INFORMATIVA SOGGETTI TERZI

Purpose of this information notice

As a professional in the IT security business interacting with Exclusive Networks (hereafter referred to as “EXN”) or as a professional interacting with Exclusive Networks back-office or management teams, certain of your employees’ personal data, in the meaning of Article 4(1) of the European Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (“GDPR”), may be collected and processed by EXN in the ordinary course of its business activities.

In accordance with Articles 13 and 14 of the GDPR, this notice aims to properly inform your employees, on their capacity as data subjects, of the processing that is likely to be carried out by EXN and pertaining to their personal data.

In view of your direct relationship with your employees whose personal data is disclosed to and processed by EXN, you are required to, and solely liable for, providing them with the information contained herein within fifteen (15) days as of the date this notice is communicated to you by EXN.

Third-party Information notice on the collection of personal data (Article 13 of the GDPR)

In the ordinary course of its business, EXN (the controller in the meaning of Article 4(7) of the GDPR) may collect and process certain personal data pertaining to the categories of data subjects listed below.

EXN may collect and process personal data pertaining to:

Its prospects
Employees of EXN clients (resellers)
Employees of end-users
Employees of vendors
Employees of EXN’s service providers
Employees of Agents/IOR
Job applicants

Depending on your personal situation, please refer to the relevant part of this page.

The following section “Your rights” pertaining to your rights as data subject under the GDPR (and any applicable national law) applies regardless of your personal situations:

Your rights

In accordance with applicable laws, you have a right of access, to rectification, to erasure, to restriction of processing, to data portability, to object to the processing of your personal data, and not to be subject to a decision based solely on automated processing. Where we are processing data based on your consent (notably regarding the deposit of cookies), you have the right to withdraw that consent at any time.

These rights are not absolute and may be exercised under the conditions set out in sections 15 to 22 of the GDPR. You can exercise them, subject to the provision of a proof of identity, with the General Counsel, at: DPO@exclusive-networks.com.

In the event of a breach of applicable regulations on the protection of personal data and in particular of the GDPR, you may lodge a complaint with the national data protection supervisory authority.

1. If you are a prospect:

a. Categories of personal data processed

EXN may collect the following personal data: name, surname, professional email, professional phone number, job title, pictures if you attend marketing events.

b. Purposes of personal data processing

EXN processes your personal data for the following purposes:

General business purpose;
Expand market shares;
Organization of marketing campaign and events (on our behalf or on behalf of vendors or resellers);
Communicating around those events internally or externally using social networks or other communication channels;
Documenting to vendors what marketing events have been organized;
Profiling of your professional interests.

c. Legal basis for data processing operations

These personal data processing activities are implemented by EXN in pursuit of its legitimate interests (as per article 6(1), f) of the GDPR).

d. The categories of recipients of personal data collected

Your personal data is communicated:

Within EXN, to the authorized staff of the marketing, sales, pre-sales, services and finance departments as well as IT administrators and management teams;
To Vendors (to report sales opportunity);
To EXN Group affiliated entities.

Please note that some of your personal data may be transmitted to data recipients located outside the European Union. EXN informs you that these transfers are, where applicable, governed by the mechanism of the standard contractual clauses of the European Commission and thus meet the requirements of Articles 44 to 50 of the GDPR relating to the transfers of personal data to third countries.

e. Personal data retention period

EXN stores your personal data in accordance with the retention periods imposed by applicable laws, and the latest recommendations of the national data protection supervisory authority. In any event, EXN undertakes to store your personal data for a period not exceeding that necessary for the purposes for which they are collected.

Prospect’s employees identification data: 3 years as of the last contact from the prospect.

