LYB
Ethics Helpline Privacy Notice

Introduction

The LYB EthicsPoint website (www.lyb.ethicspoint.com) and helpline are for any individual to report issues and concerns related to violations of the LYB Code of Conduct or other laws and regulations. The full list of issues which may be reported are identified in Annex 1. The use of this website and helpline is entirely voluntary. If you would prefer, you may report your concerns to your manager, your local HR manager or business partner or any member of LyondellBasell’s Legal department. You will not be penalised and your employment will not be affected if you use these channels rather than the helpline.

If you make a voluntary report using the EthicsPoint website and/or helpline, or if you are the incriminated person, Lyondell Chemical Company and its affiliates (“we”, “our”, “us”, “LyondellBasell”) will be the controller of any of your personal data that is collected through the report. LyondellBasell uses a third party, NAVEX, Inc. whose headquarters are in Oregon, USA, to provide the helpline and the system on which reports on the website are stored. The NAVEX privacy statement is available here - https://www.navexglobal.com/en-us/privacy-statement.

LyondellBasell operates and administers the system for itself and on behalf of its worldwide subsidiaries, affiliates and locations. You can find out more about all of the LyondellBasell entities worldwide by visiting LyondellBasell around the world | LyondellBasell. For each of the countries you choose, you will be able to see the locations where we operate and the legal entities which are based there. All of these entities and locations may use this system. LyondellBasell has safeguards in place when it comes to transferring the data to these various countries, also see “WHERE WE STORE YOUR PERSONAL DATA”.

LyondellBasell is committed to protecting and respecting your personal data which means any information related to you as an individual. We want you to know what data we collect and how we use and store it. To this end, we have published our global Data Privacy Policy, which is available on the data privacy webpage on LyondellBasell’s corporate intranet – elements Data Privacy Policy & Glossary of Terms and our Privacy statement which explains how we process your Personal Data when we provide you products and/or services, when you use our websites and other digital platforms, when you supply goods or services to us and when we send you marketing communications.

Please read the following carefully to understand our practices regarding how your personal data is managed in our Ethics Helpline program.

We take reports on violations and concerns seriously. Please make sure that all of the information you provide is correct and accurate. All reports should be in good faith. We have implemented measures to ensure your protection, including to guarantee against retaliatory measures, such as discriminatory or disciplinary actions. However, knowingly submitting a false report could lead to disciplinary action.

INFORMATION COLLECTED AND PROCESSED FURTHER TO A REPORT

We may collect and process the following personal data further to receiving a report:

• Information provided by filling in forms on the program’s website or provided to the Ethics helpline to put onto the EthicsPoint system, including: (i) your name, email address, phone number, your title or relationship with LyondellBasell (e.g. whether you are an employee, contractor, vendor, supplier or other), unless you choose to report anonymously and (ii) any other personal data disclosed within your report, including the circumstances of the incident prompting the report and the name, title, email address, phone number and other relevant personal data of the persons you name in your report.
• The name, title, email address and phone number of persons who will collect the information you provide and participate in the investigation.
• Any evidence collected in the course of investigating the facts reported.
• Any account, summary, follow-up and decisions made in the investigation of the facts reported.
• If you contact LyondellBasell or NAVEX we may keep a record of that correspondence. Employee information including your LyondellBasell identification number, work contact information and location/office of work (unless you report anonymously).

If you report anonymously, LyondellBasell will not know who you are or process this data as your personal data. To protect the incriminated person, LyondellBasell will first examine the anonymous report with regard to its admission and the appropriateness of its circulation within the framework of the whistleblowing procedures.

Complaint reports will be kept separately from any other personal data.

Sensitive Information: depending on the nature of the report made, some of the information provided to us within a report may include, what is in some countries referred to as, ‘special category personal data’, such as: medical information (including occupational health requirements, accident reports, drug and alcohol test results) and information which may reveal race or ethnicity, sexual orientation or gender identity, religious or philosophical beliefs, trade union membership, and information relating to actual or suspected criminal convictions and offences (together, “Sensitive Information”). (In the People’s Republic of China, Sensitive Information also includes financial information). We will process Sensitive Information only when necessary and permitted to do so by law, on the basis outlined in this Notice.

