The CHG-MERIDIAN AG (CHG) is committed to process personal data responsibly and in compliance with the applicable data protection laws in all countries in which the company operates.

This European Union (“EU”) Customer/Vendor Data Protection Notice (the “Notice”) describes the types of personal data CHG collects, how CHG uses that personal data, with whom the CHG shares your personal data, and the rights you, as a data subject, have regarding the CHG`s use of the personal data. This notice also describes the measures CHG takes to protect the security of the data and how you can contact us about our data protection practices.

The CHG-entities responsible for the collection and use of your personal data (the Data Controllers) in your home country for the purposes described in this notice are:

• CHG-MERIDIAN AG
• CHG-MERIDIAN Industrial Solutions GmbH
• CHG-MERIDIAN Nederland BV
• CHG-MERIDIAN Belgium NV
• CHG-MERIDIAN Belux NV
• CHG-MERIDIAN UK Limited
• CHG-MERIDIAN Computer Leasing UK Limited
• CHG-MERIDIAN Ireland Limited
• CHG-MERIDIAN France SAS
• CHG-MERIDIAN Spain S.L.
• CHG-MERIDIAN Italia S.p.A.
• CHG-MERIDIAN Austria GmbH
• CHG-MERIDIAN Schweiz AG
• CHG-MERIDIAN tehnološki menedžment d.o.o.
• CHG-MERIDIAN Norway AS
• CHG-MERIDIAN Skien AS
• CHG-MERIDIAN Sweden AB
• CHG-MERIDIAN Denmark A/S
• CHG-MERIDIAN Finland OY
• CHG-MERIDIAN Polska sp. z.o.o.
• CHG-MERIDIAN Czech Republic s.r.o.
• CHG-MERIDIAN Slovakia s.r.o.
• CHG-MERIDIAN USA Corp
• CHG-MERIDIAN Canada Ltd.
• CHG-MERIDIAN S.A.P.I. de C.V.
• CHG-MERIDIAN do Brasil Arrendamento Mercantil S.A.
• CHG-MERIDIAN do Brasil Locação de Equipamentos Ltda.

A Data Protection Officer (“DPO”) is designated. The DPO is involved in all issues related to the protection of your personal data. In particular, the DPO is in charge of monitoring and ensuring compliance with this notice and the applicable data protection laws. They will also provide advice on data protection matters upon request.

For any clarification or additional information you may need in order to fully understand this Notice, please contact:

dataprotection@chg-meridian.com

The provision of personal data is a requirement necessary to enter into a contract with CHG or a requirement by law or regulation for the CHG to administer your customer/vendor relationship. The personal data processed is limited to the data necessary for carrying out the purpose for which such personal data is collected.

Personal data processed includes the following:

• Business information (such as name of organization, department and job title);
• Contractual information (such as date of agreement, type of commercial relationship, etc.).

CHG will not collect personal data if such collection is prohibited under the applicable data protection laws.

In no case will personal data revealing religious beliefs, racial or ethnic origin, political opinions, philosophical beliefs, trade union membership or concerning sex life be processed in the customer/vendor context.

CHG will maintain personal data in a manner that ensures it is accurate, complete and up-to-date.

CHG has implemented appropriate technical and organizational measures to ensure a level of security appropriate to the risk, such risk analysis includes an analysis of the risk of compromising the rights of the data subject, costs of implementation, and the nature, scope, context and purposes for data processing.

The measures include

(i)     encryption of personal data where applicable/appropriate;

(ii)    the ability to ensure the ongoing confidentiality, integrity, availability and resilience of Processing systems and services;

(iii)   the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident; and

(iv)   a process for regularly testing, assessing and evaluating the effectiveness of technical and organizational measures for ensuring the security of the processing.

CHG will only grant access to personal data on a need-to-know basis, and such access will be limited to the personal data that is necessary to perform the function for which such access is granted.

Authorization to access personal data will always be linked to the function so that no authorization will be extended to access personal data on a personal basis. Service providers will only receive personal data according to the purposes of the service agreement with the Company.

International data transfers refer to transfers of personal data outside of the European Economic Area (“EEA”). The international footprint of CHG involves the transfer of personal data to and from other group companies or third parties, which may be located outside the EEA. CHG will ensure that when personal data is transferred to countries that have different standards of data protection, appropriate safeguards to adequately protect the personal data are implemented to secure such data transfers in compliance with applicable data protection laws. CHG has implemented Data Transfer agreements based on EU model clauses to cover international data transfers and a copy of these agreements can be obtained by contacting the DPO.

CHG will not retain your Personal data for longer than is allowed under the applicable data protection laws and regulations or for longer that is justified for the purposes for which it was originally collected or otherwise processed, subject to applicable local retention requirements.

