Privacy Notices for Europe and UK

QUADCO GROUP – PRIVACY NOTICE – CUSTOMERS

This section of our website is designed to help you understand what we do with information about individuals in our customer organisations, referred to as “personal information”. We are committed to protecting the privacy and security of your personal information. This privacy notice describes how we collect and use personal information about you during the course of our relationship with you, in accordance with data
protection law.

WHO ARE WE AND HOW TO CONTACT US

This notice explains how Quadco (where it is dealing with customers and prospective customers based in the EU and UK) use personal information collected from or about you.

This privacy notice provides an overview of what personal information we collect and store and how we use the personal information of individuals within our customer organisations. This privacy notice also tells you what your rights are over your personal information and how to exercise those rights. If you have any questions or concerns about the information in this notice, or about our handling of personal information more generally, or if you would like more detailed information on a particular point, you should contact our Local Privacy Officer who can be contacted as follows:

Alana Beaulieu, VP Human Resources at abeaulieu@quadco.com or info@quadco.com

NAVIGATION

This privacy notice answers the following:

How we use your personal information that we collect from your use of our website and our legal basis for that
How we use your personal information when you request a quotation or place an order with us and our legal basis for that
How we use your personal information where you arrange to visit one of our sites and our legal basis for that
How we use your personal information where we arrange on-site training for you and our legal basis for that
How we use your personal information where you have agreed that we can market to you and our legal basis for that
Will we change the way we use your personal information?
Do we use your personal information to make automated decisions?
How long will we keep your personal information?
Who will we share your personal information with?
Will you transfer my personal information outside the EEA?
How do we ensure that your personal information is secure?
What rights do I have over my personal information?
How will you tell me about changes to this privacy notice?
How you can contact us

HOW WE USE PERSONAL INFORMATION THAT WE COLLECT FROM YOUR USE OF OUR WEBSITE AND OUR LEGAL BASIS FOR THAT

What personal information do we collect and how do we use it?
- Information you give us: if you fill in a form on our website, request information through an application or contact us via email, telephone or social media channels, we will collect the information you include on the form or which you provide to us when you contact us, such as your name and contact details. We will use this information to:
  - send you the information you have requested, for example about our products and services; and
  - respond to your query.
- Information we collect about you from browsing our website: We use cookies on our website. If you would like details about what cookies we use please contact the Local Privacy Officer for your region (see contact details above).
- Information publicly available: if you contact us via social media channels, we may collect the information which is publicly available on those channels.
What is our legal basis for using your personal information?
- Under data protection law we must have a legal basis to use your personal information. We have set these out below.
- Information you give us: Where you fill in a form on our website, request information via an application or contact us via email, telephone or social media channels, the legal basis for this use is that it is in our legitimate interests as a business to be able to respond to enquiries that we get. We have considered our legitimate interests carefully and have balanced our legitimate interests against your rights under data protection law. We consider that this use is proportionate because we will only use the information we get from you to respond to your enquiry and it is in your reasonable expectations that we would need to use your personal information to be able to respond to you.
- Information we collect about you from your use of our website: Where we collect personal information through cookies you have accepted on our website, the legal basis for this use is that you have given your consent to this

HOW WE USE YOUR PERSONAL INFORMATION IF YOU REQUEST A QUOTATION OR PLACE AN ORDER WITH US AND OUR LEGAL BASIS FOR THAT

What personal information do we collect and how do we use it?

Information you give us: If you or your organisation requests a quotation from us or your organisation submits an order for products and/or services from us, we will collect information from you or from your organisation, such as your name, your contact details and your job title. We will use this information to:
- provide the quotation your organisation has requested;
- negotiate and conclude contracts for the sale of products to your organisation.
- carry out financial due diligence, sanction checks (where applicable) and any other legal checks we are required and allowed by applicable law to carry out prior to accepting an order;
- fulfil an order placed with us;
- agree the specification and design of products ordered from us;
- assist with the ongoing management and running of a contract;
- resolve any operational issues such as in relation to delivery;
- arrange and carry out site visits;
- arrange delivery of the products;
- arrange meetings between key stakeholders and members of the supply chain to review and discuss the project; and/or assist with any contractual or other claims.

