Global Privacy Policy
1. Overview and Objectives
The protection of personal data, as well as compliance with privacy and data protection laws and regulations, is important to our organization and its affiliates (“we”, “us”, the “Company”). We do take it seriously and we aim to ensure the privacy rights of our employees, business contacts and customers when we handle information about them.
This Global Privacy Policy (this “Policy”) establishes a comprehensive governance framework for managing privacy and data protection risks. Specifically, Exhibit A and B of this Policy address certain requirements under Colombian and Mexican law, respectively, as provided in such Exhibits.
This Policy, together with any Exhibits, and supporting documents lay out processes and tools that deliver a consistent approach to privacy risk management across the organization. The protection of personal data of employees, business contacts and customers is fundamental to preserving employee, business partner and customer trust.
In particular, this Policy:
- sets out the data protection principles that underpin our global privacy framework;
- identifies and explains the data protection roles and responsibilities;
- establishes the Privacy Program;
- identifies the internal policies, procedures and standards which support this Policy and, together with this Policy, constitute our organization's privacy framework; and
- sets out a (non-exhaustive) list of the requirements that employees, contractors, consultants and anyone providing support or service to us must comply with in order to preserve the confidentiality and security of the personal data they handle.
This Policy does not provide an exhaustive list of permitted or prohibited conduct or set forth every rule. This Policy is not a substitute for the responsibility to exercise good business judgment and proper care. Individuals should continue to seek proper advice through appropriate channels in relation to any specific concerns and issues that are not specifically addressed in this Policy.
2. Scope and Enforcement
This Policy applies to all directors, managers, employees, contractors, consultants and anyone else supporting or servicing within our organization with respect to all our operations around the world which involve theprocessing of personal data.
It is the responsibility of every director, manager, employee, contractor, consultant and any anyone else supporting or servicing our organization to comply with this Policy. Acknowledgment and understanding of this Policy is required through contracts and mandatory training. Failure to comply with this Policy may be a breach of the terms of employment and may lead to disciplinary actions up to and including termination of employment or services contracts.
Senior management is ultimately responsible for ensuring adherence to this Policy. The Legal department in coordination with Internal Audit is responsible for monitoring compliance with this Policy.
Definitions
3. Data Protection Principles
Our organization's business operations must, always, be consistent with the Data Protection Principles set out below. These principles are binding across all our businesses.
- Lawful, fair, and transparent processing
Our organization only uses personal data in a way that is lawful, fair, and transparent.
We comply with data protection and privacy laws within each of the jurisdictions in which we operate. Where required by the law, we are also committed to helping individuals understand what information we collect, how we use it and what choices they have. We explain this to employees, contractors, consultants and other workers, consumers and business contacts in a simple and clear way in our privacy statements. We review our privacy statements regularly to keep them up to date, and to ensure they match our internal practices. - Purpose limitation
We only collect personal data for specified, clear and legitimate purposes and we only collect as much personal data as we need to achieve those purposes. Though personal data helps us improve the services we provide, we only use it in ways which are proportionate to clear goals. - Data accuracy
We take steps to ensure that the personal data we hold is accurate, up-to-date and relevant to the purposes for which it is collected. - Data retention
We only keep personal data in an identifiable form for as long as is necessary for the purposes for which we are using it. - Rights of the individuals
We are fully committed to facilitate the privacy rights of individuals with respect to our processing of their personal data, in accordance with applicable laws. - Information security
We use appropriate physical, technical and organizational measures to keep personal data secure and ensure its integrity, confidentiality and availability across all systems at all times.
We are also committed to ensure that our vendors and suppliers which may process personal data on our behalf preserve the confidentiality, integrity and availability of such data. - International transfers of personal data
Our organization is a global business and as such we have to transfer information internationally. We are fully committed to ensure that there are adequate safeguards in place, as required by the applicable laws, to protect the personal data we transfer to countries that do not have adequate data protection laws. - Accountability
We are all responsible for upholding the Data Protection Principles and respecting individual privacy rights. We have a collective and individual duty to protect the personal data of our employees, contractors, consultants and other workers, consumers and business partners. In order to create an environment of trust and to comply with applicable data protection laws, all individuals operating within or on behalf of our organization must comply with our privacy policies and help the organization to uphold its commitments to the protection of personal data.
