Privacy Policy

 

Version en français disponible ici. 

 

Protecting Your Personal Information

UKG Inc., comprised of Ultimate Software, Kronos and its Subsidiaries, including PeopleDoc (collectively, "UKG", "we" and/or "us") are committed to protecting the privacy of the individuals who visit our website ("Visitors") and individuals who use UKG's Services ("Users" and/or "you") as an employee or applicant of UKG or one of its customers.

 

1. Scope

1.1. What does this Notice Cover?

1.2. Which Privacy Notice is Applicable?

1.3. Links to Non-UKG Websites 

2. Sources of Personal Information

2.1. Website Visitors

2.2. Children

2.3. UKG Job Applicants and Employees

2.4. Customers' Information (and the information of their Employees and Job Applicants)

2.5. Mobile Application Users

2.6. Website Activity, Cookies and other tracking technologies

2.7. Social Media Features and Widgets

3. Use of Personal Information

3.1. Website Visitors

3.2. UKG Job Applicants and Employees

3.3. Customers' Information (and the information of their employees)

3.4. Website Activity, Cookies and other tracking technologies

3.5. Mobile application

4. Disclosure of Personal Information

4.1. Affiliates and Subsidiaries

4.2. Third Parties (Vendors/Service Providers)

4.3. Additional Disclosures

5. Transfers of Personal Information

5.1. International Transfers

5.2. Privacy Shield

5.3. APEC

5.4. Conflicting Language

6. Retention of Personal Information

7. Cookies and Other Tracking Technologies

7.1. What are cookies?

7.2. How can you manage the use of cookies?

7.3. Managing Flash Cookies

7.4. Managing Cookies Through Your Browser

7.5. Advertising and Analytics Cookies

8. Biometric Data

9. Data Subject Rights

9.1. Exercising your Rights

9.2. Web Visitors

9.3. Ultimate Software Job Applicants and Employees

9.4. Kronos Job Applicants and Employees

9.5. Our Customer’s Job Applicants and Employees

9.6. Denial of Requests

9.7. Dispute Resolution

10. Security

11. Enforcement and Verification

12. Changes to This Privacy Notice

13. Contact Information

14. California Residents - California Privacy Notice

 

1. Scope

This Privacy Notice ("Notice") describes UKG's privacy practices in connection with the use of UKGs websites, products, services, and any associated applications ("Services"). The Notice also provides information about the choices you have regarding the collection or use of your Personal Information ("PI") and the rights provided to you, including the ability to access or update information about you.

Back to the top

1.1. What does this Notice Cover?

The Notice applies to PI provided or collected through the use of UKG’s Services by customers, employees, job applicants and/or website visitors. For purposes of this Notice, PI means information collected by UKG, relating to an Identified or Identifiable natural person.

Back to the top

1.2. Which Privacy Notice is Applicable?

Our customer’s Notice applies when you:

  • Use a customer-branded sign-on page; and
  • Are an applicant creating a profile or applying for a position with our customer.

This Notice applies when you:

  • Use a UKG Software-branded sign-on page; and
  • Are an applicant creating a profile or applying for a position with UKG.

Back to the top

1.3. Links to Non-UKG Software Websites

UKG's websites might contain links to third-party sites for your convenience and/or information. When you access those links, you leave UKG's website and are redirected to a third-party site. UKG does not control third-party sites. The privacy practices of third parties might differ from UKG’s privacy practices. We do not endorse or make any representations about third-party websites. When you share PI with third-party websites, the third-party processing is not covered by this Privacy Notice. We encourage you to review the privacy policy of any website or company before sharing PI with them.

Back to the top

2. Sources of Personal Information

Information We Collect:
UKG collects PI from several different sources, including:

  • Directly from a website visitor, prospects, customers, applicants, or employee;
  • Directly or indirectly from website visitors, customers, vendors, service providers or other third parties; and
  • From your use, visit or activity on any of our websites or products.

Please review each of the sections below to learn more about how UKG collects PI, and what PI is collected.

Back to the top

2.1. Website Visitors

How do we collect Personal Information?
UKG collects PI about a website visitor when the visitor visits our website and when the visitor chooses to provide PI. For example, we collect information when you visit our website and when you contact us via our website, provide your email, phone or other similar information, such as the information that you provide when you sign up for a webinar.

