Privacy Policy for Hydrohex – Business customers

Last update: 21 March 2024

Introduction

We value your fundamental right to privacy. As a company based in the European Union, we adhere to our obligations under the General Data Protection Regulation (GDPR). In this document, we inform you about our processing of your personal data if you’re a business customer (or a representative of one).

For clarity, we have divided the privacy policy into two parts:

• Part 1 contains general information about personal data processing at Hydrohex.
• Part 2 applies to the processing of your personal data as a business customer (or a representative of one).

If you have any questions or concerns regarding the processing of your personal data at Hydrohex, please don’t hesitate to contact us:

Hydrohex Oy Ltd

Privacy team
[email protected]

We may update our privacy policies from time to time. The date of last update is shown above. Minor changes will be shown in this document, and we ask that you review it regularly. Changes that significantly affect the rights and freedoms of our customers will be communicated to you by email or notification if we have your contact details.

Part 1: General information

Categories of personal data

As our customer (or a representative of one), we regularly process certain categories of your personal data. These are:

• Name, contact details and position (e.g. your title at the company that you represent)
• Messages and correspondence
• Financial information and public records (e.g. to fulfil our financial due diligence or to make sure that you are entitled to represent your company)
• Payment information and payment history

(Some of these categories are normally information related to the company that you represent, but in some cases such information may be considered your personal data under the GDPR.)

Occasionally, we process certain additional categories of your personal data. These are:

• Technical identifiers (e.g. device identifiers, IP addresses, geolocation data)
• Video and sound recordings and photographs (e.g. if we record a video seminar that you attend, or if we record a customer service phone call)
• Preferences and activity (e.g. if we take notes of your customer service interactions and our customer relationship activity with you)
• Social media content and other public information (e.g. if we take notes of your company’s online presence or check your information for marketing purposes)

Mandatory categories of personal data

Some categories of personal data are mandatory in the sense that without certain data, we cannot provide our services to you or carry out other critical processes related to our customer relationship. In some cases we may also have a legal duty to process certain categories of your personal data.

In Part 2 of the privacy policy, we have marked clearly which categories of personal data are mandatory for a given purpose.

Sources of personal data

We primarily process personal data that you give us, for instance when we discuss our business matters or sign a contract.

However, in some cases we may receive personal data relating to you from other sources. These are:

• Public records (e.g. company registers, business data services)
• Marketing registers (e.g. if we include your information in a marketing dossier)
• Your company (e.g. if your employer updates your contact details with us)
• Social media and the internet
• Technical sources such as cookies, scripts, databases and similar technologies (e.g. if you access our website or online services)

Retention periods of personal data

When processing your personal data, we adhere to the principle of data minimisation. That means we only keep your personal data as long as necessary for the purposes that we describe more in detail below, and only as long as we have a legal basis set out in the GDPR to process the data.

As soon as no relevant purpose or legal basis applies, we will either destroy your personal data or anonymise it in an irreversible manner.

In Part 2 of the privacy policy, we have marked clearly all retention periods of your personal data for a given purpose.

Sharing personal data with third parties

As a commercial service provider, we like most other companies have to outsource some of the processing of your data to trusted partners. Because of that, we transfer certain categories of personal data to third parties.

We always make sure that all transfers are protected by a contractual arrangement between us and our trusted partners as required by the GDPR.

Our trusted partners can be categorised as follows:

Website, data storage and technical operations

• Web hosting companies (e.g. to operate our website and online services)
• Content management services and content delivery networks (e.g. to operate our website and onlice services and to store and process online data)
• Cloud storage (e.g. to store customer and contract information)
• Online collaboration tools (e.g. if we plan and discuss our services with you internally)

Communications and deliveries

• E-mail and messaging services
• Chatbox service providers (e.g. if you use our customer service chatbox)
• Video call service providers (e.g. if we have a video call with you)
• Postal service providers and delivery companies (e.g. to ship our hardware to you)

Financial service providers

• External accountants and auditors
• Accounting software service providers (e.g. to store our invoices for bookkeeping obligations)
• Banks and payment processors

Professional  advisers

• Law firms
• Business consultants

Customer and contract management

• Hosted customer management services
• Digital signature services
• Calendar and booking services (e.g. to book and handle meetings with you)

Public authorities

• Any information lawfully requested by a public authority

Transfers outside the EU/EEA

We normally process your personal data within the European Union and European Economic Area. In some cases, we or our trusted partners process your personal data outside these areas.

Because of that, some of your personal data are transferred to the following countries:

• United States: We and our trusted partners make sure that transfers are protected under the EU-US Data Privacy Framework. If not, we and our trusted partners make sure transfers are protected by contractual arrangements using the Standard Contractual Clauses (SCC) issued by the European Commission.

