Introduction

This Privacy Policy for Business Partners and Visitors (‘Privacy Notice’) describes how eLstar Dynamics B.V. – based at Achtseweg Zuid 153 V, 5651 GW Eindhoven– and its group companies (‘eLstar, ‘us’, ‘our’ or ‘we’) processes the personal data of individuals such as customers, suppliers and visitors of eLstar premises, collaboration portals and website. Processing personal data is a broad term and includes (amongst other things) collecting, recording, storing, amending, reviewing, using and deleting personal data.

We have carefully drafted this Privacy Policy to inform you in plain language about our privacy practices. The Privacy Policy tells you what personal data we process about you, why we process it and how we use it. We encourage you to read the Privacy Policy in full.

Some countries may have stricter or deviating local legal requirements for the processing of personal data. For example, local law may impose different requirements on how long we have to keep your data (data retention). In case of a conflict between this Privacy Policy and local legislation, the latter will prevail.

Please contact our Legal and Operations Associate at megha.nair@elstar-dynamics.com for assistance.

 

What is personal data?

‘Personal data’ (or ‘data’, ‘personal information’ or ‘your data’), refers to any information relating to an identified or identifiable natural person (‘data subject’).

An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier – or by reference to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

(Art.4 EU GDPR)

 

What personal data do we process about you?

As a business partner or visitor to eLstar, we process and use your information to do business with you, to facilitate your access to our premises or website and to manage our processes. We may process personal data about you, such as:

1. Identifiers, such as contact details (i.e., name, alias, telephone number, postal address, e-mail address), gender, date of birth;

2. Organizational information such as your employer and role, Chamber of Commerce, VAT and tax information;

3. Government-issued data and documentation required under immigration laws, such as passport number and expiry date, nationality, social security/national insurance/equivalent identification number and work permit;

4. Information provided by you during eLstar’s customer and/or supplier onboarding process;

5. Interaction data such as enquiries and complaints handling, management of business relationships and communications;

6. System logs and data generated when transmitting information over an eLstar network or while using an eLstar asset, such as IP addresses, telecom data, device information, user account information and user’s activity logs, time and date of your logins and the type of information and files exchanged;

7. Information obtained from cookies and similar tracking technologies used on our websites, from your use of our websites. For more information, please read our Cookie Notice;

8. Geolocation data, such as geographical location identifiers (e.g. to verify your access rights to high risk or export-controlled data);

9. Order history, credit and payment information;

10. Information from screening and background checks;

11. Information regarding suspected and actual criminal behavior, criminal records or proceedings regarding criminal or unlawful behavior;

12. Sensory or surveillance data, such as on premise information collected through access control and CCTV recordings;

13. Information and results regarding surveys, tests and trainings;

14. Information provided by you in order to attend an eLstar event, such as education details and dietary preferences;

 

How do we obtain your personal data?

We collect personal data directly from you when you do business with us or visit us. In addition, we may collect personal data through technical means such cookies or similar technologies on our website, CCTV, or the eLstar systems and assets you might use. We also collect your personal data from third parties, such as professional screening agencies and background check providers, to the extent permitted by applicable law.

 

For which purposes do we process your personal data?

We may process your personal data for one or more of the following purposes:

1. Assessment and (re)screening of (potential) business partners;

2. Management of (delivered) services, products and materials to and from eLstar;

3. The development and improvement of products and/or services;

4. The delivery of customer services, making travel arrangements and obtaining visas, permits and technology export licenses;

5. To efficiently manage and operate administrative, information technology, and communications systems, risk management and insurance functions, budgeting, financial management, and strategic planning;

6. To protect the health, safety, security and integrity of eLstar and its business partners and visitors, (IT) facilities and assets, including occupational safety and health, and intellectual property;

7. For organizational analysis and development, management reporting and corporate or financial transactions, such as acquisitions and divestitures;

8. Financial and accounting management, archiving and insurance coverage, legal and business consulting and possible dispute resolution;

9. Sales, account management and marketing;

10. To comply with the law, including the investigation of any possible cases of non-compliance with statutory or contractual obligations or the disclosure of personal data to government institutions or supervisory authorities, as well as to exercise or defend legal claims;

11. To protect the vital interests of business partners and visitors;

12. For business process, work execution, and internal management, including (company) audits.

 

What is the legal basis for processing your personal data?