What is collected?
The PI collected from a website visitor includes:

  • Name;
  • Company;
  • Job Title;
  • Address;
  • Phone Number; and
  • Email Address.

Back to the top

2.2. Children

How do we collect Personal Information?
We do not knowingly collect PI from children under the age of 13. If you are under the age of 13, please do not submit any PI to UKG. If you have reason to believe that a child under the age of 13 has provided his/her PI to UKG, please contact us in accordance with Section 13 of this Notice, and we will endeavor to delete that information from our databases.

Back to the top

 

2.3. UKG Job Applicants and Employees

How do we collect Personal Information?
UKG collects PI about a job applicant when an application for employment with UKG is completed. Additionally, UKG collects information about individuals who create a profile on our website, regardless of whether or not an application is completed.

If hired by UKG following an application, additional information is collected during the onboarding process and throughout the employment relationship. We may also collect information that you have voluntarily made public and/or shared on publicly visible accounts, such as social media platforms.

What is collected?
The PI collected from an applicant or employee of UKG includes, but is not limited to:

  • Personal Identifiers (Name, Address, Age, Date of Birth, Social Security Number);
  • Professional or Employment-related Information (Employment Record, Salary);
  • Education Information; and
  • Personal/Professional Contact Information.

Back to the top

 

2.4. Customers' Information (and the information of their Employees and Job Applicants)

How do we collect Personal Information?
When using our products and services, our customers are solely responsible for determining what PI is collected regarding their employees or job applicants. UKG processes information solely at the direction of its customers and has no direct relationship with the individuals (our customers' employees and applicants) whose PI we process. The information may be collected through our SaaS solution, by members of our support team who provide support to customers, or by subprocessors engaged by UKG to provide you with the Services. For employees of customers who use Kronos terminals with a biometric or finger scanning device for employee timekeeping, please see the Biometric Data Privacy section of this Notice.

What is collected?
The PI processed by UKG on behalf of our customers varies, but includes information such as company name, name, address, email address, time and attendance and schedule information, and Social Security Numbers. Please contact your employer or the company with whom you applied to learn more about the information they collect for use with UKG's products and services.

Back to the top

 

2.5. Mobile Application Users

How do we collect Personal Information?
UKG collects PI about a user of our mobile application when the user chooses to provide such information. We also collect information about you through the use of mobile analytics software.

What is collected?
Our mobile application may record information concerning how often you use the application, the events that occur within the application, aggregated usage, performance data, your location, the type of device used, and from where the application was downloaded. We do not link the information we store within the analytics software to any PI you submit within the mobile application.

Back to the top

 

2.6. Website Activity, Cookies and other tracking technologies

How do we collect Personal Information?
UKG collects information through the use of website tracking software, as well as from your use or activity on any of our websites, utilizing cookies and other tracking technologies.

What is collected?
The website tracking software automatically captures technical information that is stored in our server’s log files. For example, when you visit our websites, We and our partners store and access non-sensitive information from your device, such as cookies or a unique device identifier, and process PI such as your IP address, device manufacturer and model, the type of browser being used, the web pages visited, and the amount of time spent on our website.

To learn more about our use of Cookies and other tracking technologies, please visit our Cookies and Other Tracking Technologies section.

Back to the top

 

2.7. Social Media Features and Widgets

How do we collect Personal Information?
Our websites may include social media features, such as video links, “Like” buttons, and widgets such as “Share” buttons or interactive mini-programs, and may set a cookie to enable the feature to function. Social media features and widgets may be hosted by a third party or hosted directly on our websites. Your use and interactions with these features are at your discretion, and are governed by the privacy policy of the companies providing them.

What is collected?
These features may collect your PI such as your IP address and which website page you are visiting.

Back to the top

 

3. Use of Personal Information

Why we use your Personal Information:

UKG uses PI for several purposes, including:

  • To communicate with you regarding our products and/or services;
  • To fulfill the purpose(s) for which the information was collected/provided, including providing contractually-obligated products and/or services;
  • To improve our website, products and services , through testing, research, analysis and product development;
  • For security purposes, such as to prevent unauthorized access or disclosure, to maintain data accuracy, to protect the confidentiality, integrity and availability of your PI and to allow only the appropriate use of your PI; and
  • To comply with all applicable legal obligations.

