EEA, UK, And Switzerland Privacy Notice

Last Updated and Effective Date: October 23, 2024

This EEA, UK, and Switzerland Privacy Notice supplements the Southwestern Privacy Notice and includes additional information and disclosures we are required to provide to individuals located in the European Economic Area (including the European Union) (“EEA”), United Kingdom (“UK”), or Switzerland. You should read them both carefully.

To make it simple, we use the same terms as defined in our Privacy Notice. Any new terms will be defined below. This EEA, UK, and Switzerland Privacy Notice should be read together with our Privacy Notice.

Effective Date and Changes to this EEA, UK, and Switzerland Privacy Notice

This EEA, UK, and Switzerland Privacy Notice is effective as of the “Last Updated and Effective Date” above and will remain in effect except with respect to any provisions that are changed in the future. Southwestern may make changes to this EEA, UK, and Switzerland Privacy Notice from time to time and will notify you by posting a revised version on the Site.

Our Relationship with You

If you are using Southwestern products or services where you enrolled in such products or services as a user (or an individual enrolled you on your behalf), then Southwestern is the controller of your Personal Information because we determine the means and purposes of processing this information.

If you are receiving a Southwestern product or service through another entity, such as one of our customers, dealers, or wholesalers, then that entity is the controller of your Personal Information, and Southwestern processes that Personal Information on behalf of the controller.

Our Lawful Bases for Processing Your Personal Information

Southwestern’s lawful bases for processing your Personal Information are to perform a contract with you or at your request prior to entering into a contract with you, with your consent, or to comply with a legal obligation. We also process your Personal Information for our legitimate interest in our business needs, balanced against the rights and freedoms of all individuals affected by that need. These interests incorporate considerations of the risks present in our processing, your likely response to those risks, and what benefits you are likely to receive from our processing.

We process Personal Information for several legitimate interests, including:

fulfilling our contract with our customers based upon our legitimate interest as a business in providing the products and services we offer;
in response to communications initiated by you based upon our legitimate interest as a business in responding to inquiries or suggestions about our business and the corresponding benefit you will receive in our response;
for direct marketing based upon our legitimate interest as a business in sharing information about our products and services and the corresponding benefit you will receive in learning about our products and services;
to protect against fraud based upon our legitimate interest as a business in protecting our business, products, and services; and
to ensure network and information security based upon our legitimate interest as a business in maintaining the confidentiality, security, and integrity of the information in our network and the corresponding benefit you will receive in the maintenance of the security of your Personal Information.

Disclosing Your Personal Information

Please note that in addition to the purposes for which we may disclose your Personal Information listed in the Privacy Notice, in certain situations, Southwestern may be obligated to disclose Personal Information in response to a lawful request by public authorities, including to meet national security or law enforcement requirements.

Your EEA,UK, and Swiss Privacy Rights

Under certain circumstances and in accordance with EU, UK, Swiss, or other applicable data protection laws, you may have the following rights:

Right to be Informed

Individuals have a right to be informed of how your Personal Information is collected and used. We provide that through the Southwestern Privacy Notice.

Right of Access

Individuals may have the right to access this Personal Information we have collected about you.

Right to Rectification

Individuals may have the right to request correction of any inaccurate Personal Information that we maintain about you.

Right to Erasure

Individuals may have the right to request that we delete any of your Personal Information that you have provided or that we have collected or obtained about you, subject to certain exceptions.

Right to Restrict Processing

Individuals may have the right to ask us to restrict the processing of your Personal Information in certain circumstances.

Right to Object to Processing

Individuals may have the right to object to the processing of your Personal Information in certain circumstances, and at any time where the processing takes place for the purposes of legitimate interests pursued by us or a third party. Note that the right to object under legitimate interests is absolute for direct marketing but is not absolute for other processing. We will be allowed to continue to process your Personal Information if we can demonstrate “compelling legitimate grounds for the processing which override your interests, rights and freedoms” or we need this for the establishment, exercise, or defense of legal claims.

Right to Data Portability

Individuals may have the right to ask that we transfer the Personal Information you gave us to another organization or to you in certain circumstances.

Right to Withdraw Consent

Individuals may have the right to withdraw previously given consent to process your Personal Information.

Right to Object to Automated Processing

Southwestern does not generally engage in automated processing of the information we collect about you, except to the extent that our use of cookies for targeted advertising qualifies as automated processing under applicable law. Therefore, please review our Cookie Notice and Your Cookie Rights and Choices regarding cookies.

Individuals may have the right to object to decisions being made with your Personal Information solely based on automated decision making or profiling.

Exercising Your Rights

You are not required to pay any charge for exercising your rights. If you make a request, we will respond to you as required under the applicable data protection law.

Please note that we may still use any aggregated and/or anonymized Personal Information that does not identify any individual, and may also retain and use Personal Information as necessary to comply with our legal obligations.

If you are using a Southwestern product or service where you enrolled in such products or services as a user (or an individual enrolled you on your behalf), to exercise your rights, please contact us at:

Form: here

If you are receiving a Southwestern product or service through another entity, that entity is the controller of your Personal Information, and Southwestern is not permitted to respond directly to requests related to processing of Personal Information from such users. Requests must be directed to the entity that controls the Personal Information.

The deletion or cessation of collection of information may result in cancellation of programs and subscriptions or other services initially provided to you.

Please note that if you are one of our customer’s employees and you unsubscribe from receiving promotional or marketing communications from us, we may continue to send you transactional or service-related emails.

