DATA PROTECTION DESCRIPTION (EU GDPR compliant version) Effective Date: 13 September 2017

Transcription

1 DATA PROTECTION DESCRIPTION (EU GDPR cmpliant versin) Effective Date: 13 September 2017 Data File Name: Legal Basis fr the Prcessing and Purpse f Use f the Persnal Data: Custmer Cntact Data File Prcessing f persnal data ("Cntact Data") is generally and primarily based n legitimate interest f the data cntrllers. Based n defined purpses f uses f Cntact Data and relatinship between data cntrllers and data subjects, the primary legitimate interest f the data cntrllers is the pssibility t cnduct justified and legitimate business accrding t applicable legislatin. Secndarily, fr certain data subjects, the prcessing f Cntact Data is based n direct r indirect cntractual relatinship between data subjects and data cntrllers. Purpses f use: 1) Business develpment and reprting; 2) Quality management; 3) Research and develpment f prducts and services; 4) Research and develpment f KC Grup (Knecranes Plc and all its affiliate cmpanies) IT infrastructure; 5) Marketing activities; 6) Sales activities; 7) Custmer relatinship management ("CRM"); 8) Manufacturing f prducts; 9) Delivery f prducts and services (incl. access t KC Grup digital channels); 10) Invicing, taxatin and related financial transactins; and 11) Ensuring the integrity f KC Grup business envirnment and prcesses (incl. eventual nn-cntinuus system mnitring fr the preventin r inspectin f misuse as the case may require). Data Cntent: First name; Last name; Salutatin; Title; Cmpany (emplyer); Jb rle; Decisin rle; Street Address; Pstal Cde; City; State; Cuntry; Cntact Methd; Telephne number; Mbile phne number;

2 Telephne extensin; Fax number; address; Miscellaneus business infrmatin (free text field); Custmer survey cmmunicatin prhibitin; Preferred custmer survey methd; Membership in strategic custmer survey cntacts grup; Digital identity management system identifier; Indicatr f access t data cntrllers' digital platfrms; marketing cnsent; SMS marketing cnsent; Accepted data prtectin statement versin; General direct marketing inhibitin; Last data prcessing activity (time stamp); Gegraphical lcatin cnsent (if any); Ckie cnsent; Data request date (if any); Credit card number (if any); Credit card validity (if any); Web behavir infrmatin (depending n data subject's activity); Data Subjects: Regular Surces f Data: Regular Disclsures f Data and Transfer f Data t cuntries utside EU and/r EEA: Any natural persns representing custmer cmpanies f KC Grup. Custmer cntact persns themselves, ther persns representing the custmer cmpanies f KC Grup, emplyees and ther persns wrking fr r representing KC Grup. Cntact Data are nt disclsed (t anther cntrller fr independent use unless required by the law such as t authrities) regularly except within cmpanies f KC Grup and even then at all times in accrdance with applicable laws. Cntact Data are transferred utside EU and/r EEA (incl. Switzerland) nly as allwed by and in accrdance with applicable laws. In case f absence f EU Cmmissin adequacy decisins, EU Cmmissin standard cntractual clauses (f type cntrller t prcessr, EU Cmmissin decisin 2010/87/EU) are used as apprpriate r suitable safeguards fr these data transfers. Cpies f the standard cntractual clauses will be available thrugh the cntact details mentined belw. Furthermre, if EU Cmmissin adequacy decisins are applicable we may rely n them. If Cntact Data is transferred t external data prcessrs (subcntractrs r vendrs) apprpriate cntractual arrangements (Including EU Cmmissin standard cntractual clauses, as applicable), as required by the applicable laws, are executed t secure lawful and apprpriate prcessing f Cntact Data.

3 Cntact Data can be transferred t fllwing cuntries fr prcessing: Australia Austria Bangladesh Belgium Brazil Chile Peple's Republic f China Czech Republic Denmark Estnia Finland France Germany Greece Hungary India Indnesia Italy Japan Krea Latvia Lithuania Malaysia Mexic Mrcc Netherlands New Zealand Nrway Peru Philippines Pland Prtugal Qatar Rmania Russia Saudi Arabia Singapre Slvakia Slvenia Suth Africa Spain Sweden Switzerland Thailand Turkey Ukraine

