S&P Global is a leading provider of transparent and independent ratings, benchmarks, analytics and data to the capital and commodity markets, businesses and governments worldwide. For more about the S&P Global current group companies and other related companies, please see our latest filing here.

The information that we collect from or about you - some of which is personal information under applicable data protection laws - falls into the following broad categories:

1. Information that you provide to us

As part of our Services, you may provide certain information to us, such as your contact details, user credentials, and employment information.

 A few examples include, when you fill out an on-line form to register to use our Services, such as to attend an event, to request a free trial or courtesy newsletter, or to receive research, white papers, product information or reports through our website. You may also provide us with your business card information or other contact information as you conduct business with us or you request information from us. Information we ask you for and why we ask you for it includes:

The categories of personal information listed in the S&P Global "What personal information does S&P Global collect and why?" section above may be disclosed to the following categories of recipients: 

Our group companies and our joint venture companies where applicable, service providers including without limitation professional advisers or consultants such as lawyers, bankers, auditors, accountants and insurers providing consultancy, legal, banking, audit, accounting or insurance services, financial institutions providing finance to us, external auditors, product content providers, business partners and any organization that arranges your access to our products or services (if that is not you).

We share personal information with those authorized parties referred to above for purposes consistent with those described in this Policy or as notified to you when your personal information is collected. For example, we may share your personal information with the organization that arranges your access to our products or services to fulfill its contractual obligations and to provide our products and services, support, and training for them. We may share your personal information with our service providers and business partners for the purpose of operating our business, honoring a request that you have made through the products or services, delivering, improving and customizing our products or Services, sending marketing and communications related to our business, payment processing, and for other legitimate purposes permitted by applicable law or otherwise with your consent. In certain circumstances where your personal information has been collected for marketing purposes and where permitted by applicable law, we may share the personal information with business partners in the ad tech sector for their own commercial marketing purposes. We may share the contact information you provide when registering for an event and share event attendee lists between our S&P Global divisions and with our webinar and conference partners, to ensure that your contact information is up to date and to administer, secure, and seek feedback on and promote our events. 

For a list of our current group companies and related companies, please see our latest filings here. A list of our service providers, content providers and business partners is available here. For information about the disclosure of the California enumerated categories please see the California jurisdictional section below.

In addition to the purposes described in this Policy, personal information handled by our service providers may be subject to their terms of use and privacy policies, which if applicable, will be provided to you. Please review any applicable service provider’s terms of use and privacy policies to better understand how they manage your personal information.

Your employer

We may provide personal information to your employer for purposes such as to fulfill and enforce our contract with them, to inform them of potential group training needs, to inform them of Service use by certain categories of users and for pricing purposes.

Competent law enforcement bodies, regulatory, government agency, court or other third parties

We may provide personal information to any competent law enforcement body, regulatory, government agency, court or other third party in accordance with applicable law and regulation when we believe disclosure is necessary (i) as a matter of applicable law or regulation, (ii) to protect against fraud or for risk management purposes, (iii) to cooperate with relevant agencies for the investigation and prevention of crimes such as insider trading, (iv) to exercise, establish or defend our legal rights, (v) to protect your vital interests or those of any other person, or (vi) to protect the interests, rights, safety or property of us or others.

S&P Global is regulated by various federal and state agencies, authorities and similar regulatory bodies internationally and, in the normal course of business, both in the United States of America and abroad, is the subject of government and regulatory proceedings, investigations and inquiries. We may therefore disclose your information to comply with a court order, government request or other legal or regulatory process, sometimes without prior notice to you. 

Our SEC filings set this out in more detail and are available here.

Potential Buyers

We may provide personal information to a potential buyer or a target (and that third party’s or our agents and advisers) in connection with any proposed sale, purchase, merger, transfer, acquisition or liquidation or similar event, of all or any part of our businesses. If such a change happens to our business, the buyer or target will use your personal information in the same way as set out in this Policy or will inform you about how it will use your personal information as required by applicable law. 

Other third parties

Personal information that you disclose on message boards, chat areas or social media pages or in direct messages to other users of these platforms may be collected and used by third parties to contact you, to send you unsolicited messages or for other purposes without our knowledge or control. Social media forums and chat rooms not operated by us may have additional rules and conditions. We are not responsible for the personal information or any other information you choose to submit on these forums that are not controlled by us.

