- What is this Policy about?
Last Updated: 1 January 2020
- What does S&P Global do?
- Personal information we collect
- Sharing of personal information
- Legal basis for processing personal information
- Cookies and similar tracking technology
- Keeping your personal information secure
- International data transfers
- Data retention
- Your data protection rights
- Use of Personal Information in Products
- Updates to this Policy
- Policy changes 1 Jan 2020
- How to contact us
- Russian Federation - Additional Provisions
- People’s Republic of China - Additional Provisions
- Japan - Additional Provisions
- State of California, United States - Additional Provisions
- What does S&P Global do?S&P Global is a leading provider of transparent and independent ratings, benchmarks, analytics and data to the capital and commodity markets worldwide. S&P Global’s divisions include S&P Global Ratings, S&P Global Market Intelligence, S&P Dow Jones Indices and S&P Global Platts. For more information about S&P Global, please see the “Who We Are” section of our website.
- What personal information does S&P Global collect and why?The information that we collect from or about you – some of which is personal information under applicable data protection laws –falls into the following broad categories:
1. Information that you provide to us
We ask you to provide certain information voluntarily, such as your contact details, user credentials, and employment information.
For example, when you fill out an on-line form to register to use our products and services or attend an event, provide us with your business card information or you request information from us. Information we ask you for and why we ask you for it include:
Types of personal information
Why we collect it
To maintain your account with us.
Contact details such as name, telephone numbers, email address and postal address.
To respond to your correspondence and inquiries, such as when you want to learn more about our conferences and webinars.
To gather information needed to provide products and services requested by you or your employer.
To obtain your feedback regarding our products and services or an event you attended, such as when we or our agents send you a customer satisfaction survey.
User credentials including name, email address and any personal information you provide to us when you create a profile.
To set up and maintain your user account. To monitor and enforce compliance with our contract terms.
Employer and employment information such as job title, function, seniority, department and location of your office.
To manage your individual user account when it is covered by an account of one of S&P Global's corporate customers, such as the corporate account of your employer.
Your preferences and interests, such as emails and newsletters you would like to receive or the markets, industries and conferences that interest you.
To enable us to send you tailored information on our products and services across our divisions that may interest to you.
Social security number, credit card numbers, and personal financial data (such as specific salary, mortgage details, net worth or individual portfolio information). We refer to this type of personal information as "Customer Financial Data".
In some cases, our corporate customer, such as a structured finance issuer or you, may provide Customer Financial Data to us for the purpose of informing our statistical analysis or for our use in providing our products or services. Customer Financial Data will not be used for purposes other than these, and will not be rented or otherwise made available to third parties for public distribution.
2. Information that we collect from you automatically
We may collect information automatically from your device, including information regarding how you use our websites, applications and other products and services.
Information we collect automatically includes your log-in events, IP or MAC address, device make, model and operating system, mobile network information, internet service provider, unique device identification number, advertising ID, browser type and language, geographic location (e.g., country or city level location or time zone) and other technical information. We collect "click stream" data, which is information about how your device interacts with our websites, applications and other products and services, such as the pages, screens and products accessed and links clicked.
This information helps us understand the visitors to our websites and the users of our applications and other products and services, the pages they visited before and after and what content interests them. We use this automatically-collected information:- for our analytics purposes;- to improve the quality and relevance to users, of our websites, applications and other products and services;- to develop and update our websites, applications and other products and services;- for customer services, such as evaluating our customers' training needs for our products;- to satisfy requests from S&P Global's corporate customers regarding the use of our products and services by individual users under their corporate accounts. (This information may be offered to clients in an aggregated form and clients may be required by law to request such information);- to deliver tailored information on our products and services that may be of interest or value to you and marketing and promotional e-mails with your consent if required by applicable law;- occasionally, to identify unauthorized use or unauthorized distribution of our products and services related or unrelated to a security issue;- where relevant, to review or update pricing agreed with our customers; and- for billing purposes, so that we or others (such as our content providers) can bill for the services provided.
Some of this information is collected using cookies and similar tracking technology - see "Cookies and similar tracking technology".
3. Information that we obtain from other sources
We may receive personal information about you from other sources (including your employer or business partner if you use S&P Global's products or services covered by a subscription). Where you register as a user, we will endeavour to check that these third parties have your consent or are otherwise legally permitted or required to disclose your personal information to us.The information we collect from your employer (if you use S&P Global products or services under your employer's corporate subscription) consists of your contact details and employment-related information.
We collect personal information from other third parties, such as marketing vendors, survey services, social media, conferences and other events that we or others organize, and other sources to the extent permitted by applicable law. We use this information to market our products and services to you, to maintain and correct our records, to add data fields, and to enhance the marketing and delivery of our products and services to you.
We collect personal information as part of our content collection process for some of our products. We obtain this from a variety of sources, including third-party content providers, public filings and websites, to display within some of our products. Find out more at “How does S&P Global use personal information in products?”.We also may use your personal information for other purposes that we explain to you at the time we collect your personal information or, if permitted by applicable data protection laws, that are compatible with the purposes we have disclosed to you (such as archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes).
4. Other personal information collected through our mobile apps
When you download, access or otherwise use one of our mobile apps, the information that we collect depends on your device, in-app and operating system permissions. To provide you with the functionalities of one of our apps, the app must access various functions and data on your mobile device.
When you agree, some of our apps collect the precise geo-location of your mobile device. Some of our apps also collect information which may be personal information about you or others, from or about:
- Your calendar
- Your contacts and call information
- The accounts and other apps on your mobile device
- Photos (including date, time, location and contents)
- Media files, metadata and other stored information
We also automatically collect app logs and usage statistics. For example, we record when you open an app so that we can monitor which app is used, when and how, and if the app stops working, we log the “crash data”, such as whether you have mobile reception, to help us identify and fix the cause.
To learn more about the specific information collected by any of our mobile apps, please check your device settings or review the platform from which you downloaded it, such as in Google Play. To stop collection of all information through one of our apps, please uninstall the app.
When you download one of our mobile apps from Apple’s App Store or Google Play (each, an “App Platform”), you acknowledge and agree that:
- As between S&P Global and the App Platform, S&P Global is solely responsible for the App.
- The App Platform has no obligation to provide any maintenance and support services with respect to the applications.
- In the event of any failure of our mobile apps to conform to any applicable warranty: (i) you may notify the App Platform and the App Platform may refund the purchase price for the applications to you (if applicable), (ii) to the maximum extent permitted by applicable law, the App Platform will have no other warranty obligation whatsoever with respect to the applications, and (iii) any other claims, losses, liabilities, damages, costs or expenses attributable to any failure to conform to any warranty is, as between S&P Global and the App Platform, S&P Global’s responsibility.
- The App Platform is not responsible for addressing any claims you have relating to the applications or your possession and use of the applications.
- You must also comply with all applicable third-party terms when using the applications.
- How does S&P Global use and share my personal information?We may disclose your personal information to the following categories of recipients.
Our group companies, service providers, product content providers and business partners
We provide personal information to our group companies, S&P Global divisions, service providers, and business partners who or that process personal information for purposes consistent with those described in this Policy or notified to you when your personal information is collected. For example, we may share your contact information and attendee lists within our S&P Global divisions and with our webinar and conference partners. A list of our current group companies is available here and a list of our service providers, content providers and business partners is available here.
Your employerWe provide personal information to your employer for purposes such as to fulfil and enforce our contract with them, to inform them of potential group training needs, to inform them of product/service use by certain categories of users and for pricing purposes.
Competent law enforcement bodies, regulatory, government agency, court or other third partiesWe provide personal information to any competent law enforcement body, regulatory, government agency, court or other third party when we believe disclosure is necessary (i) as a matter of applicable law or regulation, (ii) to exercise, establish or defend our legal rights, or (iii) to protect your vital interests or those of any other person.Potential BuyersWe provide personal information to a potential buyer (and its or our agents and advisers) in connection with any proposed purchase, merger or acquisition of any part of our business. We inform the buyer that it must use your personal information only as disclosed in this Policy.
Any other person or entity
Personal information that you disclose on message boards, chat areas or our social media pages or in direct messages to other users may be collected and used by third parties without our knowledge or control. We encourage you to use caution when publicly disclosing your personal information.
