Privacy policy

Privacy policy

  1. Introduction and Scope
  2. Polyfoam XPS is committed to processing Personal Data responsibly and in compliance with the applicable data protection laws in all countries in which Polyfoam  XPS operates. This European Union (“EU”) Customer/Vendor Data Protection Notice (the “Notice”) describes the types of Personal Data Polyfoam  XPS collects, how Polyfoam  XPS uses that Personal Data, with whom Polyfoam  XPS shares your Personal Data, and the rights you, as a Data Subject, have regarding Polyfoam  XPS’s use of the Personal Data. This Notice also describes the measures Polyfoam XPS takes to protect the security of the data and how you can contact us about our data protection practices.
  3. Contact Details of Data Controllers
  4. The Polyfoam XPS entity responsible for the collection and use of your Personal Data (the Data Controller) for the purposes described in this Notice is Polyfoam XPS Limited, Hunter House Industrial Estate, Hartlepool, Teesside, TS25 2BE. For any questions you may have regarding this Notice, please contact the Legal Department of Polyfoam XPS at info@polyfoamxps.co.uk
  5. Categories of Processed Personal Data
  6.   We Process the following Personal Data for the purposes listed below under Chapter IV:
    • Contact details (such as name, name of organisation, department and job title, email, phone number, office or site location); and
    • Contractual information (such as date of agreement, type of commercial relationship, etc.).
    Polyfoam XPS will not collect Personal Data if such collection is prohibited under the applicable data protection laws. In no case will Personal Data revealing religious beliefs, sexual orientation, racial or ethnic origin, political opinions, philosophical beliefs or trade union membership be processed in the customer/vendor context. Polyfoam XPS will maintain Personal Data in a manner that ensures it is accurate, complete and up-to-date. The processed Personal Data is limited to the data that is necessary for carrying out the purpose for which such Personal Data is collected.
  7. Purposes of Data Processing and Legal Basis
  8. Polyfoam XPS processes Personal Data in accordance with applicable data protection laws and regulations and only for limited, explicit and legitimate purposes. Polyfoam XPS will not use Personal Data for any purpose that is incompatible with the original purpose for which it was collected, unless you provide your prior explicit consent for further use. Personal Data relating to Customers/Vendors will be Processed for the purposes of:
    Type of Personal Data Legal Basis
    Commercial activities related to the purchase of products/raw materials from former/potential/current suppliers Legal contract with supplier/customer
    Commercial activities related to the sale of products/raw materials to former/potential/current clients; Legal contract with supplier/customer
    Product management/quality activities Applicable legal provisions
    Invoice administration for suppliers and customers Applicable legal provisions
    Sales administration and tariff consultation Legitimate business interests
    Stock correction and stock devaluation Legitimate business interests
    Supply chain and commercial activities related to external warehouses Legal contract with supplier/customer
    Management of Polyfoam  XPS’s external accounting and tax systems Applicable legal provisions
    Management of consulting activities, credit administration and credit diary Legitimate business interests/ Legal contract with supplier/customer
    Quality audits & assessments, complaint management Applicable legal provisions/ Legitimate business interests
    Carrying out promotional operations; Legitimate business interests
    Conducting statistical surveys Legitimate business interests
    Conduct email marketing Legitimate business interests
    The legitimate business interest is mainly the development of Polyfoam XPS’s ordinary course of business. Furthermore, Personal Data of Polyfoam  XPS’s customers, vendors, and external consultants (including their contact person and sales representatives) may be processed for the purposes of the legitimate interest only if such an interest is not overridden by the Data Subject’s fundamental rights and freedoms, or interests. Polyfoam XPS ensures that its internal governance procedures clearly specify the reasons behind decisions to use Personal Data for alternative Processing purposes. Prior to using your Personal Data for a purpose other than the one for which it was initially collected, you will be informed about such a new purpose.
  9. Data Security
  10. Polyfoam  XPS has implemented appropriate technical and organisational measures to ensure a level of security appropriate to the risk, such risk analysis includes an analysis of the risk of compromising the rights of the Data Subject, costs of implementation, and the nature, scope, context and purposes for Data Processing. The measures include:
    • encryption of Personal Data where applicable/appropriate;
    • the ability to ensure the ongoing confidentiality, integrity, availability and resilience of Processing systems and services;
  11. Recipients or Categories of Recipients
  12. Polyfoam XPS will grant access to Personal Data to Polyfoam XPS’s following internal departments:
    • HR
    • Legal
    • IT
    • Finance
    • Sales and Marketing
    Polyfoam XPS will only grant access to Personal Data on a need-to-know basis, and such access will be limited to the Personal Data that is necessary to perform the function for which such access is granted. Authorisation to access Personal Data will always be linked to the function so that no authorisation will be extended to access Personal Data on a personal basis. Service providers will only receive Personal Data according to the purposes of the service agreement with Polyfoam XPS.
  13. International Data Transfers
  14. International data transfers refer to transfers of Personal Data outside of the European Economic Area (“EEA”). The international footprint of Polyfoam XPS involves the transfer of Personal Data to and from other group companies or third parties, which may be located outside the EEA, including the United States of America. Polyfoam XPS will ensure that when Personal Data is transferred to countries that have different standards of data protection, appropriate safeguards to adequately protect the Personal Data are implemented to enable such data transfers in compliance with applicable data protection laws. Polyfoam XPS has implemented Data Transfer Agreements based on EU model clauses to cover international data transfers and a copy of these agreements can be obtained by contacting Polyfoam XPS at info@polyfoamxps.co.uk
  15. Retention of Personal Data
  16. Polyfoam XPS will not retain your Personal Data for longer than is allowed under the applicable data protection laws and regulations or for longer than is justified for the purpose for which it was originally collected or otherwise processed subject to applicable local retention requirements. As a general rule, collected data will be deleted 20 years after the termination of the customer/vendor relationship.
  17. Data Protection Rights
  18. Under applicable data protection laws, you will benefit from the following rights. You can exercise these rights at any time by contacting the local DPO or DPC, where applicable:
    • Right to access to, rectification and erasure of Personal Information;
    • Right to restriction of Processing and to object to Processing;
    • Right of data portability to the extent applicable;
    • Right to withdraw consent where the Processing is based on consent; and
    • Right to lodge a complaint with the supervisory authority.
  19. Notice Compliance and Contact Information
  20. Monitoring and ensuring compliance of the Personal Data Processing within Polyfoam XPS with this Notice and applicable data protection laws and regulations is the responsibility of the DPO or DPC. You may contact Polyfoam XPS at info@polyfoamxps.co.uk with regard to any issue related to Processing of your Personal Data and to exercise your rights as mentioned above.
  21. Miscellaneous
This Notice will be effective as of 25 May 2018. This Notice may be revised and amended from time to time and appropriate notice about any amendments will be given.