Data Privacy Notice
IVL Global Employee Privacy Policy
Introduction
Indorama Ventures Public Company Limited and its affiliates, subsidiaries and newly acquired companies (“IVL", “we” or “us”)[1] are committed as part of our core values to the principles of ethical and lawful conduct in all of our business activities everywhere in the world that we do business. Many of the jurisdictions in which IVL does business have privacy and data protection laws which govern how organizations can collect, use, and disclose the Personal Data of their employees, former employees, directors, interns, successful applicants, self-employed persons, and other permanent or temporary workers ("Employees"). IVL is committed to use any Personal Data fairly, lawfully, and in accordance with applicable laws. We want you to feel secure that when you work with IVL, your Personal Data are in good hands. This privacy policy (“Policy”) tells you everything you need to know about how we protect the Personal Data we process and control relating to you ("your Personal Data"; "your Data") and which rights you have in relation to the processing of your Personal Data.
Any IVL entity located outside the European Union will for the purposes of compliance with data privacy laws be represented by Indorama Ventures Europe B.V. (Markweg 201, 3198 NB Europoort Rotterdam).
Personal Data
"Personal Data" means individually, directly or indirectly, identifiable information about a person, including you, that is collected or otherwise received by IVL.
What are the sources we get your personal information from?
We may collect Personal Data about you in the following ways:
• Directly from you, such as through the application and hiring process (online or in-person);
• During your activities in the course of your employment, such as through your performance and interaction with other Employees, contractors, customers or other individuals or through your use of our systems, intranet or the HR services that we offer through our intranet or our online service and other similar applications; and
• From other parties, subject to the requirements of applicable law. These parties may include:
o References;
o Publicly available information;
o Former employers;
o Other Employees (for example, to nominate and celebrate a colleague for outstanding achievements); and
o Other third parties, such as background check agencies, police departments, company- approved third-party travel management systems, and third-party ride services (if and to the extent permitted by applicable law).
Which categories of Personal Data do we collect and how do we process such Personal Data? We collect Personal Data of our Employees. If the Personal Data we collect are not listed in this Policy, we will give individuals (when required by law) appropriate notice of which other data will be collected and how they will be used.
IVL may (but will not necessarily) process the personal information set out in the below list. In all cases the Personal Data mentioned in the below list will only be processed to the extent permitted by local law.
Personal details, contact details, and identifiers
Name, pronoun, all types of identifiers and contact details (such as home e-mail address, home phone number, mobile phone number, physical address), gender, date of birth, age, place of birth, national identification number, social security number (or similar government-issued identification numbers), insurance information, marital/civil partnership status, domestic partners, dependents, emergency contact information, and military history; professional/personal calendar availability/scheduling information for meeting/communication purposes.
Education information and professional or employment-related information
IVL may collect information about your education and professional or employment-related information, such as your employment history.
Sensitive data for recruitment purposes
IVL may collect certain types of sensitive information when permitted by local law or with your consent, such as health/medical information (including disability status), trade union membership information, religion, race or ethnicity, minority flag, and information on criminal convictions and offences. Also, incidentally, IVL may process information about your sexual orientation (when processing information related to marital status, family or dependents, such processing may unintentionally reveal a person’s sexual orientation by way of the name and gender of the partner). IVL collects all sensitive information for specific purposes, such as health/medical information in order to accommodate a disability or illness (subject to legal limits on the timing of collection of such information and other applicable limitations) and to provide benefits; background checks and diversity-related personal information (such as race or ethnicity) in order to comply with legal obligations and internal policies relating to diversity and anti-discrimination.
Documentation required under immigration laws
IVL may collect data on citizenship, passport data, visa’s and other details of residency or work permit (a physical copy and/or an electronic copy).
Financial information for payroll/benefits purposes
Your banking and other relevant financial details we need for payroll/benefits purposes.
Talent management information
Information necessary to complete a background check, details on performance decisions and outcomes, performance feedback and warnings, e-learning/training programs, performance and development reviews (including information you provide when asking for/providing feedback, creating priorities, updating your input in relevant tools), driver’s license and car ownership information.
