Privacy Policy (EU territories)

Collection and use of Personal Data

Technical information. When you visit our Website, the system automatically records data and information about your computer each time the website is accessed. The following data (“technical information”) is collected:

• Information on the browser type and version used
• The user’s operating system
• The user’s internet service provider
• The user’s IP address
• Date and time of access
• Websites from which the user’s system accesses our website
• Websites accessed by the user’s system via our website
• The respective volume of data transmitted

The data is also saved in our system’s log files. This data is not stored together with other personal data of the user.

We collect and use this technical information for purposes of (network) security (for example, to ward off cyberattacks), to better understand our users’ needs, to continuously improve our website and to enable users to access the website from their computers.

We collect this personal data under the legal basis in section 6(1)(f) of the GDPR, legitimate interests.

Retention of your Personal Data

We hold the personal data for as long as there is a business need or regulatory requirement. In deciding the period for which we will hold the personal data, we take into account the following:

• How long has been since our relationship with you ended,
• Whether we have a reasonable expectation that you would need to contact us in relation to previous purchases, and
• The regulatory requirements applicable to the information and business process for which it was used

Once the retention time is over, we dispose of the personal data in a safe and permanent way.

Sharing your personal data

We may share your personal data with third parties to support our delivery of services and products to our clients, maintain our website and protect our systems, operations and overall business.

We share data with the following categories of third parties:

• Service providers - third parties providing the following categories of services:
• web hosting services
• web analytics
• targeted advertising
• Affiliates - our affiliates may receive your personal data for reporting and market analysis purposes.

We have contracts with service providers and a data sharing agreement with our affiliates to instruct and set rules on data use.

Personal data may also be transmitted to third countries or international organisations. For your protection and the protection of your personal data, appropriate safeguards are provided for such data transmissions which include the use of EU standard contractual clauses. For information on EU standard contractual clauses, please visit https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en.

In some circumstances we are legally obliged to share the information, for example under a court order. Before sharing the information, we will satisfy ourselves that we have a lawful basis on which to share the information and document our decision making.

Cookies

Cookies are small pieces of information sent by a website or application to a visitor’s computer. We will ask for your consent to use non-essential cookies. If you choose not to accept our cookies, we cannot guarantee that your website experience will be as fulfilling as it would otherwise be. We may also place cookies from third parties for functional and marketing purposes. For further information, see here.

Links to other sites

Please be aware that while visiting our website/websites you may follow links to other sites or services that are beyond our sphere of influence. We are not responsible for the content or for their collection and use of your personal information. Consult their Privacy Policies and Terms and Conditions prior to using their services.

Rights of the individuals

We are committed to ensuring fair and transparent processing of your personal data and to respect your rights as granted by the GDPR. Depending on the specific GDPR requirements, the following rights may be applicable to your personal data:

• Right to be informed, Art. 13, 14 GDPR
• Right of access, Art. 15 GDPR
• Right to rectification, Art. 16 GDPR
• Right to erasure (“right to be forgotten”), Art. 17 GDPR
• Right to restriction of processing, Art. 18 GDPR
• Right to data portability, Art. 20 GDPR

As a data subject who works for an employer who has contracted our company, your employer serves as the data controller responsible for the processing of your personal data in accordance with GDPR requirements. As a data processor working with your organisation, we are committed to assisting you in exercising your rights under GDPR.

Under GDPR, you have the following rights regarding your personal data:

1. The right to be informed about the collection and use of your personal data.
2. The right to access your personal data and receive copies of it.
3. The right to rectify inaccurate or incomplete personal data.
4. The right to erase your personal data under certain circumstances (the "right to be forgotten").
5. The right to restrict the processing of your personal data under certain circumstances.
6. The right to data portability, allowing you to obtain and reuse your personal data for your own purposes.
7. The right to object to the processing of your personal data under certain circumstances.
8. Rights related to automated decision-making and profiling.

To exercise any of these rights or make inquiries about the processing of your personal data by your employer, we advise you to first contact your employer directly. Your employer, as the data controller, is responsible for responding to your inquiries and requests in accordance with GDPR requirements.

As a data processor, we do not have the authority to decide on matters related to the processing of personal data or to fulfil data subject requests independently. However, we are committed to supporting your employer in addressing your inquiries and requests promptly and appropriately.

If you have any questions or concerns regarding your rights under GDPR or the processing of your personal data by your employer, please do not hesitate to contact us. We are here to assist you and ensure compliance with GDPR requirements.

If you are a site visitor and do not actually use our product and you would like to exercise your rights, contact our designated Data Representative as described below or, please email privacy@workforce.com. In order to process your request and for identification purposes, please note that we will process your personal data in accordance with Art. 6 (1) (c) GDPR - compliance with a legal obligation.

Right to object

You have the right to object, on reasons relating to your particular situation, at any time to processing of personal data concerning you which is based on our legitimate interests, including profiling based on those provisions.

We will no longer process your personal data unless we have compelling legitimate grounds for the processing that override your interests, rights and freedoms or the processing is necessary for the establishment, exercise or defence of legal claims.

Where your personal data is processed for direct marketing purposes, you have the right to object at any time to processing of personal data, which includes profiling to the extent that it is related to such direct marketing. We will stop processing your personal data for direct marketing purposes, as well as profiling.

Right to not be subject to a decision based solely on automated processing, including profiling

We do not use automated decision making means in our processing. We do not use your personal data to evaluate, analyse and predict any aspects concerning yourself, for example personal preferences, interests, behaviour, location or movements(“profiling”).

Protecting your personal data

We use a variety of security measures and technologies to help protect your personal information from unauthorised access, use, disclosure, alteration or destruction in line with applicable data protection and privacy laws.

The transmission to us of information via the internet or a mobile phone network connection may not be completely secure and any transmission is at your own risk.

What if you do not want to provide us with your personal information?

Where you are given the option to share your personal information with us, you can always choose not to do so. If you object to the processing of your personal information, or if you have provided your consent to processing and you later choose to withdraw it, we will respect that choice in accordance with our legal obligations. This could mean you are unable to make full use of the services and products offered by us.

Contact us

If you have questions or requests regarding this Privacy Policy, or if you would like to exercise your rights, you can contact us by email to privacy@workforce.com or by mail to our address https://www.workforce.com/contact-us

Complaints may also be sent to the relevant supervisory authority. Our supervisory authority is the UK Information Commissioner’s Office https://ico.org.uk/global/contact-us/

See list of all EU supervisory authorities here:

• https://ec.europa.eu/info/law/law-topic/data-protection/reform/what-are-data-protection-authorities-dpas_en
• https://www.edoeb.admin.ch/edoeb/en/home/the-fdpic/contact.html