The Services may offer you the ability to share personal information through a social networking site (e.g., Facebook, Twitter) using integrated tools (e.g., Facebook “Like” button, or Twitter “Tweet” button). The use of such integrated tools enables you to share personal information about yourself with other individuals or the public, depending on the settings that you have established with such social networking site. For more information about the purpose and scope of data collection and use in connection with such social networking sites or a site’s integrated tools, please visit the privacy policies of the entities that provide these social networking sites.

We encourage you to use caution when publicly disclosing your personal information.

We may ask for your consent to share your information with other unaffiliated third parties who are not described elsewhere in this Policy.

For more information about how and why we disclose the personal information that features in our products, please see "How does S&P Global use personal information in products?" below.

Our legal basis for collecting and processing personal information depends on the personal information concerned, the context in which we collect it and the applicable laws and regulations.

Generally, we collect personal information from you where: we have your consent to do so; we need the personal information to perform a contract with you (for example, your subscription to one of our products) where permitted under applicable data protection laws; or, in some jurisdictions such as the European Economic Area (“EEA”), the processing is in our legitimate interests and not overridden by your data protection interests or fundamental rights and freedoms or the processing is otherwise consistent with applicable law. In some cases, we are required by law to collect personal information from you. 

If we ask you to provide personal information to comply with a legal requirement or to perform a contract with you, we will inform you whether the provision of your personal information is mandatory and the possible consequences if you do not provide your personal information.

Where we send you marketing or promotional e-mails regarding our Services from our different divisions and affiliates, we do so based on your consent, if required by applicable law.

Generally, if we collect and use your personal information in reliance on our legitimate interests (or those of a third party), this interest is to provide our Services to you and for our legitimate commercial interest (e.g., when responding to your queries, improving our Services, processing payments, advising you of product features or new releases, providing training, informing you of product maintenance, or undertaking marketing activities). For the legal basis on which we rely in relation to personal information in our products, please see "How does S&P Global use personal information in products?".

Generally, we use cookies and similar tracking technology (collectively, "Cookies") in certain Services (in particular our websites and some mobile applications) to collect and use personal information about you, in order to better understand and improve the usability, performance, and effectiveness of our Services, to help us tailor content or offers for you, and to serve our targeted, interest-based advertising. These technologies may also allow certain third parties to collect information about you over time and across different websites, such as information about you clicking on advertisements or installing our Services. Where permitted by applicable law, we will deploy first party performance or analytics Cookies automatically when you visit our websites. Where required by applicable law, we will obtain your consent before we place any Cookies on your device that are not strictly necessary for the functioning of our websites. To learn more, including about how to consent to or opt-out and withdraw your consent to Cookies, please see our Cookie Notice.

We may use Google Analytics to better understand how visitors use our Services. Google Analytics provides us with information about users of our Services. Google Analytics uses Cookies that Google or its affiliate DoubleClick recognizes when you visit other websites and applications. For more information about how Google collects, uses, and shares your information, including information collected through our Services, please visit the Google Privacy Policy - Partners website at https://policies.google.com/technologies/partner-sites or see Google’s own Privacy Policy at https://policies.google.com/privacy. 

Google Analytics uses Cookies to help us analyze how users use our Services. Personal information generated by these Cookies about your use of our Services (including your IP address) will be transmitted to and stored by Google on servers in the United States of America. On our behalf, Google will use this information to evaluate your use of our Services and will compile reports on your activity for us. 

If you want to opt out of Google Analytics, you can download and install the opt-out browser add-on developed by Google for your web browser. For more information about Google Analytics' currently available opt-outs, please see https://tools.google.com/dlpaqe/gaoptout.

For more information about our privacy practices relating to our advertising services, please see the Digital and advertising-related services section of this Policy.

We protect personal information that we process with appropriate technical and organizational measures designed to provide a level of security appropriate to the risk of processing your personal information. We will notify you about any security incident involving your personal information through email, correspondence, telephone, push notification or other means, as required by applicable law. If you think your data is the subject of a security incident and we have not notified you, or if you are concerned about the security of your data, please contact our dedicated security team at security@spglobal.com.  