Requested recruitment information
Information requested to provide during the recruitment process, to the extent allowed by applicable law.
Recruitment information you submit
Information that you submit in résumés / CVs, letters, writing samples, or other written materials (including photographs).
Information generated by us during recruitment
Information generated by interviewers and recruiters related to you, based on their interactions with you or basic internet searches where allowed under applicable law.
Recruitment information received from third parties
Information related to you provided by third-party placement firms, recruiters, or job-search websites, where applicable.
Audio-visual materials
Photograph, and images/audio/footage captured/recorded on CCTV or other video systems when visiting our office or captured in the course of recruitment events or video recruitment interviews or during any other virtual and live events (including recordings during virtual workshops or similar events).
Recommendations
Recommendations related information provided on your behalf by others.
Employment history and background checks
Information about your prior employment, education, spoken languages, and where applicable and allowed by applicable law, credit history, criminal records or other information revealed during background screenings.
Diversity related information
Information about race / ethnicity / religion / disability / gender and self-identified LGBTQIAP status, for purposes of government reporting where required by law, as well as to understand the diversity characteristics of the IVL workforce, subject to legal limits.
Assessment information
Information generated by your participation in psychological, technical or behavioral assessments. You will receive more information about the nature of such assessments before your participation in any of them.
Company clothing and personnel protective equipment
Height, weight, and clothing size, physical limitations and special needs, if and to the extent permitted by applicable law (for example, health and safety).
Company fleet
Driver’s license, driving record, licensing plate, parking tickets, traffic fines, GPS location, and route(s) travelled.
Outstanding achievements
Information about the efforts of Employee to improve the communities where we work and/or to have a positive impact on the lives of others (for example, as part of their involvement in charitable work).
Except for certain information that is required by law or by IVL policies (including management of an employment relationship with IVL), your decision to provide any Personal Data to us is voluntary. You will therefore not be subject to adverse consequences if you do not wish to provide us with your Personal Data. However, please note that if you do not provide certain information, we may not be able to accomplish some or all of the purposes outlined in this Policy (which may – in the extreme case – result in us being required to terminate our work relationship with you), and you may not be able to use certain tools and systems which require the use of such Personal Data.
If you provide us with Personal Data of another person (for instance, a potential employee/referral or a dependent), you are responsible for ensuring that such person is made aware of the information contained in this Policy and that the person has given you his/her consent for sharing the information with IVL.
For which purposes and on which legal basis do we use your Personal Data?
Under all circumstances IVL only uses your Personal where this is allowed under applicable law. IVL uses your Personal Data only where required for specific purposes. Please view the list below for (i) a list of the purposes for which IVL uses your Personal Data and (ii) an overview of the legal basis for each such purpose.
I. Specific employment purposes and legal basis
Manage our employment relationship with you.
Necessary for the performance of a contract to which you are a party.
Facilitate communication with you (including facilitating meetings; communication in case of emergencies, and to provide you with requested information).
Justified on the basis of our legitimate interests for ensuring proper communication and with you (including emergency handling within the organization).
Assess your suitability for employment for the role for which you are hired, as well as future roles that may become available.
Justified on the basis of IVL’s legitimate interests of ensuring that it recruits the appropriate Employees.
Perform administrative functions.
Justified on the basis of IVL’s legitimate interests of ensuring that it recruits the appropriate Employees.
Administration of Employee benefits.
Necessary for the performance of a contract to which you are a party and justified on the basis of IVL’s legitimate interests of ensuring that our Employees receive the applicable benefits.
Perform any legally required reporting and respond to legal process.
Compliance with a legal obligation.
Workflow management, such as assigning, managing, and administering projects.
Necessary for the performance of a contract to which you are a party and justified on the basis of our legitimate interests for ensuring the proper functioning of our business operations.
Compensation related-activities, including compensation analysis.
Justified on the basis of IVL’s legitimate interests of ensuring that our Employees receive the applicable benefits.
Payroll processing.
Necessary for the performance of a contract to which you are a party and justified on the basis of IVL’s legitimate interests of ensuring that our Employees receive the applicable benefits.
Performance management.
Necessary for the performance of a contract to which you are a party and justified on the basis of IVL’s legitimate interests of ensuring that it recruits the appropriate Employees.
Succession planning.
Justified on the basis of IVL’s legitimate interests of ensuring that it recruits the appropriate Employees.
Benefits, pension and personnel administration, including health and medical benefits, leave entitlements, and bonuses.
Compliance with a legal obligation, necessary for the performance of a contract to which you are a party and/or justified on the basis of IVL’s legitimate interest of ensuring that (i) our Employees receive the applicable benefits and/or that (ii) it recruits the appropriate Employees.
Talent management, career development, engagement, and teambuilding (including special events), or operations management.
Necessary for the performance of a contract to which you are a party and justified on the basis of IVL’s legitimate interests of ensuring that it recruits the appropriate Employees.
Retirement planning and management.
Necessary for the performance of a contract to which you are a party and justified on the basis of IVL’s legitimate interests of ensuring that (i) it recruits the appropriate Employees or that (ii) our Employees receive the applicable benefits.
Monitoring and enforcing compliance with company policies and procedures (including Code of Conduct, ethics, health and safety, travel and expense, corporate card, attendance, and working from home policies), legal requirements applicable to Company (pursuant to, among others, labour, tax, and social security laws) or contractual requirements (pursuant to, among others, your contract with Company), or the other activities referred to under the Monitoring section of this Policy.
Compliance with a legal obligation and/or justified on the basis IVL’s legitimate interests of ensuring that (i) it recruits the appropriate Employees or that (ii) our Employees receive the applicable benefits.
Travel, transportation, and relocation planning.
Necessary for the performance of a contract to which you are a party and justified on the basis IVL’s legitimate interests of ensuring that (i) it recruits the appropriate Employees or that (ii) our Employees receive the applicable benefits.
IT activation, support, and authentication.
Necessary for the performance of a contract to which you are a party and justified on the basis of IVL’s legitimate interests for ensuring the proper functioning of our business operations.
Organizational development and communications.
Justified on the basis of IVL’s legitimate interests for ensuring the proper functioning of our business operations.
Corporate governance or corporate affairs.
Justified on the basis of IVL’s legitimate interests for ensuring the proper functioning of our business operations.
Administration and management of Company’s financial affairs, tax validation, and optimization.
Justified on the basis of IVL’s legitimate interests for ensuring the proper functioning of our business operations.
Preventing unauthorized individuals from accessing, changing or deleting your Personal Data.
Justified on the basis of IVL’s legitimate interests for ensuring (i) the proper functioning of our business operations and (ii) data security.
Supporting any claim, defense or declaration in a judicial or quasi-judicial proceeding.
Justified on the basis of our legitimate interests for ensuring the proper functioning of IVL’s business operations.
Monitoring and preventing sexual harassment, discrimination, fraud or other criminal activities.
Justified on the basis of IVL’s legitimate interest of ensuring a safe working environment.
Safety and security monitoring while on premises (for example, CCTV monitoring and access control cards) and while working from home.
Justified on the basis of IVL’s legitimate interest of ensuring a safe working environment.
Facilitating onboarding and exit of personnel.
Justified on the basis of IVL’s legitimate interests of ensuring that it recruits the appropriate Employees.
Facilitating internal recruitment and hiring.
Justified on the basis of IVL’s legitimate interests of ensuring that it recruits the appropriate Employees.
Ensuring an engaging experience, realizing continuous improvement, and personalizing the HR services that we offer through information collected on our intranet and our SF online service and similar application.
Justified on the basis of IVL’s legitimate interests for ensuring the proper functioning of our business operations.
Communicating internally or externally (for example, through newsletters or social media).
Justified on the basis of IVL’s legitimate interests of ensuring that it recruits the appropriate Employees.
Offering Employee-specific opportunities and coupons.
Justified on the basis of IVL’s legitimate interests of ensuring that it recruits the appropriate Employees.
Managing memberships to professional associations.
Justified on the basis of IVL’s legitimate interests of ensuring that it recruits the appropriate Employees.
