Wells Fargo International Contingent Resource Privacy NoticeThis Notice applies to all countries except for the following: the United States, Brazil, Chile, the Caribbean, European Union
countries, the United Kingdom, and the Dubai International Financial Center.
Effective: 03 November 2023
The Wells Fargo entity which has engaged the vendor organization that employs or engages you ("we", "us", “our” or the“Company”) provides this Privacy Notice (“Notice”) to explain how the Company will Process your Personal Data, Wells
Fargo’s privacy practices, and your rights over your Personal Data. Under the vendor engagement, you will be providing
certain services to us on behalf of the vendor organization (“Vendor”), and the Company will act as the data controller
regarding the collection, use, storage, transfer, handling and any other processing activity (collectively, “processing” or“process”) relating to information directly or indirectly identifying you or individuals relating to you ("Personal Data"). If you
are engaged by Wells Fargo in one of the excluded countries listed above, a different privacy notice will govern the engaging
entity’s Personal Data Processing activities.

1. What Personal Data Do We collect?
We may collect the following categories of Personal Data in connection with your engagement:•

Basic data: such as name, date of birth, and government-issued identification documents (to the extent permitted
by law).

•

Work contact details: such as name, work address, work phone numbers, fax numbers, and work email address.

•

Visa and work permit data: existing and expired visa(s) and other work permit details relating to you and/or
individuals related to you (e.g., spouse, family members).

•

Emergency contact information: such as name and contact information (if provided by you) of a family member oryour nominated person to be contacted in an emergency.

•

Absence data: such as dates of absence and reasons for absence (such as medical leave) to the extent these apply
to you.

•Third party data: such as the name, title, employer, contact details, and location of any individual who you are related
to or have a close personal relationship with who: (i) provided you with a reference for engagement by Wells Fargo;(ii) is a U.S. or non-U.S. government official; or (iii) has decision making authority or capability over any mattersaffecting Wells Fargo; and any other Personal Data relating to another individual which you may provide directly or
indirectly to the Company.

•

Performance data: such as information pertaining to the quality and efficiency of the services you are rendering on
behalf of the Vendor, against the agreed benchmarks between the Company and the Vendor and other similarassessment of performance.

•

Organizational data: such as title, job position, function, worker ID, department, business unit, supervisor's nameand higher level supervisor(s), cost center, signing authority, skills, work experience at the Company, user ID, andinformation technology access rights.

© 2023 Wells Fargo Bank, N.A. All rights reserved.
IPN GEN3121 (Rev 03/11/2023)

•Engagement data: such as data that may be collected during your engagement including from use of Wells Fargo
facilities, or as part of training activities and participation in Wells Fargo surveys, initiatives or events.

•

Usage and monitoring data: such as data about when and how you use and interact with equipment, systems,
communication channels, software (including those you install), and property, such as computers, mobile devices,
email, internet, calendar invitations, shared files, instant message or chat, video and/or audio calls, recordings andtranscriptions, internet, SharePoint, shared drives and other data repositories and voicemail, and how your use of
the above compares to others to create benchmarks and risk-rating scores based on such use; images and voices
about you that may be captured by closed-circuit television (CCTV) video and audio surveillance equipment installedaccording to local law onto Wells Fargo business premises; information about your location; office access data;
device data relating to personal electronic devices or other equipment used for any Bring Your Own Device (“BYOD”)
program (if applicable to you), e.g. device name, OS or model.

•

Disciplinary data: such as information pertaining conduct, internal Wells Fargo investigations, and disciplinary andgrievance matters.

•

Health-related data: health-related data relevant to promoting and ensuring public or workplace health and safety(e.g., in connection with the COVID-19 pandemic), such as body temperature, symptoms, recent travel, potential or
confirmed exposure, testing (including results) and vaccination status.

•

Personal Data contained in communications: such as the types of Personal Data listed above that may becontained in emails, phone calls, video calls, instant messages, chats or other communications made or received on
any corporate or Wells Fargo-approved device, on any BYOD-related personal device, or through any other meansof Wells Fargo related communications, which may be reviewed as part of risk management, compliance, and otherservice engagement or business activities.

•

Criminal records data: criminal records properly obtained through a lawful background reference check may becollected for legal, compliance, risk management and other purposes.

•

Biometric data: biometric data such as fingerprints, keystrokes, hand scans, biometric algorithms, or voice prints
may be collected if you are required to access or use systems with biometric safeguards or features.

•

Financial information: data related to financial or investment accounts held by you, your spouse/domestic/civil
partner, your respective children (including financially independent minors) or other dependents as well as any otheraccounts you control, including copies of account statements and transaction details for such accounts (such as
brokerage statements or other information regarding securities transactions), may be collected legal, compliance,risk management and other purposes.

