date to the extent they address the same
issues or conflict with the provisions of these Rules.

Implementation

1.8

These Rules shall be implemented within Philips based on thetimeframes specified in Article 22.

Role of Philips
International

1.9

KPENV has tasked Philips International with the coordination andimplementation of these Rules.

Page 3

Privacy Officer
Advice1.10 Where there is a question as to the applicability of these Rules,
Staff shall seek the advice of the appropriate Privacy Officer prior
to the relevant Processing.

Article 2 – Purposes for Processing Personal Data
Legitimate
Business
Purposes

2.1

Personal Data shall be collected, used, transferred or otherwise
Processed for one or more of the following purposes (Business
Purposes):(i) Legitimate purposes as appropriate to Philips business.
This addresses Processing necessary for activities such as:(a) conclusion and execution of agreements with Customers,
Suppliers and Business Partners;(b) to record and financially settle delivered services,
products and materials to and from Philips;(c) marketing, sales, and promotions;(d) account management;(e) customer service;(f) finance and accounting;(g) research and development;(h) purchasing;(i) internal management and control;(j) investor relations;(k) external communications;(l) government and legal affairs;(m) alliances, ventures, mergers, acquisitions, anddivestitures; or(n) intellectual property and standards management;(ii) Business process execution and internal management.
This addresses Processing necessary for activities such as
managing company assets, conducting internal audits andinvestigations, and implementing business controls;(iii) Health, safety and security. This addresses Processing
necessary for activities such as those involving safety andhealth, the protection of Philips and Staff assets, and theauthentication of Customer, Supplier or Business Partner
status and access rights;(iv) Compliance with legal obligations. This addresses
Processing necessary for compliance with a legal obligation towhich Philips is subject; or(v) Vital interests. This addresses Processing necessary toprotect a vital interest of an individual.

Page 4

Consent

2.2

If none of the criteria listed in Article 2.1 applies, or if consent isrequired by applicable local law, Philips shall obtain consent fromthe individual before Processing her Personal Data. When seeking
consent, Philips shall inform the individual of:(i) the purposes of the Processing for which consent is requested;and(ii) any other relevant details to seek to ensure fair Processing.
If the Processing is reasonably necessary to address a request of
the individual (e.g., she subscribes to a service or seeks a benefit),
the individual’s consent is implied.

Denial orwithdrawal ofconsent

2.3

The individual may deny or withdraw consent at any time.
Processing will be discontinued unless Philips has taken action that
relies upon the previously provided consent. In such case Philips
will discontinue processing as soon as reasonably practical.

Article 3 – Use for Other Purposes
Processing of
3.1
Personal Data for
SecondaryPurposes

Generally, Personal Data shall be Processed only for the purposes
for which they were originally collected (Original Purpose).
Personal Data may be Processed for a legitimate Business Purposeof Philips different from the Original Purpose (Secondary
Purpose) only if the Original Purpose and Secondary Purpose areclosely related.
If there is a potential for harm to the individual as a result of theProcessing of her Personal Data for a closely-related Secondary
Purpose, additional measures such as one or more of the following
may be required:(i) limiting access to the Personal Data;(ii) implementing additional confidentiality and security controls;(iii) informing the individual about the Secondary Purpose;(iv) providing an opt-out opportunity; or(v) obtaining individual consent in accordance with Article 2.2.
If Personal Data are Processed for a Secondary Purpose that is not
closely related to the Original Purpose items (iv) and (v) need inany event be complied with.

Page 5

Generally
3.2
permitted uses of
Personal Data for
SecondaryPurposes

It is generally permissible to Process Personal Data for one or moreof the following Secondary Purposes provided appropriate
additional measures are taken in accordance with Article 3.1:(i) transferring the Personal Data to an Archive;(ii) conducting internal audits or investigations;(iii) implementing business controls;(iv) conducting statistical, historical or scientific research as
required for the business operations of Philips;(v) preparing for or engaging in dispute resolution;(vi) using legal or business consulting services; or(vii) managing insurance issues.

Consultation
Privacy Officer

Before Processing Personal Data for a Secondary Purpose Staff
shall seek the advice of the appropriate Privacy Officer.

3.3

Article 4 – Purposes for Processing Sensitive Data
Purposes for
Processing
Sensitive Data

4.1

This Article sets forth specific rules for Processing Sensitive Data.
Philips shall Process Sensitive Data only to the extent necessary toserve the applicable Business Purpose. Sensitive Data may be
Processed under one or more of the following circumstances:(i) where the individual has explicitly consented to theProcessing (“opt-in”);(ii) where providing services to the individual;(iii) where Sensitive Data are Processed in connection with thepurchase or use by an individual of a Philips product orservice;(iv) where the individual is voluntarily participating in a research
project or product test;(v) as required by or allowed under applicable local law;(vi) to establish, exercise or defend a legal claim;(vii) with regard to racial or ethnic data: to safeguard Philips' or its
Employees' assets, for site access and security reasons, andfor the authentication of Customer, Supplier or Business
Partner status and access rights, Philips may process photos
and video images (in some countries photo and video imagesof Individuals qualify as racial or ethnic data);(viii) to prevent, detect or prosecute (including cooperating withpublic authorities) suspected fraud, contract breaches,
violations of law, or other breaches of the terms of access toPhilips sites or assets;(ix) to protect a vital interest of an individual, but only where it is
impossible to obtain the individual’s consent first; or(x) where necessary to comply with an obligation of international
public law (e.g. treaties).

Page 6

Denial orwithdrawal ofconsent

4.2

The information requirements of Article 2.2 and Article 2.3 also
apply to the granting, denial or withdrawal of consent.