4. Roles and Responsibilities
Different stakeholders at different corporate levels within our organization play a role in ensuring overall privacy risk management and data protection compliance. The following offices and employees have been identified as having specific roles and responsibilities:
- The Legal department is responsible for promoting and ensuring privacy compliance, overseeing the overall privacy management and compliance program, responding to data subject queries and requests, responding to regulatory requests about data protection, liaising with the IT department where required to ensure information security which is a core part of personal data protection.
- The IT department is responsible for safeguarding and monitoring our internal networks and systems and, in particular, ensuring that personal data stored, transferred, accessed and used across these networks and systems is adequately protected from data breaches. The IT department is also responsible for participating to some important data protection activities such as Data Protection Impact Assessment ("DPIA").
- The HR department is responsible for handling the personal data properly of employees, contractors, consultants and anyone else providing services and supports and in compliance with the applicable laws. The HR department is also responsible for addressing requests from employees, contractors, consultants and other workers for the exercise of their data protection rights and escalating any further query or complaint to the Legal department. The HR department should also inform the Legal department regarding new processing activities which impact on the personal data of employees, contractors, consultants and other workers. The HR department should be engaged in performing DPIAs of new HR processing activities, updating privacy notices to employees, contractors, consultants and other workers and making them aware of their duties and responsibilities regarding personal data protection (including this Policy).
In addition, any business function which processes personal data is responsible for:
- managing the privacy risk related to the processing carried out by the function;
- consulting the Legal department when required by the internal policies and procedures;
- ensuring the security of the personal data it processes; and
- handling and escalating any privacy incidents as required.
All directors, managers, employees, contractors, consultants and workers are responsible for preserving the confidentiality of the personal data they use and for handling this information securely and in accordance with this Policy and any other supporting policies, procedures and standards (as identified below at "Policy Framework").
5. Privacy Program
Our Legal department will supervise our Privacy Program, which provides a comprehensive, coordinated approach to managing privacy risk while serving business needs and strategies. Our Privacy Program comprises, at a minimum, the following components:
- Policy framework
- Legal compliance
- One-stop-shop
- Documentation of data protection compliance (decisions, implementation and audit)
- Records of processing activities
- Data protection impact assessment
- Vendor privacy risk management
- Data protection training
- Data breach management
- Data subject rights
- Policy framework
Our organization must operate at all times in compliance with this Policy, the Code of Conduct and Business Ethics and all internal policies, procedures and standards relating to privacy such as the Acceptable Use Information Technology Policy, the Data Classification and Handling Policy, the Incident Response Policy and privacy notices to staff, online users and other individuals. Please note that these may, from time to time, be updated or replaced and the scope of the list below may be expanded to additional policies. - Legal compliance
The Legal department will at all times maintain processes that enable our organization to understand and comply with legal requirements in data protection such as providing privacy notices to data subjects and obtaining their consent to data processing where necessary. The Legal department will ensure that privacy laws are addressed consistently across the region where such laws apply. - One-stop-shop
The Legal department, jointly with senior management, will determine where our main establishment might be located based on our data processing activities to identify the lead supervisory authority within the European Union for cross-border processing. The decision should be documented. The Legal department will monitor the lead supervisory authority closely for guidance and other output issued and understand the enforcement priorities. - Documentation of data protection compliance (decisions, implementation and audit)
The Legal department, supported by the business functions concerned, will create and maintain records of the decisions and actions taken towards privacy risk management and compliance with data protection laws. This will also enable effective collaboration with the regulators as and when required and it will enable our organization to document and demonstrate its privacy compliance at all times.
Where privacy related decisions and actions are taken at regional or business level, the relevant policies and procedures will establish ownership of and responsibility for maintaining appropriate records.
The Legal department will also be responsible for ensuring and supervising the development of any additional records which may be required to demonstrate compliance under applicable data protection laws (e.g. consent forms, notices to data subjects, register of personal data breaches). - Records of processing activities
The Legal department will gather in a living document the list of all processing activities within our organization at a given time; this document will be updated from time to time to reflect changes in business operations. The IT department, the HR department and any other business functions involved in the processing of personal data should contribute to the record of processing activities (providing relevant information such as about the purposes of use of data and data transfers). - Data protection impact assessments
The Legal department will establish guidelines and procedures to perform DPIAs with respect to new products, technologies and business operations, where required by applicable laws or where this appears appropriate to manage privacy risk. The DPIAs will require the input and involvement of the relevant business functions. - Vendor privacy risk management
Risk management for engaging third party vendors that process personal data on our behalf ("data processors") is crucial to ensure our data protection compliance. The Legal department will provide guidelines and any privacy content necessary for third party risk assessment, keeping it up-to-date as necessary to address emerging privacy risks. Risks associated with a third party must be escalated to the Legal department.
