Privacy Notice

1 SUMMARY

ASEA is committed to respecting and protecting your privacy. We act in accordance with the requirements of the various privacy and data protection laws applicable in the countries or markets where we operate.

This Privacy Notice explains how we collect, use and share Personal Data pertaining to our Customers and Associates, job applicants and office and Website visitors (collectively, “you” and “your”) and explains the rights you have regarding our use of your Personal Data.

This Privacy Notice also applies to you if you publish information on the Internet (e.g. publicly available websites or blogs, Twitter, Instagram, Facebook, etc.) that we may collect data from, either directly or through third parties.

Please take into account that not all sections may be equally relevant or applicable to you depending on the circumstances. When using the term “personal data”, we mean information that relates to you and allows us to identify you, either directly or in combination with other information that we may hold. Please ensure you read this Privacy Notice carefully before using our Website or Apps and/or providing us with your Personal Data.

2 WHO ARE WE AND HOW TO CONTACT US

ASEA, LLC. and its affiliates and subsidiaries (“ASEA, LLC”, “we”, “us” and “our”) are an international group of companies offering personal care products, cosmetics, nutritional supplements and other goods or services through (i) the ASEA websites (whether local or global) (each a “Website”), (ii) ASEA Connect app and tools (the “App”) and (iii) a network of customers and associates.

Depending on who you are, your Personal Data is processed by different entities of ASEA, LLC and/or for different purposes.

Below you will find the list of the ASEA entities acting as data controllers responsible for processing your Personal Data.

Please contact the Privacy Team or our Data Protection Officer [dataprotection@aseaglobal.org] if you have questions or concerns, want to update your Personal Data, or to exercise your rights as described or you may write to us at:

ASEA, LLC
Attn: Legal Department
1488 W. Pleasant View Dr.
Pleasant Grove, Utah 84062

Establishment in the EU:
ASEA SERVICES EUROPE GmbH [GmbH – Private limited company under German law]
Lyonel-Feiniger-Straße 28
80807 München [Munich] Deutschland [Germany]
Contact:
Email: dataprotection@aseaglobal.org

3 DATA PROCESSING THROUGH OUR WEBSITE

In case of using our website for information purposes only, meaning if you do not register or otherwise provide us with information, we shall only collect the data transmitted by your server to our browser. If you want to view our website, we shall collect the following data that are technically necessary for us for displaying our website to you and for ensuring stability and security:

• sender IP address
• requested resource (URL, file download)
• HTTP method
• HTTP User Agent header

However, this data is stored separately from other information, so we are unable to allocate this data to a particular person. After an anonymous assessment for statistical purposes, this data will be deleted after 7 days.

We hold on to your Personal Data for as long as necessary to achieve the processing purposes listed above under section 5, “Personal Data we collect from you”. We no longer store your Personal Data when our (contractual) relationship with you comes to an end, unless further storage is permitted or required under applicable law.

If you visit our website in order to obtain information about our range of products and services or to use them, the basis for the temporary storage and processing of the access data is Art. 6 (1) p. 1 lit. b) GDPR (legal basis), which permits the processing of data for the performance of a contract or for the implementation of pre-contractual measures.

In addition, Art. 6 (1) p. 1 lit. f) GDPR serves as the legal basis for the temporary storage of technical access data. Our legitimate interest here is to be able to provide you with a technically functioning and user-friendly website and to ensure the security of our systems.

WHEN CONTACTING US VIA EMAIL OR ON OUR CONTACT FORM:

In this case, we will store your communicated data (your email-address, possibly your name and your phone number) to answer your questions. We retain this information for legal compliance and to track that we have received and addressed your questions.

If you contact us within the framework of an existing contractual relationship or contact us in advance for information about our range of services, the data and information you provide will be processed for the purpose of responding to your contact request in accordance with Art. 6 (1) p. 1 lit. b) GDPR (legal basis). Furthermore, to protect our legitimate interests pursuant to Art. 6 (1) p. 1 lit. f) GDPR for the proper response to customer/contact inquiries.

