Privacy Notice

Latest revision: October 1, 2026

Introduction

This privacy notice (Privacy Notice) is issued on behalf of Rimkus Consulting Group, Inc., its subsidiaries, affiliated companies, and related companies, including Rimkus New York, PLLC. “Rimkus,” “we,” “us” or “our” in this Privacy Notice refers to the relevant company in the Rimkus Group responsible for processing your data.

Rimkus strives to meet or exceed applicable privacy-law requirements in the countries, regions, and locations where it conducts business.

We will only use your personal information for the purposes described in this privacy policy, processing required for our business relationship, or, to the extent that you are a third party data subject, as needed to process data on behalf of our client, with whom you have a contractual or other business relationship, unless (1) we have obtained your consent to use it for other purposes; (2) we have provided additional or separate information prior to collecting information; or (3) we are otherwise permitted or required by applicable law to use it for such other purposes.

Data subjects have the right, at any time, to request access to, rectification or erasure of their personal data, or restriction or objection to processing, as well as the right to data portability, or to withdraw the consent given.

Services

Rimkus provides a wide range of engineering, scientific, design, and technical consulting services, including forensic consulting, dispute resolution, quantum and delay, human factors, and solutions for the built environment. Rimkus serves clients in all areas and specialities, including, but not limited to, law firms, private companies, real estate companies, management groups, insurance companies, and government agencies. Rimkus also offers support for product development, particularly in the consumer, industrial, medical device, and healthcare sectors.

Change

We may update this Privacy Notice from time to time. We will post the revised notice with an updated revision date and provide any additional notice, and obtain consent, where required by applicable law. Continued use of our Services does not constitute consent where affirmative consent is legally required.

1. Data We Collect

Personal data, or personal information, means any information about an individual that identifies an individual either directly or indirectly, by reference to other information we have access to. It does not include data where the identity has been removed (anonymous data).

The personal data we collect, and how we collect it, depends upon how you interact with us. Categories of personal data that we collect include:

We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:

Contact information such as name, email address, and telephone number.
Biographical Information such as job title, employer, photograph and video or audio content.
Technical Information such as internet protocol (IP) address, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access this website.
Usage Information such as information about how you use our website, products, and services.
Marketing and Communications Preferences and related information such as meal preferences, feedback and survey responses and your preferences in receiving marketing from us.
Special categories of data such as race and ethnicity, demographics, limited health information, or other information specifically collected as required for a particular project.
Other information that may arise related to a specific project or as shared by you for purposes of us providing service or in connection with educational courses and events that we offer.

1.2 Data from others

We may receive data about you when you use some of the services provided by our clients, including, but not limited to, insurers, loss adjusters, lawyers, property managers, property owners, businesses requesting technical or scientific consulting services, etc. As such, the client may share certain limited information as required for our services and as may be consistent with your relationship with our client or as part of the loss, event, or subject for which our professional services have been engaged. Any such information is limited to the amount necessary for the performance of our services.

2. Use of Cookies

A “cookie” is a small amount of data transferred to your browser and read by the web server that placed it there. It works as a sort of identification card, recording your preferences and previously entered information. By using cookies, the information you previously provided can be retrieved on your next visit to the website so that your navigation time is reduced, and your use of the website is simplified. Cookies are uniquely assigned to you and can only be read by a web server in the domain that issued the cookie. Web beacons may be used to deliver the cookie and to compile the statistics about our website, such as how many people visited a particular page or clicked on certain links.

Portions of our websites use cookies to help ensure the integrity of any registration process or to help provide personalised service and deliver content specific to your interests.

You can set your browser to decline cookies if you prefer. If you do so, you may not be able to get the benefit of some of the features of our website.

3. How We Use Your Data

Uses of personal data	Our lawful basis for the use of your personal data
To provide news and information related to services including email briefings and newsletters; to give access to online tools and to invite you to events that we organise or sponsor.	Where you have consented and expressed a preference to receive such marketing communications; or where it is appropriate and relevant to our business relationship with you.
To send you details of initiatives that we coordinate.	Where you have consented and expressed a preference to receive such marketing communications; or where it is appropriate and relevant to our business relationship with you
To operate suppression lists to ensure that you do not receive communications if you object or unsubscribe	To respect your rights and comply with our legal obligations
To collect insights into how you interact with our services so that we can personalise our communications with you and improve our websites and services.	Where we have your consent or where it is necessary so that we can deliver our websites and online services effectively
To maintain contact with past employees and consultants.	To promote networking and communication with and between Rimkus and its former employees and consultants
To conduct client due diligence and conflict checks when on-boarding a new client or supplier.	To comply with our legal and regulatory obligations including compliance with anti-money laundering legislation, anti-bribery, fraud, and crime prevention.
To provide professional advice and related relevant services, to manage and administer our business relationships, including to communicate with our clients, their employees and representatives, to manage billing and payments and to keep records.	To fulfill our contract with our client(s) and to comply with legal and regulatory obligations including accounting, tax and data privacy
To maintain security and manage access to our offices, systems and our websites	To comply with legal obligations, and because we have a legitimate interest in maintaining the security of our buildings, websites and networks
Enforcing our terms of engagement, website terms of use and other terms and conditions	To protect our legal interests
Sharing personal data in connection with acquisitions and transfers of our business	To comply with legal obligations and to facilitate the transaction
To manage our supply chain including identifying and maintaining contact with service providers	Where necessary for the efficient running of our business
Other purposes that we have identified at the point of collection.	Where we have your consent or for other legitimate business purposes.

4. Marketing and advertising

Interest-Based Advertising

We work with third parties such as ad networks and other advertising companies that use their own tracking technologies (including cookies, web beacons and pixel tags) on our website to provide you with tailored advertisements across the Internet. This is a common marketing practice referred to as interest-based or online behavioral advertising. These companies may collect information about your activity on our website and third-party websites (such as web pages you visit and your interaction with our advertising and other communications) and use this information to build a profile of your interests, make predictions about your preferences, develop personalized content and deliver ads that are more relevant to you on third-party websites. This information may also be used to evaluate the effectiveness of our online advertising campaigns. However, unless otherwise stated at the point of data collection or as may be contractually or legally required related to our business and business services, we do not provide your personal data to third parties for any use other than as necessary for our business purposes.

Opting-out of Interest-Based Advertising: To adjust your preferences or exercise control over the third parties who collect data on our website for interest-based advertising purposes, please contact us at [email protected].

Please note that even if you opt-out of interest-based advertising by a third party, these tracking technologies may still collect data for other purposes including analytics and you will still see ads from us, but the ads will not be targeted based on behavioral information about you and may therefore be less relevant to you and your interests.

To successfully opt out, you must have cookies enabled in your web browser (see your browser’s instructions for information on cookies and how to enable them). Your opt-out only applies to the web browser you use so you must opt-out of each web browser on each computer you use. Once you opt out, if you delete your browser’s saved cookies, you will need to opt-out again.

5. Your choices and obligations

5.1 Data retention

Rimkus retains personal information only for as long as necessary to fulfil the purposes for which it was collected, including providing services to clients, complying with legal and regulatory obligations, resolving disputes, enforcing agreements, and maintaining business records. Personal information is securely deleted, anonymized, or otherwise disposed of when it is no longer required for these purposes.

Information related to client assignments may vary depending on the type and nature of the assignment. Forensic assignments (or portions thereof) are generally retained for seven (7) years following the conclusion of work on the assignment, unless otherwise instructed by the client. Building and architecture files may be retained for up to ten (10) years following conclusion of work on the assignment, unless otherwise instructed by the client. Alternative retention periods may apply where required by nature of the services, contract, or applicable law.

Rimkus may retain information for a longer period where necessary to comply with legal obligations, enforce its rights, preserve evidence in connection with actual or anticipated litigation, or comply with a litigation hold. Information subject to a litigation hold will not be deleted until the hold has been lifted.

Where information is no longer needed and is not subject to a legal or business retention requirement, Rimkus will take reasonable steps to securely delete or de-identify the information.

