This Personal Information Protection Policy (for Roche Employees and Candidates) (this “Policy”) applies to all employees, outsourcing staff, dispatched employees, interns and candidates (collectively as “you” or “Employee”) of the following Roche entities and other Roche legal entities established in future within Mainland China region (“we” or “Roche”)：

• Shanghai Roche Pharmaceuticals Co., Ltd.

• Roche (China) Holding Ltd

• Roche R&D Center (China) Ltd

• Roche (Shanghai) Pharmaceuticals Technology Co., Ltd

• Roche (Shanghai) Pharmaceuticals Trading Co., Ltd

• Shanghai Roche Pharmaceuticals Co., Ltd. Trade Union

• Roche Diagnostics (Shanghai) Limited

• Roche Diagnostics (Suzhou) Limited
  
  

This Policy describes how we will process and protect the Personal Information of you as an employee or candidate of Roche in compliance with the principles of lawfulness, legitimacy, necessity and good faith, and for the purpose of recruitment, efficiently administering worker benefits programs and conducting general corporate affairs.

By clicking on/signing this Policy, you agree to be bound by all its terms. Please DO NOT click on/sign this Policy if you do not agree to any of its terms or conditions. Please note that your disagreement may delay the hiring process or affect your normal work at Roche.

If you have any questions about this Policy, please contact us via the following channels:

Shanghai Roche Pharmaceuticals Co., Ltd.
Roche (China) Holding Ltd
Roche R&D Center (China) Ltd

Roche (Shanghai) Pharmaceuticals Technology Co., Ltd
Roche (Shanghai) Pharmaceuticals Trading Co., Ltd
Shanghai Roche Pharmaceuticals Co., Ltd. Trade Union

Address: 1100 Longdong Avenue, Pudong District, Shanghai
Contact：cn.privacy@roche.com

Roche Diagnostics (Shanghai) Limited

Address：8/F, Building E1, No.1, Lane 1358, Yaolong Road, Pudong New District, ShanghaiContact：China.Dia_privacy@roche.com

Roche Diagnostics (Suzhou) Limited

Address：No.259, Zhongyuan Road, Suzhou Industrial Park, Suzhou City, Jiangsu Province
Contact：China.Dia_privacy@roche.com

1. Definition

The following terms used in this Policy shall have the meanings as set forth below:：

1.1. Personal Information refers to all kinds of information related to identified or identifiable natural persons recorded by electronic or other means, excluding the information processed anonymously

1.2. Sensitive Personal Information refers to the personal information that is likely to result in damage to the personal dignity of any natural person or damage to his or her personal or property safety once disclosed or illegally used, including such information as biometric identification, religious belief, specific identity, medical health, financial account and whereabouts and tracks, as well as the personal information of minors under the age of 14.

1.3. Personal Information Processing includes the collection, storage, use, processing, transfer, provision, disclosure and erasure of Personal Information.

1.4. Affiliates refer to any domestic or foreign entity that currently or in the future controls, is controlled by or is under common control with Roche. For the affiliates list, please refer to https://www.roche.com/about/business/roche_worldwide.htm

2. How Roche Collect and Use Your Personal Information

In order to establish employment relationship with candidates and manage work and employee benefits, Roche will collect the following personal information from you. Specifically:

2.1. When you participate in our recruitment and candidate evaluation, we will collect your Personal Information, so that we are able to evaluate whether you are qualified for the job. To enhance recruitment efficiency and accuracy, we may utilize Artificial Intelligence (AI) tools and technologies for recruitment-related activities such as candidate outreach and communication, resume parsing and information extraction, preliminary screening and job matching, tagging and talent pool management, and interview assessment. Results generated by AI serve solely as supplementary references. All AI-assisted recruitment processes will undergo manual review and confirmation, and final hiring decisions will always be made by human personnel. Your résumé, contact information (including phone number, email address), work experience and education background, and other personal information that you submit or that you authorize us to collect indirectly from third parties.

