Juul Labs Inc.

WORKER AND APPLICANT GLOBAL PRIVACY NOTICE

SCOPE

This Privacy Notice applies to employees, contractors, contingent and other personnel (collectively, “Workers”) and applicants and prospective Workers (collectively, “Applicants”) whose Personal Information Juul Labs may collect and process during its human resources operations, from submission of an application, throughout the course of an individual’s tenure with Juul Labs, and following such employment or services (collectively, the “Human Resources Operations”).

As used in this Privacy Notice, “Personal Information” has the meaning given to it under the law where an Applicant or Worker lives (also referred to as “you”), but typically refers to information that can be used to identify you as an individual.  Please also note that any activities we take with respect to your Personal Information are referred to as “processing” or “processing activities.”

The terms “Juul Labs,” “we,” “us,” and “our” means Juul Labs, Inc.his Privacy Notice explains the kinds of Personal Information we may collect, how we intend to use and share that information, and the rights you may have related to these processing activities.

An Important Note: This Privacy Notice only applies to data that we collect and process when interacting with you in your capacity as a Worker or an Applicant. Unless otherwise indicated on a specific website page or form, this Privacy Notice does not apply to any of the Personal Information that we process through your use of our public-facing websites, or product-related applications or services, which are subject to our user governing those properties.

PERSONAL INFORMATION WE COLLECT

Juul Labs collects Personal Information from Workers and Applicants (and your family and dependents if you provide this information to us) as described below.

Personal Information We Collect from You Directly. We may process the following categories of Personal Information that you provide to us, if and as may be applicable to your relationship with us:

• Profile/Demographic Information. For example, name, work address, telephone numbers, User ID, Personal ID, email addresses; home address, personal email address, citizenship, passport data (where required for international travel), nationality, citizenship, birth date, country of birth, national insurance number, tax reference, emergency contact details, CV data, bank account(s), information on prior employers, family members, family status, and, with respect to a company vehicle assigned to you or that you drive for company business, your license plate, car insurance, driving license, and other information pertaining to such vehicle, including your driving history and safety record;
• Worker-Related Data: For example, job title and code, work location, division, department, position level, language(s) spoken and written, employment contract (if applicable), working time, attendance and leave (as applicable and allowed or required by law), manager’s name, business travel data, data about completion of required training, information related to talent management, start and end date, reason for leaving and similar job-related data;
• Sensitive Personal Information: We may also collect sensitive Personal Information such as details of health and disability, including medical information, health insurance information, mental health, medical leave, marriage leave, and parental leaves (maternal, paternal, adoption); information about residency, citizenship, or immigration status; and optional demographic information such as sexual orientation, gender identity or affinity, race, ethnicity or veteran status, to helps us to comply with our reporting obligations and provide insight into equity and inclusion objectives.
• Communications with Us. Personal information such as personal contact information when an Applicant or Worker communicates with us, for example to inquire about employee benefits.
• From time to time, we may ask you to give us your feedback, opinion, or participate in optional surveys or polls. If you decide to participate, you may be asked to provide certain information, which may include Personal Information.
• Elective Social Activities. Occasionally, Juul Labs may run elective social activities for the benefit of its Workers. Workers who elect to participate may be asked to provide Personal Information to administer the activity and award prizes or other types of recognition.

Information from Other Sources. We may collect or receive information about Applicants and Worker from other sources, including through third-party services and organizations to supplement information provided by you. For example, where relevant to the role in question and as permitted by law, we may conduct background and credit checks on Applicants prior to employment with Juul Labs.

Personal Information generated through Applicant and Worker Relationships. We may collect, generate, or compile information about you based on the nature and tenure of our relationship.