Please note, this website is not designed or intended for the use of minors under the age of 16. We do not knowingly process information from minors under the age of 16 and do not allow such minors to participate in the opportunity.

4 HOW WE PROCESS YOUR PERSONAL DATA AS ASSOCIATE / CUSTOMER / EMPLOYEE

If you register and are active as an Associate, we process the following personal data:

• Categories:
• Identifiers, Limited Protected Class Information (such as gender, marital status, and national status), Commercial Information, Online Activity, Geolocation Data, Sensory Information, and Employment Information.
• Generally, we collect first name, last name, birth date, email address, mobile or home phone number, fax number (optional) and address data (street address, street address 2 (optional), postal code, city), your Government ID, Credit Card details or bank account details. Shipping address, if different from your billing address. Optional: Spouse or company details relevant to your ASEA business.
• For Switzerland – in addition to the above: Gender, Social Security number, civil status
• For France – in addition to the above: Gender, Social Security number, civil status, SIRET, Place of Birth
• For Italy – in addition to the above: Fiscal Code

This information is required for the establishment and execution of the contract as an Associate, in particular for the processing of commission payments, creating and managing your account, processing your product order, deliver and process product returns, processing payments. The legal basis for the processing of this data is Art. 6 (1) p. 1 lit. b) GDPR.

• Registering to our newsletter: we collect your email address. The data processing is based on your consent (Art. 6 (1) p. 1 lit. a) GDPR). You can revoke this consent at any time without incurring any costs other than the transmission costs according to the basic rates by using the unsubscribe link contained in each communication or by contacting us at communications@aseaglobal.org.
• Note that you may have a right to oppose certain uses of your personal data. You can revoke your consent at any time by clicking the unsubscribe link included in the footer of ASEA news emails or by logging into your ASEA® Virtual Office > MY ACCOUNT > Edit Information and unchecking the email permissions checkboxes. For details, please refer to our Privacy Notice. To exercise these rights, you can contact us at dataprotection@aseaglobal.org.
• Register to our events: we collect your phone number, the billing address and payment details if there is a charge for the event. This processing is necessary for the fulfillment of your contract for participation in our event. The legal basis is Art. 6 (1) p. 1 lit. b) GDPR.
• Interactions by other means: i.e. if you send an email or call our customer service. In this case we will process the data that are given to us at your own initiative. The data and information you provide will be processed for the purpose of responding to your request in accordance with Art. 6 (1) p. 1 lit. b) GDPR (legal basis).

If you register and/or place an order as a Customer, we process the following personal data:

• Categories:
• Identifiers, Limited Protected Class Information (such as gender, marital status, and national status), Commercial Information, Online Activity, Geolocation Data, Sensory Information, and Employment Information.
• Generally, we collect first name, last name, birth date, email address, mobile or home phone number, fax number (optional) and address data (street address, street address 2 (optional), postal code, city), Credit Card details or bank account details.
• Shipping address, if different from your billing address.

This processing is necessary for the fulfillment of your contract regarding the registration vie our website or the purchase of goods. The legal basis is Art. 6 (1) p. 1 lit. b) GDPR.

·        Registering to our newsletter: we collect your email address. The data processing is based on your consent (Art. 6 (1) p. 1 lit. a) GDPR). You can revoke this consent at any time without incurring any costs other than the transmission costs according to the basic rates by using the unsubscribe link contained in each communication or by contacting us at communications@aseaglobal.org. Note that you may have a right to oppose certain uses of your personal data. You can revoke your consent at any time by clicking the unsubscribe link included in the footer of ASEA news emails or by logging into your ASEA® Virtual Office > MY ACCOUNT > Edit Information and unchecking the email permissions checkboxes. For details, please refer to our Privacy Notice. To exercise these rights, you can contact us at dataprotection@aseaglobal.org.

