PERSONAL DATA PROTECTION IN COMPANY INDOP D.O.O. –
LEGAL NOTICE
Here is a document that informs you about your personal data protection rights that you have entrusted to Indop, d.o.o. (hereinafter referred to as INDOP) and for what purpose this company uses this data. Document provides information that can help you provide your rights.
In accordance with valid regulation GDPR and the Law on protection of personal data (ZVOP-2) the personal data manager may process personal data if a personal consent of the individual is given. Personal consent is a voluntary statement of an individual that his personal data may be processed for a specific purpose mentioned in this notice. In INDOP we are aware of the importance of protecting personal data, your information is handled carefully and in accordance with regulation.
These personal data protection policies apply for the use of the subdomain on our websites https://www.indop.si/ and https://www.indop.eu (Customer support – Partners portal): https://online.indop.eu, »Indop Spare parts« and connected domain »Indop documents« https://documents.indop.eu and for the Indop Remote Monitoring System (hereinafter as: IRMS,https://cns.indop.eu ).
We politely ask you to carefully read our Personal data rules. We recommend printing out and saving a copy of this document and any future versions which apply to our records of consents you have granted us.
1. Personal Data Manager
Manager of the Personal data collection is company INDOP, projektiranje, proizvodnja in trženje industrijske opreme, d. o. o., with headquarters at Primorska cesta 6a, 3325 Šoštanj, Slovenia.
For any questions please contact us on our Email address info@indop.si or call us on +386 (0)3 899 22 15.
2. Categories of personal data users
Users of personal data collection in INDOP are:
· Depending on the allocated rights and access level to individual domain:
· Company General Manager (Indop Spare parts, Indop documents, IRMS-serial number of product).
· Responsible person in Purchase (Indop Spare parts).
· Responsible person in Quality Control (IRMS and Indop Spare parts- only serial number of product).
· Responsible person in After sales (IRMS and Indop Spare parts -only serial number of product).
· Responsible person in Development and Technology (Indop Spare parts and IRMS- only serial number of product).
· Responsible person in Development and Technology (programmer) (IRMS- direct access to the product).
· Responsible person in Production (IRMS- only serial number of product).
Users of personal data collections:
· Users of personal data are only employees in INDOP. All users are obliged to respect Protection of personal data regulations of all partners. Detailed information of users can be received by sending an Email to info@indop.si. Personal data of our partners are business secret of company INDOP.
· All personal data users are carefully selected and audited by INDOP if all regulations of personal data protection are being followed during all work processes.
· Users have access to these data in accordance with authorisations and allocated rights. Users can use personal data which are necessary for the performance of working tasks.
3. Relevant Personal Data Commissioner in Republic of Slovenia
You have the right to file a complaint regarding the use of your personal data at a Relevant Personal Data Commissioner. Other information related to the protection of personal data is also available.
All data about the relevant Personal Data Commissioner in Republic of Slovenia are available here, web page https://www.ip-rs.si/o-pooblascencu/osebna-izkaznica/.
4. How your personal data are acquired, used and otherwise processed
Your personal data are acquired from various sources depending on how you provide them to us, mainly it relates to the operative business we have with your company (business transactions, communication) and your use of our web applications and their features.
We acquire them also when contacting us directly by e-mail, in writing or by using our web applications and orders of our spare parts, products and services, or from any kind of other way where you forward us your personal data. When permitted by law, we can also obtain data from other public sources. All obtained data and information we process exclusively for the performance of our work in connection with the marketing of products and services that the company carries out.
We also collect data about your use of our website using cookies. Our cookie policy, which is described in Chapter 9, provides more information on how we use cookies to collect data about you.
5. Personal Data Categories that INDOP collect and process
Within this collection, the company collects and processes your personal data such as:
- Name and Surname.
- Business Email address or and other email address you forwarded us.
- Phone number you forwarded us.
- Name and Address of the company you work or worked for.
- User name for access and access level.
- List of company products.
- Serial number of the product and location of product installation.
- State.
- Information about your use of our web page (for example what pages you saw, time you spend on each page, what you clicked).
- Information about your computer or mobile device (for example your IP address and type of browser, type of device).
