How can I exercise my rights under data privacy laws, such as to access or correct my personal information, request that it be deleted, or ask for it to be transferred to another organization?

You may have certain rights with respect to your personal information under applicable data protection laws or contractual commitments made by the Company.

If you would like to exercise these rights, you may use this personal information request form, email privacy@spglobal.com, or call us at 1-855-529-1761. If you disagree with how we handled a request, you may appeal our decision by contacting us with the subject line “Appeal,” at privacy@spglobal.com. The Company will address your request based on the data protection laws of your particular jurisdiction. We will respond to your request within 30 days or earlier if we can or are required to do so by applicable law.

Subject to applicable law, you may have the following rights in relation to your personal information:

• Right of access: You may request access to your personal information, confirmation that we have information about you, or information about our processing of your personal information which may include, depending on your jurisdiction the right to request: the categories of personal information we process or have processed about you, a list of the specific third parties with whom your personal information was disclosed, or access to your data in a portable, machine-readable format. If you require additional copies, we may need to charge a reasonable fee where permissible under applicable law.
• Right to rectification: If your personal information is inaccurate or incomplete, you are entitled to ask that we correct or complete it. If we shared your personal information with others, we will tell them about the correction where possible. If you ask us, and where possible and lawful to do so, we will also tell you with whom we shared your personal information so you can contact them directly. Note that we may keep historical information in our backup files as permitted by law.
• Right to erasure: You may ask us to delete or remove your personal information, such as where personal information is no longer necessary in relation to the purposes for which we collected it. If required by law, we will grant a request to delete information, but you should note that in many situations we may keep the personal information to comply with our legal obligations, resolve disputes, enforce our agreements, or for another business purpose. If we shared your personal information with others, we will tell them about the erasure where possible. If you ask us, and where possible and lawful to do so, we will also tell you with whom we shared your personal information so you can contact them directly.
• Right to restrict processing: You may ask us to restrict or block the processing of your personal information in certain circumstances, such as where you contest the accuracy of the data or object to us processing it. We will tell you before we lift any restriction on processing. If we shared your personal information with others, we will tell them about the restriction where possible. If you ask us, and where possible and lawful to do so, we will also tell you with whom we shared your personal information so you can contact them directly.
• Right to data portability: You have the right to obtain from us your personal information that you consented to give us or that is necessary to perform a contract with you. We will give you your personal information in a structured, commonly used and machine-readable format. You may reuse it elsewhere.
• Right to object: You may ask us at any time to stop processing your personal information, and we will do so if we are relying on a legitimate interest to process your personal information – unless we demonstrate compelling legitimate grounds for the processing.
• Right to withdraw consent: If we rely on your consent to process your personal information, you have the right to withdraw that consent at any time. This will not affect the lawfulness of processing before we received notice that you wished to withdraw your consent.
• Right not to be discriminated against: If you exercise any of the rights set out in this Section, in certain jurisdictions you have the right not to be discriminated against as a result of such exercise.
• Right to object to use of automated processing: Depending on the laws applicable to you based on your location, you may have the right to object to, or opt out of, the use of automated processing that is used as a substantial or sole factor in making decisions that produce legal or similarly significant effects concerning you. We do not make such decisions based solely on automated processing, except where permitted by applicable law and with appropriate safeguards. If you exercise this right,  please contact us using the details in this Policy, and we will respond in accordance with applicable law.
• Request human review: Where applicable law grants it, you may request that a qualified human decision-maker who has authority to change the outcome independently review any decision made with the assistance of automated processing, including the right to express your point of view and to contest the outcome.
• Receive an explanation: Where applicable law grants it, you may request meaningful information about the logic involved in the automated processing and its significance and likely consequences for you, subject to the protection of trade secrets and others’ rights.
• Right to nominate: In certain jurisdictions, you may have a right to nominate another person to exercise your rights in the event of death or incapacity.
• Right to make a data protection complaint: In certain jurisdictions, you have the right to directly complain to us about the way we handled your personal information.
• Right to lodge a complaint with the data protection authority: If you have a concern about our privacy practices, including the way we handled your personal information, or if you are not satisfied with our response, you may have the right to lodge a complaint with your local supervisory authority. Contact details for certain data protection authorities are available here.
• Please note, not all of the rights described above are absolute, and they do not apply in all circumstances. In some cases, we may limit or deny your request because the law permits or requires us to do so, because a right is not granted by the laws that apply to a specific person, or if we are unable to adequately verify your identity. Additionally, in certain jurisdictions we may be entitled to charge a fee in connection with the exercise of these rights, which will be communicated to you if applicable.
• Please note that in order to fulfill your request, we may need you to provide certain personal information to verify your identity. We may verify your identity in person, by phone call, or via email. Depending on your request, we will ask for information, such as photographic or other forms of identification to verify your identity.

In some circumstances, you may designate an authorized agent to submit a request to exercise certain privacy rights on your behalf. If you are an authorized agent submitting a request on behalf of an individual, you must provide all requested information establishing your authorization as an agent to act on another person’s behalf.

Please note, we may deny a request from an authorized agent that does not submit proof that they have been authorized to submit such request.