We will carry out a due diligence process relating to anti-bribery, fraud and money laundering. We will also carry out sanctions checks (where applicable) against our customers, proposed customers and their company officers, directors and owners and will obtain personal information as part of this process.

What is our legal basis for using your personal information?

Under data protection law we must have a legal basis to use your personal information. We have set these out below.

Information you/your organisation gives us when requesting a quotation, negotiating and concluding a contract: The legal basis for using the personal information you give or your organisation gives us when requesting a quotation, entering into negotiations or concluding a contract with your organisation is that it is in our legitimate interests as a business to be able to contact you to provide a quote and to manage and assist with the conclusion and ongoing performance of a contract with your organisation. We have considered our legitimate interests carefully and have balanced our legitimate interests against your rights under data protection law. We consider that this use is proportionate because it is relevant and appropriate to our relationship with you, it is in your reasonable expectations that we would need to use your personal information to contact you in this way and we only use your business contact details for matters which relate directly to our relationship with the organisation you work for.

Information you give to us or which we get from other sources to perform financial due diligence: The legal basis for using the personal information you give to us or which we get from other sources to perform financial due diligence is that it is in our legitimate interests as a business to check the financial standing and credit of our customers in order to safeguard our finances and reputation. We have considered our legitimate interests carefully and have balanced our legitimate interests against your rights under data protection law. We consider that carrying due diligence is proportionate because it is within your reasonable expectations, taking into account the value of the contract or potential contract being entered into, and the information is limited to the business context.

Information you give to us or which we get from other sources so that we can meet our legal obligations: The legal basis of using the personal information you give to us or which we get from other sources so that we can meet our legal obligations, for example carrying out anti-bribery, fraud, money laundering and sanctions checks, is that it is necessary for compliance with a legal obligation we are subject to under EU or Member State Law such as The Bribery Act 2010, The Anti-Money Laundering and Counter-Terrorism Financing Act 2006 and other legislation that we are bound by virtue of our corporate structure e.g. the Foreign Corrupt Practices Act of 1977.

HOW WE USE YOUR PERSONAL INFORMATION WHERE YOU HAVE AGREED THAT WE CAN MARKET TO YOU AND OUR LEGAL BASIS FOR THAT

What personal information do we collect and how do we use it?

Information you give us through our website: If you fill in a form on our website, we have tick boxes on the submission page so that you can tell us if you are happy for us to send you marketing and which communications you would like to receive.

Information you give us when you (i) give us your contact details or request information at an event or meeting, via an application, email, telephone or social media channels (ii) request a quotation, (iii) ask for further information about our products and/or services or (iv) request a site visit: If you give us your contact details, request information at a trade show, convention or meeting or via an application, email, telephone or social media channels, request a quotation, ask for further information about our products and/or services or request a site visit, we will respond to your request and may also ask you whether you are happy for us to contact you for marketing and which communications you would like to receive.

Information you give us when you purchase products and/or services on behalf of your company: If your organisation purchases products and/or services, we will fulfil the order and we may also ask you whether you are happy for us to contact you for marketing and which communications you would like to receive. Information you give to us when you register to attend training, create an account for access to our e-learning system, register to attend an event or accept a hospitality invitation: When you register to attend training, create an account for access to our e learning system, register to attend an event or accept a hospitality invitation, we have tick boxes on the registration pages or we may send a follow-up email so that you can tell us if you are happy for us to contact you for marketing and which communications you would like to receive.