- Information about your orders in the application Indop Spare parts.
INDOP does not collect or process specific types of personal data (personal data revealing racial or ethnic origin, political opinion, religious or philosophical beliefs or trade union membership, genetic data, biometric data for identifying an individual, health information or information relating to an individual's sexual life or sexual orientation).
6. Data processing purpose of your personal data
Your personal data may be used for one or more of the following purposes:
1.) Connected with your use of our products and services and with adjusting the users experience to your needs and goals:
· Managing and improving our web applications, including customizing users experience of our webpage. This is necessary for our legitimate interest to better understand the wishes of our existing and potential customers, and to adapt our web applications, products, spare parts, documentation and services according to your needs and expectations.
· Managing INDOP's relationships with current and potential customers. We do this by analysing data on the history of our customers relationship with the aim of improving business relationships with customers, with an emphasis on customer retention and final sales growth. It is necessary for our legitimate interest to better understand the wishes of our customers and to effectively manage our business.
· Segmenting data about you, which allows us to adapt the offer of our spare parts, products and services to you and for internal statistical reports.
· Communicating directly with you. This is necessary either to inform you occasionally of changes on our web application, changes and innovations of our spare parts and documentation and to follow the performance of our products, or to our legitimate interest in completing and confirming your requirements to provide you with our spare parts and services and to answer questions we receive from you. We can also inform you about benefits, discounts and special benefits, new products, eventual events.
· Implementation of operational operations - business transactions related to the subject of business (preparation of orders and deliveries). If you do not provide us with your personal information necessary for this purpose, we will not be able to offer our services that you have requested on your behalf or on behalf of your company.
· After sales activities:
· IRMS: This is necessary to keep you informed of our findings on monitoring your product performance, eliminating and analysing products malfunctioning, and creating products operating reports. Each customer can monitor the performance of their products. INDOP monitors the performance of all products sold and analyses malfunctioning when it comes to it and informs you about it. Through this application, the performance of regular services on products is planned, and direct access to individual product is also possible.
· Indop Spare parts: This is necessary for the smooth running of your orders for spare parts for individual products by serial numbers and for order status notification.
· Indop documents: This is necessary to access complete documentation of each individual product you purchase.
· Sharing personal data with third parties (hereinafter: our subcontractor),which is related to us in relation to the use of web application services. This will be necessary for our legitimate interest in effective web application management, compliance with legal obligations that bind us or for our own purposes. When we share your personal data, we will do it consistently based on the need to know, in accordance with the appropriate confidentiality restrictions, on an anonymous basis as far as possible and only to the extent strictly necessary for any of these purposes.
· Communicating with our business advisors and legal representatives.This is necessary for our legitimate interests in obtaining legal or professional business advice, and we will only provide your personal data if necessary, to the minimum extent that is necessary and anonymous whenever possible and the condition of non-disclosure contract (NDA).
· Enforcement of our legal rights and compliance with laws, regulations and other legal requirements.This is necessary for our legitimate interest in protecting our business and enforcing our contractual and other legal rights. To provide physical, network and information security and integrity.This is necessary for our legitimate interest in providing a secure and uncompromised IT system and network, including backup and archiving, preventing malicious software, viruses, errors, or other malicious code, preventing unauthorized access to our systems, and any form of attack or injury our IT systems and networks. We may need to use and process your personal data to comply with the legal obligations that we must respect. We may also need your personal data to comply with applicable legal obligations, such as tax laws and other regulations that bind us.
· For statistical and research purposes. We will anonymize the data and use them for the legitimate interests of processing personal data for statistical processing of customer data, better understanding of our customers and adapting our applications and services to your needs and expectations.
· Identifying potential criminal offenses or threats to public safety for the competent authority. This is necessary for our legitimate interest in promoting the success of our business, preventing crime, fulfilling legal obligations, in the public interest, or for legitimate interests of government authorities and competent authorities that prevent criminal offenses.
· In relation to any legal or potential legal dispute or procedure. This is necessary for our legitimate interest in promoting and ensuring the success of our business, resolving disputes and making such disclosures as required by law or which we consider to be reasonable, by law.
