Privacy Policy - Process Lab

Privacy Statement on Personal Data Processing

Introduction

Process Lab SRL is a limited liability company specialised in Software as a Service technology deployment and implementation.

This Privacy Statement on Personal Data Processing (referred to as “Privacy Statement”) concerns the personal data processing carried out by Process Lab on our website. The Privacy Statement is applicable to the personal data processing we carry out through our website, as well as to all interactions with our website hosted on the domain processlab.tech For the avoidance of doubt, it should be outlined that this Privacy Statement does not concern the processes performed due to our products or services which you can find here.

The name of the data controller and of the website owner

Process Lab is a personal data controller and the owner of the website is accessible at the following web address: https://processlab.tech/

Our business

Personal data processed for the performance of the contractual relationships with our clients, suppliers and/or other business partners

Personal data we process

In order to conduct the performance of the contractual relationship, we collect the following personal data from you:

basic data for identification purposes, such as surname, name, workplace, industry and country of residence and relationship to another person with whom we have an established connection (e.g., with an employee, with another contact or client, with a person who facilitated our connection with you);
contact data, such as the physical work address or email address and phone number;
any data you make available to us during our interactions.

How we collect personal data

We collect the personal data that you provide voluntarily (in electronic format), as well as information and data available from public sources:

– when you contact us via contact forms or email, if you are interested in becoming our client, supplier or business partner.

Legal grounds and purposes of processing

You are entitled to know the purposes for which we process your personal data. We will inform you prior to processing your personal data for other purposes than that for which you disclosed your personal data to us.

Based on the agreement we concluded with you, as client, provider or business partner of Process Lab, we will process all personal data you make available to us, as well as any other data necessary to the performance of our contractual and/or legal obligations. The legal ground of processing is the performance of a contract with you or, in case you act as a legal representative or a contact person for a legal entity, on the basis of our legitimate interest.

Personal data processed for professional communication purposes

Personal data we process

The collection of your personal data is strictly limited to what is necessary to provide you with professional communication. Personal data we process includes:

-basic data for identification purposes, such as surname, name, workplace, industry and country of residence;

-contact data, such as the physical work address or email address and phone number;

any data you make available to us during our interactions.

How we collect personal data

We collect the personal data that you provide voluntarily, as well as information and data available from public sources:

– when you contact us via contact forms, if you are interested in our professional communications or express desire to cooperate with us.

Legal grounds and purposes of processing

You are entitled to know the purposes for which we process your personal data and we will inform you prior to processing your personal data for other purposes than that for which you disclosed your personal data to us.

When you subscribe to the Information Service directly, by means of the website, we will ask your consent for the processing of personal data in order to be able to supply those services for which you have requested the subscription. Thus, in such cases, the legal ground for processing of such data is your consent.

Personal data processed for recruitment purposes

You may apply for a position within Process Lab.

We shall use your personal data related to the recruitment process to:

– evaluate whether you are appropriate for a position at Process Lab;

– contact you with regard to your application;

– manage the recruitment process;

– contact you with regard to subsequently vacant positions which we deem suitable for you, and

– keep records of prior recruitment processes of our company in which you participated and of the reasons why you have not been presented with an offer or why our offer has been rejected.

Personal data we process

When you apply via the dedicated section on the website, we will limit the processing of your data to what is strictly necessary for the purpose of recruiting.

Personal data we process include:

-basic data for identification purposes, such as your full name, email address, phone number and mail address, country of origin, any other data you make available to us by the application documents, which you provide by applying directly on the website;

-other CV related data, such as education, professional experience, competencies, your specialisation, and the type of collaboration you want;

-any data you make available to us during our interactions.

How we collect personal data

We collect the personal data that you provide voluntarily (in electronic format), as well as information and data available from public sources:

– when you contact us via contact forms, if you are interested in becoming employed or contracted by our company.

Legal grounds and purposes of processing

You are entitled to know the purpose for which we process your personal data and we will inform you prior to processing your personal data for other purposes than that for which you disclosed your personal data to us.

