Privacy statement Sekisui Eslon B.V. (website and online)

Introduction
Privacy is vital to Sekisui Eslon B.V. (hereafter: “Sekisui Eslon”). It uses personal databoth correctly and securely. In this privacy statement, it explains how itdeals with privacy, what data it processes and for what purpose. This privacystatement also includes information about the rights of data subjects.

Questions or complaints relating to privacy can be submitted to Mr R. Vlot. Data subjects may also contact the Dutch Data Protection Authority.

This privacy statement may be amended in the interim. The statement should be read on a regular basis to check for any amendments. This version was last amended on 23 May 2018.

Identity
Sekisui Eslon B.V. is: Sekisui Eslon B.V., a private limited liability company.
Metaalweg 7, NL-6045 JB Roermond, the Netherlands
Chamber of Commerce no. 13016183
Mr R. Vlot

What personal data are used?
Sekisui Eslon has data available that have been issued both by the data subjects themselves and by third parties.

An overview of the purposes for which Sekisui Eslon processes personal data is provided below.

Orders, financial and service

• Purpose:
• Dealing with questions (only on the initiative of a data subject)
• Data:
• Name, e-mail address, account number, telephone number, order number, details of the complaint
• Basis:
• Performance of the agreement
• Retention period:
• As long as necessary for this purpose

• Purpose:
• Financial administration (only in the case of an order)
• Data:
• Name, company name, invoice address, bank details (name of bank/IBAN/BIC), outstanding balance
• Basis:
• Performance of the agreement / legitimate interest / statutory obligation
• Retention period:
• Five years after the final order, but no earlier than ten years following the end of the current financial year

• Purpose:
• Invoicing (only in the case of an order)
• Data:
• Name or company name, invoicing address, Chamber of Commerce number, VAT number, client number, telephone number, e-mail address
• Basis:
• Performance of the agreement / legitimate interest / statutory obligation
• Retention period:
• One month after the order

• Purpose:
• Order processing (only in the case of an order)
• Data:
• Name or company name, address or invoice address, Chamber of Commerce number, VAT number, client number, telephone number, e-mail address
• Basis:
• Performance of the agreement
• Retention period:
• One month after the order

• Purpose:
• Service / guarantee (only in the case of an order)
• Data:
• Name or company name, invoicing address, Chamber of Commerce number, VAT number, client number, telephone number, e-mail address, order history
• Basis:
• Performance of the agreement, legitimate interest
• Retention period:
• Twenty years after the final order

Marketing

• Purpose:
• Website analytics
• Data:
• Surfing behaviour, location
• Basis:
• Unequivocal permission
• Retention period:
• Six months

• Purpose:
• CRM (only when a party becomes a client)
• Data:
• Name, user name, e-mail address, location, order history, user ID, telephone number, name and address
• Basis:
• Performance of the agreement, legitimate interest
• Retention period:
• Five years after the end of the relationship

• Purpose:
• Retargeting
• Data:
• Surfing behaviour, e-mail address
• Basis:
• Unequivocal permission
• Retention period:
• As long as necessary for this purpose

• Purpose:
• Behavioural targeting
• Data:
• Surfing behaviour, e-mail address
• Basis:
• Unequivocal permission
• Retention period:
• As long as necessary for this purpose

• Purpose:
• A/B testing
• Data:
• Surfing behaviour, e-mail address
• Basis:
• Unequivocal permission
• Retention period:
• Six months

• Purpose:
• Posting messages or reviews
• Data:
• User ID, name, message content
• Basis:
• Express permission
• Retention period:
• Six months after the message /review has been removed

Security

• Purpose:
• Offering an account
• Data:
• Name, address, e-mail address, user name, password
• Basis:
• Performance of the agreement
• Retention period:
• Six months following the removal of the account

• Purpose:
• Verifying identity
• Data:
• Electronic identification data
• Basis:
• Performance of the agreement / legitimate interest
• Retention period:
• Six months following the removal of the account

• Purpose:
• Securing data
• Data:
• Password, user name
• Basis:
• Performance of the agreement
• Retention period:
• Six months following the removal of the account

• Purpose:
• Maintaining IT systems
• Data:
• All information that is issued
• Basis:
• Legitimate interest
• Retention period:
• As long as necessary for this purpose

The rights of the data subject
The data subject has the following rights relating to his or her personal data and the processing thereof:

Access
The data subject may always request Sekisui Eslon to grant access to his or her personal data. The overview includes the processed personal data, the processing operation and the purpose of the processing. Sekisui Eslon may request a statutory payment for such.

Changes
The data subject is entitled to submit a request to change, improve, supplement, remove and restrict his or her personal data.

Restriction of processing
The data subject is entitled, subject to conditions, to restrict the processing of personal data.

Objection
If Sekisui Eslon carries out a certain processing operation on the basis of the legitimate interest of itself or a third party, the data subject will be entitled to object to that processing.

Transfer of data
The data subject has the right to obtain his or her personal data. Sekisui Eslon will supply that data in a structured and commonly used form, which can be easily accessed in other commonly used systems.

Withdrawal of permission
The data subject has the right to withdraw his or her permission for a certain processing operation. If the data processing is taking place on that basis, Sekisui Eslon will cease the processing. The withdrawal of permission has no retroactive force. Sekisui Eslon will respond within one month to a request relating to these rights. Such requests can be sent to Mr R. Vlot (rvlot@eslon.nl). Sekisui Eslon will always substantiate a rejection.

Recipients
The personal data may be transferred to processors and parties that are involved in the performance of the agreement.

Transfer to a third country or organisation
It may be necessary to transfer personal data to a third party in a country outside the European Economic Area. Legislation regarding privacy protection in such countries is different to that in the Netherlands. For this reason, Sekisui Eslon uses the Privacy Shield or the EU Model Clauses to protect the privacy of data subjects as much as possible. If that is not possible, Sekisui Eslon will ask permission to transfer the personal data to countries without an adequate level of protection. This permission may always be withdrawn. A withdrawal has no retroactive force.
By signing the privacy statement, the data subject grants permission to share surfing behaviour with Google Inc and other parties in the US for the purpose of website analytics. There is no adequate Privacy Shield in the US.

Cookies
Sekisui Eslon uses cookies to analyse visits to its website and to have its website function in an effective manner. Cookies are small text files that are installed in the memory of a device (computer, telephone, tablet) during website visits. The cookies cannot damage the device. When it refers to cookies, Sekisui Eslon also means simular technology to collect information, such as device fingerprinting.