5.2 Rights to Access and Control Your Personal Data (this may vary as per applicable laws in each region)

Delete Data: You can ask us to erase or delete all or some of your personal data (e.g., if it is no longer necessary to provide Services to you) unless we are not allowed by law or we have a right and reasonable basis to refuse such deletion.
Change or Correct Data: You can edit or request that we edit some of your personal data by contacting us. You can also ask us to change, update or fix your data in certain cases, particularly if it is inaccurate.
Object to, or Limit or Restrict, Use of Data: You can ask us to stop using all or some of your personal data (e.g., if we have no legal right to keep using it) or to limit our use of it (e.g., if your personal data is inaccurate or unlawfully held).
Right to Access and/or Take Your Data: You can ask us for a copy of your personal data and can ask for a copy of personal data you provided in machine readable form.

6. Other important information

6.1 Security

We implement security safeguards designed to protect your data, such as HTTPS and data loss prevention (DLP). We regularly monitor our systems for possible vulnerabilities and attacks. However, we cannot warrant the security of any information that you send us. We cannot guarantee that data will never be accessed, disclosed, altered, or destroyed through a breach of our physical, technical, or managerial safeguards.

6.2 Cross Border Data Transfers

We process data both inside and outside of the United States and rely on legal mechanisms to lawfully transfer data across borders. Countries where we process data may have laws which are different from, and potentially not as protective as, the laws of your own country.

Contact Details – Enterprise Level

Attention: Andrea E. Mirin, Global Privacy Officer
Rimkus Consulting Group, Inc.
12140 Wickchester Lane, Suite 300
Houston, Texas 77079
USA

Email: [email protected]

If you have been linked to this notice through Core Human Factors, Inc., please contact:

Core Human Factors, Inc.
1 Belmont Ave., Suite 704
Bala Cynwyd, Pennsylvania 19004
USA

Email: [email protected], attn.: Privacy Officer.

Rimkus reserves the right to verify the truthfulness of personal data provided at any time.

State Specific Information

This section supplements the other parts of our Privacy Policy and provides additional information for consumers who reside in specific US States. Rimkus complies with applicable data laws and regulations.

Most commonly, we will use your personal data in the following circumstances:

Where we need to perform the contract, we are about to enter into or have entered into with you, or to provide services on your behalf, including processing third party data on behalf of our clients, subject to our client’s relationship with the third-party data subject.
Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests, potentially including uses such as determining the success of our services and for determining marketing performance to share relevant information and offers about our products with clients and potential clients.
Where we need to comply with a legal obligation.

Generally, we do not rely on consent as a legal basis for processing your personal data although we may get your consent before sending third-party direct marketing communications to you or for your participation in research studies. You have the right to withdraw consent to marketing at any time by contacting us.

We endeavor to minimize the processing of personal data.

The data controller of information entered onto our website is Rimkus Consulting Group, Inc.

In certain circumstances, Rimkus is a co-data controller or processor of data with its clients in its business relationships. As a data processor, Rimkus processes data as directed by the data controller and as consistent with applicable laws.

Although we do not intend to collect any special categories of personal data about you without your direct knowledge, it is possible that our clients may share health or criminal offense/conviction information with us in a specific assignment. For example, health information about an individual injured in an auto accident, and information as to any accompanying police investigations and citations, may be received by us from our client pursuant to our services in a biomechanical engineering assignment or toxicology assignment. You may also provide information directly as a voluntary data subject.

Making A Privacy Rights Request

If you would like to exercise a privacy right, please contact us at [email protected]. Please identify the right you wish to exercise and the jurisdiction in which you reside. We may request information reasonably necessary to authenticate your identity and request. Where applicable, an authorized agent may submit a request on your behalf, subject to legally permitted verification requirements.

Access and Data Portability. You can use this type of request to confirm whether we are processing your Personal Information, access your Personal Information, and to obtain a copy of your PI in a portable format.

Correction. You may request that we correct inaccuracies in your PI, taking into account the nature of the PI and our purposes for processing it.

Deletion. You may request that we delete your PI. While we will endeavor to meet reasonable requests, under state privacy laws, we may decline to delete your PI under certain circumstances, including to complete transactions or provide services you have requested. We may also need to continue limited processing of data as required for security purposes, legitimate internal business purposes (subject to a balancing of interests and rights), compliance with law, or the exercise or defense of legal claims.

Opt-Out Requests. You may opt out of the following uses of your PI: (a) targeted advertising; (b) the sale of Personal Information (although not typically applicable); and (c) profiling in furtherance of decisions that produce legal or similarly significant effects concerning your economic situation, health, personal preferences, interests, reliability, behavior, location, or movements. We do not sell PI in exchange for money or engage in practices that qualify as profiling that produces legal or similarly significant effects under applicable state privacy law. To opt out of targeted advertising / non-monetary “sales” of PI, please contact us.

Appeals. If we deny a privacy rights request, we will provide the reason for the denial and, where applicable, instructions for appealing. You may submit an appeal through the same contact method used for the original request. If an appeal is denied, we will provide the appropriate regulator or attorney-general complaint method where required by law.

Please note that if you make a privacy rights request, we will retain the PI submitted in connection with your request for recordkeeping purposes.

Postal mail: If you no longer wish to continue receiving commercial postal mailings from Rimkus, you may follow the instructions or use the contact information contained in any such message. You may also contact us to remove yourself from our mailing lists.

Health Information Privacy and Security

In certain engagements, Rimkus may receive, access, maintain, process, or transmit personal health information or other health-related information on behalf of clients. Rimkus is committed to protecting the privacy, confidentiality, integrity, and security of such information and to complying with applicable data protection and healthcare privacy laws, including the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), the Health Information Technology for Economic and Clinical Health Act (“HITECH”), and other applicable legal and regulatory requirements where they apply to our services.

To protect health-related information, Rimkus maintains administrative, technical, and physical safeguards designed to:

Protect against unauthorized access, use, disclosure, alteration, or destruction of protected health information (“PHI”) and electronic protected health information (“ePHI”);

Maintain the confidentiality, integrity, and availability of information entrusted to us;
Identify, assess, and manage reasonably foreseeable privacy and security risks;
Restrict access to health information to authorized personnel with a legitimate business need;
Monitor and audit access to systems containing sensitive information; and
Support compliance with applicable legal, contractual, and regulatory obligations.

Our Privacy and Security Program

As part of our information governance and compliance framework, Rimkus:
Maintains policies and procedures addressing privacy, information security, records management, and incident response;
Designates personnel responsible for privacy and information security oversight;
Provides workforce training on data protection, information security, and confidentiality obligations;
Conducts periodic risk assessments and security reviews to identify and mitigate potential vulnerabilities;
Implements access controls, authentication measures, encryption technologies, network security protections, logging, monitoring, and other appropriate technical safeguards;
Maintains procedures for managing security incidents, investigating potential breaches, and fulfilling any applicable notification obligations; and
Requires employees, contractors, and relevant third parties to comply with applicable confidentiality, security, and data protection requirements.

Our Commitment

Rimkus is committed to:

Protecting the privacy and security of personal information and health-related information entrusted to us;
Maintaining appropriate safeguards that align with applicable legal, regulatory, and contractual requirements;
Limiting the collection, use, and disclosure of information to legitimate business purposes;
Promoting workforce awareness and accountability regarding information security and confidentiality; and
Continuously improving our privacy and security practices to address evolving risks and regulatory requirements.

Key Privacy and Security Controls

Our privacy and security program includes measures relating to:

Risk assessment and risk management;
Workforce security and confidentiality;
Information access management and least-privilege access controls;
Authentication and password management;
Encryption and secure transmission of data;
Security awareness and training;
Vendor and subcontractor management;
Incident response and breach management;
Backup, business continuity, and disaster recovery;
Physical security and device management;
Secure disposal and retention of information;
Audit logging and access monitoring; and
Periodic review and enhancement of privacy and security practices.

Disclaimer

Not all services provided by Rimkus involve the collection or processing of protected health information. Where HIPAA or other healthcare privacy laws apply to a particular engagement, Rimkus implements appropriate safeguards and contractual protections consistent with its legal and contractual obligations.

California

Under the California Consumer Privacy Act (CCPA), California residents have certain rights they may exercise either independently or through an authorized agent. Your California privacy rights are described below. For purposes of this Notice, in some places we have abbreviated or summarized CCPA terms or language. Terms defined under the CCPA that are used in this Notice shall have the same meanings as under the CCPA.

To submit a request to know, access, delete, or correct Personal Information, or to opt out of the sale or sharing of Personal Information, contact [email protected]. Where applicable, you may also use an authorized agent. We honor legally recognized opt-out preference signals, including Global Privacy Control, as required by California law.

If you submit a request to know, request to delete or request to correct, you may be asked to provide information to help us verify your identity.

