Privacy Policy and Calif. Privacy Rights

Privacy Policy and CCPA Policy  -- Effective Date 8.1.2024  

Privacy Policy 

Your data privacy is important to us.

This privacy policy (“Privacy Policy”) describes how Cleveland-Cliffs Inc. and our affiliates, to the extent this Privacy Policy is posted on their site or otherwise adopted by such affiliates, (collectively, the “Company”) collect, use, disclose, and otherwise process individually identifiable data about visitors to https://www.clevelandcliffs.com, or any other online platform where this Privacy Policy is posted (the “Sites”), or that otherwise interact with us or request services from us, such as our customers, prospects, distributors, sales representatives, vendors, investors, end users, and suppliers. References in this Privacy Policy to “we,” “us,” or “our,” are references to the relevant Company to which this Privacy Policy applies. These Sites contain links and references to other websites administered by unaffiliated third parties. This Privacy Policy does not apply to such third-party websites. When you click a link to visit a third-party website, you will be subject to that website’s privacy practices.

Please read this Privacy Policy carefully. By accessing or using our Sites you consent to our collection, use, sale, sharing, and disclosure of your personal data as described in this Privacy Policy. If any term in this Privacy Policy is unacceptable to you, please do not use our Sites or provide us with any personal data.

Residents of California have additional rights. See the section titled “What Do California Consumers Need to Know?” to learn more.

What Personal Data Do We Collect?

As a business to business (“B2B”) organization, we collect certain personal data or identifying information (referred to collectively as “personal data”) related to our commercial relationships. In connection with the operation of our Sites and businesses, we collect limited personal data that includes:

Personal data you choose to submit: Generally, you are not required to disclose your personal data as a condition of using the Sites. However, the Sites’ various registration forms, surveys, and some online services may request personal data from you that can identify you or your business, such as your individual contact information (such as your name, affiliation, employer, postal address, phone number, and/or email address), username and password for any portals provided on our Sites, and profile data (such as preferences that are linked to you). In many cases, you choose the amount of Personal data you supply (e.g., when sending us information through the Sites, you may choose to include only an email address for replies). There may be cases, however, where some of the personal data requested is identified as mandatory and some as voluntary. In such cases, if you do not provide mandatory personal data with respect to a particular activity on the Sites, you will not be able to engage in that activity.

Information we collect automatically: When you visit the Sites, certain information, some of which may qualify as personal data depending on your jurisdiction, is recorded in order to monitor and enhance your online experience. Such recorded information includes your IP address, the name of your internet service provider, the operating system and the type of browser you used, the date and duration of your visit, the name(s) of the visited page(s), and the amount of transferred data. This information may be collected through the use of online tracking technologies, such as cookies. For more information on how we use these technologies and the information we collect, see our Cookies Notice, which follows this policy.

How Do We Use Your Personal Data?

We collect or use the above categories of personal data for the following business or commercial purposes:

• Provide the products and services you requested, respond to your inquiries, and allow us to contact you;

• Perform our contractual obligations;

• Manage your accounts, maintain our business operations, and allow you access to our proprietary systems;

• Make our Sites more personal, intuitive, and easy to use;

• Protect the security and effective functioning of our Sites and information technology systems;

• Provide relevant marketing about our, or our affiliates’, products and services, or promotions that we are developing, and opportunities that may be available to you; and

• Address our compliance and legal obligations and exercise our legal rights.

Where we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to provide access to services and content available on the Sites. In this case, we may have to cancel a product or service you have with us, but we will provide you prior notice.

To Whom Do We Disclose Your Personal Data?

