Global Employee Privacy Policy

Purpose

McCain Foods Limited and its subsidiaries ("McCain") are committed as part of our core values to the principles of ethical and lawful conduct in all of our business activities everywhere in the world that we do business. Virtually all of the jurisdictions in which McCain does business have privacy and data protection laws which govern how organizations can collect, use, and disclose the Personal Data of their employees, former employees, directors, interns, successful applicants, and other permanent or temporary workers ("Employees"). We have prepared this McCain Global Employee Privacy Policy (the "Policy") to outline our practices regarding the collection, use, and disclosure of our Employees' Personal Data. "Personal Data" means individually identifiable information about a person, including you, that is collected or otherwise received by McCain. McCain is committed to use any Personal Data fairly, lawfully, and in accordance with applicable laws.  Personal Data will also include similar information pertaining to an identifiable juristic person or legal entity to the extent required by applicable local privacy laws, provided such person or legal entity also qualifies as an Employee, as defined herein, or third party contractor as further described below under “Third Party Contractors”.

Use of Personal Data

We may use and disclose Personal Data for purposes connected to your employment. These purposes include:

• Workflow management, such as assigning, managing, and administering projects
• Compensation related-activities, including compensation analysis
• Payroll processing
• Performance management
• Succession planning
• Benefits, pension and personnel administration, including health and medical benefits, leave entitlements, and bonuses
• Talent management, career development, engagement, and teambuilding (including special events), or operations management
• Retirement planning and management
• Monitoring and enforcing compliance with company policies and procedures (including Code of Conduct, ethics, health and safety, travel and expense, corporate card, attendance, and working from home policies), legal requirements applicable to McCain (pursuant to, among others, labour, tax, and social security laws) or contractual requirements (pursuant to, among others, your contract with McCain), or the other activities referred to under the Monitoring section of this Policy
• Travel, transportation, and relocation planning
• IT activation, support, and authentication
• Organizational development and communications
• Corporate governance or corporate affairs
• Administration and management of McCain’s financial affairs, tax validation, and optimization
• Preventing unauthorized individuals from accessing, changing or deleting your Personal Data
• Supporting any claim, defense or declaration in a judicial or quasi-judicial proceeding
• Monitoring and preventing sexual harassment, discrimination, fraud or other criminal activities
• Safety and security monitoring while on premises (for example, CCTV monitoring and access control cards) and while working from home
• Facilitating onboarding and exit of personnel
• Facilitating internal recruitment and hiring
• Ensuring an engaging experience, realizing continuous improvement, and personalizing the HR services that we offer through information collected on our intranet and our HRNow online service and similar application
• Communicating internally or externally (for example, through newsletters or social media, such as Yammer)
• Offering Employee-specific opportunities and coupons
• Managing memberships to professional associations
• Performing internal or external audits
• Conducting corporate transactions (including mergers, acquisitions and divestments)
• Organizing internal and external events
• Achieving the purposes contemplated by any drug and/or alcohol policies adopted by McCain from time to time, if any, to the extent permitted by applicable law
• Managing exceptional situations, serious threats to health and protecting you and other individuals (for example, other Employees) in such situations
• Investigating and enforcing disciplinary measures
• Dealing with legal disputes involving you, or other Employees, workers, and contractors, including accidents at work
• Carrying out our contractual obligations with customers and suppliers (for example, Personal Data included in purchase orders, quality complaints, email correspondences); and
• Nominating and celebrating Employees who go above and beyond to drive exceptional results at McCain, to foster a positive work environment, to improve the communities where we work, and/or to have a positive impact on the lives of others (for example, as part of charitable work).

