Report your Concern Online

WSH SPEAK UP DATA PRIVACY NOTICE

1. Introduction

   The WSH Speak Up platform (“Speak Up”) is a confidential reporting platform hosted by EthicsPoint and operated by NAVEX, an independent third-party company for WSH. Speak Up is a web and phone-based intake system provided to its employees, suppliers, clients and other stakeholders (“Reporters”) reporting suspected violations of laws or regulations or for certain matters specified in an applicable whistleblowing law.

   This Privacy Notice explains how WSH International Investments Limited, its subsidiaries, operating and group companies (together, “WSH”, “WSH Group company” “we”, “our”, “us”) process personal data in connection with the Speak Up platform.

   This Privacy Notice supplements, and should be read in conjunction with, the WSH Employee Privacy Notice that we provide to our employees which can be found here and our WSH Privacy Notice which can be found here. This supplemental notice provides additional and specific detail relating to the processing of personal data for the purposes of reporting certain non-compliance issues on the Speak Up platform as further detailed below.

   WSH is a data controller of personal data and uses certain data about you. This data is also used by our subsidiaries, operating and group companies, where applicable. NAVEX acts as WSH’s processor under a data processing agreement and approved transfer safeguards.

   The information you provide about yourself, your colleagues, or any aspect of WSH’s operations may result in decisions that affect others. Therefore, only provide information that is correct and factual. Knowingly providing false or misleading information may result in consequences, including disciplinary proceedings up to and including termination. WSH has a strict non-retaliation policy for any report made in good faith. The information you submit will be treated confidentially except in cases where this is not possible because of legal requirements or to conduct an investigation, in which case the information will be handled sensitively. We encourage you to identify yourself for us to follow up with questions we may have.

2. What personal data do we collect and use

   Please provide as much information as possible about your concern. The website and telephone hotline questions are designed to assist in complete reporting.

   Depending on your submission, we may process the following data: (i) your name, contact details (unless you report anonymously), Speak Up Case ID, ii) your relationship to WSH; (iii) the name and other personal data of the persons you submit in your report if you provide such information (i.e.: description of functions and contact details); and (iv) a description of the alleged misconduct as well as a description of the circumstances of the incident. Note that depending upon the laws of the country in which you are residing, the report may not be made anonymously; however, your personal information will be treated confidentially and will only be disclosed as set out below.

   You will be issued a Report Key and asked to create a password when you submit a report. You will need the Report Key and password to return to the Speak Up platform or telephone to supplement your report or to check for updates.

   If not constituting a relevant element of your report, please do not provide any data about yourself or another person concerning the philosophical beliefs, physical or mental health, political opinions, racial or ethnic origin, religious beliefs, sex life, sexual orientation or trade union membership.

3. For what purposes does WSH process personal data

   Any personal data collected and processed in relation to Speak Up, including your personal data is processed for the purposes of:

   • managing and administering the Speak Up platform;
   • reporting, documenting, tracking and investigating the alleged misconduct;
   • taking any necessary follow-up action or remedial action upon the completion of an investigation;
   • create anonymous reports for management at the respective WSH Group company;
   • engage with law enforcement or external regulators, if applicable;
   • use your personal data in an aggregated form (information identifying you is removed) for the purposes of statistics and analytics; and
   • WSH will process your personal data in accordance with applicable law in your jurisdiction.

   We may also receive information about you from other sources as part of verifying the information you provide (for example information from witnesses to the actions reported) which we will add to the information which we already hold about you.

4. Who has access to personal data

   WSH collects personal data for the purposes referred to above and will only share this information on a strictly need-to-know basis with:

   • designated employees responsible for administering the Speak Up platform at the respective WSH Group company;
   • designated departments responsible for managing, investigating, and following up on your report at the respective WSH Group company (including but not limited to our HR/People, Risk or Legal team);
   • public authorities, government, regulatory or fiscal agencies where it is necessary to comply with a legal or regulatory obligation to which the respective WSH Group company is subject as permitted by applicable local law;
   • NAVEX and its subsidiary companies, which operate the Speak Up platform on WSH’s behalf; and
   • statutory auditors, forensic auditors and external legal counsel engaged by the respective WSH Group company.

5. What is the legal basis for processing your personal data

   WSH relies on the following legal basis for the processing of personal data:

   • your consent to process the report submitted by you (this relates to personal data that identifies you as reporter); and
   • our legitimate interest in investigating your report and taking any follow-up actions upon the completion of such investigation (this relates to personal data that identifies the individuals you are reporting on). Our legitimate interest is ensuring that all suspected violations of applicable law/regulations are investigated.
   • In some cases, WSH also processes personal data submitted through the Speak Up to comply with a legal obligation to which WSH is subject or because such processing is necessary for establishing, exercising, or defending legal claims.

6. Sources of the personal data

   The primary source of the information, including personal data is submitted by the reporting persons via different reporting channels, including through the Speak Up platform. Where necessary, we may also collect other information from other sources, either internal or external, in order for us to conduct the investigation and/or verify the facts reported to us and from public sources where relevant.

7. International transfers of personal data

   NAVEX provides EU and UK datahosting options and WSH will host reports in the EU/EEA and UK, wherever applicable, subject to appropriate safeguards. If we transfer personal data outside your country e.g., data may be transferred to NAVEX’s sub-processors for service and support or translation and interpretation purposes, we implement appropriate safeguards, such as those adopted by the European Commission and the UK government, which have been implemented to govern cross-border transfers of personal data within WSH and to NAVEX.

8. How long we will retain your personal data

   Your report and personal data will be retained for as long as they are needed for the investigation of your allegations, for any legitimate follow-up to the investigation, or as otherwise consistent with complying with legal or regulatory requirements. WSH will store your personal data for 6 years following the closure of an investigation, unless there is a local legal requirement to delete your personal data earlier or later. When this period expires, your personal data is removed from our systems and repositories. Any information you submit that is not needed to answer your question or for any investigation may be deleted or archived, in accordance with our internal policies.

9. What are your rights and how can you exercise them

   You have the following rights:

   • to access, review, correct or update your personal data;
   • to request that your personal data is deleted. This right can only be exercised in certain cases, as applicable under the relevant data protection laws;
   • to request the restriction of the processing of your personal data when the accuracy, lawfulness, or necessity of the processing of the data is doubtful, in which case we may retain the data for the exercise or defence of legal claims;
   • to object to the processing of your personal data. WSH will not process your data any longer than needed to fulfil the overriding legitimate interest or for the establishment, exercise or defence of legal claims; and
   • to withdraw a consent at any time, in case where the processing was based on your consent.

   Please note that exercising of the data protection rights may also be subject to certain limitations as set out in the applicable laws regarding the protection of the whistleblowers.

   You can exercise your rights at any time by contacting WSH below.

10. Questions, Concerns or Complaints

    If you have questions or concerns regarding this Privacy Notice or the processing of your personal data in relation to the Speak Up platform, you have the right to lodge a complaint with us - please contact the applicable jurisdiction where you are employed, engaged or otherwise:

    Country	Address	Email Address
    Belgium	Avenue Louise 489, 1050 Ixelles, Brussels, Belgium	dataprotection@wshlimited.com
    France	83, rue de Monceau - 75008, Paris	dataprotection@wshlimited.com
    Ireland	2nd Floor, Avoca Building, Fitzmaurice Road, Rathcoole, Dublin 24, Ireland	dataprotection@wshlimited.com
    Denmark	Dampfærgevej 10, 1. 2100 København Ø, Denmark	gdpr@meyers.dk
    Norway	c/o Ecit Services AS, Rolfsbuktveien 4A, 1364 Fornebu, Bærum Kommune, Norway	dataprotection@wshlimited.com
    Scotland	8 Fairways Business Park, Deer Park Avenue, Livingston, Scotland, EH54 8AF	dataprotection@wshlimited.com
    The Netherlands	Signature Strawinskyhuis 114, Strawinskylaan 6, 1077XZ, Amsterdam	dataprotection@wshlimited.com
    United Kingdom and Northern Ireland	300 Thames Valley Park Drive, Reading, Berkshire, RG6 1PT, United Kingdom	dataprotection@wshlimited.com

    If you are not satisfied with the outcome from WSH, you may also lodge a complaint with the corresponding Data Protection Supervisory Authority in your country of residence. You can find the relevant Supervisory Authority name and contact details under http://ec.europa.eu/justice/data-protection/bodies/authorities/index_en.htm.

11. Updates to this Privacy Notice

    We may update this Privacy and Consent Notice from time to time.