Workplace Terms of Use

Update: August 2022

You have been invited to Workplace, a Meta owned collaboration and communication platform provided to you by GSK to facilitate business communication and collaboration amongst employees, complementary workers, and select third party organisations.

As a Workplace user, you may join groups most relevant to you, use the news feed to stay informed, share and communicate information with your colleagues and team members in real-time and collaborate with people from select third party organisations in multi-company groups.

While Workplace looks like the Meta service which many of us use in our personal lives, Workplace accounts are distinct from any Meta personal account. As explained in the GSK Privacy Notice, GSK will share with Meta specific personal information to create your Workplace user account and user profile. It is completely up to you to modify your user profile and to submit or upload additional information, including any personal information.

To keep GSK Workplace efficiency as communication channel and avoid unnecessary duplication of Global information, creation of a group with more than 250 people must be subject to formal authorization from the communications team.

GSK reserves the right to close, without notice, groups created which do not respect this rule or are set up for a use that does not comply with our terms of use.

Any information you post or share on Workplace may be globally visible to GSK and other Workplace users. Follow these principles when you use Workplace or create or respond to material on Workplace:

1. Write Right: Make sure that what you post or share reflects that you are thinking and acting ethically with no room for misunderstanding. For further guidance, please refer to the Write Right principles on Nucleus (Intranet) or this article on Write Right in Workplace

2. Be safe: Information posted on Workplace should be treated as company shared information, which may be confidential in nature, remember third parties may see it. Do not post or share GSK Critical and Sensitive Information (CSI), do not post or share links from unknown or untrusted sources that could pose a threat to GSK and do not post or share content that contains or reflects your Sensitive Personal Information.

3. Be smart: Use GSK’s Code as a guide and comply with GSK’s policies and procedures, and applicable laws. We must all take care and use judgment when communicating using company channels because what we say and do can be attributed to GSK. Do not post or share content which may be legally privileged and always keep in mind that this is a business platform.

4. Be fair: Only post or share content that you created or have obtained the necessary licenses, rights, or permissions from the original creator to publish (including images, audio or video clips). If you create an audio or video clip, only post it if you have the right to use the image, voice, attributed statements and likeness of featured individuals. If in doubt, please refrain from posting.

5. Be respectful: Be professional and respectful. Harassing, spamming, repetitive, excessive or irrelevant posts to a channel, bullying, trolling, discriminatory or otherwise inappropriate content that violates GSK policies or local laws and regulations is prohibited. Remember that what you post or share can be viewed by a global audience.

6. Be mindful: Retain content that you have posted to Workplace that is subject to a Preservation Notice. If you have any questions on preservation or retention ask IGKay or contact LEGAL Preservation-Notice-Questions.

7. Be inclusive: We all play a part in ensuring GSK is an inclusive workplace. As part of our commitment to accessibility the content you post needs to be accessible to all in GSK. This means, for example, that all videos posted on Workplace must include closed captions. Workplace has the technical capabilities to provide closed captions. GSK reserves the right to remove any video content which doesn’t include closed captions without warning.

Please note that Workplace content is like other types of content (such as presentations or memos) that you may generate in the course of your work in other ways. As such, the content you create and post on Workplace is owned by GSK, may remain on the Workplace platform and backups, and may be accessible even after your account is deactivated or terminated. GSK monitors Workplace activity, including private chats and secret groups, to protect GSK information, to ensure compliance with GSK policies, applicable law, and the correct use of the platform and to respond to comments or necessities identified in your comments.

When using Workplace, you expressly agree to follow all applicable GSK policies and your agreements with GSK, abide by these GSK Workplace Terms of Use (including the GSK Privacy Notice), and Meta's Workplace Privacy Policy, Acceptable Use Policy and Cookies Policy. Contact your manager or HR if you have questions about how GSK policies apply to Workplace.

GSK may remove content on Workplace that is offensive, inappropriate or in violation of these Terms of Use without prior notice to you. GSK may update these Terms of Use at any time and may post a notice regarding any significant updates. Your continued use of Workplace constitutes your agreement to these Terms and any updates.

GSK can also suspend users Workplace access without prior notice and place under moderation all groups to prevent or stop any Terms of Use breach.

GSK reserves the right to discontinue Workplace or to edit these User Guidelines without notice at any time.

Inappropriate postings or use of Workplace will be reported and may be subject to disciplinary action, up to and including termination.

