Data Privacy Code of Conduct

1.1 ExxonMobil is committed to protecting Personal Data, including:

i. lawfully Processing Personal Data entrusted to it, and
ii. consistent with business needs, appropriately managing privacy risks associated with Processing Personal Data.

1.2 ExxonMobil and its employees must comply with the Code when Processing Personal Data. The Code forms part of the compliance obligations set out in the Corporate Asset Policy. All policies are required to be read, understood and complied with as part of an employee’s contractual and/or employment obligations. Our list of policies is available at Code of ethics | ExxonMobil.

1.3 ExxonMobil oversees compliance with this Code and with the programs, tools and procedures implementing the Code through

i. a network of designated privacy contacts;

ii. the ExxonMobil Data Privacy Office made up of data privacy professionals, which provide advice on mitigation of risk-based privacy impact assessments performed by business lines in accordance with internal data protection policies, and is responsible for the tasks assigned to it in Sections 3.3, 8.2, 9.3, 15.1 and 18.2.x of the Code;

Data Protection Officers for Affiliates (where appointed) monitor compliance with Applicable Laws and the Code. All Data Protection Officers provide advice, report and where appropriate escalate issues to senior ExxonMobil managers, including board level and European General Counsel and are a point of contact for Individuals and the Competent Sas.; and

iii. a global corporate structure made up of senior ExxonMobil managers which are responsible for overseeing the activities of the ExxonMobil Data Privacy Office.

1.5 The Code is ExxonMobil’s Binding Corporate Rules under European Data Protection Laws.

2.1 ExxonMobil will apply the Code in every country where it Processes Personal Data.

2.2 The Code will apply to Personal Data of Individuals. Individuals include current and past employees, job applicants, contractors, representatives of customers and other business partners, and consumers. All Individuals have access to privacy notices which comply with European Data Protection Law, list the categories and types of Personal Data and are available on ExxonMobil’s internal and external websites. Where relevant, contracts are subject to confidentiality obligations and only available to the contract parties.

2.3 The Code does not apply to Anonymized Information or other information which is not Personal Data.

2.4 ExxonMobil Processes Personal Data for business purposes, which include:

i. personnel administration and human resource operations, such as an Individual’s payroll and career development,

ii. verification of an Individual’s compliance with company policies and assets,

iii. physical security and access of an Individual to buildings and premises,

iv. information technology management related to an Individual’s use of company systems, which includes, provision of software and hardware, access controls, maintaining and updating information security controls,

v. relationship management with our customers and other business partners, which includes Processing of contact details and transactional data to allow for order-taking, delivery, invoicing and business development,

vi. communicating with government agencies to satisfy regulatory requirements,

vii. communicating with external stakeholders on matters related to ExxonMobil’s business activities.

3.1 Personal Data will be Processed in a lawful manner. 

3.2 This Code sets a minimum standard of data privacy protection. Where Applicable Law requires a higher level of protection for Personal Data than the level of protection set out in the Code, ExxonMobil will apply to such higher level of protection.  For example, when Processing is permitted only on the basis of one or more grounds specified by law (see sections 18.2iv and v) ExxonMobil will meet such requirements.

3.3 ExxonMobil, with the support of the ExxonMobil Data Privacy Office and Data Protection Officers (where appointed), monitors laws globally to ensure the Code can be complied with. This process includes the Assessments in section 18.8 of this Code. Where ExxonMobil has reason to believe that a law prevents it from complying with the Code, ExxonMobil will take a responsible decision on what action to take in consultation with the ExxonMobil Data Privacy Office and  Data Protection Officers (where required to be appointed)The Data Protection Officer shall inform and consult with the Competent SA both where Applicable Law requires the Competent SA to be informed and where ExxonMobil determines such law is likely to have a substantial adverse effect on the guarantees provided by the Code.

