Agel Enterprises, Inc. (“Agel”), whose headquarters is located in the United States of America (the “United States”), controls and operates a data processing system (the “System”) that is certified under the voluntary U.S.-EU Safe Harbor program (the “Safe Harbor Program”):
The System holds (or will hold) customer, employee, vendor, and contractor contact information for the purpose of supporting online orders taken through Agel and Affilates’ websites. Agel acknowledges the privacy protections afforded to individuals in the European Union and the European Economic Area (collectively the “EEA”) regarding Personal Information (as defined below). For that reason, Agel has subscribed and will adhere to the Safe Harbor Program by adopting and implementing this set of Safe Harbor Privacy Principles with respect to the System; additionally, these include a set of frequently asked questions (collectively, the “Principles”). To learn more about the Safe Harbor program, and to view
Agel’s certification, please visit http://www.export.gov/safeharbor/.
- SCOPE OF THESE PRINCIPLES
The Principles apply to all Personal Information that is: (1) collected by any Affiliated Entity (as defined below) located in the EEA about an Individual located in the EEA; (2) in the course of the Individual’s relationship(s) with the Affiliated Entities and/or with companies that provide goods and services to the Affiliated Entities (“Independent Contractors”); and (3) transferred from the EEA to Agel or an Agel entity in the United States after the effective date of these Principles and included in the System. The effective date of these Principles is 12-23-2014.
FREQUENTLY ASKED QUESTIONS
- What is “Personal Information”?
Personal Information means any information relating to an Individual that identifies that Individual, or could reasonably be used to identify the Individual, and that is recorded in any form (e.g., paper, electronic, video, audio) and included in the System.
- What are Affiliated Entities?
Affiliated Entities are corporations or other business organizations present in the EEA that are affiliated with Agel through direct or indirect common ownership or control.
- Who is an Individual for Purposes of these Principles?
An Individual is any natural person whose Personal Information is included in the System.
- What is the relationship between the Principles and the Safe Harbor Program?
The Principles implement and satisfy the requirements of the Safe Harbor Program and establish the legally required level of protection for Individuals’ Personal Information.
III. NOTICE AND CHOICE
- Collection and Use of Personal Information
Agel collects and uses Personal Information only in a lawful manner and in compliance with the Safe Harbor Program and these Principles.
FREQUENTLY ASKED QUESTION
- Why is Personal Information transferred to AGEL in the System?
The collection and use of Personal Information is necessary for the conduct of the human resources and operational management of Agel and the Affiliated Entities. Examples of the purposes for which Agel collects and uses Personal Information about Individuals include, without limitation, facilitating the provision of internal goods and services required for employees and contractors to carry out their work duties.
- Informing the Individual and Obtaining Consent
Unless an applicable legal exception exists, Affiliated Entities are legally required to inform Individuals (or to request that Independent Contractors inform Individuals) of the ways in which their Personal Information will be collected and used and the types of third parties to which such Information will be disclosed, and to obtain the Individuals’ consent.
Accordingly, except where an applicable legal exception exists, if Agel either plans to use Personal Information for purposes incompatible with the purposes about which the Affiliated Entities (or Independent Contractors) notified Individuals and/or to which the Individuals consented, or plans to disclose Personal Information to types of third parties other than those about which Affiliated Entities (or Independent Contractors) notified Individuals and/or to which the Individuals consented (“Supplemental Uses”), then Agel shall notify (or shall request the Independent Contractor, as appropriate, to notify) Individuals of the following with respect to such Supplemental Uses:
- The type(s) of Personal Information Agel plans to use;
- The purposes for which Agel will process Personal Information;
- How to contact Agel with any inquiries or complaints about the use and processing of such Personal Information;
- The types of parties to whom Agel will disclose Personal Information;
- The privacy and security safeguards Agel employs; and
- The right of Individuals to access and, if necessary, correct Personal Information about them.
- This information will be provided before Agel uses or discloses Personal Information for Supplemental Uses or as soon thereafter as is practicable and, unless an applicable legal exception exists, Individuals’ consent to such use and/or disclosure will be obtained.
FREQUENTLY ASKED QUESTIONS
- Are there cases when Agel may disclose Personal Information about an Individual without obtaining the Individual’s consent?
In certain limited or exceptional circumstances, and in accordance with the Safe Harbor Program, Agel may disclose Personal Information about an Individual without the Individual’s consent, such as when Agel is required to disclose the Information by law or legal process or when the vital interests of the Individual, such as life or health, are at stake. In such circumstances, and at such time as may be required by law or the Safe Harbor Program, Agel, the relevant Affiliated Entity, or the Independent Contractor, as appropriate, shall inform the Individual concerned regarding whom to contact if the Individual has a legitimate reason to object to the disclosure of the Individual’s Personal Information by Agel.
- Under what circumstances may Agel disclose Personal Information to agents and contractors, and what steps does Agel take to safeguard that Personal Information?