Your personal information may be transferred to, and processed outside, the jurisdiction in which you reside. These other jurisdictions may have data protection laws that are different from the laws of the jurisdiction of your residence (and, in some cases, not as protective).

S&P Global is a multi-national group with headquarters in New York, United States of America. Our servers may be located outside of the jurisdiction where we collected the data. We may store and replicate your personal information on servers in other jurisdictions, in order to provide speed of access, robustness and protection against server failure. 

When we collect your personal information, we may transfer it to or from any of the countries in which we do business. Our group companies, related companies, any organization that arranges your access to our products or services service providers, product content providers and business partners, with whom we may share personal information, are located in and transfer personal information to various jurisdictions around the world. The principal jurisdictions where personal information is hosted by or on behalf of S&P Global are the United States of America, Canada, the United Kingdom, Germany, the Republic of Ireland, Italy, France, Switzerland, the Netherlands, India and Singapore. In some cases, your personal information may also be accessed from outside of the jurisdiction where we collected the data, such as the Philippines, India and Pakistan, where our back-office support personnel are located for certain Divisions.

Where your personal information is transferred by us or on our behalf, we implement appropriate safeguards to protect your personal information in accordance with this Policy. These safeguards include implementing applicable standard contractual clauses for transfers of personal information between our group companies, which require group companies to protect personal information they transfer from the jurisdiction in which it was collected in accordance with applicable data protection law.

Where required by applicable law, international transfers take place only when there is an adequate level of protection to the fundamental data protection rights of individuals. In some circumstances, we may choose to rely upon an adequacy decision to lawfully transfer personal information. Standard contractual clauses are one of several mechanisms that allow for personal information to be transferred across jurisdictional borders and we my rely on these for transfers to and from our affiliates, vendors and business partners where applicable. Additional safeguards may also be implemented where personal information is transferred. Please contact us to request a copy of our appropriate safeguards.

Our applicable information governance policies, procedures and standards require that personal information be retained for as long as we have an ongoing legitimate business need to do so (for example, to provide you with a Service you have requested, or to comply with applicable legal, tax or accounting requirements).

Once we no longer have a legitimate business need to process your personal information, our applicable information governance policies, procedures and standards require that we either delete or anonymize your personal information, or if deletion or anonymization is not possible, then pseudonymize and/or securely store your personal information and isolate it from any further processing until deletion is possible.

If you have any questions or require any further information about the period of time for which we will process your personal information, please contact us using the contact details set out below.

Depending on which laws apply to your personal information, you may have the right to make the following requests regarding your personal information:

- Access to Your Personal Information. You may request access to your personal information or confirmation that we have information about you. In certain limited circumstances, you may also request to receive access to your data in a portable, machine-readable format.

- Deletion Of Your Personal Information. You may request that we delete your personal information. If required by law, we will grant a request to delete information, but you should note that in many situations we must keep to comply with our legal obligations, resolve disputes, enforce our agreements, or for another business purposes.

- Corrections To Your Personal Information. We rely on you to update and correct your personal information. Where your personal information is required to access or use Services, you may have the opportunity to correct, update, or modify this information by logging into your account and updating your information online. You may ask us to correct information that is inaccurate or incomplete. Note that we may keep historical information in our backup files as permitted by law.

- Objection to Certain Processing. You may object to our use or disclosure of your personal information by contacting us at the address described below.

- Opt-out of Targeted Advertising You may opt-out of online tracking based targeted advertising or cross-context behavioral advertising (e.g., cookies) by clicking the cookie settings link on the footer of our websites. Please note that if you change browsers or computers, or if you clear your browser’s cache, you may need to click the link again to apply your preference.

- Opt-out of Sale. You may opt-out of the sale of your personal information by clicking here or the “Do Not Sell My Personal Information” link on our homepage.

- Restrict Processing. You may request that we restrict our processing of your personal information under certain circumstances, such as when you contest the accuracy of our records about you, or you make an objection.

- Promotional Emails. You may choose to provide us with your email address for the purpose of allowing us to send free newsletters, surveys, offers, and other promotional materials to you, as well as targeted offers from third parties. You can stop receiving promotional emails by following the unsubscribe or “opt-out” instructions in emails that you receive, by visiting our preference center here or by using the contact details listed on this page. If you decide not to receive promotional emails, we may still send you service-related communications.