The Personal Data that McCain Collects

McCain collects, uses, and stores certain Personal Data about you for the purposes described under the above section "Use of Personal Data" and in part for the purposes described further in this section. The Personal Data McCain collects, uses, and stores includes:

Your personal and family information, such as:

• Name
• Contact information (including home address, home phone number, mobile phone number, and email address)
• Emergency contact information
• For communication and employee relations purposes: social media profiles (for example, Twitter handle, Yammer feed etc.), and contact information, if and to the extent permitted by applicable law
• Citizenship and country of residence
• Date of birth (age)
• Social Insurance Number or similar government-issued identification numbers
• Gender
• Marital status and, incidentally, sexual orientation (when processing information related to marital status, family or dependents, such processing may unintentionally reveal a person’s sexual orientation by way of the name and gender of the partner)
• For relocation assignments: family composition and dependent information, property value and mortgage details, salary information and certain income tax documentation of the Employee or spouse and other family members
• For compliance with applicable immigration requirements and to facilitate corporate travel: immigration status and information, such as passport and other identity documentation, citizenship, residency and other visas, details regarding family composition (names, genders, ages, including re spouse, dependents, and parents) and criminal convictions and pardons
• For corporate governance and other regulatory requirements: information, such as passport and other identity documentation, citizenship, residency, and other visas, signature, family information, and other
• Forms and information relating to the application for, or in respect of changes to, employee health and welfare benefits, including short and long term disability, medical care, etc.
• Languages spoken
• Education, employment or work history and other relevant background information, including CV and related information
• Letters of offer and acceptance of employment
• Materials related to eligibility for initial employment, including verification of qualifications and references and interview notes
• Information relating to any previous applications you may have made to McCain and/or any previous employment history with McCain
• Bank account information
• Height, weight, and clothing sizes, physical limitations and special needs, if and to the extent permitted by applicable law (for example, health and safety)
• Photographs
• Signatures
• Moving image and voice from video (both CCTV and creative videos), if and to the extent permitted by applicable law
• For security reasons and compliance with legal obligations, in specific and appropriate circumstances and if applicable, localization data
• For internal and external communications and better understanding, engaging, and recognizing our Employees, as applicable, from time to time, hobbies and interests
• For the study and understanding of the business and preferences of operators, we may, as part of our product research, tape the in-business usage of our products by operators and by Employees participating in the product research. In that context, we may also process the name, address, phone number, and opinion on business matters of the participating Employees
• For analyzing the current state of diversity, equity, and inclusion (DEI) at McCain (including by conducting voluntary surveys), taking effective actions in view of improving DEI, and compliance with occasional applicable legal obligations in certain jurisdictions, if and to the extent permitted by applicable law: Personal Data concerning an individual’s sexual orientation, Personal Data revealing gender, ethnic (or racial) origin, or other Personal Data categories that are relevant for DEI purposes
• For managing our company fleet, security of premises and/or when the job requires it: driver’s license, driving record, licensing plate, parking tickets, traffic fines, GPS location, and route(s) travelled (for example, via third party ride service) etc.
• For the purposes of organizing internal and external events, engagement, and teambuilding, including special events: preferences (including dietary, clothing and shoe style and sizes, etc.), and family information
• In case of exceptional situations, serious threats to health (for example, a pandemic spread of a lethal contagious disease) we may use Personal Data (including health-related Personal Data) relating to you and your family, proportionate to the aim pursued and with appropriate safeguards
• For the use and maintenance of our internal or external communications networks, equipment, applications or devices (for example, through voicemails, conference calls: telephone, video or telepresence, e-mails, correspondence, documents, and other work product and communications): Personal Data contained or revealed through the use or maintenance of such communications methods; and
• For the purpose of nominating and celebrating Employees for outstanding achievements: information about their efforts to improve the communities where we work and/or to have a positive impact on the lives of others (for example, as part of their involvement in charitable work).

Information related to your job, such as:

