Privacy Policy

I. PURPOSE AND SCOPE

Morningstar DBRS¹ is committed to protecting the privacy of those with whom it interacts and it recognizes the need to respect and protect personal and non-personal information (herein referred to as “information”) that is collected or disclosed to us. This Morningstar DBRS Privacy Policy (“Policy”) explains: what information Morningstar DBRS collects, how Morningstar DBRS collects that information, how Morningstar DBRS uses the information, and who Morningstar DBRS may share the information with.

Morningstar DBRS collects certain information so that it may meet the needs of its customers. The information enables Morningstar DBRS to monitor and improve the services which it offers to current and potential customers.

Morningstar DBRS uses information in accordance with the Policy and applicable data protection laws, including the application of the General Data Protection Regulation (GDPR) for all residents of the European Union (EU). By accessing the Morningstar DBRS websites and other services, you agree and consent to Morningstar DBRS collecting, maintaining, using and disclosing non-personal information about you and provided by you as set out below.

^{_{1. Morningstar DBRS means DBRS Limited, DBRS, Inc., DBRS Ratings Limited, and DBRS Ratings GmbH.}}

II. WHAT INFORMATION DO WE COLLECT

Personal information is information that may include any factual or subjective information about an identifiable individual. Non-personal information is information that alone cannot be used to identify individuals. Such information includes, but is not limited to: domain names, type of device and browser used to access Morningstar DBRS Products (Section III.), demographic information, geographic information, and network providers.

Morningstar DBRS may collect internet protocol (IP) addresses which are a string of numbers assigned to a computer by an internet service provider. Such would be conducted in accordance to all applicable laws and pursuant to EU Regulation 2016/679 in reference to the GDPR.

Morningstar DBRS may also collect information on user behaviour/engagement, including but not limited to: the date and time of registration, usage session dates and duration, page views, features and functions used, preferences and settings selected, and responses to surveys.

When used in combination with other collected data, IP addresses and behaviour/engagement data may constitute personal information that can identify you.

III. HOW DO WE COLLECT THE INFORMATION

Morningstar DBRS collects information through its website, web subscriptions on dbrs.morningstar.com, Ratings Now, Viewpoint, and other Morningstar DBRS products, applications, platforms, and services such as issuers engaging Morningstar DBRS to assign credit ratings (herein referred to as “Products”).

Morningstar DBRS and its third-party service providers may collect information provided by a user or a user’s account administrator in situations such as, but not limited to:
• Registration for Morningstar DBRS Products, services, and events
• Setting-up portfolios, preferences, and notifications/alerts connected to Morningstar DBRS Products
• Logging into Morningstar DBRS Products and services through social media platforms
• Contacts with Morningstar DBRS customer support by email, phone, or other means
• Contacts with Morningstar DBRS employees by email, phone, social media, or other means
• Participation in surveys or questionnaires
• Online order forms
• Use of Morningstar DBRS Products
• Other interaction with Morningstar DBRS

Morningstar DBRS uses cookies, which are small files that are assigned to and stored in a user’s internet browser on a temporary (for the duration of the online session) or persistent basis (cookie stays on the computer after the internet browser or device has been closed). Cookies collect and store information about a user’s preferences, product usage, content viewed, and registration information which allows for Morningstar DBRS to provide users an enhanced and customized experience when engaging with our Products.

Morningstar DBRS may also use tracking and analytics tools, such as pixel tags, action tags, web beacons, and JavaScript amongst others to collect and analyze information on behaviour/engagement with our Products.

Morningstar DBRS may also collect business contact information (i.e., name, position and business email address of the relevant individual, and company) for all suppliers of Morningstar DBRS (i.e., office equipment, professional advisers).

Morningstar DBRS may also, to the extent required and/or permitted by applicable laws or regulations, monitor electronic communications (including email, SMS, social media communications, and instant messages) and retain such electronic communications in a manner and at locations at Morningstar DBRS’ discretion. By engaging in electronic communications with Morningstar DBRS, you are consenting to the monitoring and recording of such communications.

IV. HOW DO WE USE THE INFORMATION

Collected information, as well as cookies, tracking, and analytical tools are used to understand users’ interests, and engagement with our Products so that Morningstar DBRS can:
• Deliver Products, as well as, administer systems and accounts
• Provide customer support, product training, and education to users
• Send notifications and alerts in accordance with the user’s preferences and settings
• Customize content and layout of Product and services such as issuers engaging Morningstar DBRS to assign credit ratings
• Enhance Products and the user experience
• Develop new Products
• Keep users informed of research materials, events, promotions, surveys, and other content that may be of interest
• Create sales, marketing, and promotional plans and programs

The information collected by Morningstar DBRS is used primarily for internal purposes, some of which are mentioned above. Morningstar DBRS does not sell any data collected; however, it may be shared in accordance with this Policy where required by law or as otherwise detailed below.

V. WHO WE MAY SHARE THE INFORMATION WITH

Morningstar DBRS may share the information with the following:
• Applicable regulatory and government bodies
• External service providers and professional advisers that provide services to Morningstar DBRS and who adhere to this Policy, as assessed by its Data Protection Officer
• Any organisation at your request or any persons acting on your behalf, including your financial adviser, broker, solicitor or accountant
• Any authority to whom Morningstar DBRS is required to disclose such information by law

You agree to Morningstar DBRS using the information for the above-stated purposes. Where applicable, you also agree to Morningstar DBRS transferring your information outside the European Economic Area (EEA). Please note that Morningstar DBRS in the EU only transfers information to organisations outside the EEA if Morningstar DBRS has assessed the organization as having appropriate controls and safeguards in place to protect your personal information, as is required under the EU Regulation 2016/679 pertaining to the GDPR and applicable laws.

Customers’ and suppliers’ business contact information (i.e., name, position and business email address of the relevant individual, and company) may be shared with other Morningstar Group Companies. As a result, your business contact information may be processed outside of the EEA (e.g., for invoicing purposes or group company offerings). Such business contact information will remain protected in accordance with the applicable legal requirements. The Data Protection Officer oversees the methods by which such business contact information is stored, controlled and/or processed by Morningstar DBRS. The Data Protection Officer may be reached at privacy@morningstar.com, should you have any concerns or questions.

VI. ADDITIONAL INFORMATION

Disabling Cookies

Cookies can be disabled and cleared by adjusting internet browser preferences (refer to the browser provider’s website for instructions on changing preferences). Note that if cookies are disabled/blocked, this may limit your experience with our Products and potentially cause features to be inoperative or fail to operate as intended.

Questions

Please direct any questions or concerns regarding Morningstar DBRS 's Privacy Policy or practices to our Data Protection Officer at privacy@morningstar.com.

For EU and under GDPR, you have (subject to certain exceptions) the right to obtain copies of personal information which Morningstar DBRS holds about you and to inform Morningstar DBRS of any inaccuracy, including the right to be forgotten. Should you have any questions or concerns about settings and preferences on Morningstar DBRS Products, please contact Info-DBRS@morningstar.com.

Changes

Morningstar DBRS may change this Policy from time to time and any changes to this Policy will become effective when we post the revised Policy on this page. If you use this website or other services we provide to you after any revised versions take effect, your continued use of the Morningstar DBRS website, our Products and services shall constitute your agreement to the current Policy in effect.

Effective Date: February 14, 2025

Document Control Number: 20250213-027