Privacy Notice

Introduction

As a global organization, W. L. Gore & Associates and our affiliated and subsidiary companies (together “Gore” and each individually, a “Gore Entity,” or “we” or “us”) operate in many different countries. We are committed to protecting the privacy of our Associates. This Privacy Notice (“Notice”) explains how we and our affiliates collect, use, and disclose Personal Information (as defined below) relating to our Associates. In this Notice, “Personal Information” means information that identifies or could be used to identify an individual. The responsible controller of your Personal Information is W. L. Gore & Associates as the parent company together with the employing entity your employment contract is with (see the “Contact Us” section of this Notice for complete details including contact information).

Throughout this Notice we use the term "processing" to cover all activities involving your Personal Information, including collecting, handling, storing, sharing, accessing, using, transferring, and disposing of information. References to “Personal Information mean information that identifies or could be used to identify you.

What personal information we process

In the course of your employment with Gore, we will collect, use, and disclose Personal Information about you and your dependents, where permitted, relating to your working relationship with the Gore entity your employment contract is with. In this Notice, we generally describe the Personal Information we collect and the purposes for which we use it. We collect Personal Information in the course of our business operations and establishing, managing, or terminating our relationships with Associates and others. The types of Personal Information we process will vary depending on your role, your location, and the terms and conditions of your employment.

Typically, the categories of Personal Information we process will include the following:

• Personal Details: Name, maiden name and surname, e-mail and telephone details, home address, mailing address, birth date, national identification number, gender, marital status, dependents, emergency contact information, voice recordings and images;
• Identification and Verification Information: citizenship, passport data, details of residency or work permit;
• Equality and Diversity Data: where required or permitted under applicable law and where provided voluntarily, disability, data regarding the gender, age, nationality, and religious belief;
• Payroll Data: banking details, working time records (including vacation and other absence records, leave status, hours worked and department standard hours) and termination date;
• Compensation: Base salary, variable pay, benefits, overtime and shift work, details on stock grants and other awards, currency, pay frequency, the effective date of current compensation, contribution ranking;
• Travel and Expenses Information: we collect your corporate credit card number, and travel and expense information related to any travel or expense reports you submit;
• Management Records: details of any shares of common stock or directorships;
• Commitment: description of current commitment, business, division, function, location, leader(s), sponsor(s) and sponsee(s), Associate identification number, employment status and type, terms of employment, employment contract, work history with Gore, (re-)hire and termination date(s), length of service, retirement eligibility, disciplinary records, Gore level for compensation;
• Talent Management Information: details contained in letters of application and resume/CV, previous employment background, education history, professional qualifications, language and other relevant skills, details on feedback, development plan, willingness to relocate, as well as information about training and courses attended and certifications received or renewed;
• Monitoring Data, Security, and Access: identification and security information (including photograph) related to access card issuance and use, as well as CCTV images collected at our facilities; when you access Gore facilities, we collect location and date and time associated with your Gore Associate badge swipe activity; where permitted under applicable law, we also engage in CCTV monitoring for security, and data caught by IT security programs and filters, including device information (IP address, MAC address, location information, user ID) and log files and activity data associated with your access to and the use of Gore information and network resources (as explained in more detail in our Acceptable Use Policy);
• Associate Monitoring and Compliance: information relating to Associate adherence to policies and to other security and internal control matters;
• Workplace Health and Safety Data: Personal information in audits, risk assessments and incident reports;
• Associate Claims, Complaints and Disclosures Data: for example, Personal Information relating to employment-based litigation and complaints, Associate involvement in incident reporting and disclosures;
• Investigations Data: for example, internal, government, law enforcement, and other investigations, including those arising from Associate reports, claims and complaints, and other sources, and any Personal Information contained in records of allegations, investigations, and proceedings, and their outcomes. Judicial data, for example information relating to criminal offences or used in judicial proceedings.
• Sensitive health and judicial data: for example, data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership and the processing of genetic data, biometric data for the purposes of uniquely identifying an associate; data concerning an associate’s health or data concerning an associates sex life or sexual orientation when necessary.

Legal Basis and Purposes for Processing Your Personal Information

Whenever we process your Personal Information, we do so on the basis of a lawful "justification" (or legal basis) for processing. In the majority of cases, the processing of your Personal Information will be justified for the grounds set out further below. In any event, to process your Personal Information, we will be relying on one of the following legal bases:

• Employment Contract: processing is necessary for carrying out or terminating the employment contract (for example, collecting bank account details to pay your salary, creating your access rights, responding to grievances, managing beneficiary details, administer termination);
• Legitimate Interest: processing is in our legitimate interests as a business and as your employer and our interests are not overridden by your interests, fundamental rights or freedoms, including assessing new job opportunities, securing and ensuring the operation of our property, networks, systems and data) (only applicable for Germany where Personal Information are not processed for employment related purposes);
• Comply with Law: processing is necessary for us to comply with a legal obligation (for example, administering benefits schemes, reviewing eligibility for work, creating an Associate record (including absences), addressing occupational health issues, managing professional qualifications, managing IT security, disclosing tax data to a government authority or salary information to a national insurance scheme);
• Your Consent: processing is based on your prior explicit consent (for example, in order to use your photo for promotional purposes).