Performing internal or external audits.
Compliance with a legal obligation and/or justified on the basis of our legitimate interests for ensuring the proper functioning of our business operations.
Conducting corporate transactions (including mergers, acquisitions and divestments).
Justified on the basis of IVL’s legitimate interests for ensuring the proper functioning of our business operations.
Organizing internal and external events.
Justified on the basis of IVL’s legitimate interests of ensuring that it recruits the appropriate Employees.
Achieving the purposes contemplated by any drug and/or alcohol policies adopted by IVL from time to time, if any, to the extent permitted by applicable law.
Justified on the basis of IVL’s legitimate interest of ensuring a safe working environment.
Managing exceptional situations, serious threats to health and protecting you and other individuals (for example, other Employees) in such situations.
Justified on the basis of IVL’s legitimate interest of ensuring a safe working environment.
Investigating and enforcing disciplinary measures.
Justified on the basis of IVL’s legitimate interests of ensuring that it recruits the appropriate Employees.
Dealing with legal disputes involving you, or other Employees, workers, and contractors, including accidents at work.
Justified on the basis of IVL’s legitimate interests of ensuring that it recruits the appropriate Employees.
Carrying out our contractual obligations with customers and suppliers (for example, Personal Data included in purchase orders, quality complaints, email correspondences).
Justified on the basis of IVL’s legitimate interests for ensuring the proper functioning of our business operations.
Nominating and celebrating Employees who go above and beyond to drive exceptional results at Company, to foster a positive work environment, to improve the communities where we work, and/or to have a positive impact on the lives of others (for example, as part of charitable work).
Justified on the basis of IVL’s legitimate interests of ensuring that it recruits the appropriate Employees.
II. Specific recruitment purposes and legal basis
Recruitment.
Justified on the basis of our legitimate interests for ensuring that we recruit the appropriate Employees.
Assess your suitability for employment for the role for which you are applying.
Justified on the basis of IVL’s legitimate interests of ensuring that it recruits the appropriate Employees.
Facilitating communication with you (including facilitating meetings; communication in case of emergencies, and to provide you with requested information).
Justified on the basis of our legitimate interests for ensuring proper communication and with you (including emergency handling within the organization).
Manage your application.
Justified on the basis of IVL’s legitimate interests of ensuring that it recruits the appropriate Employees.
Perform administrative functions (e.g. reimburse you for interview-related expenses).
Justified on the basis of IVL’s legitimate interests of ensuring that it recruits the appropriate Employees.
Perform data analytics, including analysis of our applicant pool in order to better understand who is applying to positions at IVL and how to attract and keep top talent.
Justified on the basis of IVL’s legitimate interests of ensuring that it continually improves its recruitment processes.
If you register on our Careers website, we will enter you into a database to receive future mailings about IVL positions and events. You may also receive personalized job recommendations while browsing our Careers website.
Justified on the basis of IVL’s legitimate interests of ensuring that it recruits the appropriate Employees.
In some cases, record your online interview for review by additional recruiters and hiring managers.
Justified on the basis of IVL’s legitimate interests of ensuring that it recruits the appropriate Employees.
Transfer your contact information, education data, employment data, application information and the CV, all as supplied by you in our recruitment system, to the IVL Talent Connection — a site that we maintain to notify you about new positions that may be of interest to you.
Justified on the basis of IVL’s legitimate interests of ensuring that it recruits the appropriate Employees.
III. General purposes and legal basis
Monitoring your use of our systems (including monitoring the use of our website and any apps and tools you use).
Justified on the basis of our legitimate interests of avoiding non-compliance and protecting our reputation.
Social listening (Identifying and assessing what is being said about IVL and our clients on social media (only publicly accessible content) to understand sentiment, intent, mood and market trends and our stakeholders’ needs and thereby improving our services. We do this through key-word searches and our goal is to gain insights in conversation trends over a specified period and not to identify an individual. To achieve this, we analyze and monitor conversation streams and monitor publicly available opinions, statements or other interactions on social media channels.)
Justified on the basis of our legitimate interest of protecting our assets and our brand on social media
Improving the security and functioning of our website, networks and information.
