Privacy Notice

We have appointed a Data Protection Officer (“DPO”). For any questions relating to the processing and protection of your Personal Data you can contact the HR department of Unilever (“HR Department”) or reach out to the DPO via the following e-mail address dataprivacy.advisorSL@unilever.com

Personal data is any information relating to an identified or identifiable individual. An identifiable individual is one who can be identified, directly or indirectly, in particular, by reference to an identification number or to one or more factors specific to his physical, physiological, economic, cultural or social identity.

You are not required to provide Unilever the personal data that we request, but if you choose not to do so, we may not be able to administer your employment without certain key information (such as your name, address and identification details) or respond to any queries you may have.

Personal Data collected directly from you

We process personal data that we collect directly from you when you join Unilever during the recruitment and onboarding process and during your employment at Unilever. Examples of such data are: your personal contact details, date of birth, citizenship, bank account details, gender, information regarding work experience and education etc.

We also generate personal data during your employment at Unilever. Examples of personal data we generate during your employment are: information relating to your performance, payroll information, timesheets, information relation to leave or absence, training during your employment, and information necessary for administrative purposes, such as your employee ID, your designated MAC or IP address or device ID that allows each of your devices (mobile, laptop, fixed computer or other user equipment, whether personal or Unilever issued) to connect to the Unilever network, and your work level etc.

Personal Data collected from third parties

Sometimes we also process personal data which is provided to us by third parties. Examples of such third parties including former employees, recruitment agencies, car lease agencies, background screening providers, employee support service providers etc.

Some data is, due to its nature, more sensitive than other personal data. Under the applicable privacy legislation, some data has been categorized under special categories of personal data. We only process these special categories of personal data in limited circumstances and only when this is allowed under applicable privacy legislation.

Due to the nature of thespecial categories of personal data we consider these as high risk personal data processing activities and will apply the appropriate technical and organizational measures to keep this data secure.

Unilever will only process your personal data for specified and lawful processing purposes which are described in this Notice. The legal grounds on which we may base our processing activities include:

Performance of a contract

The processing is necessary for the performance of a contract we have with you. For example in fulfilling your employment contract, we will process your bank details for payroll purposes.

Legal obligation

The processing is necessary for us to comply with our legal obligations (not including contractual obligations). For example: compliance with tax provisions and court orders.

Responding to an emergency

The processing is necessary to respond to an emergency that threatens the life, health or safety of you. For example: In case of a medical emergency at the workplace.

Legitimate interest

The processing is necessary for the purposes of Unilever or a third party’s legitimate interest. Examples of our legitimate interests include reporting and auditing, managing our business operations, market research, analysis and statistical purposes, corporate acquisitions and mergers, and security of our operations, systems and premises including monitoring systems, networks, e-mails and IT activity to prevent misuse and fraud.

Consent

In very limited situations we will ask you for consent for the processing of your personal data. This will be the case for example when we ask you for consent to use a picture of you that was made during an event for, for instance, recruitment purposes or your personal preferences when participating to a survey.

We may process your personal data for various purposes, which are described below.

HR Services

We process your personal data in order to provide HR Support to manage all aspects of your (former) employment relationship with Unilever, including absence monitoring, performance appraisal, conducting investigations including any disciplinary and grievance processes, administering termination of employment, complying with legal or regulatory obligations including in relation to any pending or threatened litigation, establishing, exercising or defending legal rights and administering data subject requests. We may also use it for the following non exhaustive purposes:

• For statistical purposes, to understand the composition of our organisation, our labour productivity, style of working and performance, so that we can optimise the organisation and performance of Unilever. For example, to look at how graduate recruits as a cohort have performed over time, to assess how good our development programmes are.
• To understand and assess individual performance, productivity and risk factors, for example the risk of attrition. We may use information on when and who you interact with using Unilever systems, such as by sending emails or instant messages or working through tools such as Chatter, Sharepoint, Microsoft Teams and other workplace related technologies, to understand how you and your colleagues collaborate, to help us optimise the organisation. We may also use scheduling, calendar data and/or physical and logical access control data to understand where the business is spending its time. Data will be aggregated and anonymised where relevant. Similarly, we may use any of the HR data that you have given us to help assess performance.
• To understand the needs, wants and feedback from our employees, so that we can enhance the working environment for all.

 

Personal Data categories	Lawful grounds	Categories of Recipients with whom data maybe shared
Personal financial information; Personal financial information; Compensation and benefits information;  Employment information; Leave administration; Performance information; IT information. Special Categories of Personal Data  Data concerning health; Background checks including data on criminal convictions.	Necessary to carry out your employment contract;                      Necessary to comply with     legal obligations (social security and social protection laws, tax laws);   Necessary for the purposes of the legitimate interests pursued • by Unilever or a third party; Necessary to be able to respond to an to respond to an emergency that threatens the life, health or safety of you.	Pension providers; Benefit providers; IT suppliers; Cloud service providers; Payroll firms; External advisors such as law firms or auditors; Public authorities or bodies, including in the course of investigations of mergers or acquisitions, or criminal or regulatory investigations

Compensation and benefits

We also process your personaldata for thepurposeofexecution and administration ofbenefits and compensation.

