Enterprise Risk Management and Compliance Helpline Privacy Notice

Last Updated: 24 August 2023

Thank you for visiting the Wood Mackenzie Enterprise Risk Management and Compliance Helpline.

Wood Mackenzie is committed to maintaining an ethical work environment and encouraging you to speak up through a dedicated helpline. Wood Mackenzie respects your concerns about data privacy.

This Privacy Notice (“Notice”) describes how Wood Mackenzie collects and uses personal data submitted under Enterprise Risk Management and Compliance Helpline (“Helpline”, ‘Speak Up Report”). This notice applies to personal data that we collect for the purposes of administering the speak up program and investigating / responding to reports.

We will update this Notice from time to time. When we make changes, we will publish the updated Notice on the WoodMackenzie.com and Helpline website. If we make any significant changes, we will (subject to applicable law, choice of anonymity), inform you of this.

Introduction – Who are We?

Wood Mackenzie is a global insight business for renewables, energy and natural resources. To learn more about Wood Mackenzie, see ‘About us’

For the purposes of this notice, ‘Wood Mackenzie’ (“we”, “us”, "our") refers to the subsidiaries and affiliates, of Wood Mackenzie. For more details of our locations view, Our Locations | Global energy research | Wood Mackenzie

Wood Mackenzie is the data controller of personal data processed via the Helpline and relating to Speak Up Reports.

Wood Mackenzie publishes its privacy notices, classified according to the nature of your relationship with Wood Mackenzie, and designed to help you understand how we process personal data outside of the context of a Speak Up Report. You can view our notices at: Privacy Policy Centre | Wood Mackenzie | Wood Mackenzie. If you are an employee, the employee notice is available on the People Portal (or via privacy@woodmac.com).

What data do we collect and where do we collect the data from?

Wood Mackenzie will collect, use and store your personal data based on the type of report and information that you chose to share as part of your Speak Up Report submission, and as you communicate with us relating to the report.

The table below sets out the types of data and where we collect personal data from depending upon the type of report that you submit.

As part of the reporting process, we will ask you to describe the issue and involved parties (if known), location and date of the issue.

- We may also collect data about the allegation from:

• Other employees and contractors of Wood Mackenzie
• Management
• Suppliers
• Clients
• Accountants / auditors
• Forensic experts

We may also contact you to inquire as to whether you have experienced retaliation. If you respond, will collect your response (yes/no/help me decide), and any comments that you choose to share with us.

How do we use Data?

Wood Mackenzie will use your data for the purposes of investigating and responding to your report, and taking remedial action where applicable.

Subject to applicable law, if you choose not to provide personal data requested by us, we will still take your report seriously, and investigate your report, however, the information may help us better investigate the concerns.  

Under some circumstances, we may anonymise personal data so that it can no longer be associated with you. We reserve the right to use such anonymous and de-identified data for any legitimate business purpose (for example, statistical analysis) without further notice to you, or your consent.

Special categories of data?

According to the nature of your report, you may decide to provide Wood Mackenzie with sensitive data. Sensitive data includes data relating to health, religious beliefs/ethnic origin, religious or philosophical beliefs, trade union membership, data relating to sex life or sexual orientation. In some countries, other types of data may be classified as sensitive. We recommend you share only the minimum amount of sensitive information needed to enable us to investigate and respond to your report. To the extent that we receive sensitive personal data as part of the report, we will only process it in accordance with applicable law and this Notice, and where applicable, the applicable notice on the Privacy Policy Centre / People Portal.

Information We Share

Wood Mackenzie uses Convercent by OneTrust (a third-party service provider located in the UK) who provides the IT software report channel, and who will securely process personal data on behalf of Wood Mackenzie.

In instances where (subject to applicable law), you have chosen to remain anonymous towards Wood Mackenzie, we may ask Convercent to contact you to help us gather additional information about the report.

To the extent that it is necessary for the processing purpose, Wood Mackenzie may also share personal data with:

• Other members of our group of companies, as necessary for the purposes set out in this Notice
• Our legal advisors to assist us in the investigation, management and response to reports (if applicable)
• Relevant authorities / regulators (if applicable)
• If a business transfer or change in ownership occurs and the disclosure is necessary to complete the transaction. In these circumstances, we will limit data sharing to what is absolutely necessary, and we will anonymize the data where possible.

We may also disclose your identity when required to comply with a valid legal process such as a Court or Administrative Order, or Subpoena. Where possible and subject to applicable law, we will notify you of our intention to disclose identification to other parties.

Confidentiality

We recognise that the information you provide may be confidential. Wood Mackenzie does not sell, rent, or otherwise make available, personal data to any third-party except as described in this notice. Wood Mackenzie will maintain confidentiality and protect your personal data in accordance with applicable laws and this Notice, including the section titled ‘information we share’.  

Confidentiality / Anonymity – Understanding the difference

We would like to help you feel comfortable making a report to us. Here we explain the difference between confidentiality and anonymity to help you make an informed decision around how you wish to file your report.

• Confidentiality means that we will to the extent legally permissible, keep your name and personal information private. There may be occasions where we need to share your data as described in the section titled ‘information we share’.
• Anonymity means that your identity is not known to us. Please refer to the section titled ‘What data do we collect and where do we collect the data from’ for an explanation as to how this works.

Non-Retaliation Policy

Wood Mackenzie will not tolerate any retaliation against an individual for raising a concern in good faith, making a report or assisting in an investigation.

We will contact you to check in, to understand whether you have experienced retaliation.

Cookies

Wood Mackezie only uses one session-length cookie on the Hotline website. You can view information about cookies by clicking the cookie settlings (cookie icon) at the bottom of the Helpline website .