• Performance-Related Data: For example, Worker performance reviews, evaluations and ratings, disciplinary allegations, disciplinary process and disciplinary warnings, details of grievances, and any outcome and similar data about Worker performance.
• Compensation-Related Data: For example, basic salary, bonus and commission entitlements, insurance benefits (including partner, dependent and beneficiary details), date-of-birth and other information about you and your dependents required by our insurer or benefits vendor, tax code, accrued salary information, and information relating to any applicable retirement plan or pension program applicable any company loan, company credit cards, salary garnishments, capital-forming benefits, any units of stock or directorships held, details of all restricted stock units or any other entitlement to shares of any group company stock awarded, cancelled, exercised, vested, unvested or outstanding.
• Intra-Group Communications. Juul Labs may offer, enable, or require Workers to utilize Juul Labs-provided intra-company accessible sites, video-enabled meetings, pages, messaging channels, apps, blogs, or group forums (“Intra-Company Communication Channels”). Juul Labs and other individuals who use the Intra-Company Communication Channels may collect Personal Information and other information you submit or make available when using or participating in the Company Communication Channels. Personal Information collected or generated about you when using Intra-Company Communication Channels may be considered “public” and may not be subject to the same privacy protections set forth herein.
• Miscellaneous Information. We may receive or collect other miscellaneous Personal Information, (for example, information an Applicant chooses to disclose during the interview process, whether in oral or written form, and opinions generated by other Workers during the interview process.

Personal Information We Collect Automatically.

• Worker Use of Juul Labs Information Technology Systems and Networks. Juul Labs may collect certain information automatically through the course of its Workers’ employment or services, such as Internet protocol (IP) address, inferred or precise device location based on IP address, use of Juul Labs’ applications or licensed programs or activities, precise device identifiers associated with a computer or device (whether owned or authorized by us), mobile carrier and related information, activity logs, and other information about activities Workers may engage in on Juul Labs property, equipment, accounts, systems and networks. Juul Labs may have access to the location of and may monitor and review Workers’ uses of Juul Labs equipment, accounts, information technology systems and networks, including its phone networks, computer networks, including those used to access the Internet, videoconferencing systems and other Intra-Company Communications Channels. Juul Labs may access and review Workers’ video-recordings, transcripts, electronic files, chat and other forms of real-time messages, and emails sent or stored on its information technology systems, including accounts, computers, tablets, and devices provided to Workers, or on Workers’ devices on which Juul Labs systems or tools are enabled subject to Juul Labs’ internal IT terms and policies.
• CCTV Footage. Where and as permitted by law, Juul Labs may monitor its premises using CCTV cameras.

NOTE: WORKERS SHOULD HAVE NO EXPECTATION OF PRIVACY WHILE ON JUUL LABS PREMISES OR USING JUUL LABS INFORMATION TECHNOLOGY SYSTEMS, DEVICES, NETWORKS, AND ELECTRONIC COMMUNICATION TOOLS REGARDLESS OF LOCATION. THIS PRIVACY NOTICE DOES NOT ESTABLISH THAT ALL WORKERS WILL HAVE ACCESS TO, OR WILL PARTICIPATE IN, THE SYSTEMS, NETWORKS, DATA, PROGRAMS, AND OTHER BUSINESS ACTIVITIES DESCRIBED IN THIS PRIVACY NOTICE.

HOW WE USE YOUR INFORMATION

We process Personal Information to the extent permitted or required under applicable law for a variety of business purposes including those listed below. We will not process your Personal Information for a purpose other than that for which it was collected unless we have provided further information about this to you before that processing takes place. Please see the Supplemental Notice for Workers and Applicants in the UK or EEA for a table of legal bases that explains how we process your Personal Information under the General Data Protection Regulation (“GDPR”) and UK GDPR.

Applicants

• To assess your suitability, aptitude, skills, qualifications, and interests for employment with or provision of services to Juul Labs;
• To communicate with you about the application process and/or your application, and
• To take steps at your request prior to entering a relationship with you (for example, after we have sent you an offer, to process certain Personal Information to enter and commence employment).

Workers

• To assist you with a job-related relocation, or to obtain an immigration visa or work permit (where required and requested by you);
• To manage workflow, including assigning, managing and administering projects;
• To conduct job grading activities;
• To administer Human Resources Operations and communicate with Workers and Applicants;
• To administer payroll and award benefits;
• To administer compensation-related activities, including calculating and analyzing salary, bonuses, long-term incentives, and equity/stock plans;
• To monitor time-keeping entries and other records of work activities, ensure Juul Labs’ compliance with its internal policies and applicable labor laws, and operate Worker recognition programs;
• To pursue our legitimate interests (for example security and fraud prevention activities such as prevention of fraud, misuse of IT systems, or money laundering, physical security, IT and network security, or internal investigations, Worker monitoring for safety or management, whistleblowing schemes, internal investigations, and research purposes);
• To manage Worker performance and development;
• To undertake organizational development and succession planning exercises;
• To manage Worker attendance and absences;
• To operate helpdesk and IT support services;
• To run, enable or cooperate with internal and/or external or governmental compliance investigations;
• To operate, enable or cooperate with internal or external audits;
• To support diversity and inclusion initiatives;
• To support the organization and Workers during corporate restructuring events (including acquisitions, divestitures, and integrations);
• To protect Worker safety, including by administering emergency services;
• To establish, exercise or defend our legal rights;
• To comply with our legal obligations, including to support any claim or defense before any jurisdictional, and/or administrative authority, arbitration or mediation panel and to cooperate with, or to inform, law enforcement or relevant regulatory authorities to the extent required by law in or outside of your country;
• To process Worker expenses and travel charges and operate reimbursement programs, and
• To act on your behalf as you may otherwise offer, agree, or consent.