For German Associates our processing may also be based on the following specific legal bases under applicable German law:

• processing is necessary to investigate crimes, if there is a documented reason to believe the data subject has committed a crime while employed, the processing of such data is necessary to investigate the crime and is not outweighed by the data subject's legitimate interest in not processing the data, and in particular the type and extent are not disproportionate to the reason; and
• processing is necessary to exercise or satisfy rights and obligations of Associate’s representation laid down by law or by collective agreements or other agreements between the employer and works council, where such exists. The processing of special categories of Personal Information (also known as sensitive data, that is, data that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership; genetic data; biometric data for the purpose of uniquely identifying a natural person; or data concerning health or a natural person’s sex life or sexual orientation) will also be justified by one of the following:
• Comply with Law: processing is necessary for the purposes of carrying out obligations and exercising the rights of you or Gore in the field of employment law, social security and social protection law and there is no reason to believe that you have an overriding legitimate interest in not processing the data;
• Explicit Consent: processing is carried out with your explicit consent;
• Establish, Defend and Protect Legal Rights: processing is necessary for the establishment, exercise or defense of legal claims; or
• Vital Interests: in exceptional circumstances, processing is necessary to protect your vital interests and you are incapable of giving consent.

Why we process Your Personal Information

We collect and use Personal Information related to Associates, in order to conduct our business operations and establish, manage, and potentially terminate our relationships with Associates and others, including for example:

• Managing Workforce: Managing work activities and personnel generally, including performance and development and feedback, assessments, commitment changes and succession planning, recognition of achievements and anniversaries, administration and payment of salary, wages, and other awards such as profit sharing, stock ownership or participation plans, stock grants, health care, retirement plans, training, leave, transfers, honoring other contractual benefits, loans, performing workforce analysis and planning, performing background checks, managing coaching, disciplinary matters and separations, and making business travel arrangements;
• Communications and Emergencies: Business communication, facilitating communication with Associates, providing references, ensuring business continuity, protecting the health and safety of Associates and others, safeguarding IT infrastructure, office equipment and other property, facilitating communication in an emergency;
• Business Operations: Operating and managing the IT and communications systems, managing product and service development, improving products and services, managing company assets, allocating company assets and human resources, strategic planning, project management, project time tracking, business continuity, compilation of audit trails and other reporting tools, maintaining records relating to manufacturing and other business activities, budgeting, financial management and reporting, communications, managing mergers, acquisitions, and re-organizations or disposals;
• Compliance: Complying with legal and other requirements, such as income tax and national insurance deductions, record-keeping and reporting obligations, conducting audits, compliance with government inspections, restricted party screenings, and other requests from government or other public authorities, responding to legal process such as subpoenas, pursuing legal rights and remedies, defending litigation, and managing any internal complaints or claims and complying with internal policies and procedures;
• Security and Access: identity verification and ensuring secure access to our facilities; and
• Associate Resource Usage and Corporate Investigations: Monitoring activities as permitted by local law (including the monitoring of telephone, email, Internet, access control and CCTV and other company resources), and conducting internal investigations.
• Automated decision making: Gore does not make decisions which are solely based on automatic processing, including profiling. Decisions based on associates’ data always include a review by natural persons.

Transfer of Personal Information

Due to the global nature of our operations, we may disclose and transfer certain Personal Information to Human Resources and other functions throughout Gore and to affiliates to fulfill the purposes described in this Notice. This may include transferring the Personal Information to locations outside the country in which you work, (including the US and outside the European Economic Area (“EEA”)). In the event that we transfer your personal data outside the European Economic Area, we ensure that your data is protected in a manner which is consistent with applicable law. Therefore, and if required by applicable law, we take the following measures

• We share your personal data with affiliated companies outside the European Economic Area only if they have implemented an intragroup data transfer agreement enabling sufficient guarantees for the protection of personal data including international transfers.
• We transfer personal data to external recipients outside the European Economic Area only after establishing that appropriate safeguards exist between us and the recipient.

From time to time, we make Personal Information available to other parties, such as legal and regulatory authorities; accountants, auditors, lawyers, and other outside professional advisors, and to companies that provide products and services to Gore and its affiliates (such as payroll, retirement program, insurance, or medical benefits providers; human resources services, IT systems suppliers and support; and other third parties engaged to assist Gore. These third parties may be located in, or their services provided from jurisdictions outside of the jurisdiction where you work. Gore will take steps to ensure that Personal Information is protected appropriately and in compliance with applicable law regardless of where it is stored, used, or processed.

When Personal Information is transferred to jurisdictions outside the jurisdiction in which you work, as described above, it may be accessible to foreign governments, courts, law enforcement or regulatory agencies in those jurisdictions according to the laws applicable in those jurisdictions.

