The categories of Personal Data collected/processed by Elgon in connection with the use of its website or the provision of its products and/or services are as follows:

• personal identification data (e.g. surname, first name, physical and/or electronic address, telephone number, etc.);
• electronic identification data (e.g. IP addresses, cookies, electronic signature, etc.);
• data relating to professional life (e.g. name of employer, position held, etc.).

Personal Data will be processed by Elgon for the following purposes:

• to the extent that the processing is necessary for performance of the service (performance of contracts or pre-contractual measures) or transmission of the information requested (contact request, etc.). In particular, Personal Data will be processed for the purposes of implementation, administration and management of the contractual relationship as well as for updating information concerning Users and Customers;
• to the extent that the processing is necessary to comply with a legal obligation to which Elgon is subject;
• insofar as the processing is necessary for Elgon’s legitimate interests, in particular to improve the quality of services and products offered and to provide services that are increasingly adapted to the needs of its Customers, in particular in the context of service offers that are complementary to the services to which the Customer has already subscribed, and consequently for the development of commercial strategies, canvassing and marketing.

Elgon strives to make every effort to collect and process Personal Data in compliance with applicable data protection laws and regulations; in particular, Regulation (EU) No 2016/679 of 27 April 2016 (the “Regulation”).

As far as possible, Elgon endeavours to collect only such information as is necessary in order to perform its duties in the course of providing customer services or usage of its website.

Personal Data may be collected via a paper or electronic form, which is filled in when requesting information about Elgon and its services, ordering a product or service, following a training course, subscribing to a newsletter or simply exchanging business cards or filling in a customer satisfaction questionnaire.

Refusal to provide Elgon with Personal Data and/or, if applicable, any prohibition on its processing, while at the discretion of any Data Subject, may in some cases be an obstacle to the continuance of a relationship with Elgon or the provision of certain products or services.

Elgon shall endeavour to implement appropriate and reasonable security measures in light of the identified risks in order to protect Personal Data against destruction, loss, alteration, unauthorised disclosure or access and any other form of unlawful processing.

Elgon may transfer Personal Data to third parties, either as part of its legal obligations or as part of services entrusted to trusted partners.

All Elgon employees and subcontractors who have access to Personal Data are bound by a strict obligation regarding the confidentiality and security of such data. They shall have access only to the data they require in order to perform their task.

In principle, Personal Data is retained within the European Economic Area. Elgon will only transfer data outside the European Economic Area if it has a legal or regulatory obligation to do so.

Elgon will ensure that appropriate safeguards are in place before transferring Personal Data outside the European Economic Area, such as the adoption of data protection clauses or an adequacy decision by the European Commission.

To the extent that Elgon processes their Personal Data, all Data Subjects have the following rights:

• to request access to the data that Elgon holds about them (right of access);
• to request its rectification if it is inaccurate or incomplete, or its deletion if it is obsolete (rectification request);
• to request, if the preconditions are met, definitive deletion of their data (right to be forgotten);
• to oppose the processing of their data for legitimate reasons, under the conditions and within the limits provided for in the Regulation (right of opposition). In any case, the customer may object to the processing of their Personal Data for direct marketing purposes without giving any reason;
• to request not to be subject to any decision based exclusively on automated processing, including profiling, that produces legal effects concerning you or significantly affects you in a similar way;
• to withdraw, at any time, the consent that they have given (where the Personal Data processing is based solely on the consent of the Data Subject). The lawfulness of the processing based on the consent granted prior to its withdrawal will not be affected;
• to request the Personal Data provided to Elgon in a structured, commonly used and machine-readable format and to transmit this data to another controller, unless this right infringes the rights and freedoms of third parties (right to portability);

For more information on the exercising of their rights or to submit a request for the exercising of the above rights, the Data Subject may send a signed written request, including evidence of their identity, to the Elgon Legal & Compliance Department:

• by email to gdpr@elgon.lu or,
• by post to the following address: Elgon, 18 Rue de l’Industrie, L-8399 Windhof (GD de Luxembourg)

The Personal Data will be retained by for no longer than is necessary for the purposes of Elgon and in accordance with its legal obligations.