Product Privacy Notice

LAST UPDATED: October 13, 2022


This Privacy Notice explains how Moody’s Analytics, Inc. ("Moody’s", "we", "us", "our"), a Moody’s Corporation company of The Corporation Trust Company, Corporation Trust Center, 1209 Orange Street, Delaware 19801, processes personal data in connection with any Moody’s product that posts or links to this Privacy Notice (the “Product”). "Personal data" means information which identifies, or can be used to identify, living individuals, including, depending on applicable law, sole traders and unincorporated partnerships.

 

1. About the Product


The Product provides ESG assessments on demand to unlisted and private companies. If you/your company completes the ESG assessment, Moody’s will collect and process certain data about you/your company, as further described below.

 

2. Personal Data in the Product


If you/your company choose to fill out the ESG assessment you may provide the following types of data about you/your company:

  • Trading/company name
  • Industry classification code
  • Unique company ID
  • Country
  • Employee size
  • Responses to ESG assessment questionnaire
  • Contact details of the individual completing the questionnaire (name and email address).

3. Sources of Personal Data in the Product


You/your company will provide the information directly. We may also be provided contact details (name and email address) and basic company details (name, unique ID) from our clients which request a Moody’s ESG assessment of your company. We also match basic information about your company (company name, industry classification code, country, employee size, unique ID) from our database Orbis.

 

4. Uses of Personal Data in the Product


  1. ESG assessment: The information you provide will be used to conduct the ESG assessment.
  2. Use by clients: Our clients who request a Moody’s ESG assessment of your company will use the ESG assessment for their own purposes. We are not responsible for how clients use the ESG assessment.
  3. Use within Moody’s Corporation: Moody’s Corporation affiliates may also use personal data in the Product for internal purposes, including data analysis. Some Moody’s personnel working on the Product (such as IT support, sales, legal and compliance) have access to personal data in the Product as necessary for the completion of their job duties.
  4. Business transfers: If Moody’s is part of a business reorganisation, sale, merger or acquisition, personal data in the Product may be disclosed as part of the deal, safeguarded by contractual provisions to ensure confidentiality and use of the personal data only as described in this Privacy Notice.
  5. Legal or regulatory disclosures: We may disclose personal data contained in the Product where there is a reasonable requirement to do so, for example, to meet requirements of applicable law and regulation or in response to requests from regulators, courts or government agencies, or to establish or defend our legal rights.

 

5. Legal Basis, Data Retention & Data Transfers


We process personal data in the Product under contractual necessity in order to provide the ESG assessment requested by you/your company or with your consent where required under local applicable law.

Personal data is stored in the Product for as long as reasonably necessary to fulfil the purposes we collect it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure, and the applicable legal, regulatory, tax, accounting or other requirements. The personal data in the Product will be retained for 10 years after completion of the last ESG questionnaire by you/your company.

The personal data in the Product are stored by Moody’s in the US. To transfer personal data outside of the EEA, we rely on EU standard contractual clauses to ensure that an equivalent level of data protection applies. To request a copy of these clauses, please email us at privacy@moodys.com.

To access your personal data contained in the Product, contact our Data Protection Officer, exercise your rights of correction, objection, restriction or erasure, or any other privacy-related query, please email us at privacy@moodys.com.

You may also have the right to complain to your local data protection authority if you have concerns about how we process your personal data. However, we hope we can solve any queries or concerns you may have, so please contact us directly in the first instance.

 

6. Updates to this Privacy Notice


The most current version of this Privacy Notice will always be available here. You can check the “effective date” posted at the top to see when this Privacy Notice was last updated.