Confidentiality and Data Protection
PolicyPolicy Number: 0009

1

Table of Contents
PURPOSE AND STATEMENT OF POLICY ................................................................................ 3
APPLICABILTIY AND SCOPE .................................................................................................... 4
CME GROUP’S RIGHT TO MONITOR ITS INFORMATION RESOURCES................................ 4
DATA CLASSIFICATION REQUIREMENTS AND SECURITY CONTROLS .............................. 4
PRIVACY COMPLIANCE AND PERSONAL DATA .................................................................... 7
DATA SUBJECT ACCESS REQUESTS ..................................................................................... 9
ADDITIONAL REQUIREMENTS FOR CERTAIN REGULATED BUSINESSES ....................... 10
DATA COLLECTED FOR CFTC REGULATORY PURPOSES .............................................. 10
BROKERTEC AMERICAS LLC ............................................................................................... 11
F&O FINANCIAL LLC .............................................................................................................. 12
OTHER REGULATED BUSINESSES ..................................................................................... 12
DATA ACCESS REQUESTS (“DAR”) PROCESS FOR USE AND ACCESS APPROVALS ... 13
SECURE DISPOSITION ............................................................................................................. 14
RESPONSIBLITIES REGARDING CONFIDENTIAL INFORMATION....................................... 14
CME Group Colleagues .......................................................................................................... 15
Third Parties ............................................................................................................................ 15
AVAILABLE RESOURCES AND RAISING CONCERNS ......................................................... 15
OVERSIGHT AND REVIEW OF POLICY .................................................................................. 16
PENALTIES AND CONSEQUENCES ....................................................................................... 16

2

FINALCME GROUP PUBLICLEADING WITH CONVICTION AND INTEGRITYCONFIDENTIALITY ANDDATA PROTECTION
POLICYCME Group Policy Document No. andVersion No.:
Policy Document Issued By:
Policy Document Owner Information:
Date Policy Document Originally Issued:
Date Policy Document Last Revised:

0009
Version 13.0
Corporate Compliance
Information Governance and Privacy
Corporate Compliance
November 2013
July 2024

PURPOSE AND STATEMENT OF POLICYCME Group is committed to protecting its proprietary, confidential and personal data, including
information relating to its business, customers, vendors, strategic partners, employees andother third parties.
CME Group has adopted this Policy to set forth a framework so that:•

Information, including CME Group Information (defined below) is evaluated andproperly classified based upon the sensitivity and criticality of the information;•

Information is protected and managed based upon its classification;•

Personal Data (defined below) is collected, used, maintained and disposed of incompliance with legal and regulatory requirements; and•Additional considerations are taken into account for certain regulated businesses.

This policy sets forth the requirements related to the following:•

CME Group’s Right to Monitor its Information Resources•

Data Classification Requirements and Security Controls•

Privacy Compliance and Personal DataoData Subject Access Requests•

Additional Requirements for Certain Regulated Businesses•

Data Access Request (“DAR”) Process for Use and Access Approvals•

Secure Disposition•

Responsibilities Regarding Confidential Information•

Available Resources and Raising Concerns

3

APPLICABILITY AND SCOPE
This Policy applies to the CME Group organization, including those entities where CME Grouphas controlling ownership of the entity (collectively, “CME Group” or the “Company”). This
Policy applies to all employees, internal consultants, and temporary personnel of CME Groupand any authorized third-party with physical or logical access to CME Group, collectively
referred to as “Colleagues.” The responsibility to protect CME Group Information continues
even after termination of employment or service to the Company. This Policy governs thehandling of proprietary and confidential information relating to Colleagues, clients, vendors,
strategic partners, distributors, subscribers, shareholders and other third parties.
Regardless of format (e.g., verbal, hardcopy, electronic), CME Group Information must be
protected in a manner commensurate with its classification. For purposes of this Policy, theterm “CME Group Information” means any information classified as CME Group Internal,
CME Group Confidential and CME Group Highly Sensitive. These standards apply to any
access to and/or use of CME Group Information regardless of the method or device used toaccess the information. Further guidance can be found in the Information GovernanceFunctional Standard on the management of CME Group Information.

CME GROUP’S RIGHT TO MONITOR ITS INFORMATION RESOURCESCME Group has implemented a number of policies and procedures consistent with applicablelaw to protect the confidentiality, integrity, and availability of CME Group’s Information
Resources (as defined in the Information Technology Glossary). To support these efforts,
CME Group reserves the right to take possession, access, review, monitor, intercept, or conduct
surveillance on any content or materials located on any CME Group Information Resource that
may contain CME Group Information, in accordance with applicable law. CME Group resources
should only be used for CME Group business-related purposes. Personal use of CME Group
Information Resources should be limited to incidental use. CME Group may actively monitor
communications relating to regulated entities or to safeguard CME Group, in accordance withapplicable law.
CME Group may record certain verbal (e.g. telephone, web conferencing) conversations, inaccordance with regulations and applicable law. The purposes of such recordings are to provide
verification of customer transactions entered in connection with CME Group business, to protect
the organization against misconduct, to fulfill a regulatory requirement, or for general business
operations (e.g. team meetings, trainings, etc.). Advance notification should be provided alongwith the purpose of the recording prior to the recording commencing.
In accordance with regulations and applicable law, CME Group may provide information
obtained in the course of its monitoring activities to a third party, including regulators and law
enforcement agencies.

DATA CLASSIFICATION REQUIREMENTS AND SECURITYCONTROLS
Data classification is the process of assigning a level of sensitivity to information anddetermining the controls and security measures required for each classification.
4

The Company has established the following FOUR classifications to apply controls and security
measures in an efficient, repeatable and structured manner:
Public1: Information available to the general public and/or created with the intention forbroad distribution outside the Company. This information may be freely disseminatedinside and outside the Company.
→ Examples of Public Information: marketing brochures, advertisements,press releases, published annual reports and content published towww.cmegroup.com.
→ Examples of Controls and Security Measures: minimal security measuresdesigned to ensure the availability and integrity of the information.
CME Group Internal2: Information belonging to the Company created in the normal
course of business with the intention of broad, general distribution within the Company,
but not externally. Information classified as CME Group Internal should not be sharedpublicly or outside the Company, except where there is a legitimate business need.
→ Examples of CME Group Internal Information: new employee training
materials, compliance policies for the general population and all employee
communications.
→ Examples of Controls or Security Measures: minimal security measures toensure the information is not distributed outside of the Company unless such
distribution is in accordance with a valid business need, in furtherance of theinterests of the Company, in accordance with application licenses orsubscriptions, or you have permission to do so based on your role.
CME Group Confidential3: Information not broadly made available to the organization,such as information maintained solely within a single Department or Division.
This includes information sensitive to the Company or a third party (e.g., a client) andshould only be shared with individuals inside the Company on a “need to know” basis,
meaning the individual needs access to the information to perform their assigned job
functions. Improper disclosure of the information could harm or adversely impact theCompany, its clients or employees, or could result in a breach of our regulatory or legal
obligations. It is expected that most of the Company’s information will be classified
as CME Group Confidential and the security measures required will vary based on
the sensitivity of the content of the information.
→ Examples of CME Group Confidential Information: individual Department
information, information made available through a license or subscription,

1 NEX legacy classification equivalent, Public.
2 NEX legacy classification equivalent, Internal Use or Confidential-Sensitive.
3 NEX legacy classification equivalent, Confidential or Confidential – Highly Sensitive5

information protected by confidentiality agreements, client contact information,
annual budget, and strategic plans that are not material to the stock price.
→ Examples of Controls and Security Measures: Security measures must be
designed to preserve the confidentiality and integrity of the information based on
the degree to which the disclosure of the information or impairment of its integrity
would harm or adversely impact the Company, its clients, employees or otherstakeholders, or result in legal liability as discussed below. For example, do notleave CME Group Confidential information in hardcopy form unattended and/or
unsecured. Electronic versions should be saved to designated repositories withlimited access and/or password protection/encryption and transmitted using asecure company-approved method. It is the responsibility of the Information
Asset Owner (as defined in the Information Technology Glossary) to determine
the appropriate protections.
CME Group Highly Sensitive4: Information where the unauthorized internal or external
access to, alteration or inappropriate destruction of the information could have significant
harm or an impact on the Company, its clients, employees or other stakeholders. Data
integrity is extremely vital, and the highest possible levels of confidentiality,
restricted access and security measures are essential. Refer to the Frequently
Asked Questions – Confidentiality Policy for additional information.
→ Examples of CME Group Highly Sensitive Information: transaction records
including trade-related data, client or clearing firm position data and order andmessaging data, Regulatory Data (defined below), credit card information, social
security numbers, bank account information, employees’ medical information or
health insurance information, F&O Financial Sensitive Information (as defined
below) and other sensitive Personal Data.
→ Examples of Security Measures: information classified as CME Group
Highly Sensitive must be subject to the highest security protections available,
such as encryption, and access controls that are implementable based on theinformation and system at issue.
Data classifications must be applied to all data and also must be applied to services andapplications. When applying a classification to a service or application, the classification shalltake on the highest level of classification associated with the data; e.g. if an application contains
data that is public and data that is CME Group Confidential, then the classification will be CMEGroup Confidential.
When determining the classification of a service or application, you should consider thesensitivity of all of the following data: any data that is held by the service or application, alldata that passes through the service or application, all data that the service or application has
control over permissions, and all data that the service or application oversees management of(including backup and recovery).