- Revocation Of Consent. Where we process your personal information based upon consent, you may revoke consent. Withdrawing your consent will not affect the lawfulness of any processing we conducted before withdrawal, nor will it affect processing of your personal information conducted in reliance on lawful processing grounds other than consent. Please note, if you revoke your consent for the processing of personal information then we may no longer be able to provide you services.

Please note, not all of the rights described above are absolute, and they do not apply in all circumstances. In some cases, we may limit or deny your request because the law permits or requires us to do so, because a right is not granted by the laws that apply to a specific person, or if we are unable to adequately verify your identity. Individuals in certain jurisdictions may have other rights. For more information, see the applicable jurisdiction-specific addendum which forms part of this Policy. We will not discriminate against individuals who exercise their privacy rights under applicable law.

You may use this Personal Information Request Form or call us on 1-855-529-1761 to exercise any of your rights. If you disagree with how we handled a request, you may appeal our decision by contacting us with the subject line “Appeal,” at privacy@spglobal.com.

We respond to requests we receive from individuals wishing to exercise their data protection rights or express any concern in accordance with applicable data protection laws, which typically require a response within 30 days. Please be aware that in order to accommodate some requests, we must verify your identity before we can respond, and this may require you to provide photographic or other forms of identification to us.

In some circumstances, you may designate an authorized agent to submit requests to exercise certain privacy rights on your behalf. If you are an authorized agent submitting a request on behalf of an individual, you must provide all requested information establishing your authorization as an agent to act on another person’s behalf.

If you are not satisfied with our response, and are in the European Union or United Kingdom, you may have a right to lodge a complaint with your local supervisory authority. Contact details for data protection authorities in the EEA, Canada, Switzerland and the UK are available here.

Please note that in certain jurisdictions we may be entitled to charge a fee in connection with the exercise of these rights, which will be communicated to you if applicable.

We review and update this Policy from time to time. When we do, we will bring those updates to your attention, for example, by noting the date of the version on the Policy, posting the updated version here or sending you a notification. To the extent that this Policy changes in a material way, the Policy that was in place at the time that you submitted personal information to us will generally govern that information unless we receive your consent to the new policy.

S&P Global’s Markit Digital advertising services (Markit Digital Advertising) provide ad serving and marketing optimization solutions for the financial services sector. Markit Digital's advertising services never collect financial account information or any Directly Identifying Personal-Information for advertising purposes.

In some circumstances, Markit Digital collects information for use in tailored ads shown within the same browser. Markit Digital is a member of the NAI (Network Advertising Initiative) and the IAB (Internet Advertising Bureau) and abides by the NAI code of conduct and IAB requirements.

Collection and Use of Personal Information

Advertisements served from our advertising domain, ad.wsod.com, do not collect Directly Identifying Personal-Information.

Collection, Use and Sharing of Non-Personal Information

While advertisements served from ad.wsod.com do not collect information that can directly identify an individual, the system does collect information including the time and date of an ad served, the type of browser and operating system used, the visitor's IP address, and the URL visited. Additional information may be provided by publishers, advertisers, or third parties. This information is not used to identify anyone personally; it is used for aggregated analytic reports, targeting a Tailored Advertising experience, and for the purpose of site administration and diagnostics.

This information may be shared with advertising clients or their business partners at their direction.

Collection of Non-Personal Information on Mobile Devices

Markit Digital may receive non-personal information, such as device information and cookie identification from third party sources, including Apple IDFA, Google AdID, and Android ID. Use of Cookies.

Advertisements served from ad.wsod.com set and use cookies and local storage, when appropriate. The ad server uses cookies/local storage to avoid additional database look-ups, but does not use any other systems for persistently identifying users between views and visits. Cookies and all data collected from ad.wsod.com is advertiser-specific and is not shared between multiple advertisers, who may also be serving ads from the domain. An advertiser's data belongs to that advertiser, as the system used to serve ads from ad.wsod.com merely collects and temporarily stores that data for Tailored Advertising. Attribution cookies from Markit Digital's advertising services expire 30 days after the user's last attribution event. Tracking cookies expire after 60 days; after that time a tracking cookie is no longer valid and a new one is created. Opt-out settings in any cookies, along with assigned segments, expire after five years (less intervening leap-year days).

Data Retention

Markit Digital retains unidentifiable user-level information collected by our advertising system for up to 2 years in both aggregated and un-aggregated forms.

Information Relating to Children

Our products and services are designed for those 16 years of age and older. We do not knowingly collect information from anyone under the age of 16. If we are made aware that we have received information from someone under 16, we will use reasonable efforts to remove that information from our records.

Opting Out of Tailored Advertising (TA)

Tailored Advertising (TA), also known as Interest-based Advertising (IBA) or Online Behavioral Advertising (OBA) – is the process of targeting specific advertisements to each individual user, based on browsing history. If you opt-out of Tailored Advertising from our service using the tools below, the cookie and any local storage we use to contain this information will be emptied and changed to a placeholder signaling that you have opted-out. If you delete the placeholder cookie or locally-stored code, clear all cookies or local storage, or reset or reinstall your browser, you will need to opt-out again. Cookies and local storage data are browser- and device-specific, so you will need to opt-out from within each browser and computer/device, if you regularly use more than one. After opting-out, you may continue to see digital advertising from us, but it will no longer be targeted to you based on your browsing history. Opting-out does not necessarily delete or replace all cookies or local storage from our domain; some may remain which are used for aggregate reporting on the performance of the advertisements we serve.

Consumer Opt-Out

The Network Advertising Initiative (NAI) provides information to help you learn more about online advertising (http://www.networkadvertising.org/understanding-online-advertising), as well as a service to help you opt out of interest-based advertising from many organizations (http://www.networkadvertising.org/choices/). Markit Digital does not sell personal information as defined by the California Consumer Privacy Act (CCPA). However, Markit Digital still participates in services allowing all site visitors to control the use of Interest-based Advertising. Visit privacyrights.info to learn more about CCPA and how you may opt-out from other organizations' use of your data. By selecting the below opt-out, Markit Digital will respect your choices for this browser, and they will be reflected here until you clear this browser's cookies.

Opting Out on Your Mobile Device

For information on Opting Out on Mobile Devices, please visit https://www.networkadvertising.org/mobile-choice.

Privacy Inquiries

If you use our webform to correspond with us ( https://privacyportal.onetrust.com/webform/5cb57702-8ef7-437e-a62b-408fe78cd310/a2d05665-f8c3-44a2-ae58-d2015af31754 ⁠⁠), S&P Global will receive your name, email and your country of residence. S&P Global’s Markit Digital Advertising services never use this personal information or any Directly Identifiable Personal Information for advertising purposes.

Industry Associations and Compliance

Markit Digital participates in the Interactive Advertising Bureau's Self-Regulatory Program for Online Behavioral Advertising (http://www.iab.net/public_policy/self-reg).

Markit Digital adheres to and is annually reviewed for compliance with the Network Advertising Initiative's Code of Conduct (https://www.networkadvertising.org/code-enforcement/code).

Markit Digital adheres to the Digital Advertising Alliance's Self-Regulatory Principles for Online Behavioral Advertising (http://www.aboutads.info/obaprinciples).

As of 30 September 2022, S&P Global has suspended operations in the Russian Federation. Some processing of personal data may occur in relation to any regulatory or legal obligations in the Russian Federation, such as for the purpose of fulfilling tax, employment, and any other legal obligations. Any ongoing processing of personal information of Russian citizens is executed the Schneider Group, on behalf of Standard & Poor’s International Services LLC and Moscow Branch of S&P Global Ratings Europe Limited. For any questions about this processing, please see the Schneider Group's Privacy Policy or contact info@schneider-group.com. 

This China Addendum (“China Addendum”) applies to the processing of your personal information only if you are located in the People’s Republic of China (“China”) and supplements this Policy. In case of any inconsistencies between this China Addendum and the rest of this Policy, this China Addendum prevails.

1. Sensitive Personal Information. Your personal information whose leakage or unlawful use may easily infringe the dignity of a natural person, or cause harm to the personal safety or property security, including biometric characteristics, religious beliefs, specially designated status, medical health, financial accounts, personal whereabouts and personal information of minors under the age of 14 may be considered as sensitive personal information in accordance with applicable Chinese law and regulations ("Sensitive Personal Information"). To the extent we collect this Sensitive Personal Information, we will only process it to the extent necessary for fulfilling the purposes as stated in this Policy and will take measures for its security. Where required by applicable Chinese law and regulations, we will obtain your separate consent before we process your sensitive personal information.

2. Sale of business. We may provide personal information to a potential buyer or target (and that third party’s or our agents and advisers) in connection with any proposed purchase, merger, transfer, acquisition or liquidation or similar event of all or any part of our business. If such a change happens to our business, the buyer or target will use your personal information as in the same way as set out in this Policy including this China Addendum or will inform you about how it will use your personal information as required by applicable law, or (where applicable) require such third party to obtain your consent again. 

3. Notifications. We cannot absolutely guarantee the security of any information or data you provide online. In the event of a security incident, we will take mitigation measures in accordance with our incident response plan and report to competent regulators in China as required by applicable law. In the event of a security incident affecting your personal information, we will notify you as required by applicable law through email, correspondence, telephone, push notification or other means. If you think your data is the subject of a security incident and we have not notified you, or if you are concerned about the security of your data, please contact our dedicated security team at security@spglobal.com.  

4. Contact Information of our China DPO. You may contact our China Data Protection Officer at privacy@spglobal.com or DPOChina@spglobal.com or, at: 49/F, Fortune Financial Center, No.5, Dongsanhuan Zhong Rd, Chaoyang District, Beijing. You may also exercise your rights in relation to personal information transferred overseas or request closure of an account which is registered with S&P Global through the method specified under the section of this Policy titled, “What are your data protection rights?” 

This Japan Addendum ("Japan Addendum") supplements this Policy to the extent that the Act on the Protection of Personal Information (Japan) applies in relation to the processing of personal information in Japan by S&P Global Ratings Japan Inc., S&P Global SF Japan Inc., Standard & Poor's International LLC, Japan Branch, IHS Markit Japan GK (together "S&P Global Japan") and/or S&P Global entities located outside Japan. If there are any inconsistencies between this Japan Addendum and the rest of this Policy in relation to S&P Global's process of personal information subject to the APPI, this Japan Addendum prevails.

S&P Global will comply with applicable Japanese data protection laws and regulations, and not use personal information for purposes which are not set forth in this Policy or otherwise communicated to the data subject. The process for submitting a claim or request is set out in this Policy.

Joint-use of personal information inside of S&P Global Group

S&P Global Japan jointly uses personal information with other entities in the S&P Global group who may use personal information to provide information about our Services to our clients and related support and training, conduct certain market research, contact clients, or engage in other activities detailed in this policy. S&P Global Japan may also have certain products that collect business information about individuals in Japan. Such information includes: address, name, company name, department name, job title, phone number, fax number, e-mail address, billing information, history of personnel changes and professional employment history, records of job interviews with S&P Global Japan, your areas of interest, etc.

A list of our group companies is available here.

Name, address and name of representative of the person responsible for the management of said personal data 

S&P Global Ratings Japan Inc, S&P Global SF Japan Inc. 
Marunouchi Kitaguchi Bldg. 28th Floor, 1-6-5 Marunouchi, Chiyoda-ku, Tokyo 100- 0005 
Representative Director Takenari Yamamoto

Standard & Poor’s International LLC Japan Branch 
Marunouchi Kitaguchi Bldg. 28th Floor, 1-6-5 Marunouchi, Chiyoda-ku, Tokyo 100- 0005 
Representative in Japan Sachiko Katayama 

IHS Markit Japan GK
3-1-1 Kyobashi, Chuo-ku, Tokyo 104-0031

Contact information regarding handling of personal information

If you have any questions or concerns about our disclosure, correction, deletion, utilization, or other processing of your personal information (including how we secure your personal information), please contact our Privacy Compliance Team via email at privacy@spglobal.com or Japanprivacy@spglobal.com or via mail, at: Marunouchi Kitaguchi Bldg. 28th Floor, 1-6-5 Marunouchi, Chiyoda-ku, Tokyo 100- 0005, Tel: +81-(0)3-4550-8000.

This State of California, United States of America Addendum ("California Addendum") supplements this Policy to the extent the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA") applies in relation to the processing of personal information of residents of the State of California in the United States of America by S&P Global. In case of any inconsistencies between this California Addendum and the rest of this Policy, this California Addendum prevails.