Please review each of the sections below to learn more about how we use your PI.

Back to the top

 

3.1. Website Visitors

How do we use your Personal Information?
The PI you provide when using our website will be used in accordance with this Privacy Notice. We use your PI to fulfill requests for information about our products and services and to enable you to register and participate in events that we sponsor (including webinars)

Back to the top

 

3.2. UKG Job Applicants and Employees

How do we use your Personal Information?
We use PI of our job applicants and employees for legitimate human resource business purposes, such as:

  • Payroll administration;
  • Filling open employment positions;
  • Maintaining accurate benefits records;
  • Complying with governmental reporting requirements;
  • Performance management;
  • Provision of company network access;
  • Authentication of individuals; and
  • Security, health and safety management.

Back to the top

 

3.3. Customers' Information (and the information of their employees)

How do we use your Personal Information?
We use your PI to provide you with the services, which UKG is contractually obligated to provide to you, to improve these services or communicate with you about our products or services. For employees of customers who use Kronos terminals with a biometric or finger scanning device for employee timekeeping, please see the Biometric Data Privacy section of this Notice.

3.4. Website Activity, Cookies and other tracking technologies

How do we use your Personal Information?
In order to improve the content and format of our site, UKG uses website tracking software to automatically capture technical information that is then stored in our server’s log files.

UKG and its partners also utilize cookies and other tracking technologies to measure the preferences of our website visitors, analyze trends, administer the website, track users' movements around the website, and to gather demographic information about our user base as a whole. Please visit our Cookies section below to learn more.

Back to the top

3.5. Mobile application

How do we use your Personal Information?
UKG uses mobile analytics software to allow us to better understand the functionality of our Mobile Software on your phone. We do not link the information we store within the analytics software to any PI you submit within the mobile application.

Back to the top

 

4. Disclosure of Personal Information

We do not sell PI to third parties. Please review each of the sections below to learn more about how we might disclose your PI.

Back to the top

4.1. Affiliates and Subsidiaries

We might share your PI with our Affiliates and Subsidiaries in order to deliver a product or service or complete a task that you requested.

Back to the top

4.2. Third Parties (Vendors/Service Providers)

We might engage with third parties (vendors and/or service providers) in order to deliver a product or service (or perform certain functions such as enhancing and/or delivering our product and service offerings) or complete a task that you requested.

We have contracts with third-party providers (vendors and/or service providers) to perform certain functions on our behalf, and only at our direction. Our third parties are bound by confidentiality agreements, only have access to your PI to the extent necessary to provide these contracted services and are only permitted to process your PI in accordance with our instructions (and for the purposes we disclose).

Back to the top

4.3. Additional Disclosures

UKG might disclose your PI if we in good faith believe that such action is necessary to:

  • Comply with the law or with legal process;
  • Protect and defend our rights and property;
  • Protect against misuse or unauthorized use of our website; or
  • Protect the personal safety or property of our users or the public (among other things, this means that if you provide false information or attempt to pose as someone else, information about you may be disclosed as part of any investigation into your actions).

Other than as stated in this Privacy Notice, we will endeavor not to release your PI to unknown or unaffiliated third parties, and we will not cross-reference your PI with that of any other customer or entity.

Back to the top

 

5. Transfers of Personal Information

5.1. International Transfers

UKG complies with the EU General Data Protection Regulation regarding the transfer of PI from the EU to the U.S. For transfers of PI originating in the EU to UKG for processing by UKG Software in a jurisdiction other than a jurisdiction in the EU, the EEA, or the European Commission-approved countries providing 'adequate' data protection, UKG agrees it will (a) provide at least the same level of privacy protection for PI originating in the EU as required under the U.S.-EU and U.S.-Swiss Privacy Shield frameworks; or (b) use the form of the Controller-to-Processor Standard Contractual Clauses (“SCCs”) currently approved. In most cases, UKG will use European Commission-approved SCCs as a legal mechanism for cross-border PI transfers from the EU.

