ActiveGraf General Privacy Policy and Information for Data Subjects

INTRODUCTION

This Privacy Policy is  designated to generally describe how personal data is collected, used, processed and protected in connection with the business operations of ACTIVEGRAF Inc. (registered address: Address:  2118 S. Wendover Road, CHARLOTTE NC, USA; hereinafter: ACTIVEGRAF or Data controller) acting as Data controller and in certain cases as Data processor while complying with the applicable legal regulations.

This Privacy Policy also gives thorough information for the data subjects on their rights pertaining to the processing of their personal data.

This Privacy Policy applies to the processing of the personal data of our Website Users, Clients, Users of Our Products and Services, guests and also those data who aim to engage in a contractual relationship and those who were in a contractual relationship earlier; and any other person whom we may contact while operating our business. This Privacy Policy does not apply to employment related data processing.

Please be advised that ACTIVEGRAF may unilaterally amend this Privacy Policy from time to time. Please visit https://www.ActiveGraf.com/privacy-policy regularly if you want to keep up to date.

DEFINITIONS

What constitutes as “personal data”?

“Personal data” means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

What is data processing?

“Processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Who is the data controller?

“Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.

Who is the data processor?

“Processor” means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

Who is a third party?

“Third party” means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorized to process personal data.

Who is a recipient?

“Recipient” means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing.

What is a consent?

“Consent” of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

What is a data breach?

“Personal data breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed.

1. BASIC INFORMATION ABOUT THE DATA CONTROLLER

1.1 Data controller/processor

This Privacy Policy regulates the data processing by ACTIVEGRAF, and it is therefore ACTIVEGRAF who generally qualifies as data controller in respect of your personal data. There are however certain cases where ACTIVEGRAF does not act as a data controller but instead acts as a subordinate of another data controller, which case ACTIVEGRAF is understood to be a data processor (acting on behalf of another controller while processing the personal data – in such case ACTIVEGRAF proceeds in accordance and based on the instructions of the data controller and processes data only to the extent as prescribed by the data controller).

Please also note that ACTIVEGRAF operates and provides its services with close cooperation with its subsidiaries and branch offices (ACTIVEGRAF GROUP) therefore the electronic systems of ACTIVEGRAF (where most of our products are marketed and are available) are designed to share the information indicated on the Personal Data Information Sheet(s) within the ACTIVEGRAF GROUP. Based on this system structure it may occur that the data processed by ACTIVEGRAF Inc. are shared with a ACTIVEGRAF subsidiary or subsidiaries while being processed or ACTIVEGRAF subsidiaries share personal information with ACTIVEGRAF Inc.

In all cases internal policies and procedures regulate the access to the databases to ensure that while we aim to provide the best service possible all data processing are in compliance with the legal regulations.

1.2 Contact details

ACTIVEGRAF’s contact details for data protection and privacy related matters are as follows:

Name: ACTIVEGRAF Inc.

Email address: privacy@activegraf.com

Postal address: 2118 S. Wendover Road, CHARLOTTE NC, USA.

1.3 Designation of data protection officer

Please note that ACTIVEGRAF examined the need to appoint a data protection officer according to Article 37 of the GDPR (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, GDPR) and drew the conclusion that ACTIVEGRAF is not required to do so in light of the mandatory appointment criteria, in particular, ACTIVEGRAF’s core activities do not include processing operations which, by virtue of their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjects on a large scale.

1.4 Websites and services using this privacy policy

This Privacy Policy applies to the privacy practices of ACTIVEGRAF’s websites as well concerning all websites operated by ACTIVEGRAF (“Websites”), which include, without limitation, the following:

1. https://www.ActiveGraf.com,

as well as our products, online services and applications that include a link to this Privacy Policy and as such, sets out the basis on which any personal information we collect from you, or that you provide to us whether on the above websites, or otherwise (for example: in connection with the purchase of a product or service from us, or when we purchase service from you), will be processed by us. Importantly, this Privacy Policy also applies to ACTIVEGRAF’s marketing and advertising practices, as described below. Please be advised that details of each individual data processing include at least the following information:

• identification and contact details of data controller if any; identification and contact details of data processor(s);
• the purpose of processing;
• the legal basis for the processing;
• where the processing is based on the legitimate interests pursued by ACTIVEGRAF or by a third party then detailed description of this legitimate interest;
• the recipients or categories of recipients of the personal data, if any;
• where applicable, the fact that the data is being transferred to a third country (including if access is being granted to another controller/processor from a third country) and how suitable safeguards are provided.

