Data Protection Policy | Sodexo Middle East

SCOPE

The Global Data Protection Policy applies to the global organization of Sodexo entities (hereinafter designated as “Sodexo”) for all dimensions and activities, in all geographies where we operate when European data protection law, namely the General Data Protection Regulation (or “GDPR”) apply.

This policy applies to the Processing of Personal Data collected by Sodexo, directly or indirectly, from all individuals including, but not limited to Sodexo’s current, past or prospective job applicants, employees, clients, consumers, children, suppliers/vendors, contractors/subcontractors, shareholders or any third parties, with “Personal Data” being defined as any data that relates to an identified or identifiable individual or a person who may be identified by means reasonably likely to be used.

In this Policy, “you” and “your” means any covered individual. “We”, “Us”, “Our” and “Sodexo” means the global organization of Sodexo entities.

COLLECTION AND PROCESSING USE OF YOUR PERSONAL DATA

COMPLIANCE WITH THE EUROPEAN DATA PROTECTION LAW AND ANY ADDITIONAL APPLICABLE LOCAL DATA PROTECTION LAW

We are committed to complying with any applicable legislation relating to Personal Data and we shall ensure that Personal Data is collected and processed in accordance with provisions of the European data protection law and applicable legislations of the countries in the Middle East where Sodexo operates in.

LAWFULNESS, FAIRNESS AND TRANSPARENCY

We do not collect or process Personal Data without having a lawful reason to do so. We may have to collect and process your Personal Data where necessary for the performance of a contract to which you are party, or when it is necessary for compliance with a legal obligation to which we are subject or where required, with your prior consent. We may also collect and process your Personal Data for Sodexo’s legitimate interests except where such interests are overridden by your interests or fundamental rights and freedoms.

When collecting and processing your Personal Data, we will provide you with a fair and full information notice or privacy statement about who is responsible for the processing of your Personal Data, for what purposes your Personal Data are processed, who the recipients are, what your rights are and how to exercise them, etc., to the maximum extent possible.

LEGITIMATE PURPOSE, LIMITATION AND DATA MINIMIZATION

Your Personal Data is collected for specified, explicit and legitimate purposes and will not be processed in a manner that is incompatible with those -purposes.

When Sodexo acts for its own purposes, your Personal Data is processed mainly for, but not limited to, the following purposes: recruitment management, human resources management, accounting and financial management and related controls and reporting, finance, treasury and tax management, risk management, management of employees’ safety, provision of active directory, IT tools or internal websites and any other digital solutions or collaborative platforms, IT support management , including infrastructure management, systems management, applications, health and safety management, information security management, client relationship management, bids, sales and marketing management, supply management, internal and external communication and events management, compliance with anti-money laundering obligations or any other legal requirements, data analytics operations, legal corporate management and implementation of compliance processes.

DATA ACCURACY AND STORAGE LIMITATION

Sodexo will keep Personal Data that is processed accurate and, where necessary, up to date. Also, we will only retain Personal Data for as long as necessary for the purposes we collected it for, including for the purposes of satisfying any legal, accounting or reporting requirements and, where required for Sodexo to assert or defend against legal claims, until the end of the relevant retention period or until the claims in question have been settled. If you want to learn more about our specific retention periods for your Personal Data established in our retention policy, you may contact us at privacy.mea@sodexo.com.

Upon expiry of the applicable retention period, we will securely destroy your personal data in accordance with applicable laws and regulations.

SECURITY OF YOUR PERSONAL DATA

We implement appropriate technical and organizational measures to protect Personal Data against accidental or unlawful alteration or loss, or from unauthorized, use, disclosure, or access, in accordance with our Group Information and Systems Security Policy.

We take, when appropriate, all reasonable measures based on Privacy by design and Privacy by default principles to implement the necessary safeguards and protect the Processing of Personal Data. We also carry out, depending on the level of risk raised by the processing, a Privacy Impact Assessment (“PIA”) to adopt appropriate safeguards and ensure the protection of the Personal Data. We also provide additional security safeguards for data considered to be Sensitive Personal Data.

DISCLOSURE OF YOUR PERSONAL DATA

We share your Personal Data, in the following circumstances:

with Sodexo entities for the purposes described in this policy;
with third parties including certain service providers we have retained in connection with the purposes described in this policy and the services we provide;
with companies providing services for money laundering and terrorist financing checks and other fraud and crime prevention purposes and companies providing similar services, including financial institutions and regulatory bodies with whom such Personal Data is shared;
with courts, law enforcement authorities, regulators, government officials or attorneys or other parties where it is reasonably necessary for the establishment, exercise or defence of a legal or equitable claim, or for the purposes of a confidential alternative dispute resolution process;
with service providers who we engage within or outside of Sodexo, domestically or abroad, e.g., shared service centres, to process Personal Data for any of the purposes listed above on our behalf and in accordance with our instructions only;
if we sell or buy any business or assets, in which case we may disclose your Personal Data to the prospective seller or buyer of such business or assets to whom we assign or novate any of our rights and obligations.

INTERNATIONAL PERSONAL DATA TRANSFERS

For transfers of your Personal Data to countries outside of the Middle East, either to entities within or outside Sodexo, Sodexo has put in place an adequate safeguard to protect your Personal Data. You will be provided with more information about any transfer of your Personal Data outside of the Middle East at the time of the collection of your Personal Data through appropriate privacy notices or privacy policies.

For further information, including obtaining a copy of the documents used to protect your information, please contact us at privacy.mea@sodexo.com.

COOKIES

Some of our websites may use “cookies.” Cookies are portions of text that are placed on your computer’s hard drive when you visit certain websites. We may use cookies to tell us, for example, whether you have visited us before or if you are a new visitor and to help us identify features in which you may have interest. Cookies may enhance your online experience by saving your preferences while you are visiting a website.

We will let you know when you visit our websites what types of cookies we use and how to disable such cookies. You will have the ability to visit our websites and refuse the use of cookies at any time on your computer. For more details, please consult our Cookies policies.

YOUR RIGHTS

Sodexo is committed to ensure protection of your rights under applicable laws. You will find below a table summarizing your rights as per your local legislation:

UNITED ARAB EMIRATES

Right of access and rectification

You can request a copy of the Personal Data we hold about you. You may also request rectification of inaccurate Personal Data, or to have incomplete Personal Data completed.

To submit requests relating to data subject rights in the UAE please complete and submit this Requests Webform.