Back to the top

5.2. Privacy Shield

UKG complies with the EU-U.S. Privacy Shield Framework and the Swiss-U.S. Privacy Shield Framework (Privacy Shield) as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of personal information transferred from the European Union, the United Kingdom and/or Switzerland, as applicable. UKG has certified to the Department of Commerce that it adheres to the Privacy Shield Principles with respect to such information. To learn more about the Privacy Shield program, and to view our certification, please visit the Privacy Shield website.

UKG is responsible for the processing of PI we receive, defined as any operation or set of operations which is performed upon PI, whether or not by automatic means, such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction, it receives, under the applicable Privacy Shield Framework, and, on occasion, subsequently transfers to a third party acting as an agent on its behalf. UKG complies with the Privacy Shield Principles for all onward transfers of PI from the European Union, the United Kingdom and/or Switzerland, including the onward transfer liability provisions.

With respect to PI received or transferred pursuant to the Privacy Shield Frameworks, UKG is subject to the regulatory enforcement powers of the U.S. Federal Trade Commission. In certain situations, UKG may be required to disclose PI in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

If you have an unresolved privacy or data use concern that we have not addressed satisfactorily, please contact our U.S.-based third party dispute resolution provider (free of charge) at https://feedback-form.truste.com/watchdog/request.

Under certain conditions, more fully described on the Privacy Shield website, you may invoke binding arbitration when other dispute resolution procedures have been exhausted.

Back to the top

5.3. APEC

UKG's privacy practices, described in this Privacy Notice, comply with the APEC Cross Border Privacy Rules System (CBPR). The APEC CBPR system provides a framework for organizations to ensure the protection of Personal Information transferred among participating APEC economies. More information about the APEC framework can be found here.

Back to the top

5.4. Conflicting Language

If there is any conflict between the terms in this Privacy Notice and the applicable adequate transfer mechanism for cross-border transfer of PI from the EU, Switzerland, or the United Kingdom to the United States (such as the Standard Contract Clauses or the EU-U.S. Privacy Shield or Swiss-US Privacy Shield), then the language specified in the adequate transfer mechanism shall govern.

Back to the top

 

6. Retention of Personal Information

UKG will only retain PI for the length of time necessary to fulfill the purpose(s) for which the information was collected or as required or permitted by applicable laws, (including the resolution of disputes) and in accordance with our customer contracts.

Back to the top

7. Cookies and Other Tracking Technologies

7.1. What are cookies?

A cookie is a small amount of data which our website stores on your computer, and which we can later retrieve. The cookie cannot be read by a site other than ours. As discussed in our section on Use of your PI, we use cookies for a number of administrative purposes, including to store your preferences, allowing us to provide website visitors with a better experience.

Back to the top

7.2. How can you manage the use of cookies?

UKG Privacy Center: When you visit our website, you can make choices about our usage of cookies, by navigating to the bottom of our website and clicking "cookie consent choices" or by clicking "Learn More" on the pop-up banner. You also have the option of viewing our existing partners and authorizing or blocking their collection and use of your PI.

Back to the top

7.3. Managing Flash Cookies

To manage Flash cookies, please click here.

Back to the top

7.4. Managing Cookies Through Your Browser

You can monitor our use of cookies on your computer by setting your Web browser to inform you when cookies are set, or you can prevent the cookies from being set entirely. The "help" portion of the toolbar on most browsers will tell you how to prevent your browser from accepting new cookies, how to have the browser notify you when you receive a new cookie, or how to disable cookies altogether. Please understand that if you disable the use of cookies on your computer, you may be unable to access certain portions or services on our websites.

Back to the top

7.5. Advertising and Analytics Cookies

We work with third parties to manage our advertising on other sites. These third parties might use cookies or other similar technologies to provide you advertising based upon your browsing activities and interests. We use standard Google Analytics for general site analytics. To learn more about how Google uses data from sites that use their services, click here.

We have also implemented the following Google Analytics Advertising features for our paid advertising:

  • Remarketing with Google Analytics;
  • Google Display Network Impression Reporting;
  • Google Analytics Demographics and Interest Reporting; and
  • Integrated services that require Google Analytics to collect data for advertising purposes, including the collection of data via advertising cookies and identifiers.

If you wish to opt-out of the Google Analytics Advertising features that we use, click here.