Prior
Authorization of
Senior Privacy
Officer

4.3

Where Sensitive Data are Processed based on a requirement of law
other than the local law applicable to the Processing, or based on
the consent of the individual, the Processing requires either (i) theprior approval of the appropriate Senior Privacy Officer or (ii) a
privacy sub-policy governing the Processing.

Use of Sensitive
Data for
SecondaryPurposes

4.4

Sensitive Data may be Processed for Secondary Purposes only inaccordance with Article 3.

Article 5 – Quantity and Quality of Personal Data
No excessive data 5.1

Philips shall restrict the Processing of Personal Data to those datathat are reasonably adequate for and relevant to the applicable
Business Purpose. Philips shall take reasonable steps to securely
delete or destroy Personal Data that are not required for theapplicable Business Purpose.

Retention
period

5.2

Philips generally shall retain Personal Data only:(i) for the period required to serve the applicable Business
Purpose;(ii) to the extent reasonably necessary to comply with anapplicable legal requirement; or(iii) as advisable in light of an applicable statute of limitations.
Philips may specify (e.g., in a sub-policy, notice or records
retention schedule) a time period for which certain categories
of Personal Data will be kept.

End of retention
period

5.3

Promptly after the applicable retention period has ended, theResponsible Executive shall direct that the Personal Data be:(i) securely deleted or destroyed;(ii) de-identified; or(iii) transferred to an Archive (unless this is prohibited byapplicable local law or an applicable records retention
schedule).

Quality of
Personal Data

5.4

Personal Data should be accurate, complete and kept up-to-date to
the extent reasonably necessary for the applicable Business
Purpose.

Page 7

Informing
Philips

5.5

It is the responsibility of the individual to inform Philips if her
Personal Data are inaccurate, incomplete or outdated and Philips
shall rectify the data in accordance with Article 7.

Article 6 – Informing the individual
Information to
6.1
the individual foreach Processing

Philips shall inform the individual through a published privacy
notice about:(i) the Business Purposes for which Personal Data are Processed;(ii) which Philips Group Company is responsible for theProcessing; and(iii) other relevant information (e.g., the nature and categories of
the Processed Personal Data, the categories of Third Parties
to which the Personal Data are disclosed, if any, and how theindividual can exercise her rights).

Personal Data not 6.2
obtained from theindividual

To the extent required by applicable law, where Personal Data
have not been obtained directly from the individual, Philips shallprovide the individual with information as required by Article 6.1
no later than the time the Personal Data are recorded in a Philips
database.

Exceptions

The requirements of Article 6.2 may be set aside if:(i) it is impossible or would involve a disproportionate effort toinform the individual; or(ii) such provision of information would result in
disproportionate cost.

6.3

Article 7 – Rights of individuals
Rights ofindividuals

7.1

Individuals have the right to request an overview of their Personal
Data Processed by or on behalf of Philips. Where reasonably
possible, the overview shall contain information regarding thesource (if reasonably available), type, purpose and categories ofrecipients of the relevant Personal Data.
If the Personal Data are incorrect, incomplete or not Processed incompliance with applicable law or these Rules, the individual has
the right to have her Personal Data rectified, deleted or blocked(as appropriate).
The individual has the right to object to the Processing of her
Personal Data on the basis of compelling grounds related to herparticular situation.

Page 8

Procedure

7.2

To access, rectify, delete, or block Personal Data or to object to theProcessing, the individual should send her request or objection to
the contact person or contact point indicated in the relevant
privacy notice. If no contact person or contact point is indicated,
the individual may send her request or objection to Philips
through the contact section of the relevant Philips website, or she
may contact the appropriate Privacy Officer.
Prior to fulfilling the request of the individual, Philips may require
the individual to:(i) specify the type of Personal Data in question;(ii) specify, to the extent reasonably possible, the data system inwhich the Personal Data likely are stored;(iii) specify the circumstances in which Philips obtained the
Personal Data;(iv) show proof of her identity; and(v) in the case of rectification, deletion, or blockage, specify thereasons why the Personal Data are incorrect, incomplete or
not Processed in accordance with applicable law or the Rules.

Response period

7.3

Within four weeks of Philips receiving the request or theobjection, the Responsible Executive shall inform the individual inwriting either (i) of Philips position with regard to the request or
the objection and any action Philips has taken or will take inresponse or (ii) the ultimate date on which she will be informed ofPhilips position, which date shall be no later than eight weeks
thereafter.

Complaint

7.4

An individual may file a complaint in accordance with Article 17.3
if:(i) the response to the request or the objection is unsatisfactory
to the individual (e.g., the request is denied); or(ii) the individual has not received a response as required by
Article 7.3.

Page 9Denial of requests 7.5

Philips may deny an individual’s request or objection if:(i) the request or objection does not meet the requirements ofArticles 7.1 and 7.2;(ii) the request or objection is not sufficiently specific;(iii) the identity of the relevant individual cannot be establishedby reasonable means; or(iv) the request or objection is made within an unreasonable timeinterval of a prior request or objection or otherwise; orconstitutes an abuse of rights, for instance because of its
repetitive character. A time interval between requests of six
months or less shall generally be deemed to be an
unreasonable time interval.
Before denying a request or objection, Staff shall seek the adviceof the appropriate Privacy Officer.

Article 8 – Security Requirements
Data security

8.1

Philips shall take appropriate commercially reasonable technical,
physical and organizational measures to protect Personal Data
from misuse or accidental, unlawful or unauthorized destruction,
loss, alteration, disclosure, acquisition or access.

Staff access

8.2

Staff shall be provided access to Personal Data only to the extent
necessary to serve the applicable Business Purpose and to
perform their job.

