In this Privacy Policy (“Policy"), BI WORLDWIDE declares its commitment to comply with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce.

BI WORLDWIDE has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (“EU-U.S. DPF Principles”) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) and in reliance on the UK Extension to the EU-U.S. DPF.

BI WORLDWIDE has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (“Swiss-U.S. DPF Principles”) with regard to the processing of personal data received from Switzerland.

The “EU-U.S. DPF Principles” and the “Swiss-U.S. DPF Principles” shall be collectively referred to as the “DPF Principles”. If there is any conflict between the terms in this privacy policy and the DPF Principles, the DPF applicable Principles shall govern.

To learn more about the Data Privacy Framework Program, and to view our certification, please visit the Data Privacy Framework website.

BI WORLDWIDE provides business-to-businesses services. This Policy applies to the processing of personal data that BI WORLDWIDE processes in the United States relating to individuals who reside in the United States, the European Union, the United Kingdom, and Switzerland, as applicable, (collectively “Personal Data”).

This Policy does not cover data from which individual persons cannot be identified or situations in which pseudonyms are used. (The use of pseudonyms involves the replacement of names or other identifiers with substitutes so that identification of individual persons is not possible.)

BI WORLDWIDE has designated its legal department, data privacy managers, and information security officers (“Security & Privacy Team”) to oversee its information security program, including its compliance with the EU Data Privacy Framework, UK Extension to the EU-U.S. Data Privacy Framework, and Swiss Data Privacy Framework program. BI WORLDWIDE’s Security & Privacy Team shall review and approve any material changes to this information security program as necessary. Any questions, concerns, or comments regarding this Policy also may be directed to [email protected].

BI WORLDWIDE will maintain, monitor, test, and upgrade information security policies, practices, and systems to demonstrate its commitment to protect the Personal Data that it processes. BI WORLDWIDE personnel will receive training, as applicable, to effectively implement this Policy.

BI WORLDWIDE will renew its EU Data Privacy Framework, UK Extension to the EU-U.S. DPF, and Swiss Data Privacy Framework certifications annually unless it subsequently determines that it no longer needs such certification, or if it employs a different adequacy mechanism.

Prior to re-certification, BI WORLDWIDE will conduct an in-house verification to ensure that its attestations and assertions about its treatment of Individual Personal Data are accurate and that the company has appropriately implemented these practices. Specifically, as part of the verification process, BI WORLDWIDE will undertake the following:

1. Review this Policy and its publicly posted website privacy policy to ensure that these policies accurately describe the practices regarding the collection and use of Personal Data.

2. Ensure that the publicly posted privacy policy informs customers and Individuals of BI WORLDWIDE's participation in the EU Data Privacy Framework, UK Extension to the EU-U.S. DPF, and Swiss Data Privacy Framework, and where to obtain a copy of additional information (e.g., a copy of this Policy).

3. Ensure that this Policy continues to comply with the Data Privacy Framework principles.

4. Confirm that customers and Individuals are made aware of the process for addressing complaints and any independent dispute resolution process
   (BI WORLDWIDE may do so through its publicly posted website, each separate customer contract, or both).

5. Review its processes and procedures for training BI WORLDWIDE Personnel about BI WORLDWIDE's participation in the Data Privacy Framework program and the appropriate handling of Individual Personal Data.

BI WORLDWIDE collects Personal Data directly from Individuals when they register with one of our websites, login to their account, participate in reward and recognition programs, participate in meetings, events, and travel programs, redeem award points for individual travel or merchandise, request information, or otherwise communicate with us. BI WORLDWIDE also receives Individual Personal Data indirectly from its business customers in its role as a service provider. In our capacity as a service provider, we will receive, store, and/or process Personal Data. In such cases, we act as a “data processor” and will process the Personal Data on behalf of, and under the direction of our customers acting as a “data controller”. The Personal Data that we collect from individuals in this capacity is used to provide services to the individual as requested by the data controller.

The Personal Data that we collect may vary based on the Individual’s interaction with one or more of our websites used to provide the services as agreed under contract with our business customers. In general, BI WORLDWIDE collects the following types of Personal Data either directly from Individuals, or indirectly from BI WORLDWIDE business customers: contact information, including, a contact person's name, work email address, work mailing address, delivery address for merchandise award delivery, work telephone number, title, and company name. Individuals have the option to log into their accounts online and request assistance via an online form or through a live support option such as chat or telephone, collectively “Portals”. In such cases, we will collect information that they choose to provide to us through these Portals.

BI WORLDWIDE discloses relevant Personal Data only to a Third Party who reasonably needs to know such Personal Data, and only under a contract with the Third Party that provides that such data may only be processed for limited and specified purposes consistent with the consent provided by the Individual and for no other purpose. Third Party recipients must agree to provide the same level of protection as the Data Privacy Framework principles and will notify BI WORLDWIDE if it determines that it can no longer meet this obligation. The Third Party contract must provide that when such a determination is made, the Third Party must cease processing or take other reasonable and appropriate steps to remediate.

BI WORLDWIDE may provide Personal Data to Third Parties that act as agents, consultants, and contractors to perform tasks on behalf of and under our instructions. For example, BI WORLDWIDE may store such Personal Data in facilities operated by Third Parties. Such Third Parties are required to use such Personal Data only for the purposes for which the Third Party has been engaged by BI WORLDWIDE and they must either:

1. comply with the Data Privacy Framework principles or another mechanism permitted by the applicable EU, UK, & Swiss data protection law(s) for transfers and processing of Personal Data;

2. or agree to provide adequate protections for the Personal Data that are no less protective than those set out in this Policy;

BI WORLDWIDE also may disclose Personal Data for other purposes or to a Third Party when a Data Subject has consented to or requested such disclosure. Please be aware that BI WORLDWIDE may be required to disclose an individual's personal information in response to a lawful request by public authorities such as for national security or law enforcement requirements. BI WORLDWIDE is liable for appropriate onward transfers of personal data to third parties.

