MY Workplace App Privacy Notice

It is not mandatory for you to use the App. The provision of personal data to us is optional. However if you decide not to provide personal data that we request, this might mean that you cannot access certain features of the App or pre-book office services (access desks, meeting rooms, car parking spaces etc).

We collect and further process the following specific categories of personal data about you in connection with your usage of the App:

• Contact and registration details: name/surname, (work) email address, department you work in, your job title, registered office and password for the App;
• Booking information: desk, carpark space, meeting room, meeting name, number of participants and name of organiser;
• Industry-standard log data: device type, browser and operating system you are using and your IP address at the time of the creation of your user account. We may also collect the IP address associated with your device running the App each time this App syncs with our systems;
• Technical information: type of mobile device you use, software version, details of your browser, unique device identifiers (i.e. anonymous user ID for analytics and push notification ID) , mobile network information, user consent for connected apps and devices, user preferences, your mobile operating system and your time zone setting;
• Sensors: We use presence sensors in some office locations (including some international offices such as in France, Luxembourg and Italy) to provide real-time occupancy data for both desks and meeting rooms. These sensors only detect motion and transmit a continuous count of movement to the MyWorkplace App. This data is used purely to better understand how the workspace is used and to inform our location strategy. We have strict controls in place to avoid possible misuse of location data.
• Analytics information relating to your use of the App and device information: traffic data, App activity, and other communication data, and the resources that you access on the App for statistical analysis of use and to help inform future App functionality and design;
• Other information you provide to us in connection with your use of the App: such as preferences and feedback, and technical and bug fixing information;
• Location services/data: the App will ask if you consent to use global positioning system (“GPS”) and indoor positioning system (“IPS”) location data (i.e. latitude / longitude) within M&G locations. If you agree, GPS/IPS co-ordinates when you are inside an M&G building will be stored but only temporarily and only your last location is held (i.e. the previous coordinates are overwritten). Location services will help you locate rooms, desks or colleagues (if they have consented). You will be able to switch the location services on and off at any time. The App never records your location when you are in the washrooms, multi faith rooms, showers or nursing rooms. This is because the location point is linked to the sensor. GPS/IPS co-ordinates when you are outside of an M&G building will not be collected or stored because the application will stop working at the point of leaving the office sensor range; and
• Visitor Data: when booking a visitor you will enter their Full Name, Their visitor type (visitor / Employee) and optional fields are Business Name, email address.
• Any further information which you provide to us when you interact with us.

Use of the App is voluntary and as such, it is up to you to decide whether you would like to make use of the App. If you do choose to use the App:

Location-based services

• We use GPS/IPS information, where you have consented to this to detect what M&G building you are in or close to:
  • in order to provide location-based services within the App (such as “Find a Colleague”); and
  • in order to provide location-based notifications within the App including in relation to vacant meeting rooms, availability of colleagues, travel details, events, opening hours of the building, and current menus at the building’s restaurant. The App may access location in the foreground and in the background for the purposes of providing notifications through the App.

If you choose not to consent to this, you will not be able to access these features and notifications. However, you will be able to receive other non-location based services as set out below.

Other App services

We process your personal data so that you may access M&G local offices, register for an event, receive information about M&G local offices (e.g. information about the restaurant menu), make travel arrangements, book a desk, meeting room or car parking space or make use of other M&G building services (e.g. detailed floorplans). If you decide not to use the App you can also do all of the above by using the web-based application.

Other purposes

We also process your personal data for the following purposes:

• ensuring the functionality and security of the App and web based application;
• optimisation of the App and web based application;
• identifying you as a user of the App or web based application including to authenticate you, enable you to use the services and to enable us to communicate with you;
• handling your request/queries when you contact us;
• detecting and correcting errors and problems with the App;
• populating your user account in connection with the App and to support the operation of your account;
• statistical evaluation and business development;
• combating fraudulent behaviour on or in relation to use of our App or web based app;
• ensuring compliance with our legal and regulatory obligations;
• safeguarding our business interests and those of the broader M&G Plc Group, especially in defending and enforcing legal claims and/or contractual terms;
• creating aggregated data for commercial and analytics purposes; and
• other purposes to which we will explain to you at the point of data collection.

Once your personal data is anonymised, we may process it for further purposes not listed in this Privacy Notice such as sharing it with third parties that may provide services to a Group entity to create statistics on the use of the App or web based application, to improve the services or to identify new functionality.

Our lawful basis

Our lawful basis (justification) for using your personal information as described in this Privacy Notice is either:

• that you have provided your consent, specifically in relation to location-based services and to the initial download of the App;
• that the processing is necessary for compliance with a legal obligation; or
• that the processing is necessary for our legitimate business interests which are not overridden by your own privacy interests, for example:
  • our legitimate business interests in providing M&G staff with a simple and effective online means of accessing facilities provided by local M&G offices;
  • our legitimate business interests in ensuring that the App is secure and functions effectively;
  • our legitimate business interests in understanding how the App is being used and how many members of staff are using various facilities at M&G local offices and at what times during the day;
  • our legitimate business interests in preventing and detecting crime such as fraud; and
  •  our legitimate business interests arising in connection with a corporation transaction or proposed corporate transaction, under which it is envisaged that we may merge with or be acquired by another business or company.