Confidentiality
obligations

8.3

Staff who access Personal Data shall meet their confidentiality
obligations as specified by contract, Philips General Business
Principles and derived Philips Directives and Policies.

Article 9 – Direct Marketing
Consent for direct 9.1
marketing

To the extent required by applicable law, when Processing
Personal Data for the purpose of making direct marketing
communications, Philips will either:(i) obtain the prior affirmative consent (“opt-in”) of the targetedindividual; or(ii) offer the individual the opportunity to choose not to receive
such communications (“opt-out”).
In every subsequent direct marketing communication that is madeto the individual, the individual shall be offered the opportunity to
opt-out of further marketing communication.

Page 10

Objection tomarketing

9.2

If the individual objects to receiving marketing communications
from Philips, or withdraws her consent to receive such materials,
Philips will take steps to refrain from sending further marketing
materials as specifically requested by the individual. Philips will
do so within the time period required by applicable law.

Article 10 – Automated Decision Making
Automateddecisions10.1 Automated tools may be used to make decisions about individuals
but decisions may not be based solely on the results provided by
the automated tool. This restriction does not apply if:(i) the use of automated tools is required or authorized by law;or(ii) the decision is made by Philips for purposes of entering intoor performing a contract provided that(a) the underlying request leading to a decision by Philips
was made by the individual (e.g., where automated tools
are used to qualify contest entries or Process requests
from Customers); or(b) suitable measures are taken to safeguard the legitimate
interests of the individual (e.g., the individual has been
provided with an opportunity to express her point ofview).

Article 11 – Transfer of Personal Data to Third Parties
Transfer toThird Parties

11.1

This Article sets forth requirements concerning the transfer of
Personal Data from Philips to a Third Party. Note that a transfer of
Personal Data includes situations in which(i) Philips discloses Personal Data to Third Parties (e.g., in thecontext of corporate due diligence); or(ii) Philips provides remote access to Personal Data to a Third
Party.

Third Party
11.2
Data
Controllers andThird Party
Data Processors

There are two categories of Third Parties:(i) Third Party Data Processors: these are Third Parties that
Process Personal Data solely on behalf of Philips and at its
direction (e.g., Third Parties that Process Customer
registration data on behalf of Philips); and(ii) Third Party Data Controllers: these are Third Parties that
Process Personal Data and determine the purposes andmeans of the Processing (e.g., Philips business partners thatprovide their own goods or services to Customers).

Page 11

Transfer for
applicable
Business
Purposes only

11.3

Philips shall transfer Personal Data to a Third Party only asnecessary to serve the Business Purpose for which the Personal
Data are Processed (including Secondary Purposes as per Article 3
or purposes for which the individual has provided consent inaccordance with Article 2).

Third Party
11.4
Data Controller
contracts

Third Party Data Controllers (other than public authorities) may
Process Personal Data obtained in connection with theirrelationship with Philips only if they have a written contract with
Philips. As appropriate, Philips shall seek to contractually protect
the data privacy interests of impacted individuals. All suchcontracts shall be drafted in consultation with the appropriate
Privacy Officer.
Business Contact Information may be transferred to a Third Party
Data Controller without a contract if it is reasonably expected thatsuch information will be used by the Third Party Data Controller tocontact the individual for legitimate business purposes related tosuch individual’s job responsibilities. However, Philips shall nottransfer, sell, lease, or rent Business Contact Information in bulk toa Third Party Data Controller without consent except as permitted
or required under applicable law and to the extent such transfer,sale, lease, or rent serves a legitimate Business Purpose (perArticle 2.1).

Page 12

Third Party
Data Processor
contracts

11.5

Third Party Data Processors may Process Personal Data only if theThird Party Data Processor has a written contract with Philips.
The contract shall include provisions addressing the following:(i) the Third Party Data Processor shall Process Personal Data
only in accordance with Philips instructions and for the
purposes authorized by Philips;(ii) the Third Party Data Processor shall keep the Personal Data
confidential;(iii) the Third Party Data Processor shall take appropriatetechnical, physical and organizational security measures toprotect the Personal Data; and(iv) the Third Party Data Processor shall not permit
subcontractors to Process Personal Data in connection with
its obligations to Philips without the prior written consent ofPhilips.
Furthermore, contracts with Third Party Data Processors shall
include, as appropriate, provisions addressing the following:(v) Philips has the right to review the security measures taken by
the Third Party Data Processor and the Third Party Data
Processor shall submit its relevant data processing facilities
to audits and inspections by Philips or any relevant
government authority; and(vi) the Third Party Data Processor shall promptly inform Philipsof any Information Security Incident involving Personal Data.
All such contracts shall be drafted in consultation with theappropriate Privacy Officer.

