Privacy Notice - Code of Conduct

The purpose of this Privacy Notice is to protect the rights of all individuals that are concerned by a Code of Conduct investigation (including those reporting suspected violations of ASSA ABLOY’s Code of Conduct), ensure equal and secure treatment of these individuals’ personal data, provide information about ASSA ABLOY's rights, and ensure ASSA ABLOY is in compliance with applicable data protection law.ASSA ABLOY has a need to detect Code of Conduct violations, to investigate reported suspected Code of Conduct violations, and to take remedial actions, and need therefore to process certain personal information about individuals concerned by a Code of Conduct investigation (referred to as "personal data").

This notice includes information on the kind of personal data that is processed by ASSA ABLOY in relation to such individuals where ASSA ABLOY is the "data controller". Personal data is processed in accordance with this notice and data protection law. By reading this notice, you confirm that you have been informed about how your personal data is processed by us. You have several rights related to how we handle your personal data.

Your rights include:

• rights of access and rectification of your personal data
• right to object to the processing of personal data
• right to restrict the processing of personal data
• right to request deletion of your personal data
• right to data portability to another controller, where technically feasible.

Please note that you may not be allowed to use your rights in all situations. If you are dissatisfied with how we process your personal data you have a right to lodge a complaint with a data protection authority. 

Your rights are further explained below. 

ASSA ABLOY has appointed a so called Data Protection Manager ("DPM"). If you have any questions about how ASSA ABLOY collects, processes and stores your personal data, please contact the DPM as listed in Schedule B.

Authorities

In connection with investigations or legal proceedings ASSA ABLOY may need to provide personal data to authorities, regulators, and courts. Such disclosures will be carried out in accordance with mandatory law and in order to fulfill legal obligations.

ASSA ABLOY Group Companies

Furthermore, due to the fact that the ASSA ABLOY group carries out business activities in a number of different countries, personal data may need to be transferred to ASSA ABLOY companies outside of your own home country that need to receive the personal data for the purposes stated in the Data Processing Matrix.

Companies engaged by ASSA ABLOY

Your personal data may also be transferred to and processed by third party providers and suppliers which perform services for ASSA ABLOY, to enable these companies to perform the services requested by us. Services which may be requested include the provision of forensic services and advice related to investigations. Only personal data that is necessary to fulfil the purposes stated in the Data Processing Matrix will be provided to these companies. All third party providers and suppliers must follow our instructions and the applicable written data processor agreement and any other agreements that are in place between ASSA ABLOY and its third party providers/suppliers, and must implement suitable technical and organizational measures for the protection of the personal data of our employees.

A legal entity that receives personal data may be located in a country that offers a lower level of protection for personal data than the country in which you are located or a citizen. All personal data transferred to a country that offers a lower level of protection for personal data will be transferred in accordance with ASSA ABLOY's current policies regarding transfer of personal data, as applicable from time to time, to ensure that the transfer of personal data complies with the law. If personal data is transferred to a country that offers a lower level of protection for personal data, the personal data will be transferred in accordance with the "Transfer of Personal Data Matrix" in Schedule B.

We will not store or process personal data for a period longer than necessary to fulfill the purposes in the Data Processing Matrix or to comply with the relevant law in your country. Accordingly, when the purpose has been fulfilled in relation to a specific type of personal data, we will stop using the personal data for that purpose and, if the same data is not relevant for any other purpose, delete the relevant personal data as soon as reasonably possible.

Once we have confirmed your identity, we will handle your request in accordance with law. Please note that even if you object to certain processing of personal data, we may still continue this processing if permitted or required to do so by law, for example to enable us to fulfill legal requirements, administer the employment or fulfill obligations under a contract with you.

If you have any complaints about the way in which the personal data is being processed, or would like further information, please contact the DPM (please see Schedule B for contact details). You can also make a complaint about the data processing to the relevant public authority, such as where you live, work or where an alleged infringement of the applicable data protection law has occurred, please see Schedule B for further information.