International Transfers

We are a global business which results in your Personal Information likely being transferred to, stored, and processed in the U.S. and other countries outside of where you live. When we conduct such transfers, we rely on various legal bases to lawfully transfer Personal Information around the world, including fulfillment of our agreements with you, your prior consent, adequacy decisions for relevant countries, or other transfer mechanisms as may be available under applicable law, such as the European Union Commission approved standard contractual clauses.

The EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework

Southwestern/Great American, Inc. and its U.S. subsidiaries and related U.S. entities that provide products and services to individuals in the European Economic Area, the United Kingdom, Gibraltar, and Switzerland, including Southwestern Advantage, Inc., Southwestern Consulting, Inc., and Southwestern Talent, LLC (collectively, the “Southwestern EEA/UK/Switzerland Entities”) have aligned themselves with the EU General Data Protection Regulation and the UK General Data Protection Regulation as described below.

The Southwestern Privacy Notice and this EEA, UK, and Switzerland Privacy Notice reflect our procedures for processing and protecting Personal Information globally. In these documents, we provide:

Details on how we collect, use, and disclose your Personal Information and the choices available to you.
Information about the responsibilities of businesses that process Personal Information, such as the legal basis for processing Personal Information.
Rights of data subjects that may be applicable, such as requesting information about the Personal Information we store, or how it may be modified or deleted.

The Data Privacy Framework (defined below), administered by the U.S. Department of Commerce (the “DOC”), provides a legal mechanism for participating U.S. organizations to receive Personal Information from individuals in the European Economic Area, the UK, Gibraltar, and Switzerland (the “DPF Program”). The Southwestern EEA/UK/Switzerland Entities comply with the EU-U.S. Data Privacy Framework (“EU-U.S. DPF”) with regard to the processing of Personal Information received from the European Union, the UK Extension to the EU-U.S. DPF with regard to the processing of Personal Information received from the United Kingdom and Gibraltar, and the Swiss-U.S. Data Privacy Framework (“Swiss-U.S. DPF”) with regard to the processing of Personal Information received from Switzerland (collectively, the “Data Privacy Framework”). The Southwestern EEA/UK/Switzerland Entities have certified to the DOC that they adhere to the EU-U.S. DPF Principles, the UK Extension to the EU-U.S. DPF Principles, and the Swiss-U.S. DPF Principles (collectively, the “DPF Principles”) in order to participate in the DPF Program. If there is any conflict between the terms in this Privacy Notice and the DPF Principles, the applicable DPF Principles shall govern. To learn more about the Data Privacy Framework, the DPF Principles, the DPF Program, or to view our certification, please visit https://www.dataprivacyframework.gov/

Please note, this section does not apply to the Southwestern subsidiaries or related entities that are based outside of the U.S. None of those subsidiaries or entities are part of the DPF Program, nor have they committed to following the DPF Principles.

With respect to Personal Information received or transferred pursuant to the DPF Program, the Southwestern EEA/UK/Switzerland Entities are subject to the regulatory enforcement powers of the U.S. Federal Trade Commission, which has jurisdiction over Southwestern EEA/UK/Switzerland Entities’ compliance.

Under certain conditions, more fully described at this link https://www.dataprivacyframework.gov/assistance, you may invoke binding arbitration for complaints regarding compliance with the DPF Principles not resolved by any of the other mechanisms under the DPF Principles.

Choice

In compliance with the DPF Principles, you have the right to opt out of:

Disclosures of your Personal Information to third parties not identified at the time of collection or subsequently authorized, and
Uses of your Personal Information for purposes materially different from those disclosed at the time of collection or subsequently authorized.

If you choose to opt out, please let us know by following the instructions in the Exercising Your Rights section above.

Onward Transfers

In the context of an onward transfer, Southwestern EEA/UK/Switzerland Entities have responsibility for the processing of Personal Information received under the DPF Program and subsequently transferred to a third party acting as an agent on our behalf. Southwestern EEA/UK/Switzerland Entities shall remain liable under the DPF Principles if our agent processes such Personal Information in a manner inconsistent with the DPF Principles, unless the organization proves that it is not responsible for the event giving rise to the damage.

If you have a related question or concern, please contact us through our privacy portal.

In compliance with the DPF Principles, the Southwestern EEA/UK/Switzerland Entities commit to resolve complaints about our collection or use of your Personal Information. EU, UK, Gibraltar, or Swiss individuals with inquiries or complaints regarding our Privacy Notice or practices should first contact Southwestern through our privacy portal.

Southwestern EEA/UK/Switzerland Entities commit to refer unresolved complaints concerning our handling of Personal Information received from individuals in the EEA, UK, Gibraltar, and Switzerland to JAMS, an alternative dispute resolution provider based in the United States. If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, please visit the JAMS website for more information or to file a complaint. The services of JAMS are provided at no cost to you.

Contact Us

If you have any questions or concerns about our EEA, UK, and Switzerland Privacy Notice, you can contact us at:

Form: here

Phone: (888) 551-5901

Postal Address:

c/o the Vice President of I.T. of the Southwestern Family of Companies
2451 Atrium Way
Nashville, Tennessee 37214

If you are in the EU/UK, you may address privacy-related inquiries to our EU/UK representatives at:

EU:

Osano International Compliance Services Limited
ATTN: KP4S
3 Dublin Landings
North Wall Quay
Dublin 1
D01C4E0

UK:

Osano UK Compliance LTD
ATTN: KP4S
42-46 Fountain Street
Belfast
Antrim
BT1 – 5EF

We will respond to requests, inquiries, or concerns within 30 days. If you make a request to exercise one of your rights, we will respond according to the applicable data protection law.

You may also lodge a complaint with the data supervisory authority competent for your country or region if you feel unsatisfied with our treatment of your Personal Information.