Page 13

Transfer of
Personal Data
to a NonAdequate
Country

11.6

This Article sets forth additional rules for the transfer of Personal
Data to a Third Party located in a country that is not considered toprovide an ‘adequate level of protection’ for Personal Data (NonAdequate Country).
Personal Data may be transferred to a Third Party located in a
Non-Adequate Country only if:(i) a contract has been concluded between Philips and therelevant Third Party that provides for safeguards at a similarlevel of protection as that provided by these Rules; thecontract shall conform to any model contract required underapplicable local law (if any);(ii) the Third Party has been certified under the United States
Safe Harbor Program or any other similar program that isrecognized as providing an ‘adequate’ level of data protection;(iii) the Third Party has implemented binding corporate rules or asimilar transfer control mechanism which provide adequate
safeguards as required under applicable law;(iv) the transfer is necessary for the performance of a contract
with the Customer, Supplier or Business Partner or to takenecessary steps at the request of the Customer, Supplier or
Business Partner prior to entering into a contract;(v) the transfer is necessary for the conclusion or performance ofa contract concluded in the interest of the individual between
Philips and a Third Party (e.g. in case of recalls);(iv) the transfer is necessary to protect a vital interest of theindividual;(v) the transfer is necessary for the establishment, exercise or
defense of a legal claim;(viii)the transfer is necessary to satisfy a pressing need to protect
the public interests of a democratic society;(ix)the transfer is required by any law to which the relevant
Philips Group Company is subject; or(x) the individual has consented to such transfer.
To the extent permitted by law, items (viii), (ix) and (x) above
require the prior approval of the Chief Privacy Officer, who willconsult the Chief Legal Officer prior to giving her approval. The
Chief Legal Officer may delegate this responsibility to anotherexecutive within the Philips legal function.

Page 14

Consent fortransfer

11.7

When seeking consent pursuant to Article 11.6 (x), the individual
shall be first provided with the following information:(i) the purpose of the transfer;(ii) the identity of the transferring Group Company;(iii) the identity or categories of Third Parties to which the
Personal Data will be transferred;(iv) the categories of Personal Data that will be transferred;(v) the country to which the Personal Data will be transferred;and(vi) the fact that the Personal Data will be transferred to a NonAdequate Country.
Article 2.3 applies to denial or withdrawal of consent.

Transfers
between NonAdequate
Countries

11.8

This Article sets forth rules for transfers of Personal Data thatwere collected in connection with the activities of a Philips Group
Company located in a Non-Adequate Country to a Third Party also
located in a Non-Adequate Country. In addition to the grounds
listed in Article 11.6, these transfers are permitted if they are:(i) necessary for compliance with a legal obligation to which therelevant Philips Group Company is subject;(ii) necessary to serve the public interest; or(iii) necessary to satisfy a Business Purpose of Philips.

Article 12 – Overriding Interests
Overriding
Interests

12.1

Some of the obligations of Philips or rights of individuals underthese Rules may be overridden if, under the specific circumstances
at issue, a pressing legitimate need exists that outweighs theinterest of the individual (Overriding Interest). An Overriding
Interest exists if there is a need to:(i) protect the legitimate business interests of Philips including:(a) the health, security or safety of individuals;(b) Philips intellectual property rights, trade secrets or
reputation;(c) the continuity of Philips business operations;(d) the preservation of confidentiality in a proposed sale,merger or acquisition of a business; or(e) the involvement of trusted advisors or consultants forbusiness, legal, tax, or insurance purposes.
(ii) prevent or investigate suspected or actual violations of (a)law (including cooperating with law enforcement), (b)contracts, or (c) or Philips policies; or(iii) otherwise protect or defend the rights or freedoms of Philips,
its Staff or other persons.

Page 15

Exceptions in
the event ofOverriding
Interests

12.2

If an Overriding Interest exists, one or more of the following
obligations of Philips or rights of the individual may be set aside:(i) Article 3.1 (Use of Personal Data for Secondary Purposes);(ii) Article 6.1 (Information to the individual);(iii) Article 7.1 (Rights of individuals);(iv) Article 8 (Data Security); and(v) Articles 11.4, 11.5 and 11.6 (i) (Third Party Data Controller
contracts, Third Party Data Processor contracts, Transfer of
Personal Data to a Non-Adequate Country).

Sensitive Data

12.3

The requirements of Article 4.1 (Sensitive Data) may be set aside
only for the Overriding Interests listed in this Article 12.1(i)(a), (c)and (e), (ii) and (iii).

Consultation
with Senior
Privacy Officer

12.4

Setting aside obligations of Philips or rights of individuals basedon an Overriding Interest requires the prior consultation of theappropriate Senior Privacy Officer.

Information to
the individual

12.5

Upon request of the individual, Philips shall inform the individualof the Overriding Interest that led to the setting aside of Philips
obligations or the rights of the individual, unless the particular
Overriding Interest sets aside the requirements of Articles 6.2 or
7.2, in which case the request shall be denied.

Article 13 – Supervision and compliance
Chief Privacy
Officer

13.1 Philips International. shall appoint a Chief Privacy Officer who is
responsible for:(i) supervising compliance with these Rules;(ii) providing periodic reports, as appropriate, to the Chief Legal
Officer on data protection risks and compliance issues; and(iii) coordinating, in conjunction with the appropriate Senior
Privacy Officers, official investigations or inquiries into theProcessing of Personal Data by a public authority.

Page 16

Philips Privacy
Council13.2 The Chief Privacy Officer shall establish an advisory Privacy
Council. The Privacy Council shall create and maintain a One
Philips framework for:(i) the development of the policies, procedures and system
information (as required by Article 14);(ii) planning training and awareness programs;(iii) monitoring and reporting on compliance with these Rules;(iv) collecting, investigating and resolving privacy inquiries,
concerns and complaints; and(v) determining and updating appropriate sanctions forviolations of these Rules (e.g., disciplinary standards).

