Source: https://www.voestalpine.com/vademsas/en/company/data-protection/
Timestamp: 2019-04-24 20:19:36+00:00

Document:
Protecting the security and privacy of personal data of our business partners (such as customers and suppliers) is very important to [voestalpine Kardemir Demiryolu Sistemleri Sanayi ve Ticaret A.Ş. – A.H.R. Mahallesi Çankırı-Ankara Karayolu 3. KM TCDD Makas Fabrikası Yanı 18100 Çankırı / TÜRKİYE] and its subsidiaries (together [“voestalpine”]). We are obligated to protect your data and take this duty very seriously. We expect the same from our business partners.
The processing of personal data is necessary to meet the aforementioned purposes including the performance of a contractual relationship or a pre-contractual activity with the business partner.
Unless indicated otherwise, the legal basis for the processing of personal data is Article 6 (1) (a) (if consent has been given) or Article 6 (1) (b) or (f) of the General Data Protection Regulation (GDPR).
If aforementioned personal data is not provided or is insufficient or if [voestalpine] cannot collect the respective personal data the purposes described may not be met or the received inquiry/inquiries could not be processed. Note that this would not be considered failure to fulfill our obligations under a contract.
If legally permitted to do so, [voestalpine] may transfer personal data to other voestalpine Group companies (www.voestalpine.com/locations) or courts, authorities, attorneys, or other business partners (for example shipping and logistics partners for executing and processing orders).
Furthermore [voestalpine] engages processors (service providers) to process personal data (within the scope of an IT support contract, for example). These processors are contractually bound to act in compliance with applicable data protection regulations.
Recipients of personal data may be located in countries outside of the European Union (“third countries”), in which applicable laws do not offer the same level of data protection as the laws of the respective individual’s home country. In this case, according to the legal requirements personal data is only transferred if the European Commission has adopted an adequacy decision for the third country, if adequate safeguards have been agreed (e.g. EU Standard Contractual Clauses were concluded), the recipient participates in an approved certification system (e.g. EU-US Privacy Shield), binding corporate rules are implemented in accordance with Art. 47 of the General Data Protection Regulation or there is a derogation for specific situations in accordance with Art. 49 of the General Data Protection Regulation (e.g. because you explicitly consented to the proposed transfer, after having been informed of the possible risks of such transfers for the data subject due to the absence of an adequacy decision and appropriate safeguards). Further information and a copy of the implemented measures can be obtained from the contact listed under 6.
Unless explicitly indicated otherwise at the time of the collection of your personal data (e.g. in a declaration of consent), your personal data will be erased if the retention of the personal data is no longer necessary to fulfill the purposes for which they were collected and if no statutory retention obligations (such as tax or commercial law) or establishment, exercise or defence of legal claims require us to further retain the data.
In accordance with Art. 15 GDPR, you have the right to obtain from the controller confirmation as to whether or not personal data concerning you are being processed and access to information about this data.
In accordance with Art. 16 GDPR, you have the right to obtain without undue delay the rectification of inaccurate personal data and to have incomplete personal data completed.
In accordance with Art. 17 GDPR, you have the right to erasure of your personal data.
In accordance with Art. 20 GDPR, you have the right to data portability.
In accordance with Art. 21 GDPR, you have the right to object to the processing of personal data.
Finally, you are entitled to file a complaint with the supervisory authority.
If processing of your personal data is based on your consent, you have the right to withdraw your consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
In order for us to efficiently respond to such a request, we ask you to contact us using the contact data listed below and to provide us with confirmation of your identity, for example, by sending us an electronic copy of your ID.
All processors engaged by us are bound by our security concept and are obligated to adhere to similar or equal security measures.
For any questions related to data protection and asserting the rights as listed, please contact the voestalpine data protection organization at [info.vademsas@voestalpine.com].

References: Art. 47
 Art. 49
 Art. 15
 Art. 16
 Art. 17
 Art. 20
 Art. 21