We respect and adhere to all local laws and regulations pertaining to the protection of personal information and the rights and freedoms of individuals. Privacy and data protection are essential to preserving the trust of our clients and employees. Our global privacy and data protection program supports legal compliance and effective privacy risk management in the countries where we do business. Our policies governing the use and protection of personal information include our global data protection policy, global privacy policy, global personal data classification policy, global data retention policy, global personal data breach notification policy, and employee privacy policy, among others. We also provide legal guidelines to help staff interpret these policies. These internal policies and guidelines are binding for every family member and facilitate compliance across our operations. Our data protection office oversees our global privacy and data protection program and reports to our chief risk officer. The data protection office serves as the contact point for data protection authorities, handles internal and external data privacy requests, provides advice on adherence to data privacy regulations, monitors compliance, and manages the network of local data protection contacts. The data protection office is an escalation point in the event of a personal data incident that may have compromised the rights and freedoms of individuals. In partnership with our risk team, the data protection office also administers our data-privacy training and awareness program. Precise procedures promote compliance with global regulations. Among these procedures are the following:  

• A comprehensive record of how we process personal data
• Data protection impact assessments to determine whether high-risk information systems have proper controls in place to mitigate risks to individuals
• Data processing agreements with vendors, outlining security and privacy responsibilities
• Controls to reinforce lawful transfer of data within the Group and with data processors
• Methods to guarantee that our Arcadiance family manage personal data appropriately • Processes to escalate and notify the appropriate authorities in the event of a personal data breach
• Dedicated staff to handle data access, correction, or deletion requests