Right to Know

You may request the categories and specific pieces of Personal Information we collected, the categories of sources, our business or commercial purposes, and the categories of third parties to whom we disclosed, sold, or shared Personal Information. We will respond within the period required by applicable law and will notify you of any permitted extension.

The categories of PI we have collected about you, including:
The categories of sources from which the PI was collected
Our business or commercial purposes for collecting, selling, or sharing PI
The categories of third parties to which we disclose PI
The categories of PI that we sold, and for each category identified, the categories of third parties to which we sold that particular category of PI
The categories of PI that we disclosed for a business purpose, and for each category identified, the categories of recipients to which we disclosed that particular category of PI
The specific pieces of PI we have collected about you.
Right to Opt Out of Sales and Sharing of PI.

You have the right to opt out of the sale of your PI, and to request that we do not share your PI for cross-context behavioral advertising. Although we do not sell Personal Information in exchange for money, some of the ways in which we share PI for advertising or marketing may be considered “sales” or “sharing” under the CCPA.

Deletion Rights

You may request that we delete your PI that we have collected directly from you. Under the CCPA, we may decline to delete your PI under certain circumstances—for example, if we need the PI to complete transactions or provide services you have requested or that are reasonably anticipated, for security purposes, for legitimate internal business purposes, to comply with law, or to exercise or defend legal claims. Where we use deidentification to satisfy a deletion request, we commit to maintaining and using the information in deidentified form and will not attempt to reidentify the information.

Correction Rights

If you believe that PI we maintain about you is inaccurate, you have the right to request that we correct that information.

Right to Limit Use and Disclosure of Sensitive Personal Information

We do not use or disclose Sensitive Personal Information for purposes to which the right to limit use and disclosure applies under the CCPA.

Right to Non-Discrimination for the Exercise of Your Privacy Rights

If you choose to exercise any of your privacy rights under the CCPA, you also have the right not to receive discriminatory treatment by us.

Nevada

Nevada residents may submit a verified request to opt out of the sale of covered information through [email protected]. We do not currently sell covered information as “sale” is defined by Nevada law. Our general Privacy Notice identifies the categories of covered information collected, categories of third parties with whom information may be shared, procedures for reviewing or requesting changes to information, how material changes are communicated, whether third parties may collect information about online activities over time and across websites, and the notice’s effective date.

Tennessee

Tennessee Consumer Rights and Disclosures

Tennessee consumers may request confirmation and access, correction, deletion, or a portable copy of personal information, and may opt out of its sale, targeted advertising, and qualifying profiling. Consent is required before processing sensitive data, subject to statutory exceptions.

We process the categories of personal information, for the purposes, and with the categories of third parties described in the general portions of this Privacy Notice. Requests and appeals may be submitted to [email protected]. We will respond within 45 days, subject to one permitted 45-day extension. If an appeal is denied, we will provide information about submitting a complaint to the Tennessee Attorney General.

Minnesota

Minnesota Consumer Rights and Disclosures

Minnesota consumers may request confirmation and access, correction, deletion, and portability; opt out of sale, targeted advertising, and qualifying profiling; obtain information about third-party disclosures; and question certain profiling decisions as provided by law.

We process the categories of personal data, for the purposes, and with the categories of third parties described in the general portions of this Privacy Notice. Our retention practices are described in Section 5.1. Requests and appeals may be submitted to [email protected]. We will respond within 45 days, subject to one permitted 45-day extension. The date this notice was last updated appears at the beginning of the notice.

Virginia

Purposes for Processing Personal Data

We process personal data to offer and administer our services and products. We use personal data for the purposes set out in the “Processing of Personal Data” section of the Rimkus Privacy Policy.

Sharing of Personal Data with Third Parties

We may share personal data with affiliates, service providers, contractors, professional advisers, transaction counterparties, and government or regulatory authorities for the purposes described in this Privacy Notice. We do not sell personal data. Our use of personal data for targeted advertising, if any, is described in the general Marketing and Advertising section and remains subject to applicable opt-out rights.

We may share personal data with other parties as follows:

Our affiliates, as needed to operate our business and provide services.
Service providers or contractors, such as vendors, consultants and other service providers who perform certain services on behalf of Rimkus, in which case we enter a contract that describes the purpose of processing and requires the recipient to not use it for any purpose except performing the contract.

Selling, Targeted Advertising, and Profiling

We do not sell personal data to third parties.

Virginia consumers may opt out of targeted advertising, the sale of personal data, and profiling in furtherance of decisions producing legal or similarly significant effects. We do not sell personal data or engage in qualifying profiling. To exercise an applicable opt-out right, contact [email protected].

Your Rights

Subject to the VCDPA and other applicable laws, you have the following rights concerning your data processed by Rimkus:

Deletion: You have the right to request that Rimkus erase your personal data, and Rimkus will erase such data unless it is reasonably necessary for Rimkus to maintain your personal data in accordance with VCDPA § 59.1-582.

Correction: You have the right to request that Rimkus correct inaccurate personal data, taking into account the nature and purpose of processing the information.

Access: You have the right to request to access or obtain a copy of the personal data that Rimkus holds about you.

Non-discrimination: Rimkus will not discriminate against a consumer because the consumer exercised any of the consumer’s rights under applicable laws.

How to Submit a Request

To exercise any of the rights listed above, please contact us at [email protected]. We will need to verify your identity before processing your request.

Response Timeline

We will respond to your request within 45 days of receipt or as required by law. If reasonably necessary, we may extend this period by an additional 45 days, provided we notify you of the extension and the reason for it within the initial period. We will provide our response free of charge, up to twice per 12-month period. If requests are manifestly unfounded, excessive, or repetitive, we may charge a reasonable fee or decline to act on the request, in which case we will notify you of our decision.

Appeals

If we decline to take action on your request, we will notify you within the applicable response period and provide: (i) the reasons for our decision; and (ii) instructions on how to appeal our decision.

You may appeal our decision by submitting a written appeal to [email protected] within a reasonable time after receiving our decision. We will respond to your appeal within 60 days of receipt or as required by law.

If your appeal is denied, you may submit a complaint to the Virginia Attorney General through the Consumer Protection Section: Office of the Attorney General of Virginia, Consumer Protection Section, 202 North Ninth Street, Richmond, Virginia 23219 (www.oag.state.va.us).

Texas

Applicability

This Privacy Notice is provided pursuant to the Texas Data Privacy and Security Act (TDPSA). This Notice applies to Texas residents who are acting only in an individual or household context. Such Texas residents, called “Consumers” in this Notice, have certain rights when they disclose their Personal Data or have their Personal Data disclosed to Rimkus Consulting Group, Inc. These rights do not apply to individuals acting in a commercial or employment context. Any other terms defined in the TDPSA have the same meaning when used in this Privacy Notice. 

“Personal Data” means any information that is linked or reasonably linkable to an identified or identifiable individual. It does not include:

Deidentified data or publicly available information.
Health records.
Protected health information under the Health Insurance Portability and Accountability Act of 1996 (HIPAA).
Data covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FCRA), the Gramm-Leach-Bliley Act (GLBA), the Driver’s Privacy Protection Act of 1994

The purpose of this Notice is as follows:

To provide Consumers with information on the categories of personal data Rimkus processes;
Describe purposes for which We process the personal data;
Describe the rights Consumers have under the TDPSA; and
Explain how to exercise those Consumer rights.

Categories of Personal Data Processed by Rimkus

As defined in the Privacy Notice.
Rimkus typically operates in business-to-business relationships and processes data consistent with the services provided to its business clients.

Consumer Rights

Texas consumers may also opt out of processing for targeted advertising, the sale of personal data, and profiling in furtherance of decisions producing legal or similarly significant effects.

Right to confirm whether Rimkus is processing the Consumer’s Personal Data and to access the Personal Data.
Right to correct inaccuracies in the Consumer’s Personal Data, taking into account the nature of any Personal Data and Rimkus’s purposes for processing that Data.
Right to request deletion of Personal Data provided by or obtained about the Consumer.
If Personal Data is available in a digital format, obtain a copy of the Data that the Consumer previously provided to Rimkus in a portable and usable format.

Exercising Consumer Rights

Consumers are entitled to exercise their rights at any time by submitting a:

Verifiable Texas Consumer Data Request form and specifying the rights they wish to exercise. Rimkus will respond to requests without undue delay and no later than 45 days after receiving an authenticated request or as required by law. Rimkus may request an additional 45 days when reasonably necessary. Consumers will be notified of any extension and the reasons for it, either by mail or electronically.

