GDPR Compliance Policy

Section

I. Purpose

II. Policy

III. Consequences of Non-Compliance

IV. Reporting and Protection from Retaliation

V. Appendix

​

​

II. PURPOSE

This General Data Protection Regulation Compliance Policy (the “GDPR Compliance Policy” or this “Policy”) governs the manner in which Aramark (the “Company”) Processes Personal Data under the General Data Protection Regulation (EU) 2016/679 (the “EU GDPR”) and the retained EU GDPR as it forms part of the law of England and Wales, Scotland and Northern Ireland (“UK GDPR”) (together referred to as the “GDPR”).  This Policy also describes the measures the Company takes to protect Personal Data and explains how individuals can exercise their rights under the GDPR.

All capitalized terms used in this Policy, unless otherwise defined herein, have the meaning as prescribed in the GDPR.

II. POLICY

1. Scope and Applicability

This Policy complies with GDPR.

This Policy applies to all Company affiliates, employees, and Service Providers that Process the Personal Data (i) originating from, or on behalf of, an Aramark Affiliate established in a Member State of the European Economic Area (“EEA”) or Switzerland or in the United Kingdom (“UK”); or (ii) of Data Subjects located in a Member State of the EEA or Switzerland or the UK.

This Policy does not in any way override or substitute for any applicable national data protection and privacy laws and regulations. All such local laws and regulations must be followed at all times and will take precedence over the Policy in cases where they provide for stricter standards on privacy and data protection.

​

2. The Company’s Privacy Compliance Network

Our Privacy Compliance Program (the “Program”) defines the Company’s global framework for privacy compliance by setting out common rules to be applied by all the Company entities and employees worldwide when Processing Personal Data within the scope of GDPR (as set out above) on the Company’s behalf.The Program is designed to comply with applicable law, including transfers of Personal Data within the Company and to Service Providers.

The key elements of the Program are set forth below:

2.1 Privacy Compliance Team 

In recognition of the importance of privacy compliance, the Company maintains the Privacy Compliance function within the overall Compliance organisation. The Privacy Compliance function works closely with Legal, IT Operations, Information Security, and other corporate functions to protect Personal Data and Process Personal Data in accordance with applicable law.

​

The main and most important purpose of the Privacy Compliance Program is to make all Employees:

• Understand the GDPR Principles and how to apply them to their specific roles and functions in the organization;

• Receive general privacy awareness training and education on the Company’s Privacy Compliance Program; 

• Understand the Company’s obligations to comply with DSRs;

• Understand how to identify and report Data Breaches;

• Direct all questions and requests to the dedicated GDPR inbox: gdpr@aramark.com.

2.1.1. Roles and Responsibilities

With regard to Privacy Compliance Program, the Company’s representatives shall have the roles and responsibilities as set forth below: 

(i) Privacy Compliance Team Members are responsible for privacy compliance program in Europe, specifically by;

• Developing privacy protection strategy, action plans, policies and standards;

• Provision of business teams with support and guidance to privacy related topics;

• Ensuring compliance program’s execution in all relevant countries;

• Building collaboration and setting up privacy communication channels within global Compliance and Legal teams; 

• Identifying and analyzing privacy related risks and providing solutions and guidance for business to develop mitigation measures;

• Conducting privacy risk assessments and audits to ensure GDPR compliance;

• Reviewing new projects and initiatives for compliance with GDPR;

• Training management on their accountability principles and employees on GDPR compliance requirements pertaining to their functions;

• Building awareness and privacy compliance culture in the organization;

• Maintaining records of all data processing activities and accompanying compliance documentation;

• Ensuring that data subjects’ claims and requests are fulfilled or responded to;

• Managing data breaches and privacy incidents;

• Being point of contact and subject matter expert from all GDPR privacy related queries in the organization;

• Keeping privacy compliance watch and monitor developments in data protection legislations.

(ii) Director of Data Privacy Compliance Europe:

• Supervises execution of Privacy Compliance Program, assigns resources and coordinates exchange with other corporate functions;

• Supports the other Privacy Compliance Team Members in all activities belonging to Privacy Compliance Program.

(iii) Local and Corporate Privacy Legal Team:

• Provide legal support in privacy issues;

• Assist with the engagement of outside counsel to the extent needed;

• Assesses the enforceability / validity of a potential legal claims in relation to personal data processing.

