European Union Personal Information Privacy Notice

figure-1

Though Industries, Inc. (“Thought Industries, “we”, “us” or “our”), cares about your privacy and is committed to processing your Personal Information in accordance with fair information practices and applicable data privacy laws.

I. WHO DOES THIS NOTICE COVER?

This notice explains how Thought Industries handles the personal information of European Union employees, applicants, interns, former employees, dependents, beneficiaries, contractors, consultants, and temporary agency workers in the course of its activities.

II. WHAT PERSONAL INFORMATION DO WE COLLECT?

As your employer, Thought Industries needs to collect, keep and process personal information about you for employment and benefit administration purposes. Personal Information means any information relating to an identified or identifiable natural person; one who can be identified, directly or indirectly, by reference to an identifier such as name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Where we process special categories of information relating to your racial or ethnic origin, political opinions, religious and philosophical beliefs, trade union membership, biometric data or sexual orientation, we will always obtain your explicit consent for those activities unless this is not required by law, or the information is required to protect your health in an emergency. Where we are processing data based on your consent, you have the right to withdraw that consent at any time.

A. CATEGORIES OF PERSONAL INFORMATION COLLECTED OR PROCESSED

In the normal course of human resources and business activities, we process the following categories of personal information:

  • Personal identification information, such as your name, home address, date of birth, gender, work- related photographs, and phone number(s);
  • Government-issued identification numbers, such as national ID or passport for payroll and travel purposes;
  • Immigration, right-to-work and residence status;
  • Family and emergency contact details;
  • Job-related information, such as years of service, work location, employment ID, work record, vacation absences, and contract data;
  • Educational and training information, such as your educational awards, certificates and licenses, vocational records and in-house training attendance;
  • Recruitment and performance-related data, such as resumes, objectives, ratings, comments, feedback results, career history, work equipment, career and succession planning, skills and competencies and other work- related qualifications;
  • Information related to your usage of Thought Industries’ assets, in particular its computers and telecommunication systems, and traffic generated on Internet;

III.

• • • •

Voicemails, e-mails, correspondence, documents, and other work product and communications created, stored or transmitted using our networks, applications, devices, computers or communications equipment; Acknowledgements regarding our policies, including employee handbooks, ethics and/or conflicts of interest policies and computer and other corporate resource usage policies;

Information needed for compliance and risk management, such as disciplinary records, background check reports and security data; and
Payroll and payment or benefits related information, such as salary and insurance information, dependents, government identifier or tax numbers, bank account details, and employment related benefits information, family and dependent information.

HOW IS PERSONAL INFORMATION COLLECTED?

Generally, we collect personal information directly from you in circumstances where you provide personal information (during the onboarding process, for example). However, in some instances, the personal information we collect has been inferred about you based on other information you provide us, through your interactions with us, or from third parties. When we collect your personal information from third parties it is either because you have given us express consent to do so, your consent was implied by your actions (e.g., your use of a third-party employee service made available to you by us), or because you provided explicit or implicit consent to the third party to provide the personal information to us.

Where permitted or required by applicable law or regulatory requirements, we may collect personal information about you without your knowledge or consent.

We reserve the right to monitor the use of our premises, equipment, devices, computers, network, applications, software, and similar assets and resources. In the event such monitoring occurs, it may result in the collection of personal information about you. This monitoring may include the use of CCTV cameras in and around our premises.

IV. WHAT ARE OUR LAWFUL BASES FOR PROCESSING?

We will process your Personal Information on the following legal bases:

  • The performance of a contract with you;
  • The legitimate interests of Thought Industries, to run our businesses efficiently and effectively;
  • As required by law;
  • Your consent, where required and to the extent of applicable law; and
  • Your vital interests. We will process Special Categories of your Personal Information on the following legal bases:
  • Your explicit consent;
  • Employment law;
  • Your vital interests;
  • Publicly available data; and
  • Legal claims.

V. HOW WE USE YOUR PERSONAL INFORMATION

Thought Industries may use your personal information for the following purposes:

  • To manage all aspects of an employee’s employment relationship, including, but not limited to the establishment, maintenance, and termination of employment relationships. Examples of activities related to this include: determining eligibility for initial employment, including the verification of references and qualifications; pay and benefit administration; the issuance and management of stock options and restricted stock units; corporate travel and other reimbursable expenses; development and training; absence monitoring; project management; auditing, compliance, and risk management activities; conflict of interest reporting; employee communications; performance evaluation; disciplinary actions; grievance and internal investigation activities; career management, including the assessment of qualifications for a particular job or task; processing employee work-related claims (e.g., worker compensation, insurance claims); succession planning; relocation assistance; obtaining and maintaining insurance; the provision of employee related services; and other general operations, administrative, financial, and human resources related purposes.
  • For managing information technology and communications systems, such as the corporate email system, company directory, and video conferencing;
  • For administering employee engagement programs, including surveys;
  • To administer our occupational safety and health programs to protect the safety and security of our workforce, guests, property, and assets (including controlling and facilitating access to and monitoring activity on and in our premises and activity using our computers, devices, networks, communications and other assets and resources);
  • Carrying out obligations under employment contracts;
  • Complying with applicable laws (e.g., health and safety, employment laws, office of foreign asset controls regulations, tax laws), including judicial or administrative orders regarding individual employees (e.g., garnishments, child support payments); and
  • other general human resources, legal and customary business-related purposes.