Under applicable data protection laws, you will benefit from the following rights:

• Right to access to, rectification and erasure of personal information;
• Right to restriction of processing and to object to processing;
• Right of data portability to the extent applicable;
• Right to withdraw consent where the processing is based on consent; and
• Right to lodge a complaint with the supervisory authority.

This notice may be revised and amended from time to time and appropriate notice about any amendments will be given.

CHG is allowed to adapt the text of this notice only in order to be compliant with local legislation by means of an addendum attached to this notice. In case of any discrepancies between this notice and a specific local addendum made in accordance with local law, the terms of the latter will prevail.

The processing of personal data

You can visit our website without actively providing information about yourself as an individual. However, we automatically store access data (server log files) every time the website is accessed. This data includes the name of your internet service provider, the operating system used, the website you visit us from, the date and duration of your visit or the name of the file requested, for example. We also store data for security reasons, e.g. we store the IP address of the computer used so that we can recognise attacks on our websites. This data is solely used to improve our offering and cannot enable conclusions to be drawn about you as an individual. This data is not merged with other sources of data.

The legal basis for data processing is article 6 (1) (f) GDPR. We process and use data for the following purposes:

1. providing CHG-MERIDIAN AG's websites,
2. improving our websites and
3. preventing and recognising errors/malfunctions and the misuse of the websites.

This type of data processing is either undertaken for the performance of the contract regarding the use of CHG-MERIDIAN AG’s website or because we have a legitimate interest in guaranteeing the functionality and error-free operation of CHF-MERIDIAN AG's websites and adapting these websites to suit users’ requirements.

After users have logged into TESMA® within our customer area, log files are processed and stored with an additional user identifier that is assigned internally.

After the user has logged into TESMA®, these log files encompass the following data: user identifier, browser version, the operating system used and the date and duration of the visit.

We process data within this framework to fulfil our contractual obligation to our customers and to render our service. The legal basis for data processing within this framework is article 6 (1) (b) GDPR. In addition, we are contractually bound to instructions under a processor contract and have suitable technical and organisational measures in place to protect the rights of the data subject.

Email contact

If you send us enquiries or information via email, your details (email address, content of your email, subject line of your email, and date/time), including the contact information provided by you in it (e.g. signature, such as first name, last name, telephone number if given, address) will be stored for the purpose of handling the enquiry and dealing with follow-up questions. We will not disclose this information without your consent. The legal basis for the collection and processing of the data is article 6 (1) (a) GDPR.

Users are reminded that emails can be read or changed while they are being transferred, without this act being authorised or detected. CHG-MERIDIAN AG uses software to filter out undesired emails (a spam filter). The spam filter means that the system can put emails into the spam folder if certain characteristics cause them to be wrongly identified as spam, meaning that they may not reach us.

The data you provide remains with us until you request that it is erased, you withdraw your consent for the storage of the data or the purpose of storing the data lapses (e.g. once your enquiry has been processed to completion). Mandatory statutory provisions, particularly retention periods, remain unaffected by this.

Cookie-based services

We use ‘cookies’ on our websites to make visiting our website a more attractive experience and to enable certain functions to be used. Cookies are small text files that are stored on your end device. They are a standard internet technology for storing and accessing log-in details and other user information for all users of CHG-MERIDIAN AG’s websites. They also enable us to store user settings, permitting our websites to be displayed in a format tailored to your device.

The use of cookies serves our legitimate interest in making your visit to our website as enjoyable as possible and preventing you from inputting information multiple times or adjusting your settings repeatedly. The legal basis for this is article 6 (1) (f) GDPR.

Some of the cookies we use are deleted after the end of the browser session, or, in other words, after you close your browser (known as ‘session cookies’). Other cookies remain on your end device and make it possible for us or our partner companies to recognise your browser during your next visit (known as ‘persistent cookies’).

You can adjust your browser's settings so you are informed when cookies are placed and can make an individual decision as to whether to accept them, accept them under certain circumstances or universally exclude them. In addition, cookies can be retrospectively deleted to remove data that websites have stored on your computer. If cookies are deactivated, this may limit the functionality of CHG-MERIDIAN AG ’s websites.

Deactivate or remove cookies (opt-out)

Web browsers offer options for limiting and deleting cookies. Further information on this can be found on the following websites:

• Internet Explorer: https://support.microsoft.com/en-gb/help/17442/windows-internet-explorer-delete-manage-cookies  
• Firefox: https://support.mozilla.org/en-US/kb/cookies-information-websites-store-on-your-computer
• Google Chrome: https://support.google.com/chrome/answer/95647?co=GENIE.Platform%3DDesktop&hl=en
• Safari: https://support.apple.com/en-gb/HT201265

Our services

Registering on the website and logging in

You have the option of registering on our website. Registration serves the purpose of offering you content or services that can only be offered to registered users due to the nature of the matter at hand. To do so, we require the following data: first name and last name, email address. This data is required for registration, and by extension, for the fulfilment of our contractual obligation.