If you do not give consent to the above-mentioned activities, or you give it partially or you cancel the consent, will not be able to provide you with the services of using web applications and related ordering of spare parts, remote control of products and related documentation.
When processing your personal information based on your consent, you can cancel the consent at any time. In "Indop spare parts" and "Indop documents" applications, you can perform the deletion of your personal data under "My Profile" menu by clicking on the "Remove Personal Data" icon. However, in the case of a IRMS application, you can cancel the consent at any time by sending us an application to info@indop.si . The effective date of such cancellation is 30 business days from the date we received your request.
7. Retention time of personal data and retention period
Your personal data is stored by INDOP on:
· Server IT service provider in the cloud (Google cloud), located in the EU Member States.
INDOP will process your personal data to the extent that is relevant and limited to what is necessary for the purposes for which they are processed and the purposes for which we process your personal data, for example, whether it is necessary to continue keeping this data in order to continue to fulfill our obligations to the customer or to our legitimate interests; whether we have any legal obligation to continue processing your data such as any record-keeping obligations laid down by applicable law; and whether we have the legal basis to continue processing your personal information, such as your consent.
The period of retention of your personal data depends on:
· Your deletion by clicking on the "Remove Personal Data" icon (personal data is deleted from the storage.
· Your request to delete your personal data send to info@indop.si.
· Message of your company about changing the contact person.
· Reported bankruptcy or liquidation of your company.
For more detailed information about where and how long your personal data is stored and for more information about your rights to delete and transfer personal data, please contact us atinfo@indop.si.
8. General description of technical and organizational security of your personal data
We have taken appropriate technical and organizational measures to protect your personal data and their protection against unauthorized or unlawful use or processing, against accidental loss or destruction or damage to your personal data, including:
· the principle of the minimum amount of data and processing these data on an anonymous basis, wherever possible;
· training of our responsible persons who access your personal data on the importance of confidentiality and the maintenance of privacy and security of your data;
· commitment to take appropriate disciplinary measures to enforce the responsibility of company's persons responsible for protecting personal data;
· careful and responsible choice of application provider
· continuous and comprehensive updating and testing of the security technology;
· using secure servers to store your personal data;
· identification of the person responsible for the protection of personal data;
· requesting proof of identity from any individual requesting access to personal data.
We would like to point out that the transmission of information (including personal data) over the Internet is not always completely safe and if you provide us with any information via the Internet (either by e-mail, our website or by any other means), you do so entirely at your own risk.
We cannot be held liable for any costs, expenses, loss of profit, damage to reputation, liability or any other form of loss or damage that you suffered due to your transmission of data over the Internet.
There are two ways to protect your personal data in our company:
1.) Logical access
· INDOP provides control of access to your personal data in such a way that access is provided only to responsible persons in the company and in a controlled way.Access to your personal data is made possible to responsible persons through authentication of rights using username and password. All the access is clearly approved. All the access to the Data are being logged.
2.) Physical access
· Applications are specially protected by a security certificate, which is updated annually. However, you can read about the protection of personal data on IT service providers in the cloud of the provider on the following website: https://cloud.google.com/security/infrastructure/design (Google Infrastructure Security Design Overview).
· To view your personal data in the working area of responsible persons in the INDOP, the policy of blank screen and clean table applies (when a third party is entered, data are protected by closing or minimizing the application window; when leaving the workplace, computers are locked by the user; they are automatically locked after a certain period of inactivity; any information in writing can be hindered at the entrance of a third party in such a way that no third party is able to view anything, whenever the working place is left all printed information that is related to personal data is removed from all visible places, physical-technical means of data protection is also used - locking in the drawer or closet).
Protection of personal data in INDOP is also defined in the security policy and data protection documents, which is applicable at the level of the Gorenje Group, Gorenje, d.d., Partizanska cesta 12a, 3320 Velenje.
9. Personal Data supporting System (Application) and the Contractual Personal Data Processor
Personal data obtained in the manner described in Chapter 3 is processed in the above-mentioned web applications that the sub processor Metrolab, d.o.o., Arja vas 60A, 3301 Petrovče carried out for INDOP and are the property of INDOP. INDOP has signed a contract for the protection of personal data with the Contractual Personal Data Processor. Personal data is located on Google Cloud servers (https://cloud.google.com/), where the security of personal information is well regulated, which you can read onhttps://policies.google.com/privacy (Privacy Policy).