Back to the top

8. Biometric Data

As previously stated, UKG does not collect or control customer employee data. For customers who use Kronos terminals with a biometric or finger scanning device, the collection of customer employee finger scan data is undertaken and controlled by the customer. Our customers collect such employee data through their use of the finger scanning devices and related software, and either store the data at the customer-controlled site or on secure space (in accordance with applicable law) made available by Kronos in a cloud environment for that purpose. This data is used by the customer for employee verification in connection with its employee timekeeping purposes. Such data consists solely of templates created from mathematical algorithms, not fingerprints. customer employee finger scan data, or templates as described above, may be among the customer employee data collected or stored by Kronos customers. A copy of Kronos’ data security policy applicable to the secure space on which customers can store employee data can be accessed at: www.kronos.com/security. Kronos has put reasonable measures in place to minimize its access to customer employee finger scan data from its customers. On the rare occasions when Kronos accesses customer employee finger scan data (e.g. for technical support), it is done pursuant to a customer’s instruction, and subject to strict handling procedures, and Kronos permanently destroys such data promptly after the specific purpose for accessing the data has been satisfied. Customers are responsible for destroying customer employee finger scan data that they collect, control, possess or store. Any questions with regard to customer biometric or finger scan employee data, including any applicable retention schedule or destruction process, should be directed to the appropriate employer.

Back to the top

9. Data Subject Rights

UKG will take reasonable steps to ensure that all PI of UKG employees, job applicants and website visitors is accurate and complete for the intended use. As previously stated, we will only use PI in ways that are consistent with the purposes for which it was collected, as required or permitted by law, or as you might subsequently authorize.

In accordance with all applicable law, we enable you to exercise some or all of the following rights regarding our collection, use, and sharing of your PI:

    • Access the PI we maintain about you;
    • Update or correct any inaccurate or incomplete PI about you;
    • Request that we delete your PI;
    • Object to or restrict the processing of your PI;
    • Receive the PI you have previously provided to UKG, in a machine-readable format, allowing you to transfer that PI to another company at your discretion;
    • Not be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you; and
    • File a complaint directly with the relevant Supervisory Authority about how we process your PI.

Back to the top

9.1. Exercising your Rights

To protect your privacy and security, we take reasonable steps to verify your identity, before granting access to your PI. Please follow the instructions below based on your relationship with UKG, and provide the requested information to allow us to adequately address your request. We will respond to your request within a reasonable timeframe.

Back to the top

9.2. Web Visitors

If you are a resident of the European Union, Switzerland or the United Kingdom, and would like to request access to your Personal Information, and/or request erasure (right to be forgotten) of PI previously provided, you may submit your request via email at privacy@people-doc.com.

Back to the top

9.3. Ultimate Software Job Applicants and Employees

If you are a current or former employee of Ultimate and reside in the European Union, Switzerland or the United Kingdom, and would like to request access to your PI, and/or request erasure (right to be forgotten) of PI previously provided, you may submit your request via email at privacy@people-doc.com. In the email, please indicate which right you are exercising. In order to verify your identity, your request must include the following:

  • Your full name and email address associated with your profile;
  • Your preferred contact phone number; and
  • Your hire date, which can be found by current or former employees (up to one year following termination) within your profile, or on your offer letter. We require your hire date to be provided in the DD/MM/YY format.

If you previously applied for employment with UKG (job applicants) and reside in the European Union, Switzerland or the United Kingdom, and would like to request access to your PI, and/or request erasure (right to be forgotten) of PI previously provided, you may submit your request via email at privacy@people-doc.com. In the email, please indicate which right you are exercising. In order to verify your identity, your request must include the following:

  • Your full name and email address associated with your profile;
  • Your preferred contact phone number; and
  • The number of employment opportunities you have applied for with UKG, as well as the Job Title and Job Code associated with each application, which can be found in your profile, under the Applications tab.

Back to the top

9.4. Kronos Job Applicants and Employees

If you are a current or former employee of Kronos and reside in the European Union, Switzerland or the United Kingdom, reach out to your Kronos human resources contact to understand, access, change and/or control Personal Data that has been provided to Kronos in the employment context. If you previously applied for employment with Kronos (job applicants) and reside in the European Union, Switzerland or the United Kingdom, reach out to your Kronos recruiter or human resources contact, as applicable, to understand, access, change and/or control Personal Data that has been provided to Kronos in the job application context.

