Personal Data ManagementPolicy

For our prospective customers, clients, suppliers and other commercial partners
Within the Framework of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural
persons with regard to the processing of personal data and on the free movement of such data data (hereinafter ‘the GDPR’), GETZNER FRANCE (hereinafter ‘GETZNER’ or ‘us’) has put in place a policy for managing personal
data that it may collect and process through communications and contractual relations with its prospective customers, clients, suppliers and othercommercial partners (hereinafter referred to collectively or individually as‘Partners’ or ‘you’) in line with the requirements of GDPR (here-inafter ‘thePersonal Data Management Policy’).
GETZNER’s Personal Data Management Policy may be updated as a resultof changes in legislation and/or the handling of personal data that we may
carry out.
Terms such as ‘processing’ and ‘processor’ will have the definitions set outin Article 4 GDPR.
Who is the data processor in your relationship with GETZNER?
Getzner France SAS
Rue Jacqueline Auriol 19, 69008 Lyon
FRANCETelephone number: +33 4 72 62 00 16
E-mail: privacy@getzner.com
Types of data collected and processed:
We process data on our Partners, including individuals, companies, and individuals who work for these companies. These data include:— Civil status and contact details (name, surname, email address, etc.);— Data relating to business transactions and other business relationships(e.g. order details, order/invoice/delivery note numbers, account numbers, financial data, records of discussions and communication history);— Data from publicly accessible sources/information databases (e.g. commercial/trade register numbers, agencies and public bodies);— Where necessary, information relating to relevant legal proceedings andother legal disputes in which our Partner businesses are engaged.
Purpose and relevant legal basis for data processing:— Correspondence with Partners through any means (including email andonline chat) relating to our products and services, as well as news on
GETZNER projects, in particular through newsletters;— Planning, performance and administration of contractual and business
relationships between GETZNER and our Partners (e.g. to advise Partners correctly, to process orders, to deliver products, and to manage invoicing and payments);— Carrying out surveys of Partners, marketing and communications campaigns, market analyses, competitions or any other communication operations involving our Partners;— Maintaining and protecting the security of our products and services aswell as our website, identifying and preventing security threats, fraudulent acts, identity theft, and any other activities that might directly or indirectly harm GETZNER;— Complying with (i) legal requirements (e.g. retention obligations undertax and commercial law), and (ii) existing obligations regarding compliance screenings (e.g. to prevent money-laundering);— Documenting and managing data in a customer relationship management system (‘CRM system’) or similar enquiry management process;— Resolving legal disputes, enforcing existing contracts with Partners andasserting GETZNER’s rights and interests in any legal or extra-judicialproceedings, including alternative dispute resolution.
Our Partners’ personal data are processed with their consent, whether on
the grounds of legitimate interest, legal obligations or the contracts entered into between GETZNER and our Partners.

If Partners refuse to transmit personal data requested from them, or if
GETZNER is unable to collect the data itself, Partners should understandthat the purposes mentioned above may not be achieved through no fault
of GETZNER’s.
Communication of personal data to third parties:
In the scope of its processing of Partners’ personal data, GETZNER undertakes to transmit the data to third parties or give them access to it only inthe following cases:— When there is legal authorisation (e.g. if the data need to be transmitted
to third parties, such as payment service providers, for the performanceof a contract pursuant to Article 6(1)(b) GDPR).
— When you have given consent (Article 6(1)(a) GDPR).
— When we have a legal obligation to do so (Article 6(1)(c) GDPR).
— When we need to do so to pursue our legitimate interests (co-contractors, sub-contractors, IT suppliers, etc.) pursuant to Article 6(1)(f) GDPR.
GETZNER further undertakes not to communicate or provide access to Partners’ personal data to third parties that do not strictly comply with this Personal Data Management Policy. In particular, third parties are required toensure the security and confidentiality of the data, and not use them foranything other than the specific purpose for which they need them in linewith the purposes set out above and the arrangements set out in the GDPR,
in particular those relating to subcontracting.
Third parties mentioned above may include our affiliate companies (Getzner
Werkstoffe GmbH [Austria], Getzner Werkstoffe GmbH [Germany], Getzner
Spring Solutions GmbH, Nihon Getzner K.K., Byrel Fastening Systems Co.,
Ltd.; Getzner India Pvt. Ltd., Beijing Getzner Trading Co., Ltd., and Getzner
USA, Inc., Getzner Vibration Solutions Pty Ltd.).
Data transfer to third countries:
Unless there is a legal or contractual authorisation to do otherwise,
GETZNER will only process or commission processing of Partners’ personal
data in third countries, i.e. outside of the EU and the EEA, under the specific conditions set out in Articles 44 et seqq. GDPR. That means processing
is conducted on the basis of specific safeguards, such as a data protectionlevel that is officially recognised as corresponding to that of the EU or compliance with officially recognised, specific contractual obligations (‘standardcontractual clauses’).
Detailed information on newsletter sending:Content of the newsletter – purpose:
We send newsletters, emails and other electronic notifications containing
advertising information (here-inafter ‘newsletters’) for the purpose of informing recipients about our products and services as well as those from ouraffiliated companies. Such communication is only sent with the consent of
the recipient or if permissible by law. If the content of a newsletter is specified in the context of registration for the newsletter, the consent of users isbased on that specified content. In addition, our newsletters contain information about GETZNERS’s products and services.
Double opt-in and logging:A double opt-in process is used for registration for our newsletter. That means that after registering you receive an email requesting confirmation ofyour registration. That confirmation is necessary to ensure that nobody canregister with email addresses that do not belong to them. Registration for
the newsletter is logged to provide proof of the registration process in linewith legal requirements. That includes storage of the date and time of theregistration and confirmation, as well as the IP address. Any changes to yourdata that are stored with the newsletter sending service will also be logged.
Registration data:
To register for the newsletter, it is sufficient for you to enter your name/company name and email address. The registration process is logged on thebasis of our legitimate interests pursuant to Article 6(1)(f) GDPR. We havean interest in the use of a user-friendly and secure newsletter system thatserves our business interests, but that also meets the expectations of ourPartners and enables us to prove that consent has been granted.

