Cognizant Privacy Notice
Last Updated: 31 December 2023
What is the purpose of this notice?
This Privacy Notice (“Notice”) outlines how Personal Information of clients, prospective
clients, former clients, visitors, vendors and other third parties we interact with("External Individuals") is collected, managed and Processed by Cognizant. Cognizant iscommitted to handling the Personal Information of all External Individuals in an
appropriate and lawful manner. This Notice sets out the minimum requirements for
ensuring that the Personal Information of External Individuals is collected, used,retained and disclosed in a secure and compliant manner.
What other rules or notices apply?
In some cases, local laws and regulations that apply to the Processing of Personal
Information may be more restrictive than this Notice. Where this is the case, the more
restrictive requirements will apply. Where required by local laws, Cognizant will provide
you with additional privacy notices or information. In addition, this Notice may besupplemented from time to time with more specific privacy information or notices, forexample when you visit a Cognizant website, attend an event or use particular Cognizant
apps or portals.
Contacts
Any questions, concerns or complaints about the operation of this Notice should be
addressed to your relevant client partner, account executive, business development
contact, procurement contact or Cognizant’s Data Protection Office (see Contact Us
section below). This Notice may be updated from time to time. You can find the most
up-to-date version of this Notice on our website at www.cognizant.com.
Who is this notice directed to?
This Notice applies between you, as an External Individual, and the Cognizant company thatyou interact or engage with or that communicates with you in relation to services or solutions
provided by Cognizant, or the Cognizant company to whom you provide or wish to provide
your goods or services. If you are unsure as to which Cognizant company is applicable to you,please Contact Us (see Contact Us section below). This Notice applies to all External
Individuals with regards to your Personal Information. This Notice does not apply to Personal
Information belonging to Associates (as defined below) employed or contracted by Cognizant.
This Notice also does not apply to Personal Information Processed by Cognizant on behalf ofclients as part of Cognizant’s services.
What are we going to tell you in this notice?
How we collect and use your Personal Information
Why we need to collect your Personal Information
To whom we give your Personal Information
International transfer of your Personal Information
How we monitor your activities
How long we retain your Personal Information
How we protect your Personal Information
What are your rights?
Contact Us

Capitalized terms are defined at the end of this Notice, in the Definitions section.
Cognizant Privacy NoticeHow we collect and use your Personal Information
Cognizant will only collect Personal Information relating to External Individuals to the extent
that it is required for a particular purpose or purposes, in the context of its business. Readabout the purposes in the next section “Why we need to collect your Personal Information”.
Cognizant may collect or Process, and has collected or Processed in the preceding year, any
or all of the following types of Personal Information about External Individuals as part of its
business activities:
Personal Information
Category

Examples of Personal Information we may collect within eachcategory include:

Identity information

Title, full name, photograph, gender, date of birth.
Employer details, job title, work address, phone number(s) andemail address(es), emergency contact details and number, social
media handles.
Languages and information that an External Individual volunteers
in their course of dealings with Cognizant, such as throughnetworking events (which could involve the disclosure of data
about religion to facilitate prayer room access, ethnicity or sexual
orientation).
Contact history, interactions and communications with Cognizant,events attended, Cognizant information and materials (e.g.,
whitepapers) provided, contact preferences.
Meal preferences, food allergies, access requirements forphysically challenged.
Communication and meeting dates, education and qualifications,references, professional experience, membership of professional
bodies, information about complaints and feedback.
Time and location of entry and exit to premises, access torestricted zones and security camera footage data related toaccess to and usage of office equipment and corporate assets
including fixed and mobile phones, computer systems, email andthe intranet/internet, location identifiers, multifunctional devices,cost recovery systems, document management systems, carservice pick up and drop off logs, contact management systems
and online databases.

Contact details

Personal details

Marketing information
Health information
Relationshipmanagement
information

Data related to use of
and access to facilities
and corporate assets

Background screening
information

Criminal history, political exposure.

We receive Personal Information about you directly from you via our websites and portals, at
events you attend and when we contact you via post, email or phone and through your usageof Cognizant systems (such as client and vendor onboarding processes and internallydeveloped applications). We may also receive Personal Information about you from othersources such as business networks and agencies, publicly available sources such as
LinkedIn, media outlets, referrals, from the company that employs you, our past clients andwhere we purchase marketing lists.
Personal Information of others provided by you. In certain situations, including visiting ouroffices, you may provide to us the Personal Information of others (e.g., your colleagues). It isyour responsibility to inform the nominated individual about the Processing of their Personal
Information for the described purposes and to confirm, if required by law, that they have given
their permission.