COOKIES

The LyondellBasell EthicsPoint website (www.lyondellbasell.ethicspoint.com) is operated by NAVEX. Using that website will result in cookie files being stored on the hard drive of the computer you are using. These cookies and the information they collect are under NAVEX sole control and responsibility. Please refer to NAVEX’s cookie statement, available here: https://www.navex.com/en-us/cookie-statement/. The applicable statements are those referring to NAVEX Applications.

USES MADE OF THE INFORMATION

We use information held about you on the EthicsPoint system in the following ways:

• To investigate any incident reported to us.
• To make any necessary reports to third parties, such as regulators.
• To support any criminal investigation into our conduct or the conduct of our employees or third parties.
• To support disciplinary proceedings or civil proceedings against individuals breaching our codes of conduct, breaking the law or interfering with our legal or contractual rights. This may include further disclosure or transfers to different jurisdictions and LyondellBasell subsidiaries and affiliates as necessary.

LAWFUL BASIS FOR PROCESSING THIS INFORMATION

Our lawful basis for processing your personal data may be impacted by legal requirements in the country you are located. The lawful bases we use to process personal data on the EthicsPoint system are as follows:

• Compliance with a legal obligation: In many countries there is a legal obligation to take steps to prevent ethical violations, or to support criminal investigations into our conduct, the conduct of our employees and/or third parties which make it necessary for us to process personal data; or
• Compliance with the performance of a contract, for example for our employees the employment contract, where the employee is the data subject.

Depending on the nature and content of a report, we may be required to process some Sensitive Information. We are required to process this with more care in accordance with applicable data protection laws, and those laws in some instances require a different or additional legal basis for that processing. Where applicable, our lawful basis for this processing of Sensitive Information is that it:

• is necessary for the purposes of carrying out your or our obligations, or exercising your or our specific rights, in the field of employment and social security and social protection law, in so far as this is permitted by law;
• is necessary for reasons of substantial public interest (e.g. equality of opportunity or treatment);
• is necessary for the establishment, exercise or defence of legal claims;
• is necessary for the purposes of occupational medicine;
• is necessary for a reason for which such processing is permitted expressly by law; or
• is undertaken with your explicit consent where that is required.

As noted above, our lawful basis for processing your Sensitive Information may vary depending on what country you work in.

DISCLOSURE OF YOUR INFORMATION

The report you create will be shared with a distinct and specialist team of the individuals who handle the analysis and investigation of EthicsPoint reports within Lyondellbasell and NAVEX, and only where necessary, details may be shared on a need to know basis with individuals in LyondellBasell subsidiaries and affiliates across the world, to properly investigate and follow up on reports as necessary. For the purposes identified above, personal data processed further to a report may be accessed/processed by various different individuals within different LyondellBasell departments, including Compliance, Human Resources, Finance, Security and the Legal team. Those individuals may be located in the United States or elsewhere (see “Where We Store Your Personal Data” below for more information).

The LyondellBasell Compliance Department and those handling an investigation shall maintain confidentiality of the reporter, allegations, and investigation to the extent possible, balanced against the need to gather information and inform sources as well as applicable laws. In some circumstances we will need to share the information with other parties. For example, if we investigate an employee for misconduct we may need to share information with that employee to enable them to tell us their version of events or to defend themselves in court proceedings. Your personal data and the information you provide may also be disclosed to the police/and/or other enforcement or regulatory authorities. We will take care to ensure that we use any information you give us proportionally and that we hold a valid lawful basis for any disclosure. When facts reported do not relate to issues identified in Annex 1, they may be disclosed to officials of LyondellBasell when the vital interests or moral integrity of the employees are at stake, or when, under national EU Member State law, there is a legal obligation to communicate the information to public bodies or authorities competent for the prosecution of crimes.

WHERE WE STORE YOUR PERSONAL DATA

As NAVEX, our third party provider of the EthicsPoint system, is headquartered in the United States, the data that we collect from you will be transferred to, and stored at, differing locations that are primarily in the United States – primarily on its servers at its headquarters in Oregon. If you are making a report from Europe or the UK, you should be aware that it is likely that your data will be transferred outside of the European Economic Area (EEA) and/or the UK. Your personal data will also be processed by LyondellBasell staff, as well as staff of NAVEX and/or our suppliers, operating outside of the EEA in the United States. By submitting your personal data, you understand that this transfer, storing and processing will occur. LyondellBasell has adequate safeguards in place, including Standard Contractual Clauses, for these data transfers to outside the EEA and/or the UK. We take appropriate steps to ensure that your data is treated securely and in accordance with this Privacy Statement. Further information about international transfers or copies of these measures can be obtained at the contact email address listed below.

SECURITY

Where we have given you (or where you have chosen) a password which enables you to access certain parts of the site, you are responsible for keeping this password confidential. We ask you not to share a password with anyone. We and NAVEX have appropriate measures in place to prevent from accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to your personal data. We limit access to personal data to those who have a need for such access. Once we have received your information, we will use procedures and security features to try to prevent unauthorised access. LyondellBasell and NAVEX have implemented measures to ensure that the identity of the reporter is kept confidential throughout the process.

HOW LONG WE WILL RETAIN YOUR DATA

Your report and the personal data you provide or generated in the course of follow-up actions further to a report will be kept as long as necessary to process your report and investigate and to take any appropriate follow-up actions, including corrective actions or disciplinary sanctions or to meet our legal or financial requirements. Your personal data will be retained and deleted in accordance with the LyondellBasell’s Records Management Policy and Retention Schedule and/or deleted at your request (where such request conforms to the relevant legal requirements and is not otherwise limited), and in any case, upon expiration of the maximum retention period set forth by applicable law.

ACCESS AND CORRECTION OF INFORMATION

We can provide to you details of the information we hold about you at any time. You can access and correct much of the personal data the system holds on you by accessing your own report using the Follow up on a Report facility on the LyondellBasell EthicsPoint website. Incriminated persons may also access and rectify their personal data provided that this does not jeopardise the investigation, and that the identity of the reporter is kept confidential, except where the reporter maliciously has made false statements. Additionally, you may correct any information via the website as well.

OTHER RIGHTS RELATED TO PERSONAL DATA

You have certain rights, in relation to any personal data about you which we hold. Please note, you may not have access to all of these rights depending on the country you live and/or work in, and only those relevant in your jurisdiction will apply. Where there is a substantial risk that access and information on the processing of your personal data would jeopardise the investigation, this may be delayed to the incriminated person as long as such risk exists. For those working in the EU and/or the UK, all of the rights summarised below will apply to you.

As explained above, you may access the personal data about you that we store through the EthicsPoint website. You may also review or make certain corrections to the personal data we store about you. You may also request a copy of personal data you provided as part of the process from us, as long as providing you a copy doesn’t violate the rights of others, or if this does not interfere with the ongoing investigation.

You may also request the erasure of personal data about you or object to its processing. In limited circumstances, you may have data portability rights in relation to certain personal data we hold about you. These rights are not unlimited and the exercise of these rights, and the limits upon them, are briefly set out in the table below.

Where our processing of your personal data is necessary for our legitimate interests, you can object to this processing at any time. Please note however, that applicable law may not permit us to honor your request for erasure or your objection. Particularly where your report has resulted in an investigation by a governmental authority. If you do object, we will need to show either a compelling reason why our processing should continue, which overrides your interests, rights and freedoms or that the processing is necessary for us to establish, exercise or defend a legal claim (or in some circumstances we may obtain a consent from you for such processing).

For additional information regarding your rights, please see Schedule 3 to the LyondellBasell Fair Processing Notices found on Data Privacy Notices (sharepoint.com). If you wish to exercise any of your rights please contact personaldataprivacy@lyondellbasell.com in the first instance.

In some countries, should you continue to have unanswered concerns, you also have the right to contact the relevant data protection authority with your concerns.

CHANGES TO THIS PRIVACY STATEMENT

Any changes we may make to this Privacy Statement in the future will be posted on this page. This information may be expanded or updated as we change or develop the program. For this reason, we recommend that you review this Privacy Statement from time-to-time to see if anything has changed.

CONTACT

Questions regarding this Privacy Statement may be addressed to us at personaldataprivacy@lyondellbasell.com.