1/2

Distribution via MailChimp :The newsletter is distributed by the distribution service provider ‘MailChimp’, an email marketing service from the US-based company Rocket
Science Group, LLC, 675 Ponce De Leon Ave NE #5000, Atlanta, GA 30308,
USA. The MailChimp privacy policy can be viewed here: https://mailchimp.
com/legal/privacy/. The distribution service provider ‘MailChimp’ is used in
the pursuit of our legitimate interests as per Article 6(1)(f) GDPR and in thecapacity of a contracted processor as per Article 28(3) GDPR.
MailChimp may use recipients’ data in pseudonymised form, i.e. without assigning such data to a user, in order to optimise or improve its own services e.g. for technical optimisations to the distribution process and how thenewsletter is displayed, or statistical purposes. MailChimp does not use thedata of our newsletter recipients to contact them directly and these data
are not passed on to third parties.
Measuring readership and performance:
Our newsletter and other information updates contain a ‘web beacon’, i.e.
a pixel-sized file that is accessed from GETZNER’s or MailChimp’s serverwhen the newsletter is opened. During this process, technical information– such as information about your web browser and system, IP address andtime of access – is collected.
This information is used to make technical improvements to the service
based on the technical data or the target groups and their reading habits
based on their locations (which can be identified from the IP address) or theaccess times. Data on whether the newsletter has been opened, when it wasopened and which links were clicked, are also collected for statistical purposes. Although it is technologically possible to identify individual newsletter
recipients from these data, it is neither our intention nor that of MailChimp,
to monitor individual users. The data are far more useful to us to identify
the reading habits of our Partners and to adapt our content accordingly, orto send different content based on the interests of our Partners.

You may:— Request access to your data (Article 15 GDPR): This right entitles
you to obtain a copy of the personal data we have concerning you, andto check that we are processing them legally;— Request rectification of your data (Article 16 GDPR): This right entitles you to request rectification of any incomplete or inaccurate information we have concerning you;
— Request restriction of processing of your data (Article 18 GDPR):
This right entitles you to request that we restrict or suspend processingof the personal data concerning you. In most cases, we will need to suspend or cancel the services that we provide you with;— Object to the processing of your data, or request erasure of the data(Articles 17 and 21 GDPR): This right entitles you to ask us to erase yourpersonal data if we do not have legitimate grounds to process them, unless there is a legal obligation for us to keep them. In most cases, we willneed to suspend or cancel the services that we provide you with.
— Request portability of your data (Article 20 GDPR): This right entitles
you to receive your personal data that we are processing in a structured,commonly used and machine-readable format and to transmit the data
to another controller without hindrance from us.
You may exercise your rights by providing a copy of an identity document so that we can be sure that your data are only communicatedto you. Likewise you may ask us any questions about how GETZNER
collects and processes your personal data by contacting us with yourrequest using the details listed at the start of this document. We will
respond to your request as quickly as possible.
If you do not receive a satisfactory response, you may refer your request to the French Data Protection Commission (CNIL) via https://www.cnil.fr/en/home.
This page always displays the latest version of our Personal Data Management Policy.
Last updated 05 August 2020.

DSGVO GFR en © Copyright by Getzner Werkstoffe GmbH l 08-2020

Erasure of data:
Data processed by us will be erased or their processing will be restrictedpursuant to Article 17 and Article 18 GDPR. Unless expressly indicated inthis information document, data stored by GETZNER will be erased once
they are no longer required for their intended purpose and erasure of thedata is not in conflict with any statutory data retention obligations. If data
are not deleted because they are required for other purposes permitted bylaw, their processing will be restricted. That means the data will not be used
for other purposes. That applies, for example, to data that must be retained
pursuant to the law, such as the requirement to retain invoices for 9 years
after they are issued.

Your rights with respect to your personal data:
Within the limits put in place by the GDPR and the French law on Data Protection, you have certain rights with respect to your personal data.

AUSTRIA — Bürs GERMANY — Berlin — Munich — Stuttgart FRANCE — Paris — Lyon JAPAN — Tokyo INDIA — Pune
JORDAN — Amman CHINA — Beijing USA — Charlotte AUSTRALIA — Melbourne
www.getzner.com
2/2