Justified on the basis of our legitimate interests for ensuring that you receive an excellent user experience and our networks and information are secure.
Undertaking data analytics, i.e. applying analytics to business operations and data to describe, predict and improve business performance within IVL and/or to provide a better user experience. This includes marketing analytics and analytics related to the organization of events/meetings (more details on how we run analytics on our website can be found in our cooky policy).
Justified on the basis of our legitimate interests for ensuring the proper functioning of our business operations.
For audio/video captured during live/recorded events (including virtual events/webinars): to inform interested stakeholders about the content of such events/recordings (including online publication of such recordings for marketing purposes).
Justified on the basis of our legitimate interests for ensuring the proper functioning of our business operations in case of non-targeted audio/video and based on your consent obtained before publication in case of targeted audio/video.
Where the above list states that we rely on our legitimate interests for a given purpose, we are of the opinion that our legitimate interests are not overridden by your interests, rights or freedoms, given (i) the transparency we provide on the processing activity, (ii) our privacy by design approach, (iii) our regular privacy reviews and (iv) the rights you have in relation to the processing activity. If you wish to obtain further information on this balancing test approach, please contact IVL’s Compliance Department at dpo@indorama.net
We will process your Personal Data for the purposes mentioned above based on your prior consent, to the extent such consent is mandatory under applicable laws. To the extent you are asked to click on/check "I accept", "I agree" or similar buttons/checkboxes/functionalities in relation to a privacy statement, doing so will be considered as providing your consent to process your Personal Data, only in the countries where such consent is required by mandatory law. In all other countries, such action will be considered as a mere acknowledgement and the legal basis of the processing of your Personal Data will not be your consent but any other applicable legal basis as mentioned above.
We will not use your Personal Data for automated processing, including profiling. Also, we will not use your Personal Data for purposes that are incompatible with the purposes of which you have been informed, unless it is required or authorized by law, or it is in your own vital interest (e.g. in case of a medical emergency) to do so. If we wish to use your Personal Data for a new purpose, not covered by this Policy, then we will inform you thereof, explaining this new use prior to commencing the processing and setting out the relevant purposes and processing conditions.
Information about dependents
If you provide IVL with information about members of your family and/or other dependents (for example, for emergency contact, benefits administration purposes or relocation assignments), we will only use that information for the purposes for which it was provided. You are responsible for obtaining the explicit consent of these individuals (unless you can provide such consent on their behalf) to the use of that information for the purposes set out in this Policy.
Will we share your Personal Data with third parties?
We may transfer Personal Data to our service providers, professional advisors, public and governmental authorities or third parties in connection with a (potential) corporate or commercial transaction. Such third parties may be located in other countries. Before we do so, we shall take the necessary steps to ensure that your Personal Data will be given adequate protection as required by relevant data privacy laws and IVL’s internal policies. IVL may also transfer your Personal Data to any of its global affiliates/partners in furtherance of any visits to our IVL locations.
For example, we may disclose personal information to third parties for other business purposes as follows:
• We share your information with third-party service providers that provide services to us, including billing, payment processing, customer service, email deployment, advertising and marketing, security and performance monitoring, maintaining or servicing accounts, processing or fulfilling orders and transactions, verifying customer information, research, data hosting, auditing, and data processing;
• To protect and defend the legal rights, safety, and security of IVL, our affiliates, users, or the public, including to protect against fraud and malicious activity; and
• For other business purposes described in this Policy or for any other purpose disclosed to you at the time we collect the information or pursuant to your consent.
• We may also share your information in connection with a substantial corporate transaction, such as the sale of a website, a merger, consolidation, asset sale, initial public offering, or in the unlikely event of a bankruptcy.
Unless you are otherwise notified, any transfers of your Personal Data from within the European Economic Area (EEA) to third parties outside the EEA will be based on an adequacy decision or are governed by the European Commission’s standard contractual clauses (a copy of which can be obtained through the contact information included below), if necessary together with a transfer impact assessment (TIA) and any supplementary measures based on the outcome of such TIA.
What about data security?
