Privacy Policy

I. PURPOSE AND SCOPE

DBRS Morningstar¹ is committed to protecting the privacy of those with whom it interacts and it recognizes the need to respect and protect personal and non-personal information (herein referred to as “information”) that is collected or disclosed to us. This DBRS Morningstar Privacy Policy (“Policy”) explains: what information DBRS Morningstar collects, how DBRS Morningstar collects that information, how DBRS Morningstar uses the information, and who DBRS Morningstar may share the information with.

DBRS Morningstar collects certain information so that it may meet the needs of its customers. The information enables DBRS Morningstar to monitor and improve the services which it offers to current and potential customers.

DBRS Morningstar uses information in accordance with the Policy and applicable data protection laws, including the application of the General Data Protection Regulation (GDPR) for all residents of the European Union (EU). By accessing the DBRS Morningstar websites and other services, you agree and consent to DBRS Morningstar collecting, maintaining, using and disclosing non-personal information about you and provided by you as set out below.

^{_{1. DBRS Morningstar means DBRS Limited, DBRS, Inc., DBRS Ratings Limited, and DBRS Ratings GmbH.}}

II. WHAT INFORMATION DO WE COLLECT

Personal information is information that may include any factual or subjective information about an identifiable individual. Non-personal information is information that alone cannot be used to identify individuals. Such information includes, but is not limited to: domain names, type of device and browser used to access DBRS Morningstar Products (Section III.), demographic information, geographic information, and network providers.

DBRS Morningstar may collect internet protocol (IP) addresses which are a string of numbers assigned to a computer by an internet service provider. Such would be conducted in accordance to all applicable laws and pursuant to EU Regulation 2016/679 in reference to the GDPR.

DBRS Morningstar may also collect information on user behaviour/engagement, including but not limited to: the date and time of registration, usage session dates and duration, page views, features and functions used, preferences and settings selected, and responses to surveys.

When used in combination with other collected data, IP addresses and behaviour/engagement data may constitute personal information that can identify you.

III. HOW DO WE COLLECT THE INFORMATION

DBRS Morningstar collects information through its website, web subscriptions on dbrsmorningstar.com, Ratings Now, Viewpoint, and other DBRS Morningstar products, applications, platforms, and services such as issuers engaging DBRS Morningstar to assign credit ratings (herein referred to as “Products”).

DBRS Morningstar and its third-party service providers may collect information provided by a user or a user’s account administrator in situations such as, but not limited to:
• Registration for DBRS Morningstar Products, services, and events
• Setting-up portfolios, preferences, and notifications/alerts connected to DBRS Morningstar Products
• Logging into DBRS Morningstar Products and services through social media platforms
• Contacts with DBRS Morningstar customer support by email, phone, or other means
• Participation in surveys or questionnaires
• Online order forms
• Use of DBRS Morningstar Products
• Other interaction with DBRS Morningstar

DBRS Morningstar uses cookies, which are small files that are assigned to and stored in a user’s internet browser on a temporary (for the duration of the online session) or persistent basis (cookie stays on the computer after the internet browser or device has been closed). Cookies collect and store information about a user’s preferences, product usage, content viewed, and registration information which allows for DBRS Morningstar to provide users an enhanced and customized experience when engaging with our Products.

DBRS Morningstar may also use tracking and analytics tools, such as pixel tags, action tags, web beacons, and JavaScript amongst others to collect and analyze information on behaviour/engagement with our Products.

DBRS Morningstar may also collect business contact information (i.e., name, position and business email address of the relevant individual, and company) for all suppliers of DBRS Morningstar (i.e., office equipment, professional advisers).

IV. HOW DO WE USE THE INFORMATION

Collected information, as well as cookies, tracking, and analytical tools are used to understand users’ interests, and engagement with our Products so that DBRS Morningstar can:
• Deliver Products, as well as, administer systems and accounts
• Provide customer support, product training, and education to users
• Send notifications and alerts in accordance with the user’s preferences and settings
• Customize content and layout of Product and services such as issuers engaging DBRS Morningstar to assign credit ratings
• Enhance Products and the user experience
• Develop new Products
• Keep users informed of research materials, events, promotions, surveys, and other content that may be of interest
• Create sales, marketing, and promotional plans and programs

The information collected by DBRS Morningstar is used primarily for internal purposes, some of which are mentioned above. DBRS Morningstar does not sell any data collected; however, it may be shared in accordance with this Policy where required by law or as otherwise detailed below.

V. WHO WE MAY SHARE THE INFORMATION WITH

DBRS Morningstar may share the information with the following:
• Applicable regulatory and government bodies
• External service providers and professional advisers that provide services to DBRS Morningstar and who adhere to this Policy, as assessed by its Data Protection Officer
• Any organisation at your request or any persons acting on your behalf, including your financial adviser, broker, solicitor or accountant
• Any authority to whom DBRS Morningstar is required to disclose such information by law

You agree to DBRS Morningstar using the information for the above-stated purposes. Where applicable, you also agree to DBRS Morningstar transferring your information outside the European Economic Area (EEA). Please note that DBRS Morningstar in the EU only transfers information to organisations outside the EEA if DBRS Morningstar has assessed the organization as having appropriate controls and safeguards in place to protect your personal information, as is required under the EU Regulation 2016/679 pertaining to the GDPR and applicable laws.

Customers’ and suppliers’ business contact information (i.e., name, position and business email address of the relevant individual, and company) may be shared with other Morningstar Group Companies. As a result, your business contact information may be processed outside of the EEA (e.g., for invoicing purposes or group company offerings). Such business contact information will remain protected in accordance with the applicable legal requirements. The Data Protection Officer oversees the methods by which such business contact information is stored, controlled and/or processed by DBRS Morningstar. The Data Protection Officer may be reached at privacy@dbrsmorningstar.com, should you have any concerns or questions.

VI. ADDITIONAL INFORMATION

Disabling Cookies

Cookies can be disabled and cleared by adjusting internet browser preferences (refer to the browser provider’s website for instructions on changing preferences). Note that if cookies are disabled/blocked, this may limit your experience with our Products and potentially cause features to be inoperative or fail to operate as intended.

Questions

Please direct any questions or concerns regarding DBRS Morningstar 's Privacy Policy or practices to our Data Protection Officer at privacy@dbrsmorningstar.com.

For EU and under GDPR, you have (subject to certain exceptions) the right to obtain copies of personal information which DBRS Morningstar holds about you and to inform DBRS Morningstar of any inaccuracy, including the right to be forgotten. Should you have any questions or concerns about settings and preferences on DBRS Morningstar Products, please contact info@dbrsmorningstar.com.

Changes

DBRS Morningstar may change this Policy from time to time and any changes to this Policy will become effective when we post the revised Policy on this page. If you use this website or other services we provide to you after any revised versions take effect, your continued use of the DBRS Morningstar website, our Products and services shall constitute your agreement to the current Policy in effect.

Effective Date: June 30, 2021

Document Control Number: 20210629-049