·        Register to our events: we collect your phone number, the billing address and payment details if there is a charge for the event. This processing is necessary for the fulfillment of your contract for participation in our event. The legal basis is Art. 6 (1) p. 1 lit. b) GDPR.

·        Interactions by other means: i.e. if you send an email or call our customer service. In this case we will process the data that are given to us at your own initiative. The data and information you provide will be processed for the purpose of responding to your request in accordance with Art. 6 (1) p. 1 lit. b) GDPR (legal basis).

If you are an Employee, we process the following personal data:

• Categories:
• Identifiers, Limited Protected Class Information (such as gender and national status) Sensory Information, and Employment Information.
• Generally, we collect first name, last name, birth date, email address, mobile or home phone number, address data (street address, street address 2 (optional), postal code, city), your Government ID, bank account details, civil status, work history, education history, and background check (not performed for European employees unless legally required)

This information is required for the establishment and execution of the contract as an Employee. The legal basis for the processing of this data is Art. 6 (1) p. 1 lit. b) GDPR.

·        Interactions by other means: i.e. if you send an email or call our customer service. In this case we will process the data that are given to us at your own initiative. The data and information you provide will be processed for the purpose of responding to your request in accordance with Art. 6 (1) p. 1 lit. b) GDPR (legal basis).

5 CATEGORIES OF SERVICE PROVIDERS WHO RECEIVE PERSONAL DATA FROM US

We do not sell your personal data to third parties such as data brokers. However, to provide services essential to our relationship with you, we use a variety of service providers for our business purposes

In some cases, the recipients receive your personal data as processors and are then strictly bound by our instructions when handling your personal data. In some cases, the recipients act independently in their own data protection responsibility and are also obliged to comply with the requirements of the GDPR and other data protection regulations.

For our prospective and current Associates, as well as our Web Users, we cooperate with the following categories of service providers:

• Logistics companies for shipment processing
• Webhosts
• Cloud service providers
• Website managers and developers
• E-commerce application developers
• Communications and management applications
• Digital Marketing services
• Email communications
• Application developers
• The ASEA family of corporate entities
• Associates in your upline organization which have each been personally sponsored but only to the extent that the upline Associate it entitled to earn commissions on your product sales. We will take reasonable steps to ensure that these individuals have implemented reasonable security mechanisms to protect your personal data.”

For Employees we use the following service providers:

• Payroll processors
• Expense reporting tools
• Travel support tools
• Background checks [not performed for employees in Europe unless required by law (for example, Italy)]
• Cloud service providers
• Website managers and developers
• Application developers
• The ASEA family of corporate entities

6 COOKIES AND RELEVANT TECHNOLOGIES USED

We use so called Cookies on our website. Cookies do not cause any damage to your computer and do not contain viruses. Cookies serve to make our offer more user-friendly, effective, and secure and to enable the availability of certain functions.

Cookies will be stored on your computer during your usage of our website. Cookies are small text files stored on your computer and that are allocated to the browser used by you and by which the authority placing the cookie will receive certain information. Cookies cannot be used to run programs or to transmit viruses to your computer.

ASEA uses so-called “session-cookies” for being able to assign requests and requirements of the interested party. Based on these session cookies, ASEA will be able to measure the frequency of page impressions and the general navigation.

Our session cookies are characterized by the fact that they are automatically deleted after 60 minutes after their placement from the fixed disk, again. The cookie’s name and the session ID generated by the accessed website will be stored in the session cookie.

The session cookie does not have any impact on your privacy. It does not read or store any of your data, but only technical data generated by the system on its own.

Of course, you can always refuse cookies, provided that your browser allows for it. Please note that certain functions of this website such as the ordering process may not be used or only used to a limited extent if your browser is set to not accept session cookies (of our website).

When you visit our Website or use our Apps, we automatically collect, store and use technical information about your equipment and interaction with our Website and Apps (“General Information”).

