If you are an RRD Client (meaning, you buy services and/or have products manufactured by us)

Controller or Processor

We are considered controllers of your personal data regarding your position with your company and other employees of your company that you share with us, including all contact information regarding your employees. This is because we decide the reasons for collecting, holding and using that data. We also decide the ways in which we process that data.

This section does not cover the personal data of your own customers which you pass us to process for purposes of your services / products. For information on the personal data of your customers, please see Customer of an RRD Client below.

The data we collect, hold or process

We collect, store and use your business contact details, such as name, work address, telephone numbers, mobile numbers and email addresses.

We may also hold letters, emails, voicemails (if you leave one for us) and other typical business documents (e.g. spreadsheets and Word documents) relating to our business interactions. Some of these business documents may hold details about you. We also use customer relationship management systems, like Salesforce, to store details of our interactions with you as your suppliers.

If you are visiting one of our locations or offices, we may record CCTV images of you – CCTV is one of security mechanisms to prevent and detect any unauthorised access to our premises and secure areas in our locations.

As part of our billing processes, we may also hold financial information relating to your organization, including account holder details.

Special categories of data

We do not collect or hold any personal data relating to your employees racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data for the purposes of uniquely identifying you, or data concerning your health, sex life or sexual orientation.

We do not collect or hold any information related to your children.

Why we collect, hold or process your personal data

We collect your employee personal data during all stages of our business relationship, from pre-sales through post-sales support. This includes daily interactions between our client-facing teams and your staff, as well as ongoing account management.

Why we are permitted to collect, hold or process your personal data

We are performing a service for you or your organisation as part of a contract and/or we have a legitimate business purpose to hold that personal data so we can carry out usual business operations with you.

What would happen if we cannot hold your data

It would not be possible to continue operating the services we provide to your organisation if we were not able to hold and process this data.

If you are no longer working for a client of RRD then your data will be deleted (unless we are required to keep it for legal reasons) because of our regular data reviews and refreshes. If you are no longer working for one of RRD’s clients but have chosen to share your new contact details with RRD, these new contact details may be held for future pre-sales activity between us.

How long we keep your data for

Our default position is only to keep personal data for as long as is necessary for us to perform the service for you, unless there is a legal requirement for us to hold the data for a longer period of time (e.g. for tax purposes we may need to keep copies of invoices which could hold the personal data of a former client’s employee or a current client’s ex-employee).

If we need to keep data solely for legal purposes, we will not use that data for any other purposes and we will protect it from loss, alteration or unauthorised access.

Automated decision making or profiling of you

We do not use your personal data to profile you or to make any automated decisions about you.

Third-Party Suppliers we use

We use a number of suppliers to help us maintain business interactions with you.

If one of our suppliers has access to and processes your personal data, we will require that the supplier keeps your data confidential, have appropriate processes and technology in place to keep your personal data secure, and not use your data for any reason other than in accordance with the set of processing instructions we have agreed with them.

We also require that the supplier not transfer your data internationally without the required permission and legal frameworks in place.

All the necessary privacy requirements will be put in place through the contracts between us and our suppliers to allow them to hold and process your personal data.

Below are the list of suppliers that may process your personal data as part of your business relationship with RRD. [WHO UPDATES AND REVIEWS THIS INTERNALLY?]

Other countries your data may be transferred to

We are a global organisation and this means certain of our systems and offices are located around the world.

As not every country has the same rules and regulations about the privacy of your data we make sure that when we transfer your personal details outside of the European Union (or wider European Economic Area) we protect your data appropriately.

RRD is part of the EU-U.S. Data Privacy Framework (DPF) framework and the UK Extension (https://www.dataprivacyframework.gov/) which was designed by the European Commission, the Federal Administration of Switzerland, the UK Department for Science, Innovation and Technology, and the US Department of Commerce to protect the personal data and rights of individuals within the EU, United Kingdom (UK), and Switzerland if their personal data is transferred to the USA. You can review our DPF certification by searching https://www.dataprivacyframework.gov/list for RRD. We have further information on our DPF certification in the Privacy section of the main RRD web site (https://www.rrd.com/privacy-policy).

