Privacy Policy

GLOBAL EXCLUDING CHINA

ALUMNI NETWORK WEBSITE DATA PROTECTION NOTICE 

Effective: December 1, 2023

Last Update: November 2023

I. INTRODUCTION 

Thank you for making a connection and requesting to join our Alumni Network Website.

This Alumni Network Website Data Protection Notice (“Notice”) has been prepared to outline how Bank of America N.A., and each other affiliate or subsidiary (“affiliate”) of Bank of America Corporation (collectively, “the Company”, “we”, “us”, or “our”) collect, use, store, transfer and otherwise process individually identifiable information about Alumni (“Personal Data”) who visit or use the Bank of America Alumni Network Website. For the purposes of this Notice, “Alumni” means any individual who is a former employee of the Company who has retired or left in good standing as determined by us and limited to use of this site. The Company may also provide to Alumni additional data protection or privacy notices from time to time. 

California residents covered by the California Consumer Privacy Act may have additional rights. To learn more, California residents can reference the California Consumer Privacy Act Notice for additional information.

In the event this Notice is provided to an Alumni in a language other than English, any discrepancy, conflict or inconsistency between the two language versions shall be resolved in favor of the English version, subject to applicable law.

Please access the following link for Data Protection Notices in languages other than English: ALUMNI NETWORK WEBSITE DATA PROTECTION NOTICE

II. PERSONAL DATA COLLECTION AND PURPOSES OF USE 

Participation in the Alumni Network Website requires the Company to collect Personal Data that is directly relevant to its business, required to meet its legal obligations, or otherwise permissible to collect under applicable law. Listed in Appendix A of this Notice are the categories of Personal Data that we collect and the purposes for which we use the data that we collect, except where restricted by applicable law. We receive Personal Data from you and from other sources, including public sources.  To join the Network, you must first acknowledge the Data Protection Notice by checking the confirmation box when creating your account. Checking this box indicates that you are providing consent to your information to be displayed and shared, and for the program to use your contact information. 

We collect and process Personal Data about you: (i) because we are required or permitted to do so by applicable law, (ii) because such information is necessary for membership of the Alumni Network, (iii) because such information is of particular importance to us and we have a specific legitimate interest under law to process it, (iv) where the Personal Data is necessary for the establishment, exercise or defense of legal claims, or (v) where necessary, we obtain consent of Alumni for collection and processing of Personal Data

If you do not provide certain categories of Personal Data, the Company may not be able to accomplish some of the purposes outlined in this Notice and we may not be able to grant you membership.

III. COOKIES AND TRACKING TECHNOLOGY

Non-essential and essential cookies are collected on some websites and mobile applications that the Company uses.  Please refer to the following policy. 

This site may leverage technology to collect information on where Alumni are located, which in turn may be used to present job openings, volunteer activities and other opportunities to participate in the Alumni Network. See Section VI for information on how you can delete your personal data.

Industry standards continue to evolve around web browser "do not track" signals or configurations set in your internet browser. Bank of America captures opt out preference signals, and to the extent users have rights under applicable law, treats them as valid requests to opt out of sale/sharing at the browser level.

We may use third-party providers to process personal information for business purposes on our behalf. Third-party providers are contractually obligated to comply with our policies to protect information we share with them or they collect on our behalf.

IV. DISCLOSURE 

To the extent permitted by applicable law and as appropriate to achieve the purposes described in this Notice, Personal Data may be disclosed by the Company as follows:

Given the global nature of the Company’s activities, the Company may (subject to applicable law) transmit Personal Data, to other Bank of America affiliates or operations located in other jurisdictions, including the United States or other jurisdictions where data protection laws may not provide an equivalent level of protection to the laws in the Alumni’s home jurisdiction. The affiliates belonging to the Bank of America Corporation group are listed at the link below. The listing is available upon request. 

The Company may disclose in accordance with applicable law relevant Personal Data to certain third parties in connection with the provision of services to the Company.Where the processing of Personal Data is delegated to a third party data processor, such as those listed in Appendix A, the Company will delegate such processing in writing, will choose a data processor that provides sufficient guarantees with respect to technical and organizational security measures, such as data protection and information security requirements, governing the relevant processing and will ensure that the processor acts on the Company’s behalf and under the Company’s instructions. 

