ID:

Data Protection

DS026

Revision: 001

Status: Approved

Information Requirements
Interested Party/ Customer/ Date: 11 May 2018
Other External Party Data

Information on processing personal data ofInterested Party, Customer and Other External Partyper Art. 13 GDPR
Dear interested party / customer / external party,
We take the protection of your personal data very seriously. We process your data inaccordance with the EU General Data Protection Regulation (GDPR) and the Data Protection
Adaptation and Implementation Act EU (DSAnpUG-EU). The following details how we process
your data per Art. 12 et seq. GDPR.

Who is responsible for data processing? (Art. 13.1a, b GDPR)
Responsible for data processing:Interroll Joki A/S
Hammerholmen 2-6, DK-2650 Hvidovre
Phone: +45 36 88 33 44
Email: databeskyttelse@interroll.com
Ask questions about data protection to:Interroll Joki A/S
GDPR-Coordinator
Hammerholmen 2-6, DK-2650 Hvidovre
Phone: +45 36 88 33 44
Email: databeskyttelse@interroll.com

For what purposes and on what legal basis do we process your personal data?
(Art. 13.1c, d and 2f GDPR)

If you contact us for an offer, we store your data in our customer or supplier database so that
we can access it in the event of the conclusion of the contract (Art. 6.1f GDPR). If we only
respond to a request from you, we will only store your data for the purpose of answering yourrequest and will not use your data for any other purpose. We only process such data that wehave received from you directly in the context of the respective business transaction or ingeneral communication, e.g. for the conclusion and execution of contracts. The legal basis isArt. 6.1b GDPR.
If we have received your consent (pursuant to Art. 6.1a), we process your data for the purposesof information and consulting on products and services as well as marketing.

If necessary, we will process your data to protect ours or third parties’ legitimate interests inaccordance with Art. 6.1f GDPR, such as for the assertion of legal claims and defence in legal
disputes or for the guarantee of IT operations and security.

ID:

Data Protection

DS026

Revision: 001

Status: Approved

Information Requirements
Interested Party/ Customer/ Date: 11 May 2018
Other External Party Data

In order to comply with legal requirements, we may or must, if necessary, process your dataand pass it on to third parties (pursuant to Art. 6.1c).
We do not use your data in any way for automated decision making or profiling.

Who receives your personal data? (Art. 13.1e, f GDPR)
We generally do not pass on personal data to third parties unless you have given your consent(see above) or there are legitimate interests (Art. 6.1f GDPR). Data can then also betransmitted to other companies of the Interroll Group. Furthermore, within the scope of contract
processing, your data may also be received by respective external service providers, which
we have obligated to keep confidential by means of corresponding contractual regulations (e.g.
in accordance with Art. 28 GDPR).
We process your data mainly in Denmark and have no intention of processing the data inthird countries. An exception is Switzerland, where several Interroll companies are based.
In addition, data is exchanged with sales companies in other EU countries. If we receive yourdata for the preparation or acceptance of an offer, your data may be exchanged in thenetwork of the Interroll companies, which are sometimes located in third countries. As long
this is necessary to carry out pre-contractual measures or to fulfill a contract.

How long is the data stored? (Art. 13.2a GDPR)
In principle, we only store your data for as long as required by law. Data that we process on
the basis of your consent will be stored until revoked. We store data that we process on thebasis of a legitimate interest for as long as the legitimate interest exists.

What rights do you have? (Art. 13.2b, c, d, e GDPR)
Every data subject has the following rights:
Art. 15 GDPR: Right of accessArt. 16 GDPR: Right to rectification
Art. 17 GDPR: Right to erasure (‘right to be forgotten’)Art. 18 GDPR: Right to restriction of processing
Art. 20 GDPR: Right to data portability
Art. 21 GDPR: Right to object
Art. 13d GDPR: Right to lodge a complaint with a supervisory authority
Art. 7.3 GDPR: Right to withdraw consent at any time
If you wish to exercise your rights, please contact us in writing (by mail or email) as mentionedabove.

ID:Data Protection

DS026

Revision: 001

Status: Approved

Information Requirements
Interested Party/ Customer/ Date: 11 May 2018
Other External Party Data

Competent supervisory authority
Datatilsynet
Address: Borgergade 28, 5. DK-1300 København K
Postal address: Borgergade 28, 5. DK-1300 København K
Phone: +45 33 19 32 00
E-mail: dt@datatilsynet.dk

You only have to provide us with the personal necessary for our business relationship and thefulfilment of the associated contractual obligations or which we are legally obliged to collect(e.g. money laundering law, trade and finance laws). Otherwise, we cannot or may not have abusiness relationship with you or conclude and execute a contract with you.

ID:Data Protection

DS026

Revision:001

Status: Approved

Information Requirements
Interested Party/ Customer/ Date: 11 May 2018
Other External Party DataPurpose

Legal baseAnswering general inquiries / Art. 6 para. 1 a GDPR
general correspondence

Recipient

Storage period

Internal data processing

In accordance with legal retention periods

Proposal preparation

Art. 6 para. 1 b GDPR

Internal data processing

In accordance with legal retention periods

Order processing

Art. 6 para. 1 b GDPR

Internal data processing

In accordance with legal retention periods

Customer master data

Art. 6 para. 1 b GDPR

Internal data processing

In accordance with legal retention periods

Vendor master data

Art. 6 para. 1 b GDPR

Internal data processing

In accordance with legal retention periods

InvoicingArt. 6 para. 1 b GDPR

Internal data processing

In accordance with legal retention periods

Marketing / advertising

Art. 6 para. 1 f GDPR

Interroll (Schweiz) AG

In accordance with legal retention periods

Customer satisfaction
analysisArt. 6 para. 1 f GDPR

Internal data processing

In accordance with legal retention periods

Supplier assessment

Art. 6 para. 1 ) GDPR

Internal data processing

In accordance with legal retention periods