Your privacy is important to Iron Mountain

PRIVACY NOTICE – IRON MOUNTAIN SINGAPORE

We respect your privacy, Iron Mountain Singapore Pte Limited (referred to as “Iron Mountain” or “We” or “Our” in this Privacy Notice) have developed this Privacy Notice to inform you of how We process and protect the Personal Data that We Collect, Use, or Disclose with third parties. It also covers how Iron Mountain makes the Personal Data it holds available for access to and correction by you.

This Privacy Notice has been drafted having regard to Iron Mountain's obligations under Personal Data Protection Act 2012 (the “PDPA” or the “Act”). This Privacy Notice is a public document and has been prepared in light of the “Openness Obligation” (Section 12) under the Act.

Please read this Privacy Notice. By using the Iron Mountain Website, or by receiving notification from Iron Mountain on how you may access this Privacy Notice, whether by phone, email or otherwise, you are consenting to the Collection, Use and Disclosure of your Personal Data as set forth in this Privacy Notice.

1. COLLECTION OF YOUR PERSONAL DATA

1.1 Iron Mountain Collects Personal Data about customers, prospective customers, vendors, prospective vendors, contractors, job candidates, the general public (via our CCTVs) and Website users which is reasonably necessary for, or directly related to, one or more of our functions or activities. The Personal Data may be collected through our Website, over the phone, or otherwise.

1.2 At or before the time, or, if that is not practicable, as soon as practicable after, We Collect your Personal Data, We will notify you upon your request of the matters required pursuant to Section 20 of the Act – by providing you with a hard copy of this Privacy Notice, or by notifying you of how you may access this Privacy Notice.

1.3 Iron Mountain will not Collect Personal Data secretly or in an underhanded way and will not sell your Personal Data to any third party (except in the course of a sale of the business, etc.).

2. HOW WE USE YOUR INFORMATION AND WHEN WE MAY SHARE IT

2.1 Iron Mountain holds Personal Data which it has Collected for its Primary Purposes, including but not limited to:

(a) providing you with the products and services ordered from us or in relation to products or services We order from you;

(b) answering your inquiry or job application;

(d) providing you with effective customer service; and

(e) for security measures relating to our services.

2.2 Iron Mountain also holds Personal Data for purposes other than its Primary Purposes (Secondary Purposes). You provide your consent to us using your Personal Data for the following Secondary Purposes:

(a) billing and account management;

(b) business planning and product development;

(c) providing you with relevant information, including promotions, about the products and services of Iron Mountain and its affiliates;

(d) enabling us to better understand your needs and interests;

(e) improving the content, functionality and usability of our Website;

(f) improving our marketing and promotional efforts;

(g) displaying personalised advertising when you visit our Website;

(h) for any other purpose identified in any other agreement between you and Iron Mountain;

(i) issues, news or other information relevant to your dealings with Iron Mountain, or about Iron Mountain generally, or the industries in which you or Iron Mountain operates; and

(j) as otherwise described in this Privacy Notice.

2.3 Iron Mountain may Use and/or Share your Personal Data for any Secondary Purposes not included in this Privacy Notice if:

(a) the Secondary Purpose is related to a Primary Purpose;

(b) the aforementioned Secondary Purpose is something that a reasonable person would consider appropriate in the circumstances; and

(c) where applicable, the individual has been informed of by the Us (pursuant to the Notification Obligation under section 20 of the PDPA).

2.4 From time to time We may Share your Personal Data to organisations outside of Iron Mountain in order to deliver the services you require or if required for other legal reasons. Your Personal Data is Shared with these organisations in relation to us providing Our services to you or to meet such other legal requirements. These organisations carry out, amongst other services, Our:

(a) billing and debt- recovery functions;

(b) customer inquiries;

(d) marketing and communication services (including market research);

(e) website usage analysis;

(f) to support or facilitate any of those activities described in Points 2.1 and 2.2 herein; and

(g) advisers and insurers.

Iron Mountain adopts contractual or other means in compliance with the “Protection & Retention Limitation Obligation” (Sections 24 & 25 of the Act) to prevent:

(a) your Personal Data transferred to above organisations from being kept longer than is necessary for the purpose or for other legal or business purposes;

(b) unauthorised access, collection, use, disclosure, copying, modification, disposal of or similar risks to your Personal Data transferred to organisation for the provision of the above services.

Furthermore We will take reasonable practicable steps to ensure that these organisations are bound by confidentiality obligations in relation to the protection of your Personal Data.

3. DIRECT MARKETING

3.1 Iron Mountain only targets businesses with its services. Although Personal Data may be collected from any individual through Our website or otherwise for various purposes (i.e., to download a document, respond to a query or a job application), with respect to direct marketing purposes, We intend to use Personal Data that is collected from individuals in their official capacities and Our promoted services are clearly meant for the use of the targeted business. If these requirements are met, Iron Mountain does not need to obtain consent from this individual and the other provisions of the Act neither apply to Iron Mountain.