10. How we use cookies and similar technology, online plug-ins and other tools
Cookies are data files that are sent from a web site to a browser to record information about website users. The interaction between web user and web site is faster and easier with the help of cookies. With their help web site remembers individual's preferences and experiences, thus saving time, while browsing web pages is more effective and enjoyable.We use cookies on our sites.Cookies that we use on our web site don’t collect information that could personally identify you.
The process of cookie settings differs in each browser.You can find information about this using the "Help" feature, visit www.aboutcookies.org, which explains the process in all browsers, or contact us via info@indop.si.
For additional information about cookies which we use, including how to modify your browser settings, please visit our website and open the file https://indop.si/sl/o-piskotkih»About cookies«.
How can you manage or delete cookies?
We will not use cookies to collect your personal identifiable information; however, if you wish, you can also change your cookie settings in the browser on your computer or mobile device.
Most modern browsers allow you to accept or reject all cookies, accept or reject only certain types of cookies, or set a warning that the page wants to store a cookie on your device. You can also delete cookies that your browser has already saved on your device.
Please note that in case turning off cookies all features of web sites may not function equally effective, warning about the use of cookies will appear at each visit and in the long term this will have negative impact on your user experience.
How do we handle your personal information that you enter to forms on website and signing to e-news?
The data you enter into the form in the web applications "Indop Spare parts" and "Indop documents" under the "My Profile" menu are used exclusively for sending the message (inquiry, sales information, service information, orders, etc.) or required services. Your data is carefully protected and in no way transmitted to third parties to unauthorized persons or used for any other purpose.
Google Maps
Our IRMS web application uses Google Maps Maps via API. Managed by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
To use Google Maps, you need to save your IP address. This information is usually transferred to a Google server in the United States and stored there. INDOP has no impact on this data transfer.
Using Google Maps is in your interest so that our web application makes it easy to find the location of places where our products are installed. This is a legitimate interest in accordance with Art. 6 (1) (f) GDPR. For more information about handling user data, see the Google Data Protection Statement that you find on https://policies.google.com/privacy.
11. International personal data transfer
Transfer of your personal data to any country (inside or outside the European Economic Area) is not foreseen.
In a different case, we will notify you and will do so with your consent and with regards to appropriate legal basis and safeguards (data protection policy, code approved certification mechanisms, contractual clauses ....).
12. Supporting the right of the individual that gave his personal data
We would like to remind you of the following rights regarding your personal data, which you can perform by submitting an appropriate request to an email at info@indop.si, namely:
· On the basis of the application you can request from INDOP to obtain confirmation whether any personal data is processed and, if so, access to personal data and the following information: purpose of the processing, the type of personal data concerned, the users or user category to whom personal data have been or will be disclosed, estimated period of retention of personal data or, if that is not possible, the criteria used to determine this period.You also have the right to request INDOP to correct or delete personal data or limit the processing of personal data to which the personal data relates. The request shall be made in writing by completing a special request form available on the company's website.
· Data Subject Rights – Right of Access. Based on a claim, you can get access to your personal information and information regarding our use and processing of your personal information. The request shall be made in writing by completing a special request form available on the INDOP website.
· Data Subject Rights – Right to rectification. Based on a claim, you can request from INDOP to correct inaccurate personal data related to you without undue delay and to complete the incomplete personal data, considering the purposes of the processing. The request shall be made in writing by completing a special request form available on the company's website.You can correct certain personal information in the web applications "Indop Spare parts" and "Indop documents" under the "My Profile" menu by yourself.
· Data Subject Rights – Right to be erased. Based on a claim you can request from INDOP to delete personal data relating to you without undue delay when one of the following reasons applies:
· personal data are no longer needed for the purposes for which they were collected or otherwise processed;
· to cancel the consent on which the processing takes place and where processing there are no other legal basis;
· to object to the processing of personal data for their treatment but there are no overriding legitimate reasons and when personal data are processed unlawfully.