Amongst the types of Personal Data listed above, some of them may be considered sensitive under the data protection laws
where you are engaged. What Personal Data is considered sensitive depends on the data protection law where you areengaged. Examples of sensitive Personal Data may include: specific identity information (e.g., governmental identity
documents); personal whereabouts (including geolocation data); health-related data (such as medical reports); financial data(such as your investment accounts or transactions); criminal records; biometric data (such as fingerprints, voice prints, andother physical, physiological or behavioral characteristics); political affiliation; trade union membership; passwords, etc.
Unless stated otherwise, references to Personal Data in this Notice include sensitive Personal Data. However, sensitive
Personal Data will be processed in accordance with applicable data protection laws, and only where processing is necessary
to achieve the purposes described in Section 2.
If you provide the Company with Personal Data about your spouse, domestic/civil partner, or any other third party individuals(for example, for emergency contact purposes), it is your responsibility to provide them with a copy of this Notice (explaining
Wells Fargo’s data privacy practices), inform them of their rights with respect to such Personal Data and that you may
disclose their Personal Data to the Company for the activities described in the Notice. You are also responsible for obtaining
the explicit and separate consent of these individuals to the processing of their Personal Data by Wells Fargo for theactivities described in the Notice.

2

IPN GEN3121 (Rev 03/11 /2023)

We will process your Personal Data in physical and electronic form and will do so in a way that adequately safeguards yourpersonal rights and interests in accordance with applicable data protection laws. However, it is necessary that you provide
the Company with your Personal Data (including sensitive Personal Data), without which we will not be able to administer
our engagement with the Vendor where it requires the processing of your Personal Data.

2. Why We Process Your Personal Data?
The Company may process Personal Data to enable you to provide services to us under our engagement with the Vendor,
including processing the following categories of Personal Data for the following purposes (“Engagement Purposes”).
a) Human resource management purposes relating to handling, maintaining, and improving administration of ourengagement with the Vendor and related business operations. For example: assigning projects and tasks;
conducting resource analysis and planning; administering project costing and estimates; managing work activities
and administering compliance trainings; providing physical access to Wells Fargo offices/locations and issuingaccess passes or other credentials; providing performance metrics to the Vendor (as your employer or agency)
including assessment of the quality and quantity of the services provided under our agreement with the Vendor;
determining and managing your suitability to be engaged for present or future engagements; maintaining internal
lists or databases relating to your suitability for engagement. For this purpose, the Company may process basic data,
work contact details, visa and work permit data, performance data, absence data, engagement data, disciplinary
data, and other categories of Personal Data where needed.
b) Human resource management purposes relating to maintaining a corporate directory and offer platforms forsharing information, including populating such directories and platforms, making contact details available, andmaking intranet websites accessible by staff and contingent works, to facilitate staff communication and sharing of
information internally. For this purpose, the Company may process Personal Data such as work contact details,organizational data, engagement data, data you voluntarily submit for these purposes, and other categories of
Personal Data where needed.
c) Human resource management purposes in the event of emergencies, such as contacting you, your family or
emergency contacts, protecting the health and safety of staff and others in emergencies, and protecting officeequipment, facilities, and other property. For this purpose, the Company may process basic data, emergency contact
information, and other categories of Personal Data where needed.
d) Technology management purposes. For example: implementing and maintaining Information Technology (IT)systems; providing IT support and asset management; maintaining business continuity and recovery plans andprocesses; supporting the adoption of alternative and/or flexible work arrangements; managing security services;managing your access to systems and equipment; compiling of audit trails and other reporting tools; and identifying
patterns in the use of technology systems and information entrusted to us to protect Company, people andproperty. For this purpose, the Company may process Personal Data such as basic data, work contact details,organizational data, engagement data, usage and monitoring data, Personal Data contained in communications,disciplinary data, and other categories of Personal Data where needed.
e) Legal, risk and compliance purposes relating to monitoring and ensuring compliance with the Wells Fargo Codeof Ethics and Business Conduct, other policies and procedures, and applicable laws. For example: detecting or
preventing possible loss or unauthorized access or processing of customer, staff, confidential or restricted data;protecting Company, customer and third party data and assets; managing and mitigating risk; avoiding actual or
perceived conflicts of interest; meeting regulatory expectations; conducting internal audits and investigations;ensuring compliance with internal Human Resources and Return to Office policies; handling any potential
complaints or other claims; and engaging in disciplinary actions and terminations. For this purpose, the Company
may process Personal Data such as basic data, work contact details, organizational data, absence data, performancedata, engagement data, third party data, usage and monitoring data, disciplinary data, Personal Data contained incommunications, and other categories of Personal Data where needed.