Where required by applicable law, Personal Data will be Processed for specific and legitimate purposes in each case with a legal ground of processing and not further Processed in a way incompatible with those purposes. Further Processing will not be considered incompatible, for example when it is (i.) with the Individual’s consent or authorization, (ii.) in an emergency situation such as when the Individual’s life or vital interests are at stake, or (iii.) in order to establish, exercise, or defend a legal claim.

5.1 ExxonMobil commits to only Process Personal Data that is relevant to its business purposes, examples of which are set out in section 2.4 above. Where possible, Personal Data is deleted, aggregated and/or pseudonymized to ensure only the minimum Personal Data is Processed for the purpose it is collected. 

5.2 Personal Data will be kept only as long as necessary to meet the purposes for which it is Processed.  

5.3 Where required by applicable law, ExxonMobil will take measures to minimize Processing of Personal Data, including by privacy by design.

Taking into account the purpose for which Personal Data is Processed, ExxonMobil will take reasonable measures to (i.) keep Personal Data accurate, and (ii.) update the Personal Data if informed by the Individual or a Trusted Source of changes to the Personal Data.

ExxonMobil will provide a clear notice about the Processing of Personal Data, consistent with legal requirements.

8.1 Based on an assessment of the risks involved, ExxonMobil will apply appropriate technical and organizational measures to (i) ensure European Personal Data is Processed in compliance with Data Protection Laws and (ii) protect Personal Data from Personal Data Breach. These measures are listed in an information security schedule based on internationally recognized security standards.

8.2 In the event of a Personal Data Breach, ExxonMobil will (i.) consult with the ExxonMobil Data Privacy Office which keeps a record of Personal Data breaches, (ii.) report to a regulator and Competent SA and (iii) inform Individuals about the breach in each case in accordance with Applicable Laws.

9.1 Where required by applicable law, ExxonMobil will respond to requests of Individuals: (i.) to know whether and which categories of Personal Data relating to them ExxonMobil is Processing, (ii.) to receive a copy of their Personal Data, (iii.) to delete, restrict, erase, or discontinue Processing of the requesting Individual’s Personal Data, (iv.) where permitted by Applicable Law, withdraw their consent to Processing and (v.) for Data Portability.

9.2 Individuals can request ExxonMobil to rectify inaccurate Personal Data related to them, in accordance with Section 6.

9.3 In order to exercise these rights or to raise a concern or complaint that ExxonMobil is not complying with the Code, Individuals can contact the ExxonMobil Data Privacy Office to obtain more information on the procedure it will apply in order to handle the complaint:

By email to: data.privacy.office@exxonmobil.com
Or in writing to: Data Privacy Office, c/o ExxonMobil Hungary Limited Liability Company, Registered seat: H-1134 Budapest, Dózsa György út 61-63, Budapest, H-1134, Hungary

Individuals may also contact Data Protection Officers (where appointed) using the same contact details but with “DP Officer” as the email subject heading.

Whenever ExxonMobil transfers Personal Data between Affiliates, ExxonMobil will ensure that Personal Data benefits from the protections set out in this Code.

Personal Data will only be Transferred to third parties (including Transfers across national borders) if appropriate measures that comply with Applicable Laws have been taken to adequately protect the Personal Data when Transferred.

ExxonMobil commits to provide a mandatory training in relation to the obligations set out in the Code, to employees and contractors who have access to our systems who: (i) Process Personal Data, or (ii) are involved in the maintenance or development of tools used to process Personal Data. This training is at the start of employment and/or assignments with ExxonMobil and then every 3 years.

Ongoing education is supported by the Data Privacy Office and available in ExxonMobil’s existing training systems.