Thought Industries also monitors and filters the use of company devices, our network, and internet traffic for lawful business purposes, and in particular for:

  • Ensuring adequate Information Systems integrity and detecting and preventing criminal activity, including cyber-crime;
  • Protecting information, including, but not limited to, personal information, confidential information, and high- value business information against destruction, loss, alteration, unauthorized access, disclosure or hacking;
  • Securing the effective operation of its Information Systems;
  • Ensuring compliance with applicable regulatory and self-regulatory obligations; and
  • Detecting instances of non-compliance with Thought Industries’ policies on information security, internet use or the Employee Handbook and Code of Ethics.

VI. WITH WHOM DO WE SHARE INFORMATION?

When we share personal information with third parties, we require that they only use or disclose such personal information in a manner consistent with the use and disclosure provisions of this Privacy Notice and applicable law. Like most international businesses, we have centralized certain aspects of our business operations, including for example, financial and human resources administration. This may result in the transfer of personal information from one country to another and amongst our various subsidiaries and affiliates. It should be noted that this may or may not include countries where the level of privacy protection and the legal rights of individuals are not considered commensurate with standards of protection in jurisdictions having comprehensive data protection laws, such as the countries of the European Union and Canada.

Your personal information may be shared, including to our affiliates, subsidiaries, and other third parties, as follows:

  • In order to carry out the uses of personal information described above (see, How We Use Your Personal Information)
  • Other Thought Industries’ entities, joint ventures, subcontractors, vendors or suppliers who perform services on our behalf for the aforementioned purposes;
  • Where you request us to or provide your consent to us;
  • When using or collaborating with third parties in the operation of our business, including providing many of the benefits and services we offer our employees (e.g., Human Resources Information Systems, Financial Investment service providers, wellness program service providers, insurance providers);
  • Where required by law, by order or requirement of a court, administrative agency, or government tribunal, which includes in response to a lawful request by public authorities, including to meet national security or law enforcement requirements or in response to legal process;
  • As necessary to protect the rights, privacy, safety, or property of an identifiable person or group or to detect, prevent or otherwise address fraud, security or technical issues, or to protect against harm to the rights, property or safety of Thought Industries, our users, applicants, candidates, employees or the public or as otherwise required by law;
  • To professional advisers (e.g. bankers, lawyers, accountants) and potential buyers and vendors relating to the disposal or acquisition by use of a business or assets;
  • Any recipient when reasonably necessary such as in the event of a life-threatening emergency;
  • We may buy or sell businesses and other assets. In such transactions, employee information is generally one of the transferred business assets and we reserve the right to include your personal information as an asset in any such transfer. Also, in the event that we, or substantially all of our assets, are acquired, your personal information may be one of the transferred assets.

B. THIRD PARTY SERVICES

In some cases, you may provide personal information to third parties that Thought Industries works with. This could be, for example, a third-party website where you can apply for a job at Thought Industries, can take advantage of services made available to our employees, or can manage other benefits. The use of such third-party websites may be governed by separate terms of use and privacy policies which are not under our control and are not subject to this Privacy Policy. Please contact such third parties for questions regarding their privacy practices, as well as if you would like to have them delete your personal information.

VII. WHAT ARE YOUR RIGHTS?

Your rights may depend on local law. Thought Industries will be guided by local law in responding to privacy rights requests such as those listed below. You may make requests to exercise your rights verbally or in writing. Thought Industries will respond without undue delay and within one month of receipt. You may request to exercise any of these rights through your local Human Resources contact or the Privacy Office at privacy@thoughtindustries.com

  • The right to be informed. The right for individuals to be informed about the collection and use of their personal data.
  • The right of access. The right for individuals to have access to their personal data.
  • The right to rectification. The right of individuals to have inaccurate personal data rectified or completed if it is incomplete.
  • The right to erasure. A right for individuals to have personal data erased. This right is also known as the right to be forgotten.
  • The right to restrict processing. The right of individuals to request the processing restriction or suppression of their personal data. This is not an absolute right and only applies in certain circumstances.
  • The right to data portability. The right to data portability allows individuals to obtain and reuse their personal data for their own purposes across different services. The right to Data Portability is subject to restrictions. For example, Data Portability does not apply to paper records, and must not prejudice the rights of others, or sensitive company information.
  • The right to object. The right of individuals object to the processing of their personal data in certain circumstances.
  • Rights in relation to automated decision making and profiling. You may have the right not to be subject to decisions based solely on automated processing (i.e., without human intervention), if those decisions produce legal effects or significantly affect you. Automated decisions are defined as decisions about individuals that are based solely on the automated processing of data and that produce legal effects that significantly affect the individuals involved. Thought Industries does not make automated decisions for Employee data.
  • Withdrawal of consent for processing Special Categories of Personal Information. If consent is the legal basis of the processing of your Personal Information or Special Categories of Personal Information, you may withdraw any consent previously granted for a specific purpose at any time.
  • The right to lodge a complaint with a supervisory authority. The right of individuals to lodge a complaint with the supervisory authorities where their data have been processed in a way that does not comply with data protection law.