Your rights

According to the GDPR, you have various rights as we process your personal data. These are:

• Right of access: You may ask us whether we process any personal data about you, and if we do, you have a right to request a copy of some or all of the data. You also have a right to ask for more information regarding the third-party recipients of your personal data as well as our protective measures applicable to the transfers of your data to our trusted partners and outside the EU/EEA.

If you request a copy of your data, we will send it to you electronically.  In most cases we will be glad to accommodate your request, but if we receive repeated or manifestly unfounded requests from you, we may have to refuse or charge a reasonable administrative fee to process your request.

• Rectifying incorrect or incomplete personal data: If you consider that some of your personal data that we process is incorrect or incomplete, you may ask us to correct or complete the data. We will investigate your request without undue delay, and accommodate it if we can be sufficiently certain that the request is justified.

• Erasing personal data (“the right to be forgotten”): If you don’t want us to process your personal data, you may ask us to erase a part or all of it. We will do our best to accommodate your request, but in some cases we may have to refuse or postpone the request. This may happen e.g. if we have an on-going business relationship with you and we need your personal data to perform our services, or if we have a legal duty or a legitimate interest to retain some of your data (we have described these in more detail in Part 2).

• Restricting the processing of personal data: If you consider that our processing of your personal data breaches the GDPR or other laws, you may ask us to restrict the processing (i.e. to stop the processing for the time being). We will accommodate your request as well as possible while we investigate the matter.

You may also ask us that we do not erase or otherwise process your personal data if you need the data e.g. in a legal dispute and the erasure or other processing would jeopardise your interests in that regard. We will aim to accommodate your request as well as possible.

• Objecting to processing of personal data: As explained in detail in Part 2, we sometimes process your data on the basis of our or someone else’s legitimate interest. If that’s the case, you may object to our processing of your data on that basis. We will aim to accommodate your request as much as possible, however in some cases the legitimate interests in question may be so important that they outweigh your interest to object.

If that happens, we will let you know about our reasons for not accommodating your request and inform you about your right to lodge a complaint with the relevant data protection authorities.

If we have contacted you for direct marketing purposes, you may also object to our processing of your personal data for that purpose. (In other words, you may prohibit us from contacting you for direct marketing purposes). We will accommodate your request without undue delay.

• Withdrawing consent: As explained in detail in Part 2, we sometimes process your personal data on the basis of your consent. If that’s the case, you may, at any time, withdraw your consent for that processing. We will accommodate your request without undue delay, however we may continue the processing if we have another legal basis to do so. Please note that withdrawing consent will not affect the prior processing of your personal data.

• Right to lodge a complaint: If you consider that our processing of your personal data breaches the GDPR or other laws, you may at any time lodge a complaint with the relevant data protection authorities.

To exercice any of your above rights, please contact us using the contact details shown at the beginning of the document. We’ll be glad to assist you.

Cookies and tracking

Like most other companies, we use cookies and similar technologies on our website, online services and in marketing. We will adhere to applicable laws regarding the prerequisites for the processing of your personal data in such ways.

We have described in detail the types of cookies and similar technologies we use as well as their purposes in our cookie policy.

Part 2: Processing of your data

As you are a business customer (or act as a representative of one), we process your personal data in certain ways in the context of our business relationship. Here we describe the purposes of processing your personal data together with the appropriate legal bases for the processing, as well as the categories of personal data processed together with their retention periods.

Purposes and legal bases of the processing of personal data

According to the GDPR, all processing of personal data must be justified using a legal basis found in the law. We use the following legal bases for our processing:

• Contract (including contract preparation): As you are our business customer (or represent one), to perform that contract we need to process certain categories of your personal data.
• Legal obligation: As a commercial service provider, we have a number of legal obligations to fulfil. For instance, we must keep financial records of our transactions, which may include your personal data.
• Consent: In some cases, we may ask for your consent to process your personal data. If we receive your consent, we may process your data on that basis within the limits of the consent. For instance, we use cookies for statistical and marketing purposes, which may only be done if we receive your consent.
• Legitimate interest: In some cases, we may process your personal data if it’s justified for our or someone else’s legitimate interest. We only do so after having assessed your rights and freedoms against the importance of the legitimate interest (we conduct a so-called “balancing test”). For more information about this, please contact us using the contact details shown above.

Here is a complete overview of our purposes of processing and the corresponding legal bases:

Categories of personal data processed and their retention times

Below is a list of our retention times for different categories of personal data under a given purpose. Once a specific retention period runs out, we will destroy the relevant personal data or anonymise it irreversibly, unless a different purpose with a longer retention period applies.

For instance, we keep personal data for the purposes of communications (like e-mails containing your name and e-mail address) for 1 year. Once the retention period runs out, we will destroy the relevant data unless we need to keep it for the purposes of risk management for 3 years. If so, we will continue to retain the data until the 3-year retention period runs out.