General Privacy Notice

Purpose of the Privacy Statement.
Bristol Myers Squibb respects your concerns about privacy and values the relationship we have with you. This privacy policy describes the types of personal information we collect through our Careers Site, any of its sub-domains and/or directories, its applications and functionalities and all the related information or communications including e-mails (the "Site"), how we may use that information and with whom we may share it. Our privacy policy also describes the measures we take to protect the security of the personal information. We also tell you how you can reach us to answer any questions you may have about our privacy and cookies practices.

Your access to and use of this Site is subject to this privacy and cookies policy, the Terms of Use and all applicable laws and regulations. All users must carefully read this privacy policy. In case you do not agree with any of these terms and conditions, please do not access the Site and/or do not provide us with the relevant personal information.

Before accessing and browsing the Site, we encourage you to fully read and understand this privacy policy.

How Does this Privacy Policy Define "Personal Information"?
The term "personal information" as used throughout this privacy policy, applies to any information or set of information that relates to an individual who can be identified, directly or indirectly. We will process your personal information in accordance with this privacy policy or otherwise will inform you or request your consent as may be required by the applicable laws.

Information We Collect and How We Use It.
A. Personal Information You Provide.

Some areas of the Site may require you to submit information in order for us to respond to your request or for you to have access to specific areas, contents, functionalities or participate in a particular activity. Some of the information that you submit to us may be personal information. If you decide to apply for one of the jobs listed on the Site, you will be required to submit personal information so that you may access the job application functionalities of the Site and so that we may review and respond to your application.

You may always choose not to provide the requested information, but you then may not be able to participate in the particular activity that requires such information or have access to the particular content, area or functionality. If you do not provide us with certain personal information, you will not be able to complete and submit job applications via the Site. We will not use personal information that you provide to us in a manner inconsistent with the purposes for which we collected it, as set out below. Here are the ways you may be requested to provide personal information, the types of personal information you may submit, and how we may use the information.

• Recruitment Purposes
  If you use the job search and application functions of our Site, we may ask you to provide personal information for our recruitment purposes, in order to contact you about opportunities with Bristol Myers Squibb and to assess your suitability for a role with us. Such information may include your name, contact details, employment and education history, references and other information about you that could be deemed sensitive personal information (e.g., race, ethnicity, political opinions, religious or philosophical beliefs, trade union membership, health-related data or data relating to your sexual orientation), to the extent necessary or allowed by applicable law.
• Other Uses of Information
  We may use the personal information you provide through the Site for our internal purposes. These purposes include administration of Site, data analytics and compliance with our legal obligations, policies and procedures.

B. Personal Information from Public or Third-party Information Sources.
From time to time we may supplement your personally identifiable information with information we obtain from third party sources in order to verify your information and/or to provide you with more tailored information, communications or products/and or services.

Verification covers the process of checking that details supplied by individuals are accurate and complete. Please be aware that our recruitment process includes a verification process for such things as your contact information, identity, professional status, employment references, academic qualifications, right to work, financial searches, as well as criminal disclosure checks. This information will be verified by our vendors that specialise in background checks.

C. Cookies.
We may store some information on your computer using a technique your browser supports called "cookies". The cookies are used for a variety of purposes, including but not limited to: helping you login (e.g., remembering your user name if you register or login); remembering some of your customised user preferences; helping us better understand how people use our Site; and to helping us improve our Site. In some cases, this information will help us tailor content to your interests or help us avoid asking for the same information when you revisit our Site. With respect to collecting traffic data, we may use third parties to collect such data on our behalf. To disable or limit the use of cookies, please refer to the options provided by your Internet browser. If you do so, however, some pages on this Site may not work properly.

D. Web Beacons.
A Web Beacon is a clear GIF (Graphics Interchange Format) image or pixel tag that companies place on their Web sites to allow an audience measurement company to help them analyse the general usage patterns of visitors to their Web sites. Bristol Myers Squibb uses Web beacons on some of its Web sites. Subject to the transfer of control described below, Bristol-Myers Squibb will not sell or rent your personally identifiable information.