 

Personal Data categories	Lawful grounds	Categories of Recipients with whom data maybe shared
Personal Information; Personal financial information; •             Compensation and benefits information;  Employment information; •       Performance information. Special Categories of Personal Data:   Records for tax purposes or answering compelling orders to provide information to public authorities.	Necessary to carry out the                        employment contract with  you;   Necessary to comply with a  legal obligation (social security  • and social protection laws, tax  laws); Necessary for the purposes of  the legitimate interests pursued by Unilever or a third party.	Pension providers; Benefit providers; Payroll firms; IT suppliers; Cloud service providers; External advisors such as law firms or auditors; Public authorities in the course of criminal or administrative investigations.

Recruitment and onboarding

We process personal data for recruitment and onboarding purposes such as candidate selection and assessment, including pre-employment screening for validation of identity and background and reference checks, preparation of job offers, employee orientation, managing new hire activities, assigning company property and to provide secure access to Unilever premises. We are increasingly leveraging the benefits of statistics, analytics and machine learning toimprovetherecruitment andonboarding processina waythatmoreefficiently,andeffectivelymatches the right skills with the right opportunities.

Automated decision-making

In some instances, Unilever processes your Personal Data using automated means to screen applicants. An automated decision is a decision which is made solely by automatic means, where no humans are involved in the decision-making process related to your personal data, but in all recruitment decisions, there will be human intervention. For example:

• Unilever uses game simulations of science-based behavioural assessments and data science techniques to assess prospective employees. Candidates are required to play a set of games and the behavioural patterns exhibited during gameplay are assessed by a Unilever customised algorithm to predict the candidate’s potential for a specific role. This screening algorithm is regularly tested to ensure it remains fair, effective and unbiased.

We will not make decisions based solely on automated means when such automated decisions create or are likely to create an irreversible and continuous impact on your rights and freedoms under any written law. If we do so, we notify you and provide you with clear information about our decision to rely on automated processing to help us make our decision, and our lawful basis for doing so. For example, Unilever processes your personal data using automated means only if it is necessary for the entering into or the performance of a contract with you, or when you have given your consent.

You have the right to request the review of any solely automated decision when such automated decisions create or are likely to create an irreversible and continuous impact on your rights and freedoms under any written law.

 

Personal Data categories	Lawful grounds	Categories of Recipients with whom data maybe shared
Personal information; Personal financial information;          Compensation and benefits information; Employment information; Recruitment information;   IT information; Behavioural information. Special Categories of Personal Data    Data concerning health Background checks including data on criminal convictions;  Biometric information;  Facial recognition.	Your consent; Necessary to carry out the employment contract with you; Necessary to comply with a legal obligation (social security and social protection laws, tax laws);  Necessary for the purposes of the legitimate interests pursued by Unilever or a third party.	Pension providers; Screening/background providers;  IT suppliers; Cloud service providers;      External advisors such as recruitment agencies, law firms or auditors;  Public authorities in the course of investigations of mergers or acquisitions, or criminal investigations.

Security management

We also process your personal data for the purpose of ensuring the security of Unilever premises and Unilever-held information, as well as the safety of our employees. This may include processing personal data for the identification and authentication of employees, usernames and password management, video monitoring systems, logging, e-mail monitoring, keeping a list of emergency contacts, occupational health and safety management, fraud investigations and management, for detecting or preventing the loss of intellectual property or confidential information, and monitoring device usage for device, network and infrastructure management purposes, in line with privacy laws and other applicable legislation.

 

Personal Data categories	Lawful grounds	Categories of Recipients with whom data maybe shared
Personal information;  Compensation and benefits information;    IT information;  CCTV images and content. Special Categories of Personal Data •             Data concerning health Background checks including data on criminal convictions; Data concerning health;  Behavioural information from e-mail monitoring and mobile device management	Necessary to comply with a legal obligation; Necessary for the purposes of  the legitimate interests  pursued by Unilever or a third party.	Screening/background providers IT suppliers; Cloud service providers; External advisors such as, law firms or auditors; Public authorities in the course of investigations of mergers or acquisitions, or criminal investigations.

Data about you to further Unilever’s equal opportunity and diversity policies and obligations

 

Personal Data categories	Lawful grounds	Categories of Recipients with whom data maybe shared
Personal information    (including data relating to gender);  Personal financial information;  Compensation and benefits information. Special Categories of Personal Data Data relating racial or ethnic origin, sexual orientation; Data concerning health;	Consent   Necessary for the purposes of  the legitimate interests pursued by Unilever or a third party.	Public authorities; External advisors such as, law firms or auditors.

HR Information & Analytics

We aim to continuously improve and drive sound decisions about human resources, talent and organisation, based on timely and accurate people and organisation insights and to contribute to the development of organisational diagnostic capabilities. To this end, we are increasingly leveraging the benefits of statistics, analytics and machine learning.