If you have agreed that we can send you marketing, we will use your personal information to send you to send you information about our solutions, products, software, services, events, publications, surveys and news. Some of our marketing will be done by profiling, which is where we tailor the information and communications we send to you based on your preferences, the product and geographical area in which your organisation operates, your organisation’s purchase history, events you have attended. We will also review your response to ensure that the information and communications we are sending are relevant and we may contact you where your response to our information and communications indicates that you are interested in a particular topic

2. What is our legal basis for using your personal information?

Under data protection law we must have a legal basis to use your personal information. Where we use your personal information for marketing, we do this on the basis that you have consented to us sending you marketing. You have the right to change your mind about this at any time. There will be unsubscribe links in all the marketing emails that we send you, and you can also contact us at any time to ask us to stop sending you marketing. If you wish to do this please fill in our form on our website. We will refresh the consent you have given us by contacting you at least every two years.

WILL WE CHANGE THE WAY WE USE YOUR PERSONAL INFORMATION?

We will only use your personal information for the purpose we have set out in this notice. We can only change the purpose we use it for without telling you where we need to use it for another reason and that reason is compatible with those set out in this notice. If we need to use your personal information for any other purpose, we will notify you and we will explain the legal basis which allows us to do so in a similar way to how we have done it in this notice.

DO WE USE YOUR PERSONAL INFORMATION TO MAKE AUTOMATED DECISIONS?

You will not be subject to decisions that will have a significant impact on you based solely on automated decision making (i.e. one without human intervention).

HOW LONG WILL WE KEEP YOUR PERSONAL INFORMATION?

We will not keep your personal information for longer than we need it for the purposes we have explained in this privacy notice. If you would like details of how long we keep your personal information for please contact the Local Privacy Officer for your region (see contact details above). If a dispute arises between us, we will keep your personal information for the purposes of responding to and dealing with this dispute and this may mean that we keep your personal information for longer to enable us to deal with the dispute.

WHO WILL WE SHARE YOUR PERSONAL INFORMATION WITH?

We will only share the personal information that you give us with the following third parties and for the following reasons:

Group companies: We will share your personal information with our group companies which are set out above, Quadco Group and other subsidiaries, operating units and divisions of Quadco Group. This is because they provide us with assistance in managing customer accounts, orders, sales and marketing, technical support and payment. We also have group reporting obligations. We consider the use of your personal information in this way is in our legitimate interests. We have considered our legitimate interests carefully and have balanced our legitimate interests against your rights under data protection law. We consider that this is proportionate because we will only pass on the information you have given to us and we enter into data sharing agreements with our group companies. Please be reassured that only the companies mentioned on any marketing consent you have given will market to you.
With organisations for the purposes of carrying out financial due diligence: Where we carry out financial due diligence in relation to our customer organisations or prospective customers the results may reveal your personal information if you are an officer, director or owner. They process your personal information in these circumstances on the basis that it is in our legitimate interests as a business to ensure we are contracting with customers who can honour their contracts with us. We have considered our legitimate interests carefully and have balanced our legitimate interests against your rights under data protection law. We consider that this use of personal information is proportionate because we will only pass the information to reputable organisations and we have a contract with them.
With organisations for the purposes of carry out legal due diligence: We may share your personal information with organisations and agencies in order to carry out sanctions checks, anti-bribery, anti-corruption and antimoney laundering checks and to prevent fraud. We share your personal information in these circumstances on the basis that it is necessary for compliance with a legal obligation under EU or Member State Law such as The Bribery Act 2010, The Anti-Money Laundering and Counter-Terrorism Financing Act 2006 and other legislation that we are bound by virtue of our corporate structure e.g. the Foreign Corrupt Practices Act of 1977 or, where applicable, Russian laws.
With delivery companies if you have ordered products from us: We will share your personal information with delivery companies to the extent necessary to deliver any products ordered and to enable them to contact you in relation to the delivery. We share your personal information in these circumstances on the basis that it is in our legitimate interests as a business to be able to use a reputable third party to deliver products. We have considered our legitimate interests carefully and have balanced our legitimate interests against your rights under data protection law. We consider this use is proportionate because it is within your reasonable expectations for us to be able to arrange for delivery of products your organisation has ordered, we will only pass on the necessary information to allow the haulier organisation to carry out the delivery and we have a contract with our haulier organisations.
With training organisations or individuals who provide training: We will share your personal information with our vendors who provide training services in order to arrange training. We share your personal information in these circumstances on the basis that that it is in our legitimate interests to use reputable third parties to provide training to our customers on our behalf. We have considered our legitimate interests carefully and have balanced our legitimate interests against your rights under data protection law. We consider that this use is proportionate because we will only pass on the information you have given to us and which is necessary to arrange the training and we have contracts with our vendors who provide training.
With companies who provide or support for our IT systems (including our CRM system, our applications and systems relating to event bookings, marketing, and our e-learning system) and website: We use reputable third parties to provide us with our IT systems, applications and website and support for them, as well as to facilitate our event bookings and provide our e-learning system software. They may access your personal information to the extent that they need to in order to provide their services. We consider it is in our legitimate interests to be able to use reputable third party providers to provide these services. We have considered our legitimate interests carefully and have balanced our legitimate interests against your rights under data protection law. We consider that this is a proportionate use of your personal information because we only share the information that is necessary to enable our suppliers to provide their services and we have a contract with them.
With companies who provide marketing support services to us: We use reputable third parties to provide us with marketing support services such as arranging and supporting meetings at events or conferences, fulfilling requests for marketing literature or providing welcome packs. They may access your personal information to the extent that they need to in order to provide their services. We consider it is in our legitimate interests to be able to use reputable third party providers to provide these services. We have considered our legitimate interests carefully and have balanced our legitimate interests against your rights under data protection law. We consider that this is a proportionate use of your personal information because we only share the information that is necessary to enable our suppliers to provide their services and we have a contract with them.
With a company that we merge with or transfer our business assets to: In the event that we sell all or part of our business, or merge with another company, we may transfer personal information that we have collected as described in this notice, along with our other business assets, to the company that we are selling to or merging with. We do this on the basis of our legitimate interests in being able to merge or sell our business. We have considered our legitimate interests carefully and have balanced our legitimate interests against your rights under data protection law. We consider that this is a proportionate use of your personal information because we would only share what was necessary in order to allow the other entity to consider entering into the transaction and we would enter into a contract with them which required them to observe your rights in relation to data protection.
With entities, companies or individuals outside our group for legal reasons: We will share your personal information with entities, companies or individuals outside our group where this is necessary to: comply with any law, rule, regulation, legal procedure or governmental request that is applicable to us. The legal basis for this is that sharing your personal information in this way is necessary in order for us to comply with our legal obligations.
With entities, companies or individuals outside our group to obtain advice: We also share your personal information with external professional advisors such as lawyers or accountants in order to take advice or enforce the terms of our agreements. The legal basis for this is that it is in our legitimate interests as a business to be able to obtain professional advice from our external advisors about issues that may arise within our business such as how to enforce our contracts with our vendors. We have considered our legitimate interests carefully and have balanced our legitimate interests against your rights under data protection law. We consider that this is a proportionate use of your personal information because it is in your reasonable expectations that we would need to share your personal information with our professional advisors, we would only share what was necessary in order to allow our advisors to advise us, enforce our contracts and for the purposes of legal proceedings and we enter into contracts with our advisors.

WILL YOU TRANSFER MY PERSONAL INFORMATION OUTSIDE THE EEA?

Customers and Prospective Customers of Quadco

We store your personal information in the United Kingdom or in countries within the European Economic Area (“EEA”).

We will only transfer your personal information outside the EEA as follows:

Where we share your data with Quadco Group, our group companies and any subsidiaries, operating units and divisions worldwide.
Where our third party service providers who we share personal information with (as set out above) are based outside the EEA, have support services located outside the EEA or host personal information outside the EEA. The countries (outside the EEA) that your personal information may be transferred to or accessed in include the US and Russia.

We only transfer your personal information outside the EEA where we have a legal basis for doing so and where we require that your personal information is protected to the same standard as it would be protected in the EU. We do this by entering into data sharing agreements with the recipients of your personal information based outside the EEA which comply with the EU Commission’s standard clauses for the transfer of personal information.

If you would like further details about our transfer of your personal information outside the EEA or details of the contracts we have put in place to safeguard your personal information please contact the Local Privacy Officer for your region (see above for contact details).