We disclose the personal data that we collect to the following categories of recipients for business or commercial purposes:

• Affiliates: We may disclose personal data to our affiliated group of companies, business partners, employees, and other parties who require such information to assist us with establishing, maintaining, and managing our business relationship with you;

• Service providers or contractors: We may disclose personal data to service providers or contractors to enable such parties to perform functions on our behalf and under our instructions in order to carry out the purposes identified above, such as marketing and web hosting;

• Auditors and advisors: We may disclose personal data to auditors for the performance of audit functions and advisors for the provision of legal and other advice;

• Business reorganization: We may disclose personal data to any corporate purchaser or prospect to the extent permitted by law as part of any merger, acquisition, sale of company assets, or transition of service to another provider, as well as in the event of insolvency, bankruptcy, or receivership in which personal data would be transferred as an asset of the Company;

• Mandatory disclosures and legal rights: We may disclose personal data if we have a good-faith belief that we are permitted or required to do so by law or legal process, to comply with any subpoena, court order or other legal process, or other governmental request, to defend against legal claims, or to protect our rights, property or safety or the rights, property or safety of others;

• Other: We may disclose personal data for any other purpose disclosed by us when you provide the information or with your consent.

Storage of your personal data outside of the United States and Canada: Your personal data may be transferred to or stored on servers in any country where we conduct business, which includes countries outside of the United States and Canada. By using our Sites, and products or services from these Sites, or otherwise providing personal data to us through the Sites, you understand that your personal data may be transferred to and/or stored in countries outside of your country of residence.

Automated decision-making: We do not use automated decision-making without human intervention, including profiling, in a way that produces legal effects concerning you or otherwise significantly affects you.

Legal basis of processing: Some jurisdictions may require that we provide an explanation of the legal basis for the collection and processing of your personal data. We have several different legal grounds on which we collect and process your personal data, including: (a) as necessary to perform a transaction (such as in order to provide the products and services you requested); (b) as necessary to comply with a legal obligation (such as when we use personal data for record keeping to substantiate tax liability); (c) consent (where you have provided consent as appropriate under applicable law, such as for direct marketing); and (d) as necessary for legitimate interests (such as when we act to maintain our business generally, including maintaining the safety and security of the Sites). With respect to legitimate interests, given that we are a B2B company, we typically collect and process limited personal data about customer contacts and other individuals acting in their business capacities as part of our overall effort to reduce the privacy impact on individuals.

Personal data about children: We do not direct our services or our Sites to children or individuals under eighteen (18) years of age, and, therefore, we do not knowingly collect or sell personal data of children. Individuals under the age of eighteen (18) should consult with their parent or guardian about the use of these Sites for their benefit. If you are a parent or guardian and believe we might have any personal data from or about your child, contact us at info@clevelandcliffs.com. If we learn we have collected or received personal data from a child without verification of parental consent, we will delete that personal data, unless we have a legal obligation to keep it.

What Choices Do You Have Regarding Marketing?

If you request information through the Sites and supply us with your email address or your name and postal address, you accept and agree that this information will be used for the purpose of providing the requested information and that we may use this data in the future to provide other information about us and our business partners that might be of interest to you.

If you no longer wish to receive any communications from us, remain on a mailing list to which you previously subscribed, or receive any other marketing communication, you can choose to not receive such communications at any time. Please follow the unsubscribe link in the relevant communication or contact us as detailed below.

What Security Measures Do We Have in Place to Protect Your Personal Data?

The security of your personal data is important to us. We will put in place appropriate technical, physical, and organizational or administrative measures to protect your personal data from accidental or unlawful disclosure or access, taking into account the state of the art, costs of implementation, and risk. Unfortunately, no method of transmission over the Internet or method of electronic storage is 100% secure. As a result, while we will strive to protect your personal data, we cannot and do not guarantee or warrant the absolute security of any of your personal data. You should not share your username and password with anyone, and you should not re-use passwords across more than one website. We will not be and are not liable for disclosures of your personal data due to errors in transmission, networks that we do not control, nor unauthorized acts of third parties.

How Long Do We Keep Your Personal Data?

For personal data that we collect and process for the purposes described above, we typically retain such personal data for so long as it is necessary to fulfill the purposes outlined in this Privacy Policy and as otherwise needed to address tax, corporate, compliance, litigation, and other legal rights and obligations. With respect to personal data used for direct marketing, we typically retain such personal data for as long as you accept marketing communications from us. We will also retain such personal data to process your choice not to receive such communications, and to maintain a record of your marketing choices.

What Should You Know About Third-Party Websites?

Our Sites may contain links, features, components, or other interactive tools supplied by third parties and third parties may reference or link to our Sites. Please be aware that you are providing your personal data to these third parties and not to Cleveland-Cliffs. This Privacy Policy does not apply to these third-party websites. We do not endorse, screen, or approve, and are not responsible for, the privacy practices or content of such other websites or applications. Providing personal data to third-party websites or applications is at your own risk. When you click a link to visit a third-party website, you will be subject to that website’s privacy practices. CLEVELAND-CLIFFS DOES NOT CONTROL AND IS NOT RESPONSIBLE FOR WHAT THIRD PARTIES DO IN CONNECTION WITH THEIR WEBSITES, OR HOW THEY HANDLE YOUR PERSONAL DATA. PLEASE EXERCISE CAUTION AND CONSULT THE PRIVACY POLICIES POSTED ON EACH THIRD-PARTY WEBSITE FOR FURTHER INFORMATION.

Is There Any Cross-Border Transfer of Your Personal Data?

We transfer personal data to various jurisdictions as necessary for the purposes described above, including to jurisdictions that may not provide the same level of data protection as your home country. We provide appropriate protections for cross-border transfers as required by law for international data transfers.

What Do California Consumers Need to Know?

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (Civil Code Section 1798.100, et seq.) and its implementing regulations (collectively, the “CCPA”), and “Shine the Light” laws provide you with additional rights with respect to our collection, retention, disclosure, sale, sharing, and use of your personal data.  This section on “What Do California Consumers Need to Know” supplements this Privacy Policy and applies solely to eligible residents of the State of California (“consumers” or “you”) as of January 1, 2023. Any terms used but not defined in this section have the same meaning as defined under the CCPA.

In this section, personal data means information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal data does not include deidentified, aggregated or publicly available consumer information, or information that is outside the scope of the CCPA (such as protected health information). This section takes precedence over the Privacy Policy with respect to your personal data for California residents if there is a conflict between the two.

1. Personal Data We Collect. Depending on how you have interacted with us and our Sites, we may have collected certain information within the following categories of personal data from you in the last twelve (12) months. The categories below are those identified under the CCPA.

• Identifiers: Such as name, postal address, telephone number, email address, username and password for our Sites, and IP address;

• Commercial information: Such as products or services purchased, obtained, or considered, other purchasing or consuming histories or tendencies, payment information, and transaction history;

• Internet or other electronic network activity information: Such as computer and connection information, statistics on page views, traffic to and from the Sites, ad data, and other standard weblog information.

1. Sources of Collection. The categories of sources from whom we collect the categories of personal data described in the above section titled “Personal Data We Collect” include the following:

• Directly from you: For example, from forms you complete or information you provide to us when you interact with us;

• Indirectly from you: For example, from observing your actions within our platforms or your interaction with our Sites from your device if the device is configured to allow such observations;

• Third-party partners: For example, we may receive information about you from our affiliates or other third parties we work with to market or provide you our products and services;

• Third-party applications: Including blogs, chat rooms, or support centers;

• Advertising networks; and

• Other companies or organizations: Such as market research firms or data aggregators.

1. Personal Data We Disclose: In the past twelve (12) months, depending on how you have interacted with us and our Sites, we may have disclosed personal data for a business purpose to the categories of third parties indicated in the chart below.

Cleveland-Cliffs does not knowingly “sell” or “share” personal data of consumers, as such terms are defined by the CCPA.

1. CCPA Privacy Rights: If you are a resident of California, the CCPA provides you with the following rights regarding your personal data, subject to certain exceptions:

   • The specific pieces of personal data we have collected about you;

   • The categories of personal data we collected about you;

   • The categories of sources from which personal data was collected;

   • The business or commercial purpose for collecting, selling or sharing personal data;

   • The categories of third parties to whom we disclosed the category of personal data for a business purpose.

• Right to Know and Access Your Information: You have the right to request information about our collection, use, and disclosure of your personal data concerning:

Please note that we may still use aggregated and de-identified personal data that does not identify you or any individual.