Should RRD transfer your personal data from the EEA or UK to a US-based processor, we ensure they are DPF certified or that Standard Contractual Clauses (Model Clauses or Data Transfer Agreements) are in place between RRD and the supplier, as appropriate.

For any data transfers outside the EU, RRD ensures compliance by first checking for a European Commission adequacy finding. If one does not exist, we utilize Standard Contractual Clauses (Model Clauses) to govern the transfer and protect your personal information.

Other useful information

Please review the main body of this privacy notice for information about

• How to contact RRD
• Your rights related to your data as a client of RRD

If you are an RRD Supplier (you provide services to us)

Controller or Processor

We are considered controllers of your personal data regarding your position with your company and other employees of your company that you share with us, including all contact information. This is because we decide the reasons for collecting, holding and using that data. We also decide the ways in which we process that data.

The data we collect, hold or process

We collect, store and use your business contact details, such as name, work address, telephone numbers, mobile numbers and email addresses.

We also hold letters, emails, voicemails (if you leave one for us) and other typical business documents (e.g. spreadsheets and word documents) relating to our business interactions. Some of these business documents may hold details about you.

If you are visiting one of our locations or offices, we may record CCTV images of you – CCTV is one of security mechanisms to prevent and detect any unauthorised access to our premises and secure areas in our locations.

As part of our billing processes, we may also hold financial information relating to your organization, including account holder details.

Special categories of data

We do not collect or hold any personal data relating to your employees racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data for the purposes of uniquely identifying you, data concerning your health, sex life or sexual orientation.

We do not collect or hold any information related to your children.

Why we collect, hold or process your personal data

We collect your employee personal data during all stages of our business relationship, from pre-sales through post-sales support. This includes daily interactions between our client-facing teams and your staff, as well as ongoing account management.

Why we are permitted to collect, hold or process your personal data

We are performing a service for you or your organisation as part of a contract and/or we have a legitimate business purpose to hold that personal data so we can carry out usual business operations with you.

What would happen if we cannot hold your data

It would not be possible to continue operating the business relationship between our organizations if we were not able to hold and process this data.

If you are no longer working for a supplier of RRD your data will be deleted (unless we are required to keep it for legal reasons) as a result of our regular data reviews and refreshes, your data will be deleted.

How long we keep your data for

Our default position is to only keep personal data for as long as is necessary i.e. the duration of our business relationship, unless there is a legal requirement for us to hold the data for a longer period of time e.g. for tax purposes we may need to keep copies of your invoices which could hold the personal data of a former employee of yours.

If we need to keep data for legal purposes we will not use that data for any other purposes and we will protect it from loss, alteration or unauthorised access.

Automated decision making or profiling of you

We do not use your personal data to profile you or to make any automated decisions about you.

Third-Parties

We use a number of third-party suppliers to help us maintain business interactions with you.

If one of our suppliers has access to and processes your personal data, we will require that the supplier keeps your data confidential, have appropriate processes and technology in place to keep your personal data secure, and not use your data for any reason other than in accordance with the set of processing instructions we have agreed with them.

We also require that the supplier not transfer your data internationally without the required permission and legal frameworks in place.

All the necessary privacy requirements will be put in place through the contracts between us and our suppliers to allow them to hold and process your personal data.

Below are the list of suppliers that may process your personal data as part of your business relationship with RRD.

Certain of RRD’s clients may also request a right to know who you are as a third-party performing services on RRD’s behalf. If a client requests this information, RRD will notify you prior to sharing it with our client.

Other countries your data may be transferred to

We are a global organisation and this means certain of our systems and offices are located around the world.

As not every country has the same rules and regulations about the privacy of your data we make sure that when we transfer your personal details outside of the European Union (or wider European Economic Area) we protect your data appropriately.