We collect information necessary in the recruitment process, in order to be able to evaluate if you are appropriate for a position within Process Lab and for the purposes given above in this section. The processing of personal data during the recruitment procedure is legally based on the entering into an employment agreement with you, this processing representing the pre-contractual phase of the performance of the employment agreement.

Also, we will keep records of the persons who have participated in the evaluation procedure and of the reasons for which they did not receive an offer or for which they rejected the offer, based on our legitimate interest, for the purpose of streamlining the recruitment procedure.

Use of cookies

Personal data we process

Our website contains cookies, which collect personal data. The collection of your personal data is strictly limited to what is necessary to provide you with an experience of the highest quality with regard to the use of our website. We collect technical data (including the IP address), such as information on your visits on our website or by accessing materials and communications we send you electronically, your online identifiers, behavior on our website and profiling data.

How we collect personal data

We collect your personal data through our website by cookies tools. The details on the processing of personal data though such tools are available in our Cookie Policy.

Purposes of processing

We use such cookies for the purpose of providing you with a better user-experience when navigating on our website, for analytical purpose in order to better improve our services, as well as for the purpose of providing you with relevant content and advertisements, in accordance with your interests.

For more information with respect to the use of cookies on our website, please visit our Cookie Policy available at https://processlab.tech/

According to art. 22 para. 1 of the GDPR, “the data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her”.

It should be outlined that this processing does not fall under art. 22 of the GDPR, since it does not have any legal effect on the data subjects or it not have does similarly significant affect the data subjects.

Storage duration

If you have chosen to receive communications from the Information Service, we will store your personal data to provide this service for 3 years from your last interaction with our communications. Afterwards, following this period, we will ask again for your consent in order for you to keep benefiting from the Information Service.

If at any moment in time, you decide you do not want to benefit from the Information Service and you withdraw your consent, we will respect your decision and we will stop processing your personal data for this purpose.

Personal data collected in the recruitment process is stored and used for the purpose of keeping records on past recruitments for a period of 3 years from the date when you applied at Process Lab, unless we concluded an employment agreement, when it will apply the retention period for employees’ file.

We shall delete your other personal data when it is no longer necessary for the purposes for which they have been collected or when you withdraw your consent (if the processing of your data is based on consent), provided that we are not legally required or otherwise permitted to continue to hold such data. We may retain your personal data for an additional period to the extent deletion would require us to overwrite our automated disaster recovery backup systems.

-you contest the accuracy of your personal data;

-the processing of your personal data is unlawful;

-we no longer need your personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defense of legal claims;

-you have objected to processing of your personal data, pending the verification of our legitimate interest ground.

The right to data portability. You have the right to receive your personal data provided to us in a structured, commonly used and machine-readable format and you have the right to transmit those personal data to another entity without hindrance from us.

The right to object to the processing of your personal data. You have the right to object, on grounds relating to your particular situation, Recipients

As a general rule, we do not share with or transfer your personal data to third parties. If the disclosure or transfer is required or if we are obliged by law, we shall inform you in the shortest possible time with regard to such transfer, unless the applicable law, including the rules of governance for the obligation to maintain professional secrecy, prevents us from sending such notification.

If we disclose or transfer your personal data to third parties, we shall do so according to the applicable laws and take the necessary measures to ensure their integrity and protection.

We transfer your personal data to all entities in our group. The companies in our group are: Process Lab SRL. In such cases, these entities will process your personal data for the same purposes and under the same conditions as outlined in this Privacy Statement based on our legitimate interest.

For performing our activity, we use data processors, i.e., Google (for the Drive platform, and for lookalike marketing campaigns), Facebook (for Pixel, excluding custom audiences and custom conversions), on our behalf and strictly based on our instructions. We will maintain control over your personal data and will use appropriate safeguards, as provided under the applicable law, to ensure the integrity and security of your personal data in relation to those processors. We shall conclude agreements for the processing of personal data with all data processors, which will include adequate clauses to ensure that data processors undertake obligations to process personal data (including to delete it) in full agreement with applicable laws and which provide an adequate level of protection to your personal data.

