隐私声明

1.1 奥纬企业管理咨询（上海）有限公司（“奥纬”或“我们”）致力于保护访问我们网站（“网站”）的客户和用户（“您”）的隐 私。本隐私声明（“隐私声明”）阐述了我们网站收集和共享个人信息的做法，旨在告知您我们网站收集个人信息、使用个人信息以及共享您选择提供给我们的 个人信息的方式。

1.2 如果我们向您收集个人信息，我们还可能提供进一步的声明，声明强调我们计划对您个人信息的一些使用用途以及您同意或退出选 定信息使用用途的能力。

1.3 我们的网站可能包含导向其他第三方网站的链接。如果您点击任何第三方网站链接，请注意相关网站有相应的隐私政策。对于第三 方网站隐私政策或其对您个人信息的处理，我们不承担任何责任或义务。向第三方网站提交任何个人信息之前，请认真审查相关政策。

1.4 本隐私声明涵盖以下领域：

(a) 我们所收集的有关您的个人信息

(b) 我们如何使用您的个人信息

(c) 我们如何保护您的个人信息

(d) 联系我们和您所拥有的阻止营销以及访问和更新您个人信息的权利

(f) 本隐私政策的修订方法

2.1 我们将收集和处理有关您的下述全部或部分个人信息：

(a) 您向我们提供的信息►您 向我们提供的个人信息，例如使用联系表格或我们网站上的任何报告订阅表格时提供的个人信息，包括姓名、电邮地址和其他联系方式。如果您主动申请奥纬工 作岗位并通过我们的求职招聘网站提交岗位申请，我们将会收集您通过我们的求职招聘网站提交的信息。关于我们如何处理该信息，请参阅我们的求职招聘网站 上的候选人隐私声明；

(b) 我们之间的沟通信息►如 果您与我们联系，我们通常保留一份双方通信往来记录；

(c) 研究调查信息►如 果我们请求您完成用于研究目的的问卷调查， 我们将收集所完成的调查问卷提供的信息；

(d) 网站和通讯使用情况►您 的网站访问详细信息以及通过缓存数据和其他跟踪技术收集的信息，包括但不限于您的IP地 址和域名、您的浏览器版本和操作系统、流量数据、位置数据、网页日志和其他通信数据以及您访问浏览的资源。

3.1 本节说明奥纬对于通过网站收集的个人信息的使用目的。

3.2 请注意，除了下文提出的信息披露之外，某些情况下我们还向奥纬的服务提供商、承包商、代理商和关联公司披露个人信息，这些 公司代表奥纬开展本声明所述的活动。

(a) 为了有效地与您沟通和开展我们的业务►为 了开展我们的业务，包括回答您的询问、因其他原因与您沟通或履行您与我们签订的任何协议所产生的义务，某些情况下可能包括将您的数据提供给第三方，如 代理商、承包商或我们的专业服务顾问（例如: 法律、财务、业务或其他顾问）。

(b) 为您提供营销信息材料►即 按照您本人的选择，提供最新信息以及相关优惠活动。 我们还可能通过邮寄、电子邮件、短信、电话和传真方式，使用您的个人信息向您推销我们自己和我们选定的业务合作伙伴的产品 和服务。若法律要求，我们将在收集个人数据时征求您对开展此类营销活动的同意。我们将在发给您的电子营销往来信函中提供取消信息订阅或退出接收后续信 函往来的选项，或者您可以按照下文第 5.5 段的规定联系我们，选择退出接收后续营销信函往来。

(c) 研究和开发目的►分 析您的个人信息以更好地了解您和其他客户的服务和营销需求，并且更好地了解我们的业务和开发我们的产品和服务。

(d) 监控某些活动►监 控查询和交易，旨在确保服务质量、程序合规以及打击欺诈行为。

(e) 通知调整和变化►通 知有关我们服务和产品的调整和变化。

(f) 确保网站内容的参考价值►确 保以最有效的方式将我们网站的内容呈现给您和发送到您的设备，其中可能包括将您的数据提供给业务合作伙伴、供应商和/或 服务提供商。

(g) 重组或调整我们的业务►如 果我们：（i） 将就出售全部业务或部分业务与第三方进行谈判; （ii） 被出售给第三方; 或（iii） 开展重组，作为尽职调查流程的一部分，我们可能需要将您的部分或全部个人信息转移给第三方（或第三方的顾问机构）用于分析业务出售或重组建议方案。我 们还可能需要在出售业务或重组后将您的个人信息转移给重组后的实体或第三方用于本隐私声明所述的相同目的。