Workplace users are expected to report abuse of this site and/or inappropriate or questionable ads by reporting the post to the moderator. Alternatively, users may contact their Manager, HR or if preferred, users may anonymously contact GSK Speak Up.

1. Click the *** or ‘down arrow’ in the top-right corner of the post, comment, group or chat (when viewed main screen on a desktop) to present a ‘drop down’ list.

2. Select ‘report post’ and state why you do not want to see this in Workplace then click Continue.

Additionally, GSK encourages everyone to speak up about misconduct, possible breaches of the Code of Conduct, or other company policies or procedures, and suspected violations of laws and regulations. If you see or hear something, say something, GSK is ready to listen. As described below, we have a number of options for internal reporting including your manager, HR, Compliance, Legal, and our Speak Up channels.

Coordination with Employee Relations and Industrial Relations processes

GSK maintains many forums and resources for employees to raise informal or formal concerns related to their employment and to communicate with the Company about terms and conditions or proposed changes. These include, but are not limited to, our information and consultation forums, our employee relations function in HR for handling grievances or potential policy violations, works councils, unions, and recognized employee representatives, and the various speak up channels. These forums are established under local law and/or agreement with employee representatives and they are fit for purpose. For example, they offer due process and transparency or confidentiality, as appropriate, to all the parties involved.

In contrast, Workplace is designed as a broad communication channel to share information within the Company. Of course, this can include employee questions, concerns, or employee feedback. However, Workplace is not designed as a forum or channel to resolve informal or formal concerns related to employment. And the Company will not treat it as such.

If an employee raises a concern on Workplace that is appropriate for resolution in another forum, the Company will take appropriate steps to ensure that the proper process for handling the concern is followed in a consistent fashion according to our standard process. Depending on the nature of the information posted on Workplace, this may also include removing posts or information that is inappropriate, for example, employee names or personal information or repetitive information that is being addressed separately or is irrelevant to the channel or topic of the post to which it is linked. This may also include moving the post to an appropriate ‘channel’ on Workplace, such as a country or business unit or topical page, where impacted or interested individuals may view it.

Finally, when a concern has been addressed through an appropriate process, such as a consultation or grievance process, and that has been communicated directly to the impacted individuals, or, where appropriate, their representatives, the Company, in its discretion, may determine that removal of subsequent, repetitive posts about the same topic is appropriate.

Buying and Selling on Workplace

Workplace may be used by GSK employees and Contingent Workers to advertise new or used personally-owned items for sale. Items for sale must not violate any company policy, guidelines or country laws. Advertisements for the following items, services, businesses and events are considered inappropriate on Workplace (this list may be expanded at GSK’s discretion and include additional items, business, service or event GSK deems inappropriate):

• Weapons or firearms of any kind (including ammunition, knives, bows, any miscellaneous weaponry or accessories regardless of the intent and purpose of the item)

• Alcohol/drink vouchers

• Illegal drugs

• Medication (prescription or non-prescription)

• Food items

• Airline tickets

• Animals sales (however, you may post an ad to find a new home for an animal without any monetary compensation)

• Bootleg recordings

• Any commercial venture, including but not limited to:

o Multi-level marketing businesses (e.g., Tupperware, Plexus, Mary Kay, Avon) GSK may need to delete as these businesses may not be globally recognized

o Professional services (e.g., physicians, mechanics, consultants, resume writers, mortgage agents, real estate agents, breeders)

o Personal services (e.g., babysitting, tutoring, house cleaning, landscaping, snow removal)

o Sale of personally made goods and products (e.g., photography, woodworking, knitted items, crafts, jewelry)

• Commercial real estate property for sale, lease, or sublease (however, you may post an ad about your own residential property for sale, lease, or sublease)

• Non-GSK-sponsored fundraisers of any kind (e.g., selling cookies or other items for a non-profit, a school, or a sports team; fundraising for a political, religious, educational, or personal cause; GoFundMe and other crowdsourcing fundraising ads; invitations to fundraising events or functions)

• Advertisement or information regarding non-GSK sponsored events (e.g., concerts, parties, sports games, tailgates, political events, religious events, etc.)

• Ticket sales for events (e.g., concerts, parties, sports games, tailgates, etc.) sold at higher price than face value

• Any illegal item or service

• Gambling

• Dating services

Please note that advertisements are not reviewed by a Workplace Administrator prior to posting. GSK does not accept any responsibility for the accuracy of the content posted in the ads. It is each Workplace user's responsibility to confirm the quality and value of an item prior to purchase.