4 NEX legacy classification equivalent, Secret or Confidential – Extremely Sensitive6

Information classified as CME Group Confidential and CME Group Highly Sensitive may only beprovided outside of CME Group in accordance with established authorization procedures andthen only transmitted or shared through secure means, protected against tampering oralteration, and, as applicable, subject to legal protective measures, such as Non-Disclosure
Agreements. If you need guidance as to whether a transfer is authorized, contact Information
Governance Team.
If you need help determining the safest method to store or transfer Confidential or Highly
Sensitive Information, contact Information Governance Team. For additional security
measures refer to the Confidentiality Policy FAQ.
All Colleagues have responsibility for protecting CME Group’s information. Those who create,
maintain, control or manage access to CME Group Information Resources, such as certain
applications, have accountabilities as Information Asset Owners and Information Asset
Custodians (as defined in the Information Technology Glossary). Everyone must do their partto ensure information is classified and appropriate safeguards are applied to protect the
integrity, availability and confidentiality of CME Group Information. All CME Group office spaces
are secure and additional access limitations may apply within certain Departments or functions.
Even in secure areas, extra precautions must be taken to protect confidential and highly
sensitive information either electronically or physically. Appropriate precautions must also betaken when working remotely.
Please see the Frequently Asked Questions - Confidentiality Policy for additional guidance,
including specific examples of the type of information belonging to each of the fourclassifications, security measures to safeguard information, reasonable steps you should take toensure its protection, process for seeking approval for access to certain data or the transfer or
copying of CME Group Confidential or CME Group Highly Sensitive Information.
If you are uncertain of the appropriate classification, assume at a minimum it is CME
Group Confidential. You may contact the Information Governance Team if you haveadditional questions regarding the classification process or the classification of particular
information.
Any disposal of CME Group Information should be conducted in accordance with the retention
requirements of the Records and Information Management Policy and as discussed below
under Secure Disposition.

PRIVACY COMPLIANCE AND PERSONAL DATA
Personal Data (also referred to as personal information or personally identifiable information)means any information that can be used to identify a person. This includes any direct identifiers
such as a name and contact details, but also indirect identifiers such as information that may becollected from an electronic device or an alias.
Personal Data includes, but is not limited to, name, email address, phone number, address,
birthdate, social security number, driver’s license number, other government issued
identification number, financial account information, medical and health information, usernames
and passwords, IP address, employment information, demographic information, and7geographical indicators. Examples of Personal Data held by CME Group about its Colleagues
and other individuals such as candidates for employment are:•Financial information•