As a part of its normal business operations, Agel hires agents and contractors to carry out certain functions that require use of Personal Information, such as data processing and benefit administration. Agel is not required by the Safe Harbor Program to provide notice or obtain the relevant Individual’s consent in these circumstances, and Agel does not generally do so. Agel does bind such agents and contractors through written agreements to observe the relevant Principles and Agel restricts the use and retention of the Personal Information to the purposes and duration of such functions.
- What happens if an Individual objects to the collection, use, or disclosure of his/her Personal Information by Agel?
If an Individual objects to Agel’s collection, use, or disclosure of certain Personal Information, Agel or the appropriate Affiliated Entity will make reasonable efforts to address the concerns of the Individual.
- Will Agel take any adverse action against an Individual for refusing to permit his/her Personal Information to be collected, used, or disclosed?
The Safe Harbor Program prohibits a company that subscribes to the Safe Harbor Program from taking such adverse action. Accordingly, Agel may not subject an Individual to disciplinary action, sanction, or retaliation for objecting to the collection, use, or disclosure of Personal Information about the Individual.
Withholding Personal Information or barring its collection, use or disclosure, may, however, be a disadvantage to an Individual by making the Information unavailable. For example, unwillingness to provide Personal Information required for a benefit may result in the employee’s ineligibility to receive that benefit. Similarly, an employee who refuses to provide Personal Information reasonably required for to perform his or her employment duties may result in that employee’s inability to fulfill the terms of his/her employment arrangement.
- Sensitive Information
While Agel understands that all Personal Information deserves protection in accordance with the Safe Harbor Program, Agel takes special precautions and safeguards for the collection of any sensitive information, as defined by the Safe Harbor Program.
FREQUENTLY ASKED QUESTIONS
- What is “sensitive information”?
“Sensitive information” is Personal Information specifying medical or health conditions, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership or information specifying the sex life of the individual.
- What safeguards are required for “sensitive information”?
Except as otherwise provided by the Safe Harbor Program or where not legally required, affirmative permission of the Individual (“opt in” consent) is required if “sensitive information” is to be disclosed to a third party or used for purposes other than those for which it was originally collected or subsequently authorized by the Individual.
Agel provides Individuals about whom it maintains Personal Information with a reasonable opportunity to examine their information, to challenge its accuracy, and to have it corrected, amended or deleted as appropriate, subject to certain exceptions.
FREQUENTLY ASKED QUESTIONS
- How do Individuals exercise their rights under the Access Principle?
Each employee of an Affiliated Entity will have direct access to certain Personal Information about him/her contained in the System. Each employee will be able to correct certain Personal Information pertaining to him/her in the System, except where the Personal Information is determined by an Affiliated Entity, such as the employee’s type of contract, etc. (“Company Determined Personal Information”). Employees must contact the appropriate Affiliated Entity or Agel to correct Company Determined Personal Information. Similarly, upon request to the appropriate Affiliated Entity or Agel, each independent worker or employee of an Independent Contractor will be given reasonable access to Personal Information about him/her that is contained in the Systems. Reasonable access applies to both the process of accessing Personal Information and the types of Personal Information to be accessed. In terms of process, reasonable access means, for example, that requests for access are made during normal business hours, following standard procedures, and that the frequency of access requests is not excessive. In terms of types of Personal Information to be accessed, reasonable access recognizes certain exceptions discussed in the immediately following FAQ 2. If Agel or the Affiliated Entity denies an Individual access, however, such Individual will be provided with the reason(s) access was denied and a contact point for further inquiries.
If Agel or an Affiliated Entity is notified that Personal Information it maintains is incorrect, is requested to correct the Personal Information, and is provided with appropriate supporting documentation, Agel or the appropriate Affiliated Entity will either correct the information or direct the Individual to the source of the information for correction. If, upon review, Agel or the appropriate Affiliated Entity believes that the existing information is correct, the Individual will be informed accordingly.
- Is there any Personal Information about an Individual maintained by Agel that such Individual would not be permitted to access?
Yes, there are some exceptions to the obligation to provide access permitted by the Safe Harbor Program. These include access to confidential or proprietary information of either the relevant Affiliated Entity or Agel, such as business reorganization or succession plans, or situations in which granting access might have to be balanced against the privacy interests of others. In addition, Agel may deny access if the Personal Information requested relates to an ongoing investigation of the Individual, litigation or potential litigation, or where the burden or expense of providing access outweighs any risks to the Individual’s privacy that would arise from withholding access.
- ONWARD TRANSFER
If Agel performs an onward transfer of information to a third party that is acting as an agent, Agel will do so only if Agel verifies that the third party subscribes to the Safe Harbor Program, or is subject to the EU Data Directive or another EU adequacy finding. Alternatively, Agel will enter into a written agreement with such third party requiring that the third party supply at least the equivalent level of privacy protection as is required by the relevant provisions of the Safe Harbor Program.