2. If you are an employee of EXN’s clients (resellers):

a. Categories of personal data processed

EXN may collect the following personal data: name, surname, address, professional email, job title, professional interests, passport/ID number, pictures if you attend marketing events.

b. Purposes of personal data processing
EXN processes your personal data for the following purposes:

General business purpose;
Making business reviews (internally, with vendors or with resellers);
Organization of marketing campaign and events;
Communicating around those events internally or externally using social networks or other communication channels;
Expanding market shares;
Reporting to EXN’s vendors of marketing campaigns/events;
Profiling of reseller’s professional interests;
Organizing travels for marketing events;
Issuing transport documentation and coordination of shipments;
Providing professional services (support, training, installation, maintenance…);
Compliance with export control regulations;
Compliance with anti-corruption laws;
Collecting payments.

c. Legal basis for data processing operations

These personal data processing activities are implemented by EXN in pursuit of its legitimate interests (article 6(1), f) of the GDPR).

d. The categories of recipients of the personal data collected

Your personal data is communicated:

Within EXN, to the authorized staff of the marketing, sales, pre-sales, services, finance, and order processing departments as well as IT administrators and management teams;
To governments authorities;
To vendors;
To end-users;
To carriers or agents;
To EXN Group affiliated entities.

Please note some of your personal data may be transmitted to data recipients located outside the European Union. EXN informs you that these transfers are, where applicable, governed by the mechanism of the standard contractual clauses of the European Commission and thus meet the requirements of Articles 44 to 50 of the GDPR relating to the transfers of personal data to third countries.

e. Personal data retention period

EXN stores your personal data in accordance with the retention periods imposed by applicable laws, and the latest recommendations of the national data protection supervisory authority. In anyevent, EXN undertakes to store your personal data for a period not exceeding that necessary for the fulfilment of our legal and contractual obligations.

Clients’ employees identification data: 3 years as of the end of the contractual relationship; Passport/ID number: deletion immediately after the travel organization has been finalized.

3. If you are an employee of an end-user:

a. Categories of personal data processed

EXN may collect the following personal data: name, surname, address, professional email, professional interests, job title, pictures if you attend marketing events.

b. Purposes of personal data processing
EXN processes your personal data for the following purposes:

General business purpose;
Making business reviews (internally, with vendors or with resellers);
Providing professional services (support, training, maintenance…);
Organizing marketing campaign and events;
Communicating around those events internally or externally using social networks or other communication channels;
Reporting to EXN’s vendors of such marketing campaigns/events;
Profiling of the end user’s professional interests;
Expanding market shares;
Compliance with export control regulations;
Compliance with anti-corruption laws;
Issuance of transport documentation and coordination of shipments.

c. Legal basis for data processing operations
These personal data processing activities are implemented by EXN:

In pursuit of its legitimate interests (article 6(1), f) of the GDPR);
To enable EXN to comply with a legal obligation imposed on EXN (as defined in Section 6(1) c) of the GDPR): USA export control regulations, anti-corruption laws.

d. The categories of recipients of the personal data collected
Your personal data is communicated:

Within EXN, to the authorized staff of the finance, sales, pre-sales, marketing, logistics and services departments as well as IT administrators and management team;
To vendors;
To Resellers.
To carriers or agents;
To governments authorities;
To EXN Group affiliated entities.

e. Personal data retention period

End-users’ employees identification data: 3 years as of the end of the contractual relationship.

4. If you are an employee of EXN’ Vendor:

a. Categories of personal data processed

EXN may collect the following personal data: name, surname, address, professional email, job title, pictures if you attend marketing events.

b. Purposes of personal data processing

EXN processes your personal data for the following purposes:

General business purpose;
Business Prospects, Resellers or end-users’ relationship management;
Performance of business contracts;
Communications needed when raising commercial documents (quotations, purchase orders, delivery notes, invoices…) and distributing the products (hardware, software);
Organizing transportation and logistics;
Making Business Reviews;
B2B Direct marketing activities and communication around those activities;
Performing professional services, enabling licenses;
Managing finance related matters.

c. Legal basis for data processing operations

These personal data processing activities are implemented by EXN in pursuit of its legitimate interests (article 6(1), f) of the GDPR).

d. The categories of recipients of the personal data collected

Your personal data is communicated:

Within EXN, to the authorized staff of the finance, sales, pre-sales, marketing, logistics and services departments as well as IT administrators and management team;
To resellers;
To end-users;
To professional service providers;
To agents or IOR;
To EXN Group affiliated entities.

e. Personal data retention period

Vendors’ employeesidentification data: 3 years as of the end of the contractual relationship.