Personal Data also may be disclosed, where permitted by applicable law, in connection with a corporate restructuring, sale, or assignment of assets, merger, divestiture, or other changes of the financial status of the Company or any of its subsidiary or affiliated companies. Personal Data also may be released, to protect the legitimate interests of the Company (unless this would prejudice the rights and freedoms or interests of the Alumni), or in the Company’s judgement to comply with applicable legal or regulatory obligations and regulatory inquiries or requests subject to local law with respect of China. 

V. SECURITY 

The Company maintains appropriate technical and organizational measures designed to protect against unauthorised or unlawful processing of Personal Data and/or against accidental loss, alteration, disclosure or access, or accidental or unlawful destruction of or damage to Personal Data.

VI. ACCESS, PORTABILITY, RECTIFICATION AND SUPPRESSION, LIMITATION AND RESTRICTION OF PROCESSING AND ACCURACY OF PERSONAL DATA 

Alumni are entitled to access Personal Data held about them (with the exception of any documents that are subject to legal privilege, that provide Personal Data about other Alumni, or that otherwise are not subject to data subject access rights). Any Alumni who wishes to access his/her Personal Data or (where permitted under applicable law) request portability of their data should contact a member of the Alumni Network Program Office using the contact information set out in Section IX below. 

To the extent required by applicable law, Alumni have the right to have inaccurate data corrected or removed (at no charge to the Alumni and at any time) or to limit or restrict processing of their data.

To assist the Company in maintaining accurate Personal Data, Alumni must ensure they keep their Personal Data up to date on the Company’s Alumni portal. In the event that the Company becomes aware of any inaccuracy in the Personal Data it has recorded, it will correct that inaccuracy at the earliest practical opportunity.

To the extent available under applicable law, Alumni may also have the following rights (including but not limited to):

• to request a copy of Personal Data held by the Company (as part of an access request above);
• to request further information or complain about the Company’s practices and processes regarding their Personal Data;
• to object to, withdraw consent to, restrict, or request discontinuance of collection, use, disclosure and other processing of their Personal Data as described in this Notice and to request deletion of such Personal Data by the Company.

For all inquiries, Alumni should contact a member of the Alumni Network Program Office using the contact information set out in Section IX below. Under applicable law, in certain circumstances, the Company may be exempt from or entitled to refuse the above requests or rights. Certain additional terms and conditions may be applicable to process requests or rights, such as requiring communications to be in writing or requiring proof of identity.

VII. MODALITIES OF THE PROCESSING AND DATA RETENTION 

The Company does not use automated decision making on Alumni processes. ‘Automated decision-making’ is the process of making a decision by automated means without any human involvement.

Collection, use, disclosure, transfer and other processing, including storage, of Personal Data may be by electronic or manual means, including by hard-copy or soft-copy documents or other appropriate technology.  Personal Data may be stored in an Alumni’s home jurisdiction and/or other jurisdictions in which the Company has operations.

The Company will maintain Personal Data for as long as it is required to do so by applicable law(s) or for as long as necessary for the purpose(s) of use and processing in Section II, whichever is longer (“the retention period”). Any maximum storage term set forth by applicable law will prevail. The Company will delete Personal Data after the applicable retention period. The retention periods for each type of data and jurisdiction are outlined on the Global Records Retention Schedule, available upon request.

The criteria used to determine our retention periods include:

• As long as we have an ongoing relationship with the Alumni; 
• As required by a legal obligation to which we are subject; 
• As advisable in light of our legal position (such as in regard of applicable statutes of limitations, litigation, or regulatory investigations);
• The time period necessary to achieve the purpose of use and processing.

VIII. QUESTIONS 

Should any Alumni have any questions, concerns or complaints about this Notice, please contact the Alumni Program via email: alumni.network@bofa.com.

In certain countries, if you have additional queries about the way in which the Company processes your Personal Data more broadly you may contact the local Data Protection Officer using the following contact details: 

EMEA Region and Canada:           DPO@bofa.com 

Switzerland:                                    DPO@bofa.com

                                                          Nicole Busslinger-Roch

STOCKERHOF

STOCKERSTRASSE 23

ZURICH, 8002 Switzerland

Brazil:                                            DPO@bofa.com

APAC Region:                               DPO@bofa.com 

Alumni may have the right to lodge a complaint with the local Data Protection authority. 

IX. CHANGES TO THIS NOTICE

Should the Company substantially modify the manner in which it collects or uses Personal Data, the type of Personal Data it collects or any other aspect of this Notice, it will notify Alumni as soon as reasonably possible by reissuing a revised Notice or taking other steps in accordance with applicable laws including obtaining Alumni consent where required. 