3

IPN GEN3121 (Rev 03/11 /2023)

f)

Legal, risk and compliance purposes relating to responding to requests and legal demands from regulators orother authorities, or handling any legal, regulatory or other claims or proceedings involving any Wells Fargo
entity. For example: complying with requests from regulators or other authorities in your home country or otherjurisdictions; participating in legal proceedings including domestic and cross-border litigation and discovery
procedures; and complying with requests from police and/or other law enforcement authorities. For this purpose,
the Company may process Personal Data such as basic data, work contact details, organizational data, engagement
data, absence data, emergency contact information, performance data, usage and monitoring data, disciplinary data,
third party data, Personal Data contained in communications, and any other category of Personal Data necessary to
respond to the request, demand, claim or proceedings.

g) Legal, risk and compliance purposes relating to complying with worker or workplace-related legal requirements.
For example: complying with requirements pertaining to income tax, national insurance deductions, and applicablelaws relating to workers and immigration. For this purpose, the Company may process basic data, work contact
details, engagement data, organizational data, absence data, and other categories of Personal Data where needed.
h) Corporate restructuring purposes relating to conducting Merger & Acquisition (M&A) transactions,
restructuring, business transfers, combinations, and similar or related activities. For this purpose, the Company
may process any category of Personal Data necessary to achieve the purpose.
i)

Health and safety purposes relating to promoting public health and ensuring workplace health and safety, suchas in connection with the COVID-19 pandemic, where permitted or required by applicable law. For this purpose, theCompany may process Personal Data such as health-related data and other categories of Personal Data where
needed.

The Company will not process Personal Data for any other purpose incompatible with the purposes outlined in this section,
unless it is required or authorized by law, or as authorized by you. For some activities, processing of certain Personal Data
continues after individuals cease providing services to the Company. Please see Section 5 below for further information
about how long we retain Personal Data.

3. Transfers of Personal Data to Other Recipients
Wells Fargo operates across the globe, and we may transfer Personal Data to recipients located in other countries tofacilitate this. In particular, the Company may transfer the types of Personal Data described in Section 1 to the following
recipients to be processed for the Engagement Purposes described in Section 2:•

4

Affiliated Entities. The Company has Affiliated Entities operating in the United States and around the world,
including the group parent in the United States, Wells Fargo & Company, and Wells Fargo Bank, N.A. (collectively,
the Company and our Affiliated Entities are the “Wells Fargo Group”). The Company may disclose Personal Data to
our Affiliated Entities on a worldwide basis for the Engagement Purposes. A non-exhaustive list of Affiliated Entities
can be found in the following Wells Fargo & Company 10-K filings (Exhibits 21) made with the US Securities andExchange Commission, available at the following hyperlinks:○

https://www.sec.gov/Archives/edgar/data/72971/000007297123000071/wfc-1231x2022xex21.htm○

https://www.sec.gov/Archives/edgar/data/72971/000007297115000449/wfc-12312014xex21.htm•

Customers and prospects. As necessary in connection with the Engagement Purposes, Personal Data may betransferred by the Wells Fargo Group to customers, prospects and other third parties.

•

Regulators and authorities. As necessary for the Engagement Purposes described above, Personal Data may betransferred by the Wells Fargo Group to regulators, courts, and other authorities (e.g., tax and law enforcement
authorities.

IPN GEN3121 (Rev 03/11 /2023)

•Service providers. As necessary for the Engagement Purposes described above, Personal Data may be shared with
one or more parties providing services to the Wells Fargo Group, whether affiliated or unaffiliated, to process
Personal Data under appropriate instructions ("Data Processors"). Such Data Processors (also known as entrusted
persons under some applicable laws) will be subject to contractual obligations to implement appropriate
administrative, technical, physical, and organizational security measures to safeguard Personal Data, and to process
Personal Data only as instructed. Data Processors may carry out instructions related to IT system support, training,
compliance, supporting the Engagement Purposes, or other legitimate activities, and will be subject to contractual
obligations to implement appropriate technical and organizational security measures to safeguard the Personal
Data, and to process the Personal Data only as instructed. In addition, to the extent that Personal Data is disclosed
to independent external auditors, benefits providers, insurance carriers, or other service providers that may not be
acting solely as a Data Processor but also as a data controller, such service providers will be subject to any necessarycontractual obligations or other safeguards regarding the protection and processing of Personal Data.

•

Entities relating to business transfers, combinations and similar activities. As we develop our business, the Wells
Fargo Group might sell, buy, acquire, obtain, exchange, restructure or reorganize businesses or assets. In the eventof any actual or proposed sale, merger, reorganization, transaction, restructuring, dissolution or any similar event
involving our business or assets. Personal Data may, to the extent permitted by law, be transferred by the Wells
Fargo Group to entities related to these transactions to facilitate the service engagement with the Vendor (i.e., youremployer or agency) or for other Engagement Purposes.