Certain information we collect may be exempt from the CCPA because it is considered public information (i.e., it is made available by a government entity) or covered by a federal privacy law, such as the Gramm-Leach-Bliley Act, the Health Insurance Portability and Accountability Act, the Fair Credit Reporting Act or the Driver Privacy Protection Act.

"Shine the Light" Law

Residents of the State of California also have the right to request information regarding third parties to whom the company has disclosed certain categories of personal information during the preceding year for the third parties' direct marketing purposes.

How to Submit a Request

To submit a request to exercise your rights (or to submit a request on behalf of a consumer as an authorized agent):

(1) For right to know, access, correct, or deletion requests, complete and submit the Data Request Form.

(2) For the opt-out of sale requests, visit "Do Not Sell My Personal Information" or call us at 1-855-529-1761.

For information about the requests we receive, including the number of requests and the average number of days we’ve taken to respond to requests, please click here.

The following is a summary of our data collection practices, including the personal information we collect, whether we disclose that information for business purpose, and whether we "sell" and/or "share" (as those terms are defined by California law). We may use all of the information for any of the purposes described in the Policy unless limitations are listed. S&P Global "shares" or "sells" personal information to third parties in very limited circumstances. To learn more about what brands share or sell personal information, please see below. As discussed elsewhere in the Privacy Policy, we use cookies and similar tracking technologies for purposes of targeted advertising. For more information, please see our Cookie Notice. The categories we use to describe the information are those set out in the CCPA.

California Sensitive Information Disclosure. We collect the following categories of sensitive personal information (as defined under California law): Social security, driver’s license, state identification card, or passport number; precise geolocation; Racial or ethnic origin, religious, or philosophical beliefs, or union membership; health information; and sex life or sexual orientation. This information is collected in order to process transactions, comply with laws, manage our business, or provide you with services. Note that we do not use such information for any purposes that are not identified within the California Privacy Rights Act Section 1798.121. We do not “sell” or “share” sensitive personal information for purposes of cross-context behavioral advertising.

Below is a list of brands that sell of share personal information with third parties: 

• Polk (https://ihsmarkit.com/products/polk-automotive-solutions.html)

• Ipreo (https://ihsmarkit.com/products/brst-bd-advanced.html)

• Money Market Directories (https://products.mmdwebaccess.com/)  

• Capital IQ Pro (https://www.capitaliq.spglobal.com/) 

• Capital IQ (https://www.capitaliq.com/) 

• XpressFeed (https://www.spglobal.com/marketintelligence/en/solutions/xpressfeedtm) 

•  Panjiva Platform (https://panjiva.com/platform) 

S&P Global has no actual knowledge that it sells or shares the personal information of consumers under 16 years of age.

This Brazil Addendum ("Brazil Addendum") supplements this Policy to the extent that the General Data Protection Law of Brazil ("LGPD") applies in relation to the processing of personal information by S&P Global. In case of any inconsistencies between this Brazil Addendum and the rest of this Policy, this Brazil Addendum prevails.

Under the LGPD, you have the right to:

• confirm the existence of processing of your personal data;

• access your personal data;

• correct incomplete, inaccurate, or out of date personal data;

• anonymize, block, or delete unnecessary or excessive personal data or personal data that is not being processed in compliance with the LGPD;

• portability of your personal data to another service or product provider, by means of an express request;

• delete personal data processed with your consent;

• information about public and private entities with which we have shared your personal data;

• information about the possibility of denying consent and the consequences of such denial;

• revoke consent;

• request review of decisions taken solely on the basis of automated processing of personal data that affects your interests.

You or an authorized agent may exercise your rights through the Personal Data Request Form. The LGPD also provides that you may file a complaint regarding your data directly with the Brazilian data protection regulator.

Data Protection Officer
c/o Commercial Legal
Rua do Passeio 38/40
Rio de Janeiro
Brazil

This Colombia Addendum ("Colombia Addendum") supplements this Policy to the extent that the law of Colombia applies in relation to the processing of personal information by S&P Global. In case of any inconsistencies between this Colombia Addendum and the rest of this Policy, this Colombia Addendum prevails.