Some of the cookies we use on our website are provided by third parties to help us analyze the impact of our website content and the interests of our visitors, to measure the performance of our website, or to serve customized advertising and other content on our website or other websites.

As part of our website, we use both first party cookies (only visible from the domain you are visiting) and third party cookies (visible across domains and regularly set by third parties).

Como parte do nosso site, utilizamos cookies primários (visíveis apenas a partir do domínio que estiver a visitar) e cookies de terceiros (visíveis em todos os domínios e definidos regularmente por terceiros).

The cookie-based data processing is carried out on the basis of your given consent pursuant to Art. 6 (1) sentence 1 lit. a) GDPR or on the basis of Art. 6 (1) sentence 1 lit. f) GDPR to protect our legitimate interests. Our legitimate interests here lie in particular in being able to provide you with a technically optimized website that is user-friendly and tailored to your needs, as well as to ensure the security of our systems.

You can revoke any consent you have given us at any time, e.g. by deactivating the cookie-based tools/plugins listed in detail in the following overview. By making the appropriate settings, you can also object to processing based on legitimate interests.

In detail, the following cookie-based tools/plugins are used on this website:

A.      GOOGLE ANALYTICS

This website uses the functions of Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, on the basis of your consent given to us (Art. 6 (1) p. 1 lit. a) GDPR).

You can give us your consent voluntarily when you access our website by pressing the corresponding button in the “cookie banner”. On a regular basis, data is also transmitted to Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) as part of the processing described below. Google Ireland Limited and Google LLC are hereinafter jointly referred to as “Google”. Google Analytics uses cookies (first-party cookies), which enable an analysis of your use of the website.

However, this does not mean that we gain direct knowledge of your identity as a result. Google uses the information generated by the cookies on our behalf for the purpose of evaluating your use of the website, compiling reports on website activity and providing other services relating to website activity and internet usage.

This enables us to improve the quality of our website and its content. We use statistical analyses to find out how the website is used and can thus continuously optimize our services.

The IP address transmitted by your browser as part of Google Analytics is not merged with other Google data. We shall store the data acquired through the tool Google Analytics for a period of 14 months. After the expiration of this term, the data will be deleted.

IP anonymization

We have activated the IP anonymization function on our website. This means that your IP address is shortened by Google within member states of the European Union or in other states party to the Agreement on the European Economic Area before being transmitted to the US and thereby anonymized.

Only in exceptional cases will the full IP address be transmitted to a Google server in the US and shortened there. According to Google’s own information, the IP address transmitted by your browser within the scope of Google Analytics is not merged with other Google data relating to your person.

You can prevent cookies from being stored by selecting the appropriate settings in your browser software; however, we wish to point out that by doing so, you may not be able to enjoy the full functionality of this website.

You can also prevent the data generated by cookies concerning your use of the website (incl. your IP address) from being passed to Google, and the processing of these data by Google, by downloading and installing the browser plugin available at the following link: http://tools.google.com/dlpage/gaoptout?hl=de.

Alternatively, you can enable/disable the collection of your data by Google Analytics, especially on mobile devices. Upon deactivation, a cookie will be set that prevents the collection of your data during future visits to this website. Specifically, the following tracking cookies are used by Google Analytics: __utmz, __utma, __utmb, __utmc, __utmt.

More information on how Google Analytics handles user data and the security and privacy principles as well as setting and objection options can be found in Google’s privacy policy, available via the following link: https://support.google.com/analytics/answer/6004245?hl=de.

Third party information: Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, Fax: 353 (1) 436 1001.

User conditions: http://google.com/analytics/terms/de.html, overview on data protection: http://google.com/intl/de/analytics/learn/privacy.html, and the Data Protection Policy: http://google.de/intl/de/policies/privacy.

This website also uses Google Analytics for an analysis of visitor flows across all devices carried out via a user ID. You can disable the device cross-analysis of your use in your customer account under “My Data”, “Personal Data”.

