Data Privacy Code of Conduct

1.1 ExxonMobil is committed to protecting Personal Data, including:

i. lawfully Processing Personal Data entrusted to it, and
ii. consistent with business needs, appropriately managing privacy risks associated with Processing Personal Data.

1.2 ExxonMobil and its employees must comply with the Code when Processing Personal Data.

1.3 ExxonMobil oversees compliance with this Code and with the programs, tools and procedures implementing the Code through a global data protection governance body.

1.4 The Affiliate ExxonMobil Petroleum & Chemical BV, with registered office at Polderdijkweg, 2030 Antwerp, Belgium participates in ExxonMobil’s global data protection governance and has a lead role with regard to the protection of European Personal Data. Details of this role and specific rights in relation to European Personal Data are described in Section 19.

1.5 The Code is ExxonMobil’s Binding Corporate Rules under European Data Protection Laws.

2.1 ExxonMobil will apply the Code in every country where it Processes Personal Data.

2.2 The Code will apply to Personal Data of Individuals. Individuals include current and past employees, job applicants, contractors, representatives of customers and other business partners, and consumers.

2.3 The Code does not apply to Anonymized Information or other information which is not Personal Data.

2.4 ExxonMobil Processes Personal Data for business purposes, which include:

i. personnel administration and human resource operations, such as an Individual’s payroll and career development

ii. verification of an Individual’s compliance with company policies,

iii. physical security and access of an Individual to buildings and premises,

iv. information technology management related to an Individual’s use of company systems,

v. relationship management with our customers and other business partners, which includes Processing of contact details and transactional data to allow for order-taking, delivery, invoicing and business development,

vi. communicating with government agencies to satisfy regulatory requirements,

vii. communicating with external stakeholders on matters related to ExxonMobil’s business activities

3.1 Personal Data will be Processed in a lawful manner. 

3.2 This Code sets a minimum standard of data privacy protection. Where applicable law requires a higher level of protection for Personal Data than the level of protection set out in the Code, ExxonMobil will apply such higher level of protection.  For example, when Processing is permitted only on the basis of one or more grounds specified by law, ExxonMobil will meet such requirements.

3.3 Where ExxonMobil has reason to believe that a law prevents it from complying with the Code, ExxonMobil will take a responsible decision on what action to take in consultation with the ExxonMobil Data Privacy Office and consult with a competent data protection authority if ExxonMobil deems necessary. 

5.1 ExxonMobil commits to Process Personal Data that is relevant to a legitimate business purpose. 

5.2 Personal Data will be kept only as long as necessary to meet the purposes for which it is Processed or, if longer, for compliance with applicable law or to protect legitimate company interests.  

5.3 Where required by applicable law, ExxonMobil will take measures to minimize Processing of Personal Data, including by privacy by design.

8.1 Based on an assessment of the risks involved, ExxonMobil will apply appropriate technical and organizational measures to protect Personal Data from accidental or unlawful loss, misuse and unauthorized access, disclosure, alteration and destruction.

8.2 In the event of a Personal Data breach, ExxonMobil will (i.) consult with the ExxonMobil Data Privacy Office which keeps a record of Personal Data breaches, and (ii.) inform Individuals about the breach in accordance with applicable law.

9.1 Where required by applicable law, ExxonMobil will respond to requests of Individuals: (i.) to know whether and which categories of Personal Data relating to them ExxonMobil is Processing, (ii.) to receive a copy of their Personal Data, (iii.) to delete, restrict, erase, or discontinue Processing of the requesting Individual’s Personal Data, and (iv.) for Data Portability.

9.2 Individuals can request ExxonMobil to rectify inaccurate Personal Data related to them, in accordance with Section 6.

9.3 In order to exercise these rights or to raise a concern or complaint that ExxonMobil is not complying with the Code, Individuals can contact the ExxonMobil Data Privacy Office to obtain more information on the procedure it will apply in order to handle the complaint:

By email to: data.privacy.office@exxonmobil.com
Or in writing to: Data Privacy Office, c/o ExxonMobil Hungary Limited Liability Company, Registered seat: H-1134 Budapest, Dózsa György út 61-63, Budapest, H-1134, Hungary

Whenever ExxonMobil transfers Personal Data between Affiliates, ExxonMobil will treat and protect the Personal Data in accordance with this Code. 

Furthermore, Affiliates that Process Personal Data on behalf of other Affiliates, will comply with any relevant inter-Affiliate agreements which include obligations in relation to their Processing of Personal Data.