 

Personal Data categories	Lawful grounds	Categories of Recipients with whom data maybe shared
Personal information; Personal financial information; Compensation and benefits information; Employment information;  Leave administration; Performance information; IT information. Special Categories of Personal Data   Data concerning health Data relating racial or ethnic origin, sexual orientation;  Data concerning health.	Necessary for the purposes of the legitimate interests pursued by Unilever.	IT suppliers; Cloud service providers External advisors such as, law firms or auditors.

When we process your personal data, we do this based on the following privacy principles:

Purpose limitation

Your personal data will be only processed for specified and lawful processing purposes, as detailed in this Notice and will not be further processed in a manner incompatible with those purposes.

Data Minimization

We will only process personal data that is adequate, relevant and is limited to what is necessary. This also includes restricting access to personal data to only those functions/groups offunctions that need this personal data to carry out their work.

Personal data is accurate and, where necessary, kept up to date

We take appropriate measures to ensure that the personal data that we process about you is accurate and up to date. For this purpose, we provideyou with theability to correct, amend, or delete inaccurate personal data where this is applicable, in accordance with relevant laws. In some instances, you can make these changes yourself in our HR applications such as Workday. Otherwise, please contact the HR Department for more information on how you can correct, amend or delete your inaccurate data.

Personal Data is held for no longer than is necessary

In principle we do not hold your personal data for longer than is required for the original purpose it was collected, unless those purposes are compatible with the original purpose, or we are under a legal obligation to retain it for longer. The purpose of retention could be a legal obligation, such as employment laws, tax law or another legitimate reason, for example to prove our rights and obligations. When personal data is no longer required to be stored, we take appropriate steps to securely delete or anonymize. For specific applicable retention periods please refer to the Unilever Data Retention Standard.

Personal Data is protected by appropriate level of technical and organizational measures

The right security controls are in place to protect against unauthorized and unlawful processing and against accidental loss or destruction of, or damage to, personal data. This includes both technical controls (e.g. pseudonymization/encryption, role-based access control) and organizational controls (e.g. training and awareness). For moreinformation on howUnilever safeguards information, pleasevisit the Information Protection Zone.

Personal Data is only transferred to third parties and/or outside Sri Lanka if there is adequate protection

Unilever is a global company, and therefore we may need to transfer data internationally within the Unilever organization. We are fully committed to ensuring that there are adequate safeguards in place, as required by applicable laws.

Further, where we transfer personal data to third parties, we will ensure that the we follow the applicable data privacy laws of Sri Lanka in relation thereto.

In such context and where required, Unilever will send your personal data out of Sri Lanka to any country prescribed by the Data Protection Authority of Sri Lanka pursuant to an adequacy decision, or if it is to a country not so prescribed, only when Unilever is satisfied that:

(i) regardless of transfer of your personal data to such country, we are able to comply with our mandatory obligations under the data protection law of Sri Lanka, and

(ii) only after executing an appropriate instrument as may be prescribed by the Data Protection Authority of Sri Lanka, with the recipient of data in such country.

 

When we process your personal data, you have certain rights with respect to the data we process. These rights are listed and explained below:

The right to information

You have the right to be informed about the collection and use of your personal data by us. This information is shared with you through this Privacy Notice and any localized annexes.

Right to access

You have, at any time, the right to request access to the personal data we process about you. When you exercise this right, Unilever must provide a copy of the Personal Data to which you have requested access.

Right to rectification

You are entitled to require Unilever to rectify any errors in your personal data. This includes inaccurate or incomplete personal data. We must take reasonable steps to ensure that personal data which is inaccurate is rectified without delay.

Right to erasure

Under certain circumstances, you are entitled to request Unilever to erase your personal data. Please note that this right only applies under certain circumstances and is not absolute.

Right to object

In certain situations, you have the right to object to the processing of your Personal Data, in which case, we will stop processing your personal information unless the applicable law permits us to process your personal information. Such instances include when the processing is based on legitimate interests, including situations where we use profiling, for instance when Unilever uses a screening algorithm to predict if you are fit for a specific role.

Right to withdraw consent

Where we rely on your consent for the processing of your personal data, you always have the right to withdraw your consent.

Right not to be evaluated on the basis of automated decision making

You also have the right to request for a review of a decision where such decision is based solely on automated processing and has created or which is likely to create an irreversible and continuous impact on your rights and freedoms under any written law.

Exercising your rights

To exercise these rights or to receive more information, please contact the HR Department.

In the event you make such request, we will respond to you, within twenty one (21) working days and inform you whether your request has been granted, refused (with reasons therefor) or whether we have refrained from further processing your personal information.

We sometimes need to request specific information from you to help us confirm your identity and to ensure that you have the right to exercise any of your rights in relation to your personal information.

We may refuse your request based on certain grounds to the extent permitted by applicable law.

If your request has not been resolved to your satisfaction, please email dataprivacy.advisorSL@unilever.com

Right to lodge a complaint with the Data Protection Authority

You have the right to lodge a complaint directly with the Data Protection Authority about how your personal data is processed within Unilever, but please do check if the HR Department can help you first or use the BI Employee Whistleblowing Hotline and report a Code Incident.