PIB CONTENT PRIVACY NOTICE LOG IN PIB CONTENT PRIVACY NOTICE THE PROFESSIONAL INFORMATION BUSINESS CONTENT PRIVACY NOTICE Effective Date: April 2, 2020 1. INTRODUCTION Dow Jones & Company, Inc., and its subsidiaries ("Dow Jones") want you to be familiar with how we collect, use and disclose Personal Data that is part of the content of our Services, because we respect your concerns about privacy, and want to maintain your trust. This Professional Information Business Content Privacy Notice (“Content Privacy Notice”) applies to the content in our subscription only Professional Information Business Products, including Factiva, Companies & Executives, Risk & Compliance, and Due Diligence Reports (“PIB Products”). For our general Privacy Notice applicable to information we collect from and about users in connection with our websites, mobile sites, applications, widgets, conferences, events, and electronic newsletters or communications, please click here. This Content Privacy Notice describes the types of Personal Data we collect, how we use it and for what purposes, and with whom we share it. We also describe the measures we take to protect the Personal Data, rights that may be available to you depending on applicable law, and how you can contact us, or the supervisory authorities if you are in the European Economic Area or Switzerland (collectively “EEA”), about privacy practices. The entity ultimately responsible as controller for processing Personal Data within PIB Products is Dow Jones & Company, Inc. (Contact information provided below in Contact Us ). Within the EEA, the primary responsible entity is Factiva Limited, based in the United Kingdom. 2. WHAT WE COLLECT AND HOW WE USE IT "Personal Data" for the purposes of this Content Privacy Notice is the information that identifies an individual or relates to an identifiable person. 2.1 Factiva Description and purpose: Factiva is a global news and information database and media archive available by subscription. Dow Jones’ subscribing customers agree to use the database to conduct business and academic research, for competitive and trend analysis, and as a source of detailed news and information. Types of individuals included: Individuals referenced in sources contained in the Factiva database. Sources of data: Data is collected from nearly 33,000 news and information sources, including The Wall Street Journal, Dow Jones Newswires, MarketWatch, Financial News, and Barron’s as well as licensed publications, websites, press releases, blogs, images and videos. What Personal Data may be processed: Factiva may contain a wide range of Personal Data about individuals referenced in source material contained in the Factiva database, as relevant to and varied depending on the source. Details of the types of Personal Data processed in connection with related products are set out in sections 2.2 to 2.4 below. 2.2 Companies & Executives Description and purpose: Companies & Executives is a component of Factiva that contains information on industries, executives, board members, and approximately 20 million public and private companies or organizations. We provide this content for subscribing customers to inform their business research and competitive analyses. Information provided includes executive team details, corporate family trees and financial results. Types of individuals included: Executives and people in management or board positions. Sources of data: Data is sourced from third-party providers of business and financial data analytics. This data is augmented by information from company websites and content and news from other PIB Products. What Personal Data may be processed: Identifying information such as name and contact details within the company or organization, as well as company ownership information; biography; career-related information and education details; and compensation. 2.3 Risk & Compliance Description and purpose: Risk & Compliance is a subscription-only service that provides information curated exclusively from publicly available sources. Risk & Compliance collects and processes this information, which includes Personal Data available in the source material, such as newspaper articles, government and other official websites, government directories and other publicly available information, to assist our subscribing customers (e.g., financial institutions, professional services firms and other regulated entities, governments, law enforcement agencies, regulators, non-profits, and other organizations) in performing due diligence and other screening activities in accordance with their legal or regulatory obligations and risk management procedures. The information is only made available to subscribing customers who affirm that they require it to mitigate risks and meet regulatory requirements relating to, for example, money laundering, bribery and corruption, sanctions, due diligence and commercial risk operations. Risk & Compliance data is not offered for use in determining an individual’s eligibility for credit, insurance, employment or for any other eligibility determination purposes that would qualify the service as a consumer report under the Fair Credit Reporting Act (FCRA) or any other similar laws. Dow Jones does not imply any negative inferences about individuals or entities referred to within the Risk & Compliance data merely because of their inclusion within the Risk & Compliance service. Types of individuals included: Individuals on Sanctions Lists or other official lists (such as lists issued by national governments, international organizations, law enforcement agencies or financial regulators); “Politically Exposed Persons” (a term used in Anti-Money Laundering regulations to denote an individual who is or has been entrusted with a prominent public function, such as a head of state, a government minister or a board member of a state-owned company); “Special Interest Persons” (a term used to describe individuals reported in sources in Factiva to have been declared wanted, charged with or arrested on suspicion of or tried, convicted or sentenced for offences within certain crime categories); Relatives and Close Associates of individuals outlined above; individuals associated with Marijuana-Related Businesses as owners, shareholders or senior executives; individuals who are license holders of money services