RRD is part of the EU-U.S. Data Privacy Framework (DPF) framework and the UK Extension (https://www.dataprivacyframework.gov/) which was designed by the European Commission, the Federal Administration of Switzerland, the UK Department for Science, Innovation and Technology, and the US Department of Commerce to protect the personal data and rights of individuals within the EU, United Kingdom (UK), and Switzerland if their personal data is transferred to the USA. You can review our DPF certification by searching https://www.dataprivacyframework.gov/list for RRD. We have further information on our DPF certification in the Privacy section of the main RRD web site (https://www.rrd.com/privacy-policy).

Should RRD transfer your personal data from the EEA or UK to a US-based processor, we ensure they are DPF certified or that Standard Contractual Clauses (Model Clauses or Data Transfer Agreements) are in place between RRD and the supplier, as appropriate.

For any data transfers outside the EU to countries other than the US, RRD ensures compliance by first checking for a European Commission adequacy finding. If one does not exist, we utilize Standard Contractual Clauses (Model Clauses) to govern the transfer and protect your personal information.

Other useful information

Please review the main body of this privacy notice for information about

• How to contact RRD
• Your rights related to your personal data as a supplier of services to RRD

If you are a Customer of an RRD client (we received your personal data from one of our Clients)

Controller or Processor

We are not the controller of your personal data. We are considered processors of your personal data because our client has shared it with us in order for us to perform services on behalf of our client.

We are processors because we do not decide the reasons for collecting, holding, sharing, and using your data; instead we have received specific instructions from our client to process your data – and you are a customer of that client.

Our client collected your data (or you shared it with them) and they have told us how to hold and process your data. In this relationship our client is considered the controller of your personal data.

The data we collect, hold or process

We do not collect any of your personal data, it is passed to us by our client and we handle it and process it by following an agreed set of processes or instructions from our client.

The nature of the data we may hold on you will vary, depending on the services we perform for our client.

To identify the personal data our client holds about, you please contact that client directly. The laws require those companies to have a Privacy Notice (like this one) available for their customers – and their Privacy Notice should give you these details.

Special categories of data

Only if our client has provided it to us and instructed us to hold or use such personal data, it is possible that we might hold personal data relating to your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data for the purposes of uniquely identifying you, data concerning your health, sex life or sexual orientation.

Similarly we might also hold information related to your children.

Why we collect, hold or process your personal data

As we noted above, we do not collect any of your personal data, it is passed to us by our client because we have entered into a legal contract with them which requires us to hold and process your personal data.

Your data is handled and processed by following an agreed set of processes or instructions from our client.

For example, our client could be a consumer products company. We may print and produce the packaging for a consumer product that you have purchased, and we may provide warehousing and distribution services for that product.

Why we are permitted to collect, hold or process your personal data

We are performing a service for our client under its documented instructions as part of a contract and we need to hold and use your personal data to carry out those instructions of our client (for example if we print and produce the packaging for a consumer product you have purchased and sent to you). We process your data only in accordance with those instructions.

What would happen if we cannot hold your data

It would not be possible to continue operating the service we are providing to our client if we were not able to hold and process your data.

How long we keep your data for

We only retain your personal data for as long as we are instructed to by our clients, so if you stop being a customer of our client your data will be deleted when that retention time ends.

For some of the services, we provide we might only hold your data for a matter of hours or days (such as when we print the package address for a consumer product you may have purchased). For other services we might hold your data for a longer period (such as at the request of our client who may have a regulatory requirement to retain and archive the purchase transactional data long term). Generally, we prefer to agree to with out clients that we will delete your personal data within 60 days following use.

If you wish to know the exact retention periods of your personal data that we hold for our client you will need to ask our client that you are a customer of. Our client should have a Privacy Notice like this available for their customers that sets this information out for you.

Automated decision making or profiling of you

We do not use your personal data to profile you or to make any automated decisions about you. Our client may instruct us to perform analytics on your data and details of these activities will be available in the Privacy Notice of our client you have a business relationship with.

Third-Party Suppliers we use

The suppliers we use to help us fulfill our service to our clients are many, depending on the nature of the service we provide for that client.

If our supplier will process your personal data we make sure that our client has agreed that we can use this supplier and we will require that the supplier keeps your data confidential, has appropriate processes and technology in place to keep your personal data secure, and not use your data for any reason other than in accordance with the set of processing instructions we have agreed with them.