This cookie is used to ensure that the data entered is held for the process. Once the report is submitted and the browser is closed, the cookie deletes, and no cookie data is stored or transferred.

Without the use of this necessary cookie, the hotline would not be able to function.  

Data Transfers

We may transfer the personal data that we collect about you to recipients in countries other than the country in which the personal data originally was collected, as outlined under ‘Information we share’. Those countries may not have the same data protection laws as the country in which you initially provided the personal data. When we transfer your personal data to recipients in other countries (such as the U.S.), we will protect that personal data as described in this Notice. 

If you are located in the UK, European Economic Area (“EEA”) or Switzerland, we will comply with applicable legal requirements providing adequate protection for the transfer of personal data to recipients in countries outside of the UK, EEA and Switzerland.  In all such cases, we will only transfer your personal data if: 

• The country to which the personal data will be transferred has been granted a European Commission adequacy decision; or UK adequacy decision (as applicable);
• We have put in place appropriate safeguards in respect of the transfer, for example the EU Model Contracts.

You may request a copy of the safeguards that we have put in place in respect of transfers of personal data by contacting us as described in the ‘How To Contact Us’ section below. 

Protection of your data

We maintain appropriate technical and organizational measures designed to protect your personal data against loss or accidental, unlawful or unauthorized, alteration, access, disclosure or use.

How Long we Keep Information / Data Retention

We process personal data for as long as necessary to respond to the report, and for as long as needed for the establishment, exercise, or defence of legal claims. We will then delete the data unless we are legally required to retain it or if we need to retain it in order to comply with our legal obligations.

Your Rights and Choices

Please note that your rights described may be subject to certain limitations. Wood Mackenzie may not be required to fulfil all requests in all circumstances. For example, we may not be able to delete all data as we may have a legal requirement to retain such data, or to retain such data in an identifiable form.  

Wood Mackenzie does not make decisions relating to hotline reports/investigations/ based solely on automated data processing.

If you are located in the UK. European Economic Area (“EEA”), or Switzerland, you may have the following rights in relation to personal data that we hold about you: 

• Confirmation and Access: To request confirmation of whether we process personal data relating to you, and if so, to request a copy of that personal data; 
• Correction and update: To request that we rectify or update your personal data that is inaccurate, incomplete or outdated;
• Deletion: To request that we erase your personal data in certain circumstances, such as unnecessary or excessive data, where we collected personal data on the basis of your consent and you withdraw your consent; 
• Restriction: To request that we restrict the use of your personal data in certain circumstances, such as while we consider another request that you have submitted, for example a request that we update your personal data; 
• Withdraw Consent: Where you have given us consent to process your personal data, to withdraw your consent; and 
• Portability: To request the right to portability. You can request that we provide a copy of your personal data to you or third parties designated by you in a structured, commonly used and machine-readable format in certain circumstances. 

You may contact us by e-mail or as described in the “How to Contact Us” section below to exercise your rights described above. 

You also have the right to lodge a complaint with the data protection supervisory authority in your country.  You can find the contact information of the data protection supervisory authority in your country here. 

Brazil 

If you are located in Brazil, you have the following rights in relation to personal data that we hold about you:  

• Confirmation and Access: To request confirmation of whether we process personal data relating to you, and if so, to request a copy of that personal data; 
• Correction: To request that we correct incomplete, inaccurate, or out of date personal data;
• Anonymisation or blocking: To request anonymisation or blocking of personal data that is not necessary, excessive, or not processed in accordance with applicable laws; 
• Deletion: To request that we erase your personal data such as unnecessary or excessive data, or where we collected personal data on the basis of consent and you withdraw your consent; 
• Revoke consent: Where you have given us consent to process your personal data, to withdraw your consent; 
• Information regarding Consent: Where processing of personal data is based on consent, to receive information about the possibility of denying consent and the consequences of such denial; 
• Portability: To request the right to data portability. You can request that we provide a copy of your personal data to you or third parties designated by you in a structured, commonly used and machine-readable format in certain circumstances;
• You will not be subject to decisions based solely on automated data processing without your prior informed consent. Where you have provided consent, you have the right to request review of automated decisions that affect your interests; 
• Information about recipients. You have the right to request information about the entities with whom we share your personal data.;
• Informed: To be informed of which public and private entities your personal data is or was shared with. 

You have the right to lodge a complaint with the Data Protection Authority regarding the processing of your personal data; ANPD — Autoridade Nacional de Proteção de Dados (www.gov.br) 

How to Contact Us

By e-mail: Privacy@woodmac.com

Certain Wood Mackenzie affiliates and subsidiaries have a Data Protection Officer. If your personal data was provided to or collected by Vesseltracker, contact with Vesseltracker’s Data Protection Officer can be initiated via info@vesseltracker.com.

How to Complain 

 If you have any concerns about the use of your personal information, you can make a complaint to us at privacy@woodmac.com 

• If you are located in the UK, the data protection regulator is the ICO. The ICO’s address is: 

Information Commissioner’s Office 
Wycliffe House 
Water Lane 
Wilmslow 
Cheshire 
SK9 5AF 

ICO website: https://www.ico.org.uk 

• If you are located in the EU, a list of data protection authorities is available from the European Data Protection Board here: Our Members | European Data Protection Board (europa.eu)
• If you are located in Brazil, please contact: 

By Email: Privacy@woodmac.com 

FAO: Data Privacy  
Wood Mackenzie 
Av. Alm. Barroso, 52 – Centro 
Rio de Janeiro - RJ 
20031-000 
Brazil