The recipients of Personal Data identified in this Section 3 may be in the United States or other jurisdictions outside yourcountry of residence. As such, these overseas recipients may not be required to comply with data protection laws in yourcountry of residence, and may not be required to provide you with comparable levels of data protection or redress under thedata protection laws in your country of residence. Some of these recipients may also act as data controllers (rather than Data
Processors) with respect to your Personal Data. Notwithstanding the above, where required by applicable data protection
laws, the Company will: (i) address any applicable requirement to ensure an adequate level of data protection before
transferring Personal Data by ensuring the execution of appropriate data transfer agreements or confirming otherreasonable safeguards are in place; and (ii) establish that Personal Data will be made available to recipients on a need-toknow basis only for the Engagement Purposes described above. Other country-specific information about transfers of
personal data may be found in Section 9.

4. How We Safeguard Your Personal Data
Personal Data will be stored in the databases of Wells Fargo and will be held and maintained by Wells Fargo or on behalf ofWells Fargo by Wells Fargo service providers. The Company has implemented appropriate technical, physical, andorganizational security measures to safeguard Personal Data in accordance with the Company’s Information Security Policy
and standards. When we retain a non-affiliated entity or service provider to perform a function, that entity will be required
to protect Personal Data in accordance with Wells Fargo’s standards.

5. How Long Your Personal Data is Retained
The Company’s general practice is not to keep Personal Data longer than necessary for the fulfilment of the Engagement
Purposes outlined in Section 2, in accordance with our standard records retention periods, or as required or appropriate in
the jurisdiction where such records or information is retained. However, we and our service providers may need to hold
Personal Data beyond these time periods for reasons such as complying with the regulatory requirements of a particularcountry or in response to an audit, investigation, or other legal matter. The criteria used to determine retention periods
include but are not limited to:•5

The length of time we have an ongoing relationship with you (for example, for as long as you are a contingent
resource with us);IPN GEN3121 (Rev 03/11 /2023)

•Whether there is a legal obligation to which we are subject (for example, certain laws may require us to keep recordsof your engagement for a certain period of time after you are no longer engaged as a contingent resource with us);•

Whether retention is advisable considering our legal position (such as in regard to applicable statutes of limitations,litigation or regulatory investigations); and/or•

Whether our operational needs require maintaining your Personal Data (for example, for the internal audit of bankoperations, maintaining solicitation preferences – including for former and non-customers – systems
administration, or for fraud prevention).

Please bear in mind that if, as a result of your engagement, you have access to Personal Data of the Company or any of its
controlling, subsidiary or affiliated entities, its clients and/or service providers or any third parties, you are obliged tomaintain the confidentiality of such Personal Data and are prohibited from sharing such Personal Data with third parties,
without authorization of the Company or the individuals. This obligation subsists even after the termination of yourengagement.

6. Monitoring of Equipment, Systems and Property
To the extent permitted by applicable law, and subject to any other local notices or policies, the Company reserves the rightto monitor the use of physical and electronic equipment, systems, and property, including: original and backup copies of
email; instant messaging or chats; text messaging; telephonic communications; voice recordings; video call recordings;
voicemail; internet use; office access data; computer and device use activity; corporate usage, activities or communications
pertaining to devices relating to any BYOD program; and CCTV recordings, etc. The Company may engage in such activities
to administer IT access, provide IT support, manage security services and staff authorizations, manage risk, as well as tomonitor, investigate, and ensure compliance with laws, regulations and Wells Fargo's Code of Ethics and Business Conduct,other Company policies and procedures (including Human Resources and Return to Office policies), and to fulfil otherEngagement Purposes where needed. You should not expect privacy in connection with your use of any equipment, systems,
or property, including personally-owned equipment to the extent subject to Wells Fargo’s BYOD policies. Wells Fargo also
maintains separate policies that govern BYOD, including when and how Wells Fargo may perform monitoring. If you use a
BYOD approved device, you should review those policies.
Even if you create or have access to passwords to protect against unauthorized access to correspondence and activities,
using that password does not make the related communications or activities private. In addition, phone calls, video calls,
and/or instant messages or chats made or received on any business telephone or any Company device may be monitored orrecorded for legal, compliance, risk management and other Engagement Purposes. Monitoring may be conducted remotely
or locally, and related Personal Data collected and processed by the Company, Affiliated Entities, and/or service providers to
the Wells Fargo Group using software, hardware, or other means. Personal Data obtained through monitoring may betransferred to regulators and other authorities, Affiliated Entities and other recipients listed in Section 3 as necessary for
the Engagement Purposes, including recipients in your country of residence or other jurisdictions.
Personal Data obtained through monitoring will be safeguarded in accordance with the security measures set out in
Section 4 above. The Company also employs measures to protect against abuse of Personal Data that is used for monitoring,
including appropriate training and supervision of responsible staff, and periodic review of monitoring programs. Personal
Data obtained through monitoring, which is relevant to the purposes described above, will be retained for reasonable periods
to accomplish these purposes, and subject to any rights you may have under applicable law.