2.2. When you have passed the recruitment and are ready to enter an employment relationship with Roche, we will collect your Personal Information, so that we could conduct background investigation against you and/or complete the recruitment process and establish a formal employment relationship between you and Roche. Your basic personal details (including name, gender, birthday, location, nationality, profile photo, phone number, email address marital status, personal address); your personal identity information (including your ID card number, Passport number, marriage certificate); emergency contact person; personal property information like bank account; criminal records; we will review your personal credit report as well as salary certificate, both what Roche will not retain; your personal biometric information like facial recognition features; your education information like educational background, academic degrees, work experience, your work performance and comment, your social insurance information (the city where the insurance premium is paid and the place of household registration), your employment separation certificate, and proof of academic record for internship. 

Your physiological and health information, such as your health check report will be required as needed for some job positions; other Personal Information required for offering you an offer or entering into a labor contract.

2.3. When you become a formal employee of Roche and work at Roche, we will collect your Personal Information, so that we conduct daily human resources management. This includes: Your attendance records and web browsing records; your education and work information (including internal position experience, salary, performance, training records and results); your emergency contact information and your close relatives information, containing your spouse and your children's name, gender, birthday, nationality, relation to employee, phone number, ID card number, etc.
Evidencing documents for your leave application, such as evidencing documents of your marriage leave, maternity leave, prenatal check-up leave, paternity leave, parental leave, injury leave, bereavement leave. Sick leave may include sick leave slip and/or equivalent evidencing documents.

2.4. When you become a formal employee of Roche and work at Roche, we may collect your Personal Information, so that we could assign you with Roche working account and grant you the access to office site of Roche. For the purpose of maintaining public safety, we may install cameras in open public areas. This includes: Your name, your ID card number; your phone number or your facial recognition features;your video information in open public areas.


2.5. During your employment with Roche, when you recommend candidates to Roche through internal referral program, we will collect your Personal Information, so that we manage your internal referral records. This includes: Your corporate email address and employee ID.

2.6. During your employment with Roche, we will collect your Personal Information, so that we could conduct employees (and their family) financial services and benefits management (including, without limitation payment, credit card processing, purchase of insurance, delivering employee benefits and employee-caring products). This includes: Your ID card number/passport number, your name, your birth date, you phone number, your bank account; Information about your family members, including the name, gender, ID card number, marriage certificate and birth certificate of your spouse, parents, child; Your address.

2.7. During your employment with Roche, if you or your family members participate in any employee activities organized by Roche (including, without limitation, annual meeting of Roche or your department, other group meeting or activities), we may collect Personal Information of you and your family members. Depending on the specific type of activities you participate in, the Personal Information we will collect may include personal health information, ID card number/passport number, personal portrait, whereabouts, name, gender, date of birth, phone number, WeChat ID.

2.8. During your employment with Roche, if you participate in shooting of promotional videos or other audiovisual materials of Roche or your department, we may collect your Personal Information. Depending on the shooting script, the Personal Information we may collect include your personal portrait, your name and position.

2.9. During your employment with Roche, we will collect your personal information for internal investigation purpose in case you are involved in cases regarding potential violation of policies and compliance requirements. Depending on the investigation requirement, we will collect your Personal Information which may include any information in your work equipment (e.g. company laptop, iPad and cellphone) and work account. To the reasonable extent permitted by applicable laws and regulations and reasonably required by the investigation, we may also request you to provide other personal information.

2.10. For continuously improving human resource management in Roche, we will anonymously or aggregately analyze part of your Personal Information to conduct data analysis. Your basic personal information (including birthdays, education background and work experience), and your work-related information generated within Roche (including interview assessments, project and work experience, salary, job performance, training record and results).

2.11. During your employment with Roche, in order to obtain or complete any license, registration, record-filing, declaration and certification that is required under applicable statutory laws or necessary for the business operations, we may collect your Personal Information in accordance with the laws if your job duties are relevant in this aspect. Depending on the requirements under laws and regulations, we may collect your name, gender, age, contact information (your phone number and email address), ID card number; your education level, your department, your job title/position, your major, your graduation time, years of services at a specific position.

2.12. During your employment with Roche, we will collect your Personal Information pursuant to requirements of applicable Chinese governmental authorities, in order to report to the applicable governmental authorities. Depending on the specific requirements of applicable governmental authorities, we may collect your political affiliation, race, and Hukou information (including your Hukou type, and information in relation to place of Hukou).

