Privacy Policy

GENERAL INFORMATION ON DATA PROTECTION AND PRIVACY

Date: 19.09.2023

This Privacy Policy explains how we collect, process and protect your data while visiting our website. The Privacy Policy will tell you about your privacy rights, how the law protects you, and informs our employees and staff members of all their obligations and protocols when processing data.

The individuals from which we may gather and use data in the context of this website are:

• Clients;

• Website visitors; and

• any other individuals that the organisation has a relationship with or may need to contact as a result of them interacting with this website.

This Privacy Policy applies to personal data processed by us during your visit to this website. Capitalised terms not otherwise defined will refer to the defined terms found within the General Data Protection Regulation.

1. DATA CONTROLLER & INQUIRIES

The data controller is:

Sisvel International S.A., Immeuble Cubus C2, 4e étage

2, rue Peternelchen- L-2370 Howald

Grand Duchy of Luxembourg Tax code and VAT number: LU23037240.

Referred to as “Sisvel”, “Us” or “We”.

Contact mail for privacy related issues: privacy@sisvel.lu.

Any inquiries about your data should be sent to the above email. It can also be sent directly to the company, if you prefer, in a letter to the listed address. We cannot guarantee prompt responses if physical mail is your chosen method of communication.

You have the right to make a complaint at any time to the Luxembourg Data Protection Authority (CNPD) if you have any issues (https://cnpd.public.lu/en.html). We would, however, appreciate the chance to deal with your concerns before you approach the CNPD, so please contact us in the first instance if possible.

1.1 Sisvel’s processing as Controller and related responsibilities

While managing our responsibilities as a Data Controller, we have third party providers who will deal with your data on our behalf (known as “Processors”). The responsibilities described below may be assigned to a processor, or may be taken to apply to the organisation as a whole. The Data Controller and our Processors have the following responsibilities:

• Ensure that all processing of Personal Data is governed by one of the lawful bases laid out in the GDPR;

• Ensure that Processors authorised to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;

• Implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk associated with the processing of Personal Data;

• Obtain the prior specific or general authorisation of the Controller before engaging another Processor;

• Assist the Controller in the fulfilment of the Controller's obligation to respond to requests for exercising the data subject's rights;

• Make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in the GDPR and allow for and contribute to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller;

• Maintain a record of all categories of processing activities carried out on behalf of a Controller;

• Cooperate, on request, with the supervisory authority in the performance of its tasks;

• Ensure that any person acting under the authority of the Processor who has access to Personal Data does not process Personal Data except on instructions from the Controller; and Notify the Controller without undue delay after becoming aware of a Personal Data Breach;

2. DATA PROTECTION FRAMEWORK

Sisvel is based within the European Union (“EU”), and as such is a Data Controller according to the definition laid out by EU Regulation 2016/679 (“GDPR”, “Data Protection Legislation” or “EU GDPR”).

The Data Protection Legislation regulates the use of personal information generally. This means everyone must comply with seven data protection principles which say that personal data and its processing needs to be:

• Fair, lawful and transparent;

• For specified, explicit and legitimate purposes (purpose limitation);

• Adequate, relevant and limited to what is necessary (data minimisation);

• Accurate and, where necessary, kept up to date (accuracy);

• Not kept longer than necessary (storage limitation);

• Processed using appropriate security (integrity and confidentiality); and

• Accountability

3. PROCESSING YOUR DATA VIA OUR WEBSITE - LAWFUL BASIS

3.1 Types of data / Privacy Policy Scope

“Personal Data” means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

We collect, use, store and transfer different kinds of Personal Data about you which we have grouped together below. Not all of the following types of data will necessarily be collected from you, but this is the full scope of data that we could collect and when we collect it from you:

• Contact Data: This covers any data relating to your phone number, addresses & email addresses which we may receive as a result of sending us an email via the ‘Contact Us’ link on our website. Sisvel has a legitimate interest in processing the contact information provided by you in order to respond to you under Article 6.1.f of the GDPR. If the purpose or nature of the contact changes, other lawful bases may be relied upon. If this occurs, you will be informed. You may always request that we delete your data via email at mailto:privacy@sisvel.lu. Lawful basis: Legitimate interest.

• Client area: We will gather basic information from you upon entering our client area which provides you business-related documents and information. Lawful basis: Contract.

• Marketing and Communications Data: This is your preferences in receiving marketing information and other information from us for our marketing newsletters. It will include your name & email address. Lawful basis: Consent.

• Job application data: Containing information such as your name, location, email, cv data and cover letter, we use this to decide if you are a suitable candidate for the role you have applied for. You could also be applying via LinkedIn ads, in which case we will link this policy and you may find more information on how LinkedIn handle your data on their privacy policy here. Lawful basis: Necessity for Contract or legitimate interest, depending on situation. We will rely on legitimate interest during the application phase, though when/if you are selected your data will be processed according to GDPR 6.1.b, Contract, as the information is necessary to enter you into the employment contract. legal obligation for any data required to meet equality or discrimination laws. Sensitive data for the same purpose would be processed according to Article 9(2)(b) GDPR.

• Technical Data: This is your IP address, browser type and version, time zone setting and location, operating system and platform, and other technology on the devices you use to engage with us. This is used for the purpose of analytics, with your consent, as well as to improve site functionality. Lawful basis: Legitimate interest for technically necessary cookies. Consent for data collected via cookies that are not technically necessary.

• Client business data: This is likely to be contact information, business email address and phone number. Lawful basis: Necessity for Contract or legitimate interest, depending on individual situation.

For further information on the lawful bases and what they mean, please refer to section 3.2 below.

During the course of our normal business activities Sisvel will not collect any special categories of Personal Data according to the GDPR.

Sisvel will access and use your personal data only for the purposes for which you have submitted it to us to (a) provide information to you, (b) make contact with you, (c) provide services to you, or (d) maintain the operations and security of the website and services we provide to you. We will not use your personal information for any other purposes, for example for the communication of marketing materials, unless we have your specific consent that permits us to do so.

3.2 Lawful Bases Explained

There are several justifiable reasons under the EU GDPR that allow the collection and processing of Personal Data. The primary bases we rely upon during the operation of our website and associated service are the following:

• “Consent”: Certain situations allow us to collect your Personal Data, such as when you tick a box that confirms you are happy to receive email newsletters from us, or ‘opt in’ to a service.

• “Contractual Obligations”: We may require certain information from you in order to fulfil our contractual obligations and provide you with the promised service.

• “Compliance with legal obligations”: Organisations occasionally have to process data in order to comply with legal regulations and legal & regulatory requirements.

• “Legitimate Interest”: We might need to collect certain information from you to be able to meet our legitimate interests - this covers aspects that can be reasonably expected as part of running our business, that will not have a material impact on your rights, freedom or interests. Examples could be your address, so that we know where to deliver something to, or your name, so that we have a record of who to contact moving forwards. When legitimate interest is relied upon, Sisvel will conduct a Legitimate Interest Assessment (LIA) to validate the processing is not considered unfair or infringing on the data protection rights of any individuals we work with.

4. HOW WE USE YOUR DATA AND RECIPIENTS

4.1 Sources of Data

We primarily obtain the data from you (including via the devices you use) while visiting the site. If we do not collect the personal data directly from you, we will also tell you the source of the personal data and, if applicable, whether it is sourced from publicly available sources.

4.2 Recipients of Personal Data

When processing your data, we work with service providers who have access to your data. The categories of recipients are as follows:

• software companies that enable us to provide our services, help us to improve them and/or serve us for marketing purposes (for example, to send newsletters, emails, manage customer contacts or applications);

• public bodies and administrations to the extent that we are legally obliged to do so;

• payment service providers;

• hosting providers;

• social media platforms; and

• service companies, such as tax advisors or lawyers.

For the purposes of fulfilling the contract, we may also disclose your personal data to anyone to whom we assign rights arising from the contractual relationship with you. In these instances, you will be directly informed.

4.3 Data transfers

We transfer Personal Data to third parties in order to provide website functionality & our service. We may also share your Personal Data with subcontractors when necessary and with your consent. The sub-contractors are also subject to our confidentiality obligations to use it only for the purposes for which we disclose it to them and pursuant to our instructions.

We may share your Personal Data at any time if required for legal reasons or in order to enforce our terms or this Privacy Policy.

There is a transfer of data to third countries outside of the European Union. Information we collect from you could be processed in the United States or other third countries. Some third countries have not currently received an adequacy decision from the European Union under Article 45 of the GDPR which means that your data may not receive the same level of protection there as it does under the UK GDPR and European GDPR.

International data transfers are made based on contractual and other guaranteed safeguards provided for by law, which are intended to ensure adequate protection of your data and which you can view on request. We rely on the rules set out in Article 49 of the GDPR or, where applicable, on safeguards pursuant to Article 46 of the GDPR. Where possible, for US organisations we attempt to engage with organisations that are certified under the EU-US Data Privacy Framework. Where this is not possible, the aforementioned Article 46/49 safeguards are implemented. We, and our processors, strive to apply appropriate measures to protect the privacy and security of your personal data. For this reason, we only process your personal data in accordance with the practices described in our Privacy Policy.