13.1 ExxonMobil applies programs for regularly verifying its implementation of and compliance with the Code.

13.2 The compliance verification programs include: 

i. an audit program which includes regular audits of ExxonMobil units and business lines by the internal audit department, follow-up of any needed corrective measures, and oversight of the audit program and audit results by the ExxonMobil Corporation Board of Directors. 

ii. The ExxonMobil internal audit department members are guaranteed independence in the performance of their duties including scope, process and frequency. This ensures the independence of the internal audit department and audit outcomes. Outcomes are communicated to senior management of the unit or business line that has been audited and the Data Protection Officer (where applicable) and a board representative of ExxonMobil Petroleum & Chemical BV to ensure recommendations are implemented. 

iii. The internal audit department will ensure follow-up of any audit findings. Oversight of the internal audit department and program including all internal audit outcomes is carried out by the ExxonMobil Corporation Board of Directors’ Audit Committee members. This ensures the true independence of the audit department’s functions.

iv. An additional process whereby a unit or business line can request an audit is undertaken by the internal audit department.

14.1 ExxonMobil will cooperate with, respond to information requests relating to processing under the Code and carefully consider the advice of Competent SAs in relation to requests about the application of this Code.

14.2 In the execution of its public duties by a Competent SA, ExxonMobil will cooperate and comply with formal and lawful decisions of Competent SAs that are final and not subject to further appeal.

14.3 When Personal Data is Transferred among Affiliates, they shall cooperate and assist each other, where necessary, to respond to requests from Competent SAs.

15.1 The Code may be changed by ExxonMobil as necessary, for example to ensure compliance with changes in applicable law or to reflect changes in internal organization and processes. Code changes are recorded and stored by the Data Privacy Office and notified to all ExxonMobil Affiliates (Material Changes only).

15.2 ExxonMobil will communicate to Competent SA as follows:

• Material Changes to the Code and Intragroup Agreement will be communicated without unreasonable delay; and 
• on an annual basis, ExxonMobil will communicate changes to the Code and/or list of Affiliates bound by the Code, including a brief description of the changes. Where there have been no changes to the Code, this will also be communicated to Competent SA as part of ExxonMobil’s annual communication.

15.3 ExxonMobil will make the Code, and the changes to the Code, available:

• Externally on our website here;
• Upon request of the Individual, in accordance with subsection 9.3; and 
• Internally, on the ExxonMobil intranet.

The Code is effective from the date of signature of the Binding Corporate Rules Inter-Affiliate Agreement.

To obtain more information about the Code of Conduct, please contact the ExxonMobil Data Privacy Office: data.privacy.office@exxonmobil.com.

18.1 With regard to European Personal Data, ExxonMobil is accountable for and will comply with all the commitments undertaken in the Code, and where stricter European Data Protection Laws impose a higher level of protection, ExxonMobil will apply such a higher level of protection. ExxonMobil will inform the Data Exporter and ExxonMobil Petroleum & Chemical BV promptly, where it can no longer comply with the Code, including following a change of law in a Destination Country or a Government Access Request.

18.2 In the event that European Personal Data is Transferred to Affiliates outside of the European Region, ExxonMobil will afford a level of protection to European Personal Data which does not undermine the level of protection granted under European Data Protection Laws. ExxonMobil will do so, even if such protection is not afforded by the applicable law in the countries of the Affiliates outside of the European Region where the European Personal Data is received.

This means in particular in relation to the data privacy practices described in Sections 3, 4, 5, 7, 8, 9 and 11 respectively, that ExxonMobil will:

i. not Process European Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, sex life, sexual orientation, genetic data, or biometric data for the purpose of uniquely identifying an Individual, unless such Processing is permitted in accordance with European Data Protection Laws,

ii. not Process European Personal Data relating to criminal convictions and offences other than in accordance with European Data Protection Laws,

iii. carry out an impact assessment of high risk Processing operations, in accordance with European Data Protection Laws, and if risks remain high after implementing mitigating measures as recommended by the Data Protection Officers and advised by privacy counsel on a per assessment basis, consult with Competent SA, in accordance with European Data Protection Laws,

iv. Process European Personal Data for specific and legitimate business purposes, and pursuant to a valid legal basis, specifically (as applicable): 

• where the Processing is necessary for purpose(s) of ExxonMobil’s or a third party’s legitimate interest(s), except where such interests are overridden by the interests or fundamental rights and freedoms of the Individual.

• where the Individual has given consent to the Processing of his or her Personal Data for one or more specific purposes.