We may also disclose Personal Information without consent where authorized or required by law.

Security

Gore will take the appropriate legal, organizational, and technical measures to protect Personal Information consistent with applicable privacy and data security laws. When Gore retains a third-party service provider, that provider will be carefully selected and required to use appropriate measures to protect the confidentiality and security of the Personal Information.

Data Integrity and Retention

Gore takes reasonable steps to ensure that Personal Information we process is reliable for its intended use, and accurate, and complete as necessary to carry out the purposes described in this Notice. Gore will generally only retain Personal Information for the period necessary to fulfill the purposes outlined in this Notice unless a longer retention period is required or permitted by law.

Your Rights to Access, Rectification and Erasure

Gore will take steps in accordance with the applicable legislation to keep your Personal Information accurate, complete, and up to date. You are entitled to have any inadequate, incomplete, or incorrect Personal Information corrected. Furthermore, you also have the right to request access to and a copy of the Personal Information that we store about you.

You are entitled to review your Personal Information, and request that we delete such data:

1. where it is no longer necessary for us to process this data in relation to the purposes for which we collected or processed the Personal Information;
2. you have withdrawn your consent;
3. you have objected to processing and we cannot prove that there are overriding legitimate grounds for processing;
4. your Personal Information was processed unlawfully; or
5. your Personal Information must be erased in order to comply with legal requirements;

Associates in the European Union also have the right to restrict the processing of their Personal Information to only comprise storage of your Personal Information under certain circumstances:

1. the accuracy of your Personal Information is contested by you, and we must verify the accuracy of the personal Information;
2. the processing is unlawful, but you oppose the erasure of the Personal Information and request the restriction of their use instead;
3. we no longer need the Personal Information for the purposes of processing, but you require the information to establish, exercise or defend your legal claims;
4. you have objected to processing pending the verification of whether our legitimate grounds override your legitimate grounds.

You have the right to receive a copy of the Personal Information processed in a common machine-readable format and to require us to transmit it to another data controller where this is technically feasible (data portability). You may, at any time, withdraw consents that you have given to Gore pertaining to any such processing of Personal Information which is based on your consent. The withdrawal of your consent shall not affect the lawfulness of the processing based on consent before its withdrawal.

Your Right to Object

As far as we are processing your Personal Information for the purpose of our legitimate interest you have the right to object against such processing and as a consequence, we are obliged to no longer process the Personal Information unless we may demonstrate compelling legitimate grounds for the processing which override your interests.

Contact Us

The controller for your personal information is your employing Gore entity (see list below)

W. L. Gore & Associates Ges.m.b.H.

Moosfeldstrasse 1

5101 Bergheim Austria

W. L. Gore & Associates Scandinavia AB Neongatan 9

431 53 Mölndal Sweden

W. L. Gore & Associates (UK) Limited Simpson Parkway

Kirkton Campus Livingston

West Lothian EH54 7BH United Kingdom

W. L. Gore & Associates (UK) Holding Company Ltd. One Fleet Place

London EC4M 7WS United Kingdom

Gore UK Medical Ltd Simpson Parkway Kirkton Campus Livingston

West Lothian EH54 7BH United Kingdom

W. L. Gore & Associates, Polska Sp.z.o.o. ul. Migdalowa 4

02-796 Warsaw Poland

W. L. Gore & Associates, B.V. Ringbaan Oost 152-a

5013 CE Tilburg Netherlands

W.L. Gore y Asociados S.L. Calle Ciudad de Granada, 178 08018 Barcelona

Spain

W. L. Gore & Associates S.A.R.L. Bercy International

8, place des vins de France 75012 Paris

France

W. L. Gore & Associates GmbH Hermann-Oberth-Straße 22,

85640 Putzbrunn Germany

Gore Medical GmbH Hermann-Oberth-Straße 22,

85640 Putzbrunn Germany

W. L. Gore & Associati S.r.l

Attn: Italy Data Protection Officer Via Enrico Fermi, 2/4 37135 Verona

Italy

If you have any questions or concerns regarding the processing of your Personal Information, please contact us using the information set forth above, or contact our EU Data Protection Officer using the details set forth below:

W.L. Gore & Associates

Attn: EU Group Data Protection Officer Hermann-Oberth-Str. 22 85640 Putzbrunn

Germany

Email: - dataprivacyoffice@wlgore.com 

If you are in Italy, you may also contact our Italy Data Protection Officer at:

W. L. Gore & Associati S.r.l

Attn: Italy Data Protection Officer Via Enrico Fermi, 2/4 37135 Verona

Italy

Email: - dataprivacyoffice@wlgore.com 

If you have any questions, requests, or concerns about how we process Personal Information, please contact your local HR Services Team. In certain countries, you may have the right to access, ratify, modify, or object to the use of your Personal Information on the grounds that such Personal Information was used or acquired in violation of applicable law. Please note that certain Personal Information may be exempt from access, correction, or objection rights under local data protection laws. Where we make changes to this Notice that materially affect you, we will notify you by emailing a notice to your Gore email address.