(h) 涉及法律或监管义务►受 制于中国法律的义务和要求，我们处理您的个人信息以满足监管合规要求，或在需要的情况下作为与监管机构对话的一部分，其中可能包括就第三方、法庭服 务、监管机构和/或 执法机构的问询、法律程序或调查，或者当被强制要求时，向该等第三方、法庭服务、监管机构和/或 执法机构披露您的个人信息。在允许的情况下，我们将把上述信息披露要求转发给您，或者在回应上述信息披露要求之前通知您，除非这样做会妨碍犯罪预防或 侦查。

互联网安全性

4.1 通过互联网或网站传输的任何数据都无法保证免受入侵，但我们采取商业上合理的物理、电子和程序保护措施，依照数据保护法规 要求保护您的个人信息。

4.2 您所提供的全部信息都存储在奥纬或奥纬分包商的安全的服务器中（可能位于中国境外），信息的访问和使用均执行我们的安全政 策和标准规范。对于我们提供给您访问网站某些部分所需的密码（或您选择的密码），您有责任确保密码信息保密并遵守我们通知您的其他安全程序。 我们要求您不要与任何人共享密码。

个人信息的提供、传输和披露

4.3 作为跨国集团的一部分，为了我们的合法业务需求和上文第3节 提及的处理目的，我们可能会向威达信公司集团内的关联公司传输个人信息，包括奥纬的关联公司，具体名单点击此 处了 解（统称“接收方”）。

在我们向中国境外提供您的个人信息之前，我们将满足中国法律法规关于个人信息跨境传输的适用 要求，并要求海外接收方以不低 于中国适用法律法规要求的水平保护您的个人信息。

除法律要求或允许外，我们将不会在未寻求并取得您单独同意的情况下公开您的个人信息。

信息存储限制

4.4 我们在为信息收集的处理目的以及任何其他批准的关联目的（例如为了遵守某些法规要求，我们保留个人信息的时间要求超过最初 收集信息的目的）所需的时间内保留您的个人信息。相关目的实现后，我们将依照我们内部的信息保留政策对您的个人信息进行不可逆地匿名化处理（匿名化之 后的信息将被保留），或者将其安全地销毁。

营销

5.1 您有权要求我们不得出于营销目的处理您的个人信息。您可以随时点击发送给您的电子营销通信中的"取 消订阅"选 项，或按照下文第 5.5 段的规定联系我们，行使上述权利。

更新信息

5.2 我们将尽合理努力确保您的个人信息准确无误。为了帮助我们做到这一点，您应按照下文第5.5段 的规定联系我们，通知我们有关您所提供的个人信息的任何更改。

您的权利

5.3 在某些条件下，您有权：

(a) 知晓我们的处理活动，并根据适用法律对您的个人信息做出决定；

(b) 查阅和复制您的个人信息；

(c) 如果我们持有的信息不准确或不完整，更正或补充您的个人信息（请见第5.2段）；

(d) 要求我们删除任何我们不再有合法理由使用的个人信息；如果删除在技术上难以实现，或者法律要求我们继续保留该信息，我们将 停止与您的个人信息相关的所有处理活动，但通过采取必要的安全措施进行存储除外；

(e) 反对直接营销（包括任何用于此类目的的数据分析）；

(f) 根据适用法律拒绝或限制对您个人信息的处理；

(g) 要求我们解释说明我们对您个人信息的处理规则；

(h) 要求我们在满足法定转移条件时，将您的个人信息转移至您指定的个人信息处理者；

(i) 要求我们说明通过自动化决策方式作出的、对您的权益有重大影响的决定，以及拒绝仅通过自动决策的方式作出的决定；

(j) 如果处理是基于同意，您有权通过下文第5.5段 中的联系方式与我们联系，以撤回您的同意。

5.4 您对这些权利的行使受限于法律要求或允许的某些豁免和限制，并且（在适用法律允许的情况下）可能会收取合理的费用。如果您 行使任何这些权利，我们将核实您行使权利的资格并在大多数情况下在一个月内作出回应。