how we disclose your information

We may disclose Personal Information as described in this Privacy Notice (e.g., with our third-party service providers; to comply with legal obligations; to protect and defend our rights and property) or with your permission.

Vendors and Service Providers. Juul Labs may disclose Personal Information we receive pursuant to this Privacy Notice with vendors and service providers to assist us in carrying out our Human Resources Operations. The categories of service providers we engage under contract to  process Personal Information on our behalf are: (i) service providers that facilitate programs we offer to enable Workers to perform their job functions such as corporate travel services, expense reimbursement programs and administration of job-related stipends, if and as applicable; (ii)  service providers that help us maintain our Human Resources Operations such as administering payroll, benefits, workforce and performance management; (iii) service providers that provide IT and related services, and (iv) service providers that provide specialized external advice (e.g., outside law firms and auditors).

Other Group Companies. Juul Labs may share Personal Information with our corporate affiliates as permitted by applicable law, to pursue our legitimate interests in connection with the following purposes: to facilitate internal communication and task management to other group companies; group wide HR planning and administration (including staffing, succession planning, forecasting and budgeting, investment decisions, training and performance management, in connection with the group’s matrix structure etc.); and to be able to fulfil the employment relationship within our global structure (i.e., to facilitate global cooperation and employee transfers within the group). Certain group companies other than the group company that is your employer may function as a data controller for certain purposes (typically this would include any group company that makes its own decisions concerning some of the purposes above (e.g., employee transfers)).

Other Juul Labs Workers. If Workers elect to share Personal Information or other information through Intra-Company Communication Channels, other Workers may be able to see some or all this information. In addition, Worker name and photo may be available through the Intra-Company Communication Channels to facilitate collaboration and workplace communications.

Third Parties. We may and/or other group companies may transfer Personal Information to government agencies and regulators (e.g., tax authorities), social insurance carriers, courts, and government authorities, in accordance with applicable law where believe doing so is required or appropriate to: (i) comply with law enforcement or national security requests and legal processes, such as court orders, subpoenas, or regulatory investigations; (ii) protect your, our, or others’ rights, property, or safety; (iii) enforce our policies or contracts; (iv) collect amounts owed to us; or (v) assist with an investigation or prosecution of suspected or actual illegal activity.

Merger, Sale, or Other Asset Transfers. If we participate in an actual or proposed merger, acquisition, financing due diligence, reorganization, bankruptcy, receivership, sale of company assets, or transition of service to another entity, we may transfer your information as part of such a transaction as permitted by law and/or contract.

INTERNATIONAL DATA TRANSFERS

In conducting our Human Resources Operations, we may transfer, process, and store all information collected via or by Juul Labs anywhere in the world, including, but not limited to, the United States. To the extent Personal Information is transferred from the United Kingdom (“UK”) or European Economic Area (“EEA“) to the United States or other jurisdictions that require valid safeguards to be in place, Juul Labs will adopt sufficient legal safeguards (whether by standard contractual clauses or certification), and we have completed the relevant risk and impact assessments for such a transfer. We take all commercially reasonable measures to safeguard Personal Information consistent with the requirements of applicable laws and will not transfer Sensitive Personal Information outside of your country unless permitted by applicable law. If you are a resident of the UK or EEA, you may request information or to see a copy of any data transfer agreement(s) to the extent Juul Labs has relied on them to transfer of your Personal Information by Contacting Us.

