WATERS CORPORATION EEA PRIVACY DISCLOSURES

Effective Date: May 25, 2018
Last Updated: May 25, 2018

Introduction

How We Collect and Use Personal Data

Data You Provide
Data Collected Automatically
Data We Obtain from Third Party Sources
Legitimate Interests
Data Retention

How We Share and Disclose Personal Data
International Data Transfers
Your Rights
Updates to the Disclosures
Contact Us

Introduction

We are Waters Corporation and its affiliated companies (collectively, “Waters”). The following additional European Economic Area (“EEA”) privacy disclosures (the “Disclosures”) supplement the www.Waters.com Privacy Notice and any other Waters privacy notices that link to, or expressly adopt or refer to, these Disclosures. These Disclosures apply only to our processing of Personal Data within the scope of the European Union’s General Data Protection Regulation (“GDPR”) (collectively, the “EEA Processing Activities”) as follows: (i) processing of personal data by a Waters company located in the EEA and (ii) processing of Personal Data of individuals located in the EEA by a Waters company located outside of the EEA in relation to offering goods or services into the EEA or monitoring the behavior of individuals in the EEA. Unless otherwise expressly stated, the terms of the Privacy Notice apply to the EEA Processing Activities identified in these Disclosures. We may gather Personal Data for these EEA Processing Activities by any means, including hardcopy (such as, paper application or forms) and electronic means (such as, websites, mobile applications, and other digital properties).

The Waters affiliated company who controls the EEA Processing Activity involving Personal Data about you will be the data controller responsible for the collection and use of such Personal Data.

If you have any questions about these Disclosures or our information practices, or if you would like to contact a specific data controller, please contact us as set forth in the Contact Us section below.

Please read these Disclosures carefully.

How We Collect and Use Personal Data

When we use the term “Personal Data,” we mean information that can be used to identify you, directly or indirectly, as an individual person. For more information about the types of Personal Data we collect as well as the purposes and legal bases for our processing of Personal Data, click below:

• Data You Provide
• Data Collected Automatically
• Data We Obtain from Third Party Sources
• Legitimate Interests
• Data Retention

How We Share and Disclose Personal Data
International Data Transfers
Your Rights
Updates to the Disclosures
Contact Us

1. Data You Provide

We collect Personal Data you provide, such as when you enter the data into form fields on our digital properties, fill out job applications or complete forms at our tradeshows and seminars. We collect: 

Top

2. Data Collected Automatically

As is true of most digital platforms, we gather certain data automatically when you use our online services. This information includes browser, device, cookie and similar data that we collect as follows:

Top

3. Data We Obtain from Third Party Sources

We also obtain from third-parties the same categories of Personal Data described in the Data You Provide and the Data Collected Automatically sections, which we use for the purposes and under the legal bases described in those sections and as otherwise described below in this section. In some cases, we obtain your consent for additional uses, where we unambiguously request such consent.

Business Partners and Service Providers: We use business partners and service providers to perform services on our behalf, and some of these parties provide us Personal Data about you that we do not otherwise have (for example, where you sign up directly with that provider) and share some or all this information with us. In addition to the purposes described above, we generally use this information to administer and tailor our services, analyze the use of our services, and conduct marketing and advertising campaigns. We receive Personal Data from the following categories of third-party business partners and service providers: 

• Prospective Employment Providers: We collect Personal Data (including contact information, employment and education history, and other information you include in your CV/resume or application materials, as well as certain health data) from business partners and service providers who provide Personal Data about potential candidates (for example, prior employers, CV Insight, Stack Overflow, Totaljobs, Jobsite and LinkedIn) or provide platforms for collecting job applications (for example, iCIMS).
• Event Coordinators: We collect Personal Data (including contact information, professional details, financial information and product interest information) from business partners and service providers who host events on our behalf (for example, professional conference and webinar coordinators) or provide software through which we process event and program registration (for example, Cvent and ON24).
• Marketing and Analytics Providers: We collect Personal Data (including contact information, professional details, product interest information, log files and information collected by cookies, analytics and other tracking technologies) from business partners and service providers who perform marketing and analytic services on our behalf (for example, Adobe, LinkedIn Sales Navigator, Orange, Vanilla and Datananas).
• Survey and Form Providers: We collect Personal Data (including contact information, professional details, product interest information, survey responses, user generated content and log files) from business partners and service providers who create our electronic forms and facilitate our surveys (for example, Wufoo, JotForm, Adobe Campaign, Confirmit, and SurveyMonkey).
• Marketing List Providers: We collect Personal Data (including contact information, employment-related information and product interest information) from business partners and service providers that maintain marketing lists of relevant prospective customers.

Publicly Available Sources: We collect Personal Data about you that we do not otherwise have (including contact information, professional details and product interest information) from social media platforms (for example, Facebook, Twitter, Instagram, LinkedIn and YouTube), blogs (for example, WordPress), and other publicly available databases. 

Top

4. Legitimate Interests

We rely on several legitimate interests in using and sharing Personal Data about you. These interests include:

• providing, marketing, improving and customizing our services and product offerings for you
• administration of our operations and services, including managing customer accounts
• understanding marketing trends, customer needs and how our services and products are being used
• obtaining insights into interest and usage patterns of our services and products
• maintaining an ongoing relationship with customers and providing personalized offers and experiences
• providing customers with product selection assistance
• operation of our business, including managing employment relationships and facility requirements
• exploring ways to develop and grow our business
• facilitating effective customer service and receiving feedback on our products and services
• improving our products and services
• assessing the quality and safety of our products
• providing support for warranty claims, safety alerts and recalls
• ensuring the safety and security of our employees, visitors, services and facilities
• cybersecurity, including maintaining the security of member accounts and customer profiles
• enhancing protection against and preventing fraud, spam, harassment, intellectual property infringement, crime and security risks
• enforcing our legal rights

Top

5. Data Retention

We will retain Personal Data about you for as long as is necessary for the purposes set out in these Disclosures unless a longer period is required under applicable law or is needed to resolve disputes or protect our legal rights, all in accordance with the principles set forth in Article 5(1) of the GDPR. The criteria used to determine the period for which Personal Data about you will be stored varies depending on the legal basis under which we process such Personal Data:

We may face threat of legal claim and in that case, we may need to apply a “legal hold” that retains information beyond our typical retention period. In that case, we will retain the information until the hold is removed, which typically means the claim or threat of claim has been resolved. 

Top

How We Share and Disclose Personal Data

We share Personal Data with certain categories of third parties as described in the Privacy Notice.  

Top

International Data Transfers

We may transfer Personal Data about you within Waters and/or to the third parties discussed in the Privacy Notice. Your Personal Data may be transferred to, stored, and processed in a country other than the one in which it was collected, including, but not limited to, Australia, Austria, Belgium, Brazil, Canada, the Cayman Islands, China, Denmark, Finland, France, Germany, Hong Kong, Hungary, India, Ireland, Israel, Italy, Japan, Luxembourg, Malaysia, Mexico, the Netherlands, Norway, Poland, Portugal, Puerto Rico, Romania, Singapore, South Korea, Spain, Sweden, Switzerland, Taiwan, the United Kingdom and the United States. The country to which Personal Data is transferred may not provide the same level of protection for Personal Data as the country from which it was transferred. We may transfer Personal Data about you outside the EEA and when we do so, we rely on appropriate or suitable safeguards recognized under data protection laws. 

Adequacy Decision: We may transfer Personal Data about you to Canada, Israel and Switzerland, which the European Commission has approved as providing adequate protection to personal data.

Standard Contractual Clauses: The European Commission has adopted Standard Contractual Clauses, which provide safeguards for Personal Data transferred outside of the EEA. We use these Standard Contractual Clauses when transferring Personal Data from a country in the EEA to a country outside the EEA where Standard Contractual Clauses have been executed. You can request a copy of our Standard Contractual Clauses by contacting us as set forth in the Contact Us section below.

EU-U.S. Privacy Shield: We are not certified under the EU-U.S. Privacy Shield. However, if we transfer any Personal Data about you from the EEA to a third party outside the EEA who is certified under the EU-U.S. Privacy Shield Framework as set forth by the U.S. Department of Commerce, we may rely on such certification to ensure adequate protection for Personal Data so transferred. You can learn more about Privacy Shield by visiting https://www.privacyshield.gov/.

Top

Your Rights

We process all Personal Data in line with the rights granted to you under the law, including the right of access, rectification, restriction of processing, objection to processing, erasure and data portability, as applicable. In addition, we recognize your right to withdraw your consent to the processing of Personal Data about you where we are relying on consent for the purposes of such processing. If you have any complaints regarding our privacy practices, you have the right to lodge a complaint with your national data protection authority (i.e., supervisory authority).

We will provide you upon your reasonable, good faith request with information about whether we hold any Personal Data about you along with any details required to be provided to you under applicable law. In certain cases, subject to certain limitations at law, you may also have a right to: 

• Access: The right to access and obtain a copy of Personal Data about you, as well as information relating to its processing;
• Rectification: The right to correct or update any Personal Data about you that is inaccurate or incomplete;
• Restriction of Processing: The right to restrict or limit the ways in which we process Personal Data about you;
• Objection to Processing: The right to object to the processing of Personal Data about you;
• Erasure: The right to request the deletion or erasure of Personal Data about you; and
• Portability: The right to obtain a copy of Personal Data about you in an easily accessible format and the right to transmit that Personal Data to another controller.

To submit a request, please contact us as set forth in the Contact Us section below. We will respond to your request within a reasonable timeframe. 

Top

Right to Withdraw Consent

Where the purpose of our processing of Personal Data about you is based on consent, you also have the right to withdraw your consent to such processing, subject to certain limitation at law. You may withdraw your consent in the following ways:  

• Marketing Communications: Where you have provided your consent for marketing communications, you may withdraw your consent by following the opt-out instructions provided in the Managing Communication Preferences section in our Privacy Notice.
• Cookies, Analytics and Other Tracking Technologies: Where you have provided your consent for the use of cookies, analytics and other tracking technologies, you may withdraw your consent by following the instructions provided in our Cookie Policy.
• Instructions Provided Prior to Consent: Where instructions regarding the means of withdrawing consent were provided at the time you gave your consent, you may follow such instructions to withdraw your consent.
• Contact Us: You may also withdraw your consent by contacting us as set forth in the Contact Us section below.  

If you withdraw your consent to the processing of Personal Data about you for the purposes set out in these Disclosures, you may not have access to all (or any) of our services, and we might not be able to provide you all (or any) of our services. In some cases, withdrawing your consent may require you to close your online account and discontinue the use of certain services.

Please note that, in certain cases, we may continue to process Personal Data about you after you have withdrawn consent or requested that we delete Personal Data about you, if we have a legal basis for the purpose of such processing. For example, we may retain certain information if we need to do so to comply with an independent legal obligation, or if it is necessary to do so to pursue our legitimate interest in keeping our services safe and secure.

Right to Lodge a Complaint

If you have any complaints regarding our privacy practices, you have the right to lodge a complaint with your national data protection authority (i.e., supervisory authority).

Top

Updates to the Disclosures

These Disclosures will be revised as required. If we decide to change these Disclosures, we will post notice of the changes on our Services. The updated Disclosures will be effective as of the Effective Date listed at the start of these Disclosures. You can determine when these Disclosures were last revised by checking the Last Updated date at the start of these Disclosures.  

Top

Contact Us

If you have any questions, comments, requests or concerns about these Disclosures or other privacy-related matters, you may contact us at:

Waters Corporation
Attention: Data Privacy
34 Maple Street
Milford, Massachusetts 01757
Data_Privacy@waters.com