(iv) Chief Information Security Officer (CISO) is accountable, through the Chief Information Officer, to the Chief Executive Officer for:

• Establishing and maintaining policies to reflect organization risk tolerance and risk management best practices.

• Risk assessing, approving, and maintaining a list of exceptions to these policies.

v. Business Process Owner(s):

• For the purpose of this Policy, a Business Process Owner is the employee in charge of the specific process or asset involving processing of personal data and his/her role is to ensure an appropriate level of protection, confidentiality, integrity, and availability of personal data under his/her responsibility in compliance with privacy regulations.

• Business Process Owner(s) shall assist the Privacy Compliance team (or delegate) in particular in the preparation of documentation required under the GDPR and in the implementation of controls necessary to achieve objective of this Policy and participate in incident response as required. 

(vi) All Employees:

• Adhere to the Company’s expectations und undertake their duties in manner consistent with the Company’s policies and procedures;

• Undertake any necessary training as and when required;

• Will seek guidance from a Privacy Compliance Team Member, a Legal Team Member, or the Data Protection Officer (if applicable) when unsure whether any of their actions might be in breach of this Policy.

(vii) Data Protection Officer (DPO)

The Company appoints a Data Protection Officer whenever it is required according to the requirements of GDPR and local data privacy laws as well as having regard to the nature and scope of the Company’s processing activities locally.

Where it is required for the Company to appoint Data Protection Officer, they play a crucial role in the implementation and deployment of the Company's Privacy Compliance Program, working closely with other members of the Privacy Compliance Team and actively participating in the program.

Where a Data Protection Officer is appointed at the Company’s specific location, it is reflected in the local privacy compliance documentation and corresponding procedures. Where it is determined that no Data Protection Officer is required to be appointed locally, there is a Privacy Compliance Team member who has responsibility for the Privacy Compliance Program in that region. A list of all DPOs and Privacy Compliance Team members can be requested by emailing gdpr@aramark.com.

2.2 Training

(i) General GDPR awareness training;

(ii) Targeted and customized privacy awareness workshops for personnel that regularly process large volumes of Personal Data and / or sensitive Personal Data (e.g., payroll) on the Company’s behalf; 

(iii) Internal training regarding the administration of GDPR program for support function, lines of business or sites.

2.3 Compliance Documentation 

This Policy requires that the Company maintains appropriate compliance documentation as required by GDPR, including:

​2.3.1 General Documentation

(i) This Privacy Policy and associated policies that address specific aspects of Personal Data Processing, including policies on:

• Approval of New Business Processes: Execution of Privacy by Design principle;

• Data Breach Management: Handling security incidents involving personal data;

• Data Subjects Requests Handling: Documentation and implementation of a process that allows handling of and response to data subject requests and working instructions / job aids to capture incoming requests and ensure transfer to privacy organization – dedicated to those who specifically deal with DSRs; 

• Data Retention and Deletion: to address data retention obligations and associated business needs, data archiving and deletion.

(ii) Data Maps: Records of Processing Activities as required under Art. 30 GDPR

(iii) Data Protection Impact Assessments as required under Art. 35 GDPR

(iv) Privacy Notices as required under Art. 13 GDPR 

(v) Inter Affiliate Agreements to maintain adequate level of protection of processing of Personal Data between entities from the Company Group

​2.3.2 Documentation Designed to Implement the Company’s Risk Model

(i) Description of risks and the metrics to measure the risks;

(ii) Risk model to be embedded in New Business Process Approval Policy and Data Breach Management Policy. 

​2.3.3. Documentation describing the Company’s Technical and Organization Measures 

(i) The Company issues Standard Operating Procedures for specific functions processing personal data in order to ensure processing is compliant with GDPR;

(ii) The Company shall maintain adequate physical, electronic, and administrative security, at least to the level of industry standards, designed to protect Personal Data;

(iii) In retaining Services Providers that Process Personal Data on the Company’s behalf, the Company must follow the principle of “privacy by design,” and assess such Service Providers in accordance with the New Business Process Approval Policy;

(iv) The Company shall direct all Services Providers Processing Personal Data on the Company’s behalf to demonstrate appropriate safeguards for Processing Personal Data.

2.4 Audit and Control

The Company makes sure that independent internal audit and control functions monitor and assess the level of compliance in terms of privacy protection.