3.2 Should We have doubts that the collected Personal Data relates to individuals in their official capacities, We ask for consent for Using and/or Sharing any Personal Data Collected from you for Direct Marketing purposes in accordance with the Act, whether Collected via telephone, the Website, or otherwise, but subject to the terms of this Privacy Notice.

3.3 In each Direct Marketing communication, We will include:

(a) a prominent statement appearing on the relevant piece of marketing material notifying you of your right to Opt Out from further Direct Marketing; and

(b) simple means for you to Opt Out of receiving further Direct Marketing communications of that kind.

3.4 Should you Opt Out, We will stop Using and/or Disclosing your Personal Data for Direct Marketing purposes.

4. ENSURING INFORMATION IS ACCURATE AND UP-TO-DATE

We take reasonable precautions to ensure that the Personal Data We Collect, Use and Share is complete, relevant and up-to-date.

However, the accuracy of that information depends to a large extent on the information you provide. That's why We recommend that you:

let us know if there are any errors in your Personal Data; and
keep us up-to-date with changes to your Personal Data. You may change your personal details by using the relevant facility on Our Website or by contacting Iron Mountain via contact details described in Point 12.

5. HOW WE PROTECT YOUR INFORMATION

5.1 Iron Mountain will take reasonable steps to protect your Personal Data from misuse, interference, loss and unauthorised access or disclosure. This may include taking reasonable steps to destroy or permanently de-identify Personal Data once it is no longer needed for any purpose for which it may be Used or Shared in accordance with Section 23 and 24 of the Act ("Accuracy and Retention Limitation Obligation”).

5.2 Iron Mountain will not attempt to match de-identified or make anonymous data Collected through surveys or such online devices as "cookies", with information identifying an individual, without notifying the relevant individual.

5.3 Iron Mountain requires employees and contractors to perform their duties in a manner that is consistent with Iron Mountain' legal responsibilities in relation to privacy, including those in this Privacy Notice.

5.4 Iron Mountain will take reasonable steps to ensure that Personal Data is only accessible by people who have a genuine "need to know" as well as "right to know."

6. HOW YOU CAN ACCESS OR CORRECT YOUR INFORMATION

6.1 Iron Mountain will permit Our records containing your Personal Data to be accessed by you when required by Section 21 of the Act (“Access Obligation”). We may, however, refuse to provide you with access to your Personal Data if one or more of those matters contained in the Act - circumstances in which data user shall or may refuse to comply with data access request– applies, i.e., the provision of that Personal Data, as the case may be, could reasonably be expected to

(a) threaten the safety or physical or mental health of an individual other than the individual who made the request;

(b) cause immediate or grave harm to the safety or to the physical or mental health of the individual who made the request;

(d) reveal the identity of an individual who has provided Personal Data about another individual and the individual providing the Personal Data does not consent to the disclosure of his identity; or

(e) be contrary to the national interest.

Additionally We may also refuse to provide you with access to your Personal Data or other information in respect of the matters specified in the Fifth Schedule of the Act (“Exceptions from Access Requirement”)

6.2 If Iron Mountain is satisfied that:

(a) having regard to the purpose for which the information is held, the information is inaccurate, out of date, incomplete or irrelevant or misleading; or

(b) you (as the person to whom the Personal Data relates) request that We correct the information; We will take reasonable steps to correct Our records containing your Personal Data as soon as practically possible in accordance with Section 22 of the Act (“Correction Obligation”) and with the exceptions stipulated in the Sixth Schedule of the Act (“Exceptions from Correction Requirement”).

6.3 If We have refused to grant you access to your Personal Data in accordance with Point 6.1 above, We will still take all reasonable steps to provide you with access to your Personal Data in a way that meets both your needs and Our needs.

6.4 If you:

(a) wish to lodge a request to access and/or correct your Personal Data; or

(b) have been refused access to your Personal Data by us for any reason described in this Privacy Notice and you wish to challenge that refusal; you may do so by contacting the Data Protection Officer as per the details in Point 12.

6.5 Iron Mountain will not charge a fee for processing an access request unless the request is complex or is resource intensive. Iron Mountain does, however, reserve the right to charge an administration fee if an individual requests access to their Personal Data more than once in a three month period.

6.6 Where Iron Mountain offers online account management facilities, customers can use this capability to control aspects of their account, including amending or updating certain Personal Data.

7. OPENNESS

7.1 Iron Mountain’s Data Protection Officer will be the first point of contact for inquiries about privacy issues. If you wish to make an inquiry or complaint regarding your privacy, you should contact this person as per the details in Point 12.

