General Data Protection Notice

In the course of our business relationship with you, it is necessary for us to process your personal data. “Personal data” is any information that relates to an identified or identifiable natural person (e.g. names and addresses).

Protecting the security and privacy of personal data of our business relations (such as customers, suppliers and website visitors) is very important to voestalpine Track Solutions Netherlands B.V., located at Nieuwe Crailoseweg 8, 1200 AW Hilversum, Nederland. We are obligated to protect your data and take this duty very seriously. We expect the same from our business relations.

Please find enclosed a summary of the processing of personal data of our business relations:

In the context of the business relationship with business relations, voestalpine Track Solutions Netherlands B.V. may process personal data for the following purposes:

• Communicating with business partners about products, services and projects, e.g. to process inquiries from business partners;
• Initiate, process and manage (contractual) relationships and maintain business relationships between voestalpine Track Solutions Netherlands B.V. and the business partner, e.g. to process orders for products or services, to process payments, for accounting, billing and collection purposes, to make deliveries, to carry out maintenance activities and repairs;
• Conducting customer surveys, marketing campaigns, market analysis, sweepstakes, contests, and other promotional activities or events;
• Statistical analyses from internet traffic of users that visit our website, for optimization of our websites and social media;
• Maintaining and protecting the security of our products, services and websites, preventing and detecting security threats, fraud and other criminal or malicious activities;
• Ensuring compliance with (i) legal obligations (such as record keeping obligations in accordance with tax and commercial law), and (ii) voestalpine policies;
• Settling disputes, enforcing our contractual agreements and establishing, exercising or defending legal claims.

Unless indicated otherwise, the legal basis for the processing of personal data is that which is written in one or more of the following articles from the General Data Protection Regulation (hereafter: GDPR):

• Article 6 (1)(b) GDPR because the processing is necessary for the performance of a contract to which the data subject is party or for pre-contractual measures;
• Article 6 (1)(f) GDPR because the processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party;
• Article 6 (1)(a) GDPR because consent has been given.

For the aforementioned purposes, voestalpine Track Solutions Netherlands B.V. may process the following categories of personal data:

• Business contact information, such as name, work address, work telephone number and email address;
• Payment data, such as data necessary for processing payments and fraud prevention, including credit card numbers and card security codes;
• Cookies; these are little pieces of information saved by your browser. Our server will recognize in this regard your IP-address and will register the pages you visit;
• Information collected from publicly available sources, information databases and credit agencies;
• Other information that has to be processed to initiate, process and manage (contractual) relationships and maintain business relationships or that you voluntarily provide, such as orders placed, order details, inquiries or project details, correspondence, other data pertaining to the business relationship. 

If aforementioned personal data is not provided or is insufficient or if voestalpine Track Solutions Netherlands B.V. cannot collect the respective personal data the purposes described may not be met or the received inquiry/inquiries could not be processed. Note that this would not be considered failure to fulfill our obligations under a contract.

If legally permitted to do so, voestalpine Track Solutions Netherlands B.V. may transfer personal data to other voestalpine Group companies (www.voestalpine.com/locations) or courts, authorities, attorneys, or other business partners (for example shipping and logistics partners for executing and processing orders).

voestalpine Track Solutions Netherlands B.V. engages processors (service providers) to process personal data (within the scope of an IT support contract, for example). These processors are contractually bound to act in compliance with applicable data protection regulations. We guarantee that your data will never be sold to a third party.

Recipients of personal data may be located in countries outside of the European Union (“third countries”), in which applicable laws do not offer the same level of data protection as the laws of the respective individual’s home country. In this case, according to the legal requirements personal data is only transferred if the European Commission has adopted an adequacy decision for the third country, if adequate safeguards have been agreed (e.g. EU Standard Contractual Clauses were concluded), the recipient participates in an approved certification system, binding corporate rules are implemented in accordance with Art. 47 of the General Data Protection Regulation or there is a derogation for specific situations in accordance with Art. 49 of the General Data Protection Regulation (e.g. because you explicitly consented to the proposed transfer, after having been informed of the possible risks of such transfers for the data subject due to the absence of an adequacy decision and appropriate safeguards). Further information and a copy of the implemented measures can be obtained from the contact listed under 6.

Furthermore, this website uses Google Analytics, a Google Inc. (Google) web analysis service. Google Analytics uses cookies, which are text files stored on your computer to be able to analyze your use of the website. The information generated by the cookie about your use of this website is usually transferred to a Google server in the USA and stored there. We only use Google Analytics with activated IP address anonymization. This means that within the member states of the European Union or in other states parties to the agreement within the European Economic Area, Google truncates your IP address before it is transferred. Only in exceptional cases will the full IP address be transferred to a Google server in the USA and truncated there. On behalf of the website operator, Google will use this information to evaluate your website use and compile reports on website activity and to provide the website operator other services related to website use and Internet use. The IP address transmitted by your browser during Google analytics will not be combined with other Google data. You can refuse the use of cookies by selecting the appropriate settings on your browser, but note that in this case, you will not be able to use all of the website functions to their full extent. You can also prevent Google from collecting and processing the data generated by the cookie based on your website use (including your IP address) by downloading and installing the browser plug-in available at the following link http://tools.google.com/dlpage/gaoptout?hl=en). For more information on the terms of service and data protection, see http://www.google.com/analytics/terms/us.html and https://support.google.com/analytics/answer/6004245?hl=us.

Unless explicitly indicated otherwise at the time of the collection of your personal data (e.g. in a declaration of consent), your personal data will be erased if the retention of the personal data is no longer necessary to fulfill the purposes for which they were collected and if no statutory retention obligations (such as tax or commercial law) or establishment, exercise or defence of legal claims require us to further retain the data.

The security of your personal data is extremely important to us. We take specific measures to protect your personal data against loss, misuse, unauthorized access, manipulation or disclosure, including the following:

• Limited access to our premises (access control)
• Implementation of access rights and protection of media (access and transfer control)
• Deployment of network security measures such as antivirus software, firewalls, security updates, etc. (network control)

All processors engaged by us are bound by our security concept and are obligated to adhere to similar or equal security measures.

Our website uses cookies which allow the website to recognize your browser when you visit this website again. Cookies are small text files that the browser stores on your device. This allows the website to be optimally adapted to your interests. If you do not want cookies to be stored on your computer, you can set up your browser to inform you when cookies are set so that you can decide whether or not to allow them on a case-by-case basis. You can also deactivate the use of cookies in your browser. Please note that in this case, you may not be able to use all of the website functions to their full extent.
When visiting our website for the first time, visitors can decide either to accept all cookies or to assign individual settings for each cookie. You can also alter these settings at a later date here.

Right of access to and rectification or erasure of personal data, restriction of processing, Right to object to processing, right to data portability and right to withdraw explicitly granted consent

• In accordance with Art. 15 GDPR, you have the right to obtain from the controller confirmation as to whether or not personal data concerning you are being processed and access to information about this data;
• In accordance with Art. 16 GDPR, you have the right to obtain without undue delay the rectification of inaccurate personal data and to have incomplete personal data completed;
• In accordance with Art. 17 GDPR, you have the right to erasure of your personal data;
• In accordance with Art. 18, you have the right to restrict processing;
• In accordance with Art. 20 GDPR, you have the right to data portability;
• In accordance with Art. 21 GDPR, you have the right to object to the processing of personal data;
• You have the right to file a complaint with the supervisory authority;
• Finally, if processing of your personal data is based on your consent, you have the right to withdraw your consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

In order for us to efficiently respond to such a request, we ask you to contact us using the contact data listed below and to provide us with confirmation of your identity, for example, by sending us an electronic copy of your ID.

This website uses plug-ins of the social networks Facebook, LinkedIn, Twitter and YouTube. These are deactivated by default for data protection reasons. You would have to explicitly activate them to use them. By using the plug-ins you are able to share our information with others. The buttons we provide to make sharing possible are owned by the social media platforms who use cookies for this application. We bear no liability for the use of your personal data by these social media corporations. Your activity is in accordance with the privacy conditions of the social media platform that you are using and we therefore refer to the privacy statements of Facebook, LinkedIn, Twitter and YouTube.

We use solutions from AccessiWay GmbH, located in Vienna, Austria, to produce a highly accessible website. To make our website technically accessible, purely technical data is transmitted to the AccessiBe Ltd, Israel (GDPR compliant by adequacy decision) server located in the USA (GDPR compliant by adequacy decision for the EU-U.S. Data Privacy Framework). This data is SSL3 encrypted and deleted immediately after the accessible, technical information has been retrieved. No data is stored. Only the IP address and user agent (web browser) are transmitted. See website. No cookies are set or stored; the data transfer is purely technical in nature and is used to produce an accessible website.

For any questions regarding data protection and asserting the rights as listed, please contact our data protection manager, who is also our data protection officer as stated in section 4 of the GDPR, Sjaak Spruijt, E-mail: Sjaak.Spruijt@voestalpine.com

This General Data Protection Notice for business relations will be revised from time to time.

The date of the last revision is: 29-05-2018