The above facts may also be detailed in the Data Processing Information Sheets attached to this Policy or to product specific End User License Agreements or other documents that may apply to the website or application you are using.

2. GENERAL RULES

2.1. GENERAL PRINCIPLES

Personal data shall be:

1. processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’)
2. collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with GDPR, not be considered to be incompatible with the initial purposes (‘purpose limitation’);
3. adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimization’);
4. accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’);
5. kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organizational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject (‘storage limitation’);
6. processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organizational measures (‘integrity and confidentiality’).

The data controller shall be responsible for, and be able to demonstrate compliance with the above principles (‘accountability’).

2.2. LEGAL BASIS OF THE DATA PROCESSING – LAWFULNESS

Processing shall only be lawful if at least one of the following applies:

1. the data subject has given consent to the processing of his or her personal data for one or more specific purposes – i.e. if you signed a consent form or given your consent via electronic means (pressing consent button or link, or giving consent over recorded telephone etc.).
2. processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract – i.e. in case you are or want to be in a contractual relationship with ACTIVEGRAF and the processing of your data is necessary for the performance of the contract. Please note that in such case your separate consent is not required, and your data is processed as long and to the extent as required for the performance of the contract.
3. processing is necessary for compliance with a legal obligation to which the controller is subject – i.e. in case a EU or national piece of legislation prescribes for ACTIVEGRAF to process your data (data of invoices, data of customer complaints etc.). Please note that in such case also your separate consent is not required, and your data is processed as long and to the extent as required and prescribed by law.
4. processing is necessary in order to protect the vital interests of the data subject or of another natural person;
5. processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
6. processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

IN ORDER TO MEET THE ABOVE REQUIREMENTS AND TO GIVE YOU PROPER INFORMATION ON THE PROCESSING OF YOUR PERSONAL DATA AND YOUR RIGHTS AND OBLIGATIONS, WE COLLECTED THE MOST FREQUENT CASES WHEN WE PROCESS PERSONAL DATA. PLEASE NOTE THAT THE LIST OF DATA PROCESSING IN THIS PRIVACY POLICY IS NOT EXHAUSTIVE; BESIDES WHAT IS DETAILED HEREIN THERE COULD BE OTHER SPECIFIC CASES WHEN WE NEED TO PROCESS YOUR PERSONAL DATA. IN ALL CASES YOU WILL BE ADVISED DULY BEFORE YOUR PERSONAL DATA IS COLLECTED FOR OTHER PURPOSES THAN DESCRIBED IN THIS PRIVACY POLICY. PLEASE BE INFORMED THAT IN CASE YOU ARE USING OUR SERVICES VIA OUR WEBSITES THEN THE DETAILS OF THE DATA PROCESSING ARE DESCRIBED ALSO AT THE GIVEN ACTIVEGRAF WEBSITE.

3. IF YOU ARE USING OUR WEBSITES

Please note that the below description is a general guideline and advisory and specifics of each data process are detailed on the relevant Website.

3.1 WHAT INFORMATION DOES ACTIVEGRAF COLLECT ABOUT YOU?

In case you are using our Websites, ACTIVEGRAF collects several types of personal, aggregated and anonymous data about you, which may include the following:

Aggregated Data including statistical, demographical or other data which is related to you, but may not be used to directly or indirectly identify you, and which therefore does not fall as personal data.

Contact Data includes postal address (city, ZIP code, state and country), billing address, delivery address, location, company name, e-mail address, phone number, contact preferences.

Eligibility Data includes information about your location, company name, user status, ACTIVEGRAF partner data, title, purchase timeframe, purpose, company size data.

Financial Data includes credit card and bank account information, details about your payments and payment defaults, VAT/TAX ID number.

Identity Data includes your full name, position, company name, user status.

Marketing and Communications Data includes your preferences in receiving marketing from ACTIVEGRAF and its affiliates and also upon your consent from third parties, and your communication preferences.

Profile Data includes your username, password, ACTIVEGRAF ID (you may create it when registering to use a ACTIVEGRAF website and application), purchases or orders made by you, your interests, preferences, feedback and survey responses and other similar interactions, data collected from and via e-mails and phone calls and other communications, and other personal data derived from such data and decisions made on the basis of Profile Data.