We maintain appropriate organizational, physical and technical security arrangements against unauthorized or unlawful processing and/or against accidental loss, alteration, disclosure or access, or accidental or unlawful destruction of or damage thereto. We have protocols, controls and relevant policies, procedures and guidance to maintain these arrangements taking into account the risks associated with the categories of Personal Data and the processing we undertake.
We adopt market leading security measures to protect your Personal Data. For further information, please contact our Compliance Department at dpo@indorama.net.
Where will your Personal Data be processed?
As a global organization with offices and operations throughout the world, Personal Data we collect may be transferred or be accessible internationally throughout IVL's global business and between its entities and affiliates. Any such transfers throughout IVL’s global business take place in accordance with the applicable data privacy laws and in accordance with our Cross Border Data Transfer Agreement ("CBDTA"). Our CBDTA reflect the standards contained in European data privacy laws (including the General Data Protection Regulation (EU) 2016/679). Having our CBDTA means that all our group entities which have signed up to our CBDTA have to comply with the same internal rules. It also means that your rights (see "Which rights do you have with respect to the processing of your Personal Data?") stay the same no matter where your data are processed by IVL.
For more information about the CBDTA, please contact our Compliance Department at dpo@indorama.net.
How long will your Personal Data be retained by us?
IVL intends to keep Personal Data in its control accurate and up to date. We will retain Personal Data only as long as is necessary to carry out the purposes described in this Policy. If there are any changes to your Personal Data, please notify the Human Resources department. If you inform us of any changes or we otherwise become aware of any factual inaccuracies in your Personal Data, we will seek to promptly correct such inaccuracies.
IVL has internal retention policies and procedures that build upon the following criteria to determine the retention periods of Personal Data in the context of the above-mentioned purposes:
• End of the employment or working relationship with IVL;
• Sensitivity of the Personal Data;
• Security reasons;
• Applicable statutes of limitation;
• On-going or potential litigation or dispute; and
• Regulatory or legal obligation to retain the Personal Data (for example, for social security purposes or in the context of CCTV surveillance).
For more information about our retention policies and procedures, please contact our Compliance Department at dpo@indorama.net.
Which rights do you have with respect to the processing of your Personal Data?
You are entitled (in the circumstances and under the conditions, and subject to the exceptions, set out in applicable law) to:
• Request access to the Personal Data we process about you: this right entitles you to know whether we hold Personal Data about you and, if we do, to obtain information on and a copy of that Personal Data;
• Request a rectification of your Personal Data: this right entitles you to have your Personal Data be corrected if it is inaccurate or incomplete;
• Object to the processing of your Personal Data: this right entitles you to request that IVL no longer processes your Personal Data;
• Request the erasure of your Personal Data: this right entitles you to request the erasure of your Personal Data, including where such Personal Data would no longer be necessary to achieve the purposes;
• Request the restriction of the processing of your Personal Data: this right entitles you to request that IVL only processes your Personal Data in limited circumstances;
• Request portability of your Personal Data: this right entitles you to receive a copy (in a structured, commonly used and machine-readable format) of Personal Data that you have provided to IVL, or request IVL to transmit such Personal Data to another data controller.
If and to the extent that the processing of your Personal Data is based on your consent, you have the right to withdraw such consent at any time by contacting Compliance Department. Please note that this will not affect IVL’s right to process Personal Data obtained prior to the withdrawal of your consent, or its right to continue parts of the processing based on other legal bases than your consent.
If, despite our commitment and efforts to protect your Personal Data, you believe that your data privacy rights have been violated, we encourage and welcome individuals to come to IVL first to seek resolution of any complaint. You have the right at all times to register a complaint directly with the relevant supervisory authority or to make a claim against IVL with a competent court (either in the country where you live, the country where you work or the country where you deem that data privacy law has been infringed).