• Job title and description
• Job location
• Department
• Employee identification number
• Work address, telephone number, and email address
• Start and end-dates of employment
• Supervisor
• Reporting level
• Employment status (full-time or part-time; hourly or salaried)
• Contract type
• Cost center and credit card information, expenses (including T&E), and related audit flags
• Compensation, bonus, and related information (including pay scale, variable compensation, and benefits, such as company car, dependent education, housing, etc.)
• Pay periods
• Overtime and commissions information
• Pension and benefits information
• Training records
• Job performance and related information and opinions, including disciplinary measures
• Opinions, including named results
• Talent review ranking and leadership potential ranking
• Payroll information
• Leave entitlement, sickness and absences
• Mandatory policy or training acknowledgement sign-off sheets or similar communications (paper or electronic)
• Code of Conduct complaint-related information (such as information related to the complainant, the other individuals mentioned in the complaint and the subject(s) of the complaint), as applicable
• For travel, safety and security monitoring (while off premises on company business), transportation and accommodation: travel itineraries, GPS location, routes travelled (for example, via third party ride service), travel party configurations (name and relationship), travel preferences (for example, air: seat, special meals, departure city; hotel: room type, hotel services, pillows; car: type and transmission), frequent travel program numbers (air, car, hotel), and travel reward cards
• For reporting injuries, exposures, and incidents to competent bodies: Employee name, contact information, incident report, and medical information, if and to the extent permitted by applicable law
• For administering benefits (including health and medical benefits and leave entitlements), determining appropriate accommodation, and managing maternity and parental programmes: health-related information, such as disability condition, information related to leave entitlements, sicknesses and absences, maternity and parental leave information, etc.
• For administering and safeguarding McCain IT systems and ensuring compliance with applicable policies: electronic identification and communication data (for example, website browsing history, call history, caller identifier, texts, personal emails on Employee-issued devices, log-in credentials for professional McCain accounts, passwords (as well as password aide-memoire questions and answers), home contact information supplied for multi-factor authentication, computer number, IP address, cost centre number, app usage, browser type and operating system)
• For supporting the remote triage of incidents through help desk personnel: a recording of the device session via a remote take-over tool to enable technicians and service desk agents to log onto the device
• For measuring the interaction Employees have with the content posted on our intranet: certain information related to our Employees’ use of our intranet (such as how many clicks an article received, how long Employees stay on our intranet, where they originate from, what pages they exit from, and the number of visitors)
• For ensuring an engaging experience, realizing continuous improvement, and personalizing the HR services that we offer through our intranet and our HRNow online service, and similar applications: name, photograph, Employee number, which HR-related articles on our intranet and our HRNow online service and similar applications you clicked on, and possibly other linked details on record (for example, at what time/date you clicked on these articles)
• For security reasons and compliance with legal obligations through the use of Employee identification and access control cards: name, photograph, Employee number, and possibly other linked details on record (department, phone number, license plate, description of vehicle – colour, year, make), and property and plant access/exit times and dates
• For performing psychometric tests: certain information about aspects of personality which are relevant to the workplace development, if and to the extent permitted by applicable law
• For applications for, and enforcement of, patents and similar registered intellectual property rights: names, addresses, citizenship, photographs, contact details, and full resumes of the individuals that invented or developed such McCain intellectual property, as well as affidavits and other necessary documentation
• For McCain to comply with labour and social security laws: trade union memberships; and
• For the purpose of nominating and celebrating Employees for outstanding achievements: information about their efforts to achieve exceptional results at work (for example, sustainability, profit growth, safety, etc.).

Methods of Collecting Personal Data

We may collect Personal Data about you in the following ways:

• Directly from you, such as through the application and hiring process (online or in-person)
• During your activities in the course of your employment, such as through your performance and interaction with other Employees, contractors, customers or other individuals or through your use of our systems, intranet or the HR services that we offer through our intranet or our HRNow online service and other similar applications; and
• From other parties, subject to the requirements of applicable law. These parties may include:
  • References
  • Publicly available information
  • Former employers
  • Other Employees (for example, to nominate and celebrate a colleague for outstanding achievements); and
  • Other third parties, such as background check agencies, police departments, company-approved third party travel management systems, and third party ride services (if and to the extent permitted by applicable law).

Information about Dependents

If you provide McCain with information about members of your family and/or other dependents (for example, for emergency contact, benefits administration purposes or relocation assignments), we will only use that information for the purposes for which it was provided. You are responsible for obtaining the explicit consent of these individuals (unless you can provide such consent on their behalf) to the use of that information for the purposes set out in this Policy.

Information about Third Party Contractors

We may process certain Personal Data of third party contractors (for example, consultants) who do not qualify as employees pursuant to applicable laws. To the extent we process certain Personal Data about such third party contractors:

• For one or more purposes described in the McCain Global Privacy Policy, the provisions of the McCain Global Privacy Policy will be applicable; or
• For one or more purposes described above but not described in the McCain Global Privacy Policy, the provisions of this Policy will be applicable.

On What Basis Do We Use Your Personal Data?

We collect and use your Personal Data when this is necessary to:

• Perform your employment contract (or other similar type of agreement) with McCain; and
• Comply with regulatory requirements (pursuant to, among others, labour, tax, and social security laws).

