Data privacy policy for Securitas Workplace

Guidelines and user rules for Securitas Workplace

Updated July 2, 2024

Introduction

These guidelines and user rules are intended to facilitate learning and information exchange on Workplace. The guidelines and rules apply to anyone who has a user account on Securitas Workplace.

Workplace is an online collaborative software tool developed by Meta. Its features include instant messaging, file sharing, and video and audio conferencing. In our company, Workplace is a working tool used to communicate widely about our company, our strategy, purpose and values and also to connect our diverse workforce from all over the world in one single platform.

In Workplace, you have the chance to participate in groups and initiate chats with any other Securitas employee who is also in the platform. You can create posts and also react or comment on other people’s post. It’s a great place to contribute globally and your participation is considered important as your knowledge and experience can mean a lot to someone else.

It can be an opening to new contacts and an exchange that benefits you as well; there’s a good chance that you’ll find like-minded people to interact with who share your interests.

In other words, Workplace can help you find inspiration, news and facts about subjects that interest you and are relevant to your field or role. Next to that, you will find information about the strategy of the company and updates from the CEO and Securitas leaders.

Much like other social contexts, you will get the most out of things by being polite and accommodating. If you would not say or do it in the break room or at the coffee corner, don’t say or do it on Workplace. Everyone is responsible for maintaining a civil, constructive and productive tone in the groups and discussions. Always connect with respect.

How we manage Workplace

To keep the platform running smoothly, Securitas has a group of selected employees working within Communications or HR that can be Country Community Managers (CCMs) responsible for the country’s content, as well as System Admins responsible for keeping Workplace and its features working well. These people have system administration access to the platform and therefore can:

• Create, edit and share Knowledge Library content,
• Add and remove profiles manually,
• Move posts across groups,
• Manage groups: this allows access to groups across Workplace, including secret/closed groups,
• Moderate inappropriate/reported content,
• See all Workplace insights and manage campaigns.

The CCM and System Admins are appointed to/by Communications Securitas Group to receive managing access. If you would like to know who your CCM is, contact your local Country HR/Communications Manager. You can also identify these people by seeing if they have the badge “Workplace Admin” on their profile.

Reported content

Another task of the CCM is to handle the reported content coming in.

Posts, comments, chats and profiles can be reported on Workplace – by anyone. And that means that any reported content can be visible to the CCMs and System Admins – including those coming from open, closed and secret groups as well as chats between users. When a report is made, the CCMs receive a notification and have full access to the reported content.

If the content was not reported and is part of a private chat, the CCM does not have access to it.

Their responsibility then is to review that content. If a post from someone in X country is reported by someone from Y country, the local CCM of Y country will handle the case, however, the reported content is visible for all CCMs, irrespectively of the country.

And the following actions can be done depending on the type of content reported:

Chat

View the reported chat message and the person who composed it.

Allow: The reported content will remain on Workplace with no further action.

Group Chat

View the reported chat message and the person who composed it.

Allow: the reported content will remain on Workplace with no further action.

Collection of posts or messages that user has saved

Delete: the reported content will be permanently deleted.

Allow: the reported content will remain on Workplace with no further action.

Post

Delete: the reported content will be permanently deleted.

Allow: the reported content will remain on Workplace with no further action.

Profile

Allow: The reported content will remain on Workplace with no further action.

Show security logs: the reported content will be hidden from everyone on Workplace except for admins and the author. When a decision has been made regarding the content, you can restore it so it’s visible again.

Deactivate: the reported user’s Workplace profile will be deactivated.

Frequently, a lot of the reported content are done by mistake. But with this process in place, if any reported content does not apply to our guidelines or company rules, further actions can be taken such as the reported content may be escalated to the relevant HR function and the disciplinary actions against the employee may take please. Please continue reading the user rules to understand more.

User rules

Information security and the importance of operational security

Workplace is an internal Securitas work tool and people with a Workplace account have access to what is written and published there. Because it’s used on private devices, there’s a larger risk than with traditional internal communications systems that unauthorized persons can gain access to the platform; someone can lose their personal phone that isn’t password-protected, for example.

Everyone must be aware that certain information can hurt our clients or end up in the wrong hands. For that reason, it’s forbidden to publish secret or sensitive information on Workplace (specified further down in the document). All users need to be aware of this, and it’s every user’s responsibility to maintain our information security by reminding their colleagues about the following rules.