7. Exercising Rights Over Your Personal Data
You may have certain rights that enable you to have control and oversight over what organizations do with your Personal
Data. Depending on the applicable data protection law where you are engaged, you may have the following rights over your
Personal Data:

6

IPN GEN3121 (Rev 03/11 /2023)

•Right to confirm whether your Personal Data is being processed.

•

Right to obtain an explanation of processing activities relating to your Personal Data.

•

Right to access or to be provided with a copy of your Personal Data.

•

Right to correct, rectify, update or complete your Personal Data.

•

Right to suspend, restrict or object to processing of your Personal Data.

•

Right to delete your Personal Data.

•

Right to portability of your Personal Data.

•

Right to consent, elect the scope of consent, or withdraw consent, to the processing of your Personal Data.
Withdrawal of consent will not affect the lawfulness of processing done prior to withdrawal, or processing conducted
on legal bases other than consent.

•

Right to seek relief from data protection authorities, claim damages, seek self-defense, or commence legal
proceedings for violations of your rights and interests over your Personal Data under applicable data protection laws
where you are engaged.

•

Right to refuse and request for explanations regarding fully-automated decision-making using your Personal Data
(if any).

•

If you are engaged by Wells Fargo in Japan, rights to: (i) obtain information about transfer safeguards implemented
with respect to overseas transfers of your Personal Data by the Company; (ii) be provided with information about
security measures implemented to protect your Personal Data; and (iii) be informed of the names of therepresentatives of our Wells Fargo entities in Japan listed in Section 9, and the name of the Data Privacy Officer.

•

If required by privacy laws in the People’s Republic of China (“China”)1, the Company will enter into Standard
Contract(s) issued by China’s cyberspace authority with offshore recipients to comply with legal requirements
concerning transfers of Personal Data out of China. If you are engaged by Wells Fargo in China, you could be a thirdparty beneficiary to such Standard Contract(s), unless you expressly object within 30 days from the date of thisNotice. At your request, the Company may provide you with a copy of such Standard Contract(s) to the extent
required by law. Requests or questions concerning these Standard Contract(s) may be directed to us using thecontact details in Section 8.

•

If you are engaged by Wells Fargo in India, rights to: (i) have your grievances redressed, and (ii) nominate any otherindividual who, in the event of your death or incapacity, can exercise your data subject rights.

The abovementioned rights are not absolute and may be subject to exceptions or limitations depending on the applicabledata protection law where you are engaged. If the Company is not able to accommodate your request, you will be provided
with reasons for the denial. If you have questions about or wish to exercise your Personal Data rights, please contact theregional Data Privacy Officer using the contact information in Section 8 below. In addition to the Data Privacy Officers, theCompany has appointed a contact person to respond to your questions and complaints. The Contact Person is generally the
Human Resources Manager at the Company or, if there is no Human Resources Manager, the Branch Manager or Country
Manager for that location. You have the right to lodge a complaint with the local supervisory authority if you feel actions
taken by us violate your rights under applicable data protection laws and you are not satisfied with the resolution we provide.

1 Solely for the purpose of this Notice, references to “China” refer to the mainland of the People’s Republic of China, and does not include

Hong Kong Special Administration Region, Macau Special Administration Region, and Taiwan.

7

IPN GEN3121 (Rev 03/11 /2023)

8. Contacting Us For Your Request
The Company has appointed the Regional Privacy Officers (as listed below) who are responsible for responding to requests
in relation to your Personal Data.
RegionContact Details

Asia-Pacific

APAC Regional Data Privacy Officer
138 Market Street, #30-01, CapitaGreen
Singapore, 048946
Telephone: (65) 6395 6900
privacy.apac@wellsfargo.com

Canada and Latin America

Americas Regional Privacy Officer
23rd Floor, 22 Adelaide Street West
Toronto, Ontario
Canada M5H-4E3
Telephone: (416) 607-2900
For Canada: canadaprivacyinfo@wellsfargo.com
For Latin America: privacy.latinamerica@wellsfargo.com

India

India Grievance Officers
Wells Fargo Bank N.A. Mumbai Representative Office
Claire Cahill
Claire.Cahill@wellsfargo.com
Wells Fargo International Solutions Private Limited
Prasanth P
prasanth.p@wellsfargo.com

South Korea

South Korea Data Privacy Officer
Byeong-Gu Jang
Wells Fargo Bank, N.A. Seoul Branch
21/F, D1, D Tower, 17 Jong-ro 3-gil, Jongno-gu, Seoul, 03155, Korea
Telephone: (82) 2-3706-3106
Byeong-gu.jang@wellsfargo.com

Philippines

Philippines Data Protection Officer
Wells Fargo International Solutions LLC – Philippines
Wells Fargo International Clearing Support Services, LLC – Philippine Branch
Sharon A. Ferranco1180 Wells Fargo Drive,
McKinley Hill, Dr. Taguig, Philippines
Telephone: (+63) 939-923-0611
Sharon.A.Ferranco-uy@wellsfargo.com

8

IPN GEN3121 (Rev 03/11 /2023)

Contact information for the Data Protection Authority in the Philippines isavailable at: https://www.privacy.gov.ph/.