- What is our legal basis for processing personal information?Our legal basis for collecting and using personal information depends on the personal information concerned, the context in which we collect it and the applicable laws and regulations.
Generally, we collect personal information from you where: we have your consent to do so; we need the personal information to perform a contract with you (for example, your subscription to one of our products); or, in some jurisdictions such as the EEA, the processing is in our legitimate interests and not overridden by your data protection interests or fundamental rights and freedoms or the processing is otherwise consistent with applicable law. In some cases, we are required by law to collect personal information from you.
If we ask you to provide personal information to comply with a legal requirement or to perform a contract with you, we will inform you whether the provision of your personal information is mandatory and the possible consequences if you do not provide your personal information.
Generally, if we collect and use your personal information in reliance on our legitimate interests (or those of a third party), this interest is to provide our products and services to you and for our legitimate commercial interest (e.g., when responding to your queries, improving our products and services, advising you of product features or new releases, informing you of product maintenance, or undertaking marketing activities).
Where we send you marketing or promotional e-mails regarding our products or services from our different divisions and affiliates, we do so based on your consent, if required by applicable law.
We use Google Analytics to better understand how visitors use our websites. Please see https://policies.google.com/technologies/partner-sites for more information about how Google uses the information it collects through our websites. For Google Analytics’ currently available opt-outs, please see https://tools.google.com/dlpage/gaoptout/.
- How does S&P Global keep my personal information secure?We protect personal information that we process with appropriate technical and organizational measures designed to provide a level of security appropriate to the risk of processing your personal information.
- How does S&P Global treat international data transfers?Your personal information may be transferred to, and processed outside the country in which you are resident. These other jurisdictions may have data protection laws that are different from the laws of your country (and, in some cases, not as protective).
Our servers may be located outside of the jurisdiction where we collected the data, such as United States, Canada, United Kingdom, Ireland, Germany, the Netherlands and Singapore. When we collect your personal information, we may transfer it to or process it in any of the countries in which we do business.
Our group companies, service providers, product content providers and business partners, with whom we may share personal information, are located in and transfer personal information to various jurisdictions around the world.
We use appropriate safeguards to ensure that your personal information is protected in accordance with this Policy. These safeguards include implementing the European Commission’s Standard Contractual Clauses for transfers of personal information between our group companies, which require all group companies to protect personal information they process from the EEA in accordance with European Union data protection law. Please contact us to request a copy of our Standard Contractual Clauses.
- For how long does S&P Global retain personal information?We retain personal information that we collect from you for as long as we have an ongoing legitimate business need to do so (for example, to provide you with a product or service you have requested, as set forth in our information governance procedures, or to comply with applicable legal, tax or accounting requirements).When we have no ongoing legitimate business need to process your personal information, we follow our information governance procedures and either delete or anonymise your personal information, or if deletion or anonymization is not possible, then we securely store your personal information and isolate it from any further processing until deletion is possible.Please contact us for more information about the period of time for which we will process your personal information.
- What are your data protection rights?Your rights include the right to access, correct, update or request deletion of your personal information and withdraw the consent you have provided to us, subject to applicable data protection laws.You may have the following data protection rights:- to access, correct, update or request deletion of your personal information, and to request a copy of your personal information in a portable format.
- to object to our processing of your personal information if we are: using legitimate interests to justify that processing, using the personal information for direct marketing purposes, or using the information for scientific or historical research purposes or statistical purposes.
- to restrict our processing of your personal information under circumstances such as when you contest the accuracy of our records about you or you make an objection.
- to opt-out of marketing and promotional e-mails we send you at any time. You can exercise this right by clicking on the “unsubscribe” or “opt-out” link in the marketing e-mails we send you, by using the S&P Global division-specific contact details below, or by visiting the preference centre for each division by clicking here:
- if we collect and process your personal information with your consent, then you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted before withdrawal, nor will it affect processing of your personal information conducted in reliance on lawful processing grounds other than consent.
- to complain to a data protection authority about our collection and use of your personal information. For more information, please contact your local data protection authority. (Contact details for data protection authorities in the European Economic Area and Switzerland are available here.)