• Right to Delete: You have the right to request that we delete certain personal data about you that we have collected from you. We may not be able to fulfill your request if we (or our service providers) need to retain your personal data for certain authorized purposes, such as to provide a good or service you requested, to secure our services, to protect against fraud, to improve our services, or to comply with or exercise rights under applicable law.

• Right to Correct Inaccuracies: You have the right to request that we correct any inaccuracies in the personal data that we maintain about you.

• Right to Non-Discrimination: You have the right not to be discriminated against (e.g., through denying goods or services, charging different rates for goods or services, or providing a different level or quality of goods or services) for choosing to exercise any of your rights under the CCPA.

1. Exercising Your Rights Under the CCPA. To exercise the rights described above, please submit a consumer request to us by:

• Calling us at 1-800-284-1031;

• Emailing us at info@clevelandcliffs.com; or

• Sending us a request through our online request portal.

1. Authorized Agent and Verification. Only you or an authorized agent acting on your behalf may make a verifiable consumer request related to your personal data.

To protect your privacy, we may take steps to reasonably verify your identity (and if applicable, your agent’s authority to make the request on your behalf) before fulfilling your request to know, access, delete or correct. We will ask you to provide certain information to verify your identity, including your name, email address, and telephone number.

If you have an authorized agent who makes the request, then (i) we will need proof that you have provided the agent with power of attorney or (ii) you must provide the agent with signed permission to submit the request; you must verify your identity directly with us; or you must confirm with us that you provided the authorized agent permission to submit the request.

During the verification process, we will try to match the information you provided against known information in our databases. If we still need additional information, we also may contact you or your authorized agent by email or telephone number to ask you additional questions about the products or services you purchased or your last order with us, so that we can match your identity with the personal data we have about you. In some instances, we may ask you to declare under penalty of perjury that you are the California resident whose personal data is the subject of the request.

If we cannot verify your identity or sufficiently differentiate you from another consumer or cannot confirm an agent’s authority to act on your behalf, we are not required to fulfill your request.

1. Do Not Track Signals: Do Not Track (“DNT”) is a privacy preference that users can set in certain web browsers. Given the divergent practices of organizations that offer browsers and the lack of a standard in the marketplace, we do not respond to DNT signals at this time.

1798. California’s Shine the Light Law. Under California Civil Code Section 1798.83, California residents with an established business relationship with us can request information once a year about sharing their personal data with third parties for the third parties’ direct marketing purposes. If you are a California resident and would like to make such a request, please contact us as described in Section E, above.

How Will We Handle Changes to This Privacy Policy?

We may update this Privacy Policy from time to time as our services and privacy practices change, or as required by law. The effective date of our Privacy Policy is posted above, and we encourage you to visit our Sites periodically to stay informed about our privacy practices. We will post the updated version of the Privacy Policy on our Sites and ask for your consent to the changes if legally required.

How Should You Contact Us With Questions?

If you have any questions about this Privacy Policy, the practices on our Sites, your dealings with our Sites, or wish to exercise your choices under this Privacy Policy or data protection rights under applicable law with respect to our processing of your personal data, you may contact us at the following postal address, via the contact information for our Ethics Reporting Portal, or via e-mail at info@clevelandcliffs.com.

Cleveland-Cliffs Inc.

200 Public Square, Suite 3300

Cleveland, Ohio 44114

Ethics Reporting Portal

Web: https://secure.ethicspoint.com -- Enter “Cleveland-Cliffs” in the “Enter Organization Name” field

Telephone:   1-800-866-2416

Cookies Notice

This cookie notice (“Cookie Notice”) describes how Cleveland-Cliffs Inc. and its affiliates that publish this Cookie Notice on their online platforms (collectively, the “Company”) use online tracking technologies, such as browser cookies, when you interact with our website (the “Sites”). References in this Cookies Notice to “we,” “us,” or “our,” are references to the relevant Company to which this Cookies Notice applies.

What Are Cookies and Related Technologies?