We also require that the supplier not transfer your data internationally without the required permission and legal frameworks in place.

Information relating to suppliers our customer uses to process your personal data is available from our client of whom you are a customer.

Other countries your data may be transferred to

Although we are a global organisation and this means certain of our systems and offices are located around the world, we do not move your data outside of the European Union (or wider European Economic Area, EEA) without the knowledge and permission of our client who instructed us to process your personal data.

As not every country has the same rules and regulations about the privacy of your data we make sure that when we transfer your personal details outside of the European Union (or wider European Economic Area) we protect your data appropriately.

RRD is part of the EU-U.S. Data Privacy Framework (DPF) framework and the UK Extension (https://www.dataprivacyframework.gov/) which was designed by the European Commission, the Federal Administration of Switzerland, the UK Department for Science, Innovation and Technology, and the US Department of Commerce to protect the personal data and rights of individuals within the EU, United Kingdom (UK), and Switzerland if their personal data is transferred to the USA. You can review our DPF certification by searching https://www.dataprivacyframework.gov/list for RRD. We have further information on our DPF certification in the Privacy section of the main RRD web site (https://www.rrd.com/privacy-policy).

Should RRD transfer your personal data from the EEA or UK to a US-based processor, we ensure they are DPF certified or that Standard Contractual Clauses (Model Clauses or Data Transfer Agreements) are in place between RRD and the supplier, as appropriate.

For any data transfers outside the EU to countries other than the US, RRD ensures compliance by first checking for a European Commission adequacy finding. If one does not exist, we utilize Standard Contractual Clauses (Model Clauses) to govern the transfer and protect your personal information.

Other useful information

Please review the main body of this privacy notice for information about

• How to contact RRD
• Your rights related to your personal data as the customer of our client can be found on the Privacy Notice at our client.

You are an RRD Employee:

With regard to RRD employee data, RRD collects employee data only for legitimate business purposes, including:

• Performance of Employment Contract: Carrying out obligations under employment contracts and in connection with other working relationships or arrangements.
• Compliance with Legal Obligations: Compliance with employment, tax, and benefits laws.
• Legitimate Interests: Employee communications, including development and training programs; maintaining a global employee directory; and HR activity including managing employee compensation, performance, hiring (including background checks and reference checks), and employee terminations.
• Vital Interests or Consent: Voluntarily obtaining employee personal data about family members, including emergency points of contact.
• Legitimate Interests (Security & Quality Assurance): RRD Help Desk activity, including audio recordings as needed, and physical security-based video recordings.

Employee information on health, performance evaluations and other sensitive employee matters, whether it is stored physically or electronically, is accessible by other RRD employees as needed for human resource functions or issue resolutions under applicable employee / employer and other laws.

Employee personal/family information is never sold, leased, or rented to any third party. RRD will get affirmative consent from an employee before using such employee’s personal data for any purpose other than described above.

For clarity, employee personal data will never be disclosed to third parties except as follows:

• To those retained by RRD as agents for the purposes of providing requested services to RRD
• Where required pursuant to an applicable law, governmental or judicial order, law or regulation, or to protect the rights or property of RRD
• Where the employee voluntarily provides personal data and the context makes it clear that such data will be provided to a third party

Where human resource data is transferred from the EU or Switzerland to the US in the context of the employment relationship, RRD is certified under the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce.

Your personal data will be retained only for as long as is necessary to fulfill the purposes outlined above or to comply with legal obligations (such as health and safety record-keeping). Once your employment concludes and the relevant limitation periods for legal claims or financial audits have passed, your data will be securely deleted.

Under applicable data protection laws, employees maintain fundamental statutory rights regarding their personal data, including the right to:

• Access, rectify, or request the erasure of their personal data.
• Restrict or object to certain processing operations (specifically those relying on legitimate interests).
• Data portability to receive their data in a structured, commonly used format.
• Withdraw consent at any time where processing relies entirely on voluntary consent, without detriment to their employment status.

To exercise any of these rights, please contact the HR department through the How can we help you? section in this policy.

