Cookie Policy

12. Additional information for data subjects under European Union — General Data Protection Regulation (Regulation (EU) 2016/679)

12.1 Scope of this section

This section provides additional information for individuals whose personal data is processed under the General Data Protection Regulation (Regulation (EU) 2016/679, the "GDPR"). It applies in addition to, and not in substitution of, the rest of this Cookie Policy and our Privacy Policy.

In line with Article 3 of the GDPR, this section also applies where we offer goods or services to data subjects in the European Economic Area, or where our processing relates to monitoring the behaviour of data subjects taking place in the European Economic Area, even if we are established outside of the European Union.

12.2 Lawful bases for processing

In accordance with Article 6 of the General Data Protection Regulation (Regulation (EU) 2016/679, the "GDPR"), we process your personal data only where one or more of the following lawful bases applies:

• You have given consent to the processing of your personal data for one or more specific purposes (Article 6(1)(a));
• The processing is necessary for the performance of a contract to which you are a party, or in order to take steps at your request prior to entering into a contract (Article 6(1)(b));
• The processing is necessary for compliance with a legal obligation to which we are subject (Article 6(1)(c));
• The processing is necessary in order to protect your vital interests or those of another natural person (Article 6(1)(d));
• The processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority (Article 6(1)(e));
• The processing is necessary for the purposes of legitimate interests pursued by us or a third party, except where such interests are overridden by your interests or fundamental rights and freedoms (Article 6(1)(f)).

Where we rely on legitimate interests, we have carried out a balancing exercise documented in our internal records. You may request further information about this assessment at any time.

12.3 Consent

Where we rely on consent as the lawful basis for processing your personal data, that consent is requested and recorded in accordance with Article 7 of the GDPR. Consent is freely given, specific, informed and unambiguous, given by a clear affirmative act, and the request is presented in a manner clearly distinguishable from other matters, in an intelligible and easily accessible form, using clear and plain language.

You may withdraw your consent at any time. Withdrawal is as easy as the original consent and does not affect the lawfulness of processing carried out before the withdrawal. Where the processing is based on consent, you will be informed before giving consent of your right to withdraw it.

12.4 Special categories of personal data and criminal records

In accordance with Article 9 of the GDPR, we process personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data processed for the purpose of uniquely identifying a natural person, data concerning health or data concerning sex life or sexual orientation, only where one of the conditions in Article 9(2) applies, including your explicit consent, the protection of vital interests, or substantial public interest grounds laid down by Union or Member State law.

Personal data relating to criminal convictions and offences are processed only under the control of an official authority or where the processing is authorised by Union or Member State law providing for appropriate safeguards (Article 10).

12.5 Children's consent for information society services

Article 8 of the GDPR provides that, where information society services are offered directly to a child and consent is the relied-upon basis, processing is lawful only where the child is at least 16 years of age. Member States may by law provide for a lower age, provided that it is not below 13.

The applicable digital age of consent therefore depends on the Member State whose law applies. Where the data subject is below the applicable threshold and consent is the relied-upon basis, we obtain consent from the holder of parental responsibility over the child and make reasonable efforts to verify it, taking into account available technology.

12.6 Information provided at collection

In accordance with Articles 13 and 14 of the GDPR, before or at the time of collecting personal data we inform you of: the identity and contact details of the controller and, where applicable, the data protection officer; the purposes of the processing and the lawful basis; the legitimate interests pursued where applicable; the recipients or categories of recipients; any intention to transfer personal data to a third country and the safeguards relied on; the retention period (or the criteria used to determine it); your rights under the GDPR; and your right to lodge a complaint with a supervisory authority.

A consolidated description of our processing activities, retention periods, recipients and your rights is set out in our Privacy Policy.

12.7 International transfers of personal data

In accordance with Articles 44 to 49 of the GDPR, we may transfer your personal data to countries or international organisations outside the European Economic Area (EEA) only where one of the following conditions is met:

• The European Commission has decided that the destination country, territory, sector or international organisation ensures an adequate level of protection (Article 45);
• The transfer is subject to appropriate safeguards under Article 46, such as Standard Contractual Clauses adopted by the European Commission, Binding Corporate Rules approved by a competent supervisory authority, or an approved code of conduct or certification mechanism;
• A specific derogation under Article 49 applies, including your explicit informed consent to the proposed transfer, the necessity of the transfer for the performance of a contract, important reasons of public interest, the establishment, exercise or defence of legal claims, or the vital interests of the data subject.

