Privacy Notice

Last Updated: July29, 2020

O.C. Tanner Company and its affiliate or related entities (“OCT”, “we”, “us”, “our”) are committed to protecting the privacy of personal information we process as a data processor on behalf of our clients, and as a data controller in the normal course of business. This Privacy Notice (“Notice”)explains what personal information we process, how we process it, and for what purposes.

About Us

We provide employee recognition and engagement services to our clients (the “Services”). In general, if you are using our Services, your employer is our client, and we process your personal information on behalf of your employer. In that context, we only process personal information as instructed by your employer andin accordance with this Notice (if there is a conflict between your employer’s instructions and this Notice, your employer’s instructions will generally prevail). If you visit our Websites (as defined below) or conduct business transactions with OCT, we are the controller of personal information we collect in such contexts, and we will use or process it in accordance with this Notice.

Information we collect and how we collect it

The information we collect about you depends on how you interact with OCT. We collect information about you when you use the Services, visit our websites , , , or any other website where this Notice is posted (the “Websites”), or conduct business transactions with OCT. If consent is required under applicable law, we will obtain your consent to collect and process your personal information.

Information collected when using the Services. We may collect the following personal information about you when you use the Services:

  • Identifiers: Your name, gender, login credentials, Internet Protocol (IP) address, and contact information, includingwork and personal email address,work and personal telephone number, and work and home postal address.

  • Professional or Employment Related Information: Information about your relationship with your employer and information related to your employment, including employee identification number, email address, position, and hire date.

  • Commercial Information: Purchase history, submissions, and redemptions you make through the Services.

  • Physical Characteristics or Descriptions: Content such as messages, comments, photos, videos, social media type posts,and other information submitted through the Services (also referred to in this Notice as “User Content”).

  • Internet or other Network Activity: Information about the device you use to access the Services, including operating system, web browser type, traffic logs, mobile network information, any referring web page you were visiting before you connected to the Services, and other information about your use of the Services, including traffic data and logs, navigation patterns, searches, page views, date and time you use the Services, and duration of use.

  • DeviceData: Information about the language or country configurationof thedevice you use to access the Services.

We may collectpersonal information from your employer (our client), or entities affiliated with or related to your employer, directly from you, or automatically from you when you use the Services. We do this to improve the quality or personalization of the Services, and to prevent or detect fraud. Information collected when using the Website. We may collect the following personal information about you when you use the Website: Identifiers, Internet or other Network Activity, and DeviceData. We collect this information directly from you, or automatically from you when you use the Website. Information collected when you conduct business transactions with OCT. We may collect the following personal information about you when you conduct business transactions with OCT: Identifiers, Commercial Information, Professional or Employment Related Information, and Payment Card Information (if you voluntarily provide it to us), which includes credit or debit card information (we use third party payment processors, so we do not store or retain payment card information).We collect this information directly from you. You are not required to provide personal information to OCT. However, if you do not provide personal information, you may not be able to use certain features of the Services, Websites, or engage in business transactions with OCT. We may also collect non-identifying or aggregated information in the form of marketing surveys, survey responses, demographic information, and information about your use of the Services and Websites. Your participation in any surveys we conduct is voluntary. We do not collect information that is generally considered sensitive under data protection laws, such as a social security number (or other government issued identification number) or health information. If we receive such information from you or your employer, we may delete it. Please do not disclose sensitive information to us or otherwise transmit sensitive information through the Services.

Purposes for which we use your information

We use or process your personal information in order to administer our Services to you and our clients, pursue our legitimate interests, or perform contractual obligations, including to:

  • Operate, maintain, and provide features, general and unique, of the Website and Services, including the“Wall of Fame”, a private social media platform limited to your organization, which allows you to post real-time recognition of achievements and add likes and comments to others’ posts. Information posted on the Wall of Fame is shared across teams and departments within your company.

  • Contact you to respond to your questions and comments or to provide customer support.

  • Contact you to measure your interest in various services or special offers, and to inform you about new products, features, or other services that may be of interest to you (if you decide to opt-in to receive such communications).

  • Conduct surveys for our own marketing purposes, and on behalf of our clients (if you or your employer agrees to participate in such surveys). We do so to improve, and understand how users engage with, the Services and Websites.

  • Process orders and facilitate reward redemptions through the Services.

  • Seek voluntary feedback from you.

  • Improve the Services and Website.

  • Comply with legal obligations.

We do not rent or sell your personal information. We may use aggregate information that does not identify you, such as survey responses and other statistical information for any purpose.

With whom we share your information

We may share personal information with OCT affiliated or related entities, as well ascontractors and third party service providers that help run our business and administer the Websites and Services, including printing providers, data centers and cloud storage solutions, shippers, drop-shippers, payment processors, fraud monitoring and prevention providers, and other hosting providers. When we do, we require that such parties protect personal information consistent with this Notice (and our contractual obligations with your employer), and use or process it only for the purpose of providing specific services to OCT. We may also share personal information if we believe in good faith that doing so is required by subpoena, court order, law, or is otherwise required to exercise or defend legal rights, take precautions against liability, protect the rights, property, or safety of any individual, protect the integrity of the Services and Websites, protect OCT or others from fraudulent or unlawful activity, or defend OCT against third party claims. In such case, we will notify you or your employer, unless prohibited from doing so under applicable law, subpoena, or order. In the event of a merger, reorganization, or other sale of some or all of OCT’s assets, personal information may be considered one of the assets transferred to the new owner. In that context, we may share personal information with the new owner, potential owners, and the advisers related to the transaction.

