3.1CRIM respects the privacy of its employees and third parties such as customers, business partners, vendors, service providers, suppliers, former employees and candidates for employment and recognizes the need for appropriate protection and management of Personal Information. CRIM is guided by the following principles in Processing Personal Information:

• Notice
• Choice
• Accountability for onward transfer
• Security
• Data integrity and purpose limitation
• Access
• Recourse, Enforcement and Liability

3.2Notice. When collecting Personal Information directly from individuals, CRIM strives to provide clear and appropriate notice about the:

• Purposes for which it collects and uses their Personal Information,
• Types of non-Agent third parties to which CRIM may disclose that information, and
• Choices and means, if any, CRIM offers individuals for limiting the use and disclosure of their Personal Information.

3.3Choice. Generally, CRIM offers individuals a choice regarding how we Process Personal Information, including the opportunity to choose to opt-out of further Processing or, in certain circumstances, to opt-in. However, explicit consent from individuals is not required when Processing Personal Information for:

• Purposes consistent with the purpose for which it was originally collected or subsequently authorized by the individual,
• Purposes necessary to carry out a transaction relationship,
• Purposes necessary to comply with legal requirements, or
• Disclosure to an Agent.

3.4Accountability for Onward Transfer. In regard to the transfer of Personal Information to either an Agent or Controller, CRIM strives to take reasonable and appropriate steps to:

• Transfer such Personal Information only for specified purposes and limit the Agent or Controller’s use of that information for those specified purposes,
• Obligate the Agent or Controller to provide at least the same level of privacy protection as is required by this Policy,
• Help ensure that the Agent or Controller effectively Processes the Personal Information in a manner consistent with its obligations under this Policy,
• Require the Agent or Controller to notify CRIM if the Agent or Controller determines it can no longer meet its obligation to provide the same level of protection as is required by this Policy, and
• Upon notice from the Agent or Controller, take further steps to help stop and remediate any unauthorized Processing.

3.5Security. CRIM takes reasonable and appropriate measures to protect Personal Information from loss, misuse and unauthorized access, disclosure, alteration and destruction, taking into due account the risks involved in the Processing and the nature of the Personal Information.

3.6Data Integrity and Purpose Limitation. CRIM will only Process Personal Information in a way that is compatible with the purpose for which it has been collected or subsequently authorized by the individual. CRIM shall take steps to help ensure that Personal Information is accurate, reliable, current and relevant to its intended use.

3.7Access. CRIM provides individuals with reasonable access to their Personal Information for purposes of correcting, amending or deleting that information where it is inaccurate or has been Processed in violation of the CRIM data privacy principles.

3.8Recourse, Enforcement and Liability. Violation of this Policy by an employee or contractor of CRIM will result in appropriate discipline up to and including termination. Violation by an Agent, Controller or other third party of this Policy or CRIM’s privacy requirements will result in the exercise of appropriate legal remedies available at law or in equity including termination for material breach of contract.

5.1Roles and Responsibilities. Responsibility for compliance with this Policy rests with the heads of the individual functions, business units and departments together with any individual employees collecting, using or otherwise Processing Personal Information. Business unit, function and department heads, in coordination with the Legal Department, are responsible for implementing further standards, guidelines and procedures that uphold this Policy, and for assigning day-to-day responsibilities for privacy protection to specific personnel for enforcement and monitoring.

5.2Implementation. This Policy is meant to be implemented in conjunction with supplementary data privacy policies specific to a region, country or department, if required. These supplementary data privacy policies will account for differences in data protection requirements by jurisdiction or function and will specify individual roles and responsibilities. CRIM business units, functions or facilities will implement supplementary data privacy policies as required to be in compliance with applicable laws.

5.3Interpretation. In the event of any conflict between this Policy and any supplemental data privacy policy, this Policy will supersede the supplemental data privacy policy to the extent that the supplemental data privacy policy is less restrictive. Local data privacy policies may provide for stricter data privacy and protection standards than are set forth in this Policy. In the event local data privacy law provides for stricter data privacy and protection than this Policy, the local data privacy law will supersede this Policy in that jurisdiction to the extent necessary to comply with stricter local law.