Technical Data includes referral URL, internet protocol (IP) address, connection IP address, WIFI network (SSID), your login data, browser type and version, time zone setting and location, operating system and platform and other technology on the devices you use to access our websites indicated above.

Transaction Data includes details about payments made by you and other details of products and services you have purchased from ACTIVEGRAF Inc.

Usage Data includes information about how you use our or our partners’ websites, products and services (including data generated during user interactions on ACTIVEGRAF and third party websites, such as registrations, likes and comments, and also data collected automatically via normal IT environment operations (such as crash reports etc.).

ACTIVEGRAF always indicates whether the provision of a certain data is mandatory or optional. Where the provision of a data is mandatory and you fail to provide it, ACTIVEGRAF may not be able to provide the requested service or product, in which case you will be informed accordingly.

3.2 HOW AND WHERE DOES ACTIVEGRAF COLLECTS THIS INFORMATION?

3.2.1 Registration on ACTIVEGRAF websites and Customer Support

When you register to use an ACTIVEGRAF Website application, or contact us for support or other offerings or submit a claim, ACTIVEGRAF collects Identity Data about you. For obtaining certain student and teacher licenses of our applications, further Eligibility Data might be required. When you contact us for support, we may request from you to provide us with copies of your files, photos, documents or other data (although that might not constitute as personal data).

3.2.2 ACTIVEGRAF support lines

Being subject to individual agreement you may contact us for support in technical issues and other service questions by a designated telephone line or e-mail address. When you call this support line ACTIVEGRAF collects Identity Data about you. Based on the type of your request additional information might be required to provide the best solution.

3.2.3 ACTIVEGRAF Websites and Applications

We collect Technical and Usage Data, including information about how you use our websites and applications with or without registration or log-in. We collect information that your browser or device typically sends to our servers whenever you use (e.g. input text) on or visit an ACTIVEGRAF website, or when an ACTIVEGRAF desktop product or application feature takes you online (as when you visit Online help). For example, your browser or device may tell us your IP address (which may also tell us your location) and the type of browser and device you used. When you visit an ACTIVEGRAF Website, your browser may also tell us information such as the page that led you to our website (referral URL) and the websites you generally visit. To collect this information, ACTIVEGRAF may use cookies (please see our cookie information notice below) and similar technologies, and our servers may collect similar information when you are logged in to the website or application. As mentioned below, you may always refuse or opt out of the use of cookies or similar technologies. If you identified yourself or registered at a Website or application, this information may be associated with you or if you have not identified yourself or registered at a Website or application it will be anonymous.

3.2.4 ACTIVEGRAF Emails

Emails we send you, on the basis of your prior written (including electronic means) consent if you are an individual, usually include technologies that tell ACTIVEGRAF whether you have received or opened the email, or clicked a link within the email. If you do not want us to collect this information from ACTIVEGRAF marketing emails, you may withdraw your consent at any time and can either opt out of receiving ACTIVEGRAF marketing emails either in the website or application you are using, or by clicking “unsubscribe” at the end of the message. For more detailed description of your rights, please also refer to clause 10.

3.2.5 ACTIVEGRAF Online Advertising

ACTIVEGRAF advertises online in a variety of ways, including displaying ACTIVEGRAF ads on websites and in apps. We collect your Technical and Usage Data on our websites, including information about which ads are displayed, which ads are clicked on, and on which web page the ad was displayed, and which campaign has generated certain user actions – such as web page views and web page interactions, mobile app interactions, mobile app purchases, file downloads, contact form submissions or registration to ACTIVEGRAF’s online services.

3.2.6 Buttons, Tools, and Content from Other Companies

ACTIVEGRAF websites and applications may include buttons, tools, or content that link to other companies’ services (for example, a Facebook “Like” button). Using these features is completely voluntary, should you decide to use them then please note that we collect information about your use of these features. In addition, please note that when you see or interact with these buttons, tools, or content, or view a ACTIVEGRAF Website containing them, some information from your browser may automatically be sent to the other company (usually at least a javascript code snippet is downloaded from the web server of the other company, which action –being a standard web request– sends most of the details listed under the Technical Data ). Please read that company’s privacy policy for more information.

3.2.7 Third-Party Sites and Services

ACTIVEGRAF websites, products, online services, and applications may contain links to third-party websites, products, and services. Our products and services may also use or offer products or services from third parties. ACTIVEGRAF will not transfer any of your data while you are using these links or navigate to third-party website, in such case it will be these third parties who will advise you on their data processing and collect information from you, which may include such things as Contact Data, these data processing are governed by the privacy practices of these third parties. We encourage you to learn about the privacy practices of those third parties.

We are also working closely with third parties (including, for example, business partners, sub-contractors in technical, delivery services, advertising networks, analytics providers, search information providers, such as Google, Facebook, Linked In based inside or outside the EU) and may receive Technical Data or information about you from them that we usually combine with other information we have about you.

3.2.8 Public sources

To help keep our databases current and to provide you the most relevant content and experience, we may combine information from you with information from public sources and our trusted partners, in accordance with applicable law.

3.2.9 Children’s data

ACTIVEGRAF does not offer any of its products or services to children under the age of 16 and does not allow children under the age of 16 to register on the Websites.

3.3 FOR WHAT PURPOSES AND ON WHAT BASES DOES ACTIVEGRAF USE THE INFORMATION IT COLLECTS ABOUT YOU?

3.3.1 In most cases, ACTIVEGRAF will use your personal data on the following legal bases:

Consent: when ACTIVEGRAF, its distributors, resellers or members of the ACTIVEGRAF Group send you marketing communications via electronic means, such as e-mail, text messages, personal messages (point a) Article 6(1) GDPR).

Legitimate interest: where processing is necessary for our legitimate interests (or those of a third party), and your interests and fundamental rights do not override those interests, and we may verify that a favorable balance of interest test has been carried out (point f) Article 6(1) GDPR).

Performance of contract: where ACTIVEGRAF needs to perform the contract we are about to enter into or have entered into with you as natural person (point b) Article 6(1) GDPR).

Legal obligation: where ACTIVEGRAF needs to comply with a legal obligation, such as tax or other regulatory obligations and requirements (point c) Article 6(1) GDPR).

3.3.2 By way of background information, in general, legitimate interest means the interest of our business in conducting and managing our business to enable us to give you the best service/product and the best and most secure experience. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law). Please be advised if you need further information on the summary of the balance of interest tests carried out by ACTIVEGRAF in relation to the activities set out in the below table, please contact us. Of course, you can always obtain further information about how we assess our legitimate interests against any potential impact on you in respect of specific activities by contacting us.

3.3.3 Performance of contract means processing your data where it is necessary for the performance of a contract to which you as a natural person are a party or to take steps at your request before entering into such a contract.

3.3.4 Legal obligation means processing your personal data where it is necessary for compliance with a legal or regulatory obligation that we are subject to.

3.3.5 The below table includes a general overview on relevant purposes for which ACTIVEGRAF processes your data in the context of various activities, and also the relevant legal basis ACTIVEGRAF relies on.

4. WHAT ARE COOKIES AND HOW DOES ACTIVEGRAF USE THEM?

4.1 A cookie is a small piece of information that will be stored on your hard disk until you delete it. Like most websites and applications, we use our own cookies and those of third parties, together with similar technologies, to make our websites and applications work, to offer you customized and personalized service, and to learn more about our users and their likely interests. Cookies themselves don’t hold personal information. They only have a unique alphanumeric identifier that sits on your browser. And in many cases, we won’t be able to link the information we collect by using a cookie back to you. They can, however, enable us to link that information back to you and your personal information, for example, when you log in, or choose to register for a service, product or newsletter.

4.2 ACTIVEGRAF and third-party vendors including Google and Facebook use first-party and third-party cookies and related user behavior tracking technologies to measure desktop software, mobile application and website usage; record different user activities in its software and on its web sites; and display advertisements based on the user’s previously recorded activities. ACTIVEGRAF does not disclose any personally identifiable information to these third-party vendors. However, third-party vendors automatically receive IP addresses when activity tracking occurs. ACTIVEGRAF may connect user activity data gathered by third-party vendors with information collected by its websites and applications and such data may therefore become Profile or Usage Data.

4.3 You can set your browser so that the browser informs you about cookies or automatically prevents their storage. If you do not store our cookies, you will still be able to visit our website or use our services; however, the use of individual offers or features might be limited.