Back to top
Cognizant Privacy NoticeWhy we need to collect your Personal Information
PurposesCognizant uses External Individuals’ Personal Information for a variety of purposes. The mostcommon uses of Personal Information are:
•
•
•
•
•
•
•
•
•

Managing client requests, projects and bidding for work;
Marketing activities and market research;
Managing vendor relationships and invoicing and determining eligibility of vendors
including verification of references and qualifications and other background checks;
Managing client relationships;
Investigating complaints and issues;
Organizing meetings and networking events;
Business continuity management;
Security and compliance with law, including health and safety requirements; andDeveloping resource plans to meet business demands.

In order to comply with legal and regulatory obligations and to the extent permitted or requiredby local law, and specifically to ensure that we can comply with applicable trade control, antimoney laundering and/or anti-bribery and corruption laws, we may carry out backgroundscreening checks on current and prospective clients, vendors and business partners, both preand post contract. In addition to screening individuals and legal entities with whom we enter
contracts, this screening may cover individuals such as directors, officers, sole traders,shareholders and other key stakeholders. The screening utilizes publicly available information,
including government issued sanctions lists and media sources. The information obtained
through background screening may include Personal Information regarding suspected or
actual criminal behavior, criminal records or proceedings and unlawful behavior.

An extensive list of the purposes for which we may collect your Personal Information is set out
in the table below. Where Cognizant wishes to use Personal Information for a new purposethat has not been notified to the External Individual, where required by law, Cognizant will
notify the External Individual of the new purpose.

Legal Basis for Processing
Cognizant will Process Personal Information relating to External Individuals where it isrequired by law, necessary for the performance or administration of a contract, or where it hasa legitimate business interest in doing so. Cognizant will Process Sensitive Personal
Information where it is necessary for the purpose of carrying out a legal obligation or
exercising specific rights of Cognizant permitted by local law. Cognizant will obtain yourconsent to Process your Personal Information where it is required to do so by local law, andwhere required, for any new or additional purpose. Under local law, to the extent that
Processing is based on consent, External Individuals may be entitled to withdraw consent to
the Processing of their Personal Information. External Individuals who wish to withdraw
consent should follow the instructions received at the time of providing consent or contact us(see Contact Us section below).

Cognizant Privacy Notice

The primary legal basis of Processing is set out in the table below.
Purpose of Use
For vendor and client relationshipmanagement
Managing requests from clients including
Cognizant's bids for work, conducting such
work, invoicing clients and investigatingcomplaints and other issues.
Managing vendor and business partner
relationships and determining eligibility ofvendors and others including verification ofreferences and qualifications and otherbackground screening checks.
For compliance with legislation and policies
Managing, monitoring and investigatingcompliance with all relevant legal, regulatory
and administrative obligations andresponsibilities, whether in the jurisdiction
where you are based or elsewhere.
Monitoring and investigating compliance with
Cognizant policies.
For organizing and maintaining our businessstructure
Development of central databases withrespect to the Personal Information of allExternal Individuals, including databases
used by subsidiaries or branch offices forclient and vendor management.

Business development

Legal Reason for Processing• Necessary for Cognizant’s legitimate
interests (to run a successful and efficientbusiness).
• Necessary for compliance with Cognizant’slegal obligations as a business entity.
• Necessary for Cognizant’s legitimate
interests (to run a successful and efficientbusiness).
• Consent• Necessary for Cognizant’s legal obligations
as a business entity.
• Necessary for Cognizant’s legitimate
interest for monitoring compliance withregulatory obligations.
• Necessary for Cognizant’s legitimate
interests to ensure compliance with ourpolicies.

• Necessary for Cognizant’s legitimate
interests (to run a successful and efficientbusiness).
• Depending on the situation, either with theconsent of the data subject, or where
necessary for Cognizant’s legitimate
interests (to run a successful and efficientbusiness).

For Security & Business Continuity
Management of access controls and usage ofbuildings and facilities (including CCTV andparking lots).
Management of access to and usage of officeequipment and resources including but notlimited to telephones, mobile phones, laptops
and portable devices, multifunctional devices
and more generally the computer network andapplications.
Maintaining the security of Cognizant’s and its
client’s networks and information andintellectual property.
Detecting, preventing or otherwise addressing
security, fraud or technical issues.

Cognizant Privacy Notice• Necessary for Cognizant’s legitimate
interests (to comply with its responsibilities
to run a safe, secure and efficientbusiness).
• Necessary for Cognizant’s legitimate
interests (to protect Cognizant’s financesand help prevent fraud).
• Necessary for Cognizant’s legitimate
interests (to run a successful and efficientbusiness).
• Necessary for Cognizant’s legitimate
interests (to run a successful and efficientbusiness and help prevent fraud).