Employees also have the right to lodge a complaint with their local supervisory authority (e.g., an EU National Data Protection Authority, the UK ICO, or the Swiss FDPIC) if they believe their data protection rights have been infringed.

You are an Employee of a Temporary Labor Agency Working at RRD

Controller or Processor

If you are the employee of one of RRD’s Third Party Suppliers, please see the section regarding RRD’s Suppliers.

RRD would only receive or hold your personal data as provided to us by your employer. We process personal data about you that is provided to us by your employer (such as your name, contact details, qualifications, and right-to-work status) or generated during your assignment (such as attendance records, site access logs, and health and safety reports).

Both RRD and your employer would be controllers of this personal data because we both decided how to hold and use it. While we are the "controller" of the data we use to manage your work on-site, your agency remains your primary employer and a separate data controller. If you have questions regarding how your employer processes your data—including how they share it with us or other third parties—you should contact your agency’s Data Protection Officer or HR department directly.

The data we collect, hold or process

We collect, store and use your personal details, such as name, home address, telephone numbers, mobile numbers and email addresses which you or your employee provides to us.

We also hold letters, emails, voicemails and other typical business documents (e.g. spreadsheets and word documents) relating to business interactions as our temporary employee. Some of these business documents may hold details about you.

If you are visiting one of our locations or offices, we may record CCTV images of you – CCTV is one of security mechanisms to prevent and detect any unauthorised access to our premises and secure areas in our locations.

To pay your salary and as part of your benefits package we may also hold information such as your national insurance numbers, bank account details.

When you originally applied for agency work for RRD we may also have asked for copies of documents for proof of identity and address, such as your passport or household bills.

Special categories of data

Depending on the country and business unit you are working for we may collect data about your nationality for regulatory and legal reporting purposes.

During the course of your work at RRD, we might collect data about your personal health situations (e.g. as part of sickness reporting).

We do not use your genetic or biometric data for uniquely identifying you and we do not collect information on your political, religious or philosophical beliefs.

Why we collect, hold or process your personal data

We process your personal data solely for the legitimate interests of managing your assignment and ensuring the efficient, safe operation of our production facilities.

Why we are permitted to collect, hold or process your personal data

We are both performing services for each other as part of the contract of employment that we have both entered into.

What would happen if we cannot hold your data

It would not be possible for us to compensate you for your employment with us and satisfy the legal requirements related to your employment, such as payment of taxes.

If you are no longer working for RRD then as a result of our regular data reviews and refreshes, your data will be deleted (unless we are required to keep it for legal reasons).

How long we keep your data for

Your personal data will be retained only for as long as is necessary to fulfill the purposes outlined above or to comply with legal obligations (such as health and safety record-keeping). Once your assignment concludes and the relevant limitation periods for legal claims or financial audits have passed, your data will be securely deleted.

Automated decision making or profiling of you

We do not use your personal data to profile you or to make any automated decisions about you.

Suppliers we use

We use a number of suppliers to help us satisfy our business obligations with your employer.

If our supplier will process your personal data we require the supplier to keep your data confidential, have appropriate processes and technology in place to keep your personal data secure, and not use your data for any reason other than through the set of processing instructions we have agreed with them.

We also require that the supplier do not transfer your data internationally without the required permission and legal frameworks in place.

There is a special contract in place between us and our suppliers that covers all the necessary privacy requirements to allow them to hold and process your personal data.

Below are the list of suppliers that may process your personal data as part of your business relationship with RRD.

Other countries your data may be transferred to

We are a global organisation and this means certain of our systems and offices are located around the world.

As not every country has the same rules and regulations about the privacy of your data we make sure that when we transfer your personal details outside of the European Union (or wider European Economic Area) we protect your data appropriately.

RRD is part of the EU-U.S. Data Privacy Framework (DPF) framework and the UK Extension (https://www.dataprivacyframework.gov/) which was designed by the European Commission, the Federal Administration of Switzerland, the UK Department for Science, Innovation and Technology, and the US Department of Commerce to protect the personal data and rights of individuals within the EU, United Kingdom (UK), and Switzerland if their personal data is transferred to the USA. You can review our DPF certification by searching https://www.dataprivacyframework.gov/list for RRD. We have further information on our DPF certification in the Privacy section of the main RRD web site (https://www.rrd.com/privacy-policy).

