ID:

Data Protection

DS026

Revision: 002

Status: Approved

Information Requirements
Interested Party/ Customer/ Date: 11 May 2018
Other External Party Data

Information on processing personal data ofInterested Party, Customer and Other External Party
per Art. 13 GDPR
Dear interested party / customer / external party,
We take the protection of your personal data very seriously. We process your data inaccordance with the EU General Data Protection Regulation (GDPR) and the Data Protection
Adaptation and Implementation Act EU (DSAnpUG-EU). The following details how we process
your data per Art. 12 et seq. GDPR.

Who is responsible for data processing? (Art. 13.1a, b GDPR)
Responsible for data processing:Interroll Ltd
Unit 1a Orion Way, Kettering. NN15 6NL.
Phone: +44 (0) 1536 - 536722
Email: dataprotection@interroll.com
Ask questions about data protection to:Interroll Ltd
Unit 1a Orion Way, Kettering. NN15 6NL.
Phone: +44 (0) 1536 - 536722
Email: dataprotection@interroll.com

For what purposes and on what legal basis do we process your personal data?
(Art. 13.1c, d and 2f GDPR)

If you contact us for an offer, we store your data in our customer or supplier database so that
we can access it in the event of the conclusion of the contract (Art. 6.1f GDPR). If we only
respond to a request from you, we will only store your data for the purpose of answering yourrequest and will not use your data for any other purpose. We only process such data that wehave received from you directly in the context of the respective business transaction or ingeneral communication, e.g. for the conclusion and execution of contracts. The legal basis isArt. 6.1b GDPR.
If we have received your consent (pursuant to Art. 6.1a), we process your data for the purposesof information and consulting on products and services as well as marketing.

If necessary, we will process your data to protect ours or third parties’ legitimate interests inaccordance with Art. 6.1f GDPR, such as for the assertion of legal claims and defence in legal
disputes or for the guarantee of IT operations and security.

ID:

Data Protection

DS026

Revision: 002

Status: Approved

Information Requirements
Interested Party/ Customer/ Date: 11 May 2018
Other External Party Data

In order to comply with legal requirements, we may or must, if necessary, process your dataand pass it on to third parties (pursuant to Art. 6.1c).
We do not use your data in any way for automated decision making or profiling.

Who receives your personal data? (Art. 13.1e, f GDPR)
We generally do not pass on personal data to third parties unless you have given your consent(see above) or there are legitimate interests (Art. 6.1f GDPR). Data can then also betransmitted to other companies of the Interroll Group. Furthermore, within the scope of contract
processing, your data may also be received by respective external service providers, which
we have obligated to keep confidential by means of corresponding contractual regulations (e.g.
in accordance with Art. 28 GDPR).
We process your data mainly in the UK and have no intention of processing the data in thirdcountries. An exception is Switzerland, where several Interroll companies are based.
In addition, data is exchanged with production companies in other EU countries. If we receive
your data for the preparation or acceptance of an offer, your data may be exchanged in thenetwork of the Interroll companies, which are sometimes located in third countries. As long as
this is necessary to carry out pre-contractual measures or to fulfil a contract.

How long is the data stored? (Art. 13.2a GDPR)
In principle, we only store your data for as long as required by law. Data that we process on
the basis of your consent will be stored until revoked. We store data that we process on thebasis of a legitimate interest for as long as the legitimate interest exists.

What rights do you have? (Art. 13.2b, c, d, e GDPR)
Every data subject has the following rights:
Art. 15 GDPR: Right of accessArt. 16 GDPR: Right to rectification
Art. 17 GDPR: Right to erasure (‘right to be forgotten’)Art. 18 GDPR: Right to restriction of processing
Art. 20 GDPR: Right to data portability
Art. 21 GDPR: Right to object
Art. 13d GDPR: Right to lodge a complaint with a supervisory authority
Art. 7.3 GDPR: Right to withdraw consent at any time
If you wish to exercise your rights, please contact us in writing (by mail or email) as mentionedabove.

ID:Data Protection

DS026

Revision: 002

Status: Approved

Information Requirements
Interested Party/ Customer/ Date: 11 May 2018
Other External Party Data

Competent supervisory authority
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
CheshireSK9 5AF
Phone: +44 (0)303 123 1113
E-mail: casework@ico.org.uk
You only have to provide us with the personal necessary for our business relationship and thefulfilment of the associated contractual obligations or which we are legally obliged to collect(e.g. money laundering law, trade and finance laws). Otherwise, we cannot or may not have abusiness relationship with you or conclude and execute a contract with you.ID:

Data Protection

DS026

Revision:002

Status: Approved

Information Requirements
Interested Party/ Customer/ Date: 11 May 2018
Other External Party Data

PurposeLegal base

Recipient

Storage period

Answering general inquiries / Art. 6 para. 1f GDPR
general correspondence(consent)

Internal data processing

In accordance with legal retention periods

Art. 6 para. 1 b GDPR

Internal data processing

In accordance with legal retention periods

Internal data processing

In accordance with legal retention periods

Internal data processing

In accordance with legal retention periods

Internal data processing

In accordance with legal retention periods

Internal data processing

In accordance with legal retention periods

Interroll (Schweiz) AGIn accordance with legal retention periods

Proposal preparation(contractual fulfilment)

Order processing

Art. 6 para. 1 b GDPR
(contractual fulfilment)

Customer master data

Art. 6 para. 1 b GDPR
(contractual fulfilment)

Vendor master data

Art. 6 para. 1 b GDPR
(contractual fulfilment)

InvoicingArt. 6 para. 1 b GDPR
(contractual fulfilment)

Marketing / advertising

Art. 6 para. 1 f GDPR
(legitimate interest)

ID:

Data ProtectionDS026

Revision:002

Status: Approved

Information Requirements
Interested Party/ Customer/ Date: 11 May 2018
Other External Party Data

Customer satisfaction
analysisArt. 6 para. 1 f GDPR

Supplier assessment

Art. 6 para. 1 f GDPR

Internal data processing

In accordance with legal retention periods

Internal data processing

In accordance with legal retention periods(legitimate interest)(legitimate interest)