Privacy Policy

This document describes the privacy policy (“Privacy Policy”) of Mercer LLC, 1166 Avenue of the Americas, New York, NY 10036-2774, United States and its affiliated companies (“Mercer,” “we,” or “us”) related to personal data held by Mercer concerning business or professional contacts (“you” or “your”).

Mercer takes your privacy seriously because we know you do. We are committed to processing your personal data held by Mercer (“Contact Data”) in accordance with this Privacy Policy and in compliance with all applicable legislation and regulations for the protection of personal data.

Please read this Privacy Policy carefully and be aware that we may change it from time to time. If at any point we alter this Privacy Policy in ways that allow us to handle your personal data in a significantly different manner, we will notify you by e-mail or otherwise, and you will have a choice as to whether or not we may use your Contact Data in the new manner.

Contact Data We May Hold

We limit the personal data we hold to what is relevant for supplying or marketing our services or otherwise conducting business.

Individuals from whom we retain Contact Data include clients, potential clients, suppliers, service providers, government officials, journalists, academics, industry experts and others with whom we have a business or professional relationship (collectively "Contacts"). The types of contact data we may hold include:

• Name
• Telephone/address information (such as telephone numbers, street address, e-mail address)
• Other business or marketing-related personal details (such as education, business or professional role, business title, hobbies and interests, and dietary or facilities preferences required for meeting planning)
• Mercer products and services previously purchased or within the individual's area of interest
• Marketing channel preferences (such as individual's preference to be contacted via e-mail but not by telephone)
• Credit card or banking data required for invoicing or payments, but only if this is supplied by you or your employer.

Sources of Contact Data

We obtain Contact Data when individuals:

• are designated by their employer as our contacts for the purpose of submitting proposals, managing client assignments, invoicing, or (for companies providing services to Mercer) for managing the service relationship and paying invoices
• complete a Mercer registration form or other submission form, or request to be placed on our mailing list
• buy goods or services from Mercer
• request information from us or
• otherwise provide Mercer or a Mercer employee with their contact details or other personal data.

Contact Data may also be obtained from published sources and from our affiliated companies within the Marsh & McLennan Companies, Inc. group of companies (“MMC Group”).

We also receive data about employees of our clients in the form of employment-related records and information (for example, benefit plan participants or employees to be included in a compensation study) that we analyze or otherwise directly apply in undertaking client work. Data of this type are used solely to complete the client work or for broad statistical analysis, and is never combined with any Contact Data we may otherwise hold.

How We Use Contact Data

We use Contact Data to:

• provide clients with goods, services or data they request,
• advise clients and potential clients about products and services offered by Mercer or other members of the MMC Group,
• instruct our suppliers and service providers and compensate them for their services, and
• correspond with our Contacts.

Except as described further below under the heading Legal Matters, we disclose Contact Data to others only with the individual's prior permission or in the following limited circumstances:

• In the course of client work, we may disclose personal data concerning our clients to others in the same client organization or to third parties, or disclose third-party personal data to our clients, but only when we believe the disclosure is in the interest of both parties.
• We sometimes provide personal data to other companies and individuals to perform functions on our behalf (for example, to a mailing service to process a large mailing, or to a hotel to arrange a conference). Such data will be used solely to perform the contracted services for Mercer.
• As we continue to develop our business, we may sell or buy assets. If any Mercer business unit is sold or substantially all of Mercer is acquired, customer and contact data relevant to the operation sold would be one of the transferred assets.

How We Protect Contact Data

We place a high priority on the security of your Contact Data. We apply appropriate technical, administrative, and physical safeguards to protect against foreseeable loss, unauthorized access, destruction, misuse, modification, and improper disclosure. However, no system or data can ever be fully protected against every possible hazard. As a result, we cannot ensure or warrant the security and privacy of any data you provide to us and, accordingly, you do so at your own risk.

All employees, consultants, and agents of Mercer are required to comply with the terms of this Privacy Policy. Failure to do so could result in disciplinary action.

Storage and Processing of Data

Contact Data may be stored and processed in the country of origin, in the United States, or in other countries. Mercer may transfer your Contact Data to its affiliated companies, offices and service providers throughout the world. Each of these parties may share and use the Contact Data. Some countries may have different data protection standards. Mercer will ensure that the transfer and storage of Contact Data is in accordance with this Privacy Policy and the data protection and privacy laws in your country.

Your Rights

You may change your marketing channel preferences, or request that you stop receiving all communications from us, at any time by contacting us as provided below. (See Contacts and Complaints.)

You may review your Contact Data at any time and instruct that it be corrected, updated, or deleted, by contacting us as provided below. We will take all reasonable steps to make the requested changes promptly. However, you should be aware that it is not technologically possible to change or delete each and every instance of the data we hold on you from our systems, and Contact Data may remain in non-erasable forms. We may retain Contact Data for a period in our backup systems. We may also retain some data for longer periods as required by law, contract, or auditing requirements.

Legal Matters

We have the right to disclose any Contact Data without your prior permission if Mercer has a good faith belief that such action is necessary to protect and defend the rights, property, or safety of Mercer, its clients, suppliers, or the public.

We may also disclose Contact Data as we deem necessary to satisfy any applicable law, regulation, legal process, or governmental request. In this, we will strictly adhere to the privacy laws and regulations of the relevant jurisdiction(s).

This Privacy Policy is designed to establish a uniform minimum standard for Mercer’s handling of Contact Data around the world. Where local law requires stricter standards than those set forth herein, Mercer will handle this personal data in accordance with these stricter standards.

Data Collected through Mercer’s Web Sites

We also collect personal data from users of our web sites. Our use and handling of this data are governed by Mercer’s Privacy Policy for Web Site Users. Any personal data gathered through our web sites that are used in Mercer’s general client contact and marketing databases along with other Contact Data are treated in accordance with the Privacy Policy for Client and Other Professional Contact Data.

Contacts and Complaints

If you have any questions or concerns about this Policy, please e-mail us at privacycoordinator@mercer.com or speak with your Mercer consultant.