Consumer requests will be responded to free of charge no more than twice annually, per Consumer. Rimkus may charge a reasonable fee if a request is manifestly unfounded, excessive, or repetitive.

Rimkus will not comply with a request to exercise Consumer rights unless it can authenticate the identity of the requestor, using commercially reasonable efforts. We may request that a Consumer provide additional information in order to authenticate the Consumer’s identity and request.

If Rimkus declines a request, we will provide the justification and appeal instructions. Appeals may be submitted to [email protected]. We will respond to an appeal within 60 days. If an appeal is denied, we will provide the Texas Attorney General’s online complaint method.

Washington Consumer Health Data Notice

Read the full Washington Consumer Health Data Notice here.

Canada

Contact

Rimkus Consulting Group Canada Inc. Attn: Mike Bahjat
978 Montée de Liesse
St-Laurent, Québec H4T 1W7
Canada

2121 Argentia Road
4th Floor
Mississauga, Ontario L5N 2X4
Canada

Email: [email protected]

We comply with applicable Canadian privacy and electronic-marketing laws. Depending on the activity and location, this may include the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada’s Anti-Spam Legislation (CASL), and substantially similar provincial private-sector privacy laws, including those of Alberta, British Columbia, and Quebec. PIPEDA may continue to apply to interprovincial and international commercial data flows.

If you contact us to request our services via email, mail, online portal, or phone we collect information such as your first and last name, phone number, mailing address, email address, or postal code, as may be provided by you.

Sharing of Information: Legal and Compliance

Our authorized employees, agents and service providers will have access to your information on a need-to-know basis as required to fulfil their obligations to us for the purposes set out in this Privacy Policy.

Rimkus (and its Canadian, U.S. and other foreign service providers) may access, process and store your personal information outside your province (including, for Quebec residents, outside Quebec) and internationally, including in the United States, subject to appropriate legal mechanisms. We will obtain your consent prior to disclosing your personal information to our affiliates for their own marketing or other purposes.

We and our service providers may provide your personal information in response to a search warrant or other legally valid inquiry or order, or to another organization for the purposes of investigating a breach of an agreement or contravention of law, suppressing or preventing fraud, or as otherwise may be required or permitted by applicable Canadian, U.S. or other law or legal process, which may include lawful access by U.S. or foreign courts, law enforcement, or other government authorities.

Custom Audience

We may use services provided by third-party platforms (such as LinkedIn and other social media and other websites) to serve targeted advertisements on such platforms to you or others, and we may provide a hashed version of your email address or other information to the platform provider for such purposes. To opt-out of the sharing of your information for such purposes, please send a request to [email protected]. For more information about interest-based advertising and to understand your options in Canada, including how you can opt-out of receiving behavioral ads from third-party advertising companies participating in the Digital Advertising Alliance of Canada, please visit the Digital Advertising Alliance of Canada website at http://youradchoices.ca/choices.

Your Choices & Rights in Your Information

You may contact us with questions about our privacy practices, including to receive information regarding our policies and procedures with respect to service providers outside of your jurisdiction. Subject to legal and contractual restrictions, you may request access, updating, rectification and corrections of inaccuracies in your personal information in our custody or control, or withdraw your consent to our further collection, use or disclosure of your personal information (subject to legal or contractual restrictions) by contacting us. If you withhold or withdraw consent to our collection, use or disclosure of your personal information, we may not be able to provide you with the services you request.

Information About our Privacy Governance Policies and Practices

We are committed to protecting personal information and have implemented a comprehensive set of policies and practices that govern our treatment of personal information. These policies and procedures include, among other things, the following:

policies and procedures to protect personal information in our custody and control from unauthorized access, use or disclosure.
a privacy framework that defines the roles and responsibilities for our employees with respect to the treatment of personal information.
a framework for the retention and destruction of personal information to ensure compliance with legal obligations, and to securely destroy personal information once no longer required.
processes to respond to data subject requests and complaints in a timely and effective manner.
regular privacy training and awareness for our employees.

Transferring Outside of Canada

We may transfer personal information that we collect, or that you provide, to third parties (including affiliates, service providers, and others). We may process, store, and transfer your personal information in and to a foreign country, with different privacy laws that may or may not be as comprehensive as Canadian law, such as to the United States. In these circumstances, the governments, courts, law enforcement, or regulatory agencies of that country may be able to obtain access to your personal information through the laws of the foreign country. We have analyzed these risks and believe that such risks are minimal given the nature of the data processed, the nature of our services, and the security measures we have in place. You are welcome to contact us if you have questions regarding the collection, use, disclosure, or storage of personal information by our service providers and affiliates outside Canada, and/or to obtain access to written information about our policies and practices with respect to service providers (including affiliates) outside Canada.

Québec

Contact

Mike Bahjat
978 Montée de Liesse
St-Laurent, Québec H4T 1W7
Canada

This Quebec Privacy Addendum provides additional disclosures under Quebec’s Act respecting the protection of personal information in the private sector, as modernized by Law 25. The applicable requirements are in force. This Addendum should be read with the general Privacy Notice.

The Act’s goals and key requirements are consistent with Rimkus’s longstanding commitment to data protection, transparency and individual control. This Addendum describes certain information that the Act requires businesses to provide to Quebec residents, namely, Rimkus’s practices in the following key areas:

Data Transfer: Personal information may be communicated outside Quebec, including to the United States. Before such communications, Rimkus conducts the assessment and uses the written safeguards required by applicable Quebec law.

Processing of Data: We may process your data and the actions that you take on our platform to better understand your preferences and interests so that we can provide you with a more personalized experience. You can find more information about the data that we collect and how we use your data by visiting our Privacy Policy.

Data Protection and Your Rights: Subject to applicable conditions and exceptions, Quebec residents may request access, rectification, deletion where available, withdrawal of consent, cessation of dissemination or de-indexing in applicable circumstances, and portability of computerized personal information. Where a decision is based exclusively on automated processing, we will provide the disclosures and review opportunities required by law.

designated roles and responsibilities for the handling of personal data in our custody and control; 
processes for responding to questions, requests and complaints; and
a policy for the retention and destruction of data that is designed to ensure compliance with our legal obligations.

If you would like to request a copy of your data or obtain more information about how to request access to your data, you may contact us at 978 Montée de Liesse, St-Laurent, Quebec H4T 1W7, Canada or at [email protected]. The original version of this notice was drafted in English.

Coordonnées

Rimkus Consulting Group Canada Inc.
À l’attention de : Mike Bahjat
978 Montée de Liesse, Saint-Laurent (Québec) H4T 1W7, Canada

Le présent addenda relatif à la protection des renseignements personnels au Québec fournit des renseignements supplémentaires en vertu de la Loi sur la protection des renseignements personnels dans le secteur privé du Québec, telle que modernisée par la Loi 25. Les exigences applicables sont en vigueur. Le présent addenda doit être lu conjointement avec l’Avis de confidentialité général.

Les objectifs et les principales exigences de la Loi sont conformes à l’engagement de longue date de Rimkus envers la protection des données, la transparence et le contrôle individuel. Le présent addenda décrit certains renseignements que la Loi exige que les entreprises fournissent aux résidents du Québec, notamment les pratiques de Rimkus dans les domaines clés suivants :

Transfert de données : Les renseignements personnels peuvent être communiqués à l’extérieur du Québec, notamment aux États-Unis. Avant une telle communication, Rimkus effectue l’évaluation requise et utilise les garanties écrites exigées par la législation québécoise applicable.

Traitement des données : Nous pouvons traiter vos données et les actions que vous effectuez sur notre plateforme afin de mieux comprendre vos préférences et vos intérêts et de vous offrir une expérience plus personnalisée. Vous trouverez de plus amples renseignements sur les données que nous recueillons et la façon dont nous les utilisons dans notre Avis de confidentialité.