- DATA INTEGRITY
AGEL expends reasonable efforts to ensure that Personal Information accurate, complete, and current for the purposes for which such Information is used. Each Individual is responsible for ensuring that the Personal Information that AGEL maintains about that him or her is correct, complete, and current.
FREQUENTLY ASKED QUESTION
- Is there a role for Individuals to play in maintaining the accuracy of Personal Information?
Yes. It is in the best interests of Individuals, Affiliated Entities, and Agel to keep Personal Information accurate, complete, and up-to date. Agel and the Affiliated Entities expect all Individuals to assist in keeping the Personal Information that the system holds about them accurate, complete and up-to-date, and AGEL and the Affiliated Entities facilitate cooperation by Individuals in doing so.
Agel take reasonable actions, including administrative, technical, personnel, and physical measures to safeguard Personal Information against loss, theft and misuse, as well as unauthorized access, disclosure, alteration and destruction.
FREQUENTLY ASKED QUESTIONS
- Is there a role for Individuals to play in maintaining the security of Personal Information?
Individuals play a critical part in maintaining security, and are accountable for protecting Personal Information, including, for example, by safeguarding passwords used to access corporate computer systems.
- How are decisions reached about who has access to Personal Information about Individuals?
It is the policy of Agel to give access to Personal Information about Individuals only to those entities and persons that Agel determines have a legitimate need in order to fulfill their responsibilities.
- What keeps those with access to some of an Individual’s Personal Information from browsing through other parts of that Personal Information for other reasons?
It is the policy of Agel to limit the access to Personal Information given to employees, agents, and contractors to such information that Agel determine is needed to fulfill their obligations.
Agel ensures compliance with the Principles, the Safe Harbor Program, and Agel’s contractual agreements and other commitments regarding the handling of Personal Information through its internal compliance team. Agel’s legal, finance, and information technology departments (“IT”; and collectively, “Safe Harbor Compliance Team”) are responsible for implementing and supervising the administration of the Principles. All Agel employees are obligated to act in a manner aligned with the Principles with respect to Personal Information. Failure to do so may result in disciplinary action up to and including discharge from employment.
FREQUENTLY ASKED QUESTIONS
- What are the responsibilities of the Agel Safe Harbor Compliance Team?
Responsibilities of Agel’s Safe Harbor Compliance Team include:
- Ensuring that the privacy guidelines, programs, procedures, training, and other measures necessary to implement the Principles are developed and put to action;
- Overseeing replies to inquiries and resolution of grievances relating to Personal Information;
- Working with internal and, when necessary, outside legal counsel to ensure continued compliance with relevant privacy laws and agreements, as well as any obligations Agel may enter into voluntarily, such as the Principles and the U.S.-EU Safe Harbor Program; and
- Assessing Agel’s internal procedures to ensure conformity with the Principles and associated company obligations.
- What actions does Agel take to uphold compliance with the Principles?
Compliance measures include:
- Educating Agel employees about the rationale and application of the Principles;
- Training Agel employees with access to Personal Information on the purposes and application of the Principles;
- Ensuring that Agel employees, agents, and contractors with access to Personal Information are legally obligated to abide by the Principles;
- Keeping Agel employees, agents, and contractors accountable for violations of the Principles, with penalties up to and including termination of contracts and employment.
- Complaint Resolution
Agel acknowledges the value of having mechanisms in place to address and resolve complaints by Individuals about the use of Personal Information. As such, if an Individual complains about the processing of the Individual’s Personal Information, and the Agel’s internal resolution procedures do not resolve the matter to the Individual’s reasonable satisfaction, then Agel will refer such Individual to the national data protection authority in the jurisdiction where the Individual works and/or resides as required by the Safe Harbor Program.
FREQUENTLY ASKED QUESTIONS
- What procedures are in place at Agel for filing an internal complaint about the handling of Personal Information?
Individuals covered by the Principles should contact the Agel Legal Department at the following address:
Agel Safe Harbor Compliance Team
2174 West Grove Parkway Suite100
Pleasant Grove, Utah 84062
Representatives from that office will provide details about the mechanics of the complaint process.
- What types of independent dispute resolution mechanisms are available?
All EEA jurisdictions have established data protection authorities governing the processing of Personal Information that are willing to assist in the resolution of complaints. To maintain its certification under the Safe Harbor Program, Agel must collaborate with these authorities to resolve complaints and abide by their decisions in such cases.
- Changes to the Principles
Agel reserves the right to modify these Principles at any time and will notify affected individuals of such modifications in accordance with applicable law and the Safe Harbor Program. Nonetheless, as long as Agel continues to store, use, or disclose Personal Information transferred to Agel under these Principles, Agel will apply either these Principles or safeguards with equivalent or greater that provide no less privacy protection than required under the Safe Harbor Program to such Personal Information.