• where is the Processing necessary for the performance of a contract to which the Individual is party or in order to take steps at the request of the Individual prior to entering a contract.

• where the Processing is necessary for compliance with a legal obligation to which ExxonMobil is subject; or

• in exceptional circumstances, where the Processing is necessary to protect the vital interests of the Individual or of another natural person.

v. Process European Personal Data categorized as a special category personal data under European Data Protection Laws for specific and legitimate business purposes, and pursuant to a valid legal basis, specifically (as applicable):

• where the Individual has given explicit consent to the Processing of his or her Personal Data for one or more specific purposes.

• where the Processing is necessary for the purposes of carrying out the obligations and exercising specific rights of ExxonMobil or of the Individual in the field of employment and social security and social protection law in so far as it is authorized; or

• where the Processing is necessary for the purposes of preventative or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services as permitted by European Data Protection Laws.

vi. Process European Personal Data which is adequate, relevant and limited to what is necessary in relation to the legitimate business purposes,

vii. Apply privacy by design and privacy by default as appropriate,&

viii. Keep a digital, written Record of Processing activities which will be made available to a Competent SA on request,

ix. Give notice and transparency to Individuals about the use and purpose of the Processing of European Personal Data which will include reference to this Code, in accordance with European Data Protection Laws,

x. apply the same level of security measures to protect European Personal Data as provided in European Data Protection Laws,;

xi. in the event of a breach of European Personal Data ExxonMobil shall:

1. consult with the ExxonMobil Data Privacy Office, and Data Protection Officer which will support to assess the risk and document the breach in an internal register and make the relevant documentation available to the Competent SA upon request, and;

2. notify the personal data breach to the Competent SAs without undue delay and, where feasible, not later than 72 hours after having become aware of the breach unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons,

3.inform without undue delay ExxonMobil Petroleum & Chemical BV, and

3. inform Individuals without undue delay if the breach is likely to result in a high risk to the Individual’s rights and freedoms, and

4. where a breach of European Personal Data results from the actions of an ExxonMobil processor, inform the ExxonMobil controller without undue delay.

xii. respond to requests and complaints of Individuals in relation to the Processing of European Personal Data in accordance with Section 18.7, 

xiii. allow Individuals to object to the Processing of their Personal Data or to a decision based solely on automated Processing which produces legal effects concerning the Individual or similarly significantly affects the Individual, unless the decision is permitted by European Data Protection Laws, 

xiv. only Transfer European Personal Data to third parties outside of the European Region in compliance with European Data Protection Laws,

xv. enter into contracts with processors that comply with European Data Protection Laws, and

xvi Appoint Data Protection Officers in the European Region to specifically monitor compliance with European Data Protection Laws. In accordance with European Data Protection Laws, Data Protection Officers can request an audit to support their compliance monitoring responsibilities.

18.3 Competent SAs in the European Region may verify compliance with the Code, including by carrying out audits of ExxonMobil in accordance with audit rights conferred under European Data Protection Laws. Audit outcomes in relation to all Personal Data are communicated as described in Section 13.2 and the results will also be provided to a Competent SA on request. Any dispute related to the exercise of supervision of compliance with this Code will be resolved by the courts of the country of the Competent SA(s), in accordance with European Data Protection Laws. ExxonMobil agrees to submit to the applicable jurisdiction. 

All Affiliates will cooperate with ExxonMobil Petroleum & Chemical BV as needed to respond to requests by Competent SAs to provide relevant audit results and inspections including on-site audits, in relation to the Code.

ExxonMobil will comply with the advice of Competent SAs in the European Region with respect to European Personal Data, subject to the exhaustion of any legal remedies when deemed appropriate by ExxonMobil.

18.4 The Individual whose European Personal Data is Transferred to an Affiliate outside of the European Region derives third party beneficiary rights from and may directly enforce Sections 15.3 and 18.2.i., iii., iv., v., vii., viii., ix.3, x., xi., xii., 18.3 to 18.8 of the Code, using any of the following:

i. contacting the ExxonMobil Data Privacy Office in accordance with subsection 9.3, or

ii. lodging a complaint with a Competent SA where the Individual has his or her habitual residence, place of work or the alleged infringement of the Code took place, or

iii. bringing a proceeding against the relevant Affiliate established in the European Region before a competent court in the European Region, or

iv. bringing a proceeding against ExxonMobil Petroleum & Chemical BV with registered office at Polderdijkweg, 2030 Antwerp, Belgium before the Belgium Data Protection Authority () or the Brussels courts or other competent courts, where permitted by European Data Protection Law.

18.5 If a valid claim or complaint is brought under 18.4, ExxonMobil Petroleum & Chemical BV accepts responsibility for any violation of the Code by an Affiliate established outside of the European Region and agrees to take the necessary action to remedy the violation and, where appropriate, to pay compensation for damages resulting from such violation, in accordance with a final decision of a court or Competent SA not subject to further appeal.

18.6 If a claim, complaint, or proceeding is brought under 18.4 the Individual does not have to prove an actual violation of this Code by the Affiliate outside of the European Region; it suffices that the Individual demonstrates that it has suffered damage and that such damage has likely occurred as a result of a violation of this Code by an Affiliate established outside of the European Region. The burden of proof is then on ExxonMobil Petroleum & Chemical BV to demonstrate that the Affiliate established outside the European Region did not violate this Code. If ExxonMobil Petroleum & Chemical BV can prove that the Affiliate established outside the European Region is not liable for the violation, ExxonMobil Petroleum & Chemical BV may discharge itself from any responsibility.

18.7 ExxonMobil will respond to requests or complaints regarding the Processing of European Personal Data without undue delay and in any event within one month of receipt of the request or complaint, which may be extended by two further months where necessary and permitted by European Data Protection Laws and notified in writing to the individual. ExxonMobil Data Privacy Office and Data Protection Officers provide a point of escalation for ExxonMobil employees responsible for responding to any such requests or complaints.

Complaints can be submitted by an Individual to ExxonMobil by email or in writing in accordance with Section 9.3 of the Code. ExxonMobil recognizes individual requests and complaints made directly by individuals or through a representative of a not-for-profit body, organization or association on behalf of individuals where permitted by European Data Protection Laws.

In case ExxonMobil considers the complaint as justified, it will inform the Individual how it will remedy the issue which gave rise to the complaint. If the complaint is rejected or if the Individual is not satisfied with ExxonMobil’s response, the Individual can lodge a complaint or initiate proceedings in accordance with Sections 18.4.ii and 18.4.iii of the Code. Furthermore, if the complaint pertains to the Processing of European Personal Data by Affiliates established outside of the European Region, the Individual can also lodge a complaint or initiate proceedings in accordance with Section 18.4. iv.

18.8 ExxonMobil undertakes and documents Assessments to determine whether a Transfer of European Personal Data to a Data Importer located outside the European Region in reliance on the Code is adequately protected by the Code and whether any supplementary measures should be implemented as a result of the findings of the Assessment. These Assessments are kept up to date to reflect any changes in laws that might change their risk determination, which includes Data Exporters monitoring developments in the Destination Country in collaboration with Data Importers where appropriate. In accordance with Section 18.1, ExxonMobil will inform the Data Exporter and ExxonMobil Petroleum & Chemical BV promptly, where it can no longer comply with the Code as a result of any changes in law. Affiliates are informed of the Assessment outcomes by the Data Privacy Office, which include whether such Transfers are suspended or ended. Implementation of supplementary measures are recorded alongside the Assessment.

The Assessment process looks at all aspects of the Transfer, including determining whether local laws and practices in the Destination Country:

- respect the essence of fundamental rights and freedoms.

