selected item

UK BCR Summary

Article

4 min read

The ExxonMobil group of companies (“ExxonMobil”) have approved binding corporate rules (“EU BCR”), which are recognized by the European data protection authorities as providing adequate safeguards for transfers of personal data within multinational companies. ExxonMobil refers to the EU BCR as the Data Privacy Code of Conduct (the “Code”). ExxonMobil’s EU BCR was reviewed and approved by data protection authorities across Europe.  The Code is available at https://corporate.exxonmobil.com/global-legal-pages/our-privacy-policies/data-privacy-code-of-conduct.  All capitalised terms used in this UK BCR Summary which are not otherwise defined have the same meaning as is used in the Code.

ExxonMobil has entered into the UK BCR Addendum to the approved EU BCR. The lead UK BCR Member is Esso Petroleum Company, Limited.  The UK BCR Addendum is a formal legal mechanism which extends the scope of the EU BCR to include transfers of personal data from the UK. Together, the EU BCR and the UK BCR Addendum form ExxonMobil’s UK BCR (“UK BCR”). Further information about the UK BCR addendum process is available on the UK Information Commissioner’s Office (“ICO”) website at https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/guide-to-binding-corporate-rules/a-uk-bcr-addendum/.

The purpose of this UK BCR summary is to provide information to individuals whose personal data is transferred under the UK BCR so that they know how their information is processed, what rights they have under the UK BCR and how to enforce them.  

Contact details for queries about ExxonMobil's UK BCR
 ExxonMobil Data Privacy Office: data.privacy.office@exxonmobil.com.
Data transfers covered by ExxonMobil’s UK BCR

The UK BCR will apply to Personal Data of Individuals where such Personal Data is subject to UK data protection law (“UK Data Protection Law”). Individuals include current and past employees, job applicants, contractors, representatives of customers and other business partners, and consumers. All Individuals have access to privacy notices which comply with UK Data Protection Law, list the categories and types of Personal Data and are available on ExxonMobil’s internal and external websites. Where relevant, contracts are subject to confidentiality obligations and only available to the contract parties.


The UK BCR does not apply to Anonymized Information or other information which is not Personal Data.


ExxonMobil Processes Personal Data for business purposes, which include:


     i. personnel administration and human resource operations, such as an Individual’s payroll and career development
     ii. verification of an Individual’s compliance with company policies and assets,
     iii. physical security and access of an Individual to buildings and premises,
     iv. information technology management related to an Individual’s use of company systems,
     v. relationship management with our customers and other business partners, which includes Processing of contact details and transactional data to allow for order-taking, delivery, invoicing and business development,
     vi. communicating with government agencies to satisfy regulatory requirements,
     vii. communicating with external stakeholders on matters related to ExxonMobil’s business activities.


The Personal Data transferred under the UK BCRs will be subject to the following basic processing activities:

  • Receiving data (including collection, accessing, retrieval, recording, and data entry), holding data (including storage, organisation and structuring), using data, updating data, including correcting, adaptation, alteration, alignment and combination, protecting data, including restricting, encrypting, and security testing, sharing data, including disclosure, dissemination, allowing access or otherwise making available and erasing data, including destruction and deletion.
List of countries where personal data is transferred to under the UK BCR

The countries where personal data is transferred to under ExxonMobil’s EU BCR (including the UK BCR) is as follows:

  • Argentina
  • Australia
  • Austria
  • Bahamas
  • Belgium
  • Bermuda
  • Brazil
  • Canada
  • Cayman Islands
  • China
  • Cyprus
  • Czech Republic
  • Egypt
  • Finland
  • France
  • Germany
  • Greece
  • Hong Kong
  • Hungary
  • India
  • Indonesia
  • Italy
  • Japan
  • Republic of Korea
  • Luxembourg
  • Macao
  • Malaysia
  • Marshall Islands
  • Mexico
  • Mozambique
  • Netherlands
  • New Zealand
  • Nigeria
  • Northern Mariana Islands
  • Norway
  • Papua New Guinea
  • Poland
  • Singapore
  • Sweden
  • Thailand
  • Turkey
  • Ukraine
  • United Arab Emirates
  • United Kingdom
  • United States
  • Vietnam
The rights of individuals whose personal data is transferred under the UK BCR, including third party beneficiary rights, and the means to exercise those rights.

Where required by applicable law, ExxonMobil will respond to requests of Individuals: (i.) to know whether and which categories of Personal Data relating to them ExxonMobil is Processing, (ii.) to receive a copy of their Personal Data, (iii.) to delete, restrict, erase, or discontinue Processing of the requesting Individual’s Personal Data, and (iv.) for Data Portability.


Individuals can request ExxonMobil to rectify inaccurate Personal Data related to them, in accordance with Section 6 of the Code.


In order to exercise these rights or to raise a concern or complaint that ExxonMobil is not complying with the Code, Individuals can contact the ExxonMobil Data Privacy Office to obtain more information on the procedure it will apply in order to handle the complaint:

  • By email to: data.privacy.office@exxonmobil.com
  • Or in writing to: Data Privacy Office, c/o ExxonMobil Hungary Limited Liability Company, Registered seat: H-1134 Budapest, Dózsa György út 61-63, Budapest, H-1134, Hungary.

Individuals may also contact Data Protection Officers (where appointed) using the same contact details but with “DP Officer” as the email subject heading.


For information about third party beneficiary rights and the means to exercise those rights as well as specific rights in relation to  European Personal Data (which includes personal data transferred under the UK BCR and subject to UK law) please see the section “Specific rights in relation to European Personal Data” of the Code.
How to complain to ExxonMobil’s BCR Members
 Please see above.
How to complain to the UK Information Commissioner’s Office about ExxonMobil’s UK BCR

Individuals have the right to make a complaint about ExxonMobil’s UK BCR to the ICO – for more information please see https://ico.org.uk/for-the-public/how-to-make-a-data-protection-complaint/


Information Commissioner’s Office

Wycliffe House Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113
Textphone: 01625 545860

Monday to Friday, 9am to 4:30pm
Information about UK Court Claims

Below we provide information about how to bring a claim in the UK courts against Esso Petroleum Company, Limited for redress and, where appropriate, compensation for a breach of the UK BCR Addendum by Esso Petroleum Company, Limited (the Lead UK BCR Member) and any BCR Member.


The individual court systems provide guidance on how to bring a claim in England and Wales, Scotland and Northern Ireland.


Citizens Advice provides information on taking legal action in England and Wales, Scotland and Northern Ireland.


Finally, you can find further information at: