Consistent Global Standards

Since we established our global privacy program in 2001, we have worked to implement and uphold consistent global privacy standards to provide assurance for how we manage our privacy and data protection obligations across countries and regions and to support our certifications. There are many privacy regulations and frameworks that have existed over time, and below is a non-exhaustive list of the Company’s past and current regulations and certifications (an * next to a regulation means it is no longer applicable):

• US-EU Safe Harbor (2001)*
• US-Swiss Safe Harbor (2009)*
• APEC Cross Border Privacy Rules (2013)
• EU Binding Corporate Rules (2016)
• US-EU Privacy Shield (2016)*
• US-Swiss Privacy Shield (2018)*
• EU General Data Protection Regulation or GDPR (2018)
• EU-U.S. Data Privacy Framework (DPF) program, the UK Extension to DPF and the Swiss-U.S. Data Privacy Framework program (2023)

Each of our certifications is based on our Cross Border Privacy Rules Policy

Merck & Co., Inc., Rahway, NJ, USA, which has a tradename of MSD outside of the U.S. and Canada’s privacy program, described in this privacy statement, complies with the Cross-Border Privacy Rules system (CBPRs). More information about the CBPR system can be found here. To view our certification, please see the CBPR System Directory. For more information on the scope of our participation, or to submit a privacy inquiry through BBB National Programs, our Accountability Agent, please click on the official seal below:

Transparency

We recognize that it can be difficult and overwhelming for people to understand all of the different ways that information about them can be observed, sensed, collected, shared, used, analyzed and transferred, so we use a variety of approaches to support our goal of making our practices transparent both to people about whom we process information as well as the regulators and their agents who review our practices. Key examples include:

• Online Privacy – our Internet Privacy Policy describes the ways in which we process information about people online;
• Tracking Technologies – our Global Online Tracking Policy describes the ways in which our web sites and online services use cookies and other online trackers;
• Contextual Notices – which we provide at the time you use or participate in our services.
• Comprehensive Privacy Notices – these are intended to provide a thorough perspective on how our privacy practices apply to specific stakeholders.;