1. PURPOSE AND SCOPE
This PRC Privacy Policy (in addition to EPAM’s global Privacy Policy available at https://www.epam.com/privacy-policy) describes EPAM’s practices regarding the collection, storage, use, processing, transmission, provision, disclosure, and deletion (collectively referred to as “Processing” or “Process” or “Processed”) of your Personal Information in the PRC and emphasizes EPAM’s commitment to your privacy on EPAM websites and marketing initiatives. In case of inconsistency between the PRC Privacy Policy and the global Privacy Policy, the PRC Privacy Policy shall prevail.
“Personal Information” means any type of information (recorded via electronic means or otherwise) associated with an identified or identifiable natural person, but excludes information that is anonymised.
“PRC” means the mainland People’s Republic of China, excluding Hong Kong SAR, Macau SAR, and Taiwan.
“EPAM”, “us” or “our” refers to the following entities:
- EPAM Systems (Shenzhen) Co., Ltd.
- EPAM Systems (Shenzhen) Co., Ltd. Shanghai Branch
- EPAM Systems (Suzhou) Co., Ltd.
- EPAM Systems (Suzhou) Co., Ltd. Beijing Branch
- EPAM Systems (Suzhou) Co., Ltd. Chengdu Branch
- Guangzhou EPAM Systems. Co., Ltd.
- Suzhou EVelo Technology Co., Ltd.
- EPAM Continuum (Shanghai) Co., Ltd.
2. COMPLIANCE
By using or accessing EPAM websites, you agree to the terms of EPAM’s PRC Privacy Policy. If you wish to stop receiving EPAM marketing materials then please click on the following link to unsubscribe.
3. COLLECTION AND PURPOSES OF PROCESSING OF PERSONAL INFORMATION
EPAM Processes Personal Information to provide better services to its users and to better understand the visitors to its websites and what content is of interest to them. With your consent where required under applicable laws, EPAM collects and Processes Personal Information in the following ways:
- To enable you to access various downloads and view specific content
- EPAM Processes Personal Information you affirmatively choose to submit to us (such as your name, email address, company name, title, country); and Personal Information we have obtained about you from publicly available sources such as social media, marketing platforms or on events you attended. You will receive marketing communications from EPAM if you have requested information from EPAM or you or your employer has purchased services from EPAM. You may not be able to access certain downloads or content if you refuse to provide such Personal Information;
- To subscribe to EPAM newsletters, register for events and edit your preferences in receiving marketing from EPAM and its third party partners and your communication preferences
- EPAM Processes Personal Information you affirmatively choose to submit to us (such as your name, email address, company name, title, country). If you refuse to provide such Personal information, you may not be able to subscribe to our newsletters or register for events.
- To: (a) provide a personalised experience (e.g. language preferences) to you, and to understand your usage patterns; and (b) provide, improve and secure the EPAM websites
- EPAM Processes Personal Information collected from your use of EPAM websites (through the use of cookies in accordance with EPAM’s Cookies Policy), such as the IP address, browser type, ISP, referring/exit pages, platform type, date/time stamp, number of clicks, domain name and country/state of all visitors to EPAM websites and location information when you use EPAM’s websites as EPAM may collect and Process information about your location. EPAM uses various technologies and tools to determine location. EPAM will not be able to provide you with a personalised experience in use of our websites, if you refuse to provide such Personal Information;
- To improve our services
- EPAM may Process aggregated data such as statistical or demographic data. Aggregated data may be derived from your Personal Information; and
- EPAM collects technical data from various third parties and public sources, such as: analytics providers; advertising networks; and/or search information providers.
Please note that under applicable law EPAM may not be required to obtain your consent to Process your Personal Information.
4. SENSITIVE PERSONAL INFORMATIO
For the purposes stated in paragraph 3 above, EPAM may Process your Sensitive Personal Information collected from your use of EPAM websites (through the use of cookies in accordance with EPAM’s Cookies Policy), such as the IP address, browser type, ISP, referring/exit pages, platform type, date/time stamp, number of clicks, domain name and country/state of all visitors to EPAM’s websites.
“Sensitive Personal Information” means Personal Information which, if leaked or used illegally, may easily cause harm to the dignity of a natural person, or harm to personal or property safety, including: biometric information, religious belief, specific identity information, health and medical information, financial account information, individual location tracking information, and Personal Information of minors under the age of fourteen (14). Specifically, EPAM will not collect any information about criminal convictions and offences.
EPAM shall Process such Sensitive Personal Information upon obtaining your separate consent. If it is necessary for EPAM to Process your Sensitive Personal Information so that we can provide certain services to you, we may not be able to provide such services to you if you do not provide us with your separate consent.
5. MINORS’ PERSONAL INFORMATION
EPAM will not Process Personal Information of individuals who are under fourteen (14) years of age. If we are required to do so, we will only do so upon obtaining separate consent from their parents or guardians.
Where we have obtained separate consent from parents or guardians for Processing their minors’ Personal Information, we will only Process, retain and protect those minors’ Personal Information in the same manner and in the same locations as set out in this PRC Privacy Policy. If the parents or guardians refuse to provide separate consent for our Processing of their minors’ Personal Information, we may not be able to provide certain services to their minors. To exercise any data subject rights for minors, please refer to “Your Data Protection Rights” section below.
6. SHARING OF INFORMATION
To facilitate the purposes mentioned in this PRC Privacy Policy, EPAM may disclose your Personal Information to the following categories of recipients who will Process your Personal Information according to their own purposes and methods of Processing (together, “Third Party Personal Information Handlers”). These Third Party Personal Information Handlers may be located within or outside the PRC. We will only transfer and/or disclose such Personal Information to Third Party Personal Information Handlers upon obtaining your separate consent, and in accordance with applicable laws.
In addition, certain third parties may Process your Personal Information for purposes and in accordance with methods of Processing provided by EPAM (“Data Processors”). These Data Processors include our third party service providers which provide data processing services to EPAM (including to support the delivery of, provide functionality on, or help enhance the security of EPAM websites).
You can contact us for information about the third parties who receive Personal Information transferred by us.
When we share your Personal Information with any third parties, we will strive to ensure (including but not limited to using contractual measures or adopting encryption for transfer) that such third parties comply with this PRC Privacy Policy and other appropriate confidentiality and security measures.
7. USE OF INFORMATION
EPAM will only retain your Personal Information for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements. In any event, unless required by applicable laws or with your consent, your Personal Information shall be retained for 3 years from the last day of our interaction with you. After the end of the retention period, we will delete or anonymise your Personal Information.
To determine the appropriate retention period for Personal Information, EPAM considers the amount, nature, and sensitivity of the Personal Information, the potential risk of harm from unauthorised use or disclosure of your Personal Information, the purposes for which EPAM Processes your Personal Information, and whether it can achieve those purposes through other means, and the applicable legal requirements.
8. INTERNATIONAL TRANSFERS
EPAM Processes information on servers located primarily in the PRC, however, with your separate consent, EPAM may also Process your Personal Information in servers located outside the PRC, including Europe, the United States of America and countries where EPAM has offices. These countries may have data protection laws that are different from the laws of the PRC (and, in some cases, may not be as protective). However, EPAM has taken appropriate safeguards to require that your Personal Information will remain protected in accordance with this PRC Privacy Policy (including but not limited to using contractual measures or adopting encryption for transfer).
9. INFORMATION SECURITY
EPAM protects your Personal Information in the same way that it protects its other confidential information, such as storing it on secure servers that only selected EPAM personnel have access to, and by encrypting or de-identifying it to help prevent access by any unauthorised parties. EPAM has also implemented various internal management policies (including physical, electronic and management measures) and various security technologies and procedures based on the classification of Personal Information we collect from you. Your Personal Information will only be accessed by EPAM’s personnel on a “need to know” basis. EPAM also ensure that its personnel are regularly trained on data protection matters. EPAM also has in place a security incident response plan, has put in place procedures to deal with any Personal Information breach, and will notify you and any applicable regulator of a breach when legally required to do so.
10. MARKETING
As explained above, with your consent, EPAM will collect and use your Personal Information for marketing purposes. Your Personal Information will be stored in our CRM system. We will use your Personal Information to inform you about EPAM products and services we think may be of interest or for sending you our newsletters. For statistical purposes, we will collect information about your response to our emails and our interaction with you to make decisions on future marketing. If you wish to stop such collection and use of such information, please click here.
11. LINKS
EPAM websites contain links, plug-ins and applications to various third party websites. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. EPAM has no control over, and is not responsible for the content, privacy policies or reliability of such third party connections. When you leave EPAM’s website, EPAM encourages you to read the privacy notice and privacy policy of every website you visit.
12. YOUR DATA PROTECTION RIGHTS
You (or your next of kin or you acting on behalf of your minors, to the extent permitted by applicable laws) have the following data protection rights which you may be able to exercise by contacting EPAM using the contact details provided under the “Contact Details” heading below and in the right-hand side column:
- If you wish to access, obtain a copy of, correct, update, supplement or request deletion of your Personal Information, you can do so at any time by contacting EPAM. EPAM will respond to these requests to the extent required under applicable laws.
- In addition, you can object to Processing of your Personal Information, ask EPAM to restrict Processing of your Personal Information, or request portability of your Personal Information by contacting EPAM. You may also request us to transfer your Personal Information to another organisation, if such transfer is permitted under applicable laws.
- You have the right to opt-out of marketing communications that EPAM sends you at any time. You can exercise this right by clicking on the “unsubscribe” or “opt-out” link in the marketing emails EPAM sends you or by using the relevant opt-out mechanism for non-email based marketing.
- Similarly, if EPAM has collected and Processes your Personal Information based on your consent, then you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any Processing EPAM conducted prior to your withdrawal, nor will it affect Processing of your Personal Information conducted in reliance on lawful Processing grounds other than consent.
- You have the right to ask EPAM to explain its rules on Processing your Personal Information.
EPAM will endeavour to use appropriate technical means to ensure that you can exercise the above rights by contacting us. In processing your requests relating to your Personal Information, we may ask for you to authenticate your identify in order to protect the safety of your Personal Information.
You will not have to pay a fee to access your Personal Information (or to exercise any of the other rights). However, EPAM may charge a reasonable fee or refuse to comply with your request if your request is clearly unfounded, repetitive, or excessive. EPAM is dedicated to responding to all legitimate requests within the timeline required by applicable laws. Occasionally, it may take longer if your request is particularly complex or you have made a number of requests. In this case, EPAM will notify you and keep you updated.
13. COOKIES
You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies some parts of EPAM websites may become inaccessible or not function properly. For more information about the cookies that EPAM uses, please see EPAM’s Cookie Policy.
14. CHANGES TO THE POLICY
EPAM reserves the right to modify or amend this PRC Privacy Policy at its own discretion from time to time. The changes can be viewed here or elsewhere on EPAM websites. Where required under applicable laws, we shall ask for your consent to those changes.
This version was last updated on 11th March 2024 and historic versions can be obtained by contacting EPAM.
15. CONTACT DETAILS
It is important that the Personal Information EPAM holds about you is accurate and current. Please keep EPAM informed if your Personal Information changes during your relationship with EPAM. Additionally, if you have any questions about this PRC Privacy Policy, the practices of EPAM websites, or your interaction with EPAM via EPAM websites, please contact: