PLANMECA GROUP PRIVACY NOTICE

This privacy notice explains how Planmeca and the companies which belong to the same group (collectively ‘Planmeca’) collect, manage and protect your personal data. This privacy notice is addressed to our prospective, present and former clients, business partners, dealers, and other healthcare professionals. There may exist additional privacy notices issued by local Planmeca companies: these additional notices complement this group-level privacy notice and take into consideration relevant national data protection requirements and practices.

This privacy notice describes how we at Planmeca process personal data when acting as a data controller.

In the course of our business, we collect and process personal data of our prospective, present and former clients, business partners, retailers and other healthcare professionals. The purposes of collecting and processing personal data depend on the capacity in which you interact with us. The main purposes for collecting and processing personal data at Planmeca are:

- Seeking potential customers and developing customer relationships
- Carrying out marketing activities related to our products and services
- Providing services, products and consultation to our customers including both on-site and remote technical service and support, as well as medical device and software trainings
- Communicating with our present and potential customers through various channels such as newsletters, customer feedback surveys, requests or enquiries, and at events
- Conducting and facilitating sweepstakes and contests
- Promoting Planmeca products and services
- Conducting market studies and research
- Administrative purposes such as planning and developing Planmeca’s business operations.

We only process personal data when we have a legal basis to do so. The legal basis depends on the personal data concerned and the specific context in which we process it.

This means that we collect and process personal data in the following cases:

- To fulfill a contract when you have entered into an agreement with us or are considering to do so
- When we have a legitimate interest such as a business or commercial reason to process personal data −these reasons might include e.g. management and development of customer relationship or business operations or sharing data with other Planmeca Group companies. When we use legitimate interest as a legal basis we carefully consider that such processing is compatible with the data subject’s rights and freedoms
- For compliance with our legal or statutory obligations
- When you have given us your prior consent to process personal data.

The data we process depends on the nature of our relationship with you. We typically process personal data categories such as:

- General contact information and other information such as name, phone number, e-mail address, mailing address, and other contact details
- Company information and information on the function and job title of contact persons of our clients
- Data related to the customer relationship and contractual relationship, such as information related to orders and transactions, and information related to providing and administering our products and services
- Data related to customer interaction, e.g. customer contacts and demo requests or enquiries via our websites, or social media activity
- Data related to events and trainings organised by us or other associated parties
- Data related to any online accounts on our online stores, extranets or other online services
- Data collected from the use of our websites or other online services (e.g. cookies)

This data might be directly provided by you, or it might be collected from our business partners (e.g. contact info of healthcare companies), or other third parties. The data we collect from you comes from a variety of channels, such as when you contact us, purchase our products or services, or take part in our events.

We will only retain your personal data for as long as necessary to fulfill the purposes described in this Privacy Notice and to comply with mandatory legislation such as accounting requirements. As a general rule, we process relevant personal data for the duration of the customer relationship and for a predefined period after the relationship ends.

We aim to make sure that personal data we process is up to date and correct. In some circumstances, we may anonymize personal data for e.g. statistical purposes.

We are a global company and due to technical and operational requirements we may process personal data outside the European Union and/or the European Economic Area. If we transfer personal data outside the EU/EEA, the transfer will be carried out in accordance with appropriate transfer mechanisms, such as using the standard data protection clauses.

We may share personal data within our group companies and regional dealers and suppliers. In some cases, we may also share personal data with appropriate and authorised third party recipients when providing services for you. We may also transfer personal data to our subcontractors that process data on our behalf for e.g. IT development, hosting and support. We only share information with government authorities if required to do so to comply with a legal or statutory requirement.

We maintain appropriate and adequate organizational, technical and physical safeguards designed to protect against unlawful or unauthorised destruction, loss, alteration, use or disclosure of, or access to, the personal information provided to us. Only authorised persons have access to the personal data we maintain, and the access is on a strict 'need-to-know' basis. We require all employees who have access to any personal data to handle it strictly confidential.

In accordance with the applicable data protection legislation, you may have the right to

- Request access to the personal data we hold about you
- Request that we rectify any inaccuracies in the personal data we hold about you
- Withdraw your consent at any time if the processing of your personal data is based on consent
- In some circumstances, to request the transfer of your personal data to a third party
- In some circumstances, to request erasure or restriction of processing or to object to processing

You may also have the right to object to the use of personal data for marketing purposes.

If you would like to exercise any of the rights listed above, you can submit your request to us by sending an email to dpo(at)planmeca.com.

You have the right to file a complaint to your local data protection authority if you are not content with our data protection practices.