4.4 You can also prevent your data from being used by third-party vendors by installing browser extensions, such as: http://www.aboutads.info/PMC; https://tools.google.com/dlpage/gaoptout/. Or setting your preferences at web sites like: http://www.youronlinechoices.com/uk/your-ad-choices; http://www.networkadvertising.org/choices/; https://www.google.com/settings/u/0/ads/anonymous

5. DOES ACTIVEGRAF SHARE/DISCLOSE MY PERSONAL DATA?

(A) DISCLOSURE TO DATA PROCESSORS

5.1 ACTIVEGRAF as a business entity is subject to tax related obligations and also is subject to authority reviews, the course of which we could be obliged to share your data with the authorities. These obligations are imposed on ACTIVEGRAF by laws and regulatory decisions, we are legally bound to fulfil these requirements.

5.2 ACTIVEGRAF also works with companies that help us run our business. Among these are the subsidiaries of ACTIVEGRAF and also companies that are not linked to ACTIVEGRAF providing services for us. These services vary in subject and term: external consultants, professional advisers such as lawyers or auditors, technical support functions (IT and document storage providers, professionals delivering customer support and sending emails on our behalf). These are called data processors are engaged in all cases based on written contract with appropriate guarantees to safeguard the security of the data and the rights of the data subjects. In some cases, these companies have access to some of your personal information in order to provide services to you on our behalf. They are not permitted to use your information for their own purposes, and we ensure by data processing contracts (including electronic format) that your data are being processed in accordance with the legal regulations.

5.3 Currently, ACTIVEGRAF is using the following data processors:

5.4 It is ACTIVEGRAF’s legitimate interest to prevent and respond to fraud, to defend our Websites and applications against attacks, to protect the property and safety of ACTIVEGRAF, our customers, users, the public. That is why our distributors and specific companies are retained as data processors to assist us to combat piracy. Please note that it is ACTIVEGRAF’s legitimate interest from the above reasons not to identify our service providers. We share Your IP address, MAC address, software version and language with them exclusively for the above purposes.

5.5 Further to the above as indicated earlier ACTIVEGRAF provides its services in close cooperation with its subsidiaries therefore it is frequent that an ACTIVEGRAF subsidiary acts as data processor on behalf of ACTIVEGRAF.

(B) DISCLOSURE TO OTHER DATA CONTROLLERS

5.6 In other cases, we provide your data to other entities to use such data under their own name and for their own benefit. Sometimes we may need to do this to comply with a legal obligation (such as when we need to provide certain Transaction, Technical or Identify Data to the police or other authorities), and in other cases, we rely on other legal grounds, such as our legitimate interests or your written (including electronic means) consent.

5.7 Accordingly, if you consent to the sharing, as indicated above in the table, ACTIVEGRAF may also share your Identity Data, Contact Data and Marketing and Communications Data with ACTIVEGRAF’s subsidiaries, and distributors Please note that we do not share personal information about consumers with third parties for their own marketing purposes unless the consumer agreed to that sharing.

5.8 We may share or publish Aggregate Data that doesn’t specifically identify you, such as statistical information about visitors to our websites or statistical information about how customers use our applications.

5.9 We require all third parties to respect the security of your personal data and to treat it in accordance with the law and the data processing contract if any. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

6. INTERNATIONAL TRANSFERS

6.1 As indicated above, we share your personal data within the ACTIVEGRAF Group and with our Distributors as follows:

1. You provide us with certain personal data when registering at our Websites. In such case, if you consent to the sharing, as indicated above in the table, ACTIVEGRAF as data controller may also share your Identity Data, Contact Data and Marketing and Communications Data with ACTIVEGRAF’s local subsidiaries.

These transfers may involve transferring your data outside the European Economic Area (EEA).

6.2 Also, since many of our external third parties are based outside the European Economic Area (EEA) (such as Microsoft, Inc., Digital Ocean, Inc., Salesforce.com, Inc.), so their processing of your personal data will involve a transfer of data outside the EEA.

6.3 Whenever we transfer your personal data outside of EEA, we contractually ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

1. we will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission. For further details, see European Commission: Adequacy of the protection of personal data in non-EU countries.
2. where we use certain service providers, we may use specific contracts approved by the European Commission which give personal data the same protection it has in Europe. For further details, see European Commission: Model contracts for the transfer of personal data to third countries.
3. where we use providers based in the US, we may transfer data to them if they agree to abide by and process European Data in compliance with the Standard Contractual Clauses (“SCC”).  Our contractual arrangements also stipulate that, in the event of any conflict between our data processing agreements and the SCC, the SCC prevails.

6.4 Please do contact us if you need further information on the specific mechanism used by us when transferring your personal data outside of EEA.

