POLICY RESPECTING THE PROTECTION OF EMPLOYEE AND CUSTOMER PERSONAL INFORMATION
The following resolution and attached policy are required to comply with U.S. Department of Commerce safe harbor provisions concerning the consolidation of personal information about employees and customers from Europe to U.S. based computing systems.
RESOLVED, That the Company authorize, approve and adopt, for applications to the operations of the Company and all its subsidiaries and controlled affiliates world-wide, the principles and guidelines of a Policy Respecting the Protection of Employee and Customer Personal Information, a copy of which the Board ordered filed with the supplemental records of the meeting.
POLICY RESPECTING THE PROTECTION OF EMPLOYEE AND CUSTOMER PERSONAL INFORMATION
It is the policy of PolyOne Corporation to protect the privacy interests of its employees and customers in their personal information. Accordingly, PolyOne will not disclose, transfer or use personal information that it obtains about its employees and customers except in compliance with this policy statement.
APPLICATION OF THE POLICY
This policy establishes a uniform approach to the protection of personal information provided to PolyOne by its employees and customers. It applies to PolyOne and each of its controlled subsidiaries/affiliates (collectively, "PolyOne").
The policy is intended to facilitate the collection and transfer of employee and customer information as part of the implementation of centralized computerized record keeping, customer service and order entry across PolyOne, all in a manner that will protect the confidentiality of the employee and customer personal information and that will comply with the safe harbor standards that have been developed by the United States Department of Commerce in consultation with the European Commission.
Prior to the implementation of cross-border centralized computerized record keeping PolyOne will voluntarily certify to the United States Department of Commerce that it satisfies the safe harbor standards for adequate privacy protection, and will maintain such certification in effect so long as cross-border centralized computerized record keeping of personal information continues and the United States Department of Commerce maintains the safe harbor program.
As to employee personal information, PolyOne's Human Resources ("HR") Representatives have responsibility for overseeing the implementation and maintenance of this policy in their areas of responsibility. As to customer personal information, PolyOne's Customer Service ("CS") organization has responsibility for overseeing the implementation and maintenance of this policy in their areas of responsibility.
This policy is subject to and limited by national security, public interest, and law enforcement requirements; by applicable statute, government regulation and case law that create conflicting obligations or explicit authorization, or that allow exceptions or derogations from the same. PolyOne reserves a right to alter or amend this policy statement, along with any related policies and procedures, at any time, and nothing in this statement or in PolyOne's privacy policy should be construed as creating or altering any contractual obligations between PolyOne and its employees or between PolyOne and its customers.
TYPES OF INFORMATION COLLECTED AND USE OF THE INFORMATION
PolyOne collects personal information about its employees that PolyOne deems necessary for the administration of the employment relationship such as the payment and reporting of wages and provision of benefits, and to assure compliance with employment related laws and regulations. PolyOne collects personal information about customers who are individuals for purposes of establishing credit eligibility and eligibility to receive shipment of goods and technical assistance under applicable laws.
From time-to-time, PolyOne engages third parties to provide services in connection with the payment and reporting of wages, the provision of benefits, and other operational aspects of the operation of PolyOne. PolyOne reserves a right to make personal information available to such third parties to the extent necessary for such third parties to perform the services PolyOne requires. Unless required by law or regulation, PolyOne will not disclose personnel information to third parties that are not acting on behalf of PolyOne or use such information for non-employment related purposes without first giving the employee or the customer, as applicable, a right to "opt out". Transfers of employee and customer information by PolyOne to third parties will only be made if the third party provides a level of privacy and security at least equal to the privacy and security provisions of this Policy.
An employee choosing to "opt out" of a disclosure of his/her personal information to a third party may do so by communicating his/her decision to the appropriate HR Representative with responsibility for the facility in which the employee works. A customer choosing to "opt out" of a disclosure of his/her personal information to a third party may do so by communicating his/her decision to PolyOne's customer service organization in writing.
ACCURACY AND ACCESS
Information that PolyOne maintains about its employees must be accurate, current, and complete.
PolyOne employees will have reasonable access to their personnel information in order to assure that the information is accurate. PolyOne employees, who wish to review, correct, or amend personal information kept about them, should submit a written request to the HR Representative with responsibility for the facility in which the employee works. PolyOne will comply with the request in a timely manner in compliance with applicable laws and regulations.
SECURITY MEASURES
Access to employee personal information is limited only to those persons who have a need to know such information in the course of their job duties.
PolyOne will implement both security programs and training to reduce the risk of unauthorized disclosure of employee or customer personal information. PolyOne will provide training to the HR Representatives and CS representatives to make sure that they can fully perform their duties under this policy. PolyOne will conduct periodic audits to assure compliance with this policy.
Employees who violate this policy or make unauthorized disclosure or use of employee or customer personal information will be subject to appropriate disciplinary action up to and including discharge.
YOUR CALIFORNIA PRIVACY RIGHTS
Beginning on January 1, 2005, California Civil Code Section 1798.83 permits customers of PolyOne who are California residents to request certain information regarding PolyOne’s disclosure of personal information to third parties for their direct marketing purposes. To request such information, please contact us.
QUESTIONS AND COMPLAINTS
Questions or complaints regarding the collection or use of employee personal information should be brought to the attention of the appropriate HR Representative for resolution, or anonymously to the Ethics Line, 1-800-500-0333. Questions or complaints regarding the collection or use of customer personal information should be brought to the attention of: Secretary, PolyOne Corporation, 33587 Walker Road, Avon Lake, Ohio 44012.