Anything that breaks the rules should be reported immediately to the system administrators by flagging the post (click on the three dots in the upper right corner of the post and choose “report post”.

• Publishing private information is not allowed, whether about how we work or about our clients; only public and internal information is permitted. Public information is factual information published freely within and outside Securitas (such as policies and press releases); however, internal company information, retains a certain amount of sensitivity for Securitas (documents in our management system, among others).
• You may not publish or share sensitive information regarding the business, our work and other employees. This can include prices and contract information, business strategies, instructions regarding work practices or equipment, etc. A rule of thumb: if we don’t talk about it openly, don’t post it on Workplace.
• Don’t publish client information on Workplace. It’s no secret that certain businesses or organizations are our clients, but we never discuss the services we provide or how they’re staffed. Don’t post about events at a specific assignment, either. Instead, talk about your experiences without identifying the client.
• Publishing pictures taken inside our clients’ property or in the surrounding areas is not permitted. Exceptions are pictures taken from places accessible to the general public, for example, a picture of a store taken from the customer parking lot.
• If you want to discuss vacancies: create a group that consists of interested parties or use Work chat; instead of the client’s name, use something like position codes or districts/shift-ID.
• Information in the form of text, pictures and videos that have been published on Workplace may not be copied, shared, displayed and in any other way made accessible to anyone outside of Securitas.
• Your login credentials may not be shared with anyone else and should be protected as a valuable piece of information; likewise, you should ensure that you are logged out of any devices before leaving them unattended.
• So that everyone can understand what the conversation is about, only the official language/languages in your respective country are permitted in posts. Preferably use English in the global [ALL] and international [INT] groups; however, you can write in your native language, relying on the Workplace translation function.
• The group’s administrator is also responsible for ensuring that the group’s members follow the guidelines.

System Admins can see the content posted in every group – even groups that are private or secret.

Note that if you don’t follow the guidelines, disciplinary action in accordance with Securitas’ group and local policies may follow immediately. Failure to comply with these guidelines will be reported to your immediate supervisor and your account may be deactivated.

Do’s and Don’ts

Do...

• Complete and update your Account (add a picture of yourself if you wish).
• Strive to be clear and understandable when you post.
• Be personable in your communication, but remember the difference between personal and private.
• Invite others to participate in dialogue and discussion. Comment on and otherwise acknowledge others’ posts.
• Respond to the interest others show in you and what you’ve written.
• Speak up respectfully if you think someone might be wrong or misinformed.
• Respond to those who show interest and engagement when you pose questions or ask for input.
• Use emojis to add nuance and clarification to what you write – this can reduce the risk of unnecessary misunderstandings.
• Share thoughtfully. What you share becomes a representation of yourself and of Securitas.

Don’t…

• Post, publish or share:
• discriminatory content, slander, mockery, personal attacks, insults, threats against ethnic groups, sexist remarks and other harassment,
• unlawful descriptions of violence and pornography,
• criminal requests,
• messages, texts, photos or videos presenting Securitas, its employees, clients or suppliers in a wrong or bad light (see also under paragraph on User rules).
• Use profanity and upsetting remarks.
• Post gossip or unverified information and don’t be a spammer
• Publish personal information about colleagues and share photos of your colleagues without first obtaining their permission.

• Argue on political or religious statements that have no direct bearing on our operations.
• Use Workplace to talk about what you do in your free time – this is, above all, a work tool.
• Use Workplace for campaigns, fundraising or lobbying or making money out of selling objects or ideas.
• Share irrelevant or purely personal posts in a group; the latter belong on your own timeline. Respect a group’s description and purpose.
• Start group chats for entire regions or businesses. You’re welcome to use the chat function to communicate with individual colleagues in small groups, but don’t send general messages to large groups of people who aren’t expected to answer or respond in any way.

In addition to the guidelines and user rules above you must accept Facebook’s own Terms.

Workplace Policy - United States

1. Information About Workplace

Workplace is an online platform created by Meta Platforms, Inc. ("Meta”), where you as a user can benefit from information shared by Securitas Security Services USA, Inc. ("Securitas” or "we”) and related companies as well as you can collaborate and share information at work with your collegues. The Workplace platform includes websites, applications and related online services for Workplace (hereinafter collectively, the "Workplace Service").

The use of the Workplace Service is governed by our Privacy Policies. If you are an employee, you can view the applicable Privacy Policy here.

Please note that the Workplace Service is independent of any other Facebook services provided by Meta you may use. Such other Facebook Services are provided to you by Facebook and are subject to their own terms and conditions. For the avoidance of doubt, this Workplace Policy does not apply to any such services.

2. Third-Party Links and Content

The Workplace Service may contain links to websites and services provided and maintained by third parties. Such third-party websites and/or services may be governed by their own terms of use and privacy policies and your use of such websites and/or services will be governed by and subject to such terms of use and privacy policies. You should review the terms of use and privacy policy of each website and/or service that you visit/use. You understand and agree that Securitas does not endorse and that Securitas is not responsible for the conduct, functions or content of such third party websites and/or services or for any transactions you may enter into with the provider of such websites and/or services.

3. Storage

Your account will be deactivated which usually takes 90 days after it has been terminated.

Please note that content that you create and share in the Workplace Service may remain in the Workplace Service and be accessible even if Securitas deactivates or terminates your user account (i.e., content that you provide in the Workplace Service is similar to other types of content (such as presentations or letters) that you generate as part of your employment). You can manage your content, including deleting all posted communication at your convenience. For technical support, please contact Workplace Admin.

4. Changes to this Policy

Securitas reserves the right to make changes to this Workplace Policy. If we make material changes to this Workplace Policy, we will post the revised Workplace Policy and the revised effective date.

5. Contact Us

If you have questions about this Workplace Policy, please contact internalcommunications@securitasinc.com.

Workplace Policy - EU and all other countries

1. Background and purpose

We care about your privacy and we want to be responsible for and be fair and transparent when it comes to our collection and use of your personal data. Workplace is an online platform created by Meta Platforms, Inc. („Meta”), where you as a user can benefit from information shared by Securitas as well as you can collaborate and share information at work with your collegues. The Workplace platform includes websites, applications and related online services for Workplace (hereinafter collectively, the "Service").

This privacy policy (the "Privacy Policy") describes how your information is collected, used and shared when you use the Service and is applicable to the processing of your personal data carried out in connection with the use of the Service.

Your employer is the data controller for the processing personal data in connection with your use of the Service. Please refer to your Local Employee Privacy Notice for details. If you are consultant who receive an access to Workplace platfrom, Securitas entity with whom you have contractual relationship is the data controller for the processing of your personal data in connection with your use of the Service.

Securitas entities are hereinafter referred to separately as "Securitas", "we", "us" or "our".

Please note that the Service is independent of any other Facebook services provided by Meta you may use. Such other Facebook Services are provided to you by Facebook and are subject to their own terms and conditions. For the avoidance of doubt, this Workplace Privacy Policy does not apply to any such services.

2. What kind of information is collected about you

Securitas may collect and process the following types of information when you, your colleagues or other users within the Securitas Group use the Service:

• your contact information, such as full name and email address;
• your username and password;
• your title, department information and other information relating to your work or Securitas;
• content, communications, and other information you provide when using the Service, including when you register an account, create or share content, and send messages or communicate with others. This may include information in or about the content you share (e.g., metadata), such as the location of a photo or the date a file was created;
• content, communications and information that other people provide when they use the Service. This may include information about you, such as when they share or comment on a photo of you, send you a message, or upload, sync, or import your contact information;
• any communication with other users of the Service;
• user communications, feedback, suggestions and ideas sent to Securitas;
• information that you provide when you or Securitas contact or engage the platform's support regarding the Service.

3. How do we use your personal data?

Purpose of the processing

Your personal data is processed for the purpose of Securitas being able to:

• provide effective internal communication platform for internal staff of Securitas,
• provide you with a user account, give you access to the Service and to administer your user account in the Service,
• prevent, investigate or take other action in relation to misuse of the Service or violation of the use rules for Workplace or in connection with legal action, suspicion of fraud or potential threats to the rights of Securitas or others.

Legal basis for the processing

The processing is carried out on the basis of a legitimate interest, after a balancing of interests where the following interests have been taken into account by the following Securitas:

• enhance internal communication, in particular to communicate strategy, priorities, plans as well as to share other announcements,
• ensure effective collaboration across inernal staff of Securitas,
• improve productivity by sharing knowledge management between internal staff of Securitas and adapt to modern work practices,
• foster a sense of closeness and connection to Securitas as employer
• to ensure , user-friendly, and well-functioning Service,
• Securitas' interest in investigating suspicions of misuse of the Service and taking action against misuse of the Service or violation of the use rules;
• Securitas' interest in the investigation and proof of breaches or threats to its interests/rights; the interest of a third party in the investigation and provenance of a breach or threat to their interests/rights; and/or authority's interest in conducting law enforcement activities and compiling evidence for such purposes.