Customers and Prospective Customers of Quadco

We store your personal information in the Russian Federation. We will only transfer your personal information outside the Russian Federation as follows:

Where we share your data with Quadco Group, our group companies and any subsidiaries, operating units and divisions worldwide; and/or
Where our third party service providers who we share personal information with (as set out above) are based outside the Russian Federation, have support services located outside the Russian Federation or host personal information outside the Russian Federation.

The countries (outside the Russian Federation) that your personal information may be transferred to or accessed in include the US, France, Germany, Poland and the UK.

We only transfer your personal information outside the Russian Federation where we have a legal basis for doing so and where we require that your personal information is protected to the same standard as it would be protected in the Russian Federation. We do this by entering into data sharing agreements with the recipients of your personal information based outside the Russian Federation.

If you would like further details about our transfer of your personal information outside the Russian Federation please contact the Local Privacy Officer for your region (see above for contact details).

HOW DO WE ENSURE THAT YOUR PERSONAL INFORMATION IS SECURE?

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need-to-know. They will only process your personal information on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

WHAT RIGHTS DO I HAVE OVER MY PERSONAL INFORMATION?

You have the right to make a complaint to the data protection regulator based in the EU country where the Quadco group company you deal with is based. Details of relevant regulators are as follows:

UK: www.ico.org.uk
France: www.cnil.fr

You can also contact the data protection regulator in the EU country in which you are based. We would, however, appreciate the chance to deal with your concerns before you approach the regulator and so, if you are happy to do so, please contact the Local Privacy Officer for your region (see above for contact details) in the first instance and we will try to resolve your issues.

You also have a number of additional rights over your personal information, which are:

the right to ask us what personal information we have about you and to have a copy of your personal information from us;
the right to ask us to correct any errors in your personal information;
the right to ask us to review and explain our legitimate interests to you;
the right to ask us to review and explain our legal ground to process your personal information if you are a customer of Quadco;
the right to ask us to delete your personal information where: (i) we don’t need your personal information anymore; (ii) you withdraw your consent to our use of your personal information and we have no other legal basis to keep your personal information; (iii) you have asked us to review and explain our legitimate interests to you and we don’t actually have a valid legitimate interest to do what we are doing; (iv) our use of your personal information is illegal; (v) we have to delete your personal information to comply with our legal obligations;
if you are a customer of Quadco, the right to ask us to delete your personal information where: (i) you have asked us to review and explain our legal ground to collect, store and use your personal information and we don’t actually have a valid legal ground to do what we are doing; the right to ask us to restrict the use that we are making of your personal information where: (i) you don’t think the personal information we have about you is correct, so that we can check if it is correct; (ii) what we are doing with your personal information is illegal but you would rather we stop using your personal information rather than delete it; (iii) we don’t need your personal information anymore, but you need us to keep it so that you can exercise any legal rights; and (iv) you have asked us to review and explain our legitimate interests to you, so that we can check whether we actually have a valid legitimate interest to do what we are doing; if you are a customer of Quadco, the right to ask us to restrict the use that we are making of your personal information where you have asked us to review and explain our legal ground for collecting, storing and using your personal information to you, so that we can check whether we actually have a valid legal ground to do what we are doing; the right to ask us to transfer your personal information in certain circumstances; and in France the right to provide us with your instructions regarding the use of your personal information after your death.

If you want to exercise the rights set out above please contact the Local Privacy Officer for your region (see above for contact details).

HOW WILL YOU TELL ME ABOUT CHANGES TO THIS PRIVACY NOTICE?

We keep our privacy notice under regular review. Any changes we make to our privacy notice in the future will be posted on this page and if the changes will have an effect on you or the way we use your personal information we will bring them to your attention by email where appropriate (e.g. if we have your email address as a contact at one of our customers).

HOW YOU CAN CONTACT US

If you have any questions about this privacy notice or about the ways we use your personal information, please contact the Local Privacy Officer for your region (see above for contact details).