Introduction
At Kyndryl we value your privacy and are committed to protecting and processing your personal information responsibly.
This privacy statement describes how Kyndryl collects, uses and shares your information. It applies to Kyndryl Corporation and Kyndryl subsidiaries except where a subsidiary presents its own statement without reference to Kyndryl’s.
We may provide additional data privacy information by using a supplementary privacy notice.
Personal Information We Collect and Use
This section describes the various types of information that we collect and how we use it.
Your information may be transferred to or accessed by Kyndryl subsidiaries and third parties around the world. Kyndryl complies with laws on the transfer of personal information between countries to keep your personal information protected, wherever it may be.
We have implemented various safeguards including:
Contractual Clauses, such as those approved by the EU Commission and accepted in several other countries. You can request a copy of the EU Standard Contractual Clauses (EU SCCs) by clicking Contact Us.
The APEC Cross Border Privacy Rules (CBPR) system that provides protection of personal information that is transferred among participating APEC economies as it pertains to online information collected through Kyndryl.com.
Controller and Representative Information
Kyndryl does business through its subsidiaries worldwide. The privacy laws in some countries consider a Controller to be the legal entity (or natural person) who defines the purposes for which the processing of personal information takes place and how that information is processed. Parties that are involved in processing operations on behalf of a Controller may be designated as Processors. Designations and associated obligations differ, depending on the jurisdiction.
Where this is relevant for the privacy laws in your country, the Controller of your personal information is Kyndryl’s main subsidiary in your country or region, unless Kyndryl or another Kyndryl subsidiary identifies itself as the Controller for a specific interaction with you.
The contact details of our main subsidiary of a country or region can be found by selecting your country or region and selecting Contact on the footer of Kyndryl.com websites. Kyndryl can be contacted at: Kyndryl Inc., One Vanderbilt Avenue, 15th Floor, New York, United States.
Where Kyndryl or a subsidiary it controls is required to appoint a legal representative, the following representatives have been appointed.
European Economic Area (EEA)
Kyndryl 1 B.V.,
Johan Huizingalaan 765, 1066 VH
Amsterdam, The Netherlands
United Kingdom (UK)
Kyndryl UK Limited,
100 Liverpool Street, EC2M 2RH
London, United Kingdom
Information Security and Retention
To protect your personal information from unauthorized access, use, and disclosure, we implement reasonable physical, administrative, and technical safeguard. These safeguards include role-based access controls and encryption to keep personal information private while in transit. When needed, we also require our Business Partners, suppliers, and third parties to implement suitable safeguards, such as contract terms and access restrictions, to protect information from unauthorized access, use, and disclosure.
We only retain personal information as long as necessary to fulfill the purposes for which it is processed, or to comply with legal and regulatory retention requirements. Legal and regulatory retention requirements may include retaining information for:
- audit and accounting purposes,
- statutory retention terms,
- the handling of disputes,
- and the establishment, exercise, or defense of legal claims in the countries where we do business.
We retain any contractual relationship information for administrative purposes, legal and regulatory retention requirements, defending Kyndryl rights, and to manage Kyndryl's relationship with you. The information that is provided in a supplementary privacy notice may provide more detailed information on applicable retention terms.
When personal information is no longer needed, we have processes in place to securely delete it, for example by erasing electronic files and shredding physical records.
Your Rights
You have certain rights when it comes to the handling of your personal information. The Contact Us form can be used to:
request access to the personal information that we have on you, or have it updated. Depending on the applicable law, you may have additional rights concerning your personal information.
ask questions related to this Privacy Statement and privacy practices. Your message is forwarded to the appropriate member of Kyndryl's Data Privacy Team, including the responsible Data Protection Officers.
submit a complaint to Kyndryl if you are not satisfied with how Kyndryl is processing your personal information.
Information about additional rights and when they apply can be found at Your Additional Rights. Your rights may be subject to limitations and exceptions resulting from applicable laws. For example, there may be situations where we cannot share certain information that you seek if disclosing this means disclosing information about others.
You may also have the right to complain to the competent supervisory authority. Contact details of Data Protection Authorities in the European Economic Area can be found here, and in the UK here. If complaints are not resolved to your satisfaction, you can also use the TRUSTe Feedback and Resolution System here, our independent US-based third-party dispute resolution provider. This service is provided free of charge.
For marketing communications, you can also submit an opt-out request, or select Unsubscribe at the end of each marketing email.
Legal Basis
In some jurisdictions, the lawful handling of personal information is subject to a justification, sometimes referred to as legal basis. The legal bases that we rely on for the lawful handling of your personal information vary depending on the purpose and applicable law.
The different legal bases that we use are:
We rely on this legal basis when we need to process certain personal information, such as your contact details, payment details, and shipment details, to perform our obligations or to manage our contractual relationship with you.
Examples:
- If you intend to purchase a product or service, we require your business contact information to enter into a contract with you or you may need to create a Kyndryl ID (see Your Account) to access a purchased product online.
- When fulfilling a contact, you may need to receive support services, for which we will need to collect your contact information.
- We need personal information to consider job applicants or manage the pension entitlements of retirees (see Recruitment and Former Employees).
Legitimate interests relate to being able to conduct and organize business, which includes the marketing of our offerings, protecting our legal interests, securing our IT environment, or meeting client requirements.
Examples:
We capture your use of, and interaction with our websites to improve them.
We process your Kyndryl ID (see Your Account) to manage access authorization of our services.
Where we have a contractual relationship with the organization that you are working for, we have a legitimate interest to process your personal information used to manage this contract.
We process your business contact information (see Your Account) in combination with other business-relevant information to tailor our interactions with you and promote our products and services. We may process your contact information together with details of a Kyndryl event you attended to develop Marketing and business intelligence.
We process the personal information of applicants based on our legitimate interest to source suitable talent (see Recruitment and Former Employees).
We have to keep our general business operations functional. To this end we may, for example, process the login information of our IT systems and networks, or CCTV footage at Kyndryl locations for security and safety purposes.
We may also process personal information where it is necessary to defend our rights in judicial, administrative, or arbitral proceedings. This also falls under the legal basis of legitimate interest in countries where they are not a separate legal basis.
We process personal information for credit protection, which is a specific legal basis under Brazilian law (LGPD) but is also covered under the legal basis of legitimate interest in other countries.
The processing is based on your consent where we request this.
Example:
the optional use of Cookies and Similar Technologies or email of Marketing materials.
Where we need to process certain personal information based on our legal obligation.
Example:
- We may be obliged to ask for a government-issued ID for certain transactions, such as for a financing transaction (see Contractual Relationship).
Privacy Statement Updates
If a material change is made to this Privacy Statement, the effective date is revised. By continuing to use our websites and services after a revision takes effect, it is considered that users have read and understand the changes.
Learn more about Kyndryl Privacy.