Back to top
To whom we give your Personal Information

Disclosure within the Cognizant group of companies. Cognizant is a global company andyour Personal Information may be shared with or accessed by other companies within the
Cognizant group.
Disclosure to third parties. Cognizant may also share your Personal Information:•
With clients and potential clients in the course of business and businessdevelopment;•
With suppliers, subcontractors and service providers, to maintain an efficient andcommercially viable business, including caterers and security contractors if you visit
Cognizant's premises;•
With professional advisers and consultants;•
With legal advisors and external auditors for legal advice and to conduct businessaudits;•With credit reference agencies and background verification agencies, to conductcredit checks and background verification and reference checks;•
With service providers for business continuity management and contingency
planning in the event of business disruptions; and•With prospective sellers or buyers and their advisers in the event that Cognizant
merges, acquires or sells any business or assets.
The third parties with whom we share your Personal Information may in some instances
independently determine the purposes and uses of your Personal Information (e.g., legal
advisers and external auditors); in such cases, the recipient’s own privacy policy will govern
their use of your Personal Information.
Disclosure without notification. There may be circumstances where Cognizant discloses
Personal Information to third parties without notifying External Individuals. These
circumstances could include:
•
•
•

•

Where the information is publicly available;
Where Cognizant is required to do so by law or by order of a court or tribunal, or
where Cognizant has a good faith belief that such disclosure is reasonably
necessary to comply with a legal obligation, process or request;
Where it is alleged by a law enforcement authority that an External Individual isguilty of a criminal offence, or is civilly liable in a legal action, and Cognizant has agood faith belief that any disclosure is necessary to comply with a legal process orrequest.
Where Cognizant is legally required to or has a good faith belief that such disclosure
is reasonably necessary to protect the rights, property or safety of Cognizant, its
employees, contractors, job applicants, vendors, clients, customers of clients, third
parties or the public as required and permitted by law.

In the preceding year, we have not sold your Personal Information or shared it with a third
party for cross-context behavioral advertising.

Back to top
International transfer of your Personal Information
Due to the global nature of Cognizant’s business, Personal Information may be shared,
disclosed and transferred between the various Cognizant group companies where such
Cognizant Privacy Noticetransfers are required for legitimate business reasons. Where Cognizant transfers your
Personal Information internationally, which may include transferring Personal Information
outside your country of domicile,Cognizant will comply with applicable legal requirements.
Where required we will sign a data transfer agreement with the recipient of the Personal
Information, which in the case of Personal Information originating from the European
Economic Area, Switzerland and the United Kingdom, may include the Standard Contractual
Clauses.

Back to top
How we monitor your activities
Where permitted by local law, Cognizant may monitor the activities of External Individuals at
Cognizant or client facilities using CCTV. Where required, signage will indicate which areas
are subject to such monitoring. Recorded images are destroyed in accordance with ourretention policy, unless they are required for criminal or other investigations (including
circumstances where we are required to provide such information to clients for the purposesof their investigations).
In addition to the above and where permitted by local law, Cognizant may monitor its company
assets, including computers, telephones, fax machines, voice mail systems, etc., and its
networks, including intranet/internet access, email, applications, etc., and the activities ofExternal Individuals while accessing or using such office equipment or networks as set out in
our Acceptable Use Policy. If you have further questions, please contact us (see Contact Us
section below).

Back to top
How long we retain your Personal Information
Cognizant will retain Personal Information for as long as necessary for fulfilling the purpose or
purposes for which it was collected. This generally means that Personal Information will bedeleted at the latest 6 years after collection unless longer retention is required for other valid
reasons such as compliance with legal obligations, to resolve disputes or enforce contracts.

Back to top
How we protect your Personal Information
Cognizant implements appropriate security measures designed to prevent unlawful or
unauthorized Processing of Personal Information and accidental loss of or damage to
Personal Information. Cognizant maintains written security management policies andprocedures designed to prevent, detect, contain, and correct violations of measures taken toprotect the confidentiality, integrity, availability, or security of your Personal Information. These
policies and procedures assign specific data security responsibilities and accountabilities tospecific individuals, include a risk management program that includes periodic risk
assessment and provide an adequate framework of controls that safeguard your Personal
Information.