7. IS MY PERSONAL DATA SECURE, AND WHERE WILL IT BE STORED?

7.1 We understand that the security of your personal information is important. We provide reasonable administrative, technical, and physical security controls to protect your personal information. All information you provide us is stored on secure servers. Where we have given you (or where you have chosen) a password which enables you to access certain parts of our websites, you are responsible for keeping this password confidential. We ask you not to share a password with anyone. Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot warrant or guarantee the security of your data transmitted to us; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorized access. In case your data is provided by registering on our websites than we ensure that this registration is completed on a secured platform where we apply our security measures. In case you would like to have more information on the specific security measures taken in order to save your data than please contact us.

7.2 Also, we have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorized way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality.

7.3 Finally, we have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

7.4 Your personal information and data files are stored on ACTIVEGRAF’s servers and the servers of companies we hire to provide services to us. As shown in clause 7 above, your personal information may be transferred across national borders because we have servers located worldwide and the companies we hire to help us run our business are located in different countries around the world (for example, Germany, Ireland, the United States). As mentioned in clause 7 above, the data that we collect from you may therefore be transferred to, and stored at, a destination outside the European Economic Area (“EEA”). It may also be processed by staff operating outside the EEA who work for us or for one of our suppliers. Such staff maybe engaged in, among other things, the fulfilment of your order and the provision of support services.

8. HOW LONG WILL ACTIVEGRAF HOLD AND USE MY PERSONAL DATA?

8.1 We only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

8.2 To determine the appropriate retention period for personal data, we take into account the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

8.3 Details of retention periods for different types of your personal data are available in the relevant Personal Data Information Sheet attached hereto.

8.4 More specifically, and without limiting the generality of the foregoing, by law we have to keep basic information about our customers (including Contact, Identity, Financial and Transaction Data) for at least 5, in certain cases 8 years after they cease being customers for tax, financial auditing, and record keeping purposes.

8.5 In some applicable circumstances you can ask us to delete your data: see the clause dealing with ‘Right To Erasure’ below for further information.

8.6 In some circumstances we may anonymize your personal data (so that it can no longer be associated with you) for research or statistical purposes in which case we may use this information indefinitely without further notice to you.

9. YOUR RIGHTS REGARDING YOUR PERSONAL DATA

9.1 Your right to access

You have the right to access your personal data, including requesting information on whether ACTIVEGRAF processes your data, which data are processed, and you may also request a copy of the data that you or a third person provided to ACTIVEGRAF and which data is being processed by ACTIVEGRAF.

If you request that ACTIVEGRAF confirm whether or not ACTIVEGRAF processes your personal data, then you have the right that obliges ACTIVEGRAF to confirm that it processes your personal data or does not process your personal data.

Your right to obtain confirmation whether ACTIVEGRAF processes (or does not process) your personal data

(a) does not include data that is anonymous;

(b) includes the personal data that concern you;

(c) does not include personal data that does not concern you; and

(d) includes pseudonymous data that can be clearly linked to you.

ACTIVEGRAF shall give you access to your personal data if

(a) you request ACTIVEGRAF to confirm whether or not it processes your personal data, and

(b) ACTIVEGRAF confirms that it processes your personal data, and

(c) you request access to your personal data.

ACTIVEGRAF shall provide you with a copy of your personal data if

(a) you request ACTIVEGRAF to confirm whether or not it processes your personal data, and

(b) ACTIVEGRAF confirms that it processes your personal data, and

(c) you request a copy of your personal data.

If you request further copies of your personal data, then ACTIVEGRAF may charge you the fee, based on the administrative costs incurred in relation to the accommodation of such request.

Upon your request ACTIVEGRAF will give you access to the following information:

1. the purposes of the processing;
2. the categories of personal data concerned;
3. the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
4. where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
5. the existence of your right to request from ACTIVEGRAF rectification or erasure of your personal data or restriction of processing of personal data concerning you or to object to such processing;
6. the right to lodge a complaint with a supervisory authority;
7. where your data are not collected from you, any available information as to their source;
8. the existence of automated decision-making, including profiling, and meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for you.

Please also note that many of our websites and applications allow you to access or edit your personal information by accessing the “my profile,” or a similar feature of the website or application you are using. Likewise, you can access files you have stored in our online services by logging in and using the functions they make available.

9.2 Your right to rectification

You have the right to the correction of your personal data without undue delay. This enables you to ask that any incomplete or inaccurate data we hold about you be corrected.