Page 17

Senior Privacy
Officers

13.3 All of the Sector Privacy Officers, Country Privacy Officers, Region
Privacy Officers and Function Privacy Officers are considered
Senior Privacy Officers. Senior Privacy Officers will be designatedas follows: each Sector shall designate a Sector Privacy Officer;
 each Country shall designate a Country Privacy Officer,
unless the Chief Privacy Officer determines that certain
Countries will be grouped into a Region, in which case theRegion will designate a Region Privacy Officer; the Chief Privacy Officer shall determine for which Functions
a Function Privacy Officer is appropriate, after which therespective Function shall designate a Function Privacy
Officer; the Chief Privacy Officer shall act as the Senior Privacy
Officer for those Functions for which no Function Privacy
Officer is designated; and all Senior Privacy Officers shall be published on the Philips
intranetsite (pww.privacy.philips.com).
The Senior Privacy Officers may, in turn, establish a network ofqualified Privacy Officers sufficient to direct compliance with theseRules within their respective organizations. All Privacy Officers
shall be published in the relevant and applicable privacy notices.
The Senior Privacy Officers shall perform at least the following
tasks:(i) regularly advise their respective executive teams and theChief Privacy Officer on privacy risks and compliance issues;(ii) maintain (or ensure access to) an inventory of the system
information (as required by Article 14.2);(iii) implement the privacy compliance framework as required by
the Chief Privacy Officer;(iv) be available for requests for privacy approvals or advice anddirect the requests to the appropriate Privacy Officer(s) (i.e.,
Privacy Officer(s) whose organizations are impacted by theapproval or advice);(v) own and authorize all appropriate privacy sub-policies intheir organizations; and(vi) cooperate with the Chief Privacy Officer, other Senior Privacy
Officers, the Privacy Officers, and the General Business
Principles Compliance Officers.

Page 18

Responsible
Executive

13.4 The Responsible Executive shall perform at least the following
tasks:(i) ensure that the policies and procedures are implemented andthe system information is maintained (as required by Article
14);(ii) provide such system information to the Senior Privacy
Officers necessary as required for her to comply with the task
listed in Article 13.3 sub (ii);(iii) inform the individual in writing (as required by Article 7.4);(iv) direct that Personal Data are securely deleted or destroyed,
de-identified or transferred to an Archive promptly after theend of the retention period (as required by Article 5.3);(v) determine how to comply with the Rules when there is a
conflict with applicable law (as required by Article 20.2); and(vi) inform the appropriate Senior Privacy Officers of any newlegal requirement that may interfere with Philips ability tocomply with these Rules (as required by Article 20.3).

Default Privacy
Officer

13.5 If no Senior Privacy Officer has been designated in a Sector,
Function, Country or Region, the designated compliance officer for
the Philips General Business Principles for the relevant Group
Company is responsible for supervising compliance with theseRules.

Privacy Officers
with statutory
position13.6 Where a Privacy Officer holds her position pursuant to law, sheshall carry out her job responsibilities to the extent they do notconflict with her statutory position.

Article 14 – Policies and procedures
Policies andprocedures

14.1 Philips shall develop and implement policies and procedures tocomply with these Rules.

Systeminformation

14.2 Philips shall maintain readily available information regarding thestructure and functioning of all systems and processes that Process
Personal Data (e.g. inventory of systems and processes, privacy
impact assessments).

Article 15 – Training
Staff training

15.1 Philips shall provide training on these Rules and other privacy
and data security obligations to Staff who have access to or
responsibilities associated with managing Personal Data.

Page 19

Article 16 – Monitoring compliance
Audits

16.1 Philips Internal Audit shall audit business processes andprocedures that involve the Processing of Personal Data forcompliance with these Rules. The audits shall be carried out in thecourse of the regular activities of Philips Internal Audit or at therequest of the Chief or a Senior Privacy Officer. The Chief Privacy
Officer may request to have an audit as specified in this Article
conducted by an external auditor. Applicable professional
standards of independence, integrity and confidentiality shall beobserved when conducting an audit. The Chief Privacy Officer andthe appropriate Senior Privacy Officers shall be informed of theresults of the audits. Reported violations of the Rules will bereported back to senior management. A copy of the audit results
will be provided to the Dutch Data Protection Authority uponrequest.

Annual Report

16.2 The Chief Privacy Officer shall produce an annual Customer,
Supplier and Business Partner privacy report for the Chief Legal
Officer on compliance with these Rules and other relevant issues.
Each Senior Privacy Officer shall provide information relevant tothe annual privacy report to the Chief Privacy Officer.

Mitigation

16.3 Philips shall, if so indicated, ensure that adequate steps are taken toaddress breaches of these Rules identified during the monitoring or
auditing of compliance pursuant to this Article 16.

Article 17 – Complaint procedure
Complaint toPrivacy Officer

17.1

Individuals may file a complaint regarding compliance with theseRules:(i) in accordance with the complaint procedure set forth in therelevant privacy policy or contract; or(ii) with the appropriate Privacy Officer who, in turn, shall(a) notify the appropriate Senior Privacy Officers who shallinitiate an investigation;(b) when necessary, advise the organization on theappropriate measures for compliance; and(c) when measures are undertaken, monitor the steps
designed to achieve compliance until all compliancemeasures are completed.
The appropriate Senior Privacy Officers may consult with any
government authority having jurisdiction over a particular matter
about the measures to be taken.
Page 20

Reply to theindividual

17.2

Within four weeks of Philips receiving a complaint, theappropriate Senior Privacy Officer shall inform the individual inwriting either:(i) of Philips position with regard to the complaint and any
action Philips has taken or will take in response; or(ii) the ultimate date on which she will be informed of Philips
position, which date shall be no later than twelve weeks
thereafter.
The appropriate Senior Privacy Officer shall send a copy of thecomplaint and any written reply to the Chief Privacy Officer.

Complaint toChief Privacy
Officer

17.3

An individual may file a complaint with the Chief Privacy Officer if:(i) the resolution of the complaint by the appropriate Senior
Privacy Officer is unsatisfactory to the individual (e.g., thecomplaint is rejected);(ii) the individual has not received a response as required by
Article 17.2; or(iii) the time period provided to the individual pursuant to
Article 17.2 is, in light of the relevant circumstances,
unreasonably long and the individual has objected but has
not been provided with a shorter, more reasonable time
period in which she will receive a response.