If the item has been sold or the event has passed, the posting employee should delete the ad.

Ads older than 120 days will be deleted. Workplace Administrator reserves the right to edit or delete any ad at any time. Image content may be subject to size restrictions. GSK reserves the right to discontinue Workplace or to edit these User Guidelines without notice at any time.

Inappropriate postings will be reported to Employee Relations, and you may be subject to disciplinary action, up to and including termination.

GSK does not assume responsibility for the quality of goods and services, or transactions between buyers and sellers.

GSK Workplace Privacy Notice

Last Updated: July 2022

GSK is committed to protecting your privacy. This is how GSK processes, collects, uses and discloses the personal information relating to you as a user of Workplace:

1. What personal information does GSK collect about you?

To create your account and user profile on Workplace, GSK will process the following information about you:

• your basic information – such as name (including name prefix or title), MUDID;

• corporate contact information – such as work email address, work phone number(s); and

• corporate details – such as your occupation/position/role, office location (including country), line manager, department and division. GSK also gathers your username and corporate email address directly from your local GSK employer or associated company at the time GSK authenticates you as a user or when you access the platform.

When you use Workplace, GSK will also process the following information:

• (i) technical data such as: (a) information about the device you use to interact with Workplace (including the unique device identifier, hardware model, operating system and version, and mobile network information), and (b) information from your visits to Workplace (including the type of browser and operating system you use, access times, pages viewed, URLs clicked on, your IP address and the page you visited before navigating to Workplace); and

• (ii) other information you provide when you use Workplace, sign up for an account, complete or update your profile, create or share content, chat or communicate with other users or with us, post information or opinions, react to posts of others, such as event attendance; photos/videos; contact information, opinions and reactions. This can include information and metadata in or about the content you provide, such as the location of a photo (geolocation) or the date a file was created.

Please note that it is completely up to you to modify your user profile or submit or upload any information including personal information on Workplace and you can always choose not to do so. You should not share Sensitive Personal Information in Workplace.

Note also that GSK processes content, communications and information that other people provide when using Workplace. This may include information about you, such as when someone shares, uploads or comments a video or photo of you, sends a message to you, or uploads, syncs or imports your contact information.

2. How does GSK obtain your personal information?

GSK collects your personal information when monitoring our technology tools and services including Workplace. Otherwise, GSK collects your personal information when you provide it to us, for example when modifying your user profile and including additional information, when contacting us or Admins or Meta for support, when uploading information, posting, comments, “liking” posts or using emoticons.

GSK might receive your contact details from others, like your employer or your associated company, if for example you are a Complementary Worker.

Please note also that when you use Workplace, Meta collects and uses certain usage and functional information (e.g., IP addresses, browser and operating system types, and device identifiers) regarding how Users interact with Workplace through the use of uses cookies, pixel tags, local storage objects, and similar technologies in providing Workplace. Please refer to Meta’s Workplace Privacy Policy, Acceptable Use Policy and Cookies Policy for additional details. These activities are performed by Meta under its own policies.

3. How does GSK use your personal information?

GSK uses your personal information to:

• authenticate you when you are accessing Workplace. For this purpose, GSK will create you as a user of the Workplace platform;

• create your Workplace account and user profile;

• facilitate communication;

• allow you to use the technologies that might be necessary to enable and use Workplace;

• respond to and deal with your queries or requests;

• audit or analyse data (your trends and insights);

• help us improve Workplace and other GSK internal communications and collaboration services, and to help us understand how Workplace is used and improve its adoption;

• gather statistical data, analytics, trends and other high-level aggregated data derived from your use of Workplace in a form that does not directly or indirectly identify you to evaluate workforce sentiment, help us improve Workplace and other GSK internal communication and collaboration services. This aggregate data might be used by Meta also, to improve, support and operate Workplace and other products and services of Meta and the Meta Family of Companies, and to create and distribute reports regarding use of such products and services;

• comply with contractual and legal obligations, including retaining content that you have posted to Workplace that is subject to a Preservation Notice. If you have any questions, contact Legal Preservation-Notice-Questions@gsk.com;

• monitor your use of Workplace to ensure compliance with GSK policies and applicable laws;

• transfer your personal information on the terms established on this Privacy Notice;

• make in-product announcements about features or functionality related to Workplace;

• the extent necessary, to provide Workplace to you, for related support and improvement purposes of Workplace, GSK or Meta may use, copy, store, transmit, modify, display, perform and create derivative works of information uploaded into Workplace, which might contain personal information; and

• create and maintain backups.