2.13. During your employment with Roche, we may collect your Personal Information, so that we could provide IT devices to you, improve your interaction experience, repair device issues , conduct performance assessments on the devices and ensure that work-related use of equipment and data complies with Roche company policies,. Your name, you position, corporate device information and data generated when you use workplace devices or company systems through your User ID (such as IP address, UID, device ID, behavioral data when using devices and systems).

2.14. If an accident occurs during your employment at Roche, we may collect your personal information during the accident investigation for purposes such as accident handling and work injury assessment. Depending on specific laws and regulations, we may collect: your hospital medical records, test reports, etc.

**Special Notes：

We will, based on the rules and regulations lawfully formulated by Roche, the necessity of human resources management and the corresponding legal basis for processing personal information, collect and use your personal information only for the purposes as stated above. In particular:

Among the Personal Information above, ID card/passport number, bank account information, credit report and other Sensitive Personal Information are necessary for entering into an employment contract; the health check report is to fulfill the safety requirement for certain positions, which is required for Roche to comply with the law. If you reject our collection, establishing an employment relationship between you and Roche may be affected.

Among the close relative information above, your family members’ ID card number, marriage certificate, birth certificate, and other sensitive information are necessary for entering into a commercial insurance contract to which you are a party. If you reject our collection, Roche may not be able to provide you with commercial insurance and other employee benefits. Please make sure that you have obtained the valid consent of their own or guardian when you provide us with the information of emergency contacts or close relatives.

3. How We Share or Provide Your Personal Information to Third Parties

In order to provide you with better financial service, benefits and other services, please note that we may share your Personal Information with authorized Affiliates, agents, suppliers or partners, including banks, physical examination institutions, commercial insurance companies and other third party service providers, so that they can provide relevant financial service, benefits and other services to you on behalf of Roche.

In addition, we may engage one or more service providers for services including but not limited to data storage and analysis services. In providing the services, these service providers may be entrusted to access and process your Personal Information. We will enter into agreements with these service providers, requiring them to comply with the applicable laws and regulations and adopt reasonable and practical measures to protect your Personal Information.


In addition, in order to obtain approval, license and complete registration and record-filing that are necessary for the operation of business, or in order to comply with other regulatory requirements of supervising authorities, or in order to comply with other statutory requirements under laws and regulations, we will provide your information to governmental authorities or its designated third parties to the extent permitted by laws.


4. How Your Personal Information is Transferred Globally

As a multinational company, in order to manage human resource in a unified manner, Roche will transfer part of employee’s and candidates’ Personal Information to F.Hoffmann-La Roche Ltd (“Data Receiver”), Grenzacherstrasse 124, 4058 BaselGrenzacherstrasse 124, CH-4070 Basel, Switzerland，, our overseas headquarter located on Basel, Switzerland, via intra-group system private line for further processing and analyzing. You may contact the overseas recipient via global.privacy@roche.com to exercise your rights in connection with Personal Information (subject to local laws and regulations, including without limitation to access, copy, correct and delete your Personal Information). Specifically:


4.1. After you submit your resume to us as a candidate, in order to match the suitable position for you on a global scale, we may transfer your resume, including your basic information (including your name, gender, location), contact details (including your phone numbers, email address), personal education and work information (including your level of education, degree, education experience, position, employers, working experience, résumé), to the above-mentioned overseas Affiliate.

4.2. When you enter into an employment contract and establish an employment relationship with us, in order to maintain a shared  global talent pool and centralized management of data, we will provide the above-mentioned overseas Affiliate with your basic personal information (including your name, gender, date of birth, nationality, profile picture, phone numbers, marital status, email address, personal address), personal identity information (including your ID card numbers, passport numbers, marriage certificate), emergency contact person, educational and work information (including your proof of academic record for internship, education degree, working experience, internal position experience, salary, performance, training records and results, attendance records), personal property information (bank account).

4.3. During your work at Roche, to facilitate the unified processing of HR information, we may transfer your Personal Information in relation to the job evaluation, leave management and benefits distribution, including your performance, training records and results, attendance records, personal health information, health check report, as well as marital status and evidencing documents for marriage leave, maternity leave, prenatal check-up leave, paternity leave, parental leave, injury leave, bereavement leave. Sick leave may include sick leave slip and/or equivalent evidencing documents to the above-mentioned overseas Affiliate.