Request for cancellation shall be made in writing by completing a special request form available on the company's website. In the web applications "Indop Spare parts" and "Indop documents", you can delete your personal information under the "My Profile" menu by clicking on "Remove Personal Data".
- Data Subject Rights – Right to restriction of processing. Based on a claim, you may request a restriction on the use of your personal data when one of the following cases applies:
· if you dispute the accuracy of the data for a period that allows the company to verify the accuracy of personal data;
· if the processing of your personal data is illegal and you are opposed to the deletion of your personal data and request a restriction on their use instead;
· if INDOP no longer needs personal data for processing purposes, but you yourself need them to enforce or defend legal claims;
· when submitting objection concerning data processing until it is verified that the legal reasons for INDOP prevail over your reasons.
When processing of personal data is restricted in accordance with the above paragraph, such personal data, except for their retention, shall be processed only with your consent, or for the enforcement, execution or defence of legal claims or for the protection of the rights of another natural or legal person.
The request shall be made in writing by completing the special request form available on the INDOP website.
INDOP must notify you of this before limiting the use of personal data.
· Data Subject Rights - Right to data portability. Based on the claim given, you can request your personal data that you have provided us or have obtained from us through any other permitted source and which will be forwarded to you in a structured and machine-readable form (for example, .xls or .pdf file) and the right to transfer such personal data to another personal data manager. The request shall be made in writing by completing a special request form available on the company's website. For additional copies requested by an individual, INDOP may charge a reasonable fee.
· Feasibility of individual rights - in case of automatic decision-making.Automated decision-making is not carried out.
· Data Subject Rights - Right to be forgotten (withdrawal of consent to our use of your personal information, where we rely on your consent). Based on a claim submitted from your side, any legal or contractual restrictions regarding the exercise of the right to be forgotten are reviewed. In case there is no restriction, the right to be forgotten is executed. If you withdraw your consent, this will not affect the legality of our use and processing of your personal information based on your consent before the day you withdraw your consent.The request shall be made in writing by completing a special request form available on the INDOP website.
· Data Subject Rights - Notifications regarding rectification or erasure of personal data or restriction of processing. Informing an individual is an integral part of the process of implementing any of the individual's rights.
Received requests by individuals on info@indop.si are handled by the person responsible for the protection of personal data. At the request of an individual, INDOP is obliged to respond without undue delay and at the latest within one month.
Against the silence of the personal data manager (if INDOP does not reply within the legal deadline of 1 month), or against the INDOP's refusal response, you also have the right to file a complaint to the supervisory authority; In Republic of Slovenia that is an Information Commissioner, whose contact details are found in Chapter 2 of this notice and are also available here.
A claim against the INDOP's refusal response must be lodged within 15 days of receipt of the response. The request and complaint can be submitted by the client using a special request form published on the Information Commissioner's web site (see chapter 3).
For further information on your rights regarding your personal data, including certain restrictions applicable to some of these rights, see Articles 12 to 23 of the GDPR available here.
13. Changes to our privacy policy
Depending on changes in the implementation of different activities in a company, it may happen that occasionally changes of our personal data protection rules happen. We will notify you about that kind of action without delay. If you submit your personal data through our website on or after that date, you agree to be bound by a latest version of our personal data protection rules.
Whenever we intend to use your personal data for a new purpose, we will provide you with information about this purpose to obtain your consent and any other relevant information before we use your personal data for this new purpose.
14. Changes to your personal data
Please inform us of any changes to your personal data that we hold about you, so that information we hold about you is accurate and current, or you change this information yourself in web applications »Indop Spare parts« and »Indop documents« under the menu »My Profile«.
Also, please inform us of any changes about employment, transfer to another job, so that we can properly respond to the processing of your personal data and to obtain the consent of the personal data of the new contact person.
Proper personal data is crucial in the conduct of business transactions with your company.
15. Responsible person for the protection of personal data
The person responsible for protecting the personal data of this collection at INDOP can be contacted to info@indop.sior per phone +386 (0)3 899 22 15.
16. Final Provisions
INDOP reserves the right to modify or supplement this legal notice to ensure compliance with personal data protection legislation. Legal notice is available at the company's headquarters and on our web applications.
Anything not specifically specified in the legal notice is subject to the provisions of the applicable law.