CAPABILITIES EXPERTISE INSIGHTS PEOPLE CONTACT US Privacy Notice Last Updated: May 6, 2020 Equal Opportunity Monitoring: to ensure that our recruitment processes are aligned with our commitment to ensuring equal opportunities. Some of the data we may collect about you (in appropriate circumstances and in accordance with applicable local law) falls under the umbrella of “diversity information”. This could be information about your ethnic background, gender, disability, age, sexual orientation, religion or other similar beliefs, and/or social-economic background. Some of this information is considered ‘sensitive’ personal information and as such, slightly stricter data protection will apply. Where required by law, we will obtain your explicit consent before we use it. Where appropriate and in accordance with local laws and requirements, we will use this information to provide our Clients with diverse pools of qualified Candidates. We may also disclose this data (suitably anonymized where appropriate) to Clients where this is contractually required or the Client specifically requests such information to enable them to comply with their own employment processes or legal requirements – but again, only where in accordance with applicable local law. We may also collect other sensitive personal information about you, such as health-related information, religious affiliation, or details of any criminal convictions if this is appropriate in accordance with local law and is required for a role for which we are recruiting you. We will never do this without your explicit consent. CLIENT DATA: We typically use Client data for the following purposes: (1) Search & Leadership Advisory Activities: to provide the Services to your organization; to manage our relationship and account with you and your organization; and/or for our other business purposes such as data analysis, identifying usage trends, creating anonymized data sets for research, statistics and analytics purposes, creating knowledge pieces (like white papers), determining the effectiveness of our Services, and/or to enhance, customize, and improve our features, products, and services. (2) Marketing Activities: to send you information (such as reports, promotions, research, white papers, and event invitations) that we think you may find interesting (in each case, where this is in accordance with your marketing preferences). REFEREE DATA: We use Referee Data to obtain your opinion regarding Candidates in the course of providing the Services to our Clients. In addition, we may use your details to contact you in relation to any of our Services that we think may be of interest to you as a potential Client or Candidate. SOURCE DATA: We use Source Data to identify and gather information on potential Candidates in the course of providing the Services to our Clients. In addition, we may use your details to contact you in relation to any of our Services that we think may be of interest to you as a potential Client or Candidate. VENDOR DATA: We typically use Vendor Data: (i) to store (and update when necessary) your details in our database, so that we can contact you in relation to our agreements; (ii) to obtain support and services from you; (iii) to perform certain legal obligations; (iv) to help us target appropriate marketing campaigns; and (v) to help us establish, exercise, or defend legal claims. 3. DATA COLLECTED VIA OUR WEBSITE This Section applies to personal information that we collect and process through our Website in the usual course of our business, such as in connection with our events and marketing activities. What Personal Information Do We Collect? Information you provide to us: Certain parts of our Website may ask you to provide personal information voluntarily, for example, we may ask you to provide your contact details (like your name, email address, and phone number) to complete surveys, subscribe to marketing communications (like newsletters), submit inquiries, and/or otherwise communicate or interact with us. We may also collect personal information from you offline, such as when you attend one of our events. You are not obligated to provide RRA any information or participate in any of the Services we offer. As such, we will consider any information we collect directly from you as having been provided voluntarily. If, however, you are unwilling to provide us with certain requested information, please understand that this may limit your ability to participate in the Services. Information we collect automatically: When you visit our Website, we may collect certain information automatically from your device. In some countries, including countries in the European Economic Area, this information may be considered personal information under applicable data protection laws. Such automatically collected information may include your IP address, device type, unique device identification numbers, browser-type, broad geographic location (e.g., country or city-level location) and/or other technical information. We may also collect information about how your device has interacted with our Website, including the pages or content accessed and links clicked. Collecting this information enables us to better understand the visitors who come to our Website, where they come from, and what content on our Website is of interest to them. We use this information for our internal analytics purposes and to improve the quality and relevance of our Website to our visitors. Some of this information may be collected using cookies and similar tracking technology, as explained further under the heading “Cookies and Similar Tracking Technology” below. Social Media Widgets: Our Website includes social media features, such as social media widgets that link to a social media website or allow you to share website content. These features may collect your IP address, which page you are visiting on our Website, and may set a cookie to enable the feature to function properly. Social media features, such as widgets, are either hosted by a third party or hosted directly on our Website. Your interactions with these features are governed by the privacy policy of the company providing it. How Do We Use Your Personal Information? We typically use the personal information we collect through our Website in the usual course of our business for the following reasons: (i) to respond to a request that you sent us, such as a request for information about our Services; (ii) to administer, protect, and improve our Website and our Services; (iii) to better understand the preferences of our Website visitors; (iv) to compile aggregated statistics about Website usage; (v) to provide you with marketing and promotional communications (where this is in accordance with your marketing preferences); and/or (vi) for other business purposes such as data analysis, identifying usage trends, determining the effectiveness of our marketing, and enhancing, customizing and improving our Websites, products and services. Cookies and Similar Tracking Technology Like many Websites, we use cookies or other similar technologies to collect and use personal information about you. Please see our Cookie Notice at www.russellreynolds.com/cookie-notice for further information 4. GENERAL INFORMATION How We Share Your Information We may share your personal information with the following types of third parties for the purposes described in this Notice: We freely share your information with our group companies. Your information is maintained on RRA’s global database, which is secure and accessible only to RRA employees worldwide. A current list of our group companies is available here. We may share your information with any competent law enforcement body, regulatory or government agency, court or other third party where we believe disclosure is necessary as a matter of applicable law or regulation; to exercise, establish, or defend our legal rights; or to protect your vital interests or those of any other person. In the case of Candidates, Referees, and Sources, we may share your information with Clients who will need to process your information for the purposes we have described in this Notice. In the case of Candidates, we may share your information with third parties who we have retained to provide services such degree and/or license verification checks, to the extent that these checks are appropriate and in accordance local laws. Similarly, for Candidates we may share your information with Sources and Referees with whom we liaise in connection with providing the Services to our Clients. For Sources and Referees, we endeavor to keep your information confidential from the Candidates you discuss with us, but under limited circumstances, your information may be disclosed to them. We may share your information with third party service providers (our Vendors) who perform functions on our behalf (including external consultants, business associates and professional advisers, such as lawyers, auditors, accountants, technical support providers, and third party travel agencies, outsourced IT and document storage providers). We may share your information with a potential buyer (and its agents and advisers) in connection with any proposed purchase, merger, or acquisition of any part of our business, provided that we inform the buyer it must use your personal information only for the purposes disclosed in this Notice. We may share your information with our marketing partners to send emails on our behalf. We may share information with any other person with your consent. Please be assured that we do not use your information for purposes that are incompatible with those set forth in this Notice. International Data Transfers Your personal information may be transferred to, and processed in, countries other than the country in which you are resident. These countries may have data protection laws that are different from the laws of your country (and, in some cases, may not be as protective). Specifically, our servers are located in the United States, Germany, and Singapore, and our group companies and third party service providers and partners operate around the world. This means that when we collect your personal information we may process it in any of the countries where our group companies and service providers are located. However, we have taken appropriate safeguards to require that your personal information will remain protected in accordance with this Notice. These include implementing the European Commission’s Standard Contractual Clauses for transfers of personal information between our group companies, which require all group companies to protect personal information they process from the EEA in accordance with European Union data protection law. Our Standard Contractual Clauses are available upon request. We have implemented similar appropriate safeguards with our third party service providers and partners and further details are available upon request. Legal Basis For Processing Personal Information (If You Are Resident in the EEA) If you are resident in the European Economic Area, our legal basis for collecting and using the personal information described above will depend on the personal information concerned and the specific context in which we collect it. However, we will normally collect personal information from you where the processing is in our legitimate interests and not overridden by your data protection interests or fundamental rights and freedoms (for example, in connection with the Services, we typically rely on our legitimate interests to process personal information for our Search & Leadership Advisory Activities and where permitted by law, certain marketing activities). When required by law, we will collect personal information only where we have your consent to do so (for example, if we need to collect and process any sensitive personal information about you). In some limited cases, it may be necessary for us to process personal information and, where appropriate and in accordance with local laws and requirements, sensitive personal information, in connection with exercising or defending legal claims (for example, where we need to take legal advice in relation to legal processing or are required by law to preserve or disclose certain information as part of the legal process). If you have questions about or need further information concerning the legal basis on which we collect and use your personal information, please contact us using the contact details provided under the Section headed “How To Contact Us” below Your Data Protection Rights You have the following data protection rights: If you wish to access, correct, update, or request deletion of your