Privacy Policy

Privacy Notice

This privacy notice was last reviewed or revised on July 2, 2024.

We, Delphos, and its subsidiaries and affiliates (collectively, “Delphos,” “us,” or “we”) understand that your privacy is important to you. We are committed to respecting your privacy and protecting your personal data. This privacy notice describes how we handle and protect your personal data (the “Privacy Notice”) when we collect it through Delphos’s website, applications, and digital assets (collectively, our “sites”) and through our externally facing business activities, such as service offerings, events, surveys, and communications, when we interact with you and collect data from you for use by and on behalf of Delphos (i.e., when Delphos is acting as a data controller or similar term under applicable privacy law).

Depending upon the nature of your relationship with Delphos, additional or different privacy notices may apply to you as described below:

• If you are applying for a position with Delphos.
• If you are an employee of a Delphos client or a Delphos service provider, we may receive your personal data from your employer. Our use of your personal data is governed by our agreement with your employer.

You are not required to share your personal data with us, but failing to do so may result in Delphos being unable to properly provide you with our full range of services or a good user experience with our solutions, websites services, or newsletters.

Please see our terms of use for more information about other terms and policies applicable to the use of our site.

Contents

1. Data controller
2. How do we collect your personal data?
3. Why and how are we using your personal data?
4. What do we not do when we collect and process your personal data?
5. Who has access to your personal data? Data recipients and international data transfers.
6. Security
7. How long do we keep your personal data?
8. Privacy Notice for Company-Owned Devices and for End-User Owned Devices

9. What are your data protection rights, and how can you exercise them?

1. Data controller

When Delphos collects and processes your personal data in accordance with this Privacy Notice, we do so as authorized under applicable data privacy laws, whether as data controller or joint controller (similar terms may be used under applicable law), which means that we determine and are responsible for how your personal data is collected, used, protected, disclosed, and disposed of.

Depending on the jurisdiction you are located in or made contact with Delphos, the local Delphos entity may be your main data controller.

2. How do we collect your personal data?

Delphos collects personal data in the course of our business activities directly from you and from third parties:

Delphos collects personal data about you in the course of our routine business activities:

• When you interact with our site, including when you manage your cookie preferences, as described in our Cookie Policy.
• When you use any Delphos mobile apps.
• When you register to receive Delphos newsletters and alerts and when you interact with those newsletters and alerts.
• When you sign up for and participate in Delphos conferences and events.
• When you participate in public content posting areas, such as bulletin boards, discussion forums, and Delphos social media sites.
• When you participate in a survey, panel discussion, or individual discussion conducted by Delphos.
• When you interact with Delphos or its employees on its site, by email, or telephone, to ask a question, request information, or otherwise seek a response from Delphos.

LinkedIn Insight Tag

When you interact with Delphos on LinkedIn, we use the LinkedIn Insight Tag to collect data. This technology allows us to understand and measure the impact of our advertisements and optimize them. The LinkedIn Insight Tag enables the collection of data such as URL, referrer, IP address, device and browser characteristics, and timestamp.

Delphos may also receive personal data about you from third parties, including service providers and data vendors in the course of our business activities. When we collect personal information from third parties, the data consists primarily of publicly available personal information compiled from business websites, public-facing social media platforms, and other widely used public sources.

Sensitive personal data – We may also collect sensitive personal data directly from you, for instance when you respond to a survey or panel discussion conducted by Delphos and provide us with demographic or other personal data or when you provide information to permit us to accommodate your specific request at a conference or event. We use sensitive personal data only with your consent unless another legal basis exists (e.g., public health requirements). When we collect and use sensitive personal data for research, data analysis, and statistical purposes, we use it to produce reports and publications.

We may combine personal data that we receive directly from you with personal data that we receive from third parties, to the extent that all such collection and use of personal data and sensitive personal data is consistent with this Privacy Notice and with the purposes and data access as described in section three below.

3. Why and how are we using your personal data?

Delphos uses your personal data for different purposes and may combine data from multiple sources to accomplish those purposes. The table below summarizes the purposes for which we process your personal data, the categories of personal data that we use for each purpose, and the legal grounds on which each data processing activity is based, along with who has access to the personal data.

Whenever the legal ground is our legitimate interest, Delphos only processes your personal data after assessing the adequacy, proportionality, and legitimacy of the data-processing activity.

If consent as a legal basis for processing has been relied upon and you have withdrawn it, we may not be able to properly provide you with our full range of services and a good user experience.

Delphos does not use automated decision making to make decisions that have legal impact on you or that significantly affect your rights and liberties. All automated processing activities are conducted with appropriate human supervision and review.

Delphos’s use of cookies and other tracking technologies.

Delphos may use first- and third-party cookies and other tracking technologies, including web beacons, to manage our Sites and services, and to collect analytics about how you use them. Delphos may collect information about whether you open or click any links in the knowledge, research, or event communications that we send you. You have options regarding our use of cookies and other tracking technologies. Please refer to our Cookie Policy for more details and to manage your choices.