businesses. Sources of data: Data is collected from a variety of publicly available sources, including government and other official websites, government directories, Factiva, other online newspapers and periodicals, print or online directories and company websites. What Personal Data may be processed: Identifying information such as name, alias, date of birth or age, gender, place of birth, personal identification numbers; photographic images; politically exposed roles; information about relatives and close personal associations; inclusion on Sanctions Lists or other official lists; Information about ownership of companies (Ultimate Beneficial Ownership data is provided by Dun & Bradstreet as data controller); Information from public sources about specific types of crime or criminal allegations. The amount of Personal Data processed will vary depending on the publicly available information for the individual and the reason the individual is included in Risk & Compliance. As a result, not all of the categories listed above may be included for an individual. 2.4 Due Diligence Reports Description and purpose: Due Diligence Reports are commissioned by subscribing customers to help them identify potential legal or regulatory risks associated with their suppliers, customers or third parties. Subscribing customers are provided the reports to determine risk levels in a business relationship and mitigate against those risks. Due Diligence Reports are not offered for use in determining an individual’s eligibility for credit, insurance, employment or for any other eligibility determination purposes that would qualify the service as a consumer report under the Fair Credit Reporting Act (FCRA) or any other similar laws. Types of individuals included: As determined by the Dow Jones customer. Sources of data: Data is collected from a variety of publicly available sources as well as from company and litigation information providers with whom we have contracts. Sources include government and other official websites, government directories, Factiva and Risk & Compliance as well as other online sources and registers. What Personal Data may be processed: Identifying information such as name, date of birth or age, place of birth, personal identification numbers; information about family members should they have any links to government or be involved in adverse or noteworthy issues; career-related information and education details; public and professional roles and personal affiliations; politically exposed roles; information about ownership of companies; financial information such as bankruptcy or insolvency filings; inclusion on Sanctions Lists; information from public sources about specific types of financial crime and related proceedings. The amount of Personal Data processed will vary depending on the publicly available information for the individual and the type of report requested. As a result, not all of the categories listed above may be included for an individual. 3. LEGAL BASES The processing is necessary for the purposes of legitimate interests pursued by us or asserted by our subscribing customers (for example, our customers have a legitimate interest in seeking to meet their legal obligations, to reduce their compliance risks, to carry out business, for the purpose of journalism, or to conduct academic research). Depending on the product, the processing may also be necessary for a task carried out in the public interest (for example, the public interest in preventing crime, financial crime, and fraud). As regards special categories of data and criminal data that may be in certain of these products as described above, the legal bases are as described above, as well as because the processing is necessary for reasons of substantial public interest (including for the purposes of journalism and academic research), or the processing is authorized under applicable Member State laws for various reasons, including the prevention of unlawful acts, dishonesty, terrorism, and fraud. 4. HOW WE SHARE YOUR PERSONAL DATA We may disclose your Personal Data to the subscribing customers of our PIB Products for the purposes listed above. Dow Jones & Company, Inc., and its subsidiaries may share your Personal Data with one another for the purposes described in this Content Privacy Notice, including to support the PIB Products or to provide related products or services to the relevant subscriber. Dow Jones may also share your Personal Data with Dow Jones Affiliates. A list of Dow Jones subsidiaries and Affiliates is available in annual reports here. We may disclose your Personal Data to third parties in compliance with applicable law. This may include: competent regulatory or governmental authorities in order to comply with requests for information; third party service providers for technical support and maintenance in relation to the Services (including to ensure that there are appropriate technical, organizational and security measures to protect your information); our professional advisers, including legal service providers and accountants in the context of taking professional advice, protecting our rights and as otherwise described above. Further, there may be instances when Dow Jones may disclose your Personal Data, including situations where we have a good faith belief that such disclosure is necessary in order to: protect, enforce, or defend the legal rights, privacy, safety, or property of Dow Jones, our Dow Jones Affiliates or their employees, agents and contractors (including enforcement of our agreements and our terms of use); protect the safety, privacy, and security of users of our products and services or members of the public; protect against fraud and other unlawful activity or for risk management purposes; comply with and enforce the law or legal process, including laws outside your country of residence, contractual obligations, and our policies; or respond to requests from public and government authorities, including public and government authorities outside your country of residence, to the extent permitted by applicable law. If Dow Jones sells all or part of its business or assets, or is otherwise involved in a merger, reorganization, dissolution, liquidation, or transfer of all or part of its business, as part of that transaction Dow Jones may transfer your Personal Data to the party or parties and their advisors involved in the transaction. 