13.1 ExxonMobil applies programs for regularly verifying its implementation of and compliance with the Code.

13.2 The compliance verification programs include 

i. an audit program which includes regular audits by the internal audit department and follow-up of any needed corrective measures, and oversight of the audit program and audit results by the ExxonMobil Board of Directors 

ii. a data privacy organization consisting of:

1. a network of designated privacy contacts, 

2. the ExxonMobil Data Privacy Office which performs risk-based privacy impact assessments, and is responsible for the tasks assigned to it in Sections 3.3, 8.2, 9.3, 17, 19.2.ix, 19.3 and 19.4.i of the Code.

3. a global data protection governance body made up of senior ExxonMobil managers which owns and oversees compliance with the Code, and which oversees the activities of the ExxonMobil Data Privacy Office.

14.1 ExxonMobil will cooperate with and carefully consider the advice of competent data protection authorities in relation to requests about the application of this Code. 

14.2 ExxonMobil will comply with formal and lawful decisions of competent data protection authorities that are final and not subject to further appeal. 

14.3 When Personal Data is transferred among Affiliates, they shall cooperate and assist each other, where necessary, to respond to requests from competent data protection authorities.

15.1 The Code may be modified by ExxonMobil as necessary, for example to ensure compliance with changes in applicable law or to reflect changes in internal organization and processes.

15.2 ExxonMobil will communicate changes to the Code to the Belgium Data Protection Authority as follows:

• Material Changes to the Code and Intragroup Agreement will be communicated without unreasonable delay; and 
• on an annual basis, ExxonMobil will communicate changes to the list of Affiliates bound by the Code, and non-Material Changes to the Code and Intragroup Agreement that concern European Personal Data. 

15.3 ExxonMobil will make the Code, and the modifications to the Code, available:

• Externally, at: https://corporate.exxonmobil.com/Global-legal-pages/Our-privacy-policies/ 
• Upon request of the Individual, in accordance with subsection 9.3 
• Internally, on the ExxonMobil intranet

“Affiliate” means any company or partnership that has adopted the Code, in which Exxon Mobil Corporation or any parent of Exxon Mobil Corporation now or hereafter, directly or indirectly, owns or controls more than 50 percent of the ownership interest having the right to vote or appoint its directors or functional equivalents, and any successor in interest to such company or partnership. 

“Anonymized Information” means information which has been rendered anonymous. 

“Data Portability” means the right to obtain the Personal Data in a format ready to transmit to a third party in accordance with applicable law.

“EEA” means the European Economic Area, established under the EEA agreement of January 1, 1994, which provides for the free movement of persons, goods, services, and capital within the European Single Market.

“European Data Protection Laws” means the Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (EU General Data Protection Regulation) (as implemented in national law of EEA member states and UK, and as amended from time to time), or the Swiss Federal Act on Data Protection. 

“European Personal Data” means Personal Data which is or has been subject to European Data Protection Laws.

“European Region” means countries in the European Economic Area (EEA), UK and Switzerland. 

“Individual” means any identified or identifiable natural person whose information is Processed by or on behalf of ExxonMobil; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; Individuals include current and past employees, job applicants, contractors, representatives of customers and other business partners, and consumers.

“Intragroup Agreement” means the ExxonMobil inter-Affiliate agreement by which the Affiliates adopt the Code.

“Material Changes” means amendments to the Code which have an adverse impact on the standard of data protection for European Personal Data provided under the Code, or which significantly affect the scope or the structure of the Code with respect to European Personal Data.

“Personal Data” means data relating to an Individual.

“Process”, “Processed”, “Processes”, “Processing” means performing of any operation on Personal Data, whether or not by automated means, such as accessing, collecting, storing, recording, organizing, altering, disseminating, disclosing, transferring, retrieving, destroying or otherwise using Personal Data. 

“Trusted Source” means a person or entity that is authorized to represent the Individual, or a person or entity that, in ExxonMobil’s determination, has apparent authority to represent the Individual.

19.1 With regard to European Personal Data, ExxonMobil is accountable for and will comply with all the commitments undertaken in the Code, and where stricter European Data Protection Laws impose a higher level of protection, ExxonMobil will apply such higher level of protection.

19.2 In the event that European Personal Data is transferred to Affiliates outside of the European Region, ExxonMobil will afford a level of protection to European Personal Data which does not undermine the level of protection granted under European Data Protection Laws. ExxonMobil will do so, even if such protection is not afforded by the applicable law in the countries of the Affiliates outside of the European Region where the European Personal Data is received.