E. Web Server Logging and IP Addresses.
An IP address is a unique identifier that certain electronic devices use to identify and communicate with each other on the internet. When you visit our Sites, we receive information regarding the IP address of the device you use to connect to the Internet.

If you consent to the use of analytics cookies through the Site’s cookie banner, then this Web site will use Google Analytics, a web analytics service provided by Google Ireland Limited, based in Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). This service uses “cookies” to help the Web site analyze how you use the site and compile reports on Web site activity, which are used to analyze the performance of our Web Site and subsequently improve it, to enable social share, and for security (as further explained here). The information generated by the cookie about your use of the Web site will be transmitted to and stored by this service on their servers in the United States. The service will use this information for the purpose of evaluating your use of the Web site, compiling reports on Web site activity for Web site operators and providing other services relating to Web site activity and internet usage. Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google’s behalf. Google will not associate your IP address with any other data held by Google. We use the “anonymizeIP” function which requires Google to abbreviate your IP address and to only transmit this abbreviated IP address to the US. Some of these cookies set for this purpose are automatically removed from your device once you close your browser. Others may last for a period of up to 48 months from your last visit to our site. You may refuse the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full functionality of this Site. To learn more about how Google processes your information and what choices Google may offer, visit here.

With or without cookies, our Site keeps track of usage data, such as the source address that a page request is coming from (i.e., your IP address, domain name, date and time of the page request, the referring Web site (if any), and other parameters in the URL (e.g., search criteria)). We use web server data and other technologies to better understand Web site usage on the whole and to determine which areas of our Site users prefer (e.g., based on the number of visits to those areas). This information is stored and used by Bristol Myers Squibb for statistical reporting.

Our Legal Grounds to Use and Process Your Personal Information.
Our legal grounds to use and process personal information about you include that the processing is necessary for:

• The operation of the Site and the provision of the Site’s features, content, tools, services or activities;
• Bristol Myers Squibb’s legitimate interests to establish and manage our employment relationship with you and for related functions including for human resource and administrative purposes, such as recruitment and record maintenance;
• The performance of employment and services contracts, including human resource administration and payroll; and
• The purposes of carrying out the obligations and exercising rights under applicable employment laws and regulations.

Information We Share.
At all times, personal information is treated confidentially and in accordance with applicable laws. If necessary for the purposes described in this privacy policy, we may also share your personal information among Bristol-Myers Squibb related entities and with people and companies with whom Bristol-Myers Squibb work, such as service providers, recruitment partners and regulatory and enforcement bodies.

A. Service Providers.
We may share information with service providers for them to perform data processing services on our behalf and/or for internet-based delivery purposes, in compliance with the applicable laws (for example, to process online registration forms for events or to administer our blogs). These service providers are not authorised by us to use or disclose the information except as necessary to perform services on our behalf or to comply with legal requirements.

B. Recruitment Partners.
Personal information collected in our recruitment process will be made available to our outsourced recruitment partners in the European Union, hosted in the United States by Workday or iCIMS and processed by our data processors Workday and iCIMS outside of the European Union. Additionally only Bristol-Myers Squibb personnel responsible for managing the particular job to which you have applied will have access to your personal information. This may require us to share your personal information with appropriate Bristol-Myers Squibb affiliates in or out of the European Economic Area (EEA), for the purposes of making a recruitment decision, recruitment policy, equal opportunities monitoring and selection. We will disclose your data only where necessary for legitimate business purposes (e.g., for human resource and administrative purposes relating to our recruitment and employment processes) and such disclosures will be carried out in accordance with applicable data protection laws.

C. Law Enforcement.
In rare situations, we may be required by court order or other legal or regulatory process, or as otherwise required by law, to divulge personally identifiable information to law enforcement authorities, the courts, or regulatory authorities. We may also be required to make such disclosure when we believe disclosure is necessary or appropriate to prevent physical harm or financial loss or in connection with an investigation of suspected or actual illegal activity. Bristol-Myers Squibb will cooperate in responding to such requests, in accordance with the regulatory or legal process, and will take appropriate measures to ensure that the requester understands the sensitive nature of any health-related personally identifiable information they receive.