Back to the top

9.5. Our Customer’s Job Applicants and Employees

When processing PI on behalf of a customer, UKG has no direct business relationship with the individuals whose PI it processes (applicants or employees of our customers).

If you are a current or former employee or job applicant of one of UKG’s customers, please contact your employer/former employer/company you applied with directly to exercise your rights relating to your PI. As a processor, UKG does not respond to requests from our customer’s applicants or employees unless that customer is no longer in business.

Back to the top

9.6. Denial of Requests

UKG may deny a request relating to a Data Subject's individual rights as permitted by applicable law. UKG will endeavor to timely notify you regarding any decision and reason(s) for denial.

Back to the top

9.7. Dispute Resolution

In accordance with this Notice, UKG will investigate and attempt to resolve complaints and disputes regarding the use and disclosure of your PI. Additionally, UKG agrees to cooperate with Data Protection Authorities within the European Union and the Federal Data Protection and Information Commissioner in Switzerland, or authorized representatives for disputes specific to Human Resource information received from the European Union, the United Kingdom and Switzerland.

Any privacy-related dispute or concern that is still unable to be resolved to your satisfaction shall be handled in accordance with applicable dispute resolution procedures through our U.S.-based third party dispute resolution provider (free of charge) at https://feedback-form.truste.com/watchdog/request.

We strongly encourage you to raise any complaints you may have with regard to this Privacy Notice and/or our activation of this Notice to us prior to proceeding to the arbitration procedure described in the prior paragraph.

Back to the top

10. Security

To prevent unauthorized access or disclosure, to maintain data accuracy, and to allow only the appropriate use of your PI, UKG utilizes physical, technical, and administrative controls and procedures to safeguard the information we collect.

To protect the confidentiality, integrity, availability and resilience of your PI, we utilize a variety of physical and logical access controls, firewalls, intrusion detection/prevention systems, network and database monitoring, anti-virus, and backup systems. We use encrypted sessions when collecting or transferring sensitive data through our websites.

We limit access to your PI and data to those persons who have a specific business purpose for maintaining and processing such information. Our employees who have been granted access to your PI are made aware of their responsibilities to protect the confidentiality, integrity, and availability of that information and have been provided training and instruction on how to do so.

Back to the top

11. Enforcement and Verification

UKG will periodically assess its operations to validate compliance with this Privacy Notice.

When we have knowledge that one of our employees or third parties is using or disclosing PI in a manner contrary to this Privacy Notice, we will take reasonable steps to prevent or stop the use or disclosure. We hold our employees and third parties accountable for maintaining the trust that our customers place in us.

Back to the top

12. Changes to This Privacy Notice

This Notice describes our current PI protection policies approved on August 21, 2020. UKG reserves the right to modify or amend this Notice at any time consistent with applicable laws. We encourage you to periodically review this page for the latest information on our privacy practices.

Back to the top

13. Contact Information

At any time, you may contact Ultimate with questions or concerns about this Privacy Notice at privacy@people-doc.com.

Written responses may also be submitted to:


The Ultimate Software Group
Attention: Vice President of Privacy, Risk & Compliance
2000 UKG Way
Weston, FL 33326

Those residing in the EU may contact the Data Protection Officer (DPO) via email at privacy@people-doc.com. The DPO also serves as Ultimate Software’s representative in Europe and is located at:

The Ultimate Software Group
Attention: DPO
53 rue d’Hauteville
75010 Paris, France




Regarding Kronos, you may also contact privacy@kronos.com at any time. Written responses may also be submitted to:

Kronos Incorporated
Attn: Privacy Officer
900 Chelmsford St.
Lowell, MA 01851

Or, for those residing in the EU:

Kronos Systems Limited
Attn: Law Department
The Capitol Building
2nd Floor, South Wing
Oldbury, Bracknell
UK RG12 8FZ
Phone: +44 118 978 9784

UKG will respond to all correspondence within a reasonable timeframe, including as required by applicable law.

Back to the top

14. California Residents - California Privacy Notice

The California Consumer Privacy Act ("CCPA") provides certain privacy-related rights to California residents. Please click here to learn more about UKG’s privacy practices and compliance with the CCPA.

Back to the top

 

Last Updated: September 2020