联系我们

5.5 如果您希望向我们或接收方行使您有关个人信息的权利，请发电邮联系PRCDSRSubmissions@oliverwyman.com。 如果您对本隐私声明有任何疑问，请发电邮联系owglegalandcompliance@oliverwyman.com。

6.1 我们可能修改网站的内容，因此未来我们的隐私声明可能不定期地修改。如果我们修改本隐私声明，我们将更新下文列出的隐私声 明最后修改日期。如果相关修订具有实质性影响，我们将采取合理步骤措施，通知您相关的修订和更改并在适用法要求的情况下征求您的同意。

6.2 本隐私声明最后更新日期为2021年11月1日。

We allow certain third parties to use cookies and other online tracking technologies to collect personal information of visitors on our websites, such as IP addresses and identifiers.  These third parties help us to personalize ads and content based on your interests, measure the performance of our ads and content, and derive insights about the audiences who saw our ads and content.  Certain of these third parties may have also collected your information from your activity on other companies’ websites, or through your direct relationship with them (e.g., Google), and they use that collective information to share de-identified insights about website visitors with companies like ours.  Others may offer free services or enhanced add on services to our company, and they may use your personal information for purposes beyond the services they provide to our company (for example, building consumer profiles to help other clients with their targeted advertising).  California law considers this exchange and processing of personal information to be a “sale” or “sharing” of personal information in some cases. 

For the names of specific third parties that we sell or share information with, please click on the “Manage Cookies” link below.

You have the right to opt out of the sale of your personal information or the sharing of your personal information for cross context behavioral advertising or targeting purposes. To opt out of disclosures of your personal information to third parties that may be considered selling or sharing under applicable law, please click on the “Manage Cookies” link at the bottom of this webpage and ensure the toggles for “Advertising” and “Analytics” trackers are set to “No”.

You may also implement a browser setting or extension to communicate your selling and sharing preferences automatically to the websites you visit.  Our websites process such “opt out preference signals” in a frictionless manner.  The current “opt out preference signal” with a defined protocol for companies to follow if they receive the signal is called the Global Privacy Control (GPC). GPC is available for an increasing number of browsers and browser extensions, listed here. If you want to use GPC, you can download and enable it via a participating browser or browser extension. More information about downloading GPC is available here.

Under certain state privacy laws, residents of the applicable states may have the following rights regarding their personal information.  These rights are subject to certain exceptions as described below.

Please note that, in many cases, we collect personal information on behalf of our commercial clients, pursuant to a contract.  In such circumstances, we act as a “service provider” or “processor” to our clients under applicable privacy laws, and are thus obligated to process personal information in accordance with clients instructions. Accordingly, in any case where we are acting as a service provider or processor to a Client, if you or your authorized agent wish to exercise any rights of the below rights, you should direct your request to our Client, who is the party responsible for receiving, assessing, and responding to your requests.  If you submit a request directly to us in a scenario where we only process your information as a service provider or processor, we may be required to deny your request.  If you are not certain what our role is with respect to your personal information, please contact us through one of the methods described at the end of this Privacy Notice.

When required, we will respond to most requests within 45 days, unless it is reasonably necessary for us to extend our response time.

1. Right to Confirm or Access Information

You may have the right to confirm whether we process your personal information or what information we process, and to obtain a copy of that information in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the information to another business without hindrance. If you submit a valid and verifiable request and we confirm your identity and/or authority to make the request, we will disclose to you any of the following at your direction (with various exceptions):

• The categories of personal information we have collected about you.
• The categories of sources for the personal information we have collected about you.
• Our business or commercial purpose for collecting that personal information.
• The categories of third parties to whom we disclose that personal information.
• If we sold your personal information for a business purpose, a list of the personal information types that each category of recipient purchased.
• If we disclosed your personal information to a third party for a business purpose, a list of the personal information types that each category of recipient received.
• The specific pieces of personal information we collected about you.

2. Right to Delete Personal Information

You may have the right to request that we delete any of your personal information that we collected from you and retained, subject to certain exceptions.  If you submit a valid and verifiable request and we can confirm your identity and/or authority to make the request, we will determine if retaining the information is permitted or required under law.

If no retention conditions apply, we will delete your personal information from our records and direct our service providers to do the same.

3. Right to Correct Personal Information

You may have the right to correct inaccuracies in your personal information, taking into account the nature of the personal information and the purposes of the processing of your personal information.  If you submit a valid and verifiable request and we can confirm your identity and/or authority to make the request, we will use commercially reasonable efforts to correct the inaccurate information.