4. On what basis does GSK use your personal information?

GSK uses your personal information on the following basis:

• for the legitimate interests of GSK, such as to help GSK operate and improve our communication channels, to make our communications with you more relevant and personalized to you, and to make them efficient and effective;

• to comply with certain legal and regulatory obligations of GSK; and

• in line with your consent, where required by local law.

Where required by local law, by agreeing to this Terms of Use and accessing Workplace, you expressly grant consent to process your personal information uploaded into and processed by means of Workplace. You also grant consent to transfer your personal information outside of your country, as described in the Terms of Use and in this Privacy Notice.

5. How long will GSK keep your personal information?

GSK will keep your personal information for as long as required to fulfil the purposes described above. GSK will also keep your personal information where GSK needs to do so in connection with legal action or an investigation involving GSK. Preservation notices are applied in Workplace and will override retention schedules.

6. With whom do GSK share your personal information?

GSK shares your personal information with members of the GSK group of companies; and the following third parties: (i) Meta Ireland Limited and its group of associated companies (Meta’s Affiliates), including the Meta Family of Companies as updated from time to time, which is working with GSK to develop and continually improve Workplace; (ii) GSK contracted suppliers of related services such as data retention and system suppliers; (iii) our professional advisors and auditors; and (iv) regulators, governments and law enforcement authorities, when required.

Please see this link for a list of our affiliates and their locations.

7. Transfers of your personal information outside of your home country

Your personal information is transferred by GSK outside the European Economic Area to its affiliated companies and GSK’s third-party suppliers in accordance with the purposes stated in this Privacy Notice. Those transfers can involve countries where additional requirements are needed to put in place to guarantee the protection of your personal information. Moreover, some of those countries can have data privacy laws that are not equivalent to the ones applicable to GSK as controller of the Personal Information under this service, or as protective as, the laws in your home country. Some of these countries are Singapore and United States.

GSK implements appropriate measures to assess and ensure that your personal information remains protected and secure when it is transferred outside the EEA or of your home country, in accordance with applicable data protection and privacy laws applicable to GSK and to GSK privacy principles. These measures include: (i) data transfer agreements implementing standard data protection clauses and provisions, and (ii) GSK’s Binding Corporate Rules. You can find more information about data transfer agreements here, and more information about GSK’s Binding Corporate Rules here.

8. Protecting your personal information

GSK uses security measures and technologies to help protect your personal information from unauthorised access, use, disclosure, alteration or destruction consistent with applicable data protection and privacy laws. GSK also manages content and personal information with confidentiality controls appropriate to the context, in accordance with local laws, and after appropriate consultation.

9. Your rights

You may update your Workplace profile information and content online and may be entitled to:

• ask GSK about the processing of your personal information, including to be provided with a copy of your personal information;

• request the correction and/or deletion of your personal information (It typically takes about 90 days to delete an account after account closure, but some information may remain in backup copies for a reasonable period of time);

• request the restriction of the processing of your personal information, or object to that processing;

• request receipt or transmission to another organization, in a machine-readable form, of the personal information that you have provided to GSK; and

• complain to your local supervisory authority if your privacy rights are violated, or if you have suffered as a result of unlawful processing of your personal information.

You are given the option to share personal information with us, and you can always choose not to do so. If you object to the processing of your personal information, GSK will respect that choice in accordance with our legal obligations. This could mean that you are unable to use Workplace. GSK may continue to process your personal information to the extent required or otherwise permitted by law, for example in connection with our obligations under rules on preservation notice requests.

If you would like to exercise your rights, please let us know by getting in contact via your local HR function, or by accessing the tools provided by Workplace for this effect (for example, editing your profile information).

10. How does GSK update this Privacy Notice?

From time to time, GSK will update this Privacy Notice. Any changes become effective when GSK posts the revised Privacy Notice on Workplace. This Privacy Notice was last updated as of the “Last Updated” date shown above. If changes are significant, GSK will provide a more prominent notice to let you know what the changes are.

11. Contact us

If you have questions or requests about the processing of your personal information please get in contact via your local HR representative. If you see inappropriate content you can report specific comments to the Workplace administrator online.

12. Data controller

GlaxoSmithKline Services Unlimited, 980 Great West Road, Brentford Middlesex TW8, is the controller of your personal information on Workplace. To contact our UK data protection officer, please see Privacy contact information for details.