Protection des données et vos droits : Sous réserve des conditions et exceptions applicables, les résidents du Québec peuvent demander l’accès, la rectification, la suppression lorsqu’elle est disponible, le retrait du consentement, la cessation de la diffusion ou la désindexation dans les circonstances applicables, ainsi que la portabilité des renseignements personnels informatisés. Lorsqu’une décision repose exclusivement sur un traitement automatisé, nous fournirons les renseignements et les possibilités de révision exigés par la loi.

des rôles et responsabilités désignés pour la gestion des renseignements personnels dont nous avons la garde ou le contrôle;
des processus permettant de répondre aux questions, demandes et plaintes; et
une politique de conservation et de destruction des données conçue pour assurer le respect de nos obligations légales.
Si vous souhaitez demander une copie de vos renseignements personnels ou obtenir de plus amples renseignements sur la façon de présenter une demande d’accès, vous pouvez communiquer avec nous au 978 Montée de Liesse, Saint-Laurent (Québec) H4T 1W7, Canada, ou à [email protected]. La version originale du présent avis a été rédigée en anglais

Europe

Contact: Nikol Rashkova, Data Protection Officer

If you are in the European Union (EU), European Economic Area or are otherwise subject to the General Data Protection Regulation, then this section of our Privacy Notice applies to you.

Rimkus acts as the data controller for personal data processed for its own business purposes. Where Rimkus processes personal data solely on a client’s documented instructions, Rimkus acts as a data processor. We process personal data under an applicable legal basis, including contract, legal obligation, legitimate interests that are not overridden by individual rights, consent, and, where applicable, legal claims or another condition permitted for special-category or criminal-offence data.

On the basis of your consent:

to send you direct marketing messages about our services and promotions; and
to deliver targeted advertisements to you, both on and off the services, including by using cookies and similar technologies, as explained below.

You can withdraw your consent at any time by contacting us. If you withdraw certain consents, we may no longer be able to offer related services.

E-Mail: If you wish to unsubscribe or opt out of receiving direct marketing from Rimkus via email, you may follow the instructions contained in any such message. You may also contact us for information about how to remove yourself from any of our mailing lists.

Other: If you no longer wish to continue receiving other commercial communications from Rimkus, you may follow the instructions or use the contact information contained in any such message, or by changing the privacy settings in your browser (for example, with respect to cookies). You may also contact us to remove yourself from other types of direct marketing in accordance with local law.

You may lodge a complaint with a supervisory authority if you consider that our processing of your personal information infringes applicable law.

Our Services may use web analytics services, such as Google Analytics, which are provided by Google, Inc. and other third-party providers. These services use “cookies” to help analyze how visitors use online services. The information generated by the cookies about your use of the online services (including your IP address) will be transmitted to and stored by these providers, including outside the EU in third countries such as the United States which might not have data protection and other laws that are as comprehensive as those in your country.

If your IP address is not truncated through IP-anonymization, then the full IP address may be transferred to third party providers’ non-EU servers. These providers may use this information for the purpose of evaluating your use of the websites, compiling reports on website activity for website operators and providing other services relating to website activity and Internet usage. You may refuse the use of cookies as described elsewhere in this policy.

We process your personal data where we have a valid legal basis under applicable law, including where processing is necessary for our legitimate interests, to perform a contract, to comply with a legal obligation, or on the basis of your consent, as applicable.

Where required under applicable law, including for certain electronic direct marketing and non-essential cookies or similar technologies, we rely on your consent:

to send you direct marketing messages about our services and promotions by email, text message, or other electronic means where consent is required, unless an applicable exception under Irish law applies; and
to place or use non-essential cookies and similar technologies, including for analytics and targeted advertising, in accordance with your preferences.

You can withdraw your consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out before withdrawal. If you withdraw certain consents, we may no longer be able to provide related services or features.

E-Mail: If you wish to unsubscribe or opt out of receiving direct marketing from Rimkus by email, you may follow the unsubscribe instructions in the message. You may also contact us to ask that we stop using your personal data for direct marketing purposes.

Other: If you no longer wish to receive other commercial communications from Rimkus, you may follow the instructions or use the contact information provided in the relevant message or adjust your browser or device settings where relevant (for example, in relation to cookies). You also have the right to object at any time to the processing of your personal data for direct marketing, including profiling related to such marketing, in accordance with applicable law.

If you are located in Ireland or we have provided services through our location in Ireland, you may lodge a complaint with the Irish Data Protection Commission if you consider that our processing of your personal data infringes applicable law, without prejudice to any other administrative or judicial remedy available to you.

Our Services may use web analytics services, such as Google Analytics, and other third-party tools. These services may use cookies and similar technologies to help analyse how visitors use our online services. Where required by Irish law, non-essential cookies and similar technologies will be used only with your consent. Information collected through these technologies may include your IP address and information about your use of the online services.

Where personal data collected through analytics or similar tools is transferred outside the European Economic Area, we will do so only where permitted by applicable law, including where the destination country is subject to an adequacy decision or where appropriate safeguards have been implemented, such as standard contractual clauses. Where available, we will also apply additional safeguards that are appropriate to the nature of the transfer and the risks involved. You can refuse or manage non-essential cookies as described elsewhere in this policy.

United Kingdom — Contact

Nikol Rashkova, Data Protection Officer
Rimkus Consulting UK Limited
40 Lime Street, 5th Floor
London, EC3M 7AW
United Kingdom

You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

Third-party links

This website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy notice of every website you visit.

The data we collect about you

Personal data we collect from you

We use different methods to collect data from you including:

When you sign up to receive any news services, or literature from us, use a toolkit or register for one of our online services, we will ask you to provide your contact and other relevant information, as well as your communication preferences.
When you register to attend one of our events, we will ask you to provide your contact, guest and other relevant information, including meal preferences.
When you use our website or one of our online services, we collect information about your visit and how you interact with our website.
When a client uses our services, we will ask for the information that we need to provide those services; this information includes contact details, billing information, information necessary to conduct pre-clearance checks and information relevant to the services we provide. Information provided by a client may include personal data that relates to persons whose information is relevant to the instruction; for example, when we provide professional services in relation to a dispute, business transaction or a regulatory investigation.
If you visit one of our buildings, we may collect information that we need in order to identify you and complete necessary security checks.
When you apply for a job with us, we will ask you for information relevant to your application.
If you become an employee or provide services to us, we will collect personal data that is relevant to the employment or engagement.

If you provide information to us about another person, you must ensure that you comply with any legal obligations that may apply to your provision of the information to us, and allow us, where necessary, to share that information with service providers.

Information we collect from third parties

Most of the personal data that we collect about you will be information that you provide to us voluntarily. In some circumstances we may also receive information from:

other Rimkus entities
our clients, when we handle personal data on their behalf
regulatory bodies
other companies providing services to us.

Some of these third-party sources may include publicly available sources of information.

We may receive data about your use of our website or technical interactions with us from Google Analytics, a web analytics service provided by Google, Inc. (“Google”) whose servers are in the European Union. Google Analytics uses cookies to help us analyse how users use our site.

We may also receive information about you from advertising networks and search information providers, some of whom are based in the UK, some based in the EU, and some based outside both the UK and the EU.

Data we collect automatically

When you visit our website, we automatically collect, store and use technical information about your equipment and interaction with our website. This information is sent from your computer to us using a variety of cookies. It is possible to manage your cookie preferences by visiting the cookie settings icon.

We may also receive technical data about you if you visit other websites employing our cookies.

How we use your personal data

We will only use your personal data fairly and where we have a lawful reason to do so.

We are allowed to use your personal data if we have your consent or another legally permitted reason applies. These include to fulfil a contract with you, comply with a legal duty, or when it is in our legitimate business interest to use your personal data. We can only rely on our legitimate business interest if it is fair and reasonable to do so.

Most commonly, we will use your personal data in the following circumstances:

Where we need to perform the contract, we are about to enter into or have entered into with you.
Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
Where we need to comply with a legal or regulatory obligation.
Where you have consented to such processing.

We process special-category data only where an applicable Article 9 condition is satisfied and criminal-offence data only where authorized by applicable law. Depending on the engagement, relevant conditions may include employment or social-protection law, establishment or defense of legal claims, explicit consent, or another specifically applicable legal basis. Professional advisory services alone are not treated as an independent Article 9 condition.

We have set out below, in a table format, a description of all the ways we plan to use your personal data, and the lawful basis for the use of such data.

Note that we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data. Please contact [email protected] if you need details about the specific legal ground we are relying on to process your personal data where more than one ground has been set out in the table below.

