TIAA-CREF Individual & Institutional Services LLC

In this Privacy Policy, “Labaton” refers to Labaton Sucharow LLP, a limited liability partnership under the laws of New York, U.S.

Labaton is committed to maintaining the privacy and security of your personal data in compliance with all applicable laws. We collect and process your personal data fairly and lawfully and in order to carry out our lawful business activities. This Privacy Policy describes Labaton’s practices with respect to (i) the personal information we process on the SEC Whistleblower Advocate’s website (www.secwhistlebloweradvocate.com) and dependent pages (the “Site”); (ii) the way we use personal information we process from the Site; and (iii) how we share this information with third parties.

We encourage you to read this Privacy Policy. This Policy governs our privacy practices relating to visitors to the Site and the personal information they provide. Additional information concerning the business purposes for processing may be provided to you at the time when the personal data is provided. If you have any questions concerning the Privacy Policy or Labaton’s processing of your personal data, you may contact Labaton’s Privacy/Data Protection Officer at dataprivacy@labaton.com.

What personal data does Labaton collect and process?

For purposes of this Privacy Policy, “Personal data” means any information relating to an identified or identifiable natural person (“Data Subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. Personal data does not include information that is anonymized.

“Special categories” of personal data refers to information concerning racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.

“Processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Labaton processes all or some of the following personal data provided by you:

Your name, address, telephone number, email address, educational history, employment information, professional background, device identifiers, or other information that you may provide us that may reasonably be used to identify you or someone connected to you.

How do we collect your personal data?

Generally, you may browse the Site without providing any personal information. Labaton will not collect personal data unless you choose to provide it to us. We may ask that you provide data at various times and locations through the Site. For example, if you register with the Site to request information on our Firm and legal services, you will be asked to provide information such as your name and email address. You may also choose to volunteer additional personal data by completing forms on other sections of the Site, for example for subscriptions to newsletters, seminars or events, or on our Careers site.

By submitting personal data and other information to the Site, you consent to the collection, use and disclosure of such information as set forth in this Privacy Policy.

You may withdraw your consent to processing at any time. Please see the section on “Do you have rights in your personal data?” below.

Do we use Cookies?

A “cookie” is an element of data that a website can send to your browser, which may then be stored on your computer if you agree. Labaton uses different kinds of cookies on the Site. For detailed information please see our Cookie Policy. By using our Sites, you consent to the use of cookies. You may set your browser to refuse cookies but if you do so your user experience may be adversely affected and you may not be able to access certain information on the Sites. To ensure that you Opt-Out from Google Analytics, you can click here.

Will we honor Do-Not-Track signals?

Your browser may allow you to send “do-not-track” requests to websites you visit. If you enable this feature and your browser sends a “do-not-track” request, the Site will respond by deactivating all user identification cookies set on the Site.

Do we use Google Services?

On the Site, Labaton uses several services provided by Google:

Google Analytics
This Site uses Google Analytics, a web analytics service provided by Google, Inc. (“Google”).

Google Analytics uses “cookies” if you agree. The information generated by the cookie about your use of the website (including your IP address) will be transmitted to and stored by Google on servers in the United States. Please note that, for the Site, we activated the IP anonymization, i.e., Google will truncate/anonymize the last octet of your IP address to ensure an anonymized collection of IP addresses (IP Anonymization). In exceptional cases only, the full IP address is sent to and shortened by Google servers in the United States.

On behalf of the website provider, Google will use this information for the purpose of evaluating your use of the Site, compiling analytics, demographics (such as age and gender), where visitors have come to the Site, and interest reports on website activity for website operators and providing other services relating to website activity and Internet usage to the website provider. Google will not associate your IP address with any other data held by Google.

You may refuse the use of cookies by selecting the appropriate settings on your browser. However, please note that if you do this, you may not be able to use the full functionality of this website. Furthermore, you can prevent Google’s collection and use of data (cookies and IP address) by downloading and installing the browser plug-in available here.

Further information about how Google uses advertising cookies can be found here.

Google Maps
Additionally, because we use visual mapping services on the Site if you agree, please be aware that the Google Maps/Earth Terms of Service, including the Google Privacy Policy also applies.

Google AdWords
Labaton occasionally uses Google AdWords. Through automated means (such as cookies and web beacons if you agree), Google may collect data that helps Labaton in designing and providing our services, in understanding how our websites are used by those who visit them, and in analyzing any advertisements we may use.

Do we take steps to protect your personal data?

Labaton has appropriate technical, physical and administrative measures in place designed to protect your personal data from loss, misuse, unauthorized access, disclosure, alteration or destruction taking into account the nature of the personal data, emerging threats, the risks of collection and processing, best practices for securing the data and the associated cost of implementation. You should keep in mind, however, that no Internet transmission is ever 100% secure or error-free. In particular, email sent to or from this Site may not be secure, and you should therefore take special care in deciding what information you send to us via email. Please also read our Disclaimer before sending any information to us. Moreover, where you use passwords, ID numbers or other special access features on this Site, it is your responsibility to safeguard them.

What are Labaton’s legitimate interests in processing your personal data?

The information collected by and through this Site may be used by Labaton and other entities that are involved in the operation of this Site for Labaton’s lawful business purposes.

Labaton will use personal data only for the purpose for which it was provided, as well as other purposes for which the user gives consent. This includes, but is not limited to, the following purposes:

● Contact Forms: If you contact us by using the contact form on the Site, we use the information you provide to get in contact with you and to answer your queries.

● Events: If you register for one of our events, we use the information you provide to register you for the event and to provide you with information about the event. Please note that we may also share your name, professional title and your professional address with other people that are attending the same event.