4. Sharing your personal data

We will share your personal data with the following categories of recipients in the following circumstances and for the following reasons:

Third-Party Service Providers: We share your personal data with third-party service providers who assist Securitas in providing services related to Securitas' business and who therefore process personal data on behalf of Securitas, e.g. IT infrastructure providers, developers and storage providers; IT maintenance providers; and other third-party service providers such as software providers and service providers who facilitate and/or provide services to us in order for us to provide you with access to the Service.

These third-party service providers are only entitled to use your personal data as necessary to provide us with their services and they do not have an independent right to process or share your personal data.

Meta: Securitas will further share your personal data that Securitas collects with Meta as the ultimate provider of the Service in order for Meta to be able to provide and support the Service and in accordance with other instructions they receive. Meta may use your personal information to, for example:

• communicate with users and administrators about their use of the Service;
• enhance the safety and security of the Service for Securitas and other users, such as by investigating suspicious activity or violations of applicable terms or policies;
• customize your and Securitas' experiences as part of Meta’s provision of the Service;
• develop new tools, products and services in the Securitas Service;
• connect activities in the Service across different devices used by the same individual to improve the overall operation of the Service;
• identify and rectify errors that may occur; and
• conduct data and system analysis, including research to improve the Service.

Affiliates: We share your personal data with our subsidiaries and group companies that process your personal data on our behalf. They are obliged to only process such personal data in accordance with our instructions.

Other users: Your personal data may be available to other users of the Service. Your data will only be shared with other users within your company and within the Securitas Group.

5. Transfer of your personal data outside the EU/EEA

The personal data that we collect about you may be transferred and processed in a country outside the EU/EEA (i.e. in a so-called third country), including countries that the European Commission does not consider to have an adequate level of protection for personal data. In such case, we will take all steps necessary under applicable law to ensure that such transfer of your personal data is in accordance with applicable law. For the Service, Meta has certified its participation in the EU-U.S. Data Privacy Framework. We rely on the EU-U.S. Data Privacy Framework, and the European Commission’s related adequacy decision, for transfers of information to Meta Platforms, Inc. in the U.S..

6. Third-Party Links and Content

The Service may contain links to websites and services provided and maintained by third parties. Such third-party websites and/or services may be governed by their own terms of use and privacy policies and your use of such websites and/or services will be governed by and subject to such terms of use and privacy policies. You should review the terms of use and privacy policy of each website and/or service that you visit/use. You understand and agree that Securitas does not endorse and that Securitas is not responsible for the conduct, functions or content of such third party websites and/or services or for any transactions you may enter into with the provider of such websites and/or services.

7. Storage

Your account will be deactivated which usually takes 90 days after it has been terminated.

Please note that content that you create and share in the Service may remain in the Service and be accessible even if Securitas deactivates or terminates your user account (i.e., content that you provide in the Service is similar to other types of content (such as presentations or letters) that you generate as part of your employment). You can manage your content, including deleting all posted communication at your convenience. For technical support, please contact Workplace Admin.

8. Your rights

You can access, correct or delete information that you have uploaded to the Service using the tools available in the Service (for example, by editing your profile information or via the activity log). If you are unable to manage your information by using the tools in the Service, please see further information about your rights in the Country Employee Privacy Notice and contact us if you wish to exercise your rights.

9. Changes to this Privacy Policy

Securitas reserves the right to make changes to this Privacy Policy. Securitas will, before Securitas makes any material changes to this Privacy Policy, provide you with a clear notice thereof in a manner appropriate to the circumstances, for example by providing you with a prominent notice thereof in the Service.

10. Contact Us

If you have questions about the processing of your personal data, this Workplace Privacy Policy, otherwise have comments on processing of your personal data or if you wish to exercise your rights as described above, please refer to the information in the Country Employee Privacy Notice to contact the relevant data controller.

You can also contact Group privacy team, to re-direct you to the relevant country DPO: E-mail: privacy@securitas.com