The purpose of this policy is to help ensure that Whirlpool Europe fulfils its strong commitment of maintaining the privacy of its customers and employees. The Chief Privacy Officer of Whirlpool Europe has full authority to enforce this policy and may delegate all or part of this authority to a Privacy Manager. The Privacy Program applies to all Whirlpool entities in Europe (collectively referred to as the Whirlpool Europe Region or "WER") and consists of the privacy principles listed below. Individual data may only be collected, used and processed in a manner consistent with these key principles.

 

Whenever WER staff are collecting individual data about employees or customers they are required to provide the individual with notice about the purposes for which it collects and uses information, how to contact WER with any inquiries or complaints, the types of third parties to which WER will disclose the information, and the choices and means WER offers individuals for limiting its use and disclosure. This notice must be provided in clear and conspicuous language when individuals are first asked to provide personal information. All such notices must be approved in advance by the Chief Privacy Officer.

 

Individual data may only be processed when WER has received the unambiguous consent from the individual. When WER staff are collecting individual data about employees or customers they are required to offer the individual the opportunity to choose whether their personal information is to be used for a purpose that is different from the purpose(s) for which it was originally collected (e.g. using warranty card data to sell future products). This consent and choice may be obtained through the use of an "opt out" box when WER is collecting non-sensitive information (i.e. personal information that does not relate to medical or health conditions, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership or information specifying the sex life of the individual). The form of the consent must be approved in advance by the Chief Privacy Officer.

 

No individual data may be transferred to a third party, including other Whirlpool Regions, unless approved by the Chief Privacy Officer. Approval shall only be given when the individuals affected have been notified of the possible onward transfer and have given their consent to the transfer. The Chief Privacy Officer may waive the requirement of notice and consent to onward transfer if the transfer only involves a third party that is acting as an agent and the third party either (a) subscribes to the EU\US Safe Harbor Privacy Principles, (b) is subject to the EU Privacy Laws or another adequacy finding, or (c) has entered into a written agreement with WER in which the third party has agreed to provide at least the same level of privacy protection as is required under this policy and European privacy laws.

 

WER will take reasonable precautions to protect individual data from loss, misuse and unauthorized access, disclosure, alteration and destruction of personal data. The information security group shall become familiar with the security regulations of each country within Europe and implement processes and procedures that comply with such requirements after reviewing them with the Chief Privacy Officer. All WER employees are required to comply with these security processes and procedures.