Cookies and tracking technologies

A cookie is a small file placed on your computer or device by a website that uses the cookie to store information about your use of a website to help users navigate websites efficiently, as well as to provide information to the owner of the website. You can delete cookies at any time through your browser settings. When you visit the Websites or use the Services, we may place session and persistent cookies in order to improve your experience by recognizing you when you return to the Websites or Services, such as by assigning a session ID, delivering content specific to your interests, and remembering your preferences on the Websites and Services. Information we collect via cookies may be linked to your personal information we have previously collected. You can disable cookies on your device at any time. If you do so, you may be unable to access certain parts of the Websites or Services. We use tracking technologies, such as “clear.GIFs” to gather statistical information about when and where emails are opened and viewed. Certain web browsers may allow you to enable a “do not track” option that sends signals to the websites you visit indicating that you do not want your online activities tracked. This is different than blocking cookies as browsers with the “do not track” option selected may still accept cookies. We currently do not honor “do not track” signals. If we do so in the future, we will update this Notice accordingly.

Storage of personal information and cross-border transfers (overseas disclosures)

We may store personal information in data centers on our premises or in virtual private cloud storage solutions. This may involve a cross-border transfer or overseas disclosure of personal information to OCT affiliated or related entities, or to third party service providers that help OCT administer the Services and Websites.In both cases, such parties may be located in other countries, including Australia, Canada, Germany, India, Singapore,United Kingdom, or the United States. These cross-border transfers or overseas disclosures are essential to enable OCT to administer the Services and Websites. To ensure the protection of personal information we transfer or disclose to overseas recipients, we have concluded appropriate data transfer and processing agreements (including Standard Contractual Clauses approved by the European Commission, as required by applicable law)with OCT affiliated or related entities and third party service providers, which you may be entitled to review by contacting us a described in this Notice.

Your rights and choices concerning your personal information

You may contact us to exercise certain rights concerning your personal information, including the right to:

  • Erase or delete your personal information.

  • Access your personal information.

  • Restrict the processing of your personal information.

  • Correct, update, or rectify your personal information.

  • Receive a copy of your personal information (data portability).

  • Object to the processing of your personal information.

  • Withdraw consent to the processing of your personal information, if we relied on your consent to collect and process your personal information.

Please note that in most cases, we are required to forward your request to your employer, who will handle the request and instruct OCT accordingly. You may also have the right to (i) request that we disclose the categories and specific pieces of personal information we have collected and disclosed about you; (ii) know whether we have sold your personal information (we do not sell personal information); and (iii) request information about OCT’s disclosure of personal information to third parties, including for their direct marketing purposes. You also have the right to lodge a complaint with a supervisory authority. Depending on where you are located, some of these rights may not apply or may be subject to limitations. For example, we may limit the number of requests you make or charge reasonable fees as legally permitted.You will not face discrimination for exercising your rights with respect to your personal information.

You or your authorized agent may contact us (as described below) to exercise these rights. Your request must provide sufficient information that allows us to reasonably verify you are the person about whom the request is made and describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it. You may opt out of certain features of the Services, including the “Wall of Fame” feature by contacting your employer. If you would like to delete User Content made to the Wall of Fame, you may do so by contacting your employer, who will instruct us accordingly. However, please note that User Content that others share or post about you will not be deleted. Additionally, while we may delete User Content from the Wall of Fame (from public view), OCT may retain User Content for administrative or legal purposes. You may also opt-out of receiving email communications from us about new products, features, or other services by clicking the “Unsubscribe” link at the bottom of the communication, or byfollowing the opt-out instructions included in the communication.

Children's Privacy

The Services and Websites are not directed to children underthe age of 13, and we do not knowingly collect personal information from such children. If you are over the age of 13, but under the age of 18, please refer to our Terms of Use for information about your ability to use the Services.

Retention

We retain personal information for a reasonable period to fulfill the purposes for which we collected it (as outlined in this Notice). If we no longer need personal information for such purposes, we delete it from our records, unless applicable law or legal considerations necessitate a longer retention period.

Security Measures

We use technical and organizational measures, such as encryption technologies, to protect personal information against loss, misuse, and unauthorized access, use, or alteration. We review our security measures regularly and consider new measures as appropriate. However, wecannot guarantee that such measures will not be hacked or otherwise bypassed by bad actors, so please exercise caution when submitting personal information online.

Changes to this Notice

We may update or change this Notice from time to time.When we do, we will update the “last updated” date above and notify you if such changes affect your rights or our obligations under this Notice.

Translated Versions

If this Notice appears in a language other than English, and there is a question or concern regarding interpretation or meaning, we will refer to the English version, available here . The English version will also resolve any conflicts of interpretation between the translated versions.

Contact us

If you have questions, comments, or complaints about this Notice or our practices under applicable law, you may contact our data protection officeras described below. We will respond as soon as possible, but no later than the period required by applicable law.
O.C. Tanner Company
Attention: Data Protection Officer
1930 South State Street
Salt Lake City, Utah 84115
Email: privacy@octanner.com, legal@octanner.com
Phone: 1 (888) 7087080