Should RRD transfer your personal data from the EEA or UK to a US-based processor, we ensure they are DPF certified or that Standard Contractual Clauses (Model Clauses or Data Transfer Agreements) are in place between RRD and the supplier, as appropriate.

For any data transfers outside the EU to countries other than the US, RRD ensures compliance by first checking for a European Commission adequacy finding. If one does not exist, we utilize Standard Contractual Clauses (Model Clauses) to govern the transfer and protect your personal information.

Other useful information

Please review the main body of this privacy notice for information about

• How to contact RRD
• Your rights related to your personal data as an agency worker of RRD

You are a Potential RRD Employee

Controller or Processor

We are considered controllers of your personal data that you share with us. This is because we decide the reasons for collecting, holding and using your data. We also decide the ways in which we process your data.

The data we collect, hold or process

We collect, store and use your personal details, such as name, home address, telephone numbers, mobile numbers and email addresses.

We also hold letters, emails, voicemails and other typical business documents (e.g. spreadsheets and word documents) relating to your interactions with us as a potential employee. Some of these business documents may hold details about you.

If you are visiting one of our locations or offices, we may record CCTV images of you – CCTV is one of security mechanisms to prevent and detect any unauthorised access to our premises and secure areas in our locations.

When you applied to work for RRD, we may also have asked for copies of documents for proof of nationality, residence status, identity, work authorization, and address, such as your passport or household bills.

Special categories of data

Depending on the country and business unit you are working for we may collect data about your nationality for regulatory and legal reporting purposes.

Depending on the country and business unit you have applied to work for we might also have had a third party conduct a background check on you as part of our employee screening process. This may have included a check on any criminal convictions to the extent permitted by applicable laws.

We might have collected data about your personal health situation e.g. as part of a pre-employment health check.

We do not collect or use your genetic or biometric data for uniquely identifying you and we do not collect information on your political, religious or philosophical beliefs.

Why we collect, hold or process your personal data

This data was collected as part of the pre-employment process. We needed this data to discharge various legal obligations, such as checking your right to work for us, and for some roles in some countries we might also have been contractually bound to screen our employees as a requirement to perform services on behalf of our clients.

Why we are permitted to collect, hold or process your personal data

We collect personal data as part of the pre-employment interactions before we both enter into a contract of employment. We collect, hold and process your personal data as part of our legitimate business interests.

What would happen if we could not hold your data

If you are not successful in your application to work for RRD, your personal data will be deleted as a result of our regular data reviews and refreshes, unless we are required to keep it for legal reasons.

If you are successful in your application to work for RRD, we will continue to hold your data as part of the employee data we hold and process as part of the employment contract between us.

How long we keep your data for

Our default position is to delete personal data of job applicants unless there is a legal requirement for us to hold the data for a longer period of time e.g. for employment law purposes. We determine retention periods based on legal regulations and our financial record responsibilities. We do not retain any documents specific to a criminal background checks in our records.

If we do need to keep data for legal purposes, we will not use that data for any other purposes and we will protect it from loss, alteration or unauthorised access.

If you are successful in your application to work for us, your personal data will be held as employee personal data.

Automated decision making or profiling of you

We do not use your personal data to profile you or to make any automated decisions about you without your permission.

Suppliers we use

We use a number of suppliers to help us satisfy our obligations to confirm legal requirements when you are evaluated as a potential employee.

If our supplier will process your personal data we require the supplier to keep your data confidential, have appropriate processes and technology in place to keep your personal data secure, and not use your data for any reason other than through the set of processing instructions we have agreed with them.

We also require that the supplier do not transfer your data internationally without the required permission and legal frameworks in place.

All the necessary privacy requirements will be put in place through the contracts between us and our suppliers to allow them to hold and process your personal data.

Other countries your data may be transferred to

We are a global organisation and this means certain of our systems and offices are located around the world.