Appeals to
17.4
responses fromthe Chief Privacy
Officer

The procedure described in Articles 17.1 through 17.3 shall apply
to complaints filed with the Chief Privacy Officer. Appeals to
responses from the Chief Privacy Officer should be directed to theChief Legal Officer if at least one of the conditions of 17.3(i),17.3(ii), or 17.3(iii) is satisfied.

Article 18 – Legal issues
Local law andjurisdiction

18.1 Any Processing by Philips of Personal Data shall remain to be
governed by applicable local law. Individuals keep any rights andremedies they may have under applicable local law. Local publicauthorities having jurisdiction over the relevant matters maintaintheir authority.

Page 21

Specific
provision when
Data Protection
Authorities in
EEA havejurisdiction
under local law

18.2 If a Data Protection Authority of one of the EEA countries has
jurisdiction under its applicable data protection law to evaluate
data transfers by a Group Company established in its country, such
Data Protection Authority may evaluate these data transfers also
against these Rules. The Dutch Data Protection Authority will
provide cooperation and assistance where required, including
providing audit reports available with the Dutch Data Protection
Authority insofar as relevant to evaluate the aforementioned datatransfers against these Rules.

Protection
provided by theRules

18.3 Where these Rules provide more protection than applicable local
law or provide additional safeguards, rights or remedies for
Individuals, these Rules shall apply.

Lead Authority 18.4 Except in case of jurisdiction of a Data Protection Authority of one
for supervisionof the EEA countries pursuant to Article 18.2, compliance withand enforcement
these Rules shall be exclusively supervised by the Dutch Dataof RulesProtection Authority (College Bescherming Persoonsgegevens) in
The Netherlands, which is also exclusively authorized to advise
Philips International on the application of these Rules at all times.
The Dutch Data Protection Authority shall have investigative
powers based on the Dutch Data Protection Act (Wet bescherming
persoonsgegevens). To the extent the Dutch Data Protection
Authority has discretionary powers related to enforcement of the
Dutch Data Protection Act, it shall have similar discretionary
powers for enforcement of these Rules.

Exclusivejurisdiction
to hearcomplaints andclaims under
Rules

18.5 Complaints and claims shall be admissible only if the individual has
first followed the complaint procedure set forth in Article 17 ofthese Rules. Any complaints or claims of an individual concerning
any right the individual may have under these Rules shall bedirected to Philips International only and shall exclusively be
brought before the Dutch Data Protection Authority in The
Netherlands (except in case of jurisdiction of a Data Protection
Authority of one of the EEA countries pursuant to Article 18.2) orthe competent court in Amsterdam, The Netherlands.

Rules
enforceable
against Philips
International
only

18.6 Any additional safeguards, rights or remedies granted toindividuals under these Rules are granted by and enforceable in the
Netherlands against Philips International only. Philips
International shall, if so indicated, ensure that adequate steps aretaken to address violations of these Rules by a Group Company.

Page 22

Available
18.7 Under these Rules, individuals shall only be entitled to remedies
remedies,
available to data subjects under the Dutch Data Protection Act, thelimitation of
Dutch Civil Code and the Dutch Code on Civil Procedure, which
damages, burden
shall include the right to damages. However, Philips Internationalof proof re.
shall be liable only for direct damages (which, excludes, without
damages
limitation, lost profits or revenue, lost turnover, cost of capital, anddowntime cost) suffered by an individual resulting from a violationof these Rules.
Regarding the burden of proof in respect of damages, it will be forthe individual to demonstrate that he has suffered damage and toestablish facts which show it is plausible that the damage has
occurred because of a violation of these Rules. It will subsequently
be for Philips International to prove that the damages suffered by
the individual due to a violation of these Rules are not attributable
to the relevant Group Company.

Mutual18.9 All Group Companies shall cooperate and assist each other to theassistance Groupextent reasonably possible to handle issues including:Companies and(i) a request, complaint or claim made by an individual; orredress(ii) an investigation or inquiry by a public authority.
The Philips organization (e.g., Royal Philips, a Group Company)
receiving the individual’s request, complaint or claim is responsible
for handling any communication with the individual regarding her
request, complaint or claim except where circumstances dictate
otherwise and as mutually agreed among Senior Privacy Officers
relevant to the specific issue.
The Group Company that is responsible for the Processing to which
the request, complaint or claim relates, shall bear all costs involved
and reimburse Philips International.

Article 19– Sanctions for non-complianceNon-compliance 19.1 Non-compliance of Philips employees with these Rules may resultin disciplinary action up to and including termination of
employment.

Page 23

Article 20– Conflicts between the Rules and applicable local law
Conflict of law
whentransferring
Personal Data

20.1 Where a legal requirement to transfer Personal Data conflicts withthe laws of the Member States of the EEA or other countries withlegal requirements regarding cross-border data transfer, any
relevant Personal Data transfer requires the prior approval of the
Chief Legal Officer. The Chief Legal Officer shall seek the advice of
the appropriate Senior Privacy Officers. The Senior Privacy Officers
may seek the advice of the Dutch Data Protection Authority or
another competent public authority.

Conflict between 20.2 In all other cases, where there is a conflict between applicable local
Rules and law
law and the Rules, the relevant Responsible Executive shall consult
with the appropriate Senior Privacy Officers and their legal
departments to determine how to comply with these Rules andresolve the conflict to the extent reasonably practicable given thelegal requirements applicable to the relevant Group Company.
New conflicting
legalrequirements

20.3 The relevant Responsible Executive, in consultation with her legal
department, shall promptly inform the appropriate Senior Privacy
Officers of any new legal requirement that may interfere with
Philips ability to comply with these Rules.

