Charles River Development (“Charles River” or the “Company”) has elected to comply with the Safe Harbor Agreement between the United States Department of Commerce and the European Union (“EU”), with respect to personal information that is transferred from the EU to the United States (“US”) (the “Safe Harbor Agreement”) by issuing and maintaining this Safe Harbor Privacy Policy (the “Policy”). The Policy applies to all Charles River employee and Client personal or sensitive information received by Charles River in the US from the EU, in any format, including electronic, paper or verbal.
The following Safe Harbor principles apply to the transfer, collection, use or disclosure of personal information from the EU by Charles River:
Notice
Client data collected by Charles River will be maintained at its corporate offices in Burlington, Massachusetts, U.S.A. Charles River collects such data for, among other things, legitimate business reasons such as product support, accounts payable/receivable, marketing, financial, sales and contractual requirements. All Client data collected by Charles River will be used for legitimate business purposes consistent with this Policy and the applicable law and disclosed in accordance with the notices provided by such Clients and the choices made by the individuals to whom such personal information relates.
Charles River collects employee personal information for, among other reasons, human resource management such as payroll administration, filling employment positions, health benefits, and performance management. Charles River does not request or gather information regarding political opinions, religion, philosophy, or sexual preference. To the extent Charles River maintains information on an individual’s medical health or ethnicity (only for countries where it is legally required), Charles River will protect, secure and use that information in a manner consistent with this Policy and the applicable law.
Charles River will not disclose any EU employee information to a third party, other than a third party that is acting as an agent or data processor for Charles River to perform task(s) on behalf of and under the instructions of Charles River. Notice to EU-based employees will be provided before Charles River uses the information for purposes other than for which it was collected. Personal Information collected by Charles River from employees and applicants for employment is maintained at its corporate offices in Burlington Massachusetts in the United States as well as the local office of the employee or applicant.
Choice
Charles River will offer employees and Clients the opportunity to choose (opt-out) whether their personal information is: (a) to be disclosed to a third party which is not an agent; or (b) to be used for a purpose other than the purpose for which it was originally collected or subsequently authorized by the individual.
For sensitive personal information, Charles River will give individuals the opportunity to affirmatively and explicitly (opt-in) consent: (a) to the disclosure of the information to a non-agent third party; or (b) the use of the information for a purpose other than the purpose for which it was originally collected or subsequently authorized by the individual. Charles River will provide individuals with reasonable mechanisms to exercise their choices should requisite circumstances arise.
Transfers to Third Parties
Charles River will not transfer Client data to third parties, unless lawfully directed by the Client, or in certain limited or exceptional circumstances in accordance with the Safe Harbor principles. For example, Charles River may disclose personal information without offering individuals an opportunity to opt out (i) if we are required to do so by law or legal process, (ii) to law enforcement authorities or other government officials based on an enforceable government request or as may be required under applicable law, or (iii) when we believe disclosure is necessary or appropriate to prevent physical harm or financial loss or in connection with an investigation of suspected or actual illegal activity.
Charles River may transfer employee data to a third party consistent with any contractual protections or consents that employees have given. Charles River will require that such party is either subject to the Safe Harbor Agreement, subject to similar laws providing an adequate and equivalent level of privacy protection, or will enter into a written agreement with the third party requiring them to provide protections consistent with the Safe Harbor Privacy Framework and Charles River's Safe Harbor Privacy Policy.
Access
Charles River provides Clients and employees located in the EU with reasonable access to the personal information maintained by Charles River about them. Charles River will also provide a reasonable opportunity to correct, amend or delete that information where such personal information is inaccurate. The Company may limit or deny access to personal information where providing such access is unreasonably burdensome or expensive under the circumstances, or as otherwise permitted by the Safe Harbor principles.
An EU based employee who wants to have access to his or her personal information should provide a written request to his or her local Human Resources representative. Clients can obtain access to personal information, as specified in the “Contact Information” section of this Policy.
Security
Charles River takes reasonable measures to protect personal information from loss, misuse, and unauthorized access, disclosure, alteration or destruction. Charles River has put in place appropriate physical, electronic and managerial procedures to safeguard and secure the personal information from loss, misuse, unauthorized access or disclosure, alteration or destruction.
Data Integrity
Charles River seeks to ensure that any personal information held about EU individuals is accurate, complete, current and otherwise reliable in relation to the purposes for which the information was obtained. Charles River collects personal information that is adequate, relevant and not excessive for the purposes for which it is to be processed. EU individuals have a responsibility to assist Charles River in maintaining accurate, complete and current personal information about them.
Enforcement
Charles River assures compliance with this Safe Harbor Privacy Policy and the Safe Harbor Privacy Framework by utilizing the self-assessment approach. The self-assessment is conducted on an annual basis to ensure that all of Charles River's relevant privacy practices are being followed in conformance with this Safe Harbor Privacy Policy and the Safe Harbor Privacy Framework.
Charles River will also assure compliance with the Safe Harbor principles by fully investigating and attempting to resolve any complaint or dispute regarding the use and disclosure of personal data in violation of this Policy.
For complaints that cannot be resolved by Charles River and the complainant, Charles River agrees to cooperate with data protection authorities located in the EU (or their authorized representative) and to participate in dispute resolution procedures of those authorities, pursuant to the Safe Harbor principles.
Any questions or concerns regarding the use or disclosure of personal information should be directed to the office of the Charles River’s Risk Manager indicated below.
Contact Information:
Questions or comments about this Policy should be directed to:
Charles River Risk Manager
7 New England Executive Park
Burlington, MA 01803
USA
Email: riskmanager@crd.com
Charles River must annually, in writing, certify to the Department of Commerce that it agrees to adhere to the Safe Harbor Principles.