​​​​

3. Processing of Personal Data

3.1 Compliance with Applicable Law

The Company shall comply with GDPR and any other applicable legislation relating to Personal Data which is within the scope of this Policy as set out above and will Process Personal Data in accordance with such laws.

3.2 Lawfulness, Fairness and Transparency

The Company shall not Process Personal Data without having a lawful reason to do so. The Company may Process Personal Data where necessary for the performance of a contract to which an individual is a party, when it is necessary for compliance with a legal obligation to which the Company is subject or where required, or with lawful prior consent. In certain circumstances, the Company may also Process Personal Data for the Company’s legitimate interests, except where such interests are overridden by an individual’s interests or fundamental rights and freedoms.

Prior to Processing Personal Data, the Company shall provide a fair and complete privacy notice, unless providing such notice is impossible or requires disproportionate efforts to provide.The Company’s privacy notices shall be designed to address: (i) who is responsible for the Processing of Personal Data, (ii) purposes of Processing, (iii) parties with whom Personal Data is shared, and (iv) a Data Subject’s rights under applicable law and how to exercise them.

When required by applicable law, we will seek an individual’s prior consent to processing (e.g., before collecting any Sensitive Personal Data).

3.3 Legitimate Purpose, Limitation and Data Minimisation

The Company must Process Personal Data solely in accordance with specified, explicit, and legitimate purposes and not in a manner that is incompatible with such purposes.

When the Company acts for its own purposes, such Processing includes (but is not limited to) the following purposes: recruitment management, human resources management, accounting and financial management and related controls and reporting, finance, treasury and tax management, risk management, management of employees’ safety, provision of active directory, IT tools or internal websites and any other digital solutions or collaborative platforms, IT support management, including infrastructure management, systems management, applications, health and safety management, information security management, client relationship management, bids, sales and marketing management, supply management, internal and external communication and events management, compliance with anti-money laundering obligations or any other legal requirements, data analytics operations, legal corporate management and implementation of compliance processes.

The Company must only process Personal Data that is adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed.

3.4 Data Accuracy and Storage Limitation

The Company must act in accordance with industry standards to ensure that Personal Data that the Company controls is accurate and up to date.The Company must only retain Personal Data for as long as necessary for the lawful purposes for which such Personal Data was collected, including for the purposes of satisfying any legal, accounting or reporting requirements and, where required for the Company to assert or defend against legal claims, until the end of the relevant retention period, or until the claims in question have been settled.

Upon expiration of the applicable retention period, the Company shall securely destroy Personal Data in accordance with applicable laws and regulations.

3.5 Security of Personal Data

The Company has implemented reasonable and appropriate technical and organizational measures to protect Personal Data against accidental or unlawful alteration or loss, or from unauthorized, use, disclosure, or access, in accordance with our Global Information Security Policy.

​

The Company has also implemented a Data Breach Management Policy, designed to ensure that, in the event of a Personal Data breach, the persons affected by the incident are protected against damage and that the competent supervisory authority is properly notified in a timely manner.

3.6 Disclosure of Personal Data

The Company may only share Personal Data in the following circumstances:

(i) With Company entities for the purposes described in this GDPR Compliance Policy;

(ii) With third parties including certain Service Providers retained in connection with the purposes described in this GDPR Compliance Policy and the services the Company provides; 

(iii) With companies providing services for money laundering and terrorist financing checks and other fraud and crime prevention purposes and companies providing similar services, including financial institutions and regulatory bodies with whom such Personal Data is shared; 

(iv) With courts, law enforcement authorities, regulators, government officials or attorneys or other parties where it is reasonably necessary for the establishment, exercise or defense of a legal or equitable claim, or for the purposes of a confidential alternative dispute resolution process;

(v) With Service Providers who the Company engages within or outside of the Company, domestically or abroad (e.g., shared service centers, information security management, etc.), to process Personal Data for any of the purposes listed above on the Company’s behalf and in accordance with our instructions only; 

(vi) With clients where necessary and only where permitted by law;

(vii) If the Company sells or buys any business or assets, in which case the Company may disclose Personal Data to the prospective seller or buyer of such business or assets to whom we assign or novate any of our rights and obligations.

​​

4. Data Subject Rights

The Company is committed to ensuring that individuals can exercise their rights under applicable laws. The table below summarises Data Subject Rights.A more detailed process for responding to Data Subjects requests, as well as instructions for how to execute Data Subject Rights, are set forth in Data Subject Requests Handling Policy.