D. Sale or Transfer of Business.
We reserve the right to share, sell, transfer, license or otherwise make available any information we have about you in the event of a sale, divestiture, merger, acquisition, or other means of transfer of all or a portion of our business or assets and in accordance to the requirements provided for in the applicable laws. Should such a sale or transfer occur, we will use reasonable efforts to try to require that the transferee uses the personal information you have provided through this Site in a manner that is consistent with this privacy policy.

E. International Data Transfer.
The above-listed people, companies and agencies may be located in your country, other countries of the European Economic Area (EEA), the United States, and other countries that are outside of the EEA. Some non-EEA countries may not offer the same level of privacy protection as you are used to in your country. However, Bristol-Myers Squibb will keep any personal information it receives as confidential as possible within the limits of the law. Bristol-Myers Squibb will implement appropriate contractual measures (including model contractual clauses and our binding corporate rules (BCRs)) to ensure that the relevant Bristol-Myers Squibb entities and third parties outside the EEA provide an adequate level of protection to your personal information as set out in this privacy policy, as required by applicable law. Should you wish to obtain copies of our model clauses or binding corporate rules, please contact us using the details below.

Links to Other Sites.
Occasionally we provide links to other Web sites for your convenience and information. These Web sites operate independently from our Site and are not under our control. These Web sites may have their own privacy notices or terms of use, which we strongly suggest you review if you visit any linked Web sites. We are not responsible for the content of these Web sites, any products or services that may be offered through these Web sites, or any use of the linked Web sites. Please refer to the Terms of Use for further information on this topic.

How We Protect Personal Information.
We maintain administrative, technical and physical safeguards for the Site designed to protect against loss, misuse or unauthorised access, disclosure, alteration or destruction of the personal information we collect through our Site, in accordance with the applicable laws.

Storage of Your Personal Information.
We will only hold your personal information for as long as it is necessary to fulfill the above-stated purposes or to comply with any legal obligation. When your personal information is no longer necessary for these purposes, the personal information will be securely deleted. This may mean that your personal information is stored by Bristol-Myers Squibb for a number of years, depending on the purpose and need for that data to be processed.

Modification of Privacy Policy.
To the extent allowed by applicable laws, Bristol-Myers Squibb may, at any time, revise the terms and conditions of this privacy policy governing use of the Site. If any terms and conditions contained in this privacy policy are changed, the amended policy will be posted on the Site. You are bound by any such revisions and should, therefore, periodically review these terms and conditions.

Your Rights.
You are entitled to request access to, rectification or erasure of personal information relating to you or restriction of processing or to object to certain types of processing of such information or to data portability and other rights, such as a right to erasure of your information, in certain circumstances in accordance with applicable law. Bristol-Myers Squibb may refuse to provide such information in limited circumstances under applicable local law.

If, having considered the personal information we hold about you, you find that it is inaccurate or you otherwise have any concerns, you may request that your information be amended, erased or restricted in accordance with applicable requirements.

You may exercise these rights at any time by contacting us by writing to us at:
Attn.: c/o Data Protection Officer
Bristol-Myers Squibb
Plaza 254
Blanchardstown Corporate Park 2
Ballycoolin, Dublin 15
Ireland
EUDPO@bms.com.

In addition, Bristol-Myers Squibb is committed to assigning a data protection officer who will be responsible for overseeing our compliance with the new EU data protection regime under the General Data Protection Regulation. Our Data Protection Officer may be contacted in case of any questions or concerns regarding the processing of your personal information. If you would like more information on GDPR and BMS’ EU Office of the Data Protection Officer (DPO), which provides oversight for data protection and compliance to the GDPR, please email EUDPO@bms.com.

If Bristol-Myers Squibb’s processing of your personal information is covered by EU law you may also lodge a complaint with the corresponding data protection supervisory authority in your country of residence. You can find the relevant supervisory authority name and contact details under http://ec.europa.eu/justice/data-protection/bodies/authorities/index_en.htm.

Version date: August 2020