Amcor : Employee Privacy Notice The Pod June2024

Privacy Notice - The Pod

Amcor respects the individual privacy of its coworkers. Amcor processes information relating to identified or identifiable natural persons or households ("Personal Information") in a manner consistent with applicable data ("Applicable Data Protection Laws") and is committed to upholding the highest ethical standards in its Human Resources and Business practices.

The purpose of this Privacy Notice (the "Notice") is to inform you of Amcor's practices regarding the processing of your Personal Information within the context of our digital communication platform called the Pod (the "Pod").

1. Who is responsible for Personal Information in the Pod?

In the context of the Pod, Amcor Group GmbH ("Amcor") along with other Amcor entities which act as your employers and participate in the Pod platform (collectively, "the Amcor Group", "we" or "us", acting as joint controllers under relevant Applicable Data Protection Laws) make decisions about your Personal Information, as explained below. You can check the list of Amcor Group entities, including addresses, by clicking here.

2. What does this Notice cover?

The Pod is a global digital communication platform, available via Pod's website and mobile app that allows Amcor Group to provide information and news to current coworkers and it allows you to react to these through dedicated tools. This Notice applies to the collection, management, storage and other processing of Personal Information about Amcor coworkers within the Pod website, app and systems we need to help us keep it running.

3. What Personal Information do we process and where does it come from?

We process the following Personal Information for the purposes outlined in Section 4 below. We may combine information from the below sources based on common identifiers, such as your name.

1. Personal Information you provide to us directly, when you create your account on the Pod platform and interact with the Pod, such as by posting content or commenting on the content posted on the platform.
2. 1. Identifiers, such as your name, company, ZIP code, username and password, dedicated identifier, which will allow you to connect to the app.
   2. Protected class and demographic information, such as age (based on your date of birth), gender.
   3. Professional or employment information, such as job start date.
   4. Your user preferences, such as language option you select for using the Pod.
   5. Your contributions to the platform, such as the content you publish on the platform, including pictures from your devices or comments you post reacting to other coworkers' content. You will be able to upload pictures in the Pod app, only if you allow the app access to photos on your device. If you prefer not to do so, you can always upload pictures through the website.
3. Personal Information Created in the Course of your Employment with Amcor Group.
4. 1. Professional or employment information, such as Amcor ID, work email, business unit and group, work site/location (including country), function, length of service, job profile and title, pay rate type (i.e., salary/hourly), whether you manage other and your management level, benefit plan/insurance type.

1. Inferences drawn about your interaction with Pod and your location. We will generate reports, based on your use of the Pod app and website (for example, which content gets most comments, which types of coworkers interact with Pod the most, etc.). Such reports will be aggregated based on data from all coworkers using the Pod and will not aim to specifically identify you as an individual. We will also infer your location (city/state and country) based on your IP address.

3.3. Personal Information collected automatically when you use the Pod on your mobile phone and/or the Pod website.

1. Device information, Internet, or other electronic network activity information when using the Pod app or website, such as such as Pod ID, your preferences and activity on the Pod website, time of the Pod app launch, Pod join date, date when you were last active, IP address, carrier and Pod app version. Device (mobile) information includes mobile device ID, manufacturer, model, operating system, device dimensions, advertising ID on an Android device, and IDs collected through cookies stored in the device.

4. What do we use your Personal Information for?

We will process your Personal Information for the following purposes, based on our legitimate business interest to operate the Pod platform in order to help our coworkers stay informed and integrate into Amcor Group. Your participation is voluntary and you can choose whether you would like to take part in the Pod or not.

1. Enable you to access and use the Pod, including by storing your Personal Information. We want to better integrate and inform you about Amcor Group, and help you stay up to date about events we plan, learn about other interesting topics related to your job, through published content, which will be created by coworkers themselves (we will call these coworkers "Channel Contributors") or by our communications team. We will use your Personal Information to identify you as one of our coworkers so you can access the Pod and use its features (such as interact with published content through comments). This will include storing your credentials as well as your published content and comments to make these available to you through the Pod.
2. Create targeted channels to deliver content to you. We will create channels within the Pod, where we will group you with your closest coworkers and/or coworkers that have similar professional profile (e.g., they have the same job title, similar length of service, same insurance plan, etc.) as you do to allow us to better target content on the Pod to your interests;
3. Generate reports on your use of the Pod. Generated reports that will help Amcor understand what content is successful, by counting number of reads/clicks/comments;
4. Email or otherwise notify you of content available on Pod. We may send you links by email and as well as through push notifications if you enable these on your device, with content posted on Pod, which we think would be interesting for you.
5. Determine your location and use it to target certain information relevant for that location. When we would like to notify coworkers in certain city/state/country/region only, we will use your IP address to determine your location to help us target such communications.
6. Provide a translation of content/comments on the Pod platform in your preferred language. When you would like to understand a comment your coworker from a different country wrote in their native language, we will offer a corresponding machine translation into the language you have chosen for your use of the Pod.
7. Assess answers to polls. We may ask your opinion on various Amcor matters and for feedback on specific Amcor issues, such as new policies and decisions we make. We will not produce reports on how each individual coworker voted, but rather how many voted and what was the proportion of answers to ensure you can vote in the polls freely.