In general, BI WORLDWIDE does not receive or collect Sensitive Data from Individuals. Within specific services provided by BI WORLDWIDE, and as contractually required and directed by a BI WORLDWIDE customer, some sensitive data may be processed. In such cases, Individuals will be provided with information to explain why that data is required and the Individuals’ explicit consent will be obtained unless other legal grounds exist for the processing of Sensitive Data.

BI WORLDWIDE uses reasonable efforts to maintain the accuracy and integrity of Personal Data and to update it as appropriate. BI WORLDWIDE has implemented physical and technical safeguards to protect Personal Data from loss, misuse, and unauthorized access, disclosure, alteration, or destruction. BI WORLDWIDE also employs access restrictions, limiting the scope of Personnel who have access to Personal Data. Further, BI WORLDWIDE uses secure encryption technology to protect certain categories of personal data. Despite these precautions, no data security safeguards guarantee 100% security all of the time.

BI WORLDWIDE notifies Individuals residing outside the United States about its adherence to the applicable Data Protection Framework principles through this policy which is accessible via BI WORLDWIDE’s Data Privacy Framework certification list (https://www.dataprivacyframework.gov/list) and from each applicable website hosted by BI WORLDWIDE.

BI WORLDWIDE personnel may access and use Personal Data only if they are authorized to do so, only for the purpose for which they are authorized, and they are granted access only to Personal Data relevant to the purpose of processing.

1. Right to Access. Individuals have the right to know what Personal Data about them is included in the databases and to ensure that such Personal Data is accurate and relevant for the purposes for which BI WORLDWIDE collected it. Individuals may review their own Personal Data stored in the databases and request to have it corrected, erased, or blocked, as permitted by applicable law and BI WORLDWIDE policies. Upon reasonable request and as required by the DPF principles or US data privacy laws, as applicable. BI WORLDWIDE allows Individuals access to their Personal Data, in order to correct or amend such data where inaccurate. Individuals may edit their Personal Data by logging into their account profile or by contacting BI WORLDWIDE by email or other means provided by the website. In making modifications to their Personal Data, Data Subjects must provide only truthful, complete, and accurate information. To request erasure of Personal Data, Individuals should submit a written request via email to the Data Controller listed within the Privacy Notice of the website managed by BI WORLDWIDE containing the Individual’s Personal Data. If the website does not include a Privacy Notice with contact information of the data controller, the Individual may submit their written request via email to: [email protected].

2. Requests for Personal Data. BI WORLDWIDE will track each of the following and will provide notice to the appropriate parties under law and contract when either of the following circumstances arise: (a) legally binding request for disclosure of the Personal Data by law enforcement authorities having jurisdiction over BI WORLWIDE’s compliance unless prohibited by law or regulation; or (b) requests received from the Data Subject.

3. Satisfying Requests for Access, Modifications, and Corrections. BI WORLDWIDE will endeavor to respond in a timely manner to all reasonable written requests to view, modify, or inactivate Personal Data.

This Policy may be amended from time to time, consistent with the DPF principles and applicable data protection and privacy laws and principles. We will make Personnel aware of changes to this policy either by posting to our intranet, through email, or other means. We will notify affected Individuals if we make changes that materially affect the way we handle Personal Data previously collected, and we will allow them to choose whether their Personal Data may be used in any materially different manner.

Individuals may contact BI WORLDWIDE with questions or complaints concerning this Policy at the following email address: [email protected].

In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, BI WORLDWIDE commits to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities (DPAs) and the UK Information Commissioner’s Office (ICO) and the Swiss Federal Data Protection and Information Commissioner (FDPIC) with regard to unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF. at no cost to you.

The Federal Trade Commission has jurisdiction over BI WORLDWIDE’s compliance with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF).

BI WORLDWIDE will promptly respond to inquiries and requests by the U.S Department of Commerce’s International Trade Association (ITA)

Finally, as a last resort, BI WORLDWIDE will commit to binding arbitration through the Data Privacy Framework Panel if at the request of an EU, United Kingdom, or Swiss Individual.

Capitalized terms in this Privacy Policy have the meanings assigned or the following meanings, as applicable:

"Individual" means an Individual from the United States, EU, the United Kingdom, or Switzerland. The term also shall include any employee of a BI WORLDWIDE customer where BI WORLDWIDE has obtained Personal Data from such Individual as part of the customer’s business relationship with BI WORLDWIDE.

"Data Subject" means an identified or identifiable natural living person. An identifiable person is one who can be identified, directly or indirectly, by reference to a name, or to one or more factors unique to his or her personal physical, psychological, mental, economic, cultural or social characteristics. For Individuals residing in Switzerland, a Data Subject also may include a legal entity.

"Personnel" means an employee (whether temporary, permanent, part-time, or contract), former employee, independent contractor, or job applicant of BI WORLDWIDE or any of its affiliates or subsidiaries, who is also a resident of a country within the European Economic Area.

"Europe" or "European" refers to a country in the European Union.

"Personal Data" means data that personally identifies or may be used to personally identify a person, including an individual's name in combination with country of birth, marital status, emergency contact, salary information, terms of employment, job qualifications (such as educational degrees earned), address, phone number, e-mail address, user ID, password, and identification numbers. Personal Data does not include aggregate or anonymous data that does not personally identify an individual. For Switzerland, the term "person" includes both a natural person and a legal entity, regardless of the form of the legal entity.