4.4. During your work at Roche, if you have participated in Roche’s employee stock purchase programme and purchased Roche’s stock, in order for us to set up your personal account at SIX Swiss Exchange for you, we will transfer your personal address and phone number to the above-mentioned overseas Affiliate.

4.5. During your work at Roche, to unify the provision and distribution of family benefits, and contact your family members in the occurrence of emergency, we may transfer the basic personal information (including name, gender, date of birth, nationality, relation to employee, phone number) and personal identity information (including ID card number) of your family members (including your spouse and children), to the above-mentioned overseas Affiliate.

As required by the applicable laws, Roche will, prior to cross-border transfer of your Personal Information, obtain your separate consent and enter into a contract with the overseas Affiliates in the standard form prepared by the national cyberspace authority to specify the rights and obligations of the parties. Roche will take necessary measures to ensure that the overseas recipient provides the same level of protection in processing the Personal Information.


5. Exceptions of Consent

As required by the applicable laws and regulations, Roche may share, transfer or disclose to the public your Personal Information without your prior consent if:

5.1. It is related to Roche’s fulfilment of obligations under the laws and regulations;

5.2. It is necessary for Roche’s conclusion or performance of a contract to which you are a contracting party or for conducting human resource management under the labor rules and regulations developed in accordance with the law and a collective contract signed in accordance with the law;

5.3. It is necessary for Roche to respond to public health emergencies or protect the life, health or property safety of natural persons under emergency circumstances;

5.4. Such Personal Information is processed by Roche within a reasonable scope to conduct news reporting, public opinion-based supervision, or other activities in the public interest;

5.5. Such Personal Information that has been disclosed by yourself or other Personal Information that has been legally disclosed is processed by Roche within a reasonable scope in accordance with the law;

5.6. Any other circumstances as provided by any law or administrative regulation.

6. Storage Period and Protective Measures

Roche will retain your Personal Information for such a minimum period as is necessary to achieve the purpose of processing. Specifically, if you are a candidate, your Personal Information will be retained for up to three years after the termination or completion of recruitment process; if you are an employee, your Personal Information (including Personal Information about your family members that you provided to Roche) will be retained for up to ten years after the termination of employment relationship between you and Roche, or of your services to Roche (as applicable), unless (1) otherwise stated by the law or regulations, (2) otherwise agreed by relevant agreements, (3) you withdraw your consent or request to delete your Personal information, or (4) (only applicable to candidates) Personal Information is needed to be retained in accordance with Roche or Data Receiver’s legal status.

We and our service providers will adopt adequate technical and management measures in accordance with industrials' practices to prevent unauthorized access to as well as the leakage, tampering or loss of Personal Information.

Upon the expiry of retention period, we will delete your Personal Information or anonymized your Personal information.

7. How to Exercise Your Rights Regarding Personal Information

You have the following rights with respect to our processing of your Personal Information

7.1. Right to access, correction, portability and erasure:

If you have any questions or concern about how Roche will process your Personal Information; if you would like to have access to, rectify, take a copy or suspend the use of or delete your Personal Information, please contact us via the contact channels as shown in the above chart. However, please note, in accordance with applicable data protection laws or other laws and regulations, our processing of certain Personal Information might not be subject to your requests in such kinds.

7.2. Right to restrict or refuse the processing of Personal Information, right to withdraw your consent:

You have the right to restrict or refuse our processing of your Personal Information, please note however, if you restrict, refuse our use of your Personal information or withdraw your consent, the employment relationship between Roche and you might be affected. For example, we might not be able to pay your remuneration. In such instances, please contact us via the contact channels as shown in the above chart.

If you wish us to explain the personal information process rules in more details, you may also contact us via the methods indicated above.

8. How This Policy is Updated

We may update this Policy from time to time to meet the legal, technical and commercial changes. When we update this Policy, we will inform you in an appropriate way according to the importance of these changes. We will obtain your consent when making any major changes to this Policy according to the requirements of applicable personal information protection laws.

You can find out the updated time through "Last updated in" indicated at the top of this Policy.

9. Governing Law and Interpretation

The effectiveness, performance and interpretation of, and the resolution of disputes arising from, this Policy shall be governed by the laws of the People’s Republic of China.