1. Remove offensive content/comments from the platform. We will remove such content/comments if this has been flagged by a coworker. We will also ask the Channel Contributors to keep an eye on the comments related to the content they have published. We will also screen for offensive words, which will also be automatically flagged to our communications team for the review and replaced with musical notes by the Pod.
2. Ensure compliance with internal policies, regulations and applicable laws. We may seek further action against coworkers who post offensive content/comments or otherwise breachDigital Communications Policy, Corporate Code of Conduct and Ethics and other internal Amcor policies and regulations, as well as any applicable laws. We will also use your Personal Information from the Pod if required to do so by applicable laws and to bring, respond and defend against legal claims, as necessary.
3. In Connection with Corporate Transactions. If we or one of our entities are acquired by another entity, we will share your Personal Information with that entity.

5. How long do we keep your Personal Information?

We keep your Personal Information as long as reasonably necessary to fulfil the purposes for which your Personal Information is collected and processed and to comply with legal obligations or for the establishment, exercise or defense of a legal claim, in accordance with Applicable Data Protection Laws.

In particular, we will keep your Personal Information for as long as you have a Pod account and you remain a coworker of Amcor, and for the period of no longer than three months after you decide to close your Pod account or no longer work for Amcor, unless there is a legal obligation or other lawful basis for us to retain Personal Information for longer. After this time, your Personal Information in Pod will be erased and/or anonymized.

6. Who do we share your Personal Information with?

Amcor takes precautions when sharing Personal Information with Amcor Group legal entities (i.e., intra-group) and with other third parties.

1. Intra-Group. We will share your Personal Information collected within the Pod platform within the Amcor Group. In particular, coworkers from our communications team will have access to all your Personal Information on the platform, for all the purposes specified in Section 4 of this Notice. Please note that the content you post as Channel Contributors, or any comments you make as a regular user of the Pod will be visible to other coworkers in the Amcor Group and they will be able to associate such content and comments with you.
2. Third Parties.
3. 1. Service Providers. We disclose Personal Information to our service providers that have been duly selected by Amcor to help us with running certain aspects of the Pod on our behalf. This includes Social Chorus, Inc., which helps us facilitate the entire Pod platform and its functionality and run its features (such as automated offensive words flagging and replacement), and other IT service management and hosting providers which help us store your Personal Information, as well as provide machine translations of content/comments on the Pod; and data analytics providers, which help us understand what content is successful and optimize the Pod experience for you. The service providers engaged by Amcor only use Personal Information to provide the requested services to Amcor.
   2. Law Enforcement, Courts and other Authorities. We will also disclose Personal Information when required to do so by law, such as in response to a lawful subpoena, including to law enforcement agencies, tribunals and courts in countries where we operate.
   3. Acquiring Companies. We will disclose Personal Information to buyers, their lawyers or professional advisors, courts, tribunals, opposing or other related parties to the proceedings and their

professional advisors, where needed to affect the sale or transfer of business assets, to enforce our rights and to protect our property or assets.

7. Where will my data be transferred and how is it safeguarded?

Due to the global nature of our operations, some of the Amcor Group companies and our service providers are located in countries outside the country of your employment.

1. Intra-Group. Personal Information processed in the Pod will be available to Amcor staff in countries where Amcor Group companies have offices. In particular, all such Personal Information will be accessed by our coworkers from the communications team in Switzerland, US, Singapore and Belgium. Personal Information protections outside the country of your employment take place on the basis of our intra- group Global Data Transfer Agreement, as appropriate. This agreement includes standard data protection contractual clauses (including as adopted by the European Commission) for transfers outside the EEA, UK and Switzerland.
2. Third Parties. Some of the members of our service providers, with whom we share Personal Information may also be located outside the country of your employment, including the US.
   If you are located in the EEA, UK and Switzerland, such transfers will take place using a data transfer mechanism in accordance with specific local requirements, such as under the standard contractual clauses for data transfers (see here).
   When transferring personal data to any other third parties, we will ensure an appropriate transfer mechanism under Applicable Data Protection Laws is in place, if necessary.
3. For more Information. Please write to [e-mail],if you want to receive further information or, where available, a copy of the relevant data transfer mechanism.

8. Your Data Subjects Rights

Subject to the conditions set by Applicable Data Protection Laws, you may be able to exercise certain rights regarding your Personal Information.

If you are located in EEA, Switzerland and/or UK, you have specific rights when it comes to the processing of your Personal Information by us. You have the right to be informed about our processing of your Personal Information, access and receive a copy of it, and have your Personal Information rectified if it is inaccurate or incomplete.

Under certain circumstances, you can request your Personal Information to be erased, ask us to restrict (stop any active) processing, and object to it on grounds relating to your specific situation.

You may also ask to receive your Personal Information that you have provided to us in a structured, commonly used and machine-readable format and have the right to transmit that it to others (data portability). You have the right to lodge a complaint with data protection authorities if you believe your rights have been breached.

We may ask for your consent with installing the Pod app or storing and accessing information on your device. You are free to withdraw your consent at any time without any adverse negative consequences to you as a coworker. In such case, withdrawing the consent would not allow us to offer you access to the Pod via the app. The lawfulness of our actions based on the consent, which occurred prior to the withdrawal will not be affected.

9. Contact Details

If you wish to exercise any of the aforementioned rights (see Section 8) or if you have any questions regarding this Notice, the roles and responsibility of any of the Amcor Group legal entities (e.g., where they act as joint controllers including their arrangement), please direct your request to your HR manager or to [e-mail] of all Amcor Group addresses is available here.