Article 21– Changes to the Rules
21.1 Any changes to these Rules require the prior approval of the Chief
Legal Officer.
21.2 Any amendment shall enter into force after it has been approved
and published on the Philips General Business Principles Internetsite.
21.3 Any request, complaint or claim of an individual involving theseRules shall be judged against the version of these Rules that is inforce at the time the request, complaint or claim is made.
21.4 The Chief Privacy Officer shall be responsible for informing therelevant government authorities of significant changes to theseRules on a yearly basis and coordinating their responses. The Chief
Privacy Officer shall inform the appropriate Philips Senior Privacy
Officers of the effect of these responses.

Page 24

Article 22 – Transition Periods
GeneralTransition
Period22.1 Except as indicated below, there shall be a two-year transition
period for compliance with these Rules starting on the Effective
Date. Accordingly, except as otherwise indicated, within two yearsof the Effective Date, all Processing of Personal Data that is subject
to these Rules shall be conducted in compliance with the Rules.
During any transition period, Philips shall strive to comply with theRules.

Transition
Period for New
Group
Companies

22.2 Any entity that becomes a Group Company after the Effective Dateshall comply with the Rules within two years of becoming a Group
Company.

Transition
22.3 A Divested Entity will remain covered by these Rules after its
period fordivestment for such period as may be required by Philips toDivested Entities
disentangle the Processing of Personal Data relating to such
Divested Entity.
Transition
Period for IT
Systems

22.4 Where implementation of these Rules requires updates or changes
to information technology systems (including replacement ofsystems), the transition period shall be four years from the
Effective Date or from the date an entity becomes a Group
Company, or any longer period as is reasonably necessary tocomplete the update, change or replacement process.

Transition
Period for
Existing
Agreements

22.5 Where there are existing agreements with Third Parties that are
affected by these Rules, the provisions of the agreements will
prevail until the agreements are renewed in the normal course ofbusiness.

Transition
22.6 Processing of Customer, Supplier or Business Partner Personal
Period for LocalData that were collected in connection with activities of a Philips
for-Local
Group Company located in a Non-Adequate Country shall be
Systemsbrought into compliance with these Rules within five years of theEffective Date.

Page 25

ANNEX 1

Definitions
Archive

ARCHIVE shall mean a collection of Personal Data that are no longer
necessary to achieve the purposes for which the Personal Data originallywere collected or that are no longer used for general business activities,
but are used only for historical, scientific or statistical purposes, dispute
resolution, investigations or general archiving purposes. An archive
includes any data set that is subject to appropriately enhanced security
and has restricted access (e.g., only by the system administrator andresponsible executive).

Business
Contact
Information

BUSINESS CONTACT INFORMATION shall mean personal information
typically found on a business card that is used by an individual in the
conduct of her employment.

Business
Partner

BUSINESS PARTNER shall mean any (a) individual or (b) individual
associated with an entity, other than a Customer or Supplier, which has
a business relationship or strategic alliance with Philips (such as a joint
marketing partner, joint venture or joint development partner).

Business
Purpose

BUSINESS PURPOSE shall mean a purpose for Processing Personal Dataas specified in Article 2 or 3 or for Processing Sensitive Data as specified
in Article 4.

Chief Legal Officer CHIEF LEGAL OFFICER shall mean the chief legal officer of KPENV.
Chief Privacy
Officer

CHIEF PRIVACY OFFICER shall mean the officer referred to in Article
13.1.

Country

COUNTRY shall mean each country in which a Group Company isestablished.

Country Privacy
Officer

COUNTRY PRIVACY OFFICER shall mean the Senior Privacy Officer
designated for a certain Country, in accordance with Article 13.3.

Customer

CUSTOMER shall mean any (a) individual or (b) individual associatedwith an entity, which purchases or may purchase a Philips product orservice.

Page 26

Data Controller

DATA CONTROLLER shall mean the entity or natural person which alone
or jointly with others determines the purposes and means of theProcessing of Personal Data.

Data Processor

DATA PROCESSOR shall mean the entity or natural person which
Processes Personal Data on behalf of the Data Controller.

Divested Entity

DIVESTED ENTITY shall mean the divestment by Philips of a Group
Company or business by means of:(a) a sale of shares as a result whereof the Group Company so divested
no longer qualifies as a Group Company and/or(b) a demerger, sale of assets, or any other manner or form.

EEA

EEA or EUROPEAN ECONOMIC AREA shall mean all Member States of
the European Union, plus Norway, Iceland and Liechtenstein.

Effective Date

EFFECTIVE DATE shall mean the date on which these Rules become
effective as set forth in Article 1.5.

Employee

EMPLOYEE shall mean an employee, job applicant or former employee
of Philips.

EU Data
Protection
Directive

EU DATA PROTECTION DIRECTIVE shall mean the Directive 95/46/EC
of the European Parliament and of the Council of 24 October 1995 on
the protection of individuals with regard to the processing of personal
data and on the free movement of such data.

ExportingGroup Company

EXPORTING GROUP COMPANY shall mean the Group Company locatedwithin the EEA that transfers Personal Data to a Group Company locatedin a Non-Adequate Country.

Function

FUNCTION shall mean a corporate department organized within Philips
International (e.g. Corporate HRM, Corporate IT, Corporate Finance,
Corporate Legal).

Function Privacy
Officer

FUNCTION PRIVACY OFFICER shall mean the Senior Privacy Officer
designated for a certain Function, in accordance with Article 13.3.