5. HOW WE PROTECT AND RETAIN PERSONAL DATA Dow Jones uses a combination of administrative, technical, personnel and physical measures to safeguard Personal Data in its possession against accidental, unlawful or unauthorized loss, use, access, disclosure or modification. We make reasonable efforts to ensure a level of security appropriate to the risk of the processing, taking into account the costs of implementation and nature of the processing of Personal Data. We keep your Personal Data for as long as needed in light of the purpose(s) for which it is processed, unless a longer retention period is required or allowed by law. The criteria used to determine our retention periods include (i) as long as the information is relevant to the purposes of processing; (ii) as required by a legal obligation to which Dow Jones is subject; (iii) and as needed to defend or enforce Dow Jones’ legal rights. 6. YOUR RIGHTS Depending on the applicable jurisdiction, you may have certain rights in relation to the Personal Data we hold about you: you may have the right to request access to Personal Data we hold about you, ask us to update, correct or remove Personal Data we hold about you, or object to or ask us to restrict our processing of your Personal Data. See the Contact Us section below for more details. Note that if your request relates to the processing of Personal Data by a PIB Products subscriber, we will refer your request to the relevant subscriber. We may ask you to provide further information about the basis for your request before we respond. For example, we may ask you to specify the reasons why you believe the Personal Data we hold about you is incorrect, incomplete or not processed in accordance with applicable data protection law. For your protection, we may need to verify your identity before implementing your request. For example, we may request additional information to verify your identity depending on the nature of the request and the sensitivity of the information sought. You can use an authorized agent to submit your request. If you use an authorized agent, in addition to verifying the request itself (see above), we will also verify the authorized agent’s ability to act on your behalf (they should submit written permission to act on your behalf or a power of attorney). We will try to comply with your request as soon as reasonably practicable. To the extent permitted by applicable law, we may charge a reasonable fee to comply with your Privacy Request. You should be aware that we may not be required to comply (or fully comply) with your request. In those circumstances, we will write to you explaining why we are unable to comply. You may have the right to lodge a complaint with a supervisory authority, depending on where you are located. For information on supervisory authority contacts, see the Contact Us section, below. In addition, subject to certain limitations, California Law permits our customers who are California residents to request certain information regarding our disclosure of Personal Data during the preceding calendar year. To make such a request, California residents can write to us at privacypolicy@dowjones.com, Attn: Privacy Team, and include your name and the address to which you would like us to respond. 7. OTHER IMPORTANT INFORMATION 7.1 Notice Updates Dow Jones may periodically update this Content Privacy Notice without prior notice, to reflect changes in our practices. Please look at the Effective Date at the top of this Content Privacy Notice to see when this Content Privacy Notice was last revised. Any changes to this Content Privacy Notice will become effective when we post the revised Content Privacy Notice. We will notify you by posting a prominent notice indicating we have updated this Content Privacy Notice. 7.2 Transfers Your Personal Data may be stored, transferred to, and processed in any country where we have facilities or in which we engage service providers. These countries, which may include the United States, may be outside your country of residence, and may have different data protection laws than in your country. If you are located in the EEA or another jurisdiction with data transfer restrictions, we will implement appropriate safeguards to protect your Personal Data as required if we transfer it outside the EEA or your non-EEA country to a country that is not considered to provide an adequate level of data protection by the European Commission. In these cases we have put in place adequate measures, such as standard contractual clauses adopted by the European Commission, to protect your Personal Data. To obtain a copy of our safeguards for such transfers, please communicate your request using the information shown below in Contact Us. 8. CONTACT US If you have any questions about this Content Privacy Notice or how we handle your Personal Data, or if you want to contact us in relation to your rights referred to in sections 6 or 7 above, please contact our Chief Privacy Officer and Data Protection Officers at riskandcompliance.support@dowjones.com. Or you may write to either: Attention: Privacy Dow Jones & Company, Inc. 4300 U.S. Route 1 North Monmouth Junction, NJ 08852 United States of America Email: riskandcompliance.support@dowjones.com. Factiva Limited The News Building, 7th Floor 1 London Bridge Street SE1 9GF London England Attention: Data Protection Officer Email: riskandcompliance.support@dowjones.com. We will respond to your questions and complaints about our processing of your Personal Data. If you are not satisfied with our response, depending on where you are located you can contact a supervisory authority or your state’s attorney general. A list of supervisory authorities in the European Union can be accessed here, as well as our lead supervisory authority the United Kingdom Information Commissioner’s Office. Please avoid unnecessarily disclosing sensitive Personal Data (e.g., information related to racial or ethnic origin, political opinions, religion or other beliefs, health, or trade union membership), social security numbers, or criminal background information when contacting us. CONTACT LEGAL EQUAL OPPORTUNITY MODERN SLAVERY STATEMENT CODE OF CONDUCT PRIVACY NOTICE COOKIE NOTICE SECURITY PIB CONTENT PRIVACY NOTICENEW SITEMAP © DOW JONES 2021