EU AND UK PRIVACY NOTICE CONCERNING CUSTOMER AND OTHER BUSINESS-RELATED PERSONAL DATA

1. INFORMATION ABOUT US
2. CONTACT DETAILS
3. WHAT PERSONAL DATA WE COLLECT AND WHY?
4. SHARING OF YOUR INFORMATION
5. TRANSFERS OUTSIDE THE EUROPEAN ECONOMIC AREA (EEA) AND UK
6. YOUR RIGHTS

1. INFORMATION ABOUT US AND INTRODUCTION

Fernox Ltd. (sometimes referred to as “Fernox,” “we,” the “Company,” or “us”) values and protects the personal data of our existing and prospective customers, business partners, suppliers, website visitors, job applicants and promotion and giveaway participants. Fernox is a global, diversified producer of high technology specialty chemical products and provider of technical services with headquarters in the United Kingdom and trading in several countries some of which outside the European Union. This Privacy Notice covering personal data of individuals in the EU and UK contains important information about the way in which we collect, use, disclose, retain and otherwise process personal data. For the purpose of (in respect of the EU) the General Data Protection Regulation 2016/679 and any implementing legislation and (in respect of the UK) the UK GDPR as defined under the UK Data Protection Act 2018  (collectively the “GDPR”), Fernox is the data controller responsible for any personal data that we process. Executive Headquarters: Unit 2 Genesis Business Park, Albert Drive, Sheerwater, Woking, Surrey, GU21 5RW, United Kingdom.

This policy may be amended from time to time, at our discretion. The most up to date version of this policy will be posted on our website with the date the policy was last updated indicated.

2. CONTACT DETAILS

Questions, comments, and other communications regarding this privacy policy, or our privacy practices in general, are welcomed and should be addressed to our Data Protection Privacy Advocate. Any queries and requests regarding this privacy policy may be sent by email or post to: Data Protection Privacy Advocate Unit 2 Genesis Business Park, Albert Drive, Sheerwater, Woking, Surrey, GU21 5RW, United Kingdom / Email:  DPPA@MacDermid.com

3. WHAT PERSONAL DATA WE COLLECT AND WHY?

This section 3 covers the different sources and categories of personal data that we collect and process, why we do so, and the lawful bases for processing by Fernox. Depending on your relationship with Fernox, please see the relevant section below where we describe how we obtain your personal data and how we will treat it. This privacy notice covers the processing of information for the following categories of individuals:

Section 3.1 Representatives of our Existing or Prospective Customers, Business Partners and Vendors

Section 3.2 Visitors to Premises

Section 3.3 Website Visitors

Section 3.4 Job applicants

Section 3.5 Participants and social media users in the context of promotions, giveaways or prize draws

Section 3.6 Fernox App for water testing and administration of product warranties

3.1 Representatives of our Existing or Prospective Customers, Business Partners and Vendors

We may collect personal data related to employees, directors, authorised signatories, in other words, representatives of Fernox’s existing or prospective customers, business partners or vendors.

A – Sources of personal data

We may obtain your personal data from the following sources:

1. from you directly,
2. from a company that employs you, if you are an employee of our existing or prospective customer, business partner or vendor,
3. from Fernox’s affiliates (see the list in Annex 1);
4. during networking events that we have either hosted, or sponsored, or attended; and/or
5. from publicly available sources (for example, your company website or social media sites)

B – Personal data that we collect and process

We may collect the following categories of personal data relating to our existing or prospective customers’ or vendors’ employees, officers, authorised signatories, and other associated individuals:

1. name;
2. business address;
3. business email address;
4. business telephone number;
5. job title;
6. date of birth;
7. business bank details;
8. credit information; and/or
9. billing information.

C – Why do we collect your personal data and what are our lawful bases for it?

D – How long do we keep your personal data?

We will keep and Process your Personal Data only for as long as is necessary for the purposes for which it was collected. We will keep your personal data for the duration of our business relationship with regard to the provision of goods or services to you.  We will retain information about you after the closure of a customer account or the end of a business relationship as long as required for legal, regulatory and legitimate business purposes. Upon expiry of such data retention period, we will delete it securely.

If we process your personal data on the basis of your consent, we will usually retain it until you withdraw your consent.

To demonstrate consent, we store relevant data for as long as we need to demonstrate the consent and compliant data processing in accordance with applicable laws. The processing is necessary for compliance with legal obligations.

3.2 Visitors to Our Premises

A – Sources of personal data

We may obtain your personal data from you directly and from our business systems’ records.

B – Personal data that we collect and process

1. name;
2. business contact details;
3. organisation;
4. role;
5. time and date of your visit; and/or
6. image (for example, from CCTV cameras at our premises).

C – Why do we collect your personal data and what are our lawful bases for it?

D – How long do we keep your personal data?

We keep your personal data for as long as necessary to ensure the security of our office visitors, once this period ends and when there is no longer a legal or a business need to keep it, we will delete it securely.

