1. Introduction

EPAM Systems, Inc. (“EPAM”) has set up the EPAM EthicsLine to enable you to raise questions about or report any suspected violations of EPAM’s Code of Ethical Conduct, its policies, or laws and regulations (an "EthicsLine Report").

The purpose of this Data Privacy Notice is to inform you about the collection, processing and use of personal information related to EthicsLine Reports. We process this personal information in order to comply with our legal obligations to detect wrongdoing in the workplace and/or because it is in our legitimate interest to do so.

EPAM runs both the EthicsLine online portal and a phone system, and has implemented controls to limit distribution and provide for confidentiality and anonymity as far as appropriate, while at the same time weighing those interests against relevant laws and the need to conduct a fair, complete and compliant review.

When you submit an EthicsLine Report via the EthicsLine it will be automatically routed to EPAM’s Chief Compliance Officer located in the United States, including any personal information contained within it. EPAM will make every reasonable effort to keep reported information confidential and communicated on a need-to-know basis only to those with a legitimate business or legal need.

EPAM will not discipline, discriminate, retaliate or tolerate retaliation against a person because he or she submitted an EthicsLine Report which turns out to lack merit, provided it was made honestly and in good faith.

2. How to Make a Report, Scope and Anonymous Reporting

Scope: The EthicsLine should be used to raise questions about or report suspected violations of obligations under EPAM’s Code of Conduct, its policies or applicable laws and regulations. 

You may file an EthicsLine Report in two different ways:

1. By using the online portal at https://ethics.epam.com; or
2. By calling the published phone number listed on the online portal above, where you can speak to an EPAM call center representative who has agreed to the parameters of confidentiality and anonymity described above, and who will create an intake report of your concern on your behalf.

Subject to applicable law, you may submit your report anonymously. If you choose to remain anonymous, EPAM's investigation may be hindered, and we may not be able to fully address your concerns. For these reasons, EPAM encourages but does not require you to identify yourself when making an EthicsLine Report. Please note that individuals named in your report may have a right under law to be informed about the fact that a report has been made. Such individuals will also have the right to respond to or correct certain information that is reported, if it is incorrect. Your identity and personal data will at all times be treated as confidential, and shared carefully only with those who have a legitimate business or legal need to know.

For reports that fall outside the permissible scope of matters that may be reported through a hotline in a particular geography, please use in-person channels instead to raise your concerns, which are listed in EPAM’s Code of Ethical Conduct. 

3. Personal Information Collected

The personal information that we will process related to EthicsLine will be personal information that is either provided by you or someone else as a result of an EthicsLine Report, which relates to any individuals referred to in the EthicsLine Report or identified during an  investigation such as your supervisor, authorized persons involved in the investigation, public authorities, or other public resources. The types of personal information may include contact details (e.g. name, postal address, email address, and telephone number), job function and location, details about the matter, contact information for individuals involved in the matter  and any witnesses, any pseudonynms or aliases and any photographs, videos, comments, and other content relating to an individual which you submit or is included in your EthicsLine Report.

EPAM will collect, process, and use personal information in connection with the EthicsLine to consider the need for and nature of any review, to investigate your EthicsLine Report, and to take appropriate measures. 

4. Record Management – Retention Period

Our standard retention period for Hotline reports follows our personnel records retention period of 6 years or greater where indicated by law, however your personal information is stored by EPAM strictly to the extent necessary for the reasons set out in this notice and only for the time necessary to achieve the purposes for which the information is collected, in accordance with applicable law (we could hold such information for a longer or shorter period, depending on the circumstances of the matter). When EPAM no longer needs to use your personal information or does not need to retain it for compliance with any legal or regulatory purpose (in compliance with our data retention policies), we will take reasonable steps to remove it from our systems and/or records and/or take steps to properly anonymize it so that you can no longer be identified from it.

5. Data Transfers, Security and Disclosures

All personal information that you submit via the EthicsLine will be collected and stored on servers hosted under the direction of EPAM in the Netherlands and the United States.

In addition to the receipt and processing of such personal data by EPAM, personal information may be transferred to departments, subsidiaries or affiliates of EPAM located outside of the territory in which you are located, such as to the United States or other territories outside the European Economic Area. As part of EPAM’s global structure, personal information may be transferred to managers or certain regional or global departments in EPAM outside of the territory in which you are located, such as the United States or other territories outside the European Economic Area. Personal data may also be made available to outside law firms or consultants for assistance with certain aspects of an investigation, and to law enforcement agencies as required or appropriate in connection with an investigation into an EthicsLine Report or subsequent measures following such an investigation. EPAM has put in place appropriate safeguards for the global transfer of personal data, including implementing agreements incorporating the Standard Contractual Clauses, with EPAM group companies and third parties. These agreements require recipients of personal information to provide adequate privacy and security protections for personal information.

In addition, EPAM has put in place other appropriate security mechanisms to ensure that your personal information is adequately protected.

6. Questions and Contact Information

If you have any questions about the EthicsLine or the personal information held about you, please contact us at confidential@epam.com.

This Notice supplements our other privacy notices and policies, including our Privacy Policy, where you can find more information about our privacy practices and more information about your rights.

Where applicable, the controller of your information is EPAM Systems, Inc.

This Notice was last updated on August 30, 2022.