5. If you are an employee of EXN’s service providers (IT suppliers/consultants/advisors/external providers, freight forwarders, trainers, bank, insurance, auditor, external professional service providers):

a. Categories of personal data processed

EXN may collect the following personal data: name, surname, professional email, professional phone number, job title, pictures if you attend to marketing events.

b. Purposes of personal data processing

EXN processes your personal data for the following purposes:

General business purpose;
Have and maintain IT systems and related IT security;
Advisory or auditing of EXN depending on a pre-agreed scope of work (such as Organise logistics/ clear customs/ organise a marketing event/ perform marketing campaign on our behalf/ Maintain company accounts/ make payment…);
Provide resellers or end-users with professional services in the IT security business (support, training, installation, consultancy, maintenance…).

c. Legal basis for data processing operations

These personal data processing activities are implemented by EXN in pursuit of its legitimate interests (article 6(1), f) of the GDPR).

d. The categories of recipients of the personal data collected

Your personal data is communicated:

Within EXN, to the authorized staff of the finance, sales, pre-sales, marketing, logistics and services departments as well as IT administrators and management team;
To external auditors;
To vendors;
To reseller;
To end-users;
To EXN Group affiliated entities.

e. Personal data retention period

Provider’s employees identificationdata: 3 years as of the end of the contractual relationship.

6. If you are an employee of an Agent/IOR (Importer of Records):

a. Categories of personal data processed

EXN may collect the following personal data: name, surname, professional email, professional phone number, job title.

b. Purposes of personal data processing

EXN processes your personal data for the following purposes:

Custom clearance;
Implementation and coordination of a logistics scheme;
Issuing and transferring logistics related documentation;
Perform marketing campaign on our behalf;

c. Legal basis for data processing operations

These personal data processing activities are implemented by EXN in pursuit of its legitimate interests (article 6(1), f) of the GDPR).

d. The categories of recipients of the personal data collected

Your personal data is communicated:

Within EXN, to the authorized staff of the finance, sales, pre-sales, logistics departments as well as IT administrators and management teams;
To EXN’s vendors, resellers or end-users;
To auditors;
To government authorities;
To EXN Group affiliated entities.

e. Personal data retention period

EXN stores your personal data in accordance with the retention periods imposed by applicable laws, and the latestrecommendations of the national data protection supervisory authority. In any event, EXN undertakes to store your personal data for a period not exceeding that necessary for the fulfilment of our legal and contractual obligations.

Agent/IOR’s employees identification data: 3 years as of the end of the contractual relationship.

6. If you are a job applicant:

a. Categories of personal data processed

EXN may collect the following personal data: name, address, hobbies, personal email, birth date, phone number, history of professional experience, studies, professional certifications.

b. Purposes of personal data processing

EXN processes your personal data for the following purposes:

Recruitment purpose (current and future)

c. Legal basis for data processing operations

These personal data processing activities are implemented by EXN in pursuit of its legitimate interests (as per article 6(1), f) of the GDPR).

d. The categories of recipients of the personal data collected

Your personal data is communicated:

Within EXN, to the authorized managers of any department recruiting employees;
To EXN Group affiliated entities.

e. Personal data retention period

EXN stores your personal data in accordance with the retention periods imposed by applicable laws, and the latest of the national data protection supervisory authority. In any event, EXN undertakes to store your personal data for a period not exceeding that necessary for the purposes for which they are collected.

Job applicants’ personal data: 2 years as of the last contact with the applicant.