Following the Schrems II judgment of the Court of Justice of the European Union (Case C-311/18), where we rely on Standard Contractual Clauses or other safeguards we also assess the laws and practices of the destination country and apply supplementary measures where necessary to ensure an essentially equivalent level of protection.

12.8 Your rights under the GDPR

In accordance with Articles 15 to 22 of the GDPR, you have the following rights in respect of your personal data:

• Right of access (Art 15): to obtain confirmation of whether your personal data are being processed and, where that is the case, access to the data and to the information listed in Article 15.
• Right to rectification (Art 16): to obtain the rectification of inaccurate personal data and the completion of incomplete data.
• Right to erasure (Art 17): to obtain the erasure of your personal data without undue delay where one of the grounds in Article 17(1) applies.
• Right to restriction (Art 18): to obtain restriction of processing in the cases listed in Article 18(1).
• Right to data portability (Art 20): to receive the personal data you have provided to us in a structured, commonly used and machine-readable format and to transmit it to another controller, where the processing is based on consent or contract and is carried out by automated means.
• Right to object (Art 21): to object, on grounds relating to your particular situation, to processing based on Article 6(1)(e) or (f); and at any time to object to processing for direct marketing purposes.
• Automated decision-making (Art 22): not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, except in the cases set out in Article 22(2).
• Right to lodge a complaint (Art 77): to lodge a complaint with the supervisory authority of the Member State of your habitual residence, place of work or place of the alleged infringement.

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within one month, extendable by two further months where necessary, in accordance with Article 12 of the GDPR.

12.9 Data Protection Officer

Articles 37 to 39 of the GDPR require the designation of a Data Protection Officer where the processing is carried out by a public authority or body, where the core activities consist of processing operations which by their nature, scope or purposes require regular and systematic monitoring of data subjects on a large scale, or where the core activities consist of large-scale processing of special categories of data or data relating to criminal convictions and offences.

Where we are required (or have voluntarily chosen) to designate a Data Protection Officer, the contact details of that officer are published in our Privacy Policy and notified to the competent supervisory authority. The Data Protection Officer is the point of contact for data subjects on all issues related to the processing of their personal data and the exercise of their rights under the GDPR.

12.10 Breach notification and impact assessments

In accordance with Article 33 of the GDPR, in the event of a personal data breach we will notify the competent supervisory authority without undue delay and, where feasible, not later than 72 hours after having become aware of the breach, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons.

In accordance with Article 34, where the breach is likely to result in a high risk to your rights and freedoms, we will also communicate the breach to you without undue delay, in clear and plain language, together with the information listed in Article 34(2). Communication is not required where one of the exceptions in Article 34(3) applies.

In accordance with Article 35, where a type of processing is likely to result in a high risk to the rights and freedoms of natural persons (in particular, using new technologies, taking into account the nature, scope, context and purposes of the processing), we carry out a Data Protection Impact Assessment (DPIA) prior to the processing. Where the DPIA indicates a residual high risk that we cannot mitigate, we consult the competent supervisory authority before commencing the processing.

12.11 Profiling and automated decision-making

Where we engage in profiling or in decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you, we comply with Article 22 of the GDPR. Such decisions are made only where: necessary for entering into or performing a contract with you; authorised by Union or Member State law to which we are subject and which provides suitable safeguards; or based on your explicit consent.

Where automated decision-making is permitted, we implement suitable measures to safeguard your rights and freedoms and your legitimate interests, including at least the right to obtain human intervention on our part, the right to express your point of view and the right to contest the decision.

12.12 Penalties for non-compliance

For information only: the GDPR provides for administrative fines of up to twenty million euros (€20,000,000) or, in the case of an undertaking, up to 4% of total worldwide annual turnover of the preceding financial year, whichever is higher (Article 83). Lower-tier fines of up to ten million euros (€10,000,000) or 2% of worldwide turnover apply to the breaches listed in Article 83(4).

These fines are administered by the competent national supervisory authority of the Member State concerned, in cooperation with other supervisory authorities under the GDPR's consistency mechanism.

12.13 Supervisory authority

The competent national supervisory authority for our processing is the data protection authority of the Member State in which we are established. The full list of EU/EEA national supervisory authorities is available on the European Data Protection Board (EDPB) website at https://www.edpb.europa.eu/.

Without prejudice to the above, you have the right to lodge a complaint with the supervisory authority of the Member State of your habitual residence, place of work or place of the alleged infringement, where you consider that our processing of your personal data infringes the GDPR (Article 77).

Coordination of national supervisory authorities at EU level is carried out by:

European Data Protection Board (EDPB)
Rue Wiertz 60, B-1047 Brussels, Belgium
https://www.edpb.europa.eu/