9. Data Privacy.
(a) Data Collection and Usage. The Company and the Employer collect, process and use certain personal information about the Grantee, including, but not limited to, the Grantee’s name, home address, telephone number, email address, date of birth, social insurance number, passport or other identification number, salary, nationality, job title, any shares of Stock or directorships held in the Company, details of all Awards granted under the Plan or any other entitlement to shares awarded, canceled, exercised, vested, unvested or outstanding in the Grantee’s favor (“Data”), for the legitimate purpose of implementing, administering and managing the Plan. Where required, the legal basis for the collection and processing of Data is the Grantee’s consent.
(b) Stock Plan Administration and Plan Brokers. The Company transfers Data to E*TRADE Financial Corporate Services, including its affiliated companies (collective, “E*TRADE”), an independent service provider based in the United States, which assists the Company with the implementation, administration and management of the Plan. In the future, the Company may select a different service provider, which will act in a similar manner, and share Data with such service provider. The Company’s service provider will open an account for the Grantee to receive and trade shares of Stock. The processing of the Grantee’s Data will take place through both electronic and non-electronic means. The Grantee’s Data will only be accessible by those individuals requiring access to it for purposes of implementing, administering, and operating the Plan.
(c) International Data Transfers. The Company and its service providers operate, relevant to the Company, in the United States, which means that it will be necessary for Data to be transferred to, and processed in, the United States. By participating in the Plan, the Grantee understands that the service providers will receive, possess, use, retain, and transfer the Grantee’s Data for the purposes of implementing, administering, and managing the Grantee’s participation in the Plan. The Grantee should note that his or her country has enacted data privacy laws that are different from the United States. For example, the European Commission has issued a limited adequacy finding with respect to the United States that applies only to the extent companies register for the EU-U.S. Privacy Shield program. As a result, in the absence of appropriate safeguards, the transfer of Data to the United States or, as the case may be, other countries might not be subject to substantive data processing principles or supervision by data protection authorities. Where required, the Company’s legal basis for the transfer of Data is the Grantee’s consent.
(d) Data Retention. The Company will hold and use Data only as long as is necessary to implement, administer and manage the Grantee’s participation in the Plan, or as required to comply with legal or regulatory obligations, including under tax, securities, exchange control and labor laws. This may mean Data is retained until after the Grantee’s employment ends.
(e) Voluntariness and Consequences of Consent Denial or Withdrawal. Participation in the Plan is voluntary and the Grantee is providing the consents herein on a voluntary basis. The Grantee understands that the Grantee may request to stop the transfer and processing of the Grantee’s Data for purposes of the Grantee’s participation in the Plan and that the Grantee’s compensation from or employment with the Employer will not be affected. The only consequence of refusing or withdrawing consent is that the Company would not be able to allow the Grantee to participate in the Plan. The Grantee understands that the Grantee’s Data will still be processed in relation to his or her employment for record-keeping purposes.