- exceed what is necessary and proportionate in a democratic society to safeguard the risk of requiring disclosure of or authorizing access to, European Personal Data; and

- require the disclosure of European Personal Data or provide measures authorizing access by public authorities,

such that they have a substantial adverse effect on the guarantees and commitments provided in the Code. In accordance with Section 18.1, an Affiliate will inform the data exporter and ExxonMobil Petroleum & Chemical BV.

Where an Assessment determines that local laws and practices will have such a substantial adverse effect, ExxonMobil, in coordination with ExxonMobil Petroleum & Chemical BV, the Data Privacy Office and Data Protection Officers, will review existing contractual, technical and organizational security measures and decide whether to supplement the existing measures to reduce this risk. The Assessment and supplementary measure implementation process also applies to existing Transfers notified as being so affected by local laws and measures by the Data Importer. These Transfers are immediately suspended at the direction of ExxonMobil and if instructed by the Competent SAs, until supplemental measures are identified.

Where either supplemental measures cannot be identified or where identified, but cannot provide the protection needed to enable the Code to protect the Transfer of European Personal Data or a suspended Transfer is not restored within 1 month of such suspension or where the suspension is extended for business continuity purposes, the extended suspension period, existing Transfers are discontinued, and new Transfers are not permitted. All European Personal Data that would have been Transferred, including all copies, is returned or destroyed, at the choice of the Data Exporter unless a local law prohibits this. In this case, the European Personal Data will remain with the Data Importer who will continue to comply with the Code. Where the Data Exporter elects deletion, the Data Importer will provide evidence, where requested, that it has permanently deleted all such European Personal Data.

All Assessments are made available to Competent SA upon request.

18.9 Where a Data Importer receives or becomes aware of a Government Access Request, it shall inform the Data Exporter promptly, and the Individual whose European Personal Data is the subject of the Government Access Request.

If partially or completely prohibited from making such notifications, the Data Importer will use its best efforts to obtain a waiver of such prohibition and will document its best efforts, including the original Government Access Request, in order to be able to demonstrate them upon request of the Data Exporter and for so long as the Transfer of Personal Data subject to the Government Access Request, is protected by the Code. All Government Access Requests and internal documentation will be preserved in accordance with ExxonMobil’s record management guidelines.

ExxonMobil will assess the legality of a Government Access Request for disclosure as described above – in particular, whether it is within the powers granted to the requesting public authority – and challenge the Government Access Request if, after careful assessment, it concludes that there are reasonable grounds to consider that the Government Access Request is unlawful under the laws of the Destination Country, applicable obligations under international law, and/or principles of international comity. ExxonMobil will share this assessment with the Data Exporter. ExxonMobil will, under the same conditions, pursue possibilities of appeal. When challenging a Government Access Request, ExxonMobil will seek interim measures with a view to suspending the effects of the Government Access Request until the competent judicial authority has decided on its merits. ExxonMobil will document its legal assessment and any challenge to the Government Access Request for disclosure, and to the extent permissible under the laws of the Destination Country, make the documentation available to Competent SA on request. ExxonMobil will not disclose the Personal Data requested until required to do so under the applicable procedural rules and shall provide the minimum amount of information permissible when responding, based on a reasonable interpretation of the request.

ExxonMobil will take measures to prevent any Transfers of European Personal Data to any public authority (as well as any direct access by such authorities to Personal Data Transferred under the Code) that are massive, disproportionate and indiscriminate in a manner that would go beyond what is necessary in a democratic society.

Data Importer will provide general information on the Government Access Requests to the Data Exporter annually and, at regular intervals, which will include as much relevant information as possible on the requests received (in particular, number of requests, type of data requested, requesting authority or authorities, whether Government Access Requests have been challenged and the outcome of such challenges).

18.10 Affiliates will not Transfer European Personal Data under the Code to other Affiliates unless the latter are bound by the Code.

18.11 Where a Data Importer is no longer required to comply with this Code may be permitted to keep, return, or delete the Personal Data received under this Code by the Data Exporter. If the Data Exporter and Data Importer agree that the data may be kept by the Data Importer, the Data Importer agrees that it will maintain protection in accordance with European Data Protection Law.