We may process some of your Personal Data when this is in our legitimate interest. This is the case, for example, when we collect and use your Personal Data to:

• Organize teambuilding events
• Secure our premises and IT systems
• Handle and investigate complaints through our Code of Conduct Hotline; and
• Prevent or investigate fraud or other criminal activities.

Sometimes, we may process your Personal Data after you have given us your prior consent. For example, in certain circumstances we will ask your prior consent before using your photos or videos as part of our corporate communications.

What Happens if You Do Not Provide Us with the Personal Data We Request or Ask That We Stop Processing Your Personal Data?

Our ability to perform our obligations derived from your employment contract (or similar type of agreement) with McCain and our ability to comply with our legal and contractual obligations sometimes depend on McCain having access to and being able to use certain Personal Data.

Therefore, and depending on the circumstances, if you do not provide us with the Personal Data we request or if you ask that we stop processing your Personal Data, we may not be able to perform our contractual obligations (such as paying you for your work) or we may be in breach of one or more legal obligations applicable to us. In some cases, if we are not allowed to process your Personal Data, this may result in us being required to terminate our work relationship with you.

Access to Personal Data

Access to your Personal Data will be given to those who need such access for the purposes listed above or where required by law. These parties include, among others, the McCain Human Resources department, relevant business managers, and, on limited occasions, members of the Information Technology ("IT"), Finance, Tax, and Legal departments. Access to the internal Employee directory (which contains the professional (contact) details of McCain personnel) will be provided to the Employees that need to access such internal Employee directory.

We may share your Personal Data with affiliates or subsidiaries that provide shared services within McCain, for example, in connection with HR services, financial and accounting support, credit control, recordkeeping, and payroll. For further information, please contact our Privacy Officer at [email protected].

We may also transfer/assign Personal Data to third parties that provide products or services to McCain. These third parties may include payroll administrators, benefits administrators, financial consultants and financial services providers, professional advisers, IT systems providers (including enterprise resource planning and cloud-based software providers and consultants), outside counsel, expense claims providers, employee data management solutions providers, timekeeping solutions providers, hardware providers, company car management companies, travel and mobility service providers, and limited other parties.

Some third party software products and services provided to you at McCain have a function whereby the third party provider (such as Microsoft) collects information about you and your usage of the software.  McCain does not have access to such data.  You can switch this function on or off.  If you do not want such data to be collected by the third party provider, you should switch off the function.  Please call the Global IT Service Desk if you need help to switch the function off.

We will carefully select such third parties and will require them to only process Personal Data in accordance with the instructions of McCain. The recipients of these disclosures and their information storage systems may be located in other countries. If McCain discloses Personal Data to such recipients, we will require that they will provide an adequate level of protection for your Personal Data and that appropriate security measures are in place.

Where permitted by applicable law, Personal Data also may be disclosed in connection with a corporate restructuring, sale, or assignment of assets, merger, divestiture, or other changes of control or financial status of McCain (or any of its subsidiaries or affiliated companies).

Finally, Personal Data may be disclosed and transferred to respond to law enforcement requests or where required by applicable laws, court orders, or government regulations (including disclosures to tax, social security, and employment authorities); or to government entities to manage or administer McCain’s financial and tax affairs. We may also disclose Personal Data to external legal counsel to assist us with the establishment and defence of legal claims or to other third parties also engaged in such legal matters (for example, to the adverse party in court proceedings, to judicial experts, to other stakeholders involved in the claim, etc.).

We may also share Personal Data with other third parties subject to your prior consent.

Where is Your Personal Data Stored?

McCain operates globally, and your Personal Data may be stored and processed by it or its service providers in multiple jurisdictions, including your home jurisdiction.  For more information about where we store your Personal Data, please contact your local Human Resources department or our Privacy Officer at [email protected].

We maintain reasonable administrative, technical, and physical safeguards to protect Personal Data against accidental or unlawful destruction, or loss, alteration, unauthorized disclosure or access. In the event that we do transfer any Personal Data, we will only do so in accordance with applicable law, and will require that there is an adequate level of protection for the Personal Data and that appropriate security measures are in place.