personal information, you can do so at any time by contacting us using the contact details provided under the Section headed “How To Contact Us” below. Consistent with applicable law, when asked to remove a record from our database, RRA will retain minimal personal information in order to prevent future contact, to keep a record of the information disclosed to our Clients and Candidates, and to preserve RRA’s interests in accordance with any applicable legal requirements. If you are a California resident, you can submit a request to exercise your access and deletion rights with respect to your personal information via our webform here or via our toll free number at 1-800-547-0804. Please note that before processing your request, we may take reasonable steps to verify your identity. In addition, if you are a resident of the European Economic Area, you can object to processing of your personal information, ask us to restrict processing of your personal information, or request portability of your personal information. Again, you can exercise these rights by contacting us using the contact details provided under the Section headed “How To Contact Us” below. You have the right to opt-out of marketing communications we send you at any time. You can exercise this right by clicking on the “unsubscribe” or “opt-out” link in the marketing e-mails we send you. To opt-out of other forms of marketing (such as postal marketing or telemarketing), please contact us using the contact details provided under the Section headed “How To Contact Us” below. Similarly, if we have collected and processed your personal information with your consent, then you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal information conducted in reliance on lawful processing grounds other than consent. If you withdraw your consent to our Notice, you will not be able to be a part of a RRA search, assessment or leadership project. Residents of California have the right to know what categories of personal information we collect, the sources from which we collect the information, how we use that information, and the categories of third parties to which we disclose that information. You can find this information in Sections 2 and 3 of our Privacy Policy above. In addition, if you are a resident of California, you have the right to opt out of the “sale” of your personal information. Under the CCPA, “sale” is broadly defined to mean the sharing of personal information with third parties who are not acting as our service providers. This may include our sharing of your information with prospective employers. If you are a California resident and would like to opt out of information sharing for purposes that may be a “sale” under California law, you may do so here. You have the right to complain to a data protection authority about our collection and use of your personal information. For more information, please contact your local data protection authority. (Contact details for data protection authorities in the European Economic Area are available here.) We respond to all requests we receive from individuals wishing to exercise their data protection rights in accordance with applicable data protection laws. Consistent with applicable law, we do not discriminate (as defined in applicable law) against individuals for exercising their legal rights with respect to their personal information. How Long Do We Keep Your Personal Information? We will retain information we collect from you where we have an ongoing legitimate business need to do so (for example, to provide you with the Services or to comply with applicable legal, tax, or accounting requirements). When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize it or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible. If you have any questions about how long we retain your personal information, you may contact us using the contact details provided under the Section headed “How To Contact Us” below. How Do We Keep Your Personal Information Secure? Transmissions over the Internet are not completely secure or error-free. We do however take appropriate technical and organizational measures to protect your personal information from loss, misuse, unauthorized access, disclosure, alteration, and destruction. The measures we use are designed to provide a level of security appropriate to the risk of processing your personal information and to help ensure that your data is safe, secure, and only available to you and to those with authorized access. If you have any questions about the security of your personal information, you may contact us using the contact details provided under the Section headed “How To Contact Us” below. Updates To This Notice We may update this Notice from time to time in response to changing legal, technical, or business developments. When we update our Notice, we will take appropriate measures to inform you of any material changes. From time to time, we may refer to this Notice in notices and consent requests, for example related to Candidate searches or surveys. Under such circumstances, this Notice applies as modified in the particular notice or consent request. You can see when this Notice was last updated by checking the “Last Updated” date displayed at the top of this Notice. How To Contact Us Please feel free to contact us with any comments, questions, complaints, or suggestions you might have regarding the information or practices described in this Notice. You may contact us by sending a message to privacy@russellreynolds.com. You can also write to us using the details below: Russell Reynolds Associates, Inc. 277 Park Avenue, Suite 3800 New York, NY 10172 USA Attention: RRA Privacy Office If you are resident in the EEA you may also write to us at the following address: Russell Reynolds Associates Limited Almack House 28 King Street London SW1Y 6QW United Kingdom Attention: RRA Privacy Office Important Note to EEA residents: If you are a visitor to any of our Websites the controller of your personal information is Russell Reynolds Associates, Inc. If you are a Candidate, the controller of your personal information is typically the local RRA entity that contacts you. If you are a Referee, Source, or Client, the controller of your personal information is typically the RRA entity that is engaging with and managing the relationship with you.