In addition, we use tools and applications that reduce security threats and reduce the risk of access by bots and automated devices, but we do not use those tools and applications for non-security purposes.

4. What do we not do when we collect and process your personal data?

Delphos does not sell, rent, or disclose your personal data to unauthorized third parties. We strictly limit access to your personal data to only those who need it to fulfill our business obligations and as permitted by law. Your personal data is used solely for the purposes outlined in this Privacy Notice, ensuring it remains confidential and protected from unauthorized use. If we share any personal data with third parties, we will require them to keep the data secure.

5. Who has access to your personal data? Data recipients and international data transfers

Personal data collected in the course of Delphos business activities may be transferred and made available to Delphos entities, service providers, and third parties as necessary to accomplish the specific business purposes for which the personal data were collected and to support our interactions with you, and otherwise as required to comply with applicable law. The Delphos entity that collects your personal data may provide access to and transfer your data to the following categories of data recipients, for the business purposes described in section three, above:

• To Delphos’s subsidiaries and affiliates and personnel across our global organization;
• To Delphos’s service providers and personnel;
• To Delphos’s legal and professional advisors;
• To third parties in the following circumstances;
• If we are required to do so by law or legal process;
• To law enforcement authorities or other government officials pursuant to lawful request;
• When we believe disclosure is necessary or appropriate to prevent physical harm or financial loss or in connection with an investigation of suspected or actual illegal activity;
• If disclosure is necessary to protect the vital interests of a person;
• To enforce our terms of use;
• To protect our property, services, and legal rights;
• To prevent fraud against Delphos, our subsidiaries, affiliates, and/or business partners;
• To aid in Delphos’s investigation of an actual or suspected security incident, such as a breach involving confidential information or personal information or a violation of Delphos policy;
• To support auditing, compliance, and corporate governance functions;
• To comply with any and all applicable laws.
• To a successor or different business entity in the event of a reorganization, merger, sale, joint venture, assignment, or other transfer or disposition of all or any portion of our business.

To protect personal data that is transferred internationally, Delphos complies with all applicable data transfer laws, including incorporating required data transfer terms into our agreements with Delphos affiliates, subsidiaries, service providers, and third parties.

6. Security

Delphos protects and safeguards your personal data globally, in accordance with applicable law, our privacy and data security policies, and this Privacy Notice. We use generally accepted standards of technical and operational security to protect your personal data against accidental or unlawful loss, misuse, alteration, or destruction, in consideration of the risks associated with the personal data and its processing, and we require the same level of protection and safeguarding from our subsidiaries and affiliates, our service providers, and third parties. Only authorized personnel of Delphos and of our service providers are permitted to access personal data, and these employees and service providers are required to treat this information as confidential. Despite these precautions, however, Delphos cannot guarantee that unauthorized persons will not obtain access to your personal data.

7. How long do we keep your personal data?

Delphos keeps your personal data only as long as necessary to accomplish the business purposes for which it was collected to meet our legal or contractual obligations and in compliance with Delphos’s data-retention policy. We will securely delete your personal data promptly after the purposes described above cease to apply in accordance with the prevailing market practice for such destruction.

If you request that we delete your personal data, Delphos will comply with applicable law and will make reasonable attempts to delete all instances of the personal data, subject to our right to keep a copy of such data for the purposes mentioned above. For requests for access, corrections, or deletion, especially where the processing is based on your consent, please refer to section nine of this Privacy Notice.

8. Privacy Notice for Company-Owned Devices and for End-User Owned Devices

The responsible for the processing of your Personal Data for Intune is the “Data Controller”. Depending on the jurisdiction you are located in or made contact with Delphos, the local Delphos entity may be your main data controller (“Delphos” or the “Company”).

Delphos has provided you with a Company-funded mobile device (“device” or “mobile device”) or has permitted you to install Delphos applications and/or use or access Company networks on a device that you own. The use of your own mobile device to install Delphos applications and/or use or access Company networks is never obliged and/or necessary for the performance of your tasks.

Delphos will install Intune, a Mobile Device Management (MDM) application, on your device before you can use the device to access Delphos e-mail, network services and data.

The Personal Data collected by MDM is the following: First name, Last name, mobile number, business e-mail address, country of your mobile provider and a list of all corporate applications present on your device. If you have a Company-funded mobile device, MDM will also process the list of apps installed on your device and the version.

Legal basis of the processing - This installation of MDM and processing of your Personal Data is based on the legitimate interests of Delphos to secure Company assets, the legal obligations of Delphos (where applicable) and/or the performance of a contract between you and Delphos.

Purpose of processing - MDM will monitor and audit your device to ensure that the device is compliant with Delphos mobile security requirements. Delphos does not track your use of the device, the content of applications and/or communications nor does it process any other Personal Data than the ones described above, such as pin-codes or location data.

