1. Personal Information We Collect

We may collect Personal Information about you from the different sources listed below. In this Policy, "Personal Information" means any information relating to an identified or identifiable natural person. Where applicable, we indicate whether and why you must provide us with your Personal Information, as well as the consequences of failing to do so. If you do not provide Personal Information when requested, you may not be able to benefit from Responsibility Works if that information is necessary to provide you with the program or if we are legally required to collect it.

Information provided by you

• Responsibility Works. When you participate in our employee training tool, Responsibility Works, you may provide us with Personal Information, such as your name and contact details (including home or work address, email address and phone number), your job title and the company you work for.
• Correspondence and other communications. When you contact us via email, or by other means, you may provide us with Personal Information, such as your name and contact details (including home or work address, email address and phone number), your job title and the company you work for, your company size, company location and company contact details, and the content, date and time of our communications.

Information collected from Cookies and similar technologies

We and third parties may automatically collect information about your online activities via cookies, invisible tags, and similar technologies (collectively "Cookies") in your browser. This information may include Personal Information, such as your IP address, web browser and device type and information about your interactions with Responsibility Works, such as the time of your visit to Responsibility Works and where you have clicked. Below is an overview of the types of Cookies we and third parties may use to collect personal information.

• Strictly Necessary Cookies. Some Cookies are strictly necessary to make Responsibility Works available to you. We cannot provide you with Responsibility Works without this type of Cookies. We use the following necessary Cookies:

  Name	More Information	Retention
  Stateless Cookies	Stateless cookies are self-contained; they include all session information that you need (for authenticated users, the user ID) and reside on the client.	Inactivity timeout after 4320 minutes, Required log in after 10080 minutes.

  Please review your web browser's "Help" file to learn the proper way to modify your cookie settings. Please note that if you delete or choose not to accept Cookies from Responsibility Works, you may not be able to utilize the features of Responsibility Works to their fullest potential.

Information collected from other sources

• Information from third parties. We may obtain Personal Information about you from third parties, in particular through identity providers. This information may include name, title, company name, addresses, telephone number, and email address. Session tokens for authentication are stored via Auth0 and adhere to their respective terms: https://auth0.com/docs/manage-users/cookies.

2. How We Use Personal Information

We may use your Personal Information for the following purposes:

• Providing Responsibility Works. We use Personal Information about you to operate, maintain, debug and provide Responsibility Works.
• Analytics and product development. We use Personal Information about you to analyze usage trends and preferences to improve Responsibility Works, as well as to develop new products, services, features, and functionalities.
• Communicating with you and your employer. We may use your contact details to contact you and your employer, provide you with updates and other information relating to Responsibility Works, such as the results of the program, provide information that you request, respond to comments and questions, and otherwise provide customer support.
• Legal. We may use your Personal Information to enforce this Policy, to defend our legal rights and to comply with our legal obligations and internal policies. We will also use your Personal Information as necessary to comply with applicable laws and regulations, or comply with judicial processes or government agency requests.
• Fraud. To find and prevent fraud, and respond to trust and safety issues that may arise.

3. On What Legal Grounds We Process Personal Information

If you are located in the European Economic Area, Switzerland or the United Kingdom ("Europe"), we only process your Personal Information based on a valid legal ground, including when:

• Consent. You have consented to the use of your Personal Information, for example when you consent to take part in Responsibility Works. You can withdraw consent at any time.
• Contract. We need your Personal Information to provide you with Responsibility Works, including responding to your inquiries.
• Legal obligation. We have a legal obligation to use your Personal Information, for example to comply with tax and accounting obligations.
• Legitimate interest. We or a third party may have a legitimate interest in using your Personal Information, in particular for product development and internal analytics purposes, and otherwise to improve the safety, security, and performance of Responsibility Works. We only rely on our or a third party's legitimate interests to process your Personal Information when these interests are not overridden by your rights and interests.

4. How We Share Your Personal Information

We may disclose Personal Information to third parties if you consent to us doing so, as well as in the following circumstances:

• Affiliates. We may share Personal Information about you to our affiliates for any purposes described in this Privacy Policy.
• Your employer. We may disclose the results of your Responsibility Works program to your employer and details on when you completed it.
• Vendors and service providers. We work with third party service providers to operate Responsibility Works, including by providing IT-hosting, maintenance, and other services for us. These third parties may have access to or process your Personal Information as part of providing those services for us.
• Marketing. We do not rent, sell, or share information about you with nonaffiliated companies for their direct marketing purposes unless we have your permission.
• Legal. We may disclose your Personal Information if required to do so by law or in the good-faith belief that such action is necessary to comply with applicable laws, in response to a court order, judicial or other government subpoena or warrant, or to otherwise cooperate with law enforcement or other governmental agencies. We also reserve the right to disclose your Personal Information that we believe, in good faith, is appropriate or necessary to (i) take precautions against liability, (ii) protect ourselves or others from fraudulent, abusive, or unlawful uses or activity, (iii) investigate and defend ourselves against any third-party claims or allegations, (iv) protect the security or integrity of Responsibility Works and any facilities or equipment used to make Responsibility Works available, or (v) protect our property or other legal rights, including to enforce our agreements, or the rights, property, or safety of others.
• Merger, Sale, or Other Asset Transfers. We may disclose or otherwise transfer Personal Information to an acquirer, successor or assignee as part of any merger, acquisition, debt financing, sale of assets, or similar transaction, as well as in the event of an insolvency, bankruptcy, or receivership in which information is transferred to one or more third parties as one of our business assets.
• Consent. We may also disclose Personal Information with your permission.