X. JURISDICTION-SPECIFIC CLAUSES

AUSTRALIA 

All reasonable steps are taken to ensure security, privacy and integrity of any Personal Data transferred to recipients outside Australia. However, the Company must rely on your consent to transfer Personal Data to unaffiliated third-party recipients outside Australia. You acknowledge that, prior to your consent to transfers of Personal Data to unaffiliated third party recipients outside Australia (other than service providers), the Company has expressly informed you that it is a consequence of such consent that, if any such overseas recipient handles the Personal Data in breach of the Privacy Act 1988 (Cth) (“Privacy Act”), the Company is not accountable under the Privacy Act and you may not be able to seek redress under the Privacy Act or in the overseas jurisdiction. 

BRAZIL 

The Lei Geral de Proteção de Dados Pessoais (LGPD) has implemented new rights in addition to those listed in Section VII: 

• to receive information about the consequences of denying consent; 

• to request anonymization, blocking, or deletion of unnecessary or excessive personal data; 

• to request information about entities with which the company has shared personal data; and 

• to request review, by a natural person, of decisions taken solely on the bases of automated processing of personal data that affects the Alumni’s interests. 

Under applicable law, in certain circumstances, the Company may be exempt from or entitled to refuse the above requests or rights. Certain additional terms and conditions may be applicable to process requests or rights, such as requiring communications to be in writing or requiring proof of identity.

PEOPLE’S REPUBLIC OF CHINA (“China”, which, as a jurisdiction for the purpose of this Notice, excludes the jurisdictions of Hong Kong Special Administrative Region, the Macau Special Administrative Region and Taiwan) 

Please see Appendix B for a list of the organizations to whom we transfer Personal Data as data controllers in China (which can independently determine processing purposes and processing methods in Personal Data processing activities) and other receiving parties outside of China, and their respective contact details and details on what, how and why such organizations process your Personal Data and, where required, how you can exercise your data privacy rights in respect of those organizations. If you want to exercise your rights related to the protection of Personal Data to the overseas recipients, you can submit your requests through the contact information provided in the “Questions” section of this Notice. After we transfer your Personal Data outside of China, the data controller outside China may also provide some of your exported Personal Data to our affiliated entities or third-party service providers that are entrusted to provide relevant services such as software and hosting services and benefits and insurance administration and management or allow them to access the Personal Data within the necessity of providing such services.

Where required or permitted by applicable law, we may process Sensitive Personal Data for employment purposes in a manner that reasonably considers and mitigates, where practicable, negative impacts to your rights and interests.

In accordance with the National Administration for Financial Regulation (NFRA) Shanghai regulations, banks and insurance companies operating in Shanghai are required to disclose to NFRA Shanghai certain employee hiring and termination information, including employment status, job movements and disciplinary records, during your employment with the Company. Such information is recorded in the NFRA Shanghai’s system and is accessible by other banks and insurance companies for reference check purposes.

EEA / UK / Switzerland

Given the global nature of the Company’s activities, the Company may transfer your Personal Data to countries located outside of the European Economic Area (“EEA”), the UK or Switzerland. With regards to transfers from the EEA, UK or Switzerland to other countries, we have put in place adequate measures, such as standard contractual clauses adopted by the European Commission to protect your information. Where necessary we added the UK SCC addendum (for transfers from UK) and/or additional clauses for Switzerland (for transfers from Switzerland). Alumni in the EEA, UK or Switzerland may obtain a copy of these measures by going to https://commission.europa.eu/law/law-topic/data-protection_en

Where countries are considered adequate by the EU, UK and Switzerland respectively, we rely on this adequacy decision as a safeguard. Countries that are subject to an adequacy decision can be found on the links below.

For the EEA: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en

For the UK: https://www.gov.uk/government/publications/uk-approach-to-international-data-transfers/international-data-transfers-building-trust-delivering-growth-and-firing-up-innovation

For Switzerland: https://www.edoeb.admin.ch/edoeb/en/home/datenschutz/arbeit_wirtschaft/datenuebermittlung_ausland.html

Individuals may also file a complaint with a supervisory authority competent for their relevant country or region. A list of data protection authorities in the EEA is available at: http://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=612080. The data protection authority in the UK is the Information Commissioners Office (the ICO) and in Switzerland it’s the Federal Data Protection and Information Commissioner (FDPIC).

FRANCE

Under French law, in addition to the above, Alumni shall have the right to set guidelines regarding the retention, erasure and disclosure of their Personal Data after their death.

PHILIPPINES AND SINGAPORE 

To the extent required by applicable law, certain authorized individuals may exercise the rights mentioned in Section VII on behalf of a deceased Alumni. In furtherance of data protection and security, the Company may apply additional terms and conditions to process requests or rights made by individuals other than the deceased Alumni, such as requiring proof of legal authority to validly act on behalf of the deceased Alumni. Authorized individuals that seek to exercise these rights may contact a member of the Alumni Program using the contact information set out in Section IX.

SOUTH AFRICA 

Where Personal Data is transferred by the Company outside of South Africa, the Company will address any applicable requirement to assure an adequate level of data protection before transferring Personal Data by assuring the implementation of binding corporate rules or the execution of appropriate data transfer agreements conforming to the European Union Standard Contractual Clauses. In terms of POPIA, Alumni are entitled to approach the South African courts and can lodge a complaint with South Africa’s information regulator in respect of any alleged interference with the protection of their Personal Data. The contact details of South Africa’s information regulator are as follows: 

Physical address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 

Postal address: P.O. Box 31533, Braamfontein, Johannesburg, 2017 

Email address: complaints.IR@justice.gov.za

SWITZERLAND

.

TAIWAN 

See Annexures 1 and 2 for a list of the relevant standard purposes of use and types of personal data as prescribed by the Ministry of Justice.

TURKEY

As per Article 11 of the Data Protection Law (Law No. 6698) your rights regarding protection of your personal data are as follows: 

• To know whether or not personal data is processed
• To request information if personal data is processed 
• To know the purpose of processing personal data and whether or not the data is being processed in accordance with these purposes
• To know of any third parties where personal data is transferred to within Turkey or abroad, to request correction of personal data if it is incomplete or inaccurately processed, and to request notification of such correction if the personal data is being transferred
• To request the deletion or destruction of the personal data in case the legal ground or reasons requiring the processing of the data is no longer existed and to request notification of such deletion or destruction if the personal data is being transferred
• To object to negative results occurred through a fully automated processing of personal data
• To request compensation in case of loss due to unlawful processing of personal data. 

For your request regarding usage of your rights mentioned above in connection with your personal data, please contact the Company, please refer to Section IX for details, or deliver by hand or by a notary public with your identification documents with original signature. Your request will be finalized as soon as possible at the latest within 30 (thirty) days after the receipt of the relevant documents. If your application is rejected, you can apply to the Personal Data Protection Board within 30 days and at the latest 60 days in accordance with the Article 14 of the Data Protection Law (Law No. 6698).

UNITED ARAB EMIRATES 

International Transfers of Personal Data 

With regards to transfers from the DIFC to other countries, we have put in place suitable safeguards, such as standard contractual clauses, adopted by the DIFC to protect your information. Alumni in the DIFC may obtain a copy of these measures by following these links: https://www.difc.ae/business/operating/data-protection/adequate-data-protection-regimes/ 

Consent of the Notice

I have read the “Alumni Network Data Protection Notice” describing the collection, processing and use of my Personal Data by the Company, and the international transfer of my Personal Data (including to jurisdictions where data protection laws may not provide an equivalent level of protection to the laws of my home jurisdiction) during the course of enrolment into the network. By voluntarily submitting my Personal Data, I explicitly consent to the processing as set out in this Notice. 

Appendix A 

The table below contains the purpose for which we may process your personal data, the types of processing activities that may take place and the category of personal information that would be used for such processing as well as the legal basis for the processing. More information is listed below the table about the personal information categories.

*Personal Data marked with an asterisk in this Section is mandatory for Alumni to provide to the Company. It is voluntary for Alumni to provide other types of Personal Data and information about themselves. Some of the personal data listed above may be shared, collected, used, transferred and/or disclosed in-line with country specific laws/regulations.

The Categories Of Unaffiliated Third Parties With Whom We May Share Personal Data

Annexure 1

Relevant Standard Purposes for Personal Data Protection Act as prescribed by Ministry of Justice

Annexure 2

Relevant Data Types for Personal Data Protection Act as prescribed by Ministry of Justice

Appendix B 

Organizations To Which We May Disclose Personal Data