B. SOCIAL MEDIA

Our website uses plugins of the video platform YouTube to embed videos and play them directly on our website. The operator of the video platform is YouTube, LLC, 901 Cherry Ave, San Bruno, CA 94066, USA (“YouTube”). YouTube is an affiliated company of Google Inc. (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; “Google”).

The integration of YouTube videos takes place in the so-called “extended data protection mode”, which, according to the provider, only initiates the storage of user information when the video(s) is/are played. However, the transfer of data to YouTube partners is not necessarily excluded by the extended data protection mode. Thus, YouTube establishes a connection to the Google DoubleClick network – regardless of whether you watch a video.

If you activate embedded videos on our website, a connection to YouTube’s servers is established and a data transmission is started. We have no influence on the scope and content of the data that is transmitted to YouTube and possibly other partners of YouTube by activating the plugin.

Among other things, the YouTube server is informed which of our pages you have visited. According to YouTube, this information is used, among other things, to collect video statistics, improve user-friendliness and prevent abusive behavior. YouTube uses cookies to collect information about user behavior. The cookies remain on your terminal device until you delete them. You can prevent YouTube from storing cookies by making the appropriate settings in your browser software (see above).

If you are logged into your YouTube account, you enable YouTube to assign your surfing behavior directly to your personal profile. You can prevent this by logging out of your YouTube account before activating the play button.

YouTube is used in the interest of an appealing presentation of our online offers. This represents a legitimate interest within the meaning of Art. 6 (1) p. 1 lit. f) GDPR.

For more information on the handling of user data, please refer to YouTube’s privacy policy at: https://google.de/intl/de/policies/privacy.

C. ZOOM IN COMBINATION WITH FACEBOOK AND YOUTUBE

aa) Zoom

We use the “Zoom” tool to conduct webinars online. “Zoom” is a service of Zoom Video Communications, Inc., 55 Almaden Blvd, Suite 600, San Jose, CA 95113, United States of America.

If you access the “Zoom” website, the provider of “Zoom” is responsible for data processing. The website needs to be accessed only for the purposes of downloading the software for the use of “Zoom.”

Different types of data are processed when “Zoom” is used. The scope of the data is also a function of the details you provide about the data prior to or during participation in a webinar.

The following personal data are processed:

User details: First name, last name, telephone (optional), email address, password (unless “single sign-on” is used), profile picture (optional), department (optional),

Meeting metadata: Topic, description (optional), participant IP addresses, device/hardware information as well as written communication conducted via Zoom chat.

A webinar gives you the opportunity to use the written chat, question, or survey functions. If you do use these functions, the text entries you make are processed to display them in the webinar and, where appropriate, to log them. You can only participate in our Zoom webinar in writing, via chat. At a minimum, you must provide information about your name if you wish to join a webinar.

We will also process the questions that webinar participants ask for the purposes of recording and post-processing for publication on YouTube.
Chat data can be stored for up to one month at “Zoom.”
Automated decision-making within the meaning of GDPR 22 is not used.

The legal basis for data processing in this case is GDPR 6 (1) a – your consent to participate.

Personal data that are processed in connection with participation in webinars will not be passed along to third parties.

Further recipients: The provider of “Zoom” necessarily receives the above-mentioned data, insofar as this is provided for in our order-processing agreement with “Zoom.”

“Zoom” is a service performed by a provider from the USA. This means that personal data are also processed in a third country. We have concluded an order-processing agreement with the provider of “Zoom” that meets the requirements of GDPR 28.

The supplier has also signed the standard contractual clauses of the EU. (https://ec.europa.eu/info/law/law-topic/data-protection/publications/standard-contractual-clauses-controllers-and-processors)

bb) Livestreaming the Zoom webinar on Facebook

We would like to point out that Zoom webinars are streamed live on our Facebook fan page. To provide this information service, we rely on the technical platform of Meta Platforms Ireland Limited, 4 Grand Canal Square Grand Canal Harbour, Dublin 2, Ireland (hereinafter: Facebook). All of the webinar information, including written chats in which you can participate, are thus published on our Facebook fan page.