Your right to obtain rectification of your data that are inaccurate

(a) does not include data that is anonymous

(b) includes the personal data that concern you

(c) does not include personal data that does not concern you and

(d) includes pseudonymous data that can be clearly linked to you.

ACTIVEGRAF shall rectify your personal data if

(a) ACTIVEGRAF processes your personal data, and

(b) the personal data in question are inaccurate, and

(c) you request the rectification of your personal data.

ACTIVEGRAF shall complete your personal data if

(a) ACTIVEGRAF processes your personal data, and

(b) the personal data in question are incomplete, and

(c) you request the completion of your personal data and if necessary, you provide supplementary information for completion.

ACTIVEGRAF may verify any and all data provided to it. ACTIVEGRAF shall taking account of available technology and the cost of implementation, take reasonable steps, including technical measures, to communicate the rectification of your personal data to recipients of such personal data (if any). However, ACTIVEGRAF shall not communicate the rectification of personal data to recipients if the communication to such recipients is either impossible or involves a disproportionate effort.

Please also note that many of our websites and applications allow you to edit your personal information by accessing the “my profile,” or a similar feature of the website or application you are using. Likewise, you can edit files you have stored in our online services by logging in and using the functions they make available.

9.3 Your right to erasure (‘right to be forgotten’)

Subject to certain conditions and in certain cases, you have the right to the erasure of your personal data. This means that you may request that we delete your personal data that we may have processed unlawfully or where the use of your data is no longer needed for a purpose. Please keep in mind that ACTIVEGRAF may not be able to meet your request for specific legal reasons that will be notified to you, if applicable.

ACTIVEGRAF shall erase your personal data without undue delay if

(a) ACTIVEGRAF processes your personal data, and

(b) you request to obtain the erasure of your personal data, and

(c) the personal data are no longer necessary to the purposes for which ACTIVEGRAF collected them

ACTIVEGRAF shall erase your personal data without undue delay if

(a) ACTIVEGRAF processes your personal data based on your consent, and

(b) you request to obtain the erasure of your personal data, and

(c) you withdraw your consent on which the processing of your data is based, and

(d) there is no alternative legal basis for the processing of your data any further.

ACTIVEGRAF shall erase your personal data without undue delay if

(a) the processing is based on being necessary for the purposes of the legitimate interests of ACTIVEGRAF or a third party, and

(b) you object to ACTIVEGRAF’s processing of your personal data, and

(c) the legal ground for the processing of your personal does not override your objection.

ACTIVEGRAF shall erase your personal data without undue delay if

(a) you request to obtain the erasure of your personal data, and

(b) the processing by ACTIVEGRAF of such data is unlawful, or

(c) if the erasure is required under applicable law, or

(d) your data is collected in relation to the offer of an information society service.

ACTIVEGRAF shall, taking account of available technology and the cost of implementation, take reasonable steps, including technical measures, to communicate the erasure of your personal data to recipients of such personal data (if any). However, ACTIVEGRAF shall not communicate the erasure of personal data to recipients if the communication to such recipients is either impossible or involves a disproportionate effort.

Please note that there are certain cases when you may not request erasure of your data. These reasons will be communicated to you if your request for erasure cannot be completed.

Please also note that many of our websites and applications allow you to edit or delete your personal information by accessing the “my profile,” or a similar feature of the website or application you are using. Likewise, you can delete files you have stored in our online services by logging in and using the functions they make available.

9.4 Your right to the restriction of processing

You may also request the restriction of the processing of your personal data. For instance, you may request that we suspend the processing of your personal where our use of the data is unlawful, but you do not want us to delete it.

Your right to request the restriction of the processing of your personal data

(a) does not include data that is anonymous;

(b) includes the personal data that concern you;

(c) does not include personal data that does not concern you; and

(d) includes pseudonymous data that can be clearly linked to you.

ACTIVEGRAF shall restrict the processing of your personal data for a period to verify the accuracy of such data if you request to obtain the restriction of the processing of your personal data, and you contest the accuracy of such data.

ACTIVEGRAF shall restrict the processing of your personal data if you request to obtain the restriction of the processing of such data, the processing of which is unlawful, and you oppose the erasure of such data.

ACTIVEGRAF shall restrict the processing of your personal data if

(a) you request to obtain the restriction of the processing of such data, and

(b) ACTIVEGRAF does not need such data for the purposes of its processing, and

(c) you require your data for establishment, exercise or defense against a legal claim.