4.3.1 Is my data shared with anyone else?

Sisvel is a part of the Sisvel group of companies. The Sisvel group operates, at times, as a group of controlled undertakings which, in accordance with the GDPR Art. 4 (19), Recital 37 + 48, allows for a legitimate interest in sharing certain personal data within the group. This data sharing is limited to what is necessary, and primarily applies to limited applicant data. Your data will not be shared with other companies within the group with no purpose. If your data is to be shared, you will be provided with notice and information related to the sharing.

4.3.2 Third-party links

This Site may include links to third-party websites, plug-ins, and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our Site, we encourage you to read the privacy policy of every website you visit.

4.4 Protection of your personal data

We are concerned with keeping your data secure and protecting it from inappropriate disclosure. Any Personal Data collected by us is only accessible by a limited number of employees who have special access rights to such systems and are bound by obligations of confidentiality. When we use subcontractors to store your data, we will not relinquish control of your Personal Data or expose it to security risks that would not have arisen had the data remained in our possession.

However, unfortunately no transmission of data over the internet is guaranteed to be completely secure. It may be possible for third parties not under the control of Sisvel to intercept or access transmissions or private communications unlawfully. While we strive to protect your Personal Data, we cannot ensure or warrant the security of any Personal Data you transmit to us. Any such transmission is done at your own risk. If you believe that your interaction with us is no longer secure, please contact us at privacy@sisvel.lu.

4.5 Change of purpose

We will only use your Personal Data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us.

If we need to use your Personal Data for an unrelated purpose, we will notify you and we will explain the lawful basis which allows us to do so.

Please note that we may process your Personal Data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

5. YOUR RIGHTS

As a data subject under the EU GDPR, you have several rights:

• Your right of access You have the right to ask us for copies of your personal information. This right always applies.

• Your right to rectification You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. This right always applies.

• Your right to erasure You have the right to ask us to erase your personal information in certain circumstances.

• Your right to restriction of processing You have the right to ask us to restrict the processing of your information in certain circumstances.

• Your right to object to processing If we are processing your personal data for our legitimate interests as stated above, you have the right to object to our further processing of your personal data. There are legitimate reasons why we may refuse your objection, which depend on why we are processing it. Where you have given consent, you are free to withdraw that consent at any time. Any request you make will not affect the lawfulness of the processing that took place prior to that request.

• Your right to data portability This only applies to information you have given us. You have the right to ask that we transfer the information you gave us from one organisation to another or give it to you. The right only applies if we are processing information based on your consent or under, or in talks about entering a contract and the processing is automated.

To exercise these rights, you can send an email to us at any point at the following email address: privacy@sisvel.lu.

We will handle any request to exercise these rights in accordance with the relevant laws, but please note that these rights may not be absolute. Sisvel may refuse or deny a request in accordance with these rules, though you will be informed why this is happening as well as our reasoning for such a decision.

You will not have to pay a fee to access your Personal Data (or to exercise any of the other rights). However, if your request is clearly unfounded, we could refuse to comply with your request.

We may also need to request specific information from you to help us confirm your identity and ensure you have the right to access your Personal Data (or to exercise any of your other rights). This is a security measure to ensure that Personal Data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

6. CHILDREN’S PERSONAL DATA

Sisvel and any services available from our website are not directed to people under the age of 16. If you learn that a child under the age of 16 has provided us with their personal information without having parental consent, please contact us at privacy@sisvel.lu in order for us to rectify the situation. We reserve the right to delete any such data where we suspect it relates to anyone under the age of 16.

7. WHEN DO WE DELETE YOUR DATA?

We will keep your personal data only for as long as is necessary to ensure we can fulfil our business requirements and to comply with our regulatory requirements and will then securely destroy or anonymise that data.

In addition, data may be stored beyond the outlined periods in certain rare circumstances where data must be kept in order to exercise legal rights or to comply with other legal obligations. In these cases, the data is deleted when a storage or retention period prescribed by law expires.

We store applicant documents for a period of six months if the application does not lead to an employment relationship and no further storage has been agreed.

If you would like to know how long we will keep a specific piece of data about you, please contact us.

8. CHANGES TO THIS PRIVACY POLICY

We may change this Privacy Policy from time to time. Significant changes will be highlighted where necessary.

9. CONTACTING SISVEL GROUP

If you have any questions about this Privacy Policy, would like to exercise any of your statutory rights, or to make a complaint, please write to:

privacy@sisvel.lu