Government issued identification documents•

Employment information•

Medical / Health information

Personal Data must be appropriately secured and retained based on its classification. CME
Group adheres to the following privacy principles:→ Transparency: Express or implied consent may be required before obtaining
Personal Data. When required, the individual providing the Personal Data should bemade aware of the type of Personal Data being collected and the relevant;→ Purpose Limitation: Personal Data should only be collected for specific, legitimate,
and lawful purposes. Personal Data should only be collected if it is directly relevant andnecessary to accomplish the specific business purpose(s);→ Data Minimization: Personal Data should only be collected if it is directly relevant
and limited to what is necessary to accomplish the specific purpose(s);→ Accuracy: Personal Data should be accurate, complete, and current. Personal Data
that is incomplete, inaccurate or outdated should be corrected;→ Storage Limitation: Personal Data should only be maintained for as long as it isnecessary to fulfill the specified purpose(s). Personal Data should be destroyed
appropriately as specified by the Records and Information Management Policy andas discussed below under Secure Disposition;→ Confidentiality: Appropriate security safeguards, in accordance with this Policy andthe Corporate Information Security Policy, should be put in place to protect Personal
Data from known and unknown threats and to minimize the risk of unauthorized access,disclosure, loss, or destruction; and→ Access: Upon request, Personal Data should be made accessible to the individual.
The individual should have the ability to correct any inaccuracies or request destructionof his or her Personal Data. Personal Data may not be destroyed if it is required to be
maintained for legal, regulatory, or business purposes. Refer to Global Privacy – Data
Subject Access Requests for further details.
Any unauthorized access, whether intentional or unintentional, of Personal Data should bereported to Cyber Defense Monitoring immediately. You may limit further exposure, but do nottake any additional remediation actions until you have spoken to a CME Group privacy orinformation security representative.

8

CME Group may collect, use, maintain and disclose Personal Data about an individual to carryout its business activities. For more information about how CME Group collects, uses, discloses,
and protects Personal Data, see the Privacy Center.

DATA SUBJECT ACCESS REQUESTS
Individuals, including those working for CME Group, third parties or clients, may ask CMEGroup to provide them with the information we collect, use and maintain about them. This is
known as a Data Subject Access Request (“DSAR”) and must be handled promptly and in a
specific manner to comply with relevant privacy laws.
DSARs can take on different forms. Any written inquiry that asks for information held about theperson making the request can be construed as a DSAR. DSARs include requests to access,be provided copies of, modify, restrict further processing of, or delete Personal Data.
The following are likely to be considered a DSAR:•“Please send me a copy of my employment records.”•“I have a right to see all the invoices issued to me for the last three years. Please sendcopies to me.”•“Please send me any documents or correspondences relating to any work you havecompleted with me.”

Immediately forward all requests, even if you are not sure you have received a DSAR, to thePrivacy Compliance team for review, particularly if it relates to a client or a third party. If therequest involves a current or former Colleague, immediately forward the request to Human
Resources.
If you receive a phone inquiry asking you to disclose any Personal Data (e.g. contact details
relating to a third party or a Colleague), please be aware that you should only disclose thisPersonal Data once the following conditions have been met:•

The caller’s identity has been verified to ensure that the information is only provided tosomeone who is authorized to receive it; and•The scope of the requested data is reasonable based upon the business justification forrequesting the data.

If you feel that you are unable to verify the identity of a caller, please take down his/her contact
details and check internally. Alternatively, ask the caller to submit their request in writing.
Should you have any doubt or questions regarding a request, please direct your questions to
Privacy Compliance.

9ADDITIONAL REQUIREMENTS FOR CERTAIN REGULATEDBUSINESSES
1. DATA COLLECTED FOR CFTC REGULATORY PURPOSESCME Group currently operates four U.S. designated contract markets (“DCMs”)5, global
trade repositories (“Trade Repositories”) and a Swap Execution Facility (“SEF”). Thesebusinesses are subject to regulations that apply additional use restrictions to certain typesof information collected by the DCMs, the Trade Repositories and the SEF.
Information that meets the definition of Regulatory Data may not be used for business ormarketing purposes or distributed outside of the CME Group organization unless themarket participant who provided it to the DCM, Trade Repository or SEF has clearly
consented to the use of such data in such manner.
The definition of CFTC Regulatory Data for these purposes is limited to proprietary data or
Personal Data collected, maintained or received by a DCM, Trade Repository or the SEF
for the purposes of fulfilling its regulatory obligations. More specifically, Regulatory Data
includes:•Derivatives Clearing Organization records – Records of all activities related to theclearing and settlement activities of the derivatives clearing organization, including all
cleared transactions, margin levels, value and adequacy of financial resources, andthe establishment of settlement prices.

•

Detailed regulatory transaction data ─ Trade data maintained by the Market
Regulation Department including order and messaging data at the specific account or
customer level.

•

Financial information ─ Financial records and other information collected by the
Financial and Regulatory Surveillance Department during the course of regulatory
and fee examinations, and member or participant due diligence reviews, and any
information received by the Company from third-party depositories of clearing
members in its capacity as a designated self-regulatory organization (“DSRO”).

•

Investigative materials ─ Information collected by the Market Regulation
Department as part of surveillance activities or investigations of potential ruleviolations.

•

Position data ─ Reports of large positions collected pursuant to
CME/CBOT/NYMEX/COMEX Rule 561 (Reports of Large Positions), records ofrequests for exemptions from position limits collected pursuant to Rule 559 (Position
Limits), and records collected pursuant to Rule 560 (Position Accountability).

•

Trade Repository data – Any information received or maintained by the Trade
Repositories for the purposes of complying with applicable regulatory reporting5

CME Group’s DCMs are permitted to share “Regulatory Data” with other DCMs or swap execution facilities
registered with the Commodity Futures Trading Commission (“CFTC”) for regulatory purposes with or without
customer consent.

10requirements, that is not subject to public reporting. For avoidance of doubt, any data
received or maintained in the regular course of business outside of a Trade
Repository does not become Regulatory Data for purposes of this Confidentiality
Policy merely because it is also received or maintained by a Trade Repository.
All CFTC Regulatory Data is classified as CME Group Highly Sensitive Information.
Note that the use restrictions that prevent Regulatory Data from being used for “business”
or “marketing” purposes would not prevent appropriate internal uses of Regulatory Data byauthorized personnel. “Business” purposes do not include: activity aimed at compliancewith the Commodities Exchange Act or any other applicable law or regulation; market
regulation; clearing; risk management; market operations; market and product researchand development; and performance monitoring in connection with ensuring effective
operations and integrity of the marketplace. For example, Regulatory Data collected by the
Financial and Regulatory Surveillance Department could be shared with CME Clearing risk
management staff for the purpose of operating CME Group’s clearing house business
function in compliance with CFTC Core Principles related to risk management. Other usesof Regulatory Data must be authorized by the CME Group Data Access Review Team.
Finally, the Regulatory Data received by the Trade Repositories is also subject to certain
special access restrictions. This information can be accessed internally only by individuals
who are duly authorized or who are otherwise operating pursuant to a documented Service
Level Agreement, and in such cases only to the degree that such access is necessary for
those individuals to perform their assigned job responsibilities. Additionally, in appropriate
circumstances, counterparties to a trade (with certain limitations) housed by a Trade
Repository and certain approved regulators as set forth in the Global Repository Services
Access Policy may also be allowed to access Regulatory Data received and maintained bya Trade Repository. For questions, please refer to OpenExchange for the contact detailsof our Regulatory Compliance Officers.

2. BROKERTEC AMERICAS LLC
BrokerTec Americas LLC (“BTEC”) operates as an alternative trading system (“ATS”)6
registered with the U.S. Securities and Exchange Commission and has established andmaintains safeguards and procedures limiting access to any confidential or highly-sensitive
trading information of subscribers to those who are operating the ATS or responsible for its
compliance with applicable rules.
Subscriber confidential trading information includes, but may not be limited to:•Orders and order detail information;•

Trades and execution detail information; and•Any information that cannot be ascertained by subscribers from directly looking at theATS’s screens at the time subscribers submit their information to the ATS.

6 SEC Regulation ATS Rule 301(b)(10).

11Only Colleagues who provide services to assist BTEC’s ongoing operations will be eligible
to receive access to confidential trading information, to perform their job functions. If you are
confirmed to be eligible to have access to BTEC confidential trading information, you may
not use it for any other purpose other than for the business function for which access wasprovided and you may not share that information with unauthorized persons. Individuals who
receive access may be subject to certain additional monitoring requirements.
Initial requests to receive confidential trading information of BTEC subscribers should besubmitted through the Data Access Review process.

3. F&O FINANCIAL LLC
F&O Financial LLC (“F&O Financial”) operates as a futures commission
merchant (“FCM”) registered with the CFTC and has established access to thenon-public information of its customers to those who are running the FCM or who
are responsible for its compliance with applicable rules.
Non-public customer information, referred to as F&O Financial Sensitive Information,
includes but may not be limited to:•

Customer detailed position information;•

Customer personal information; and•Customer balances or margin amounts.