4 United Kingdm United Arab Emirates Vietnam Security Principles f Data File: Cntact Data is prtected by technical and rganizatinal measures against accidental and/r unlawful access, alteratin, destructin r ther prcessing including unauthrized disclsure and transfer f Cntact Data. Such measures include but are nt necessarily limited t prper firewall arrangements, apprpriate encryptin f telecmmunicatin and messages as well as use f secure and mnitred equipment and server rms. Data security is f special cncern when third parties (e.g. data prcessing subcntractrs) prviding and implementing IT systems and services are retained. Data security requirements are duly bserved in IT system access management and mnitring f access t IT systems. Access t Cntact Data is available nly in the internal netwrks f KC Grup. Persnnel prcessing Cntact Data as part f their tasks is trained and prperly instructed in data prtectin and data security matters. Right t Object Data Prcessing: In accrdance with the law the data subject has at any time the right t: 1) Object the prcessing f Cntact Data fr the purpses f direct marketing, market research and pinin plls; and 2) On grunds relating t his r her particular situatin, bject the prcessing f his/her Cntact Data when lawfulness f prcessing is based n legitimate interest f the data cntrllers. In rder t use these rights, the data subject shall cntact the belw mentined cntact persns in writing (incl. ). Hwever, the request may be declined where allwed r required under the law. Other Rights f Data Subject: In accrdance with the law the data subject has at any time the right t: 1) Access the Cntact Data n him/her and at request, receive a cpy f the Cntact Data and related supplementary infrmatin cncerning Cntact Data prcessing as required by the law; 2) Request, prvided that the purpses f data prcessing allw: a. Inaccurate Cntact Data t be rectified; b. Incmplete Cntact Data t be supplemented; and c. Outdated r bslete Cntact Data t be erased. 3) Be frgtten by us, if: a. Cntact Data are n lnger necessary in relatin t the purpses f data prcessing; b. The data subject has bjected t the data prcessing pursuant t reasn explained abve in pint 2 f the sectin "Right t Object Data Prcessing" and there are n verriding legitimate grunds fr the data prcessing; c. The data subject has bjected t the data prcessing pursuant t reasn explained abve in pint 1 f the sectin "Right t Object Data Prcessing"; r

5 d. The Cntact Data have been unlawfully prcessed by us; 4) Restrict the prcessing f the Cntact Data n him/her if: a. Data subject cntests the accuracy f the Cntact Data; b. The prcessing is unlawful and the data subject ppses the erasure f the Cntact Data and requests the restrictin instead; c. The data cntrllers n lnger need the Cntact Data fr the purpses f uses, but Cntact Data are required by the data subject fr the establishment, exercise r defense f legal claims; r d. Data subject has bjected t prcessing pursuant t reasn explained abve in pint 2 f the sectin "Right t Object Data Prcessing" and pending the verificatin whether the legitimate interests f the data cntrller verride thse f the data subject; 5) Receive the Cntact Data cncerning him r her, which he r she has prvided t data cntrllers, in a structured, cmmnly used and machine-readable frmat and have the right t transmit thse data t ther data cntrller when the prcessing is necessary fr perfrmance f a cntract where the data subject is invlved; r 6) Ldge a cmplaint with a supervisry authrity (Finnish Data Prtectin Ombudsman); In rder t use these rights, the data subject shall cntact the belw mentined cntact persns in writing (incl. ). Hwever, the request may be declined where allwed r required under the law. Retentin Perid f Cntact Data: Prvisin f Cntact Data: Generally, t the extent permitted by applicable laws and regulatins, data cntrllers retain Cntact Data at mst ten (10) years after the last business activity where the data subject has been invlved. This retentin perid is justified due t data cntrllers' bligatins r needs related t e.g. prduct and service warranties, prduct liability statutes as well as burdens f prfs in pssible litigatin situatins. It is nt statutry fr the data subject t prvide the Cntact Data but certain Cntact Data is required t execute r enter int a business activity (such as business cntract) with KC Grup. Lack f r failure t prvide Cntact Data prevents r may prevent the business activity (such as business cntract) as the case may be. Data Cntrllers: 1) Knecranes Glbal Crpratin (Finnish Business ID ) Address: Kneenkatu 8 (P.O. 661), Hyvinkää, Finland Telephne: +358 (0) ) Knecranes Plc (Finnish Business ID ) Address: Kneenkatu 8 (P.O. 661), Hyvinkää, Finland Telephne: +358 (0)

6 Cntact Persn in Matters Related t Data File: Lasse Tivnen (Data Prtectin Manager) firstname.lastname@knecranes.cm Mailing address and telephne number as abve.