● Marketing: You may subscribe or unsubscribe to receive Labaton communications on various subject matters, such as alerts on important legal developments, newsletters and invitations to live events and webinars, as well as firm news and announcements.

What are the lawful basis for processing your personal data?

Labaton is committed to processing personal data only when there is a lawful basis including:

● the Data Subject has given consent to the processing of his or her personal data for one or more specific purposes;
● processing is necessary for the performance of a contract to which the Data Subject is a party or in order to take steps at the request of the Data Subject prior to entering into a contract;
● processing is necessary for compliance with a legal obligation to which Labaton is subject;
● processing is necessary in order to protect the vital interests of the Data Subject or of another natural person;
● processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in Labaton;
● processing is necessary for the purposes of the legitimate interests pursued by Labaton or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the Data Subject which require protection of personal data, in particular where the Data Subject is a child.
● processing of special category personal data shall only occur where the Data Subject has given explicit consent to the processing of the personal data for one or more specified purposes or where permitted by applicable law.

We will not use your data in connection with any automated decision making process or for any profiling purpose.

Do we transfer data across borders?

Our servers are located in the United States or, if located in other countries, may be accessed from the United States. Please note that in countries outside your own country, and in particular outside the EU and EEA, a different standard on data protection might apply than you are used to in your own country.

By using our Site or providing personal data from outside the United States, you acknowledge and consent that your data will be transferred across national borders, including to countries outside the EU/EEA.

To govern transfers of personal data from the EU/EEA to recipients outside the EU/EEA, we have in place appropriate safeguards, which may include adhering to model contractual clauses adopted by the European Commission. We are happy to provide you with a copy of the standard data protection clauses upon request.

Do we disclose your personal data to third parties?

Any personal data that you provide to us will be used for our business purposes only. Your information will not be shared with other individuals or other companies other than as described in this Privacy Policy.

In some instances we may retain other companies and individuals to perform functions on our behalf, including, but not limited to, website developers, IT services providers, shipping or direct mail organizations, storage facilities or parties assisting us in a recruitment process. Such third parties may be provided with access to your personal data to perform the functions for which they have been retained.

We further may disclose any information, including personal data, we deem necessary, in our sole discretion, to comply with any applicable law, regulation, legal process or governmental request.

Does Labaton provide links to Third-Party Sites?

Our Site may contain links to other third-party sites. When you click on one of these links you are visiting a website operated by an entity other than Labaton, and the operator of that website may have a different privacy policy. Labaton is not responsible for third-party operators’ individual privacy practices. We encourage you to investigate the privacy policies of these third-party operators.

What are your California Privacy Rights?

California Business Code Section 22575 permits our customers who are California residents to request certain information regarding our processing of personal information. Should you wish to review or request changes to your personal information, please contact our Privacy Data Protection Officers at dataprivacy@labaton.com.

Does Labaton seek parental consent for children under 13 years of age?

Our Site is not intended for children under 13 years of age. No one under age 13 may provide any information to us through the Site. We do not knowingly collect personal data from children under 13. If you are under 13, do not access, use or provide any information on the Site or on or through any of its features. If we learn we have collected or received personal data from a child under 13 without verification of parental consent, we will delete that information. If you believe we might have any information from or about a child under 13, please contact us.

How long does Labaton retain your personal data?

Personal data will be stored as long as the information is required to fulfill our legitimate business needs or the purposes for which the information was collected, or for as long as is required by law. Personal data will be maintained for at least their minimum time period required retention under Labaton’s records retention schedules.

Do you have rights in your personal data?

You have the following rights in your personal data held by Labaton:

● right to access your personal data and request certain information concerning your personal data, such as an explanation of the purpose of the processing and disclosure of third parties with whom Labaton shares the data;

● right to rectify inaccuracies in your personal data or to ensure that it remains up to date. Labaton is committed to ensuring that your information is accurate and kept up to date. Please inform us of any changes to your personal data;

● right to erasure of your personal data under certain circumstances. For example, you may request erasure if the data is no longer needed in connection with the reasons it was collected or processed or if you withdraw your consent to further processing. Labaton may deny your request where it is required or permitted by law to retain your personal data or when we need to retain your information in connection with the exercise or defense of legal claims;

● right to restrict processing where you contest the accuracy of the data in order to permit time to rectify the inaccuracies and in other circumstances;

● right to data portability by requesting a copy be provided in a structured, commonly used and machine-readable format and/or requesting that Labaton transmit your personal data to a third party where technically feasible;

● right to object to processing of your personal data where you contest that the processing is necessary for the purposes of Labaton’s or its business partners’ legitimate interests. Labaton may deny your request because it has compelling legitimate business interests or the exercise or defense of legal claims. You may also advise us at any time that you no longer wish to receive direct marketing materials from Labaton; and

● right to bring a complaint before the applicable governmental privacy regulator.

You may contact the data privacy officer concerning your rights.

If you wish to make a formal request for information we hold about you, you can contact us at dataprivacy@labaton.com.

Revisions to This Privacy Policy

Labaton reserves the right to change this privacy policy at any time whereby relevant changes take effect for the future. The applicable version of this Privacy Policy is available on the Site. Please check this Privacy Policy regularly, and before you submit additional personal information via the Site.

Contact

The Site is owned and operated by Labaton Sucharow LLP.

If you have questions or comments regarding this Privacy Policy or if you would like to exercise your rights, please send us an email to dataprivacy@labaton.com.

(Updated / Effective: July 9, 2018)

The materials appearing on this website are provided for informational purposes only and do not constitute legal advice. You should not take action based upon this information without consulting legal counsel. This site is not intended to create an attorney-client relationship. The hiring of a lawyer is an important decision that should not be based solely upon any single source of information, including advertising on this website. You may ask us to send you further information about us, and we urge you to review other sources of information about us.