Updated: 24 May 2018
1 Purpose and Scope
Efecte Plc (business ID 1509667-4) (“Efecte”) and its affiliates are committed to protecting the privacy of customers, business partners and visitors to Efecte’s website (collectively hereinafter “Data Subject(s)”).
Efecte acts as a controller with respect to the information that is processed in connection with our business relationships. For example, Efecte is the controller in relation to Data Subjects’ contact details and other commercial Personal Data. On the other hand, Efecte also acts as a processor of Data Subjects’ Personal Data in connection with the provision of the Services. When Efecte acts as the processor, Personal Data is processed in line with applicable data protection laws and data processing agreement entered into with the controller, where applicable. In such a case, please refer to the privacy policies of controllers for further information on the processing of Personal Data.
2 Processing of Personal Data
Efecte processes Personal Data of Data Subjects to manage business relationships and to offer the Services. In this context, Personal Data may be processed for market and customer analysis, reporting and statistical purposes, marketing purposes such as customised marketing, administration notices, database management and maintenance, product suggestions and offers and newsletters. Personal Data may be used for direct marketing, including, where applicable, by electronic means unless objected by the Data Subject.
Further, Personal Data may be used for invoicing and to send important information to the Data Subject e.g. to contact the Data Subject and provide information on customised Services based on their profile and preferences.
Efecte processes Personal Data on the following basis:
- for the performance of the contract between Efecte and the Data Subject (Article 6.1(b) of the GDPR);
- for the purposes of Efecte’s legitimate interests related to the customer and business relationships between Efecte and the Data Subjects (Article 6(f) of the GDPR);
- to comply with legal obligations applicable to Efecte (Article 6(c) of the GDPR, such as corporate and accounting).
Efecte may ask for the Data Subject’s consent for the processing of certain type of Personal Data (for example for a campaign). When collecting such consents, Efecte informs the Data Subject of the respective purposes of processing and such processing is conducted only when appropriate consent is received.
3 Collection and Use of Personal Data
Personal Data is mainly obtained directly from the Data Subject. Personal Data may be updated and supplemented by collecting data from private and public registers. Information is also collected from browsers to customise and improve Efecte’s website and make it more user-friendly.
Efecte collects the following types of Personal Data: name, phone number, e-mail, street address, role in the company and/or towards Efecte, IP address, usage data and cookies.
Efecte does not collect sensitive information (special categories of Personal Data).
4 Disclosure of Personal Data
Personal Data is primarily not transferred outside the European Union and the European Economic Area (“EU/EEA”). If any such transfers are needed, they are performed subject to appropriate safeguards such as European Commission adequacy decision, other appropriate safeguards or standard data protection clauses adopted or otherwise approved by the EU Commission in accordance with the GDPR (“Standard Data Protection Clauses”).
5 Retention Period
Efecte may retain the Data Subject’s Personal Data for five 5 years from the Data Subject’s latest purchase or contact with us. Personal Data may be, wholly or in part, retained for longer or shorter term if required by applicable law or if there is other justified reason to retain or delete them. In such a case, the Data Subject’s Personal Data shall be erased with no further delay after there is no longer any need for such a retention.
Efecte evaluates the necessity and accuracy of the Personal Data on a regular basis.
6 Data Subjects’ Rights
Data Subjects have a right to request:
- access to and rectification or erasure of their Personal Data;
- for restriction of processing concerning the Data Subject or to object to processing; and
- to receive, under certain preconditions, the Data Subject’s Personal Data in a structured, commonly used and machine-readable format and to transmit those data to another controller.
Data Subjects may exercise the aforementioned rights by sending a written request to Efecte. Where the processing is based on consent, the Data Subject has a right to withdraw such consent at any time. This will not affect the lawfulness of processing based on consent before its withdrawal.
In case the Data Subject considers that its rights under the data protection laws are infringed, the Data Subject may lodge a complaint with the supervisory authority of the Data Subject’s residence in the EU.
7 Security Safeguards
Efecte has taken adequate technical and organisational measures in order to keep Personal Data safe and to secure it against unauthorised access, loss, misuse or alteration by third parties, such as encryption, access controls, and firewalls. However, data transmission over the internet is inherently insecure, and Efecte cannot guarantee that the security measures will prevent illegally and maliciously operating third parties from obtaining access to Personal Data and the absolute security of that data during its transmission or its storage on Efecte’s systems.
10 Contact information of data controller
Data controller: Efecte Plc (business ID 1509667-4) and its affiliates.