Personal Data Protection Notice

Last updated: 01/02/2024

1 / Introduction

Rotarex S.A. and its companies (hereinafter "ROTAREX GROUP", "company", "we", “us” or “our”) attaches great importance to the protection of personal data and undertakes to comply with Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 ("GDPR") as well as any other applicable laws and regulations.

2 / Scope

This Personal Data Protection Notice (“Notice”) explains how ROTAREX GROUP collects, uses, shares and otherwise processes your personal data in connection with your relationship with us as a supplier, partner, visitor, client or acting for a client or being generally interested in our services, in accordance with applicable data protection laws and regulations.

3 / Update

This Notice will be reviewed on a periodic basis. Any changes to this Notice shall be approved by the ROTAREX GROUP Executive Committee.

The latest version of this Notice will always be available on our website.

4 / Categories of personal data processed

When using the term “personal data” in our Notice, we mean information that relates to you and allows us to identify you, either directly or in combination with other information that we may hold.

We may collect personal information from you in the course of our business, including through your use of our website, when you contact or request information from us, when you engage our services or as a result of your relationship with one or more of our staff and clients or when you visit our company premises.

Depending on the purposes pursued, we may collect the following information:

If relevant to the products and services we provide to you, we will also collect information about your business partners, their representatives, and agents.

Please note that some of your information is collected automatically. Thus, when you access our website, we may automatically collect, through log files, certain information from your device, such as the IP address, the operating system of your device, the pages visited, the requests made, the day and time of connection and the information associated to your account such as your username, e-mail address and password. The use of such files allows us to offer you a more consistent experience on the website.

Also, we and our partners are using technologies like cookies or targeting and process personal data and browser information to customize the content on our website and improve your browsing experience. You can learn more about the cookies used on the ROTAREX GROUP website and can modify your consent at any time on the Cookie Notice page.

5 / Legal bases and purposes of processing

We always process your personal data for a specific purpose and only process the personal data which is relevant to achieve that purpose.

We will only use your personal data for the purposes for which we collected it and which we informed you about, unless we reasonably consider that we need to use it for another reason which is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

6 / Recipients of personal data 

We may use or disclose personal data if we are required by law to do so or if we reasonably believe that use or disclosure is necessary to protect our rights and/or to comply with judicial or regulatory proceedings, a court order or other legal process.

To achieve the purposes mentioned above, the data is transmitted to the following recipients:

• Internal employees who have permissions;
• Network and technology systems providers;
• IT service provider ;
• Member firms of ROTAREX GROUP;
• Any third party to whom we assign our rights or obligations;
• Administrative authorities, courts, tribunals, government agencies, law enforcement agencies and notaries;
• Insurance companies by reason of the conclusion of an insurance contract over the benefits or occurrence of the insured event (e.g., liability insurance);
• Cooperation partners and legal representatives acting on our behalf;
• Other recipients as determined by the client (i.e., group companies of the client);
• Other service providers acting as subcontractors and on instruction from ROTAREX GROUP.

Some of the above-mentioned recipients may be based in third countries. Where this is the case, transfers will be undertaken in line with Chapter V of the GDPR and applicable data protection laws and regulations. In case of an intra-group transfer to another member firm located in a country that do not offer adequate protections, we use the European Commission's standard contractual clauses (SCCs) to provide adequate protection.

7 / Personal data retention period

Your personal data is stored by ROTAREX GROUP only for as long as is necessary for the purpose for which we obtained them. The retention period will depend upon several factors, such as the duration of the contract concluded with you, or legal requirements imposed to the members of ROTAREX GROUP.

Thus, the log files collected during interactions with the website are destroyed after 6 months after the moment of the collection.

Furthermore, the personal data we collect when responding to your requests will not be kept for more than 3 years from the last contact with ROTAREX GROUP if no contact is signed between you and ROTAREX GROUP.

We may also keep and process your personal data after the termination of our contractual or commercial relationship for specific purposes such as the compliance with other legal obligations (as a rule, data must be kept for a period of 10 years for commercial matters) or the establishment, exercise, or defence of legal claims.

Whenever we process your personal data on the basis of your consent, you have the right to withdraw your consent at any time by contacting us as indicated below or by clicking the unsubscribe link in the email communication we send you (e.g., ROTAREX GROUP events, product updates, etc.). Please, note that the withdrawal of your consent does not affect the lawfulness of the personal data processing based on consent prior to its withdrawal.

In some circumstances we may anonymize your personal data so that it can no longer be associated with you, in which case it is no longer considered as personal data.

Upon expiry of the applicable retention period, we will securely destroy your personal data in accordance with applicable laws and regulations.

8 / Security of personal data

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk so that the processing complies with the GDPR and applicable date protection laws.

These measures must provide for a level of security considered appropriate considering the technical standards and the type of personal data processed but also:

• the state of the art and implementation costs.
• the nature, scope, context, and purposes of processing; and
• the likelihood and severity of the risk to the rights and freedoms of natural persons.

Security requirements are continually evolving, and effective security requires frequent assessment and regular improvement of outdated security measures. We are committed to continuously evaluate, strengthen, and improve the measures we implement.

9 / Data subjects’ rights

As a natural person, you have several rights regarding your personal data that we can exercise in certain circumstances, including:

• the right of access: You can request access to the data concerning you at any time as well as a copy of the data.
• the right to rectification: You can request at any time that inaccurate or incomplete data be rectified.
• the right to erasure: You can request that your data be deleted when, for example, the data is no longer necessary for the purposes for which it was collected or processed.
• the right to restriction of processing: You can request that we restrict the processing of data if, for example, you question the accuracy of the data concerning you or if you object to the processing of data concerning you.
• the right to data portability: You have the right to have your data transferred to another data controller in a structured, commonly used, and machine-readable format, if the processing is carried out by automated means or if it is based on prior consent.
• the right to object to processing: You can object to the processing of your data and can withdraw your consent if the processing is based on consent, for example if the data is used for commercial prospecting purposes.

If you wish to exercise your rights, please contact us at gdpr@rotarex.com

Your request will be responded to within 1 month at the latest, starting from the moment of your identity confirmation. We may extend the time limit by a further 2 months if the request is complex or if we have received a high number of requests.

You will in general not have to pay a fee to exercise any of your individual rights mentioned in this Notice. However, we may charge a reasonable fee if your request to exercise your individual rights is manifestly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

If you are not satisfied with our response, you also have the right to lodge a complaint at any time with the competent data protection authority.

• List of EU data protection authorities: https://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm
• List of global data protection authorities: https://iapp.org/resources/global-privacy-directory/