A. ACCESS TO PERSONAL INFORMATION WE COLLECT

You can ask to see the personal information that we hold about you. Your right to access the personal information that we hold about you is not absolute. There are instances where applicable law or regulatory requirements allow or require us to refuse to provide some or all of the personal information that we hold about you. In addition, the personal information may have been destroyed, erased or made anonymous. In the event that we cannot provide you with access to your personal information, we will inform you of the reasons why, subject to any legal or regulatory restrictions.

B. CORRECTION OF COLLECTED PERSONAL INFORMATION

We endeavor to ensure that personal information in our possession is accurate, current and complete. If an individual believes that the personal information about him or her is incorrect, incomplete or outdated, he or she may request the revision or correction of that information. We reserve the right not to change any personal information considered accurate.

If it is determined that personal information is inaccurate, incomplete or outdated, we will use reasonable efforts to revise it and, if necessary, use reasonable efforts to inform agents, service providers or other third parties, which were provided with inaccurate information, so records in their possession may be corrected or updated.

C. REQUESTS TO OBJECT, RESTRICT PROCESSING OR DELETE INFORMATION

You may have the right to restrict the processing of your personal data where you have a reason for wanting the restriction. Restriction means that your Personal Information is only stored by Thought Industries and not further processed. You may have the right to object to specific types of processing in certain circumstances.

Any request by you to us to delete your personal information will not result in deletion of any information submitted by you to a third-party provider If you require the third-party to delete any of your personal information, you must contact the third party directly to request such deletion.

VIII. HOW LONG IS PERSONAL INFORMATION RETAINED?

Except as otherwise permitted or required by applicable law or regulatory requirements, we may retain your personal information only for as long as we believe it is necessary to fulfill the purposes for which the personal information was collected (including, for meeting any legal, accounting or other reporting requirements or obligations).

You may request that we delete the personal information about you that we hold. There are instances where applicable law or regulatory requirements allow or require us to refuse to delete this personal information. In the event that we cannot delete your personal information, we will inform you of the reasons why, subject to any legal or regulatory restrictions.

IX. HOW WE SHARE INFORMATION ACROSS BORDERS

Thought Industries is a global company with its headquarters in the U.S. This means that your Personal Information may be used, processed, and transferred to the United States and other countries or territories and those countries or territories may not offer the same level of data protection as the country where you reside, including the European Economic Area. In such cases, we take measures to ensure that your Personal Information receives an adequate level of protection, which includes setting forth high standards for processing personal information in contractual commitments and Standard Contractual Clauses. Where required, in accordance with local law, we may request your consent.

X. HOW IS PERSONAL INFORMATION PROTECTED?

Thought Industries takes precautions to protect Personal Information from loss, misuse, and unauthorized access, disclosure, alteration, and destruction. We have taken appropriate technical and organizational measures to protect the information systems on which your Personal Information is stored, and we require, through contractual commitments, all third-parties to whom we may transfer personal information to maintain adequate security safeguards in compliance with applicable laws and standards to protect personal information.

XI. APPLICATION OF LOCAL LAWS

While this Privacy Policy is intended to describe the broadest range of our information processing activities globally, those processing activities may be more limited in some jurisdictions based on the restrictions of their laws. For example, the laws of a particular country may limit the types of personal information we can collect or the manner in which we process that information. In those instances, we adjust our internal policies and practices to reflect the requirements of local law. Any questions about applicable legislation and Thought Industries’ compliance with it shall be addressed to Thought Industries’ Privacy Office at privacy@thoughtindustries.com or to the legal department in the US.

XII. HOW DO I RESOLVE CONCERNS?

If you have any questions about this notice or if you believe that your Personal Information is not handled in accordance with the applicable law or this notice, you may contact or file a complaint with Thought Industries’ Privacy Office at the contact information below. You will not be penalized for filing a complaint. Thought Industries must respond to the complaint within 30 days.

  1. HOW TO CONTACT US

    Thought Industries, Inc.
    Privacy Office
    6 Liberty Square
    Suite 6099
    Boston, MA 02109
    privacy@thoughtindustries.com

  2. INDEPENDENT RECOURSE MECHANISM AND ACCESS TO FREE DISPUTE RESOLUTION

If you do not receive acknowledgment of your complaint within 30 days of receipt from us or if you are not satisfied with our response, you may submit a complaint directly to your local Data Protection Authority.

XIII. MODIFICATIONS TO OUR PRIVACY NOTICE

We may amend this notice from time to time, should it become necessary to do so. This notice may also be supplemented by other statements as needed to comply with local requirements in the country where you live, or where employee representation agreements exist.

Effective Date: May 25, 2018

Last Modified Date: November 03, 2021