INDIVIDUAL RIGHTS IN PERSONAL DATA

To the extent permitted under applicable law, you may have the right to:

• Obtain access to and portability of your Personal Information, including: (i) confirming whether we are processing your Personal Information; (ii) obtaining access to or a copy of your Personal Information; (iii) receiving an electronic copy of Personal Information that you have provided to us, or asking us to send that information to another company (the “right of data portability”);
• Request correction of your Personal Information where it is inaccurate or incomplete. In some cases, we may provide self-service tools that enable you to update your Personal Information, or we may refer you to the controller of your Personal Information who is able to make the correction;
• Request deletion of your Personal Information, in cases where Juul Labs is not required to retain such Personal Information and subject to other legal requirements and exceptions prescribed by law; and
• Request restriction of or object to our processing of your Personal Information, if and as applicable, and where such requests are permitted by law, including the right to (i) withdraw your consent to processing, (ii) object to, or restrict, processing of your sensitive Personal Information for certain purposes, or (iii) opt out of profiling in furtherance of decisions that produce legal or similarly significant effects concerning you.

You also have the right to lodge a complaint with your data protection supervisory authority. In the UK, this is the Information Commissioner’s Office (“ICO”). If you are located in the EU, information about your national supervisory authority can be found here.

If you would like to exercise any of these rights, please contact us. We will process such requests in accordance with applicable laws. To protect your privacy, Juul Labs will take measures to verify your identity before fulfilling your request. You may authorize an agent to may make a verifiable consumer request on your behalf. To authorize an agent to exercise a privacy right on your behalf, you must provide us with written authorization signed both by you and your designated agent and contact us for additional instructions.

We will not discriminate or retaliate against anyone exercising their privacy rights.

DATA RETENTION

Juul Labs retains the Personal Information we receive as described in this Privacy Notice for as long as necessary to fulfill the purpose(s) for which it was collected, carry out our Human Resources Operations, resolve disputes, establish legal defenses, conduct audits, pursue legitimate business purposes, enforce our agreements, comply with applicable laws, or based upon other criteria, including, but not limited to, the sensitivity and volume of such data. Additionally, we endeavor to retain all such Personal Information in accordance with legal requirements.

SECURITY OF YOUR INFORMATION

We take steps to safeguard your Personal Information in accordance with this Privacy Notice. Unfortunately, we cannot guarantee the security of any information you provide to us. To the fullest extent permitted by applicable law, we do not accept liability for unauthorized disclosure.

THIRD-PARTY WEBSITES/APPLICATIONS

Various resources and sites at Juul Labs may contain links to third party websites/applications and other websites/applications may reference or link to Juul Labs that we do not control. We do not control these third-party services. We encourage Applicants and Workers to read the privacy policies of each website and application with which they interact. We do not endorse, screen, or approve, and are not responsible for the privacy practices or content of such other websites or applications. Visiting these other websites or applications is at your own risk.

CHANGES TO OUR PRIVACY NOTICE AND PRACTICES

We may revise this Privacy Notice from time to time at our sole discretion. If there are any material changes to this Privacy Notice, we will notify you as required by applicable law. You understand and agree that by continuing your employment with or service engagement with us after the new Privacy Notice takes effect you will be deemed to have accepted the updated Privacy Notice.

CONTACT US

If you wish to exercise any of your privacy rights or have any questions about our privacy practices or this Privacy Notice, please contact us at dataprivacy@juul.com.

SUPPLEMENTAL NOTICE FOR CALIFORNIA RESIDENTS

The following describes the categories of Personal Information Juul Labs collects and the categories of third parties to which such information has been disclosed:

Category of Personal Information Collected by Juul Labs

• Identifiers: For example, a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security number or other similar identifiers.
• Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)): For example, a name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information.
• Sensitive Personal Information: For example, a social security, driver’s license, state identification card, or passport number, an account log-in, financial account, debit card or credit card number in combination with any required security or access code, password, or credentials allowing access to an account, precise geolocation, racial or ethnic origin, citizen or immigration status, religious or philosophical beliefs, or union membership, contents of a consumer’s mail, email, and text messages unless the business is the intended recipient of the communication, or genetic information.

Category of Personal Information Collected by Juul Labs

• Protected classification characteristics under California or federal law: For example, age (40 years or older), race, color, ancestry, national origin, citizenship, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information).

Category of Third Parties to which Personal Information may be Disclosed

• Service providers
• Government entities such as federal, state, or local regulators

Category of Personal Information Collected by Juul Labs

• Sensory data: For example, audio, electronic, or visual information.