Page 27

GroupCompany

GROUP COMPANY shall mean KPENV and any company or legal entity ofwhich KPENV, directly or indirectly owns more than 50% of the issued
share capital, has 50% or more of the voting power at general meetingsof shareholders, has the power to appoint a majority of the directors, orotherwise directs the activities of such other legal entity; however, anysuch company or legal entity shall be deemed a Group Company only (i)as long as a liaison and/or relationship exists, and (ii) as long as it iscovered by the Philips General Business Principles.

ImportingGroup Company

IMPORTING GROUP COMPANY shall mean a Group Company locatedwithin a Non-Adequate Country that receives Personal Data from an
Exporting Group Company.

Information
Security
Incident

INFORMATION SECURITY INCIDENT shall mean any actual or suspected
theft, or unauthorized Processing, loss, use, disclosure, or acquisition of,or access to, any data.

KPENV

KPENV shall mean Koninklijke Philips Electronics N.V., having its
registered seat in Eindhoven, The Netherlands.

Non-Adequate
Country

NON-ADEQUATE COUNTRY shall mean a country that under applicable
local law (such as Article 25 of the EU Data Protection Directive) isdeemed not to provide an “adequate” level of data protection.

Original
PurposeORIGINAL PURPOSE shall mean the purpose for which Personal Data
was originally collected.

Overriding
Interest

OVERRIDING INTEREST shall mean a pressing legitimate need that
under specific circumstances outweighs the interest of the individual.

Personal DataPERSONAL DATA shall mean any information relating to an identified or
identifiable individual where the individual is associated with a Philips
Customer, Supplier or Business Partner.

Philips

PHILIPS shall mean KPENV and its Group Companies.

Philips
International

PHILIPS INTERNATIONAL shall mean Philips International B.V., having
its registered seat in Eindhoven, The Netherlands.

Philips Privacy
Council

PHILIPS PRIVACY COUNCIL shall mean the council referred to in Article
13.2.

Page 28

Privacy Officer

PRIVACY OFFICER shall mean the privacy officers appointed by the
Senior Privacy Officers pursuant to Article 13.3.

Processing

PROCESSING shall mean any operation that is performed on Personal
Data, whether or not by automatic means, such as collection, recording,storage, organization, alteration, use, disclosure (including the grantingof remote access), transmission or deletion of Personal Data.

RegionREGION shall mean a particular geographic area in which certain
Countries are grouped.

Region Privacy
Officer

REGION PRIVACY OFFICER shall mean the Senior Privacy Officer
designated for a certain Region, in accordance with Article 13.3.

Responsible
Executive

RESPONSIBLE EXECUTIVE shall mean the lowest-level Philips businessexecutive or the non-executive general manager of a Philips ORU(Organizational Reporting Unit) who has primary budgetary ownershipof the relevant Processing.

Rules

RULES shall mean the Privacy Rules for Customer, Supplier and Business
Partner Data.

SecondaryPurposeSECONDARY PURPOSE shall mean any purpose other than the Original
Purpose for which Personal Data is further Processed.

Sector

SECTOR shall mean a top-level product division that is globally served
by a specific Group Company, (e.g., Philips Healthcare, Philips Lighting,Philips Consumer Lifestyle).

Sector Privacy
Officer

SECTOR PRIVACY OFFICER shall mean the Senior Privacy Officer
designated for a certain Sector, in accordance with Article 13.3.

Senior Privacy
Officers

SENIOR PRIVACY OFFICERS shall mean the appropriate Sector Privacy
Officers, Function Privacy Officers, Country Privacy Officers, and/or
Region Privacy Officers.

Page 29

Sensitive Data

SENSITIVE DATA shall mean Personal Data that reveal an individual’s
racial or ethnic origin, political opinions or membership in politicalparties or similar organizations, religious or philosophical beliefs,
membership in a professional or trade organization or union, physical ormental health including any opinion thereof, disabilities, genetic code,
addictions, sex life, criminal offenses, criminal records, proceedings withregard to criminal or unlawful behavior, or social security numbers
issued by the government.

Staff

STAFF shall mean all Employees and other persons who Process
Personal Data as part of their respective duties or responsibilities using
Philips information technology systems or working primarily from
Philips premises.

Supplier

SUPPLIER shall mean any (a) individual or (b) individual associatedwith an entity, which provides goods or services to Philips (such as anagent, consultant or vendor).

Third Party

THIRD PARTY shall mean any person or entity (e.g., an organizations or
government authority) outside Philips.

Third Party
Data Controller

THIRD PARTY DATA CONTROLLER shall mean a Third Party that
Processes Personal Data and determines the purposes and means of theProcessing.

Third Party Data
Processor

THIRD PARTY DATA PROCESSOR shall mean a Third Party that
Processes Personal Data on behalf of Philips that is not under the direct
authority of Philips.

Interpretations
INTERPRETATION OF THESE RULES:
i. Unless the context requires otherwise, all references to a particular Article or Annex arereferences to that Article or Annex in or to this document, as they may be amended fromtime to time.
ii. Headings are included for convenience only and are not to be used in construing any
provision of these Rules.
iii. If a word or phrase is defined, its other grammatical forms have a corresponding
meaning.
iv. The female form shall include the male form.
v. The words “include,” “includes,” “including” and “e.g.”, and any words following themshall be construed without limitation to the generality of any preceding words orconcepts and vice versa andvi. A reference to a document (including, without limitation, a reference to these Rules) is tothe document as amended, varied, supplemented or replaced, except to the extent
prohibited by these Rules or that other document.
Page 30