As not every country has the same rules and regulations about the privacy of your data we make sure that when we transfer your personal details outside of the European Union (or wider European Economic Area) we protect your data appropriately.

RRD is part of the EU-U.S. Data Privacy Framework (DPF) framework and the UK Extension (https://www.dataprivacyframework.gov/) which was designed by the European Commission, the Federal Administration of Switzerland, the UK Department for Science, Innovation and Technology, and the US Department of Commerce to protect the personal data and rights of individuals within the EU, United Kingdom (UK), and Switzerland if their personal data is transferred to the USA. You can review our DPF certification by searching https://www.dataprivacyframework.gov/list for RRD. We have further information on our DPF certification in the Privacy section of the main RRD web site (https://www.rrd.com/privacy-policy).

Should RRD transfer your personal data from the EEA or UK to a US-based processor, we ensure they are DPF certified or that Standard Contractual Clauses (Model Clauses or Data Transfer Agreements) are in place between RRD and the supplier, as appropriate.

For any data transfers outside the EU to countries other than the US, RRD ensures compliance by first checking for a European Commission adequacy finding. If one does not exist, we utilize Standard Contractual Clauses (Model Clauses) to govern the transfer and protect your personal information.

Other useful information

Please review the main body of this privacy notice for information about

• How to contact RRD
• Your rights related to your data as a potential employee of RRD

If you are a Former RRD Employee

Controller or Processor

We are considered controllers of your personal data that you shared with us. This is because we decide the reasons for collecting, holding and using your data. We also decide the ways in which we process your data.

The data we collect, hold or process

We collect, store and use your personal details, such as name, home address, telephone numbers, mobile numbers and email addresses.

We also hold letters, emails, voicemails and other typical business documents (e.g. spreadsheets and word documents) relating to your interactions with us as our employee. Some of these business documents may hold details about you.

If you are visiting one of our locations or offices, we may record CCTV images of you – CCTV is one of security mechanisms to prevent and detect any unauthorised access to our premises and secure areas in our locations.

To pay your salary and as part of your benefits package, we may also have held information such as your national insurance numbers and bank account details.

When you originally applied to employment at RRD, we may also have asked for copies of documents for proof of nationality, residence status, work authorization, identity and address, such as your passport or household bills.

Special categories of data

Depending on the country and business unit you are working for we may collect data about your nationality for regulatory and legal reporting purposes.

Depending on the country and business unit you worked for we might also have had a third party conduct a background check on you as part of our employee screening process. This may have included a check on any criminal convictions to the extent permitted by applicable laws.

Prior to employment and during the course of your employment we might have collected data about your personal health situation, e.g., as part of sickness reporting.

Certain employee benefits might also have required you to pass information on your health to us, e.g., if we offered you private medical health insurance.

We do not use or hold your genetic or biometric data for uniquely identifying you and we do not collect information on your political, religious or philosophical beliefs.

It is possible we might hold information related to your children should they have been given to us as next-of-kin in the event of your death in service, or you may have extended an employee benefit, such as private health care insurance, to include your children.

Why we collect, hold or process your personal data

This data was collected as part of the pre-employment and ongoing employment process. We needed this data to discharge various legal obligations, such as checking your right to work for us and we might also have been contractually bound to screen our employees as part of our services to our clients.

We also needed this data to pay your salary and to provide you with the benefits package to compensate you for working for us.

Why we are permitted to collect, hold or process your personal data

We were both performing services for each other as part of the contract of employment we have both entered into. We collect, hold and process your personal data as part of our legitimate business interests.

What would happen if we could not hold your data

As you are no longer working for RRD then as a result of our regular data reviews and refreshes, your data will be deleted (unless we are required to keep it for legal reasons).

How long we keep your data for

Our default position is only to keep personal data for as long as you are employed by RRD, unless there is a legal requirement for us to hold the data for a longer period of time e.g. for tax purposes. We determine retention periods based on legal regulations and our financial record responsibilities. We do not retain any documents specific to a criminal background checks in our records.