McCain has policies and procedures in place to ensure that we comply with all applicable laws in the event of a security incident leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, your Personal Data.

In the event that we do transfer any Personal Data internationally, we will only do so in line with applicable law and we will require that there is an adequate level of protection for the Personal Data and that appropriate security measures are in place.

Personal Data may be transferred from countries located within the European Economic Area (EEA) to countries located outside of the EEA, such as Canada and the United States, in particular. In such cases, we will require that the following safeguards are taken:

• The laws of the country to which Personal Data is transferred ensure an adequate level of data protection under article 45.1 of the EU General Data Protection Regulation (2016/679). For Canada, the adequacy decision is available here; or
• The transfer is subject to data protection clauses approved by the European Commission under article 46.2. c) or d) of the EU General Data Protection Regulation (2016/679). More information about those data protection clauses is available here; or
• Any other applicable appropriate safeguards under article 46 of the EU General Data Protection Regulation (2016/679).

For more information about the safeguards relating to Personal Data transfers outside of the EEA, please contact our Privacy Officer at [email protected].

Your Rights

Depending on and subject to applicable laws, you have certain rights regarding the Personal Data that we hold about you. These rights may include the following:

• The right to access the Personal Data we hold about you
• The right, under certain circumstances, to block or suppress further use of your Personal Data
• The right to request the rectification of the Personal Data that we hold about you if that information is inaccurate or incomplete
• The right to object to certain types of processing
• The right, under certain circumstances, to request the deletion or removal of your Personal Data
• The right to lodge a complaint with the competent data protection supervisory authority (such as, in Europe, in the EU Member State of your usual residence) about the way we handle or process your Personal Data
• If our processing of your Personal Data is based specifically on your consent, the right to withdraw that consent at any time
• The right to obtain from us, under certain circumstances, the Personal Data that we hold about you in a structured, commonly used and machine-readable form so you can reuse it for your own purposes across different services.

These rights can be exercised by contacting our Privacy Officer at [email protected]. However, please note that we may, if and to the extent permitted by applicable law, need to retain or continue processing certain information, for example for legal or administrative purposes (for example keeping of social security records).

For all requests set out above, please send us an email with “data privacy request” in the subject line. Where required under applicable law, we may ask for a copy of your identity card or another proof of your identity (for example, driver’s license) to help us prevent unauthorized individuals from accessing, changing or deleting your Personal Data.

We will respond to your request as soon as practically possible and always within the timeframes set forth by applicable law.

Retention and Accuracy of Personal Data Collected

McCain intends to keep Personal Data in its control accurate and up-to-date. We will retain Personal Data only as long as is necessary to carry out the purposes described in this Policy. If there are any changes to your Personal Data, please notify the Human Resources department. If you inform us of any changes or we otherwise become aware of any factual inaccuracies in your Personal Data, we will seek to promptly correct such inaccuracies.

McCain has internal retention policies and procedures that build upon the following criteria to determine the retention periods of Personal Data in the context of the above-mentioned purposes:

• End of the employment or working relationship with McCain
• Sensitivity of the Personal Data
• Security reasons
• Applicable statutes of limitation
• On-going or potential litigation or dispute; and
• Regulatory or legal obligation to retain the Personal Data (for example, for social security purposes or in the context of CCTV surveillance).

For more information about our retention policies and procedures, please read our Global Record Management Policy and Retention Schedule.

Monitoring

If and to the extent permitted by applicable law, McCain may monitor the use of its information systems to detect and remediate information security threats or improper use of McCain’s information systems. This may require the processing of certain Personal Data from Employees related to their use of said information systems.

McCain’s monitoring practices are described in the McCain Acceptable Use Policy, which outlines how you may use McCain’s information systems resources. You should review the Acceptable Use Policy to ensure that you understand McCain's monitoring practices and your obligations under that Policy.

Revisions to the Policy

McCain may update the Policy from time to time, and when we do, we will reissue a revised Policy and notify all Employees of any changes, to the extent required by law.

Conflicts or Inconsistencies between Policies

If there is any conflict or inconsistency between a provision of this Policy and a provision of any other McCain policy that is referred to in this Policy, this Policy will prevail.

Questions

If you have any questions about this Policy, please contact McCain's Privacy Officer at [email protected].