7.2 You will find that the Iron Mountain’s Website contains a copy of this Privacy Notice.

8. STAYING ANONYMOUS

8.1 Iron Mountain will not make it mandatory for visitors to Our Website to provide Personal Data unless such Personal Data is required to answer an inquiry or provide a service. Iron Mountain may however request visitors to provide Personal Data voluntarily to Iron Mountain (for example, as part of a competition or questionnaire).

8.2 Iron Mountain will allow you to transact with us anonymously or by using a pseudonym wherever that is reasonable and practicable.

9. TRANSFERRING PERSONAL DATA

9.1 If We send Personal Data out of Singapore, Iron Mountain will take appropriate steps to ensure that the recipient is bound by legally enforceable obligations so as to provide to your transferred Personal Data a standard of protection that is comparable to that under the Act.

9.2 In addition to the process set forth in Section 9.1, Iron Mountain may Share Personal Data to a recipient if:

(a) you are Expressly Informed of the intended transfer of your Personal Data to the recipient, and you consent in writing;

(b) the transfer of the personal data to the recipient is necessary for the performance of a contract between you and Us, or to do anything at your request with a view to you entering into a contract with Us;

(c) the transfer of the personal data to the recipient is necessary for the conclusion or performance of a contract between Us and a third party which is entered into at your request;

(d) the transfer of the personal data to the recipient is necessary for the conclusion or performance of a contract between Us and a third party if a reasonable person would consider the contract to be in your interest;

(e) the transfer of personal data to the recipient is necessary for the Personal Data to be used under paragraph 1(a), (b) or (d) under the Third Schedule of the Act or disclosed under paragraph 1(a), (b), (c), (e) or (o) of the Fourth Schedule to the Act, and We have taken reasonable steps to ensure that the Personal Data so transferred will not be used or disclosed by the recipient for any other purpose;

(f) the Personal Data is data in transit; or

(g) the Personal Data is publicly available in Singapore.

Under (a), We will:

before you give your consent, give a reasonable summary in writing of the extent to which Personal Data to be transferred to that country or territory will be protected to a standard comparable to the protection under the Act;
ensure that We did not require you to consent to the transfer as a condition of providing a product or service unless the transfer is reasonable necessary to provide the product or service to you; and
not obtain or attempt to obtain your consent by providing false or misleading information about the transfer, or by using other deceptive or misleading practices.

Additionally, you may withdraw consent given for the transfer of Personal Data to a country or territory outside Singapore.

10. CHANGES TO THE PRIVACY NOTICE

Iron Mountain may, in its sole discretion, update this Privacy Notice at any time and from time to time. Any changes will be effective when posted on Our Website. Your continued use of Our Website will indicate your acceptance of any changes to the Privacy Notice. All Personal Data, Collected both before and after any changes take effect, will be subject to the terms of the then current Notice, for which you will be taken to have provided consent, unless you indicate otherwise by contacting the Data Protection Officer as per the details in in Point 12. We encourage you to refer back to this page and especially prior to providing us with any Personal Data.

11. GLOSSARY

Collect means gather, acquire or obtain by a lawful and fair means, information in circumstances where the individual is identifiable or identified.

Direct Marketing involves the Use and/ or Sharing of Personal Data to communicate directly with an individual to promote goods or services through written, verbal or electronic means of communication for the company that the individual is acting for and behalf of. The goods or services which are marketed may be those of Iron Mountain or those of an independent third party organisation on behalf of Iron Mountain.

Sharing generally means the release of information outside Iron Mountain, including under a contract to carry out an "outsourced function."

Expressly Informed means the circumstance where We have provided you with a clear statement (either verbal or in writing) of the fact that that We will not be accountable under the Act and you will not be able to seek redress under the Act in the event that you provide consent to the Sharing of your Personal Data by us to a recipient outside of Singapore and this recipient handles your Personal Data in breach of the Act.

Opt Out means an individual's expressed request not to receive Direct Marketing communications.

Iron Mountain means Iron Mountain Singapore Pte Limited

Personal Data means any data (a) relating directly or indirectly to a living individual;(b) from which it is practicable for the identity of the individual to be directly or indirectly ascertained; and (c) in a form in which access to or processing of the data is practicable. This includes, but is not limited to, an individual’s name, address, telephone number and email address.

Primary Purpose is the main reason for the Collection of any Personal Data.

Reasonable Expectation means an individual's reasonable expectation that their Personal Data might be Used or Shared for the relevant purpose.

Secondary Purpose means a purpose of Use or Sharing other than a Primary Purpose.

Use means the handling of Personal Data within Iron Mountain.

Website means the website of Iron Mountain and related webpages.

12. CONTACTING IRON MOUNTAIN

If you have questions concerning this Privacy Policy, please contact the Privacy & Compliance Team via email at compliance@ironmountain.com.

This Privacy Notice was last updated on 20 September 2018.