Privacy Policy

Objectives

We process certain categories of your personal data which we receive from you in the course of our business relationship. For the purpose of transparency and in accordance with Article 13 of the General Data Protection Regulation (GDPR), we therefore want to inform you about the data processing as follows:

Definitions

"GDPR" shall mean the Regulation (EU) 2016/679 of the European Parliament and the Council of 27th April 2016 on the protection of natural persons with regard to the processing of Personal data and on the free movement of such data, and repealing Directive 95/46/EC.
"EU Data Protection Law" shall mean all laws and regulations, including laws and regulations of the European Union (e.g. GDPR), the European Economic Area and their member states, applicable to the processing of personal data (as defined therein).
"Personal data" shall mean any information relating to an identified or identifiable natural person as defined in article 4 para 1 GDPR; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, gender, age or mental, economic, cultural or social identity of that natural person.
"Controller" shall mean the natural or legal person, public authority, agency or another body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
"Processor" shall mean a natural or legal person, public authority, agency or another body, which processes personal data on behalf of the Controller.
"Processing" shall mean any operation or set of operations performed upon personal data or sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
"Consent" - shall mean any freely given, specific, informed and unambiguous indication of his or her wishes by which the data subject, either by a statement or by a clear affirmative action, signifies agreement to personal data relating to them being processed.

The controller of the data processing is Borealis AG, Trabrennstr. 6-8, 1020 Vienna, Austria.

Hereinafter “Borealis”, “we”, or “us”.

For any request and further information regarding the processing of your personal data, please contact gdprquestions@borealisgroup.com.

Lawfulness of processing:

We may only process Personal Data if the processing is necessary:

for the performance of a contract (e.g. to provide: products and services; carry out customer/business partner instructions; fulfil commitments; to execute the supplier contract etc.);
to comply with a legal obligation to which Borealis is subject;
for the purposes of Borealis’ legitimate interests (such as maintaining the security of our operations and premises, and promoting our products and services); and
in certain cases, with your prior, free and informed consent for one or more specific processing purposes.

Data processing concerning customers and business partners

Data processing

We may use Personal Data among others for the following specific purposes:

For the purposes of management of our business relationship, we process in particular your following personal data:

name and surname
contact details (address, email address, phone number, if applicable)

For the purposes of promoting our products and services, in particular through MyBorealis, by sending promotional information by e-mail or other electronic means, we process in particular your following personal data:

name and surname
Contact details (company, email address, country, and department)

To manage our business relationship by personalizing our products and services, and organizing events with data subjects etc.;

To provide products and services, carry out our customer/business partners’ instructions, fulfil our commitments to our customers/business partners and ensure that invoices are issued for this;

For the purpose of the management of internal investigations and to be able to defend our rights in connection with any investigation involving a regulatory or other competent authority, we process your personal data to ensure compliance with legal obligations and/or the absence of infringement by the Borealis Group;

In connection with the use of video surveillance system to protect our offices and ensure the security of our staff, premises and data, any images, photos or videos of you that may be collected if you visit our offices, only to the extent permitted by applicable law;

To ensure the security of our operations and our premises;

We do not make decisions about Data Subjects based exclusively on automated processing that produce legal effects concerning them or similarly significantly affect them.

How do we collect personal data?

The Personal Data we process may either be directly provided by you, or by our customers or business partners, or be obtained from the following sources in order to verify or complete our databases:

search engines such as Dow Jones;
publications/databases made available by official authorities;
databases made publicly available by third parties.

The recipients or categories of recipients

The Personal Data collected as part of this processing may be shared with Borealis Group entities and only for the purposes mentioned.

We may disclose your personal data to the following categories of recipients (but not necessarily all personal data to all recipients) and only for the purposes mentioned above:

advertising agencies
Government authorities in accordance with applicable law
agencies in charge with organising different business events
tax accountants
accounting firms
legal advisors
business partners
other service providers

We may also pass on your personal data to third parties if we are required to do so on the basis of legal requirements or decisions of courts. Additionally, disputes and other incidents may lead us, in exceptional circumstances, to share personal data about you with police and other law enforcement bodies.

In the event of a total or partial reorganization or transfer of our organization, we may also pass on your personal data to (un)related third parties.

Retention of your personal data

Generally speaking, your personal data will be retained as long as necessary for the fulfilment of the above purposes.

