EPAM EthicsLine Data Privacy Notice

EPAM Systems, Inc. has set up the EPAM EthicsLine to enable you to report any suspected violations of EPAM’s Code of Ethical Conduct, its policies, or laws and regulations (an "EthicsLine Report").

The purpose of this Data Privacy Notice is to inform you about the collection, processing and use of personal information related to Ethicsline Reports.  We process this personal information in order to comply with our legal obligations to detect wrongdoing in the workplace and/or because it is in our legitimate interest to do so.

EPAM has engaged Convercent, Inc., a premier global compliance and ethics software provider, to run the EthicsLine online portal and phone system. 

When you submit an EthicsLine Report via the EthicsLine it will be automatically routed to EPAM’s Chief Compliance Officer located in the United States, including any personal information contained within it.  EPAM and Convercent will make every reasonable effort to keep reported information confidential and communicated on a need-to-know basis only to those with a legitimate business or legal need.

EPAM will not discipline, discriminate, retaliate or tolerate retaliation against a person because he or she submitted an EthicsLine Report which turns out to lack merit, provided it was made honestly and in good faith.

Scope: The EthicsLine should be used to report suspected violations of obligations under EPAM’s Code of Conduct, its policies or applicable laws and regulations. 

You may file an EthicsLine Report in two different ways:

1. By using the online portal at https://ethics.epam.com; or
2. By calling the phone number that has been set up for your region, where you can speak to an individual who specializes in receiving reports, who will create an EthicsLine Report on your behalf (phone numbers may be found at the online portal link above).

Subject to applicable law, you may submit your report anonymously. If you choose to remain anonymous, EPAM's investigation may be hindered, and we may not be able to fully address your concerns.  For these reasons, EPAM encourages but does not require you to identify yourself when making an EthicsLine Report. Please note that individuals named in your report may have a right under law to be informed about the fact that a report has been made. Such individuals will also have the right to respond to or correct certain information that is reported, if it is incorrect. Your identity and personal data will at all times be treated as confidential, and shared carefully only with those who have a legitimate business or legal need to know.

For reports that fall outside the permissible scope of matters that may be reported through a hotline in a particular geography, please use in-person channels instead to raise your concerns. ¹

The personal information that we will process related to EthicsLine will be personal information that is either provided by you or someone else as a result of an EthicsLine Report, which relates to any individuals referred to in the EthicsLine Report or identified during the investigation such as your supervisor, authorized persons involved in the investigation, public authorities, or other public resources. The types of personal information may include contact details (e.g. name, postal address, email address, and telephone number), job function and location, details about the incident, contact information for individuals involved in the incident and any witnesses, any pseudonynms or aliases and any photographs, videos, comments, and other content relating to an individual which you submit or is included in your EthicsLine Report.

EPAM will collect, process, and use personal information in connection with the EthicsLine to investigate your EthicsLine Report and to take appropriate measures. 

Your personal information is stored by EPAM and/or Convercent strictly to the extent necessary for the reasons set out in this notice and only for the time necessary to achieve the purposes for which the information is collected, in accordance with applicable law. When EPAM no longer needs to use your personal information or does not need to retain it for compliance with any legal or regulatory purpose (in compliance with our data retention policies), we will take reasonable steps to remove it from our systems and/or records and/or take steps to properly anonymize it so that you can no longer be identified from it.

All personal information that you submit via the EthicsLine will be collected and stored on servers hosted by Convercent, in Dublin (Republic of Ireland) and Frankfurt Germany.  Convercent’s headquarters is at 5995 Greenwood Plaza Blvd, Suite 110, Greenwood Village, CO 80111, United States.  

In addition to the receipt and processing of such personal data by Convercent, personal information may be transferred to departments, subsidiaries or affiliates of EPAM located outside of the territory in which you are located, such as to the United States or other territories outside the European Economic Area. As part of EPAM’s global structure, personal information may be transferred to managers or certain regional or global departments in EPAM outside of the territory in which you are located, such as the United States or other territories outside the European Economic Area. Personal data may also be made available to outside law firms or consultants for assistance with certain aspects of an investigation, and to law enforcement agencies as required or appropriate in connection with an investigation into an EthicsLine Report or subsequent measures following such an investigation. EPAM requires recipients of personal information by contract or other safeguards to provide suitable privacy and security protections for personal information.

Convercent adheres to the privacy principles of the Privacy Shield program and more details can be found at the Privacy Shield List.

In addition, EPAM has put in place other appropriate security mechanisms to ensure that your personal information is adequately protected.

If you have any questions about the EthicsLine or the personal information held about you, please contact us at confidential@epam.com.

This Notice was last updated on 2/5/18.

[1] At present, the geographies where EPAM does business permit individuals to raise any, serious potential code of conduct violations.