We respond to all requests we receive from individuals wishing to exercise their data protection rights or express any concern in accordance with applicable data protection laws and in any event within 30 days.
- How does S&P Global use personal information in products?Some of our products contain personal information about persons who are directors, officers, managers, trustees or large shareholders of companies. S&P Global obtains such data from publicly available and other sources.Our products include business contact details, professional history details, work data, compensation details, education history data, shareholding and common holding information, and photographs (if you have made photographs available publically).Information in our products is for reference purposes, such as to identify the officers or shareholders of a particular organization or common shareholders or officers among otherwise not obviously related corporate entities, and is made available to our customers for this purpose. Customers are required by contract to comply with applicable data protection laws and their use of personal information is restricted by their contract with S&P Global. S&P Global customers are located worldwide, including countries with data protection laws that may offer lower protections than the laws of your country.S&P Global may share personal information in its products within its corporate group and those parties who provide content to S&P Global. S&P Global will not use your personal information for any other purposes than as described above, which is within S&P Global's legitimate commercial interests to provide S&P Global products and services to its customers.
S&P Global updates the information in its products for accuracy on a regular basis. S&P Global removes data from its systems when such data becomes obsolete or inaccurate and S&P Global operates data governance standards for collection, use and retention of the personal information.
Residents of the State of Nevada have the right to opt out of the sale of certain pieces of their information to third parties who will sell or license their information to others. If you are a Nevada resident and would like to make such a request, please email email@example.com.
We review and update this Policy from time to time. When we do, we will note the date of the version on the Policy and post it.
• Simplified the Policy language and structure to make it easier to navigate and find the information you may be looking for;
• Created jurisdiction-specific addenda for you to easily find jurisdiction-specific information, including relevant information for the California Consumer Privacy Act (CCPA) and the People’s Republic of China regulations;
• Specifically call out at the start of the Policy the fact that third parties that link from our online properties and products, and the third parties from whom we may collect personal information, have their own privacy policies that may apply to the information that they collect from individuals.
- How can you contact us?If you have any questions or concerns about our use of your personal information, please contact our Chief Privacy Officer and Data Protection Officer at firstname.lastname@example.org or 55 Water Street, New York, NY 10041.You may also use this personal data request form to contact us or exercise any of your rights.If the controller of your personal information is located outside the EEA, below are the details of the EU representative of non-EEA controller by division.
S&P Global Ratings
S&P Global Ratings Europe Limited
Fourth Floor, Waterways House
Grand Canal Quay
Dublin 2, Ireland
S&P Global Market Intelligence
20 Canada Square
S&P Dow Jones Indices
20 Canada Square
S&P Global Platts
20 Canada Square
- Russian FederationThis Russian Federation Addendum (“Russian Federation Addendum”) applies in relation to the processing of personal information of Russian citizens by S&P Global affiliates registered in the Russian Federation and supplements this Policy. In case of any inconsistencies between this Russian Federation Addendum and the rest of this Policy, this Russian Federation Addendum prevails.
- People’s Republic of ChinaThis China Addendum (“China Addendum”) applies only if you are located in the People’s Republic of China (“China”) and supplements this Policy. In case of any inconsistencies between this China Addendum and the rest of this Policy, this China Addendum prevails.
1. Sensitive Personal Information. Your telephone number, national identification card number, email address, data regarding your physical and/or mental health, sexual orientation, religious or similar beliefs and certain information about your use of Company Technology IT Systems, such as your location, web-page browsing history, content and record of your communications, may be considered as sensitive personal information in accordance with applicable Chinese law and regulations. We will only use it for the purposes as stated in this Policy and will take measures to ensure its security.2. Sale of business. We may transfer any personal information when we sell or transfer all or a portion of our business or assets to a third party such as in the event of merger, acquisition, liquidation or similar event. We will require such third party to continue to comply with this Policy including this China Addendum or require such third party to obtain your consent again.3. Notifications. We cannot absolutely guarantee the security of any information or data you provide online. In the event of a serious security incident, we will notify you and report to competent regulators in China as required by applicable law.4. Closure of a registered account. If you want to close an account which is registered with S&P Global, please contact our Chief Privacy Officer at email@example.com or Chief Privacy Officer, at: 49/F, Fortune Financial Center, No.5, Dongsanhuan Zhong Rd, Chaoyang District, Beijing.