Purpose / Activity	Type of Data	Lawful Basis
Register you as a client/contact and administer our relationship	Contact information; Biographical information	Performance of a contract
Provide and deliver consulting and expert services, including processing claims and assignments	Contact information; Special categories (health, criminal offense data where shared by clients)	Performance of a contract; Legal obligation; Legitimate interests (providing professional services)
Manage payments, fees, and charges	Contact information; Financial information	Performance of a contract
Manage our relationship with you, including notifying you of changes to our terms or this notice	Contact information; Marketing and communications preferences	Performance of a contract; Legal obligation; Legitimate interests (keeping records up to date)
Send you direct marketing communications about our services and promotions	Contact information; Marketing and communications preferences	Consent (where required by law); Legitimate interests (developing our business)
Deliver targeted advertisements, including via cookies and similar technologies	Technical information; Usage information	Consent
Administer and protect our business and website (troubleshooting, testing, maintenance, security)	Contact information; Technical information	Legitimate interests (running our business, IT services, network security)
Use data analytics to improve our website, services, and client relationships	Technical information; Usage information	Legitimate interests (keeping our website relevant and understanding our client base)
Administer events, webinars, and educational courses	Contact information; Biographical information; Marketing and communications preferences	Legitimate interests (organising and running events); Consent (where requested)
Comply with legal and regulatory obligations, including responding to legal process	All categories as relevant	Legal obligation
Establish, exercise, or defend legal claims	All categories as relevant	Legitimate interests (protecting our legal rights); Legal obligation
Process special category data (health, race/ethnicity, criminal offense data) received from clients in connection with an assignment	Special categories of data	Applicable Article 9 condition determined by context, which may include Article 9(2)(b) for employment or social-protection obligations or Article 9(2)(f) for legal claims; criminal-offence data is processed only where authorized by applicable law.

We do not make decisions about you based solely on automated processing (including profiling) that produce legal or similarly significant effects. If this changes, we will update this notice and, where required by law, seek your consent or provide you with the right to request human review.

Where we rely on consent as the lawful basis for processing, you have the right to withdraw that consent at any time by contacting [email protected] or [email protected]. Withdrawal of consent will not affect the lawfulness of any processing carried out before withdrawal.

Marketing

We strive to provide you with choices regarding certain personal data uses, particularly around marketing and advertising.

Promotional offers from us

We may use your personal data to form a view on what we think you may want or need, or what may be of interest to you. This is how we decide which products, services and offers may be relevant for you.

You will receive marketing communications from us if you have requested information from us or if you provided us with your details otherwise and, in each case, you have not opted out of receiving that marketing.

Third-party marketing

We will get your express opt-in consent before we share your personal data with any company outside the Rimkus group of companies for marketing purposes.

Opting out

You can ask us or third parties to stop sending you marketing messages at any time by contacting us.

Where you opt out of receiving these marketing messages, this will not apply to personal data provided to us as a result of a service purchase, service experience or other transactions.

Change of purpose

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us at [email protected].

If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

Sharing and transferring your data

We treat your personal data with respect and do not share it with third parties except as described below.

We may disclose your personal data to other Rimkus entities for the purpose of our internal business processes (such as administration, liaising with experts in different jurisdictions and billing) and for the purpose of providing our services. When we provide personal data to Rimkus entities outside of the EU and EEA, we have in place an intra-group transfer agreement in the form approved by the European Commission. Where it is necessary to transfer data from any Rimkus entity outside of the EU and EEA, we will comply with any transfer requirements applicable under local law.
We may disclose personal data relating to our clients, their employees and agents to other specialists including solicitors, barristers, mediators, arbitrators, consultants or experts engaged in a matter. We may also disclose personal data to law firms for the purpose of obtaining legal advice.
We may share personal data with our suppliers and service providers including event organisers and partners and document production and management services
We may share personal information when necessary with law enforcement and regulatory authorities
We may share personal information with third parties to whom we may choose to sell, transfer, or merge parts of our business or our assets or who buys our shares. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this Privacy Notice.
We may also share your personal data when you have consented to us doing so.

For transfers outside the EEA, we rely on an adequacy decision, approved standard contractual clauses with any required supplementary measures, or a legally available derogation. For restricted transfers from the United Kingdom, we separately apply UK adequacy regulations, the UK International Data Transfer Agreement or UK Addendum, and any required transfer risk assessment.

where the transfer is to a country or other territory which has been assessed by the European Commission (or an equivalent UK body) as ensuring an adequate level of protection for personal data
with your consent or
on the basis that the transfer is compliant with the GDPR (or equivalent UK regulations) and other applicable laws.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

How we protect your personal data

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

Keeping your personal data

We do not keep your personal data for any longer than is necessary to fulfil the purpose for which we collected it, or to comply with any legal, regulatory or reporting obligations or to assert or defend against legal claims.

Your rights concerning your personal data

You have certain rights regarding how we use and keep your personal data. These are:

you can require us, to update or correct any inaccurate personal data, or to complete any incomplete personal data, concerning you. If you do, we will take reasonable steps to check the accuracy of and correct the information. Please let us know if any of your information changes so that we can keep it accurate and up to date;
you can require us to stop processing your information for direct marketing purposes; if you withdraw your consent, we may not be able to provide certain products or services to you; and
you have the right to object to our use of your personal data more generally.

You may also have the right, in certain circumstances to:

be provided with a copy of any personal data that we hold about you, with certain related information. There are exceptions to this right; for example, where information is legally privileged or if providing you with the information would reveal personal data about another person
to require us, without undue delay, to delete your personal data
to “restrict” our use of your information, so that it can only continue subject to restrictions; and
to require personal data which you have provided to us, and which are processed by using automated means, based on your consent or the performance of a contract with you, to be provided to you in machine readable format so that they can be “ported” to a replacement service provider.

You can exercise the above rights, where applicable by contacting [email protected]. We will require you to provide satisfactory proof of your identity in order to ensure that your rights are respected and protected. This is to ensure that your personal data is disclosed only to you.

Australia

Contact

Min Hew, Regional Privacy Representative
Rimkus AU Pty Limited
Level 6, 36 Carrington Street
Sydney, New South Wales 2000
Australia

Email: [email protected] or [email protected]

Australian residents are hereby notified that, subject to The Privacy Act 1988 (Privacy Act), you have the option to deal anonymously or by pseudonym if you contact us by telephone and you merely seek information about our services, but you do not wish to enter into any further discussions with us. However, if you wish to deal with us in this way, you will not be able to engage with us in respect of our services. If you wish to engage with us in respect of our services, you may be required to provide us with your personal information.

Rimkus may disclose personal information to overseas recipients, including affiliates and service providers in the United States and United Kingdom. Where APP 8 applies, Rimkus takes reasonable steps to ensure overseas recipients do not breach the Australian Privacy Principles and may remain accountable for their acts or practices, subject to statutory exceptions.

We rely on your consent to send you direct marketing messages about our products, services, and promotions, and to deliver targeted advertisements to you. You can withdraw your consent at any time. You also may change the privacy settings of your browser, for example, with respect to cookies. If you withdraw consent, we are no longer able to offer these services.

If we become aware of any ongoing concerns or problems concerning our privacy practices, we will take these issues seriously and work to address these concerns. If you have any further queries relating to our privacy policy, or you have a problem or complaint, please contact us. If you are not satisfied with our handling of your problem or complaint you may make a complaint to the Australian Information Commissioner – for further details please visit https://www.oaic.gov.au/.

Data Breach Notification — Notifiable Data Breaches (NDB) Scheme

A data breach is an eligible notifiable data breach where: (i) there is unauthorised access to, or unauthorised disclosure of, personal information held by us, or personal information is lost in circumstances where unauthorised access or disclosure is likely to occur; and (ii) a reasonable person would conclude that the access or disclosure would be likely to result in serious harm to any of the individuals to whom the information relates.

If we have reasonable grounds to believe an eligible data breach has occurred, we will: (1) conduct an assessment as soon as practicable, and in any event within 30 days of becoming aware that there are reasonable grounds to suspect an eligible data breach; (2) notify the Office of the Australian Information Commissioner (OAIC) as soon as practicable after confirming an eligible data breach; and (3) notify affected individuals whose personal information is involved and who are at risk of serious harm, as soon as practicable after notifying the OAIC.

Our notification to affected individuals will include: the identity and contact details of Rimkus AU Pty Limited; a description of the data breach; the kinds of personal information involved; and recommendations about the steps individuals should take in response to the breach.

If you have questions about our data breach procedures or wish to report a suspected breach, please contact us at [email protected]. For further information about the NDB scheme, please visit the OAIC website at www.oaic.gov.au.

New Zealand

Local Contact

Min Hew, Regional Privacy Representative
Rimkus NZ Limited
Level 8, 34 Shortland Street
Auckland Central 1010
New Zealand

Email: [email protected]

Rimkus Processes Your Data Subject to the Privacy Act 2020 (Act)

Collecting Information

When you contact us through our website to request our services, we collect certain standard information that your browser sends to every website you visit, such as your Internet Protocol (IP) address, your browser type and capabilities and language, your operating system, your computing device type, your geographical location, the date and time you access the site, the website from which you access our site, length of visit and number of page views. We may also collect your name, email address, physical address. You can opt-out of this collection by contacting us at [email protected] or [email protected].

Use of Information

We will only use your information for legitimate business purposes. This may include the provision of services, marketing and business development, and customer communications. We use web analytics to track your data to improve website functionality. Data may be accessed globally by IT administrators, including the United States and the United Kingdom. Such data access (transfers) is subject to legal mechanisms.

Sharing Information

We will not share your information with third parties without your consent. We may share your information with our staff, third-party advertisers, investigatory bodies, and potential business buyers.

Cross-border Data Transfers

Personal information may be stored in or accessed from New Zealand and other countries, including the United States and United Kingdom. Where disclosure to an overseas recipient occurs, we take steps required by the Privacy Act 2020 to ensure an applicable legal basis and appropriate protection. We do not represent that all information is exclusively located in New Zealand.

Storage and Security

We store your personal information securely in our cloud storage. We take steps (such as using multifactor authentication) to protect all information we transmit over the internet but cannot guarantee complete security. Information is stored for six years, after which it is deleted according to our cyber security guidelines.

Accessing Information

You can contact us at [email protected] or [email protected] to request access to your personal information, or to request that your information is corrected. We may refuse access to your personal information in some limited circumstances, for example if the information is not readily retrievable.

Data Breach Notification

Where a privacy breach has caused or is likely to cause serious harm, we will notify the New Zealand Privacy Commissioner and affected individuals as soon as practicable, subject to applicable exceptions. We aim to notify the Commissioner within 72 hours where practicable, consistent with regulatory guidance; the statutory standard remains notification as soon as practicable.

Contact

If you have any questions or concerns about the privacy of your data, please contact us at [email protected] or [email protected] or at our principal locations.

Singapore

Contact

Min Xi Hew, Data Protection Officer
Rimkus SG PTE Limited
138 Market Street
CapitaGreen, Level 5
Singapore SN 048946

Rimkus processes personal data subject to the Personal Data Protection Act of 2012, as amended.

How We Collect Personal Data

The types of personal data that we collect depend on the circumstances of collection and on the nature of the transaction undertaken with us. The personal data that we may request includes, but is not limited to (individually and collectively referred to as “Personal Data”):

We may collect Personal Data in various ways including:

in the course of your engaging our products or services, or your providing documentation or information to us;
when you interact with our customer service officers or any of our staff, for example, via face-to-face meetings, business interactions in events and exhibitions, telephone calls, letters, online forms (such as any “Contact Us” forms on our websites), online reservation chat, social media platforms and emails, or other mailing list, alerts or newsletters;
when you visit our websites. Technical and statistical data, such as your IP address, browser type, domain names, access times and referring website addresses, will automatically be collected by us to maintain the quality of the service and to compile general statistics regarding the use of our websites;
when you contact us or request that we contact you;
when you respond to our request for additional Personal Data;
when you respond to our initiatives or market research or surveys;
CCTV recordings while you are within our premises;
when you participate in events organised by us;
when you submit any application(s) for employment or other appointments with us (including scholarships, internships and attachments) or provide documents or information to us such as your resume, including from recruitment agencies, and employment references;
in the course of conducting interviews;
from public information sources, search services and other third parties; and
when you submit your Personal Data to us for any other reason.

If you provide third-party Personal Data to us such as the Personal Data of your family members, by doing so, you confirm and represent that you have obtained their respective consents to the collection, use and disclosure of their Personal Data on these terms.

Note: A “cookie” is a small amount of data transferred to your browser and read by the web server that placed it there. It works as a sort of identification card, recording your preferences and previously entered information. By using cookies, the information you previously provided can be retrieved on your next visit to the website so that your navigation time is reduced, and your use of the website is simplified. Cookies are uniquely assigned to you and can only be read by a web server in the domain that issued the cookie. Web beacons may be used to deliver the cookie and compile statistics about our website, such as how many people visited a particular page or clicked on certain links.

Portions of our websites use cookies to help ensure the integrity of any registration process or to help provide personalised service and deliver content specific to your interests.

You can set your browser to decline cookies if you prefer. If you do so, you may not be able to get the benefit of some of the features of our website.

Purposes for Which we Collect, Use and Disclose Personal Data

The purposes for which we collect, use, and disclose Personal Data include:

to communicate or interact with you, to respond to, handle, and process queries, requests, applications, complaints, and feedback from you;
to manage your relationship with us;
to process payment or credit transactions;
to comply with any applicable laws, regulations, codes of practice, guidelines, or rules, or to assist in law enforcement and investigations conducted by any governmental and/or regulatory authority;
to provide you with our products or services or provide customer support;
to verify your identity and conduct background checks;
to help us manage the delivery of and improve our products and services, including conducting market research or surveys, performing market analysis and identifying customer needs, and developing new products and services;
to compile, manage and track the profile of our clients and vendors in our database;
to contact you or provide you with information about our products and services or in relation to matters concerning Rimkus or which we believe may be of interest to you, including sending you alerts, newsletters and marketing materials;
to handle claims and disputes, conduct and facilitate investigations and proceedings, and protect and enforce our contractual and legal rights and obligations;
to prevent, detect and investigate crime, including fraud and money laundering, and to analyse and manage other commercial risks;
to manage the administrative and business operations of Rimkus and to comply with internal policies and procedures;
to facilitate business asset transactions, including mergers, acquisitions or asset sales, involving Rimkus;
to facilitate attendance at events organised by us or in which we are involved;
to submit incident reports to authorities, insurance companies or for internal investigations;
to submit CVs of persons for tender bids and interview purposes;
to pay vendors, contractors and sub-contractors for the provision of services;
to manage the security and other aspects of premises, facilities and technology infrastructure, including carrying out CCTV surveillance and conducting security clearances; and/or
any other purpose relating to any of the above.

In addition, if you are seeking employment or any other appointment with us (including scholarships, internships or attachments) or are an existing employee, the purposes for which we collect, use and disclose your Personal Data include:

to evaluate, administer and process your application and suitability;
to conduct background checks, verify your credentials and qualifications, and obtain references;
to manage our talent pool, including compiling and maintaining an information database on the job, scholarship, internship or attachment applicants and existing employees;
to manage or terminate your employment relationship with us;
to facilitate the business operations of Rimkus, including compiling and maintaining an employee resume/CV database for purposes of project tender submissions and providing products and services to clients;
to organize staff training and development programs;
to assess and evaluate your performance;
to administer benefits and payroll processing;
to provide you with tools and/or facilities to enable or facilitate the performance of your duties;
to communicate with you to comply with our policies and processes, including for business continuity purposes, compiling and publishing internal directories and contact lists;
to conduct analysis and survey for human resource planning and management; and/or
any other purpose relating to any of the above.

In relation to particular products and services, or in your interactions with us, we may also have specifically notified you of other purposes for which we collect, use or disclose your Personal Data. If so, we will collect, use and disclose your Personal Data for these additional purposes as well, unless we have specifically notified you otherwise.

The purposes listed in the above paragraphs may continue to apply even in situations where your relationship with us (for example, pursuant to your employment contract should you be hired) has been terminated or altered in any way, for a reasonable period thereafter (including, where applicable, a period to enable us to enforce our rights under a contract with you).

Personal Data may be disclosed to various parties including:

entities within the Rimkus or related companies and affiliates of Rimkus;
our joint venture or alliance partners;
our clients, vendors, sub-contractors and business partners;
our agents, contractors, third party service providers and specialist advisers who provide operational, administrative, financial, research or other services, such as courier services, telecommunications, information technology, payment, payroll, processing, training, event organizing, market research, storage, archival, and client support services;
our professional advisers such as our lawyers and auditors;
insurers or insurance investigators and credit providers;
any investor, assignee or transferee (actual or prospective) to facilitate business asset transactions, including mergers, acquisitions or asset sales, involving Rimkus;
any relevant authorities, including regulatory bodies and/or law enforcement agencies, whether local or overseas;
to the extent necessary to comply with any laws, regulations, rules, directions, guidelines and other similar requirements;
anyone to whom we transfer or may transfer our rights and obligations; and
any other party as may be consented to by you.

