Last Update: 10/15/2024

The present Privacy Notice is applicable to ZimVie´s Speak Up channel (whistleblowing scheme) that allows us to receive and, if applicable, manage, investigate and take actions regarding any information or complaint received about any alleged irregularity or act contrary to the law, ZimVie´s internal regulations and policies or industry practice as detailed in our website – Speak Up section (hereinafter, the “Speak Up Channel”). 

1.  Who is the data controller of the personal data related to Speak Up Channel? Is there a data protection officer? 

The ZimVie Group entities listed in the following link: Privacy Notice (zimvie.com) (hereinafter, jointly “ZimVie”) are the joint-controllers for the processing of your personal data through the Speak-Up Channel. Notwithstanding this, the data received through the Speak Up Channel will be accessed by the ZimVie Group entities and joint-controllers on a strictly "need to know" basis and limited only to what is necessary to carry out the relevant investigations.

The contact address of the joint controllers for the purposes of this Privacy Policy (and in case of any questions about joint-controllership regime and its operation) and the appointed data protection officer is the following:  you are based in the EU or EEA privacy.emea@zimvie.com or dpo.germany@zimvie.com if you are based in Germany; in North America privacy.nam@zimvie.com; or APAC privacy.apac@zimvie.com.

2.  What data do we process and how do we obtain them?

A. If you are the person filing the complaint / providing the information (hereinafter, the “Whistleblower”):

You can use the Speak Up Channel without identifying yourself directly and remaining anonymous, either completely (neither ZimVie nor the platform provider will know your identity) or exclusively towards ZimVie (only the platform provider will know your identity). In case you decide to remain anonymous towards ZimVie, you may be contacted by our provider managing the Speak-Up Channel Convercent, Inc., to confidentially gather some additional information about the complaint, yet it will not reveal your identity to ZimVie.

In any event, personal data may be collected directly from you, or from witnesses or any third party involved in the investigation. These data may include identification data (i.e. name, surname and contact details), economic data, commercial data, professional data (i.e. professional role, department, tasks, employment data), as well as any information that is the subject of the investigation or that is included in the description of the facts of the complaint. While special categories of data (such as health data, data concerning person’s sex life or sexual orientation, sanctions & infringements, etc.) would not generally be processed, depending on the information and investigation exceptionally it may be required.

B. If you are a person under investigation, witness or any third party involved in the investigation:

Your personal data may be collected directly from you, from the Whistleblower or from individuals involved in the investigation. These data may include identification data (i.e. name, surname and contact details), economic data, commercial data, professional data (i.e. professional role, department, tasks, employment data), as well as any information that is the subject of the investigation or that is included in the description of the facts of the complaint. While special categories of data (such as health data, data concerning person’s sex life or sexual orientation, sanctions & infringements, etc.) would not generally be processed, depending on the information and investigation exceptionally it may be required.

3.  What are the purposes for the processing of your personal data? What are the applicable lawful bases for such processing?

Your personal data will be processed for the sole purpose of managing the Speak Up Channel and complaint / information received, investigating and taking action in relation to complaints received through ZimVie´s Speak-Up Channel. This includes ensuring the protection against any reprisals towards the Whistleblower or towards other persons such as facilitators, colleagues or relative of the Whistleblower who are also in a work-related connection with the reporting person’s employer or customer or recipient of services; taking corrective action or any other action relevant to the specific misconduct/illegal conduct (e.g. informing the competent authorities, disciplinary actions, etc.); and complying with applicable regulations and, in particular, those governing the protection of Whistleblowers, as well as providing our management board with reporting on the complaints received within the Speak Up Channel on an anonymous basis.

If you are an EU resident, we process your personal data in compliance with our legal obligations to the extent that we are legally obliged to establish such a channel (under local laws implementing Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law); or, for joint controllers voluntarily adhering to this Channel, on the basis of the public interest to prevent and detect misconducts and unlawful behaviors based on the same laws.

Please avoid providing us special categories of data unless strictly required for the handling of the relevant complaint. As the case may be, we will process it in accordance with the essential public interest recognized by currently applicable laws. Otherwise, we will erase them immediately.

4. Who are the recipients of your personal data?

Your personal data may be communicated to the competent judicial and administrative authorities, following the legal obligations of ZimVie. Such communication is always provided to the extent legally required.

Additionally, on certain occasions, ZimVie may communicate personal data received through the Speak Up Channel to other companies of the ZimVie Group and joint controllers on a "need to know" basis and limited only to what is necessary to carry out the relevant investigations, and third parties, such as external consultants, auditors or persons in charge of managing the processing of the data or investigation according to the instructions received by ZimVie (e.g. Convercent, Inc.).

5. Do we carry out international data transfers?

Please access our policy on transfer of personal data across national borders by clicking on this link.

If you are an EU resident, we generally process your personal data within the European Economic Area (EEA) and we procure to contract with service providers located within the EEA or in countries that have been declared as having an adequate level of protection. However, as explained below, certain processing of personal data necessary for the operation of the Speak Up Channel may be also carried out in the United States.

In those cases where we need to share your personal data with entities located outside the EEA in countries that haven´t been declared as having an adequate level of protection, we will adopt the appropriate safeguards in order to ensure the level of protection comparable to that of the European Union.

In particular, your personal data is shared with the entity Biomet 3i, LLC, based in United States, in order to ensure the aligned and coordinated operation of the Speak Up Channel in the ZimVie Group. Those joint-controllers subject to the General Data Protection Regulation 2016/679 have entered into the appropriate standard contractual clauses approved by the European Commission with Biomet 3i, LLC. Additionally, our Speak Up Channel platform provider Convercent, Inc., is also based in United States, processing the personal data on Biomet 3i LLC´s behalf in accordance with Biomet 3i, LLC and Convercent Data privacy agreement whereby Convercent agrees to adopt the required standards to ensure an equivalent level of protection for processed data. For further information, please contact ZimVie by means provided within the section “1. Who is the data controller of the personal data related to Speak Up Channel? Is there a data protection officer?”. 

6. For how long do we retain your personal data?

Your personal data will be processed only for as long as necessary to carry out the investigation (including legal proceedings, if applicable) and comply with our legal obligations including the obligation to keep the Speak Up Channel’s registry for no more than 10 years.

In any case, after 3 months from the reception of the complaint in the Speak Up Channel, the personal data will be erased if it is understood that, after examining the complaint, the investigation was not appropriate or when the investigation has not been initiated.

7.  Your data protection rights:

You may exercise your rights of access, rectification, erasure, portability, restriction of processing and, as the case may be, objection and/or withdrawal of consent in the terms and conditions provided under applicable data protection laws by addressing to the following email address: privacy.emea@zimvie.com for the EU or EEA; in North America privacy.nam@zimvie.com; or APAC privacy.apac@zimvie.com.

You can also file a complaint before the competent data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. The address of the European supervisory authorities can be found here.