Data Subject Rights

Subject to applicable law, you have the right to:

• freely access your personal information;

• know, update, and correct personal information when data is inexact, incomplete, fragmented, misleading, or where processing is not authorized or prohibited;

• request proof of authorization to process your personal information, unless exempted under applicable law;

• bring complaints to the Superintendent of Industry and Commerce;

• revoke authorization and/or require the deletion of personal information when there is not a legal or contractual reason to keep the personal information; and

• decline authorization for the processing of sensitive personal information. The provision of sensitive personal information or the personal information of minors is optional.

Principal Place of Business

S&P Global Colombia SAS (NIT #900.505.649-2) has its principal place of business at Carrera 19A No 90 – 13 Bogotá, Colombia.

This South African Addendum (“South African Addendum”) applies in relation to the processing of personal information by the S&P Global responsible parties listed below in the Republic of South Africa and supplements the information set out above in this Policy. In case of any inconsistencies between this South African Addendum and the rest of this Policy, this South African Addendum prevails.

1. Responsible Parties.
S&P Global responsible parties that may process personal information from time to time include:

• SPGI Indices UK (Incorporated in United Kingdom) External Profit Company South Africa, registration number 2013/147353/10

• SPGI UK (Incorporated in England) External Profit Company, registration number 2012/065136/10

• S&P Global Ratings Europe Limited (Incorporated in Ireland) External Profit Company, registration number 2017/655416/10

• S&P Global Ipreo Limited (Incorporated in United Kingdom) External Profit Company, registration number 2005/035402/07

2. Personal information of juristic persons

In addition to the individual’s personal information collected as set out in this Policy, we process information relating to South African juristic persons, which may constitute personal information for purposes of the Protection of Personal Information Act of South Africa. The personal information relating to South African juristic persons we process includes:

• A company’s or other juristic person’s name, address, telephone number, email address, company registration number, and company contact’s name;

• A company’s or other juristic person’s incorporation documents, tax numbers, audited financial statements, B-BBEE certificates, and bank account records;

• A company’s or other juristic person’s representative’s details, including their name, email, telephone numbers, job title, job function and details relating to the area of work;

• A company’s or other juristic person’s product or specification requirements; and

• Information related to product support interaction and product training information, to the extent that this information is identifiable.  

We collect the information directly from the juristic person concerned or its representatives during negotiation, when preparing and concluding agreements and during implementation or use of products/services for their users. We may also collect the information from the client’s employee users when they register and use products/services or obtain the information that has been made publicly available via the internet and website searches or when the client’s employee user otherwise gives S&P Global their contact details.

3. Purposes and legal basis for the processing of personal information of juristic persons

The purposes of the processing of the abovementioned personal information include:

• To identify clients and prospective customers;

• To market and sell products to clients;

• To negotiate and enter into contracts with clients;

• To obtain permission from clients and their users;

• To conduct training and to provide support to clients/users;

• To record client engagements and conversations;

• To invoice and collect from clients and account for client revenue;

• To comply with applicable statutory obligations;

• To carry out and manage our business operations and for any other legitimate business purposes; and

• In connection with our products and services.

Generally, we process the above personal information for purposes of the performance of a contract with a client, or where we have the consent of the client or the juristic person concerned, or on the basis that it is in our legitimate interests or that of a third party to whom the information is supplied for purposes of, amongst other things, marketing and selling our products and services, supporting client access to and use of our products, providing training to users of our products, responding to client or user queries, improving products and services, advising users of product features, new releases or maintenance.

The personal information of juristic persons may be shared with third parties and transferred to countries outside of South Africa. Please see the relevant provisions of the Policy in this regard.

4. Laws authorizing or requiring the collection of the personal information.

The legislation in terms of which personal information of individuals or juristic persons may be required to be processed includes:

• The Financial Intelligence Centre Act, 2001;

• The Income Tax Act, 1962; and

• The Company’s Act, 2008.

5. Sensitive Personal Information.

To the extent applicable, information relating to an individual’s religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life, biometric information or criminal behavior, including any photographs or video recordings of may be considered as sensitive/special personal information in accordance with applicable South African law and regulations. We will use an individual’s special personal information for the purposes as stated in this Privacy Policy, or as otherwise as notified to you from time to time.

6. Contact us. If you have any questions or concerns about this Addendum or the Policy you may contact the Information Officer at privacy@spglobal.com, or in accordance with the information provided in the Policy under “How to contact us”. We will reply to your request within reasonable period of time and in any event within 30 days. We may require you to verify your identity.