Further information about the way in which we use your personal information, including more detailed information on which lawful basis applies in which circumstances, is set out in Annex 2.

We make an unwavering commitment to keep your data safe, and not to use or share your personal data with others without being transparent about it.

Against this background, we may share your data with the following third parties to the extent required to provide the services and to fulfil the other purposes described in this Privacy Notice. For more detail please see Annex 2:

• Third party IT service providers. We share your personal data with third party information technology service providers to allow us to provide services and other functionality through the App, and in connection with the use of customer and market research tools and software in relation to the App, which allows us to understand how the App is being used;
• Third-party application providers (listed in Annex 1). We include third-party applications in the App and web based app and make it possible for you to use the App to interact with third party applications that you use. This includes functionality that allows you to share and sync your personal data with third party applications. Sharing and syncing will always be initiated by you. Where you initiate this, we will share your personal data with the third party operating the application. Please consult the privacy notice of that third party to understand how they will process your personal data that they receive;
• Third-party office service providers (Catering, Security, Maintenance). If you use the App to book any services that are provided as part of M&G office maintenance or management, such as carpark space booking, catering requirements, visitor bookings or raise a maintenance request, the personal data you have provided will be shared with the relevant third party.
• Other M&G Plc Group companies: We share your personal data within the M&G group where this is necessary to administer and/or manage the App and its services;
• Prospective owners: in the event that we merge with or are acquired by another business or company in the future (or enter into meaningful discussions about such a possibility) we may need to share your personal information with the (prospective) new owners of the business or company; and
• Legal and other professional advisers, witnesses, experts and judicial and quasi-judicial authorities. We may occasionally need to disclose your personal data to these third parties if:
  
  • this is necessary in order for us to obtain legal advice/other professional advice;
  • we are under a duty to disclose or share such personal data in order to comply with any legal or regulatory obligation or request;
  • this is reasonably required to enforce terms of use or any other agreement we have entered into with you or to investigate potential breaches;
  • this is required to protect the rights, property or safety of the M&G Plc Group, our customers, or others (including by exchanging information with other companies, industry bodies or organisations for the purposes of crime prevention such as detection of fraud); and/or
  • in accordance with applicable laws, to defend our interests or to prevent and combat any criminal activity.

We may also be required to share your personal data with other third parties if we have a legal obligation to do so or are otherwise required to do so under a court order or in connection with a legal claim.

GPS/IPS location data that the App collects whilst you are using it i.e. live data is not stored by any third party. This is because such information is only ever held for short periods of time when an activated device is within the sensor range to provide users with location-based features and is deleted when the App is closed or when the device is out of sensor range.

 Personal data collected in relation to the App is processed within the UK and is transferred to your local office in accordance with our intra group data sharing agreement.

We apply technical and organisational security measures to protect your personal data against unauthorised use, manipulation, loss, disclosure, destruction or access by unauthorised persons and to protect your rights and ensure compliance with applicable data protection laws and regulations. However, due to the inherent open nature of the internet, we cannot guarantee that communications between you and us or the personal data stored in relation to the App are absolutely secure. We will notify you of a data breach when required to do so by applicable data protection laws and regulations.

We use standard encryption techniques to transfer your data. As a Group, we transfer data in accordance with Chapter V of the EU and UK GDPR. We use EU Standard Contractual Clauses for such transfers. Further information about how we safeguard your information can be obtained by contacting the Data Protection Officer in the Contact Section of this Privacy Notice.

We retain your personal data collected in connection with the App for a period of 2 years from the point of inactivity or leaving M&G Plc unless we need to keep it longer to comply with legal or regulatory retention duties. This excludes location data, which is only stored temporarily whilst the app is in use before being deleted or overwritten. We will delete or anonymise personal data that is no longer required, to the extent permitted by law. Information you enter into the App relating to visitors will be stored in line with visitor protocols which is 3 years from the date of their visit appointment.

You have certain rights relating to the personal data we hold about you, which are outlined below:

Please note:

• we will need to validate your identity before we can respond to your request;
• we may deny your request if we are unable to confirm your identity or if we have reason to believe that your request is manifestly unfounded or manifestly excessive;
• once we have validated your identity, we will respond to your request within one calendar month or otherwise we will let you know within one calendar month if we need additional time to respond (no later than a further two months for complex requests or if we receive a number of requests from you); and
• we will let you know whether we accept or refuse your request.
   

If you have any concerns about the use of your personal data, or the way we handle your requests relating to your rights, you can raise a complaint directly with us using our contact details.

If you are not satisfied with the way we handle your complaint, you are entitled to raise a complaint directly with your local Data Privacy Supervisory Authority;

• UK Information Commissioner’s Office via the details available on their web based app: www.ico.org.uk
•  EU Supervisory Authorities contact details local to where you live or work. can be found here: https://edpb.europa.eu/about-edpb/board/members_en
• Hong Kong Privacy Commissioner for Personal Data (PCPD) via the details on their web based app: www.pcpd.org.hk
• Singapore Personal Data Protection Commission (PDPC) via the details on their web based app: www.pdpc.gov.sg