Legal bases are justified reasons for the processing of your personal data (as per Art.6 of the EU GDPR):

1. The legitimate interest of business and management purposes;

2. Entering into and managing a contract or business relationship;

3. Compliance with our legal obligations;

4. Protecting your vital interest or that of another natural person; and

5. Your specific and informed consent.

In the event that the processing of your personal data is based on your consent, you have the right to withdraw your consent at any time. Please note that the withdrawal of your consent does not affect the lawfulness of the processing of your personal data prior to the withdrawal of your consent.

 

Who has access to your personal data?

Access to your personal data within eLstar

Our employees are authorized to access personal data only to the extent necessary to serve one or more of the purposes set forth in this Privacy Policy and in so far as necessary within the scope of their roles and responsibilities as eLstar employees.

Access to your personal data by third parties

Your personal data may be shared with third parties for the purpose of providing their products and/or services to eLstar or vice versa. When we transfer personal data to third parties, we will only do so under strict confidentiality obligations and where necessary, we will have an agreement concerning the processing of your personal data in place.

Your personal data may also be disclosed to competent public authorities, governments, regulatory or fiscal agencies where it is necessary to comply with rules or regulations to which eLstar is subject. Additionally, we may disclose your personal data to third parties at your direction and we may also disclose your personal data when we believe disclosure is necessary to comply with the law or to protect the rights, property, or safety of eLstar, its customers, or others.

eLstar does not sell your personal data or disclose it for cross-context behavioral advertising to anyone.

 

How long will we keep your personal data?

Your data will be kept only for the period required to serve the purposes mentioned under this privacy policy (and to comply with legal requirements – if any). After the applicable retention period your personal data will be securely deleted, destroyed or de-identified.

 

How is your personal data secured?

We have taken adequate measures to protect the confidentiality, integrity and availability of your personal data. The implementation of appropriate technical, physical and organizational measures protects your personal data against the following incidents:

• Accidental or unlawful destruction;

• Accidental loss, damage or alteration;

• Unauthorized disclosure or access; and

• Any other forms of unlawful processing (including, but not limited to improper use).

We have procedures in place to deal with any (potential) personal data breach. You and the relevant data protection authorities will be notified of a personal data breach, where we are legally required to do so.

 

What are your rights?

Where provided under the applicable law, you have rights in relation to your personal data, such as:

• The right to access the personal data we have about you;

• The right to know how we process your personal data;

• The right to have your personal data corrected;

• The right to have your personal data deleted (‘right to be forgotten’);

• The right to restrict processing of your personal data by us;

• The right to object to automated decisions;

• The right to withdraw consent at any time and without detriment;

• The right to object to certain data processing operations;

• The right to request a transfer of your personal data (‘right to data portability’); and

• The right to copy, correct, delete your personal data by your relative in case of your death (if applicable).

Reasonable limitations in the application of these rights can occur insofar as it is permitted under the GDPR (e.g: requests associated with the right to access may be denied if the request is found to be manifestly unfounded or excessive).

If you feel we are not handling your request appropriately you also have the right to lodge a complaint with the relevant data protection authority.

(Art. 12 – 23 EU GDPR)

 

How do you exercise your rights?

If you wish to exercise any of these rights, please email our Legal and Operations Associate at megha.nair@elstar-dynamics.com.

We will always check your identity to ensure that it is you exercising your rights. To verify your identity, we match personal data that you provide us against personal data we maintain in our files. The more risk entailed by the request (e.g., a request for specific pieces of personal data), the more items of personal data we may request to reduce the risk that someone might try to impersonate you. If we cannot verify your identity to a sufficient level of certainty to respond to your request, we will let you know promptly and explain why we cannot verify your identity and what further information we might need from you to be able to properly verify your identity and comply with your request.

When exercising your right; the more specific you are, the better we can assist you with your request. In some cases, where permitted by law, we may deny your request, in which case we will notify you of the reason for denial.

 

What are your responsibilities?

We would like to kindly remind you that you are responsible for providing us with accurate, complete and up-to-date data.

Furthermore, please keep in mind that this privacy policy may be updated in the future for legal or operational purposes. You are therefore advised to refer to this page from time to time to keep track of such changes.