In the view of the European Court of Justice, there is a shared responsibility within the meaning of GDPR 26 between Facebook and the operator of a Facebook fan page with respect to the personal data processed via the Facebook fan page. In view of this arrangement, we have concluded an agreement with Facebook on joint responsibility. We provide you with the following information with regard to data processing on our Facebook fan page:

The data collected in this context are processed by Facebook and in some cases may be transferred to countries outside the European Union.

In its data policy, Facebook offers a general description of the information it receives and how these data are used. There, you will also find information about ways of contacting Facebook and adjusting the settings in relation to advertisements. The data policy is available at the following link: http://de-de.facebook.com/about/privacy. You will find Facebook’s complete data policy here: https://de-de.facebook.com/full_data_use_policy. Facebook’s privacy statement contains further information about the way it processes data: https://facebook.com/about/privacy/. Users can set their opt-out status here: https://facebook.com/settings?tab=ads and here http://youronlinechoices.com

We cannot ensure that the personal data of users and visitors to the Facebook fan page will not be transmitted or further processed in third countries, such as the United States, nor can we prevent the possible associated risks to users and visitors.

cc) Publication of recorded webinars on YouTube

We would like to point out that we publish videos of the livestreamed webinars, as well as those we have recorded, on Facebook, with the provider YouTube, Google Ireland Limited Gordon House, Barrow Street Dublin 4, Ireland. The webinars, along with all of the chats and information you have added with regard to and during the webinars, will thus be published on YouTube.

Please refer to the YouTube privacy policy for further information on the purpose and scope of data collection and processing by YouTube. There, you will also find further information about your rights and settings options for protecting your privacy: https://policies.google.com/privacy

In order to establish an adequate level of security, your consent may serve as the legal basis for transfer to third countries in accordance with GDPR 49 (1) a.

Google also offers a number of options to opt out of the collection of personal data by Google: https://policies.google.com/privacy#infochoices

Legal basis: GDPR 6 (1) a

7 PERSONAL DATA WE COLLECT FROM THIRD PARTIES

Most of the Personal Data that we collect about you will be information that you provide to us directly. In some circumstances we may also receive Personal Data about you from:

Associates, Individuals who provide us with your Personal Data (e.g. your family members), Regulatory bodies, and other companies providing services to us (e.g. social listening companies).

Some of these third-party sources may include publicly available sources of information. We may receive Personal Data from social networks when you engage with our content, reference our Site or Service, or grant us permission to access information from the social networks.

In addition, we could collect, either directly or through third-party service providers, information that is publicly available on the Internet (e.g. from websites, blogs, social media).

8 OTHER DATA PROCESSING PURPOSES

Compliance with legal requirements: We also process your personal data to comply with other legal obligations that may apply to us in connection with our business activities. These include, in particular, retention periods under commercial, trade or tax law. In doing so, we process your personal data in accordance with Article 6 (1) sentence 1 lit. c) GDPR (legal basis) to fulfill a legal obligation to which we are subject.

Legal enforcement: We also process your personal data in order to assert our rights and enforce our legal claims. Likewise, we process your personal data to be able to defend ourselves against legal claims. Finally, we process your personal data to the extent necessary to prevent or prosecute criminal offences. In this regard, we process your personal data to protect our legitimate interests pursuant to Art. 6 (1) p. 1 lit. f) GDPR (legal basis), insofar as we assert legal claims or defend ourselves in legal disputes or we prevent or investigate criminal acts (legitimate interest).

Consent: Insofar as you have given us consent to process personal data for certain purposes (e.g. sending information material and offers), the lawfulness of this processing is based on your consent. Consent given can be revoked at any time. Please note that the revocation is only effective for the future and processing until then is not affected.

9 HOW WE USE YOUR PERSONAL DATA

As an Associate or Customer, we use your personal data for the following legal basis and purpose:

1.      To fulfil our contract with you, in cases such as:

• Creating and managing your Associate account or Customer/Preferred Customer account
  This is to fulfil our contract with you and to comply with legal obligations, including accounting and tax requirements.
• Executing our Associate Agreement with you

This is to fulfil our contract with you and to comply with legal obligations, including accounting and tax requirements

• Processing your product order
  When you place an order, we use your personal data to fulfil your order. We contact you by email to send you confirmation of your order and payment status. This is to meet our contractual obligations to you.
• Deliver and process product returns
• Processing payments
• Enforcing our policies and rights

2. Based on our legitimate business purposes, in cases such as:

• Communicate with you as part of our business relationship
• Communicate your sales performance data to Associates in your upline as this information is subject to their commission payments
• Statistical and marketing analysis as well as maintenance and development
• Protect the integrity and security of our services
• Improve the user experience of our websites
• Provide you with information and advertising for similar products you have already purchased. You can object to the use of your email address at any time without incurring any costs other than the transmission costs according to the basic rates by using the unsubscribe link contained in each communication or you can withdraw your consent at any time by clicking the unsubscribe link included in the footer of ASEA news emails or by logging in to your ASEA® Virtual Office > MY ACCOUNT > Edit Information and unchecking the email permissions checkboxes. For details, please refer to our Privacy Notice. Note that you may have a right to oppose certain uses of your personal data. You can withdraw your consent at any time by clicking the unsubscribe link included in the footer of ASEA news emails or by logging into your ASEA® Virtual Office > MY ACCOUNT > Edit Information and unchecking the email permissions checkboxes. For details, please refer to our Privacy Notice. To exercise these rights, you can contact us at dataprotection@aseaglobal.org

3.      To meet our legal obligations, in cases such as:

• for tax and accounting purposes;
• responding to requests by authorities or other public institutions as required by law

As a prospective or current Employee, we use your personal data for the following legal basis and purpose:

1. To fulfil our employment contract with you.
2. Based on our legitimate business purposes for security of our organization.
3. To meet our legal obligations.

As a Web User, we use your personal data for the following legal basis and purpose:

1.       Based on our legitimate business purposes such as:

• Statistical and marketing analysis as well as maintenance and development
• Protect the integrity and security of our services

10 TRANSFERS OF DATA WITHIN THE ASEA FAMILY OF COMPANIES

We transfer Personal Data to other jurisdictions as necessary for the purposes described in this Privacy Notice, including to jurisdictions that may not provide the same level of data protection as the jurisdiction in which your Personal Data was originally collected. For instance, we may transfer your data to the US because our parent companies are located there.

When we transfer your Personal Data to other countries or jurisdictions, we will protect that data as described in this Privacy Notice and in accordance with applicable law.

Where required under applicable law, we will put in place binding contractual obligations with the data recipient to safeguard your data protection rights. Furthermore, we will notify any data transfer and/or data transfer mechanisms to the competent Supervisory Authority where required under applicable law.

With respect to transfers originating from the European Economic Area (“EEA”) to the United States and other non-EEA jurisdictions, we implement standard contractual clauses approved by the European Commission, and other appropriate solutions to address cross-border transfers as required or permitted by Articles 46 and 49 of the General Data Protection Regulation.

Please contact the Privacy Team, if you have any questions with respect to the safeguards we have put in place to protect your Personal Data when we transfer this (including how to obtain a copy of or consult these safeguards).).

11 HOW WE PROTECT YOUR PERSONAL DATA

We protect your Personal Data and implement reasonable security including physical (e.g. secured filing cabinets), technical and organizational security measures appropriate to protect your Personal Data against unauthorized or unlawful processing and against any accidental loss, destruction, or damage.

We operate data networks protected by industry standard firewall and password protection systems. We also use transport layer security (TLS) to protect the transmission of your Personal Data. Access to this information will be provided only to authorized individuals for legitimate business purpose.

In addition, access to your Personal Data is restricted to staff and service providers on a need-to-know basis.