5. Your Rights in Relation to Your Personal Information

If you are located in Europe, you have the rights described below, which you may be able to exercise in relation to your Personal Information:

• You may request access to the Personal Information we maintain about you, update and correct inaccuracies in your Personal Information, restrict or object to the processing of your Personal Information, have your Personal Information anonymized or deleted, as appropriate, or exercise your right to data portability to easily transfer your Personal Information to another company. In addition, you have the right to lodge a complaint with a supervisory authority, including in your country of residence, place of work or where an incident took place.
• You may withdraw any consent you previously provided to us regarding the processing of your Personal Information at any time and free of charge. We will apply your preferences going forward and this will not affect the lawfulness of the processing before you withdrew your consent.

You may exercise these rights by contacting us using the contact details at the end of this Policy. Before fulfilling your request, we may ask you to provide reasonable information to verify your identity. Please note that there are exceptions and limitations to each of these rights, and that while any changes you make will be reflected in active user databases instantly or within a reasonable period of time, we may retain Personal Information for backups, archiving, prevention of fraud and abuse, analytics, satisfaction of legal obligations, or where we otherwise reasonably believe that we have a legitimate reason to do so.

6. Cookie Preferences

You can block Cookies by setting your internet browser to block some or all Cookies. However, if you use your browser settings to block all Cookies (including essential Cookies) you may not be able to access all or parts of Responsibility Works. You can change your browser settings to block or notify you when you receive a cookie, delete Cookies. Please refer to your browser instructions or help screen to learn more about how to adjust or modify your browser settings. If you do not agree to our use of Cookies or similar technologies which store information on your device, you should change your browser settings accordingly. You should understand that some features of Responsibility Works may not function properly if you do not accept Cookies or these technologies. Where required by applicable law, you will be asked to consent to certain Cookies and similar technologies before we use or install them on your computer or other device.

7. Third-Party Sites

Responsibility Works contains features or links to websites and services provided by third parties (e.g., third parties operating social media pages). Any information you provide on third-party websites or services is provided directly to the operators of such websites or services and is subject to those operators' policies governing privacy and security, even if accessed via Responsibility Works. We are not responsible for the content or privacy and security practices and policies of third parties to which links or access are provided through Responsibility Works. We encourage you to learn about third parties' privacy and security policies before providing them with your Personal Information.

8. Data Security

We use physical, organizational, and technical safeguards that are designed to improve the integrity and security of Personal Information that we collect and maintain. However, as no electronic transmission or storage of information can be entirely secure, we can make no guarantees as to the security or privacy of your Personal Information.

9. Data Retention

We take measures to delete your Personal Information or keep it in a form that does not permit identifying you when this information is no longer necessary for the purposes for which we process it, unless we are required by law to keep this information for a longer period. When determining the retention period, we take into account various criteria, such as the type of products and services requested by or provided to you, the nature and length of our relationship with you, the impact on the services we provide to you if we delete some information from or about you, mandatory retention periods provided by law and the statute of limitations.

10. Cross-Border Data Transfers

We may transfer your Personal Information to countries other than the country where you are located, including to the U.S. or any other country in which we or our service providers maintain facilities. If you are located in Europe or other regions with laws governing data collection and use that may differ from U.S. law, please note that we may transfer your Personal Information to a country and jurisdiction that does not have the same data protection laws as your jurisdiction.

We comply with applicable legal requirements when transferring Personal Information to countries other than the country where you are located. For instance, we may transfer your Personal Information to countries for which adequacy decisions have been issued or use contractual protections for the transfer of Personal Information. If you are located in Europe, you may contact us as specified below to obtain a copy of the safeguards we use to transfer Personal Information outside of Europe.

11. Changes to this Policy

We may update this Policy from time to time to reflect changes in our privacy practices. If we modify this Policy, we will indicate the date of the latest revision at the top of this Policy.

12. Our Contact Information

If you have any questions, comments, or concerns about our processing activities, please email us at [email protected] or by writing to us at: 1250 I Street NW #400, Washington, DC 20005.