A cookie is a small text file that is stored by your web browser when you visit a website. These cookies may store certain information, such as your location, IP address, and content viewed. We and our authorized third-party partners use cookies, web beacons, and other similar technologies (collectively, “cookies”) to learn more about how visitors use our Sites.

What Information Cookies Collect

Cookies allow us and our third-party providers to collect certain information so that we may understand an individual’s interactions with our Sites. For example, cookies on our Sites may collect information about pages visited, time spent on a given page, courses accessed, content viewed, features used, your search queries, click data, date and time of your visit, referrals to our Sites, and other data regarding your use of the platform.

Use of Cookies

We use the following types of cookies and technologies:

• Necessary cookies: These cookies are essential to enable basic functions on the Sites and make the Sites usable. For example, they enable basic functionality, such as security and website accessibility. Once you close your browser, these cookies disappear. The legal basis for our use of necessary cookies is our legitimate interest in being able to provide and maintain our Sites.

• Functional cookies: These cookies enable the Sites to save information about the look and behavior of the Sites based on information entered (such as language choices or your region) so that we can offer you more personalized functions. These cookies collect anonymous information and cannot track your movements on other websites. The legal basis for our use of functional cookies is an individual’s consent.

• Targeting cookies: These cookies record your visit to our Sites, including information about the pages viewed and links clicked, so that we may tailor marketing messages we send to the individual based on interests. We use targeting cookies to market only Cleveland-Cliffs products or services to you on our Sites. The legal basis for our use of targeting cookies is an individual’s consent.

Cleveland-Cliffs participates with affiliate programs where third party links, used by third parties to drive traffic to our website, track whether a purchase was made. The information collected includes purchase amount, invoice number, and date of purchase so that the affiliate receives an award based on the purchase amount as agreed.

The table below explains the cookies we use and why.

How To Manage Cookies

You can review your Internet browser settings, typically under the sections “Help” or “Internet Options,” to manage or disable cookies (except for strictly necessary cookies) at any time using your browser settings. Browsers are different, so you should refer to the settings menu of your browser for instructions on how to change your cookie preferences. If you disable or delete certain cookies in your Internet browser settings, you might not be able to access or use important functions or features of these Sites, and you may be required to re-enter your login details.

You can find information on how to manage cookie settings on certain browsers through these links:

• Cookies settings in Microsoft Edge

• Cookies settings in Firefox

• Cookies settings in Chrome

• Cookies settings in Safari

• Cookies settings in iOS

• Cookies settings in Android

To learn more about certain cookies used for interest based advertising by third parties, including through cross-device tracking and to exercise certain choices regarding such cookies, please visit the following:

1. Network Advertising Initiative (NAI) - The NAI provides detailed information about cookies, online advertising, and how consumers can opt out of interest-based advertising. (https://optout.networkadvertising.org])

2. Digital Advertising Alliance (DAA) - The DAA offers resources and tools for consumers to manage their ad preferences and opt out of interest-based advertising. (https://optout.aboutads.info/)

3. Google Ads Settings - Google allows users to control the ads they see and opt out of personalized advertising through their ad settings page. (https://adssettings.google.com/)

Within Canada, the local DAA organizations operate a similar “ad choices” scheme: see Your AdChoices (Canada) - The Digital Advertising Alliance of Canada (DAAC) provides resources for understanding online advertising and tools for opting out of interest-based advertising. (https://youradchoices.ca/)

How To Contact Us

If you have questions or concerns about the use of cookies on our Sites, please contact us at info@clevelandcliffs.com.

Privacy Notice for Prospective Employees Residing in California 

Effective Date: August 1, 2024

This Privacy Notice (“Privacy Notice” or “Notice”) applies solely to persons who have applied for or sought employment with Cleveland-Cliffs Inc. (the “Company”, “we”, “us”, or “our”) and who reside in the State of California at the time of the application (“Prospective California Employees” or “you”). We adopt this Notice to comply with the California Consumer Privacy Act of 2018 (“CCPA”), as amended by the California Privacy Rights Act (“CPRA”), and other California privacy laws (collectively, “California Law”). Any terms defined in the CCPA and CPRA have the same meaning when used in this Notice.