Any of your rights under this Policy can be exercised by contacting our Compliance Department at dpo@indorama.net. However, please note that we may, if and to the extent permitted by applicable law, need to retain or continue processing certain information, for example for legal or administrative purposes (for example keeping of social security records), or if we have a compelling legitimate interest in not deleting the Personal Data that outweighs your privacy interest. If we have deleted the Personal Data, we may not, for technical reasons, immediately remove all copies of the personal data from our systems and backup systems. We may also refuse to comply with the above requests if they are unreasonably frequent, require unreasonable technical effort or have an unreasonable technical impact on our systems or jeopardize the privacy of others.
For all requests set out above, please send us an email with “data privacy request” in the subject line. Where required under applicable law, we may ask for proof of your identity (for example, by sending a verification e-mail) to help us prevent unauthorized individuals from accessing, changing or deleting your Personal Data.
We will respond to your request as soon as practically possible and always within the timeframes set forth by applicable law.
If we comply with your request to improve, supplement or remove Personal Data, we will also inform third parties to whom these Personal Data have been provided of the changes made.
On what basis do we use your Personal Data?
We collect and use your Personal Data when this is necessary to:
• Perform your employment contract (or other similar type of agreement) with IVL; and
• Comply with regulatory requirements (pursuant to, among others, labour, tax, and social security laws).
We may process some of your Personal Data when this is in our legitimate interest. This is the case, for example, when we collect and use your Personal Data to:
• Organize teambuilding events;
• Secure our premises and IT systems;
• Handle and investigate complaints through our Code of Conduct Hotline; and
• Prevent or investigate fraud or other criminal activities.
Sometimes, we may process your Personal Data after you have given us your prior consent. For example, in certain circumstances we will ask your prior consent before using your photos or videos as part of our corporate communications.
What happens if you do not provide us with the Personal Data we request or if you ask that we stop processing your Personal Data?
Our ability to perform our obligations derived from your employment contract (or similar type of agreement) with IVL and our ability to comply with our legal and contractual obligations sometimes depend on IVL having access to and being able to use certain Personal Data. Therefore, and depending on the circumstances, if you do not provide us with the Personal Data we request or if you ask that we stop processing your Personal Data, we may not be able to perform our contractual obligations (such as paying you for your work) or we may be in breach of one or more legal obligations applicable to us. In some cases, if we are not allowed to process your Personal Data, this may result in us being required to terminate our work relationship with you.
Access to Personal Data
Access to your Personal Data will be given to those who need such access for the purposes listed above or where required by law. These parties include, among others, the IVL Human Resources department, relevant business managers, and, on limited occasions, members of the Information Technology ("IT"), Finance, Tax, and Legal departments. Access to the internal Employee directory (which contains the professional (contact) details of IVL personnel) will be provided to the Employees that need to access such internal Employee directory.
We may share your Personal Data with affiliates or subsidiaries that provide shared services within IVL, for example, in connection with HR services, financial and accounting support, credit control, recordkeeping, and payroll. For further information, please contact our Compliance Department at dpo@indorama.net
We may also transfer/assign Personal Data to third parties that provide products or services to IVL. These third parties may include payroll administrators, benefits administrators, financial consultants and financial services providers, professional advisers, IT systems providers (including enterprise resource planning and cloud-based software providers and consultants), outside counsel, expense claims providers, Employee data management solutions providers, timekeeping solutions providers, hardware providers, company car management companies, travel and mobility service providers, and limited other parties.
Some third-party software products and services provided to you at IVL have a function whereby the third-party provider (such as Microsoft) collects information about you and your usage of the software. IVL does not have access to such data. You can switch this function on or off. If you do not want such data to be collected by the third-party provider, you should switch off the function. Please call the Global IT Service Desk if you need help to switch the function off.
We will carefully select such third parties and will require them to only process Personal Data in accordance with the instructions of IVL. The recipients of these disclosures and their information storage systems may be located in other countries. If IVL discloses Personal Data to such recipients, we will require that they will provide an adequate level of protection for your Personal Data and that appropriate security measures are in place.
Where permitted by applicable law, Personal Data also may be disclosed in connection with a corporate restructuring, sale, or assignment of assets, merger, divestiture, or other changes of control or financial status of IVL (or any of its subsidiaries or affiliated companies).