Category of Third Parties to which Personal Information may be Disclosed

• Service providers

Category of Personal Information Collected by Juul Labs

• Professional or employment-related information: For example, current or past job history or performance evaluations.

Category of Third Parties to which Personal Information may be Disclosed

• Service providers
• Juul Labs affiliates

The categories of sources from which we collect Personal Information are described above in the section titled “Personal Information We Collect.”

Your Personal Information is not: (i) “sold” or (ii) “shared” (for purposes of targeted advertising) by us and we use the data we collect about you for the business purposes described above in the section titled “How We Use Your Information.” In addition, we may share any data we hold about you with the parties described above.

Data Retention. The Data Retention section above outlines the criteria we utilize for determining how long to retain data.

Sensitive Personal Information. We process sensitive Personal Information exclusively for the purposes outlined above, and only to the extent permitted under law. We do not use sensitive Personal Information to infer any characteristics about you.

SUPPLEMENTAL NOTICE FOR WORKERS AND APPLICANTS IN THE UK OR EEA

We rely on the following legal bases for the processing of your Personal Information. Where we process Sensitive Personal Information, we will only do so when we have both a legal basis for doing so and one of the additional conditions under the GDPR or UK GDPR applies:

FOR THE PROCESSING OF WORKER AND APPLICANT DATA

Processing Purposes: Compensation-related Purposes

• Categories of Personal Information
  • Contact and Identifying Data
  • Job Data
  • Salary Data
  • Equity Compensation Data
  • Performance and Disciplinary Data
• Legal basis
  • Contract Justification;
  • Legal Obligation Justification; or
  • Legitimate Interest Justification (i.e. the pursuit of the specified purposes).

Processing Purposes: Benefit-related Purposes

• Categories of Personal Information
  • Contact and Identifying Data
  • Job Data
  • Salary Data
  • Performance and Disciplinary Data
• Legal basis
  • Contract Justification

Processing Purposes: Workforce Management-related Purposes

• Categories of Personal Information
  • Contact and Identifying Data
  • Job Data
  • Salary Data
  • Communication Data
  • Performance and Disciplinary Data
• Legal basis
  • Contract Justification; or
  • Legitimate Interest Justification (i.e. the pursuit of the specified purposes.)

Processing Purposes: Regulatory-related Purposes

• Categories of Personal Information
  • Contact and Identifying Data
  • Job Data
  • Salary Data
  • Equity Compensation Data
  • Performance and Disciplinary Data
• Legal basis
  • Contract Justification;
  • Legal Obligation Justification; or
  • Legitimate Interest Justification (i.e. the pursuit of the specified purposes.)

Processing Purposes: Internal Compliance-related Purposes

• Categories of Personal Information
  • Contact and Identifying Data
  • Job Data
  • Salary Data
  • Monitoring Data
  • Communication Data
  • Performance and Disciplinary Data
• Legal basis
  • Contract Justification;
  • Legal Obligation Justification; or
  • Legitimate Interest Justification (i.e. the pursuit of the specified purposes.)

Processing Purposes: Communication-related Purposes

• Categories of Personal Information
  • Contact and Identifying Data
  • Job Data
  • Communication Data
• Legal basis
  • Contract Justification;
  • Legal Obligation Justification; or
  • Legitimate Interest Justification (i.e. the pursuit of the specified purposes.)

Processing Purposes: Emergency Contact-related Purposes

• Categories of Personal Information
  • Contact and Identifying Data
• Legal basis
  • Legitimate Interest Justification (i.e. the pursuit of the specified purposes);
  • or The processing is necessary in order to protect your vital interests or those of another natural person (GDPR Art. 6(1)(d)).

Processing Purposes: Authority-related Purposes

• Categories of Personal Information
  • Contact and Identifying Data
  • Job Data
  • Salary Data
  • Equity Compensation Data
  • Monitoring Data
  • Communication Data
  • Performance and Disciplinary Data
• Legal basis
  • Legal Obligation Justification; or
  • Legitimate Interest Justification (i.e. the pursuit of the specified purposes.)

Processing Purposes: Security and Fraud Prevention-related Purposes

• Categories of Personal Information
  • Contact and Identifying Data
  • Job Data
  • Monitoring Data
  • Communication Data
  • Performance and Disciplinary Data
• Legal basis
  • Legal Obligation Justification; or
  • Legitimate Interest Justification (i.e. the pursuit of the specified purposes.)