“Affiliate” means any company or partnership that has adopted the Code through its signature of the inter affiliate agreement, and in which Exxon Mobil Corporation or any parent of Exxon Mobil Corporation now or hereafter, directly or indirectly, owns or controls more than 50 percent of the ownership interest having the right to vote or appoint its directors or functional equivalents, and any successor in interest to such company or partnership.

“Anonymized Information” means information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the Individual is not or no longer identifiable.

“Applicable Laws” means (i) in relation to European Personal Data, the European Data Protection Laws and/or (ii) in relation to any other Personal Data, the applicable national, federal, state and local laws and regulations relating to the data protection, privacy and security of Personal Data as may be updated, modified or replaced from time to time and as applicable to the processing carried out by ExxonMobil.

“Assessments” means a legal review of (i) the specific circumstances of the Transfers, (ii) the laws and practices of the Destination Country relevant to a particular Transfer, including those that require disclosure or access as well as those that may place limitations or offer safeguards and (iii) any relevant and existing contractual, technical or organizational safeguards in place to supplement the protections under the Code.

“Competent SA(s)” means the EEA data protection supervisory authority competent for the Data Exporter under this Code.

“Data Exporter” means the Affiliate in the European Region that transfers European Personal Data out of the European Region to a Data Importer.

“Data Importer” means the Affiliate that receives European Personal Data transferred out of the European Region by a Data Exporter.

“Data Portability” means the right to obtain the Personal Data in a format ready to transmit to a third party in accordance with applicable law.

“Destination Country” means of country outside the European Region where Personal Data is Transferred to and which does not have a current adequacy decision from the European Commission.

“EEA” means the European Economic Area, established under the EEA agreement of January 1, 1994, which provides for the free movement of persons, goods, services, and capital within the European Single Market.

“European Data Protection Laws” means Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (EU General Data Protection Regulation) (as implemented in national law of EEA member states and UK, and as amended from time to time), or the Swiss Federal Act on Data Protection and all corresponding or equivalent EEA Member State and national laws or regulations, as may be updated, modified or replaced from time to time as applicable to the processing carried out by ExxonMobil.

“European Personal Data” means Personal Data which is or has been subject to European Data Protection Laws.

“European Region” means countries in the European Economic Area (EEA), UK and Switzerland.

“Government Access Request” means (i) the receipt of a legally binding request for disclosure of European Personal Data by a public authority of the Destination Country, or (ii) becoming aware of the direct access by public authorities to such European Personal Data in a country outside of the European Region.

"Individual” means any identified or identifiable natural person whose information is Processed by or on behalf of ExxonMobil; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; Individuals include current and past employees, job applicants, contractors, representatives of customers and other business partners, and consumers.

“Intragroup Agreement” means the ExxonMobil inter-Affiliate agreement by which the Affiliates adopt and are bound by the Code.

“Material Changes” means amendments to the Code which have an adverse impact on the standard of data protection for European Personal Data provided under the Code, or which significantly affect the scope or the structure of the Code with respect to European Personal Data.

“Personal Data” means data relating to an Individual.

“Personal Data Breach” means a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized access to, disclosure of Personal Data.

“Process”, “Processed”, “Processes”, “Processing” means performing of any operation on Personal Data, whether or not by automated means, such as accessing, collecting, storing, recording, organizing, altering, disseminating, disclosing, transferring, retrieving, destroying or otherwise using Personal Data.

“Transfer”, “Transfers” and “Transferred” mean a single transfer or a set of transfers of Personal Data as applicable and both a first transfer and any onward transfers of Personal Data within the same Destination Country or to another Destination Country.

“Trusted Source” means a person or entity that is authorized to represent the Individual, or a person or entity that, in ExxonMobil’s determination, has apparent authority to represent the Individual.

Affiliates are listed by country and include registration number.

Each country’s address and the contact details of the Data Protection Officer where required, is provided as part of the country privacy notice or contact us page available at Our privacy policies | ExxonMobil.