The period for which your personal data will be processed and stored by us is determined by the following criteria:

during the term of our business relationship
after the business relation is terminated:
- for an additional period of three years (Borealis may be in touch with you for follow-up on operations and legal matters)
- for an additional period of seven years (Borealis may be in touch with you for sales and marketing communication related to our products and innovations)
to fulfil statutory record retention requirements
with regard to use for our action or defence in response to claims and/or disputes, for the period provided by law and for any additional period if needed.

Data Processing regarding visitors of our website

We process personal data for the purposes of our legitimate interests (operation, analysis and improvement of our website). For further information on the use of cookies and analysis services, please read our Cookie Policy. You have the right to object to the processing of your personal data based on our legitimate interests with effect for future processing activities (see section "Your Rights").

Our use of User Data

Borealis will use user data it collects from you only in accordance with the following guideline:
Marketing activities.

If you have registered to receive marketing materials from Borealis in paper and or electronic form, Borealis may use your data in order to send you in electronic and or paper form marketing and other materials relating to Borealis, its products and or services. Borealis may use the data provided by you to update records held by Borealis.

If you are not registered to receive marketing information from Borealis in paper and or electronic form and wish to receive such information please send Borealis your consent by e-mail. You may withdraw your consent to the receipt of marketing materials on request and free of charge by sending an e-mail to Borealis.

Security

We implement adequate technical and organisational measures to ensure a level of security of your Personal Data that is appropriate to the risks.
We take appropriate measures to ensure that we report security incidents leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Personal Data.

Transfer to a third country or international organization

Your personal data will in principal only be processed within the European Economic Area (EEA). In the event that we would transfer your personal data to countries outside the EEA, Borealis will ensure that the same level of protection is achieved (e.g. by concluding an standard contractual clauses with the Processor located in a country outside the EEA).

Your rights

You are entitled to obtain information by BOREALIS as to which personal data are being processed and to get access to that personal data upon your request. We will provide you with one copy of the Personal data undergoing processing free of charge, unless the disclosure may adversely affect the rights and freedoms of others.

To access your personal data please submit Borealis' Access Request Form.

Information and Access

You are entitled to request rectification of inaccurate personal data or completion of incomplete personal data concerning you without undue delay.

You are entitled to request erasure of personal data without undue delay, if
Personal data are no longer necessary in relation to the purposes for which they were collected,
You withdraw your consent in case processing is based only on consent
Your personal data have been unlawfully processed
Personal data have to be erased for compliance with a legal obligation applicable to BOREALIS

However, BOREALIS is not obliged to execute such erasure if processing is necessary:

for exercising the right of freedom of expression and information
for compliance with a legal obligation to which BOREALIS is subject
for the performance of a task carried out in the public interest or in the exercise of official authority
for reasons of public interest in the area of public health
for processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, or
for the establishment, exercise or defence of legal claim

Rectification and Erasure

To request rectification/ completion or erasure of personal data concerning you please contact gdprquestions@borealisgroup.com.

Right to Object

Regarding the processing of your data for the purposes of promoting our products and services, you have a right to object. Upon receipt of your objection, we will stop processing your personal data for this purpose.

To object to the processing of your personal data please submit Borealis’ Request Form.

Right to Object

You are entitled to request the restriction of processing of personal data in the following circumstances and for the following periods:

you contest the accuracy of the personal data concerning you; restriction of processing may be effected for a period enabling the us verify the accuracy of the relevant personal data
the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead
we do no longer need the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defence of legal claims
you have objected to processing, for the period until the verification whether our legitimate grounds override those of you

To request restriction of processing of your personal data please submit Borealis’ Request Form.

Data Portability

You are entitled to data portability, namely to receive your personal data which you have provided to BOREALIS and which is processed

based on your consent or the concluded contract
and by automated means

in a structured, commonly used and machine-readable format.

You are entitled to request that the personal data is transmitted directly to another controller by us, where technically feasible. This right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority.

To request data portability of your personal data please submit Borealis’ Request Form.

Complaint

You have the right to lodge a complaint with the Austrian Data Protection Authority
(Österreichische Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna, E-Mail: dsb@dsb.gv.at)

Changes to the Privacy Statement

This Privacy Statement may be amended by Borealis at any time. Please check the website periodically to inform yourself of any changes.