In particular, the Legal department will ensure that:- any data processor is subject to adequate due diligence on its information security measures before being selected as a business partner;
- an appropriate processing agreement is in place with any data processor which imposes data protection obligations on the data processor; and
- data processor compliance with the processing agreement and the applicable law is monitored from time to time.
- Data protection training
Data protection training will be a part of the annual compliance training plan and mandatory for relevant staff upon joining the firm and on a regular basis thereafter. The Legal department will ensure that training content remains up to date and appropriate to our organization’s business operations, and that it is refreshed on a regular basis. Training completion rates will be monitored and documented (e.g. training log). - Data breach management
All business functions are responsible for monitoring business operations for incidents concerning the security of personal data, capturing them on a timely and consistent basis, and executing appropriate risk mitigation strategies.
All employees and business functions are responsible for immediately escalating any actual or suspected data breaches according to our Incident Response Policy. Any relevant office and/or business function is required to take part in breach management according to such policy.
The Legal department is jointly with the IT department will ensure that known incidents and risk events are identified, evaluated and remediated appropriately, and will evaluate trends so that root causes can be addressed. The Legal department will also handle breach notifications to the competent regulator or data subjects as and when required by the applicable laws. - Data subject rights
The Legal department will provide guidelines and assistance to the HR department and any other office to address any data subject right request (e.g. an individual's request to access personal data held by us in accordance with the applicable law), as well as to inform any data subject of their rights under the applicable law, which includes the right to lodge a complaint before the relevant data privacy government regulator(s) should the Company violate any applicable data privacy law in the processing of a data subject’s personal and sensitive personal data.
- Policy framework
6. What Employees, Contractors, Consultants and Workers Must Do
Apply the Data Protection Principles to the collection and use of personal data and follow the policies, procedures and standards regarding privacy.
In particular, compliance with the following policies is required:
- Acceptable Use and Information Technology Policy
- Confidential Data Policy
- Data Classification and Handling Policy
- Email Policy
- Encryption Policy
- Password Policy
- Remote Access Policy
- Third Party Software Policy
- Data Retention Policy
You are also expected to complete all required data protection training.
Non-compliance with the terms of this Policy may result in disciplinary action up to and including termination of employment or business relationship, as well as legal action
7. Reporting and Questions
ICU Medical personnel may report any concerns through an anonymous and confidential hotline at 1-844-330-0007. Anonymous and confidential reports can also be made by email to reports@lighthouse-services.com (must include Company name in the report), through confidential web submission at http://www.lighthouse-sercies.com/icumed, or via the Governance Reporting section in our corporate governance website at https://ir.icumed.com/governance.cfm. A Company Representative may also make confidential reports to his/her supervisor, HR, the Compliance Officer, or the General Counsel.
8. Amendments to the Policy
The Legal department will review this Policy no less than once every year and recommend appropriate changes.
We will draw your attention to any changes where appropriate or required
9. Exceptions and Escalations
Any exceptions to this Policy must be reviewed and approved by the Legal department. All exceptions to this Policy must be approved in writing before implementation.
The Legal department is responsible for resolving questions about the appropriate interpretation of this Policy in light of legal and regulatory requirements. The Legal department is responsible for addressing questions about interpreting this Policy.
Exhibit A
Global Privacy Policy – Exhibit for Colombia
ICU MEDICAL COLOMBIA LIMITADA ("ICU COLOMBIA"), domiciled in Colombia, is an affiliate of ICU MEDICAL, INC (the "Company") based in the United States.
This Exhibit is intended to complement the Company’s Global Privacy Policy ("GPP") in order to include certainelements that are only applicable to the extent that Colombian Data Protection Law applies. Colombian Data Protection Law applies only to the processing in Colombia of personal data and the processing of personal data of Data Subjects based in Colombia abroad, under certain circumstances.
Terms used herein shall have the meaning ascribed in the GPP unless otherwise defined herein.
Exhibit B
Global Privacy Policy – Exhibit for Mexico
To the extent Mexican data protection laws or regulations apply, the following additional Mexico- specific basic elements and provisions apply and shall prevail over conflicting provisions in the existing Global Privacy Policy.