ACTIVEGRAF shall restrict the processing of your personal data if

(a) you object to the processing of your personal data that are necessary for the purposes of the legitimate interests that ACTIVEGRAF pursues, and

(b) you wait to verify that the legitimate ground of ACTIVEGRAF’s processing of your personal does not override your objection.

ACTIVEGRAF shall, taking account of available technology and the cost of implementation, take reasonable steps, including technical measures, to communicate the restriction of processing of your personal data to recipients of such personal data (if any). However, ACTIVEGRAF shall not communicate such restriction to recipients if the communication to such recipients is either impossible or involves a disproportionate effort.

If ACTIVEGRAF restricts its processing of an your personal data, then it may

(a) store such personal data,

(b) process such personal data on the basis of your consent,

(c) process the personal data for establishing, exercise or defend a legal claim, or for protecting the rights of another person.

In case you have obtained restriction of processing as per the above than you shall be informed by ACTIVEGRAF before the restriction of processing is lifted.

9.5 Your right to data portability

Where the processing of your data is either based on your consent (e.g. in respect of electronic direct marketing), or is necessary for the performance of a contract (e.g. customer registration data and data relating to your orders), and the processing is carried out by automated means, than you may request the provision of your personal data that you have provided to us in a standard format, and you may also request that such data be transferred to another entity.

Without prejudice to your rights above, you have the right to receive the personal data concerning you, which you provided to ACTIVEGRAF, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance (where technically feasible) from ACTIVEGRAF, where the processing is based on your consent, or is necessary for the performance of a contract, and the processing is carried out by automated means.

Your right to data portability

(a) does not include data that is anonymous;

(b) includes the personal data that concern you;

(c) does not include personal data that does not concern you; and

(d) includes pseudonymous data that can be clearly linked to you.

9.6 Your right to object

Importantly, when we process your data on the basis of our legitimate interests as indicated in the above table, you may object to such processing and request that any of those activities be stopped. Similarly, you may opt-out of any of our direct marketing activities at any time by contacting us at privacy@activegraf.com, by adjusting your preferences in the privacy dashboard provided as part of some of our services (e.g.”my profile”), or by using the ‘unsubscribe’ function at the end of our messages.

9.7 Your rights in relation to automated decision making and profiling

You have the right to request not to be the subject of automated decision-making including profiling where the decision produces legal effects or equally has a significant effect on you, and can insist on human intervention where appropriate.

There are exceptions to this right, which are, if the decision:

1. Is necessary for concluding or performing a contract
2. Is authorised by law
3. Is based on the data subject’s explicit consent

9.8 Your right to withdraw consent

Also, you have the right to withdraw your consent at any time where we rely on your consent for processing your data (e.g. for certain electronic direct marketing purposes). You may do this at any time by contacting us at privacy@activegraf.com , by adjusting your preferences in the privacy dashboard provided as part of some of our services (e.g.”my profile”), or by using the ‘unsubscribe’ function at the end of our messages. Remember that the withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal and that in some cases we may need time to process request.

ACTIVEGRAF shall, taking account of available technology and the cost of implementation, take reasonable steps, including technical measures, to communicate your objection/withdrawal of consent to recipients of such personal data (if any). However, ACTIVEGRAF shall not communicate such restriction to recipients if the communication to such recipients is either impossible or involves a disproportionate effort.

9.9 Your right to lodge a complaint

Without prejudice to any other administrative or judicial remedy that you may have (such as the right to claim compensation for damages suffered as a result of ACTIVEGRAF’s breach of the GDPR), you have the right to lodge a complaint with the supervisory authority in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes the GDPR.

In any case, we would highly appreciate the chance to deal with your concerns before you approach the regulatory authority, so please contact us in the first instance if you have any problems.

9.10 Restrictions on the above rights

Please be advised that based on GDPR Member States are allowed to restrict by way of a legislative measure the scope of the rights you may have as per the above. In case such restriction is applicable in your respect, we will advise you accordingly when you contact us on exercising any of your above rights.

9.11 Contact details

If you wish to exercise any of your rights mentioned above, please contact us at the addresses set out in clause 1.2 above.

9.12 No fee usually required

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a fee if your request is clearly unfoundead, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

9.13 Verification of your identify

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

10. CHANGES TO THIS PRIVACY POLICY

This Privacy Policy is effective as of the date indicated on the top. Earlier versions may be obtained by contacting us at privacy@activegraf.com. We will inform you in case of any changes to this Privacy Policy in due course.