Processing Purposes: Finance and Audit-related Purposes

• Categories of Personal Information
  • Contact and Identifying Data
  • Job Data
  • Salary Data
  • Equity Compensation Data
  • Monitoring Data
  • Communication Data
  • Performance and Disciplinary Data
• Legal basis
  • Legal Obligation Justification; or
  • Legitimate Interest Justification (i.e. the pursuit of the specified purposes.)

Processing Purposes: Litigation-related Purposes

• Categories of Personal Information
  • Contact and Identifying Data
  • Job Data
  • Salary Data
  • Equity Compensation Data
  • Monitoring Data
  • Communication Data
  • Performance and Disciplinary Data
• Legal basis
  • Legitimate Interest Justification (i.e. the pursuit of the specified purposes.)

Processing Purposes: Compensation-related Purposes

• Categories of Personal Information
  • Number of sick days
  • Information on parental leave
  • Information on work-related accidents
  • Information on disability
• Legal basis
  • The processing is necessary for: the purposes of carrying out the obligations and exercising our or your specific rights in the field of employment and social security and social protection law (GDPR Art. 9(2)(b) and the corresponding provisions under local data protection law);
  • protecting your vital interests as a data subject (e.g. in the case of a workplace accident) (GDPR Art. 9(2)(c) and the corresponding provisions under local data protection law);
  • (iii) for the assessment of the working capacity of an employee or the provision of health or social care or treatment (GDPR Art. 9(2)(h) and the corresponding provisions under local data protection law), as applicable.

Processing Purposes: Workforce Management-related Purposes 

• Categories of Personal Information
  • Number of sick days
  • Information on parental leave
  • Information on maternity leave
  • Information on the marriage leave
  • Information on work-related accidents
  • Information on disability
• Legal basis
  • The processing is necessary for: the purposes of carrying out the obligations and exercising our or your specific rights in the field of employment and social security and social protection law (GDPR Art. 9(2)(b) and the corresponding provisions under local data protection law);
  • protecting your vital interests as a data subject (e.g. in the case of a workplace accident) (GDPR Art. 9(2)(c) and the corresponding provisions under local data protection law);
  • (iii) for the assessment of the working capacity of an employee or the provision of health or social care or treatment (GDPR Art. 9(2)(h) and the corresponding provisions under local data protection law), as applicable.

Processing Purposes: Regulatory-related Purposes

• Categories of Personal Information
  • Number of sick days
  • Information on parental leave
  • Information on maternity leave
  • Information on work-related accidents
  • Information on disability
• Legal basis
  • The processing is necessary for: the purposes of carrying out the obligations and exercising our or your specific rights in the field of employment and social security and social protection law (GDPR Art. 9(2)(b) and the corresponding provisions under local data protection law);
  • protecting your vital interests as a data subject (e.g. in the case of a workplace accident) (GDPR Art. 9(2)(c) and the corresponding provisions under local data protection law);
  • (iii) for the assessment of the working capacity of an employee or the provision of health or social care or treatment (GDPR Art. 9(2)(h) and the corresponding provisions under local data protection law), as applicable.

Processing Purposes: Benefit-related Purposes

• Categories of Personal Information
  • Number of sick days
  • Information on parental leave
  • Information on maternity leave
  • Information on work-related accidents
  • Information on disability
• Legal basis
  • The processing is necessary for: the purposes of carrying out the obligations and exercising our or your specific rights in the field of employment and social security and social protection law (GDPR Art. 9(2)(b) and the corresponding provisions under local data protection law);
  • protecting your vital interests as a data subject (e.g. in the case of a workplace accident) (GDPR Art. 9(2)(c) and the corresponding provisions under local data protection law);
  • (iii) for the assessment of the working capacity of an employee or the provision of health or social care or treatment (GDPR Art. 9(2)(h) and the corresponding provisions under local data protection law), as applicable.

Processing Purposes: Litigation-related Purposes

• Categories of Personal Information
  • Number of sick days
  • Information on parental leave
  • Information on maternity leave
  • Information on work-related accidents
  • Information on disability
• Legal basis
  • The processing is necessary for the establishment, exercise, or defense of legal claims (GDPR Art. 9(2)(f) and the corresponding provisions under local data protection law).