To ensure compliance with Delphos mobile security requirements, Delphos may automatically change the configuration of the mobile device, which may change or limit the functionality of the device. This can entail, for example, obligating the use of a pin-code or a biometric access code and restricting access to Delphos applications and networks in the event the pin-code or biometric access code of the device is expired. Delphos may add, remove, or alter the security configuration that affects the device.

Should there be a security problem, you can be notified and possibly asked to remedy the problem (e.g. update the operating system) and/or you will be notified by e-mail of the problem and the actions which Delphos has or will take.

WIPING OF THE DEVICE - Delphos may remotely wipe the device, and circumstances requiring such action may include, a lost or stolen device, an employee leaving the

Company (or a Contractor whose contract is expired or terminated) or a detected security risk. A wipe will only be conducted, when it follows from a documented assessment by Delphos’s corporate GDPR Ambassador that Delphos’s legitimate interests, such as securing company assets and trade secrets and preventing commercial and financial losses, override the negative impact that this wipe could or will have on the rights and interests of the employee/contractor. Delphos will make a best effort attempt to selectively wipe the device to avoid removal of personal information.

If this fails a full remote wipe can be used that will permanently erase all corporate data stored on the mobile device, including but not limited to, e-mails, contacts, calendar postings, applications, ringtones and photos. The mobile device will then be reset back to factory default settings. Delphos may remove corporate data and any network connection if the device is detected as being Rooted or Jailbroken.

To prevent unexpected data loss, to the extent possible, Delphos will consult the employee/contractor before a wipe is conducted and, if feasible, offer him the possibility to safeguard his Personal Data. If such consultation/prevention cannot take place, either because the employee/contractor did not respond within the timeframe that was set forward by Delphos for his response, or if - given the concrete circumstances - the security problem would not allow any such delay, the wipe will be conducted (taking into account the legitimate interest assessment and the best efforts strategy with regard to selective / full wipe).

Recipients of personal data - The data can be viewed by administrators who have been granted permission to use the MDM system to secure the Delphos mobile environment.

Retention period- Personal data will be retained as long as necessary to achieve the purpose for which it was collected and for any period thereafter as legally required or permitted by applicable law.

Rights - You may have the right to access, correct, restrict and request removal of your personal data by contacting info@delphos.co and the right to lodge a complaint with a supervisory authority. Delphos uses industry-standard safeguards to protect your personal data.

Transfer - Delphos may transfer personal data to other Delphos entities and third parties located in jurisdictions outside the European Economic Area (EEA) and the United Kingdom (UK). Where such transfers involve personal data subject to the EU GDPR or the UK GDPR, Delphos ensures an adequate level of protection by relying on:

• Adequacy decisions issued by the European Commission or the UK Government (as applicable),
• Contractual safeguards including the EU Standard Contractual Clauses and the UK International Data Transfer Addendum or UK Standard Contractual Clauses, and
• Binding Corporate Rules approved by the competent supervisory authorities.

These measures are implemented to ensure that all personal data receives a level of protection equivalent to that required under the applicable data protection laws in the EU and the UK.

You confirm you have read and will abide by the following policies:

• This Notice; and
• The Delphos Privacy Notice.

9. What are your data protection rights, and how can you exercise them?

9.1. Your data protection rights.

Subject to applicable law, including exceptions, you have the following rights with regard to the personal data that we collect about you:

• Right to request information about the personal data that we hold about you, including information about how we use your personal data, who has access to it, and the terms under which third parties have access to your personal data;
• Right to request a copy of the personal data that we hold about you;
• Right to request portability of your data to permit you to provide a copy of your personal data in a structured, commonly used, and machine-readable format and to transmit that personal data to another controller;
• Right to request that we correct or otherwise amend your personal data if it is not correct or otherwise not complete, timely, and accurate for the purposes for which we are using it;
• Right to request deletion of your personal data;
• Right to request that we cease processing or restrict or limit the processing of your personal data;
• Right to withdraw your consent to our processing of your personal data where the basis of our processing is your consent;
• Right to not be discriminated against for exercising your individual rights regarding your personal data;
• Right to request review by Delphos’s Global Protection Officer and, if applicable, Delphos’s data protection officer for your jurisdiction, of our response to your request to exercise your individual data protection rights; and
• Right to seek additional legal remedies regarding our response to your request to exercise your individual data-protection rights, depending upon your jurisdiction, by lodging a complaint with your data-protection authority or initiating a legal proceeding.

9.2. How do you exercise your data protection rights?

You can contact the Data Protection Officer for your jurisdiction at info@delphos.co

If you would like to exercise your data protection rights regarding your personal data, you can do so by:

• Completing the data-subject request form.
• Emailing your request to us at: info@delphos.co
• For requests from US residents, call us at (USA) +1 202 337 6300