 I.            Information We Collect from Prospective California Employees

During the time you are a prospective employee, we collect and maintain different types of personal information (“Personal Information”), which is information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular Prospective California Employee, about you relating to your prospective employee relationship with the Company. In particular, we have collected the following categories of Personal Information from Prospective California Employees:

 II.            How We Collect Personal Information

We collect information that you give us directly when you complete your employment paperwork during the onboarding process, in certain contexts, enroll in employee benefits, or when you otherwise interact with us and provide Personal Information in the context of your employment.

Depending on the context of your interaction with us, we may collect information about you from our service providers with whom you provide your Personal Information, such as recruiters and third-party referrals.

 III.            Use of Personal Information

We may use your Personal Information for the following purposes:

• Job Applications: We use your Personal Information to process your job application you submit to us, to communicate with you, to verify employment references and referrals, to make employment decisions, to perform background screenings, to effectively process expense reimbursement requests, and, if hired, to establish and manage your employment relationship with the Company.
• Monitoring and Compliance: We use your Personal Information to maintain internal recordkeeping and oversight of the Company’s hiring decisions, and to comply and monitor compliance with internal policies and applicable state and federal labor, employment, and wage and hour laws.

 IV.            Disclosure of Personal Information

We may disclose the information we have collected about you, including Personal Information, as disclosed at the time you provide your information in the following circumstances:

• Service Providers: We may disclose your Personal Information with service providers, such as recruiters, pre-employment screening services, background check providers, and others.
• When You Agree to Receive Information from Third Parties: You may be presented with opportunities to receive offers or information directly from third parties. If you agree to have us disclose your Personal Information, we will disclose your Personal Information to such third parties. Please be advised that the third party’s own privacy policy may apply to its use of your Personal Information. If you decide that you no longer want to receive communications from a third party, you agree to contact that third party directly.
• Administrative and Legal Reasons: We may transfer and disclose your information, including Personal Information, to third parties: (i) to respond to subpoenas or other legal process or if in our opinion such disclosure is required by law; (ii) at the request of governmental authorities conducting an investigation; or (iii) to protect the personal safety, rights, property or security of any individual.
• Business Transfer: We may disclose Personal Information to our subsidiaries and affiliates for internal reasons. We also reserve the right to disclose and transfer all information including, without limitation, your Personal Information in connection with a corporate merger, consolidation, restructuring, the sale of substantially all of the Company’s stock and/or assets or other corporate change, including, without limitation, during the course of any due diligence process.
• Professional Financial and Legal Advisors: We may need to disclose Personal Information with our professional advisors, which includes lawyers, auditors, bankers, or other professional consultants for business purposes.

 V.            Selling and Sharing of Personal Information

We have not sold or shared Personal Information of our Prospective California Employees as those terms are defined by California Law; however, we may disclose your Personal Information as described in the Section above titled “Disclosure of Personal Information.”

 VI.            Data Retention

We may retain all categories of your Personal Information described above for as long as needed to carry out the purposes described herein or as otherwise required by applicable law. Unless we are required or permitted by law to keep your Personal Information for a longer period of time, when your Personal Information is no longer necessary to carry out the purposes for which we process it, we will delete your Personal Information or keep it in a form that does not permit identifying you. When determining the retention period, we take into account various criteria, such as when you request that we retain your Personal Information in your application for future consideration, the impact on our recruiting practices, mandatory retention periods provided by law and the statute of limitations, and our use of your Personal Information for aggregated employment market research.

VII.            Changes to Our Privacy Notice

We reserve the right to amend this Privacy Notice at our discretion and at any time and will post the date it was last updated at the top of the Privacy Notice. We (or the recruiter that you are working with) will provide additional notice if you accept an offer of employment.

VIII.            Contact Information

For more information regarding our privacy practices, please contact us at info@clevelandcliffs.com.  If you have any questions or comments about this Notice, the ways in which we collect and use your Personal Information, your choices and rights regarding such use, or wish to exercise your rights under California Law, please contact us at info@clevelandcliffs.com.