This means in particular in relation to the data privacy practices described in Sections 3, 4, 5, 7, 8, 9 and 11 respectively, that ExxonMobil will:

i. not Process European Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, sex life, sexual orientation, genetic data, or biometric data for the purpose of uniquely identifying an Individual, unless such Processing is permitted in accordance with Article 9.2 of the EU General Data Protection Regulation,

ii. carry out an assessment of the impact of high risk Processing operations, in accordance with Article 35 of the EU General Data Protection Regulation, and if risks remain high after implementing mitigating measures identified by the assessment, consult with the competent data protection authority, in accordance with Article 36 of the EU General Data Protection Regulation,

iii. Process European Personal Data for specific and legitimate business purposes, 

iv. Process European Personal Data which is adequate, relevant and limited to what is necessary in relation to the legitimate business purposes, 

v. apply privacy by design and privacy by default as appropriate, 

vi. keep a register of Processing activities, 

vii. give notice and transparency to Individuals about the use and purpose of the Processing of European Personal Data in accordance with Articles 13 and 14 of the EU General Data Protection Regulation, 

viii. apply the same level of security measures to protect European Personal Data as provided in European Data Protection Laws, 

ix. in the event of a breach of European Personal Data:

1. consult with the ExxonMobil Data Privacy Office, which will document the breach in a register and make the relevant documentation available to the competent data protection authority upon request, and 

2. notify without undue delay ExxonMobil Petroleum & Chemical BV who, if the breach is likely to result in a risk to the Individual’s rights and freedoms, will in turn notify the competent data protection authority without undue delay and, where feasible, not later than 72 hours after having become aware of the breach, and

3. inform Individuals without undue delay if the breach is likely to result in a high risk to the Individual’s rights and freedoms, 

x. respond to requests and complaints of Individuals in relation to the Processing of European Personal Data in accordance with Section 19.7, 

xi. allow Individuals to object to a decision based solely on automated Processing which produces legal effects concerning the Individual or similarly significantly affects the Individual, unless the decision is permitted under Article 22 of the EU General Data Protection Regulation, and 

xii. transfer European Personal Data to third parties outside of the European Region when adequate protection is provided in accordance with Article 28.3 and Articles 45 to 48 or a derogation under Article 49 of the EU General Data Protection Regulation.

19.3 Competent data protection authorities in the European Region may verify compliance with the Code, including by carrying out audits of ExxonMobil in accordance with audit rights conferred under applicable laws. 

Affiliates outside of the European Region will cooperate with ExxonMobil Petroleum & Chemical BV as needed to respond to requests by data protection authorities in the European Region to provide relevant audit results in relation to the Code. 

ExxonMobil will communicate to the ExxonMobil Data Privacy Office the audit results in relation to European Personal Data transferred under the Code to Affiliates outside of the European Region. 

ExxonMobil will comply with the advice of the competent data protection authority in the European Region with respect to European Personal Data, subject to the exhaustion of any legal remedies when deemed appropriate by ExxonMobil.

19.4 The Individual whose European Personal Data is transferred directly or indirectly to an Affiliate outside of the European Region derives third party beneficiary rights from, and may directly enforce Sections 15.3 and 19.2.i., iii., iv., v., vii., viii., ix.3, x., xi., xii., 19.3 to 19.8 of the Code, by:

i. contacting the ExxonMobil Data Privacy Office in accordance with subsection 9.3, or

ii. lodging a complaint with a national data protection authority of competent jurisdiction in the country in the European Region where (i.) the Individual has (a.) his or her habitual residence, (b.) place of work or (ii.) the alleged infringement of the Code took place, or

iii. bringing a proceeding against the relevant Affiliate established in the European Region before a competent court in the European Region, or 

iv. bringing a proceeding against ExxonMobil Petroleum & Chemical BV with registered office at Polderdijkweg, 2030 Antwerp, Belgium before the Belgium Data Protection Authority (Autorité de Protection des Données) or the Brussels courts or other competent courts referred in Article 79(2) EU General Data Protection Regulation.

19.5 If a valid claim or complaint is brought under 19.4. ExxonMobil Petroleum & Chemical BV accepts responsibility for any violation of the Code by an Affiliate established outside of the European Region, and agrees to take the necessary action to remedy the violation and, where appropriate, to pay compensation for damages resulting from such violation, in accordance with a final decision of a court or supervisory authority not subject to further appeal.

