Privacy Policy for the Tempur International Training App ("International Training App")

Last reviewed: 12 September 2022

This policy together with our end-user licence agreement (terms of use) and any additional terms of use incorporated by reference into the terms of use) applies to your use of:

• The International Training App mobile application software once you have downloaded or streamed a copy of the International Training App onto your mobile or handheld device or accessed via our website ("International Training App").
• Any of the services accessible through the International Training App (services).

This Privacy Policy sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us and our authorised partners. This International Training App is not intended for children, and we do not knowingly collect data relating to children.

Please read the following carefully to understand our practices regarding your personal data and how we will treat it.

1. The personal data we collect about you

We will collect and process the following personal data about you:

• Personal data you give us. Personal data (including Identity, contact data, job title and certain employment information) you provide us by filling in forms on the International Training App, entering a competition, survey or promotion or by corresponding with us (for example, by email or phone). It includes personal data you provide when you register to use the International Training App (including your work or personal email address), download the International Training App and when you report a problem with the International Training App or our services. If you contact us, we will keep a record of that correspondence.
• Personal data we collect about you and your device. Each time you use the International Training App and services we will automatically collect personal data including device, content, and usage data. We collect this personal data using cookies and other similar technologies. We work with authorised partners who assist us with this.
• Information we receive from other sources including third parties. We will receive personal data about you from various third parties as set out below:
  • Device data for example received from analytics providers such as Google and Crashlytics based outside the UK; and
  • Identity, contact information and employment information from your employer.

2. How do we use your personal data and our legal basis

Tempur collects, uses, maintains and may share the personal data provided by you or collected by us with our affiliates, parent companies and/or other related companies (such as with authorised members of staff of the company you are employed by) for all purposes necessary to ensure the proper functioning and operation of the user accounts, provision of the International Training App and/or for the proper functioning of the International Training App and the services. These purposes may include (collectively the "Purpose"):

• Creating and managing your user account to use the International Training App and services;
• Providing information and allowing the users access to the International Training App and services;
• Diagnosing technical problems and managing technical support and processing inquiries concerning the International Training App and services;
• Contacting the Users to (i) verify your account (ii) for information and operational purposes such as account management, instructions, alerts, reminders, customer service, system maintenance and others;
• Analysing your data and using and sharing the resulting data to third parties (such as the company that you are employed by);
• The operation, evaluation and improvement of the International Training App and services (including the development of additional products and/or services, enhancing and improving the current International Training App, analysis of our services, quality control activities and performing internal business functions such as accounting and auditing);
• Protecting against, identify and prevent fraud and other unlawful activity, claims and other liabilities;
• Complying with and enforcing any applicable legal obligations;
• In accordance with our Terms and Conditions and Privacy Policy.

We will only use your personal data when the law allows us to do so. Most commonly we will use your personal data in the following circumstances:

• Where you have consented before the processing.
• Where we need to perform a contract, we are about to enter or have entered with you.
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
• Where we need to comply with a legal or regulatory obligation.

Sharing your personal data

We may share your personal data within the Tempur Group to manage and administer group functions, including the provision of our products and services to you. This may involve transferring your personal data outside your jurisdiction. We ensure your personal data is protected by requiring all our group companies to follow the same rules when processing your personal data.

Tempur will access, retain, and disclose personal data in jurisdictions such as UK, Europe, United States, and India (with safeguards in place) in the following events:

• In order to be in compliance with any applicable legislation or regulations;
• If a law enforcement authority or other government official requests;
• In accordance with our Terms and Conditions or Privacy Policy;
• The investigation of any suspected or actual fraudulent or illegal activity; and
• To protect your or our safety and/or rights.

By using the International Training App and services, you acknowledge and explicitly agree that we may disclose certain information to vendors and service providers who help us provide the International Training App and services. Examples of these vendors and service providers include entities that provide technical IT services.

By using the International Training App and services, you acknowledge and explicitly agree that we may disclose certain information to providers that build profiles to improve the diagnostic capabilities of the Application. In addition, the technical processing and transmission of the International Training App and services, including your personal data, may involve (i) transmissions over various networks; and (ii) modifications to conform and adapt to technical requirements of connecting networks, or devices.

By using the International Training App and services, you acknowledge and explicitly agree that we may disclose certain International Training App data (such as your performance in training tests and your usage of the International Training App) to your company on a need-to-know basis.

We may engage with other businesses and individuals to perform certain services and functions on our behalf. This includes the administration and operation of our App, sending mail or email, managing employee lists, analysing data, providing marketing advice and support and distributing surveys and promotions. The service providers we engage will only be provided with the personal data necessary to run its own designated service and may not use the personal information for any other purpose.

To view a list of the key third party service providers that process your personal data, please see the following:

Your personal data will also be shared with government agencies and/or law enforcement agencies and credit reference and fraud prevention agencies if required for the purposes above, if mandated by law or if required for the legal protection of our legitimate interests in compliance with applicable laws.

In the event that the business is sold or integrated with another business, your details will be disclosed to our advisers and any prospective purchaser’s adviser and will be passed to the new owners of the business.

Security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality.

If our physical, technical, or management protection facilities are damaged and we cannot prove that we are not at fault, resulting in unauthorised access, public disclosure, tampering, or destruction of your personal data, thus causing damage to your legitimate rights and interests, we will be held legally responsible. However, considering the characteristics of information technology and cyberspace itself, under certain special circumstances (such as hacker attacks, telecommunications failures and so on), there is still a risk of personal information leakage despite the necessary measures we have taken as stipulated by laws and regulations. Although we are continuously working to enhance and strengthen our security measures to protect your data and personal information from accidents or damage, we cannot always guarantee that your personal information is 100% safe, so please make sure you take offline backup measures.

We have put in place procedures to deal with any suspected personal information breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

We strongly recommend that you do not send your personal information via unencrypted email, instant messages, or other unsecure forms of communication. Please use complex passwords to keep your account secure. Except as otherwise provided in this policy, to protect your personal and property security, we specifically remind you not to provide sensitive information, such as your account password, authentication code, communication content, property information, or physiological information to us or any third-party providing services to you on our behalf, through public networks.

Cookies

We use cookies and/or other tracking technologies to distinguish you from other users of the App, App Site, the distribution platform (Appstore) or Services Sites and to remember your preferences. This helps us to provide you with a good experience when you use the App and also allows us to improve the App. If you would like further information on the cookies we use, please refer to our website www.tempur.com and see the privacy policy for your jurisdiction.

Your rights

Under certain circumstances you have the following rights under data protection laws in relation to your personal data. You have the right to:

• Request access to your personal data. This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
• Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
• Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
• Object to or request restriction of the processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate legal or other grounds to process your information which override your rights and freedoms.
• Request the transfer of your personal data to you or to a third party.
• Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

You can exercise any of these rights at any time by contacting us at the details given below.

You will not have to pay a fee to access your personal data (or to exercise any of the other relevant rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive. Alternatively, we could refuse to comply with your request in these circumstances.

We try to respond to all legitimate requests within fifteen (15) business days (or other period required by applicable laws and regulations). Occasionally it could take us longer than fifteen (15) business days if your request is particularly complex or you have made several requests. In this case, we will notify you in time and keep you updated.

Personal data retention

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting, or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you. We will delete or anonymise your personal data where the processing purpose has been achieved, is impossible to achieve, or where it is no longer necessary to achieve the purpose.

Third Party websites or applications

You acknowledge and agree that certain content or services provided by third parties may be made available to you through the International Training App and the services. You agree that such linked content or services may have their own privacy policies for which Tempur cannot be held responsible. Tempur does not in any way review or endorse the privacy practices of such third parties.

Changes to this privacy policy and your duty to inform us of changes

We keep our policy under regular review. We may need to update the policy from time to time to comply with applicable laws and regulations or other legitimate purposes. We may separately advise you about the change according to laws. Please pay attention to the notices we post and review the contents of our policy periodically to keep abreast of relevant changes. Please understand that your continued use of our product or service after we post the notice of changes constitutes your acceptance of those changes. Historic versions can be obtained by contacting us.

Contact us

Tempur Sealy International Limited is the Data Controller and responsible for your personal data.
If you have any questions about our data protection practices, please contact us at the details below:
Full name: Tempur Sealy International Limited Email address: dataprotection@tempursealy.com Registered office address: First Floor, Charter Building, Charter Place, Uxbridge, UB8 1JG

You also have the right to make a complaint at any time to the relevant supervisory authority for your jurisdiction.