4. Right to Limit Processing of SPI

We process sensitive personal information solely as necessary in performance of the Services, to ensure the security and integrity of the information, or as otherwise authorized under law or regulation.  Because we do not process your Sensitive Personal Information for other purposes, we do not provide any mechanism for you to limit our processing of such information.

5. Right to Opt-out of Profiling

We do not engage in automated processing of personal Information to make decisions that produce a legal or other significant effect.  Because we do not engage in such automated processing, we do not provide a mechanism for you to limit our processing of personal information in such a manner.

6. Right to Non-Discrimination

You may exercise your rights under law without discrimination.  For example, unless applicable law provides an exception, we will not:

• Deny you goods or services;
• Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties;
• Provide you a different level or quality of goods or services; or
• Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

We may offer you financial incentives to provide us with personal information that is reasonably related to the information’s value.  This could result in different prices, rates, or quality levels for our products or services.  Any financial incentive we offer will be described in written terms that explain the material aspects of the financial incentive program.  You must opt-in to any financial incentive program and may revoke your consent at any time by contacting us as indicated below.

7. Direct Marketing and Do Not Track Signals

Under California’s “Shine the Light” law, California residents may request and obtain a notice once a year about the personal information we disclosed to other businesses for their own direct marketing purposes.  Such a notice will include a list of the categories of personal information that were disclosed (if any) and the names and addresses of all third parties with which the personal information was disclosed (if any).  The notice will cover the preceding calendar year.  To obtain such a notice, please contact us as described below.

In addition, under this law you are entitled to be advised how we handle “Do Not Track” browser signals.  Because there currently is not an industry or legal standard for recognizing or honoring DNT signals, we do not honor Do Not Track requests at this time.

How to exercise the above rights

To exercise your rights to disclosure or deletion described above, please submit a verifiable consumer request to us by visiting our online privacy rights portal by clicking here.  Alternatively, you may call us at 855-246-3836.

*Please note that, as described above, in certain cases we may collect your personal information as a service provider pursuant to a contract we have with a commercial Client to provide the Service.  In any case where we are acting as a service provider to a Client, you should direct your requests to exercise your rights available under data privacy laws to our Client, who is the party responsible for receiving, assessing, and responding to your requests.

Only you or a person legally authorized to act on your behalf may make a verifiable consumer request related to your personal information.  To designate an authorized agent, we may require you to verify your identity or confirm with us directly that you have provided permission to your authorized agent, or we will rely on a power of attorney you have provided to your authorized agent.

You may make a verifiable consumer request for access or deletion no more than twice within a 12-month period. The verifiable request must:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative.  Depending on the nature of your request and the sensitivity of the information, we may ask you to confirm various data elements we already have on file, such as your mailing address and phone number, or, in the event you request access to sensitive personal information, we may require you to submit a copy of a government-issued form of identification.

and

• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

You will not be required to create an account with us in order to submit a verifiable request, though we may communicate with you about your request via a pre-established account if applicable.  However, in order to safeguard the personal information in our possession, if we cannot verify your identity or authority to act on another’s behalf, we will be unable to comply with your request.  We will process and retain personal information you provide when submitting a verifiable request only to confirm your identity or authority, or to fulfill your request.

How to appeal an action we have taken with respect to your request to exercise a right

In order to appeal a decision or denial we have made with respect to your personal information and a right you have requested to exercise in relation thereto, please contact the email address for appeals provided in our written response to your request. Our privacy team will consider your request and applicable law, and either agree to honor your appeal request or deny it.

We do not knowingly collect personal information from children under 13.  If we learn that we have collected any personal information from a child under the age of 13 without verifiable parental consent, we will delete that information from our files as quickly as possible.  If you believe that we may have collected information from a child under 13, please contact us at the email address provided below.

If you are 16 years of age or older, you have the right to direct us to not sell your personal information at any time (the “right to opt-out”).  However, we never knowingly sell or share the personal information of minors under 16 years of age, and would not do so in the future without affirmative authorization of the consumer if between 13 to 16 years of age, or the parent or guardian of a consumer less than 13 years of age.

To submit general questions, requests, complaints, or appeals regarding this Privacy Notice or our privacy practices, please contact us at  owglegalandcompliance@oliverwyman.com.

Last Updated: August 8, 2023