Only Colleagues who provide services to assist the FCM’s ongoing operations will
be eligible to receive access to F&O Financial Sensitive Information, and only ifaccess to such information is necessary to perform their job function at the FCM
or supervising the FCM. If you are confirmed to be eligible to have access to F&O
Financial Sensitive Information, you may not use it for any other purpose otherthan for the business function of the FCM for which access was provided and you
may not share that information with unauthorized persons. Individuals who receive
access may be subject to certain additional monitoring requirements.
Initial requests to receive F&O Sensitive Information should be submitted through the Data
Access Review process.
4.

OTHER REGULATED BUSINESSESCME Group has a number of additional regulated businesses, including those regulated by
the Financial Conduct Authority and the Netherlands Authority for the Financial Markets.
Each of our regulated entities have regulatory requirements limiting the access and use of
information, and this Policy has considered the requirements under the relevant regimes. By
protecting and preserving CME Group Information in accordance with this Policy, Colleagues
help to ensure that the Company continues to meet its confidentiality obligations stemmingfrom various regulations. If you have any questions about our regulatory obligations withregards to the use or access of information, please reach out to Corporate Compliance.
12Please refer to OpenExchange for additional guidance on data related to certain businesses
and partnerships.

DATA ACCESS REQUESTS (“DAR”) PROCESS FOR USE AND
ACCESS APPROVALS
Access and use of CME Group Confidential or CME Group Highly Sensitive data should bestrictly limited to Colleagues that have a business reason to access and/or use the information.
If a Department, team, or Colleague requires access to CME Group Confidential or CME Group
Highly Sensitive data for a new business purpose, requests should be submitted through theData Access Request (“DAR”)7 process for review and consideration. The DAR team iscomprised of representatives from Legal, Compliance, Market Regulation, Information Security,
and Data Management. DAR will determine if the request should be approved as is, approved
with modifications, or declined, and will indicate what controls or other security measures are
required to allow the use or access. In making its determination, DAR will assess the type of
information the individuals proposed to obtain access to and how the information will be used
and will consider any regulatory or contractual considerations. Please refer to OpenExchange
for additional guidance on data related to certain businesses and partnerships.
Examples of requests that should be submitted to DAR include (but are not limited to) the
following:•a business need to use or combine datasets that have not previously been brought
together, providing new insights which are not available when reviewing the datasets
individually;•

access to data that has not previously been granted to a particular Department, team, orColleague, specifically as it relates to the regulated businesses;•

a novel use of data of the regulated businesses, even if the Department or Colleague
involved already has access to such data; or•creation of a new report intended to be shared externally that is not available to thegeneral public.

If a request is approved, Colleagues may not use the information for any other purpose beyond
what was specified in the approval from DAR. Any access or use granted by DAR to a specific
Department, team or Colleague may not be shared with others without first obtaining additional
approval from DAR, even with Colleagues who are part of your same Department or team.
When in doubt, please refer questions to Privacy Compliance or DAR Admin, who can assist
with determining whether a DAR review is necessary.

SECURE DISPOSITION
To reduce the risk of exposing CME Group Information to unauthorized persons or for
unintended purposes (e.g. data breaches, identity theft, fraud, software license violations, or
exposure of proprietary or trade secret information), all Information Assets and Information
Resources should be properly destroyed or cleansed of CME Group Internal, CME Group
7 DAR requests should be submitted through Archer GRC, Information Governance – DAR: General User, Create

New DAR.

13

Confidential and CME Group Highly Sensitive data using methods that render the data
unreadable and non-recoverable by any means.
This applies to Information Assets and Information Resources (both as defined in the
Information Technology Glossary) such as computers, technology equipment and otherelectronic or physical media capable of displaying, collecting, or storing CME Group Information
regardless of final disposition (e.g., destruction of devices or data, donations, recycling, returns,
resale, and repurpose by internal or external parties).
CME Group has set forth a framework designed to ensure:•

Information Assets and Information Resources use methods for disposal that render the
information irretrievable and incapable of being reconstructed by any reasonable means;•

Corporate assets and information are properly identified and have met the retention
requirements as outlined within the Records Retention Schedule or applicable Legal
Hold Notices; and•Prior to final disposition reasonable attempts are made to secure the Information Assets
and Information Resources at all times.

Disposal of physical materials:•

All CME Group owned and managed facilities are equipped with secure shredding
consoles or electronic cross-cut shredders.

•

CME Group materials should never be placed in recycling or garbage receptacles.

•

Physical materials such as paper, photos, booklets, and some small media (flash drives,
tapes, CDs, etc.) must be placed in secure consoles or shredders to ensure secure
disposition.