While we endeavor to always protect our systems, sites, operations and information against unauthorized access, use, modification and disclosure, due to the inherent nature of the Internet as an open global communications vehicle and other risk factors, we cannot guarantee that any information, during transmission or while stored on our systems, will be absolutely safe from intrusion by others.

Please contact the Privacy Team (dataprotection@aseaglobal.org) if you have any questions about how we protect your Personal Data.

12 HOW LONG WE KEEP YOUR PERSONAL INFORMATION

We hold on to your personal data for as long as necessary to achieve the processing purposes listed above. This means, for instance, that we no longer store your personal data when our (contractual) relationship with you comes to an end, unless further storage is permitted or required under applicable law.

13 CHANGES TO THIS PRIVACY NOTICE

We may make changes to this Privacy Notice from time to time. We will publish any new version of this Privacy Notice on our website. Any changes to this Privacy Notice will be considered effective immediately after the changes are posted on this Website unless otherwise indicated. The Privacy Notice was last revised in April 2022.

14 AUTOMATED DECISION MAKING/PROFILING

We do not use automated decision making that has legal effect on you or affects you.

15 YOUR RIGHTS REGARDING YOUR PERSONAL DATA

You are entitled to the following rights as a data subject under the statutory requirements:

Right to information: You are entitled at any time, within the framework of Art. 15 GDPR, to request confirmation from us as to whether we are processing personal data relating to you; if this is the case, you are also entitled, within the framework of Art. 15 GDPR, to receive information about this personal data as well as certain other information (including processing purposes, categories of personal data, categories of recipients, planned storage period, the origin of the data, the use of automated decision-making and, in the case of third country transfers, the appropriate safeguards) and a copy of your data.

Right to rectification: You are entitled to demand that we rectify the personal data stored about you if it is inaccurate or incorrect, in accordance with Art. 16 GDPR.

Right to erasure: You are entitled, under the conditions of Art. 17 GDPR, to demand that we delete personal data concerning you without delay. The right to erasure does not exist, among other things, if the processing of the personal data is necessary, for example, to comply with a legal obligation (e.g. legal retention obligations) or to assert, exercise or defend legal claims.

Right to restriction of processing: You are entitled to demand that we restrict the processing of your personal data under the conditions of Art. 18 GDPR.

Right to data portability: You are entitled, under the conditions of Art. 20 GDPR, to demand that we hand over to you the personal data concerning you that you have provided to us in a structured, common and machine-readable format.

Right of revocation: You can revoke a given consent to the processing of personal data at any time vis-à-vis us. This also applies to the revocation of declarations of consent given to us before the GDPR came into force, i.e. before 25.5.2018. Please note that the revocation only takes effect for the future. Processing that took place before the revocation is not affected. To declare the revocation, an informal communication, e.g. by e-mail to us, is sufficient.

Right of objection: You are entitled to object to the processing of your personal data under the conditions of Art. 21 GDPR, so that we must stop processing your personal data. The right to object exists only within the limits provided for in Art. 21 GDPR. In addition, our interests may conflict with the termination of processing, so that we are entitled to process your personal data despite your objection.

Right of appeal to a supervisory authority: Under the conditions of Art. 77 GDPR, you have a right of appeal to a competent supervisory authority.

Authorizing your Request:

In order to authenticate your identity when you make a request, we may require additional information to process your request. We cannot process your privacy requests if we cannot authenticate your identity. In the event we cannot authenticate your identity, we will use the information you have provided us to opt you out of marketing emails from us.

If you want to exercise your rights, you may contact us at dataprotection@aseaglobal.org. ASEA will not discriminate you because you have made a request to exercise your privacy rights.

ASEA’s privacy team has received training to help you exercise your privacy rights.

If you would like to lodge a complaint against us, you may contact your local supervisory authority. If you have trouble locating a supervisory authority, please contact our privacy team at dataprotection@aseaglobal.org and we will help you contact a supervisory authority.