19.6 If a claim, complaint, or proceeding is brought under 19.4 the Individual does not have to prove an actual violation of this Code by the Affiliate outside of the European Region; it suffices that the Individual demonstrates that it has suffered damage and that such damage has likely occurred as a result of a violation of this Code by an Affiliate established outside of the European Region. The burden of proof is then on ExxonMobil Petroleum & Chemical BV to demonstrate that the Affiliate established outside the European Region did not violate this Code. If ExxonMobil Petroleum & Chemical BV can prove that the Affiliate established outside the European Region is not liable for the violation, ExxonMobil Petroleum & Chemical BV may discharge itself from any responsibility.

19.7 ExxonMobil will respond to complaints regarding European Personal Data without undue delay and in any event within one month of receipt of the request or complaint, which may be extended by two further months where necessary. 

Complaints can be submitted by an Individual to ExxonMobil by email or in writing in accordance with Section 9.3 of the Code. 

In case ExxonMobil considers the complaint as justified, it will inform the Individual how it will remedy the issue which gave rise to the complaint. If the complaint is rejected or if the Individual is not satisfied with ExxonMobil’s response, the Individual can lodge a complaint or initiate proceedings in accordance with Sections 19.4.ii and 19.4.iii of the Code. Furthermore if the complaint pertains to Processing of European Personal Data by Affiliates established outside of the European Region, the Individual can also lodge a complaint or initiate proceedings in accordance with Section 19.4.iv.

19.8 In the event of a conflict between the Code and a legal requirement in a country outside of the European region as described in Section 3.3, ExxonMobil will notify the competent data protection authority in the European Region if such legal requirement, including a legally binding request for disclosure of European Personal Data by a law enforcement authority or a state security body of a country outside the European Region, is likely to have a substantial adverse effect on the guarantees provided in the Code with regard to European Personal Data.

In addressing this obligation, ExxonMobil undertakes to conduct an assessment which takes due account of: (i) the specific circumstances of the transfers; (ii) the laws and practices of the third countries of destination (relevant in light of the specific circumstances of the transfers, and the applicable limitations and safeguards); and (iii) the relevant contractual, technical and organizational security measures put in place under the Code. Affiliates outside of the European Region receiving European Personal Data will make best efforts to provide relevant information to assist with this assessment, which ExxonMobil will document and make available to the competent data protection authority upon request. If ExxonMobil becomes aware that an Affiliate outside of the European Region can no longer fulfil its obligations under the Code, ExxonMobil will promptly identify appropriate supplementary measures to be adopted by the relevant Affiliate(s) to address the situation. The relevant Affiliate(s) will suspend the transfer if ExxonMobil considers that no appropriate safeguards for such transfer can be ensured, or if instructed by the competent data protection authority to do so.

If notification to the competent data protection authority in the European Region is prohibited, ExxonMobil will use its best efforts, as reasonably practical, to obtain the right to waive this prohibition, and will document that it did so. If in spite of its best efforts, as reasonably practical, ExxonMobil cannot notify the competent data protection authority in the European Region about the requests it receives, it will annually provide general information on the requests.

ExxonMobil will assess the legality of a request for disclosure as described above – in particular, whether it is within the powers granted to the requesting public authority – and challenge the request if, after careful assessment, it concludes that there are reasonable grounds to consider that the request is unlawful under the laws of the country of destination, applicable obligations under international law, and/or principles of international comity. ExxonMobil will, under the same conditions, pursue possibilities of appeal. When challenging a request, ExxonMobil will seek interim measures with a view to suspending the effects of the request until the competent judicial authority has decided on its merits. ExxonMobil document its legal assessment and any challenge to the request for disclosure, and to the extent permissible under the laws of the country of destination, make the documentation available to the competent data protection authority on request. ExxonMobil will not disclose the Personal Data requested until required to do so under the applicable procedural rules, and shall provide the minimum amount of information permissible when responding, based on a reasonable interpretation of the request.

ExxonMobil will take measures to prevent any transfers of European Personal Data to any public authority (as well as any direct access by such authorities to Personal Data transferred under the Code) that are massive, disproportionate and indiscriminate in a manner that would go beyond what is necessary in a democratic society.

19.9 Affiliates will not transfer European Personal Data under the Code to other Affiliates unless the latter are bound by the Code.