If you have questions regarding the disposal of physical materials, contact the Information
Governance Team.
Disposal of electronic assets & content:•

All CME Group owned and managed assets (laptops, desktops, mobile devices, servers,
SAN, etc.) are to be securely destroyed by authorized personnel only.

•

For disposal of assets or secure disposition of content, please contact Customer Support
Group for assistance, at +1 312 930 3444 or e-mail.

RESPONSIBLITIES REGARDING CONFIDENTIAL INFORMATION
CME Group Colleagues
CME Group Confidential and CME Group Highly Sensitive information fall under the definition of“Confidential Information” as defined in the Acknowledgement and Acceptance ofConfidentiality and Intellectual Property Policy and/or an applicable employment agreement(collectively, the “Confidentiality Agreement”) signed at the beginning of employment with, or
14

provision of services to, CME Group. Accordingly, you are obligated by your Confidentiality
Agreement to hold all CME Group Confidential and CME Group Highly Sensitive information in
the strictest confidence, and to take reasonable precautions to prevent the unauthorized
disclosure of such information.
If you inadvertently send Personal Data, CME Group Confidential or CME Group Highly
Sensitive information to an unintended third party, internal or external, contact Cyber Defense
Monitoring immediately. We ask that you do not attempt to resolve the matter directly.
If you receive any subpoena or become subject to any legal obligation to disclose any CME
Group Confidential or CME Group Highly Sensitive information that is not part of your regularresponsibilities at CME Group, you must contact Corporate Compliance or a litigation attorneyin the Legal Department and comply with any objections made by the Company regarding suchdisclosure obligations.
Certain employees are required to execute a Confidentiality, Non-Competition and NonSolicitation Agreement that contains similar undertakings regarding the preservation andsafeguarding of such information.
Nothing in this Policy, the Confidentiality Agreement or the Confidentiality, Non-Competition and
Non-Solicitation Agreement (if applicable), prohibits you from communicating with any
governmental authority or making a report in good faith and with a reasonable belief of any
violations of law or regulation to a governmental authority, or from filing, testifying or
participating in a legal proceeding relating to such violations, including making other disclosuresprotected or required by any whistleblower law or regulation to the Securities and Exchange
Commission, the Department of Labor, or any other appropriate government authority.
Third Parties
To the extent CME Group engages a third party vendor to provide services that include hostingor processing any information classified as CME Group Confidential or CME Group Highly
Sensitive, the business owner of the relationship and representatives from Legal, Complianceand from the Third Party Risk Management (“TPRM”) Risk Assessment process (asappropriate) must review the vendor’s process and controls against the standards of this Policy.
Corporate Procurement can assist with arranging for the required reviews when engaging
such vendors. Please allocate sufficient time for the completion of such reviews which will vary
based on the complexity of the engagement.

AVAILABLE RESOURCES AND RAISING CONCERNSQuestions regarding this Policy should be directed to Corporate Compliance. Suspectedviolations of this Policy, including any inappropriate use, disclosure, destruction, theft or loss of
CME Group Confidential or CME Group Highly Sensitive Information (including Regulatory Data
and Personal Data) whether intentional or inadvertent, must be raised in accordance with the
Speak Up and Escalation Policy and your obligations under your Confidentiality Agreement,
including reporting to the CME Group Compliance & Ethics Helpline. Your timely reporting isnecessary and important to ensure the Company can appropriately respond to any
15inappropriate data disclosure or breach in accordance with applicable legal and regulatory
requirements.

OVERSIGHT AND REVIEW OF POLICYThis Policy is subject to the oversight of the Global Corporate Compliance & Ethics Team. CME
Group will periodically review and monitor compliance with this Policy as necessary andappropriate. Colleagues are required to execute periodic certifications of compliance with thisPolicy, as well as attend any required educational programs associated with this Policy. This
Policy is subject to review on an annual basis.

PENALTIES AND CONSEQUENCES
Breaches of CME Group’s commitments as set forth in this Policy can have serious
repercussions on many levels, including legal and regulatory consequences and damaging theCompany’s reputation. Potential violations of this Policy will be subject to investigation by CME
Group, and any failure to comply with this Policy may result in discipline, up to and including
termination, referral to regulatory authorities, and potential civil and criminal exposure.

16