9. Other Country-Specific Information
If you are engaged by Wells Fargo in any of the listed countries below, please see additional country-specific privacy
information for the relevant country below.
Australia
Our Wells Fargo entities in Australia covered by this Notice are as follows:
Entity Name

Address

Wells Fargo Bank, N.A. - Sydney, Australia

Level 8, 88 Phillip Street, Aurora Place, Sydney, NSW 2000

Wells Fargo International Finance (Australia) Pty Ltd‘Building 8’ Level 2 576, Swan Street, Richmond, VIC 3121

China
Our Wells Fargo entities in China covered by this Notice are as follows:
Entity Name

Address

Wells Fargo Bank, N.A. - Beijing, People’s No. 7 Jinrong Street Units F722-F723, 7/F, Winland International FinanceRepublic of China
Center Xicheng District, Beijing, People’s Republic of China
Wells Fargo Bank, N.A. - Shanghai, People’s No. 100, Century Avenue Unit 30, 32/F, Shanghai World Financial Centre
Republic of China
Pudong New District Shanghai, People’s Republic of China
Wells Fargo CDF Commercial Factoring Unit 1501-3, 1501-4, 1501-5, 15/F Capital Square No. 268 Hengtong Road,(China) Company Limited - Shanghai Branch Jing’an District, Shanghai, People’s Republic of China
Further information relating to the direct transfer of Personal Data by Wells Fargo entities in China to offshore recipients isfound below:
Name of the
Offshore
RecipientContact Details Type of Personal
Data
Transferred

Processing
PurposeThe Company’s Offshore
Types of
Purposes listed
Affiliatedrecipients can be Personal Data
in Section 2
Entities (defined contacted
listed in Section abovein Section 3)
through the
1 abovesuch as Wells
APAC Regional
Fargo &
Privacy Officer
Company, etc. using the contact
details in Section
8 above

Processing
Means

Collection,
storage, use,
processing,transfer, anddeletionJapan
Our Wells Fargo entities in Japan covered by this Notice are as follows:9

IPN GEN3121 (Rev 03/11 /2023)

Retention
PeriodMethod andProcedure to
Exercise Rights

As specified in Data subject
Section 5 above rights can be
exercised bycontacting ususing the details
in Section 8
aboveEntity Name

Address

Wells Fargo Bank, N.A. – Tokyo Branch

24th Floor, Marunouchi Trust Tower Main, 8-3, Marunouchi
1-chome, Chiyoda-ku, Tokyo 100-0005

Wells Fargo Securities (Japan) Co., Ltd.

24th Floor, Marunouchi Trust Tower Main, 8-3, Marunouchi
1-chome, Chiyoda-ku, Tokyo 100-0005

To the extent that the sharing of Personal Data with the recipients listed in Section 3 is subject to any Japanese dataprotection laws, the Wells Fargo Japan entity above which you are engaged by is responsible for the management of Personal
Data shared with such recipients, and the contact details of that entity’s Data Privacy Officer is listed in Section 8 under the‘Asia-Pacific’ heading.
New Zealand
Our Wells Fargo entity in New Zealand covered by this Notice is as follows:
Entity Name

Address

Wells Fargo International Finance (New Zealand) Limited

North Lobby, Level 1, Office #108, 293 Durham Street,
Christchurch, 8013, New ZealandPhilippines
In compliance with the Philippines Data Privacy Act of 2012, its implementing rules and regulations, and other relevant
issuances, Wells Fargo International Solutions LLC – Philippines (WFIS) and Wells Fargo International Clearing Support
Services, LLC – Philippine Branch (WFICSS) were registered with the NPC, along with its Data Processing Systems andappointed Data Protection Officer. These entities have been issued seals of registration by the NPC, which are displayed
below.

Wells Fargo International Solutions LLC – Philippines

10

IPN GEN3121 (Rev 03/11 /2023)

Wells Fargo International Clearing Support Services, LLC– Philippine BranchSouth Korea
Your Personal Data may be transferred electronically (e.g., by IT network, etc.) or physically (e.g., by courier, post, etc.),
including outside South Korea, to the third party recipients listed in Section 3 during your engagement with the Company
and/or within the periods of retention and use explained in Section 5. You may contact us using the details in Section 8 for
queries relating to offshore recipients of your Personal Data.
TaiwanOur Wells Fargo entity in Taiwan covered by this Notice is as follows:
Entity Name

Address

Wells Fargo Bank, N.A. – Taipei Branch

No.44, 17F, Chung Shan North Road, Section 2 Taipei City,
TaiwanVietnamOur Wells Fargo entity in Vietnam covered by this Notice is as follows:
Entity Name

Address

Wells Fargo Bank N.A. Hanoi Representative Office

No. 16, Phan Chu Trinh Street, Unit 1410, Cornerstone
Building, Hoan Kiem District, Hanoi

10. Updates to this Notice
We may change or update parts of this Notice to reflect changes in our practices and/or applicable law and regulation. Pleasecheck this Notice (available at http://www.wellsfargo.com/privacy_security/) from time to time so that you are aware of any
changes or updates to it, which may be indicated by a change in the effective date noted at the beginning of the Notice. If
and when required under applicable law, we will notify you of any change or update in relation to this Notice by either
individual message or disclosing the changes to the data processing on an available medium.

11

IPN GEN3121 (Rev 03/11 /2023)

Acknowledgement and Consent[For Contingent Resource Staff in all countries except China, South Korea, and Vietnam]
I understand that the Company will directly or indirectly collect, use, store, transfer (within and outside my country ofresidence) or otherwise process my Personal Data (including sensitive Personal Data) in accordance with this Notice, andthat such Personal Data includes the Personal Data of third party individuals which I provide the Company (for example, myemergency contacts). I am also aware that such processing includes conducting staff monitoring or performing any otheroperations on my Personal Data. I acknowledge that this Notice and Consent will supersede any prior notice on this subject
and shall cover all Personal Data collected or maintained by the Company in connection with my engagement even after theengagement is over. I understand that that I may decline to provide the Company with my Personal Data but acknowledge
that this may affect my engagement to provide services to the Company where it requires processing of my Personal Data.
By signing below, or if acknowledged electronically (e.g. by alternative modes like email, electronic signature, clicking
the accept button, etc.), I hereby voluntarily confirm:•

my consent to the processing of my Personal Data in accordance with this Notice;•

my consent to the transfer of my Personal Data to recipients outside my country of residence as described in this Noticewith full knowledge of the implications of such overseas transfers as described in Section 3 of this Notice;•that where I provide Personal Data of other third party individuals, I have provided them with a copy of this Notice andobtained their separate consent to their Personal Data being processed in accordance with this Notice; and•that Personal Data I provide the Company shall be accurate and be maintained as accurate.

Legal Name (Printed)

Name of Firm (which you are employed by or work for)Signature

Date

12

IPN GEN3121 (Rev 03/11 /2023)

Acknowledgement and Consent[For Contingent Resource Staff in the People’s Republic of China]
I understand that the Company will directly or indirectly collect, use, store, transfer (within and outside China) or otherwise
process my Personal Data (including sensitive Personal Data) in accordance with this Notice, and that such Personal Data
includes the Personal Data of third party individuals which I provide the Company (for example, my emergency contacts). I
am also aware that such processing includes conducting monitoring of staff or performing any other operations on my
Personal Data. I acknowledge that this Notice and Consent will supersede any prior notice on this subject and shall cover all
Personal Data collected or maintained by the Company in connection with my engagement even after the engagement isover. I understand that that I may decline to provide the Company with my Personal Data but acknowledge that this may
affect my engagement to provide services to the Company where it requires processing of my Personal Data.
By checking the boxes and signing below, I hereby voluntarily confirm the following:☐

My separate consent to the collection and processing of my Personal Data in accordance with this Notice.

☐

My separate consent to the collection and processing of my sensitive Personal Data in accordance with this Notice.

☐

My separate consent to my Personal Data being transferred to recipients outside China as described in this Noticewith full knowledge of the implications of such overseas transfers as described in Section 3 of this Notice.

☐

My separate consent to the provision of my Personal Data to other third parties described in Section 3 of this Notice
who may act as independent data controllers of such Personal Data.

☐

Where I provide Personal Data of other third party individuals to Wells Fargo, I have provided them with a copy ofthis Notice and obtained their separate consent to their Personal Data being processed in accordance with the Notice.

☐That Personal Data I provide the Company shall be accurate and maintained as accurate.

Legal Name (Printed)

Name of Firm (which you are employed by or work for)Signature

Date

13

IPN GEN3121 (Rev 03/11 /2023)

Acknowledgement and Consent[For Contingent Resource Staff in South Korea]
I understand that the Company will directly or indirectly collect, use, store, transfer (within and outside South Korea) orotherwise process my Personal Data (including Personal Data constituting Unique Identification Information2 and Sensitive
Information3) in accordance with this Notice, and that such Personal Data includes the Personal Data of third party
individuals which I provide the Company (for example, my emergency contacts). I am also aware that such processing
includes conducting monitoring of staff or performing any other operations on my Personal Data.
I acknowledge that this Notice and Consent will supersede any prior notice on this subject and shall cover all Personal Data
collected or maintained by the Company in connection with my engagement even after the engagement is over. I understandthat that I may decline to provide the Company with my Personal Data but acknowledge that this may affect my engagement
to provide services to the Company where it requires processing of my Personal Data.
By checking the boxes and signing below, I hereby voluntarily confirm the following:☐

My separate consent to collection and processing of my Personal Data in accordance with this Notice.

☐

My separate consent to collection and processing of my Personal Data constituting Unique Identification
Information in accordance with this Notice.

☐

My separate consent to collection and processing of my Personal Data constituting Sensitive Information inaccordance with this Notice.

☐

My separate consent to provision of my Personal Data to third party recipients described in Section 3 of this Notice.

☐

My separate consent to provision of my Personal Data constituting Unique Identification Information to third party
recipients described in Section 3 of this Notice.

☐

My separate consent to provision of my Personal Data constituting Sensitive Information to third party recipients
described in Section 3 of this Notice.

☐

My separate consent to my Personal Data being transferred to recipients outside South Korea as described in thisNotice with full knowledge of the implications of such overseas transfers as described in Section 3 of this Notice.

☐

My separate consent to any staff monitoring using my Personal Data as described in this Notice.

☐

Where I provide Personal Data of other third party individuals to Wells Fargo, I have provided them with a copy ofthis Notice and obtained their separate consent to their Personal Data being processed in accordance with the Notice.

☐That Personal Data I provide the Company shall be accurate and maintained as accurate.

Legal Name (Printed)

Name of Firm (which you are employed by or work for)SignatureDate

2 Unique Identification Information refers to resident/foreigner registration numbers, passport numbers, and driver’s license numbers.
3 Sensitive Information refers to information relating to an individual’s race, ethnicity, ideology, belief, political opinions, admission to orwithdrawal from a trade union or political party, health, sex life, DNA, criminal records, identifying physical, physiological or behavioral
characteristics, and other Personal Data likely to markedly threaten their privacy.

14

IPN GEN3121 (Rev 03/11 /2023)

Acknowledgement and Consent[For Contingent Resource Staff in Vietnam]
I understand that the Company will directly or indirectly collect, use, store, transfer (within and outside Vietnam) orotherwise process my Personal Data (including sensitive Personal Data) in accordance with this Notice, and that such
Personal Data includes the Personal Data of third party individuals which I provide the Company (for example, my emergency
contacts). I am also aware that such processing includes conducting monitoring of staff or performing any other operations
on my Personal Data. I acknowledge that this Notice and Consent will supersede any prior notice on this subject and shallcover all Personal Data collected or maintained by the Company in connection with my engagement even after theengagement is over. I understand that that I may decline to provide the Company with my Personal Data but acknowledge
that this may affect my engagement to provide services to the Company where it requires processing of my Personal Data.
By checking the boxes and signing below, I hereby voluntarily confirm the following:☐

My separate consent for my Personal Data to be collected and processed in accordance with this Notice for thehuman resource management purposes described in Section 2 [Paragraphs a) to c)] of the Notice.

☐

My separate consent for my Personal Data to be collected and processed in accordance with this Notice for thetechnology management purposes described in Section 2 [Paragraph d)] of the Notice.

☐

My separate consent for my Personal Data to be collected and processed in accordance with this Notice for the legal,risk and compliance purposes described in Section 2 [Paragraphs e) to g)] of the Notice.

☐

My separate consent for my Personal Data to be collected and processed in accordance with this Notice for the
corporate restructuring purposes described in Section 2 [Paragraph h)] of the Notice.

☐

My separate consent for my Personal Data to be collected and processed in accordance with this Notice for the healthand safety purposes described in Section 2 [Paragraph i)] of the Notice.

☐

My separate consent for my Personal Data to be transferred to recipients outside Vietnam as described in this Noticewith full knowledge of the implications of such overseas transfers as described in Section 3 of this Notice.

☐

Where I provide Personal Data of other third party individuals to Wells Fargo, I have provided them with a copy ofthis Notice and obtained their separate consent to their Personal Data being processed in accordance with the Notice.

☐That Personal Data I provide the Company shall be accurate and maintained as accurate.

Legal Name (Printed)

Name of Firm (Which you are employed by or work for)Signature

Date

15

IPN GEN3121 (Rev 03/11 /2023)