We require that parties to whom we disclose Personal Data implement adequate levels of protection in order to protect Personal Data, and to only process Personal Data strictly for our intended purpose.

Disclosing your Personal Data

You will appreciate that we may not be able to perfectly secure your Personal Data from cyber-attacks, such as hacking, spyware, and viruses. Accordingly, Rimkus cannot guarantee protection against all unauthorized disclosure, loss, or destruction arising from such risks.

Keeping your Personal Data accurate and up to date 

We endeavor to ensure that the Personal Data we have about you is accurate and up to date. We realise that Personal Data changes frequently with changes of address or other personal circumstances. We encourage you to contact us as soon as possible to enable us to update any Personal Data we have about you.

Withdrawal of consent, access and correction of your Personal Data, and contacting us 

The consent that you provide for the collection, use and disclosure of your Personal Data will remain valid until such time it is withdrawn by you in writing. You may withdraw consent and request us to stop using and/or disclosing your Personal Data for any or all of the purposes listed above by submitting your request in writing by post or via email to our Data Protection Officer at the contact details provided below.

Upon receipt of your written request to withdraw your consent, we may require reasonable time (depending on the complexity of the request and its impact on our relationship with you) for your request to be processed and for us to notify you of the consequences of us acceding to the same, including any legal consequences which may affect your rights and liabilities to us. In general, we shall seek to process your request within ten (10) business days of receiving it.

Whilst we respect your decision to withdraw your consent, please note that depending on the nature and scope of your request, we may not be in a position to continue providing our products or services to you and we shall, in such circumstances, notify you before completing the processing of your request. Should you decide to cancel your withdrawal of consent, please inform us in writing in the manner described above.

Please note that withdrawing consent does not affect our right to continue to collect, use and disclose Personal Data where such collection, use and disclosure without consent is permitted or required under applicable laws. As such, Personal Data may be accessed by IT administrators located in the United States and the United Kingdom.

If you wish to make (a) an access request for access to a copy of the Personal Data that we hold about you or information about the ways in which we use or disclose your Personal Data; or (b) a correction request to correct or update any of your Personal Data which we hold about you, you may submit your request in writing by post or via email to us at the contact details provided in this Policy.

Please note that a reasonable fee may be charged for an access request. If so, we will inform you of the fee before processing your request.

We will respond to your request as soon as reasonably possible. Should we not be able to respond to your request within thirty (30) days after receiving your request, we will inform you in writing within thirty (30) days of the time by which we will be able to respond to your request. If we are unable to provide you with any Personal Data or to make a correction requested by you, we shall generally inform you of the reasons why we are unable to do so (except where we are not required to do so under the PDPA).

Updates to this Policy

This Policy will be reviewed from time to time to take into account new laws and technology, changes to our operations and practices and the changing business environment. If you are unsure whether you are reading the most current version, please contact us.

Transfer of Personal Data outside of Singapore

Except as stated below, we generally do not transfer your Personal Data to countries outside of Singapore. However, if we do so, we will take steps to ensure that your Personal Data continues to receive a standard of protection that is at least comparable to that provided under the PDPA and any such transfer is subject to legal mechanisms.

Before transferring personal data outside Singapore, we take appropriate steps to ascertain and ensure that the recipient is bound by legally enforceable obligations providing protection at least comparable to the PDPA, unless another permitted transfer condition applies. Where we rely on consent, we will provide the information and choices required by law and will not make consent a condition of service unless the transfer is reasonably necessary to provide the service.

Questions or feedback about your Personal Data or our Policy

If you:

have any questions or feedback relating to your Personal Data or our Policy;
would like to withdraw your consent to any collection, use or disclosure of your Personal Data as set out in this Policy; or
would like to obtain access or make corrections to your Personal Data,

Reach out to our Data Protection Officer for the APAC region. Please email [email protected] or [email protected] with your request.

Israel

Contact

Andrea Mirin, Global Privacy Officer

To the extent applicable, Rimkus processes personal data in accordance with Israel’s Protection of Privacy Law, 5741-1981, its regulations, and Amendment 13, effective August 14, 2025. Amendment 13 modernized statutory terminology, expanded regulatory enforcement, narrowed database-registration requirements, introduced notification duties for certain large databases containing especially sensitive data, and requires appointment of a Data Protection Officer for specified organizations.

Use of your personal data

Where the PPL is applicable to Rimkus, we are only permitted to process your personal data on the basis of certain legal requirements which are outlined in the applicable legislation. As such, you will find below the valid legal bases which permits us to process your personal data for the fulfilment of one of the below purposes (which are outlined more specifically above in our general notice). 

To ensure access to our website and online services

Under the PPL, the lawful basis for this processing is our legitimate interest in enabling and improving our website and online services, or consent, where requested and obtained.

To answer your queries, support and contact requests 

Under the PPL, the lawful basis for this processing may be for the performance of a contract with you or to take steps at your request before entering into a contract with you, or for our legitimate interests in behaving as a responsible organization in dealing with these matters, or consent, where requested and obtained.

Subscriptions to our promotional communications

Under the PPL, the lawful basis for this processing is the consent, where requested and obtained.

To administer events and associated activities

Under the PPL, the lawful basis for this processing is our legitimate interest in organizing and running such events, or consent, where requested and obtained.

To manage, administer and fulfil the obligations under contracts, and regulations

Under the PPL, and depending on the processing activity, the lawful bases for this processing may be for the performance of a contract with you or to take steps at your request before entering into a contract with you, our legitimate interest in providing services to your company or employer, or legal obligation.

To promote Rimkus brand, products, initiatives, and values with marketing communications

Under the PPL, the lawful basis for this processing is Rimkus’s legitimate interests in promoting its brand, products, initiatives and values, or consent, where requested and obtained.

Transferring Israel Data Subject information outside Israel

We may transfer the personal data we collect about you to one or more countries outside Israel, including India, in order to perform one of the activities listed above (see “How we will use information about you”). Where there is no adequacy decision by the Israel authorities in respect of those countries – meaning that these are not deemed to provide an adequate level of protection for your personal data – we have put in place the appropriate measures to ensure that your personal data will be secure. These measures include data transfer agreements. If you require further information about these protective measures, you can request it from our Data Protection Officers (see contacts below).

Your duty to inform us of changes

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

Your rights in connection with personal data

Under certain circumstances, by law you have the following rights:

Request access to your personal data (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data we hold about you.
Request for rectification. This enables you to request for rectification the personal data that we hold about you. You can ask us to update any incomplete, inaccurate or out of date information we hold about you, to be corrected.
Request deletion/erasure. This enables you to ask us, in certain situations, to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have exercised your right to object to processing (see below).
Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal data for direct marketing purposes.
Request the restriction of processing of your personal data. This enables you to ask us, in certain circumstances, to suspend the processing of personal data about you, for example if you want us to establish its accuracy or the reason for processing it.
Data portability. This enables you to ask us, in certain circumstances, to provide you with the personal data you have provided to us in a structured, commonly used and machine-readable format or to transmit the personal data that you have provided to us to another party.
Right to withdraw consent. In the limited circumstances where you may have provided your consent to the collection, processing and transfer of your personal data for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact our Data Protection Officer (see contacts below). Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legal basis for doing so.
Right to complain to the relevant data protection authority. This enables you the right to file a complaint if you consider that the processing of your personal data infringes the PPL. Israel Privacy Protection Authority is the regulatory and enforcing authority responsible for the protection of the privacy of individuals and for information held in digital databases.

If you are an Israeli resident and want to exercise a data subject right in connection with your personal data, please contact our Data Protection Officer for Israel (see contacts below).

What we may need from you

If you exercise one of the above rights, we may need to request specific information from you to help us confirm your identity and that you are entitled to make such a request. This is to ensure that personal data is not disclosed to any person who has no right to receive it.

Data Protection Officer

Rimkus has appointed a Global Privacy Officer to oversee compliance. Where Israeli law requires a Data Protection Officer, Rimkus will ensure that the role, independence, expertise, access, and contact arrangements satisfy applicable requirements. Questions and rights requests may be sent to [email protected].