Supplier Privacy

Information on the Processing of Personal Data Related to the Below Olin Entities as Subject to GDPR:

This communication is to provide you important information about the processing of your personal data in the course of the contractual relationship with one of the Olin entities listed above, which includes the transfer to and processing by and among Olin Corporation and its subsidiaries (collectively, referred to as “Olin”).

Controller. The respective Olin company that you contract with from the above list together with Olin Corporation, 190 Carondelet Plaza, Suite 1530, Clayton, MO 63105, United States of America will process your personal data as joint controller. Olin will be responsible for any requests in relation to the data processing and will provide you with the relevant information in this regard. However, you may exercise your rights described at the end of this Information also towards Olin.

Data Protection Representative. Since Olin as a company is not residing in the EU, Olin has appointed Blue Cube Germany Productions GmbH & Co. KG, located at Buetzflether Sand 2, 21683 Stade, Germany, as its EU representative for data protection according to Art. 27 of the General Data Protection Regulation (“GDPR”). The same applies for those Olin subsidiaries that are located outside of the EU.

Data Protection Officer. Olin has appointed Megan Rosenberg, dpo@olin.com or +1.314.355.8285 as the Olin Global Data Protection Officer.

Purpose of use and legal basis for processing the data

Your personal data may be processed for the purpose of

• execution and administration of the contractual relationship with you and/or your company, in particular administration of procurement, contracting and deliveries, accounting, billing, and payment processing;
• granting you access to our facilities by issuing entry cards or by other means, if applicable;
• granting you access to our onsite infrastructure, such as machinery and laboratories, which entails processing of your access information and/or documentation of your data by Olin’s systems, and may include processing your personal data for work place safety reasons, such as incident reporting for future prevention, if applicable;
• granting you access to our IT infrastructure, if applicable, which also entails any services provided to you with regard to software, hardware and/or file management support through our help desks, IT services, and/or competent departments;
• administration of supplier relationships, i.e. enhancing the relationship through marketing activities, including but not limited to sending of product information and event invitations;
• listing you in our supplier databases, if applicable;
• audits, which may require that Olin processes your personal data for background checks, corporate compliance, regulatory and/or export compliance, which entails the fulfillment of legal tasks including investigating and responding to claims against the company and its customers and employees, handling complaints, internal audits, third party audits, including anticorruption screening, if applicable, as well as third party due diligence.

Legal Basis for Processing. Your personal data is processed in accordance with Art. 6 par. 1 b) GDPR for the performance of the contractual relationship. To the extent we are required to process your personal data in order to comply with a legal obligation, we are processing your personal data on basis of Art. 6 par. 1 c) GDPR, or in cases where we transfer your personal data to another group company or to other recipients for the purposes of the legitimate interests pursued by us or by a third party, we will do so on the legal basis of and in accordance with Art. 6 par. 1 f) GDPR. In exceptional cases, to the extent the processing of your personal data is not strictly required to execute the contractual relationship with you, we may ask you for your consent to process your personal data according to Art. 6 par. 1 a) GDPR.

Source of data. We have received your personal data mainly because you provided it to us or we have been collecting it or supplemented the data during the course of the contractual relationship with our supplier for whom you are acting as an employee, sales representative or in a comparable function. We may also receive personal data from industry associations, business networks or publically available sources, such as the Internet.

Recipients. Your personal data will only be accessible for employees of Olin and its subsidiaries, including external representatives that Olin engages, who are responsible for sales, customer service, technical service and development, research and development, legal, product marketing, strategic business lead and customer database administration. In addition, employees of Olin, who are responsible for providing and maintaining our IT infrastructure, and external IT service providers, who are engaged to assist with hosting, software services or any kind of IT services, may have access to your personal data.

Transfer. Olin will transfer your personal data to Olin in the US and other countries outside of the European Union where Olin’s subsidiaries or external service providers are located. The transfer is based on the EU Standard Contractual Clauses or in case a service provider is certified under the EU-U.S. Privacy Shield on data processing agreements, or on a service providers approved binding corporate rules. You may request a copy of the EU Standard Contractual Clauses, the data processing agreements or the binding corporate rules by contacting Olin’s Global Data Protection Officer.

Categories of data. We may process the following categories of personal data:

• First name, middle name, last name;
• Employing company, position, job title;
• Business contact details including mobile phone number;
• Personal contact details, including your home address, mobile phone number, and email address;
• Work location, previous positions, career history, background check information;
• Time keeping information, attendance records, pictures;
• Work place safety incidents;
• Professional expertise;
• Bank account number.

Data Retention. Olin will retain your personal data for the time of the contractual relationship and an additional period after in order to comply with statutory storage periods. You may also contact Olin’s Global Data Protection Officer in this regard.

Your rights. You may contact us either in writing or by e-mail to dpo@olin.com to exercise the following rights:

• Access your data to check and review them;
• Have a copy of your personal data;
• Demand that we supplement, correct or delete your personal data; or cease or restrict the collection, processing, use or disclosure of your personal data; the right of rectification will comprise the right to have incomplete personal data completed, including by means of providing a supplementary statement;
• Object to the processing of your personal data;
• Receive your personal data in a structured, commonly used and machine-readable format and have it transmitted to another controller provided that the processing is based on your respective consent or to execute a contractual relationship or a relationship prior to entering into contract with you.

You have the right to lodge a complaint with a supervisory authority in relation to the processing of your personal data.

Statutory/contractual requirement. You may choose not to provide your personal data or provide incomplete personal data. However, you should be aware that we may not be able to engage in or continue a contractual relationship with you or your employer or provide information to you or your employer since your personal data is required for our administrative purposes or to fulfill statutory requirements.

Automated decision-making and profiling. Your personal data will not be used for automated-decision making. Olin is creating profiles in order to analyze details of the (pre-)contractual relationship.

Intention of processing for other purposes. Please note that we may use your personal data for other purposes than it was collected for. In case we decide to start such use, we will provide you with the relevant information on that purpose and other relevant information.