3.3 Website Visitors

A – Sources of personal data. Personal data that we collect. Why do we collect your personal data and what are our lawful bases for it?

The personal data that we collect and process about you includes data within the categories below. We do not necessarily collect all data listed in a particular category, nor do we collect all categories of data for all individuals. The sources of personal data and purpose of the processing are also set out in the chart below:

B – How long do we keep your personal data?

Your personal data will be retained only for as long as the information is needed to fulfil the purposes for which it is collected and processed. Fernox reserves the right to retain and use personal data for as long as necessary to comply with our legal and regulatory obligations and business requirements and/or to resolve any ongoing disputes and enforce our agreements. For the avoidance of doubt, data will not be destroyed before any regulatory retention period expires, or during a pending investigation, whether legal or regulatory.

If we process your personal data on the basis of your consent, we will usually retain it until you withdraw your consent.

To demonstrate consent, we store relevant data for as long as we need to demonstrate the consent and compliant data processing in accordance with applicable laws. The processing is necessary for compliance with legal obligations.

3.4 Job Applicants

We may collect personal data related to job applicants for positions advertised on our website.

A – Sources of personal data

We may obtain your personal data from the following sources:

1. from you directly,
2. from a third party, for example, individual referrals or a recruitment agency,
3. from Fernox’s affiliates (see the list in Annex 1);
4. via hard copy and web-based application forms;
5. during networking events that we have either hosted, or sponsored, or attended; and/or
6. from publicly available sources (for example, professional networks, such as LinkedIn)

B – Personal data that we collect and process

We may collect the following categories of personal data, which may differ, depending on the content of your CV or baseline documents you submit to us:

1. name;
2. residence address;
3. personal email address;
4. telephone number;
5. date of birth;
6. career and education history;
7. skills, experience, and qualifications;
8. personal interests, languages spoken, questionnaire results;
9. gender;
10. names and contact details for references. Please note that it is your responsibility to obtain consent from your references prior to providing us personal information about them;
11. current and historic salary details together with salary expectations;
12. details of your current benefit entitlements;
13. information about your entitlement to work in the country in which the Fernox EU affiliate is located;

C – Why do we collect your personal data and what are our lawful bases for it?

D – How long do we keep your personal data?

We will keep and Process your Personal Data only for as long as is necessary for the purposes for which it was collected. If you are successful and we hire you, we will keep your CV as part of your employee record for the duration of your employment with us. We will keep CVs and documents submitted by unsuccessful candidates for no longer than six months after decision, unless we obtained their consent to keep it for longer.

3.5 Participants and social media users in the context of promotions, giveaways or prize draws

We may collect personal data of social media users who participate in any promotions, giveaways, prize draws etc. (collectively, “Promotions”) that we may run from time to time or who are tagged in social media posts about such Promotions by participants.

A – Sources of personal data

We may obtain your personal data from the following sources:

1. from you directly (for example, via your expression of interest in the particular Promotion by commenting on a social media post);
2. if you are tagged in one of our social media posts; and/or
3. if you contact us or we contact you in the context of a particular Promotion, we may keep a record of that correspondence.

B – Personal data that we collect and process

We may collect the following categories of personal data, which may differ, depending on the specific Promotion we are running:

1. name;
2. social media username;
3. email address;
4. postal address;
5. proof of satisfaction of the eligibility requirements for the particular Promotion (as set out in the applicable Terms & Conditions); and/or
6. participant’s entry post.

C – Why do we collect your personal data and what are our lawful bases for it?

If you do not wish to provide the information required for entry into a particular Promotion, we may not be able to facilitate your participation or provide you with a prize (where applicable). If you wish to object to your personal data being provided to those who enquire, please send such objection to us using the contact details provided above in section 2.

D – How long do we keep your personal data?

We will keep and process your personal data only for as long as is necessary for the purposes for which it was collected, which in these circumstances will be running the Promotion, distributing prizes as appropriate and addressing any queries, complaints or claims which may arise post such Promotion. After this time, we will securely delete your personal data.

Section 3.6 Fernox App for water testing and administration of product warranties

We may collect the following categories of personal data relating to the users of the Fernox App for water testing and administration of product warranties:

1. name;
2. business address;
3. business email address;
4. business telephone number;
5. job title; and/or
6. address where a boiler is installed.

C – Why do we collect your personal data and what are our lawful bases for it?

D – How long do we keep your personal data?

We will keep and Process your personal data only for as long as is necessary for the purposes for which it was collected. We will keep your personal data for the duration of our business relationship with regard to the provision of goods or services to you.  In particular We will retain information about you after the closure of a customer account or the end of a business relationship as long as required for legal, regulatory and legitimate business purposes. Upon expiry of such data retention period, we will delete it securely.

4. SHARING OF YOUR INFORMATION

Data that we collect may be shared with our affiliated companies, suppliers or service providers, and government authorities. See details in relevant sections below.

Affiliates

We may share your personal data with affiliates (see the list in Annex 1 below) for the following purposes:

• to provide us with IT support and systems and tools for managing operations,
• overall group-wide risk management,
• litigation management,
• compliance with regulatory requirements applicable to affiliates, and
• direct marketing.

In so doing, our affiliates may be data controllers and / or data processors of your personal data together Fernox.  As data controllers and / or data processors, these affiliates will process your data in line with the intra-group data transfer agreements in line with the requirements of the GDPR.

Government or regulatory authorities

We may also disclose information about you if we have a legal duty to do so or if we are required or requested by any governmental or regulatory authority or similar body pursuant to any applicable law or regulation. Otherwise, we will keep information about you confidential.

Service providers

We may give information about you to organisations that provide a service to us or are acting as our agents, subject to contractual measures that we put in place obligating such organisations, on the understanding that they will keep the information confidential and will comply with applicable data protection laws. For example, we may share your information with the following types of service providers that we engage with:

1. Marketing service providers, including companies who send out surveys and marketing communications on our behalf
2. Technical support providers who assist with our website and IT infrastructure;
3. Third party software providers, who may include ‘software as a service’ solution providers, where the provider hosts the relevant personal data on our behalf;
4. Professional advisers such as solicitors, accountants, tax advisors, auditors and insurance brokers;
5. Money laundering and compliance search providers;
6. Providers that help us store, collate and organise information effectively and securely, both electronically and in hard copy format, and for marketing purposes; and/or
7. Providers that help us generate and collate reviews in relation to our services.

Mergers and acquisitions

In the context of mergers and acquisitions, we may transfer your personal data to potential purchasers and their advisors, subject to appropriate confidentiality obligations, in the event we decide to dispose of all or parts of its business.

5. TRANSFERS OUTSIDE THE EUROPEAN ECONOMIC AREA (EEA) OR UK

In general, when transferring your personal data outside the EEA (which consists of EU member states and Iceland, Lichtenstein and Norway) or the UK, we will only do so using one of the following safeguards:

• the transfer is to a country which has an adequacy decision by the EU Commission and/or the relevant UK Secretary of State (e.g. Israel);
• the transfer is covered by a contractual agreement, which covers the GDPR requirements relating to transfers to countries outside the EEA/UK.
• the transfer is to an organization which has Binding Corporate Rules approved by an EU/UK data protection authority; or
• the transfer is to an organization in the US that is EU-US Data Privacy Framework or UK-US Data Bridge certified.

You may request a copy of the relevant document by contacting us as indicated in section 2 above.

6. YOUR RIGHTS

User Privacy Rights

Depending on your jurisdiction, subject to certain exceptions as set forth by law, you may have the following rights with respect to personal data about you:

1. Right of access/Right to know – You may be entitled to request that we tell you the specific pieces of personal data we have collected about you, the categories of sources from which the information was collected, the purposes of collecting the information, the categories of third parties we have disclosed the information to, and the categories of personal data that have been disclosed to third parties for a business purpose. Before providing any of this information, we must be able to verify your identity.
2. Right of data portability – In some instances, you may have the right to receive the information about you in a portable and readily usable format.
3. Right to have personal data erased – Subject to certain conditions, you may be entitled to request that we delete personal data about you. We will not delete personal data about you when the information is required to fulfill a legal obligation, is necessary to exercise or defend legal claims, or where we are required or permitted to retain the information by law.
4. Right to correct – To the extent the personal data about you that we maintain is incorrect, you may be entitled to request that we correct that inaccurate personal data.
5. Right to appeal – In the event we fail to respond to your request within the timeline specified below, or we deny your request, you have the right to appeal that decision. If we deny your request, you may also have the right to appeal that decision. Instructions on how to appeal any denial will be included in the notice of denial.
6. Right to object the processing of your personal data – You have the right to object the processing of your personal data for marketing purposes or on grounds relating to your particular situation.
7. Right to withdraw consent / Right to opt out of receiving our marketing emails – Where you have provided your consent to receive electronic direct marketing, you can withdraw your consent at any time without affecting the lawfulness of the processing based on consent before its withdrawal. To stop receiving our promotional emails, including newsletters, follow the instructions in any promotional message you get from us. Alternatively, if you object to our use of your information for direct marketing purposes, please email us at [Marketing@macdermidenthone.com]. Even if you opt out of getting marketing messages, we will still send you transactional messages. These include responses to your questions.

You also have the right to lodge a complaint related to any alleged infringement with a supervisory authority of your respective country.

For further information regarding your rights, or to exercise any of your rights (other than the right to lodge a complaint with an authority), please email DPPA@MacDermid.com or send postal mail to the following address: Data Protection Privacy Advocate Unit 2 Genesis Business Park, Albert Drive, Sheerwater, Woking, Surrey, GU21 5RW, United Kingdom / Email:  DPPA@MacDermid.com

If you chose to exercise any of these rights, we will not discriminate against you on the basis of choosing to exercise your privacy rights.

List of Affiliates

Subsidiaries

The following are subsidiaries of Element Solutions Inc as of December 31, 2023 and the state or jurisdiction in which each of these subsidiaries is incorporated or organized: