Wells Fargo International Contingent
Resource Privacy NoticeThis Notice applies to contingent resources in India and the Philippines.
Effective: 11 May 2023
"We," "us," “our,” or "Wells Fargo" refers to the Wells Fargo entity which has engaged the firm that employs you,or that you otherwise work for (the “Vendor”), to perform certain services for us. Under this engagement, you will
be providing certain services to us on behalf of the Vendor, and Wells Fargo will act as the data controller regarding
the collection, use, transfer, and processing of individually identifiable information about you ("Personal Data"). This
document is referred to as the "Notice."
Wells Fargo is one of the largest financial institutions in the world and operates globally. As described in Section 2 below, inorder to carry out employment-related operations, including administering your contract or employment relationship with
the Company, we need to collect, process, and use Personal Data. We also have to meet the different requirements of dataprotection laws across the world.
Name of group parent: Wells Fargo & Company
Headquarters location: 420 Montgomery Street; San Francisco, CA 94104 USA
Contact information for our designated Officers are listed in Section 8 below.

1. What Personal Data do we collect?
We may collect the following categories of Personal Data in connection with your engagement:•

Master data: first name and family name, date of birth, national identification number or other personal
identification number;•Work contact details: first name and family name, work address, work phone numbers, fax numbers, and work
email address;•

Emergency contact information: first name and family name, and contact information (if provided by you) ofa family member or your nominated person to be contacted in an emergency;•

Absence data: dates of absence and reasons for absence (such as medical leave) to the extent these apply to you;•Third party data: the name, title, employer, contact details, and location of any individual who you are related to or
have a close personal relationship with who: (i) provided you with a reference for employment with Wells Fargo; (ii)
is a U.S. or non-U.S. government official; or (iii) has decision making authority/capability over any matters affecting© 2023 Wells Fargo Bank, N.A. All rights reserved.
IPN CRINP7322 (Rev 11/05/23)

Wells Fargo, and any other Personal Data relating to another individual which you may provide the Company.
•

Performance data: information pertaining to the quality and efficiency of the services you are rendering on behalfof the Vendor, against the agreed benchmarks between the Company and the Vendor and other similarassessment of performance;•

Organizational data: title, job position, employer, function, non-employee ID, department, business unit,
supervisor's name and higher level supervisor(s), cost center, signing authority, skills, work experience at theCompany, user ID, and information technology access rights
Employment data: data that may be collected in the course of your engagement including use of Company facilities,
training activity, or attendance at Company events.

••

Computer/Device usage data and contents: data about when and how you use and interact with equipment,
electronic communications systems, and property, such as computers, mobile devices, email, internet, geolocation,
calendar invitations, shared files, instant message or chat, video and/or audio calls, recordings and transcriptions,intranet SharePoint sites, shared drives and other data repositories, voicemail, and software (including software you
install), and how your use compares with benchmarks based on both your own prior use and others’ use, and riskrating scores based on such use.

•

Disciplinary data: information about conduct, disciplinary and grievance investigations, and disciplinary andgrievance matters. It is obligatory that you provide this information to the Company so that it can provide accessto its systems and for the additional Engagement Purposes described below to the extent they apply to yourengagement.

•

Public health data: information relevant to public health, e.g., body temperature, symptoms, recent travel,
potential or confirmed exposure, testing (including results) and vaccination status.
Personal Data contained in communications: such as the types of Personal Data listed above that may becontained in emails, phone calls, video calls, and/or instant messages or chats made or received on any businesstelephone or any Company device or other means of communication that are reviewed in the course of risk
management or compliance activities••

Sensitive Personal Information: We may also collect from you certain types of sensitive Personal Information,such as physical or mental health information, as permitted by local law, for example, in relation to disability
accommodations, or such as sensitive data contained in communications such as email that are reviewed in thecourse of risk management activities.

2. Why We Process Your Personal Data
The Company may use and process Personal Data to enable you to provide services to us under our engagementwith the Vendor, including using and processing the following categories of Personal Data for the following purposes("Engagement Purposes").

2•

To provide performance metrics to the Vendor (as your employer or agency), including assessment of the quality
and quantity of the services provided under our agreement with the Vendor, the Company may process master
data, work contact details, performance data, absence data, and disciplinary data.

•

To provide physical access to Wells Fargo offices/locations and to issue physical access badges, the Company
may process master data, sensitive personal information and work contact details.

•

To maintain and improve effective administration of our engagement with the Vendor, including assigning
projects and tasks, conducting resource analysis and planning, administering project costing and estimates,
managing work activities, and administering compliance trainings, the Company may process work contact details,

IPN CRINP7322 (Rev 11/05/23)

performance data, absence data, and disciplinary data.
•

To maintain a corporate directory, including populating and making available contact details and/or an intranet
website accessible by Company employees and authorized nonemployees to facilitate communication with you,or sharing of information internally. For this purpose, the Company may process Personal Data such as work
contact details, organizational data, and other data you voluntarily submit for these purposes.

•

To maintain information technology ("IT") systems, including implementing and maintaining IT systems,
providing IT support and asset management, maintaining business continuity and recovery plans and processes,
and not limited to adoption of alternative and/or flexible work arrangements and managing security services
and employee access rights, compiling of audit trails and other reporting tools; and identifying patterns in theuse of technology systems and information entrusted to us to protect Company, people and property. For thispurpose, the Company may process Personal Data such as master data, work contact details, computer usage
data, personal data contained in communications, organizational data, Sensitive Personal Data, and disciplinary
data, for example•

To determine your suitability to be engaged, at the time Vendor assigns you to provide services to Wells Fargo
that require access to Wells Fargo’s network to determine whether you appear on Wells Fargo’s and its affiliates’“Do Not Hire” or “Do Not Reengage” lists or to pl ace your Personal Data on the Wells Fargo and affiliates’ “Do Not
Hire” or “Do Not Reengage” lists, if Wells Fargo determines, in its discretion, that you have committed a crime
involving theft, fraud or dishonesty or committed a serious violation of Wells Fargo’s code of conduct orinformation security policies, and maintain the Personal Data on such lists for purposes of future consultation,
Company may process master data and disciplinary data.
To monitor and assure compliance with Wells Fargo's Code of Ethics and Business Conduct, other policies andprocedures, and applicable law, including detecting or preventing possible loss or unauthorized access orprocessing of customer, employee, confidential or restricted data, protecting Company and other party data andassets, mitigating insider trading risk, avoiding actual or perceived conflicts of interest, and meeting regulatory
expectations, conducting internal audits and investigations, handling any potential or other claims, and engaging in
disciplinary actions and terminations. For this purpose, the Company may process Personal Data such as work
contact details, organizational data, contract data, bonus and incentive information, absence data, benefits
information, performance data, employment data, background data, third party data, personal data contained incommunications, Sensitive Personal Data, computer usage data, and disciplinary data, for example.

••

To respond to requests and legal demands from courts, regulators or other authorities, including complying
with requests from courts, regulators or other authorities in your home country or other jurisdictions,and participating in legal investigations and proceedings including domestic and cross-border litigationand discovery procedures, and where permitted or required by law, disclose to third parties such as thepolice and/or other law enforcing authorities without consent, the Company may process master data,
work contact details, emergency contact information, absence data, performance data, computer
usage data, personal data contained in communications, and disciplinary data.

•

To contact your family/partner of any emergencies, protecting the health and safety of employees
and others, and protecting office equipment, facilities and other property the Company may
process master data and emergency contact information.

•

To comply with other employment-related legal requirements, such as income tax, national insurance
deductions, and applicable employment and immigration laws, the Company may process master
data, work contact details, organizational data, visa and work permit data, contract data, andabsence data.
To promote public health and to ensure workplace health and safety, such as in connection with the COVID-19
pandemic, where permitted or required by applicable law, the Company may process Personal Data such as certain•3

IPN CRINP7322 (Rev 11/05/23)

sensitive health and recent travel information, which may include but not be limited to body temperature, symptom,
recent travel, potential or confirmed exposure, testing (including results), and/or vaccination information, andSensitive Personal Data, for example.
The Company will not process Personal Data for any other purpose incompatible with the purposes outlined inthis section, unless it is required or authorized by law, or as authorized by you. For some activities, processing ofcertain Personal Data continues after individuals cease providing services to the Company. Please see Section 4
below for further information about how long we retain Personal Data.

3. Transfers of Your Personal Data to other Recipients
The Company may make Personal Data available to third parties for Engagement Purposes as described in Section 2 asfollows:

4•

Wells Fargo & Company. Since management, human resources, legal and audit responsibility partially rests
with Wells Fargo & Company as the group parent in the United States ("Wells Fargo & Company"), theCompany may make Personal Data available to, or otherwise allow access to such data by, Wells Fargo &Company, which may use, transfer, and process the data for the following purposes: to maintain and improve
effective administration of the workforce; to maintain a corporate directory; to maintain IT systems; tomonitor and assure compliance with the Wells Fargo Code of Ethics and Business Conduct, other policies andprocedures, and applicable laws; and to respond to requests and legal demands from regulators and otherauthorities, including such authorities in the United States.

•

Affiliated Entities. To the extent that your management or human resources responsibility for managing yourengagement partially rests with different Wells Fargo entities ("Affiliated Entities"), the Company may also
make Personal Data available to, or otherwise allow access to such data by, relevant Affiliated Entities, which
may use, transfer, and process the data for the following purposes: to maintain and improve effective
administration of the workforce; to maintain a corporate directory; to maintain IT systems; to monitor andassure compliance with the Wells Fargo Code of Ethics and Business Conduct, other policies and procedures,
and applicable laws; and to respond to requests and legal demands from regulators and other authorities,
including authorities in the jurisdictions where the Affiliated Entities are located. The current Wells Fargo &Company 10-K filing, Exhibit 21, made with the US Securities and Exchange Commission provides a list of theAffiliated Entities as of December 31, 2020 (seehttps://www.sec.gov/Archives/edgar/data/72971/000007297123000071/wfc-1231x2022xex21.htm•

Customers and prospects. As necessary in connection with the Engagement Purposes, work contact details
may be transferred to customers and other third parties.

•

Regulators, authorities, and other third parties. As necessary for the Engagement purposes describedabove, Personal Data may be transferred to regulators, courts, and other authorities (e.g., tax and law
enforcement authorities), lawyers and consultants, independent external advisors (e.g., auditors), and theWells Fargo & Company Board of Directors, Data processors. As necessary for the Engagement Purposes
described above, Personal Data may be shared with one or more parties, whether affiliated or unaffiliated, toprocess Personal Data under appropriate instructions ("Data Processors"). Such Data Processors will be
subject to contractual obligations to implement appropriate administrative, technical, physical, andorganizational security measures to safeguard Personal Data, and to process Personal Data only as instructed.
Data Processors may carry out instructions related to IT system support, training, compliance, and other
legitimate activities, and will be subject to contractual obligations to implement appropriate technical and

IPN CRINP7322 (Rev 11/05/23)

organizational security measures to safeguard the Personal Data, and to process the Personal Data only as
instructed.
•

Business transfers, combinations and related activities. As we develop our business, the Wells Fargo Groupmight sell, buy, acquire, obtain, exchange, restructure or reorganize businesses or assets. In the event of any
actual or proposed sale, merger, reorganization, transaction, restructuring, dissolution or any similar event
involving our business or assets, Personal Data may be shared with the relevant entity or may be part of thetransferred assets and will be subject to any necessary contractual obligations to ensure the protection of
Personal Data.

Access to Personal Data within the Company will be limited to those who need to know the information for Employment
Purposes and will include but may not be limited to your managers and their designees, and personnel in HR, IT,
Compliance, Legal, Finance and Accounting, and in Internal Audit.
All personnel within the Company will generally have access to your business contact information such as name, position,
telephone number, work address, and email address.
The recipients of Personal Data identified in this Section 3 may be located in the United States and other jurisdictions
that may not provide the same level of data protection as your home country. To the extent required by applicable law,
the Company, Wells Fargo & Company, and Affiliated Entities will (i) address any applicable requirement to assure anadequate level of data protection before transferring Personal Data by assuring the execution of appropriate datatransfer agreements or confirming other controls, and (ii) establish that Personal Data will be made available toindividuals within the recipient entities on a need-to-know basis only for the relevant Engagement Purposes describedabove. These measures enable us to transfer and use Personal Data in a secure manner anywhere in the world where wehave an establishment, or where we have contracted third parties to provide us with services. Please contact theapplicable Wells Fargo officer, using the contact information in Section 8, to obtain additional information about these
Safeguards or to make such a request.

4. How Your Personal Data is Safeguarded and Retained
Personal Data will be stored in the databases of Wells Fargo and will be held and maintained by Wells Fargo or on
behalf of Wells Fargo by Wells Fargo service providers. The Company has implemented appropriate technical,
physical and organizational security measures to safeguard Personal Data in accordance with the Company’s
Information Security Policy and standards. When we retain a non-affiliated entity or service provider to perform afunction, that entity will be required to protect workers’ Personal Data in accordance with Wells Fargo’s standards.
The Company’s general practice is not to keep Personal Data longer than necessary for the fulfillment of the purposes
outlined in Section 2, in accordance with our standard records retention periods, or as required or appropriate in thejurisdiction where such records or information is retained. However, we and our service providers may need to hold
Personal Data beyond these time periods for reasons such as to: i) fulfill the purposes outlined in this Notice; ii) comply
with legal or regulatory obligations to which Wells Fargo is subject; or iii) perform a contract duly established with you or
in order to take steps at your request prior to entering a contract. We may need to hold Personal Data beyond retention
periods in response to a regulatory audit, investigation, or other legal matter. These requirements also apply to our third
party service providers. Where required by law, Wells Fargo will anonymize data for additional processing.
Please bear in mind that if, as a result of your engagement you have access to Personal Data of the Company or any of
its controlling, subsidiary or affiliated entities, its clients and/or service providers or any third parties, you are obliged
to maintain the confidentiality of such Personal Data and are prohibited from sharing such Personal Data with third
parties, without authorization of the Company or the individuals. This obligation subsists even after the termination ofyour engagement.

5

IPN CRINP7322 (Rev 11/05/23)

5. Exercising Your Rights Over Your Personal Data
You may have certain rights under applicable local law to know, update and amend your Personal Data and otherrights under local law. These rights may include the rights to request access, correction, suspension of use, porting ordeletion of, or the right to object to the processing of, your Personal Data. These rights are not absolute, andexceptions may apply. If we are not able to accommodate your request, you will be provided with reasons for thedenial. If you have questions about your Personal Data rights please contact your company supervisor who will raise
the queries and concerns with the applicable Wells Fargo officer as listed in Section 8 below.
You may have a right under applicable law to make a complaint about this Notice. Please submit your complaint in writing
to your Company’s supervisor who will submit the complaint with the applicable Wells Fargo officer. We will respond to a
written complaint within 30 days. If you are not satisfied with our response, you may be able to pursue your complaint
with your data protection authority or privacy commissioner for your country.
The Company has appointed a contact person ("Contact Person") to respond to your access and correction requests,
questions and complaints. Please refer to the contact information in Section 8.

6. Monitoring of Systems, Equipment, and Property
To the extent permitted by local law, and subject to any other local notices or policies, the Company reserves the rightto monitor the use of equipment, electronic communication systems, and property, including original and backup
copies of email, instant messaging, text messaging, voicemail, internet use, security door access records, computer use
activity, voice recordings, video recordings, and presentations hosted by Wells Fargo and CCTV. The Company may
engage in such activities to administer IT access, provide IT support, manage security services and access control
authorizations, as well as to monitor, investigate, and assure compliance with the Wells Fargo Code of Ethics andBusiness Conduct and other Company policies and procedures and disciplinary or grievance investigations. The
Company also monitors so to ensure the security of its facilities. You should not expect privacy in connection with youruse of any equipment, systems, or property.
Even if you create or have access to passwords to protect against unauthorized access to correspondence andactivities, using that password does not make the related communications or activities private. In addition, phone calls
made or received on any business telephone may be monitored or recorded for legal, regulatory and compliancepurposes and/or internal investigations.
Monitoring may be conducted remotely or locally, and related Personal Data collected and processed by, the Company,
Wells Fargo & Company, Affiliated Entities, and/or Data Processors using software, hardware or other means. Personal
Data obtained through monitoring may be transferred to regulators and other authorities, as well as the Wells Fargo &Company Board of Directors, and other recipients as necessary for the Engagement Purposes described above, including
recipients in your home country or other jurisdictions. Personal Data obtained through monitoring, which is relevant to
the Engagement Purposes described above, will be retained for reasonable periods to accomplish these purposes, andsubject to any rights nonemployees may have under applicable law.
The Company employs measures to protect against abuse of Personal Data that is used for monitoring, including
appropriate training and supervision of responsible staff, and periodic review of monitoring programs.

7. Updates to this NoticeThis Notice may be modified as a result of amendments to the law or regulations or due to other reasons. In such case,

6

IPN CRINP7322 (Rev 11/05/23)

an amended Notice will be posted on our website at http://www.wellsfargo.com/privacy-security/The page
providing the Notice shall contain a date as to when the Notice was last updated.

8. Who to Contact with Questions About How Your Process
Personal Data is Processed
Please direct requests relating to access, correction, or processing of Personal Data to your company’s supervisor who willraise the queries and concerns with the applicable Wells Fargo officer most applicable to your location.
India Grievance Officer:
Wells Fargo International Solutions
Private Limited
Prasanth P
prasanth.p@wellsfargo.com
Philippines Data Privacy Officer:
Wells Fargo International Solutions LLC –Philippines
Wells Fargo International Clearing
Support Services, LLC- Philippines
Bien Jasfer J Forbes ,1180 Wells Fargo Drive, McKinley Hill, Dr.
Taguig, Philippines
Telephone: (63) (946)-616-3722

Bienjasfer.J.Forbes@wellsfargo.com

7

IPN CRINP7322 (Rev 11/05/23)

Acknowledgement andConsent
I understand that Wells Fargo will collect, use, transfer and disclose the Personal Data about me as described in thisNotice. By signing below or clicking the accept button, if acknowledged electronically, I confirm my consent to thecollection, processing, use, transfer and disclosure of my Personal Data for the purposes and on the terms set
out above and agree that this Notice and Consent supersedes any prior notice on this subject and shall cover all
Personal Data collected or maintained by Wells Fargo in connection with my engagement to perform services
for Wells Fargo.

8

Legal Name (Printed)

Taxpayer ID/SSN

Signature

Date

IPN CRINP7322 (Rev 11/05/23)