As you are no longer working for RRD then as a result of our regular data reviews and refreshes, your data will be deleted (unless we are required to keep it for legal reasons or for the administration of benefits). If we do need to keep data for these purposes we will not use that data for any other purposes and we will protect it from loss, alteration or unauthorised access.

Automated decision making or profiling of you

We do not use your personal data to profile you or to make any automated decisions about you.

Suppliers we use

We use a number of suppliers to help us satisfy our obligations to confirm legal requirements when you are evaluated as a potential employee.

If our supplier will process your personal data we require the supplier to keep your data confidential, have appropriate processes and technology in place to keep your personal data secure, and not use your data for any reason other than through the set of processing instructions we have agreed with them.

We also require that the supplier do not transfer your data internationally without the required permission and legal frameworks in place.

All the necessary privacy requirements will be put in place through the contracts between us and our suppliers to allow them to hold and process your personal data.

Other countries your data may be transferred to

We are a global organisation and this means certain of our systems and offices are located around the world.

As not every country has the same rules and regulations about the privacy of your data we make sure that when we transfer your personal details outside of the European Union (or wider European Economic Area) we protect your data appropriately.

RRD is part of the EU-U.S. Data Privacy Framework (DPF) framework and the UK Extension (https://www.dataprivacyframework.gov/) which was designed by the European Commission, the Federal Administration of Switzerland, the UK Department for Science, Innovation and Technology, and the US Department of Commerce to protect the personal data and rights of individuals within the EU, United Kingdom (UK), and Switzerland if their personal data is transferred to the USA. You can review our DPF certification by searching https://www.dataprivacyframework.gov/list for RRD. We have further information on our DPF certification in the Privacy section of the main RRD web site (https://www.rrd.com/privacy-policy).

If RRD’s decides to transfer your personal data out of the EEA or UK to a US processor, we require that processor to be DPF certified, as we are or we put in place Standard Contractual Clauses (also called Model Clauses or Data Transfer Agreements) between ourselves (RRD) and the supplier, depending on which method is appropriate for the situation.

Should RRD transfer your personal data from the EEA or UK to a US-based processor, we ensure they are DPF certified or that Standard Contractual Clauses (Model Clauses or Data Transfer Agreements) are in place between RRD and the supplier, as appropriate.

For any data transfers outside the EU to countries other than the US, RRD ensures compliance by first checking for a European Commission adequacy finding. If one does not exist, we utilize Standard Contractual Clauses (Model Clauses) to govern the transfer and protect your personal information.

Other useful information

Please review the main body of this privacy notice for information about

• How to contact RRD
• Your rights related to your personal data as a former employee of RRD

If you are a Visitor to Our Websites or Our Social Media Platform Sites

General interactions with us

We collect basic data (like your name, email, address, and phone number) that you choose to provide through our websites, RRD applications (also known as “apps”), or when you contact us directly.

Sending us emails

If you email us, your email data will be held and processed in either Google Mail or Salesforce Marketing Cloud.

These are third-party services and are located either in the European Union or in the United States of America (USA). We make sure that your data is transferred legitimately to the email systems in the USA through the protection of the EU-U.S. Data Privacy Framework (DPF) regulatory framework.

The privacy information for Google Mail can be found at https://policies.google.com/privacy and for Salesforce can be found here https://www.salesforce.com/uk/company/privacy/.

When you email us, we try to use Transport Layer Security (TLS) to encrypt and protect the email traffic between us. If your email systems cannot use TLS you should be aware that any email that we send or receive may not be protected as it travels across the Internet.

We also monitor any emails sent to us for viruses and malicious software.

Please be aware that all the emails we send and receive through Google Mail are kept in a read-only archive for legal purposes in the event they are needed as part of an investigation or court case.

Using social media

We use social media to help you reach us and keep you informed. If you message us privately through any of the below identified platforms, we will retain that message for no more than 12 months unless there is a legal requirement to hold the message longer.

The privacy notices of the of the following social media platforms we use can be found below.

1. YouTube: https://policies.google.com/privacy
2. X (formerly Twitter): https://x.com/en/privacy
3. LinkedIn: https://www.linkedin.com/legal/privacy-policy