Finally, Personal Data may be disclosed and transferred to respond to law enforcement requests or where required by applicable laws, court orders, or government regulations (including disclosures to tax, social security, and employment authorities); or to government entities to manage or administer IVL’s financial and tax affairs. We may also disclose Personal Data to external legal counsel to assist us with the establishment and defence of legal claims or to other third parties also engaged in such legal matters (for example, to the adverse party in court proceedings, to judicial experts, to other stakeholders involved in the claim, etc.).
We may also share Personal Data with other third parties on the basis of our legitimate interest for ensuring the purposes as mentioned in this Policy (also see the chapter “Will we share your Personal Data with third parties?” of this Policy).
Where is your Personal Data stored?
IVL operates globally, and your Personal Data may be stored and processed by it or its service providers in multiple jurisdictions, including your home jurisdiction. We store Personal Data on servers in Amsterdam, the Netherlands, with back-up servers in Frankfurt am Main, Germany. For more information about where we store your Personal Data, please contact your local Human Resources department or our Compliance Department at dpo@indorama.net.
We maintain reasonable administrative, technical, and physical safeguards to protect Personal Data against accidental or unlawful destruction, or loss, alteration, unauthorized disclosure or access. In the event that we do transfer any Personal Data, we will only do so in accordance with applicable law and will require that there is an adequate level of protection for the Personal Data and that appropriate security measures are in place.
IVL has policies and procedures in place to ensure that we comply with all applicable laws in the event of a security incident leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, your Personal Data.
In the event that we do transfer any Personal Data internationally, we will only do so in line with applicable law and we will require that there is an adequate level of protection for the Personal Data and that appropriate security measures are in place. Personal Data may be transferred from countries located within the European Economic Area (EEA) to countries located outside of the EEA, such as but not limited to Thailand and the United States, in particular. In such cases, we will require that the following safeguards are taken:
• The laws of the country to which Personal Data is transferred ensure an adequate level of data protection under article 45.1 of the EU General Data Protection Regulation (2016/679). At this
moment there are adequacy decisions for Andorra, Argentina, Canada (commercial organisations), Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, Republic of Korea, Switzerland, the United Kingdom and Uruguay, which means that the European Commission has recognized these countries as providing adequate protection; or
• The transfer is subject to data protection clauses approved by the European Commission under article 46.2. c) or d) of the EU General Data Protection Regulation (2016/679). More information about those data protection clauses is available here; or
• Any other applicable appropriate safeguards under article 46 of the EU General Data Protection Regulation (2016/679).
For more information about the safeguards relating to Personal Data transfers outside of the EEA, please see the information under the heading “Will we share your Personal Data with third parties?” or contact our Compliance Department at dpo@indorama.net
Monitoring
If and to the extent permitted by applicable law, IVL may monitor the use of its information systems to detect and remediate information security threats or improper use of IVL’s information systems. This may require the processing of certain Personal Data from Employees related to their use of said information systems.
IVL’s monitoring practices are described in the corporate and local policies which outlines how you may use IVL’s information systems resources. You should review those policies to ensure that you understand IVL's monitoring practices and your obligations under those policies. For more information about those policies, please contact our Compliance Department at dpo@indorama.net.
Revisions to the Policy
This Policy is effective as of July 1st, 2022. Please note that this Policy will regularly be updated to reflect any changes in the way we handle your Personal Data or any changes in applicable laws. When we do, we will reissue a revised Policy and notify all Employees of any changes, to the extent required by law.
Conflicts or inconsistencies between this Policy and other privacy policies
IVL has adopted a series of privacy policies in order to address the specific privacy concerns of certain groupings of individuals and specific issues relating to the use of our websites. This Policy applies only to the Personal Data of our Employees. We have developed other documents that describe our privacy policies and practices with respect to our customers and other parties with whom we interact and information collected on our website (see our “Website Privacy Policy). If you submit a job application through our website, your Personal Data will be processed in accordance with both this Policy and the Web Privacy Statement. If there is any conflict or inconsistency between a provision of this Policy and a provision of any other IVL privacy policy, this Policy will prevail.
Contact us
If you have any questions about this Policy, please contact IVL's Compliance Department at dpo@indorama.net.