Back to top
Cognizant Privacy NoticeWhat are your rights?
Certain Cognizant systems may allow External Individuals to check and update certain
Personal Information. Where applicable, it is the responsibility of all External Individuals toensure that their Personal Information is kept up-to-date. Where permitted under applicablelaws, External Individuals have the right to access their Personal Information, including toknow the specific pieces of Personal Information that we collect, use and disclose, to verify
and challenge the accuracy and completeness of their Personal Information and have it
corrected, amended or deleted if inaccurate and, in limited circumstances, object toProcessing of their Personal Information or ask for Processing to be restricted. Cognizant may
require External Individuals to provide reasons or evidence to justify the amendment of
Personal Information held by Cognizant. In addition, where applicable, External Individuals
can ask for their data to be moved to another controller or be provided in a portable format.
Where Cognizant is Processing Personal Information on the basis of consent, External
Individuals can withdraw that consent at any time. However, please note that if you withdraw
your consent, you might not be able to use services or features that require collection or useof such Personal Information. External Individuals can exercise these rights by contacting us
per the Contact Us section below. External Individuals can also unsubscribe from marketing
sent by Cognizant at any time by following the instructions received in the relevant marketing
communication. We will not discriminate against your for exercising these rights.
We respond to all requests we receive from External Individuals wishing to exercise their dataprotection rights in accordance with applicable data protection laws. Complying with all or partof your request may be denied or limited by Cognizant if it would violate another person's
rights and/or as otherwise permitted by applicable law.
Before responding to a request, we reserve the right to verify and authenticate your identity
and the information that your request relates to. Cognizant may ask for your: (a) First, Middle(if available), and Last Name; (b) Physical Address; (c) Month/Year of Birth; (d) Valid Email
Address; and (e) Valid Telephone Number.
Authorized agents will be required to submit a written authorization document that includes
your name, address, telephone number and valid email address, signed and dated by you,appointing the individual as your authorized agent, to act on your behalf. Cognizant may also
request you to verify your own identity with Cognizant and confirm that you have provided theauthorized agent permission to submit the request. For the safety and security of yourinformation, requests submitted to Cognizant by an authorized agent will require a direct
method of communication, preferably a valid email address, with you, to fulfill the request. We
may deny a request from an authorized agent who does not submit sufficient proof to act on
your behalf.
If an archival copy of your Personal Information is required to be retained by applicable law
after receiving a request for deletion or closure of your account, we will follow the statutory
term for such a retention.

Back to top
Contact Us
Any questions, concerns or complaints about the operation of this Notice should be addressed toyour main or usual Cognizant contact in the first instance (e.g. your relevant client partner, accountexecutive, business development contact or procurement contact) or, if you do not have a
Cognizant contact, to Cognizant’s Data Protection Office at DataProtectionOfficer@cognizant.com.

Cognizant Privacy NoticeIf you wish to access the Personal Information we hold about you or exercise any of your otherlegal rights in respect of your Personal Information, please contact SAR@cognizant.com. In
addition to contacting us, in certain countries you have the right to lodge a complaint with your local
data protection authority if you so choose. If you are in California, you also may exercise yourprivacy rights by calling the Cognizant Ethics and Compliance Helpline toll-free at 1-866-824-4897.

Back to top
Note Cognizant may update this Notice from time to time. Any such updates will be effectivefrom the date on which they are notified to External Individuals or posted on the Cognizant
website at www.cognizant.com. External Individuals should check this Notice from time to time
and take notice of any changes made.

Definitions•“Associate” means any current, past and prospective employees, individual
contractors or other members of personnel of Cognizant.

•“Cognizant” means Cognizant Technology Solutions Corporation, a public limited
company incorporated in Delaware, United States with a registered address at 500
Frank W Burr Blvd, Teaneck, NJ 07666 USA, and its global affiliates and subsidiaries,
including the Cognizant company which you or your employer contracts orcommunicates with.

•“Personal Information” is defined under applicable law but may include any
information or combination of information, in any form or medium that can identify anExternal Individual. Examples include name, email address, physical address, phone
number, date of birth, age, home address, personal preferences, behavioral
information, government issued IDs, IP address, hardware identifiers, etc.

•

“Sensitive Personal Information” means Personal Information, which if lost,
compromised, or disclosed without authorization, could result in substantial harm,
embarrassment, inconvenience, or unfairness to an individual. Examples of Sensitive
Personal Information in various jurisdictions may include social security numbers,
driver’s license numbers, passwords, passports, tax IDs, financial account and credit
card numbers, health information (including Protected Health Information (PHI),
biometric identifiers, racial or ethnic origin, and information about political opinions,religious beliefs, trade union membership, criminal history, sexual orientation or bloodgroup, as well as any other information deemed sensitive under applicable dataprotection laws.

•“Process/Processed/Processing” means any operation or set of operations which is
performed on Personal Information or on sets of Personal Information, whether or notby automated means, such as collecting, recording, storing, deleting, viewing,
accessing, amending, using or disclosing the Personal Information.

•

Note, where we have used words such as “include,” “including,” “for example,” or“such as” in this Notice, these are meant to be examples and not exhaustive lists.

Back to top

Cognizant Privacy Notice