Logging into our website with your log-in details also leads to the IP address provided by the data subject’s internet service provider (ISP), the date, and the time of log-in being stored. This data is stored because this is the only way that the misuse of our services can be prevented and because this data is required, when necessary, to shed light on crimes that have been committed. To this extent, this data needs to be stored for our protection. In principle, this data is not disclosed to third parties, unless there is a statutory obligation for disclosure or the disclosure is in the interests of law enforcement.

The legal basis for processing is the performance of a contract pursuant to article 6 (1) (b) GDPR.

Contact form/enquiries

On our website, you have the option of sending us enquiries via a contact form. Here, your details from the contact form (content of your enquiry, subject line of your enquiry and date), including the contact details you provide (first name, last name, company, telephone number and email), are stored by us for the purpose of handling the enquiry and in the event of follow-up questions. The legal basis for the collection and processing of the data is article 6 (1) (a) GDPR.

The data provided by you via the contact form remains with us until you request that it is erased, you withdraw your consent for the storage of the data or the purpose of storing the data lapses (e.g. once your enquiry has been processed to completion). Mandatory statutory provisions, particularly retention periods, remain unaffected by this.

Shop function

Our websites give you the option of using shop functions. To this end, we collect additional contact and address data for the following purposes:

We process your data for the following purposes:

• To process your order and, if necessary, return your order
• In addition, we process your data to manage your personal account
• To send text messages about your order’s shipment status
• To make contact in the event that there are problems with delivering your goods

We may need to disclose this data to third parties such as processors, shipping services, banks, the tax office etc. in order to fulfil our contractual obligations. The legal basis for the collection and processing of data is article 6 (1) (b) GDPR.  This data remains stored for the entire usage period. Mandatory statutory provisions, particularly retention periods as per the provisions of trade law and tax law, remain unaffected by this.

Feedback function

Our websites give you the option of leaving feedback. This feedback can be accessed by the TESMA community. Your comment will be stored and published with the user name stated by you and details about when the comment was left. In addition, the IP address of the data subject provided by the internet service provider will be logged as well.

Information service

When you write a comment, you can tick a box for our email service. This will inform you if other users leave a comment on your post. You can turn off notifications at any time by clicking the link within the email.

CHG MERIDIAN AG has implemented appropriate technical and organizational measures to ensure a level of security, appropriate to the risk. This type of risk analysis includes estimating the risk that the data subject’s rights will be compromised, the costs of implementation and the nature, scope, context and purpose of data processing.

These measures encompass:

1. encrypting personal data, provided this is necessary and appropriate;
2. ensuring the confidentiality, integrity and availability of the processing systems and services, and their reliability in the event of malfunction;
3. guaranteeing the availability of and access to personal data in the event of a physical or technical incident, and its timely restoration;
4. creating a procedure for regularly reviewing and assessing the effectiveness of technical and organisational measures to guarantee the security of processing.

Recipients of personal data

CHG-MERIDIAN AG only grants access to personal data if this is absolutely necessary. This access is limited to the personal data required for the purpose in question.

The authorisation for access to personal data is always associated with a purpose, meaning that universal approval for access to personal data is not granted. Service providers only receive personal data in line with the purpose of their contractual relationship with the company.

International data transfer

International data transfer relates to the transfer of personal data outside the European Economic Area (EEA). The international presence of CHG-MERIDIAN AG involves the transfer of personal data from and to other group companies or third parties located outside the EEA. When personal data is transferred to countries with different data protection standards, CHF MERIDIAN AG will ensure that suitable measures are taken to provide personal data with adequate protection, ensuring that data transfers are performed in compliance with the applicable data protection legislation. CHG-MERIDIAN AG has implemented data transfer agreements on the basis of EU standard contractual clauses to cover international data transfers. The data protection officer can provide a copy of these agreements on request.

CHG-MERIDIAN AG will not process your personal data for longer than permissible in line with applicable data protection legislation and provisions. This applies subject to the applicable local retention requirements.

This online offering is not suitable for minors under the age of 16. Individuals who are under the age of 16 may not transfer personal data to CHF-MERIDIAN AG without the permission of their parent or guardian.

Within the framework of the applicable data protection legislation, you have the following rights:

• The right of access, the right to rectification, and the right to erasure of personal data;
• The right to restriction of processing and the right to object to processing;
• The right to data portability, as applicable;
• The right to revoke your consent to processing; and
• The right to file a complaint with the supervisory authority.

External links

Our website contains links to websites offered by other providers, We hereby indicate that we have no influence over the content of the linked websites and their providers’ compliance with the provisions of data protection legislation.

Changes to our Privacy Policy

This Privacy Policy can be changed and expanded from time to time. CHF-MERIDIAN AG is only permitted to adapt this Privacy Policy to take local and general legal provisions into account. In the event that this Privacy Policy contradicts with a specific local law, local laws take precedence.