- JapanThis Japan Addendum (“Japan Addendum”) applies in relation to the processing of personal information in Japan by S&P Global Ratings Japan Inc., S&P Global SF Japan Inc., and Standard & Poor’s International LLC, Japan Branch (together “S&P Global Japan”) and supplements this Policy. In case of any inconsistencies between this Japan Addendum and the rest of this Policy, this Japan Addendum prevails.S&P Global Japan will comply with applicable Japanese data protection laws and regulations, and not use personal information for purposes which are not set forth in this Policy. The process for dealing with customers’ claims is set out in this Policy.
Use of personal information inside the S&P Global groupS&P Global Japan uses personal information with other entities in the S&P Global who may use such information to provide information about our products and services to our clients, conduct certain market research or contact clients. Such information includes: address, name, company name, department name, job title, phone number, fax number, e-mail address, billing information, history of personnel changes and professional employment history, records of job interviews with S&P Global Japan, your areas of interest, etc.A list of our group companies is available here.
Anonymously Processed Information provided to S&P Global Ratings Japan Inc. and S&P Global SF Japan Inc. and shared by S&P Global Ratings Japan Inc. and S&P Global SF Japan Inc. with other companies in the S&P Global group.S&P Global Ratings Japan Inc. and S&P Global SF Japan Inc. share anonymously processed information with other companies in the S&P Global group on an ongoing basis in the context of structured finance business. The “information items relating to individuals” included in the anonymously processed information shared with those companies and the “method of sharing” those items are set out below.
“Information items relating to individuals to be shared with other companies in the S&P Global group”:• Information in relation to borrowers and joint guarantors (borrower code allocated by a creditor, age-related information, gender, address-related information, occupation-related information, annual income, account balance etc)• Loan information relating to the individual borrower (category, loan amount, loan period, information-related to property location and evaluation amount)
“Method of sharing the anonymously processed information”:By such means as uploading or sending by e-mail to a server that only authorized S&P Global group personnel may access.
If you have any questions or concerns about our use of your personal information, please contact our Chief Privacy Officer via email at firstname.lastname@example.org or Japanprivacy@spglobal.com or via mail, at:Marunouchi Kitaguchi Bldg. 28th Floor1-6-5 MarunouchiChiyoda-kuTokyo100-0005Tel: +81-(0)3-4550-8000.
- State of California, United StatesThis State of California, United States Addendum (“California Addendum”) applies in relation to the processing of personal information of residents of the State of California in the United States by S&P Global as required by the California Consumer privacy Act (“CCPA”) and supplements this Policy. In case of any inconsistencies between this California Addendum and the rest of this Policy, this California Addendum prevails.
Certain information we collect may be exempt from the CCPA because it is considered public information (i.e., it is made available by a government entity) or covered by a federal privacy law, such as the Gramm–Leach–Bliley Act, the Health Insurance Portability and Accountability Act, or the Fair Credit Reporting Act.
Right to Access Information
You have the right to request access to personal information collected about you and information regarding the source of that information, the purposes for which we collect it, and the third parties and service providers with whom we share it. To protect our customers’ personal information, we are required to verify your identify before we can act on your request.
Right to Request Deletion of Information
You have the right to request in certain circumstances that we delete any personal information that we have collected directly from you. To protect our customers’ personal information, we are required to verify your identify before we can act on your request. We may have a reason under the law why we do not have to comply with your request, or why we may comply with it in a more limited way than you anticipated. If we do, we will explain that to you in our response.
Right to Information Regarding Participation in Data Sharing for Financial Incentives
We will ask you for your consent before collecting your personal information in connection with offering a financial incentive.
Right to Opt Out of Sale of Personal Information to Third Parties
You have the right to opt out of any sale of your personal information by us to third parties. Please note that your right to opt out does not apply to our sharing of personal information with service providers, who are parties we engage to perform a function on our behalf and are contractually obligated to use the personal information only for that function.
“Shine the Light” Law
Residents of the State of California also have the right to request information regarding third parties to whom the company has disclosed certain categories of personal information during the preceding year for the third parties’ direct marketing purposes.
How to Submit a Request
To submit a request to exercise your rights:(1) For Access and Deletion rights, fill out a Data Request Form.(2) For the Opt-out right, visit “Do Not Sell My Personal Information”.(3) Call us on 1-855-529-1761.The following is a description of our data collection practices, including the personal information we collect, the sources of that information, the purposes for which we collect information, and whether we disclose that information to external parties. We may use any and all of the information for any of the purposes described in the Policy, unless limitations are listed. The categories we use to describe the information are those set out in the CCPA.• Personal Identifiers:o We collect your name, phone number, email address, and contact address when you create an account, an account is created for you or you complete a transaction. If you choose to create an account, you will also be asked to create a username, and we will assign one or more unique identifiers to your profile.o You provide us with payment and billing information when you purchase one of our products or register for a paid event.o We collect social security numbers, credit card numbers and personal financial data from you or corporate customers such as structured finance issuers for the purpose of informing our statistical analysis or to use in providing our products or services. Such data will not be used for purposes other than these, rented or otherwise made available to third parties for public distribution.o We do not collect your Driver’s License number or Passport number.o We do not collect any medical information or health information about you.o We collect your IP address automatically.o We collect your Device ID automatically.o We collect your photograph if you make one available through a publicly available means, such as a publicly available social media profile.• Protected Classifications: We collect your age and gender.• Commercial Information: When you engage in transactions with us, we create records of goods or services purchased or considered, as well as purchasing or consuming histories or tendencies.• Biometric Information: We do not collect information about your physiological, biological, or behavioral characteristics.• Internet or Other Electronic Network Activity Information: We collect information about your browsing history, search history, and information regarding your interaction with product portals, websites, applications, or advertisements automatically when you use our website and services.• Geolocation Data: As described above, we collect your IP address automatically. We may be able to determine your general location based on the IP address. Some of our mobile applications will also collect your precise location (e.g., your GPS coordinates), though users can turn off location tracking in their mobile device settings• Audio, electronic, visual, thermal, olfactory, or similar information: If you contact us via phone, we may record the call. We will notify you if a call is being recorded at the beginning of the call. We may collect your image. We do not collect any thermal, olfactory, or similar information.• Professional or employment-related information: We collect information about your current employer, position, and other aspects of your professional history.• Education information: We collect information about the institutions you have attended or the level of education you have attained.• Inferences drawn to create a profile about a consumer reflecting the consumer’s preferences or characteristics: We may analyze your actual or likely preferences through a series of computer processes. On some occasions, we may add our observations to your internal profile.We may share such information with service providers, which are external parties that we engage for business purposes and are restricted from using personal information for any purpose that is not related to our engagement. The categories of service providers with whom we share information and the services they provide are described here.The CCPA provides California residents with certain rights in relation to the “sale” of information to third parties. According to the CCPA, to “sell” personal information means to disclose it to an external party for monetary or other benefit where, for example, our contract does not restrict that party from using such information for other purposes. We may “sell” information in the following limited circumstances:• Personal Identifiers:o We display contact information in our products, which are accessible by our subscribers and the subscribers of our business partners. We disclose contact information to our webinar and conferences partners (i.e., attendee lists).o We provide contact information to public safety authorities where necessary.o We provide IP addresses and Device IDs to our advertising partners.o We display photographs in our products, which are accessible by our subscribers and the subscribers of our business partners.• Protected Classifications: We display age, if available, in our “Professionals” database, which is accessible by our subscribers and the subscribers of our business partners. We do not display individuals’ genders.• Internet or Other Electronic Network Activity Information: We disclose information about subscribers’ interactions with our products to businesses from which we collect data.• Professional or employment-related information: We display information about an individual’s current employer, position, compensation details and other aspects of an individual’s professional and education history in our products, which are accessible by our subscribers and the subscribers of our business partners.• Inferences drawn to create a profile about a consumer reflecting the consumer’s preferences or characteristics: Third parties such as advertising partners may collect personal information using cookies or other tracking technologies as disclosed in our Cookie Notice.