Certain recipients of your personal data, such as Google and Facebook are located in countries for which the European Commission has not issued a decision regarding the provision of an adequate level of data protection, namely: The United States of America. These recipients are certified under the privacy agreement concluded between Europe and USA called the “EU-US Privacy Shield”.

Security of personal data

Personal data is secured against threats and we make sure they are protected by appropriate IT infrastructure and security measures. Moreover, we have implemented internal measures that allow us to discover, notify, and document personal data breaches in the shortest possible time.

If we discover any personal data breach that poses a risk for your rights and freedoms, we shall notify the National Supervisory Authority for Personal Data Processing. You will be informed with regard to your personal data breach if it leads to a high risk for your rights and freedoms.

Your rights regarding the processing of personal data

If you expressed your consent with respect to the processing activities, you might withdraw such consent at any time with future effects. Such withdrawal will not affect the legality of the processing prior to the withdrawal of your consent. As a general rule, if you withdraw your consent, we will no longer allow the processing of your personal data and will take any appropriate actions to erase any records containing your personal data. However, if the processing is mandatory for the provision of our services and the processing may be performed on other legal bases stipulated by the applicable legal provisions, we will proceed to such processing and will notify you in this respect.

You have the following rights regarding the processing of your personal data:

The right to access your personal data. You have the right to be informed, upon request, as to whether or not your personal data are being processed, and, where that is the case, to request access to the personal data. The access information includes, inter alia, the purposes of the processing, the categories of personal data concerned, and the recipients or categories of recipients to whom your personal data have been or will be disclosed. You have the right to obtain a copy of your personal data processed. For any additional copies, we may charge a reasonable fee based on administrative costs.

The right to rectification your personal data. You have the right to have your inaccurate Personal data rectified. Depending on the purposes of the processing, you have the right to have your incomplete Personal data completed, including by means of providing a supplementary statement.

The right to erasure your personal data. You have the right to ask us to erase your personal data.

The right to restriction of processing of personal data. This right is available to you when:

at any time to the processing of your personal data by us and we can be required to no longer process your personal data. If you have a right to object and you exercise this right, your personal data will no longer be processed for such purposes by us. Exercising this right will not incur any costs.

Should you have any questions related to the processing of your personal data or if you would like to submit a request, as well as to exercise any of the rights on the processing of personal data, please contact us at:

– email address: contact@processlab.tech

We will review each request and notify you with regard to the undertaken actions in the shortest possible time, but no later than one month since the registration of your request. Should we require more information from you or experience difficulties in the settlement of your request, we shall notify you without delay with regard to the fact that we need additional time to perform a proper review of your request.

Should you consider that we have failed to settle all your requests or are discontent with our answers, you may file a petition with the National Supervisory Authority for Personal Data Processing. You may also refer to the courts of law.

Amendments of the Privacy Statement

If we decide to amend this Privacy Statement, we will publish the new version on our website, which will supersede the current version.

Thank you for trusting us with your personal data and for finding the necessary time to read our Privacy Statement. Please feel free to contact us if you have any questions related to your personal data and our processing of your personal data.

Cookie Policy

This Cookie Policy applies to any websites, apps and digital platforms operated by Process Lab (hereinafter “we”, and “our”). Any personal data collected by us via cookies is processed in accordance with this Cookie Policy and with our Privacy Notice, which is available here.

We only use Cookies in compliance with the legal provisions in force and with utmost care for your privacy. For any questions about this Cookie Policy or on how we use cookies, please contact us at:

E-mail: contact@processlab.tech

Telephone: ‭(0726) 306 835

What is a Cookie?

A Cookie is a small text file made up of letters and numbers that will be stored on the user’s computer, mobile terminal or other device from which the user accesses a web page. The Cookie is installed by a request made by a web server to a browser (e.g. Internet Explorer, Google Chrome) and it is completely “passive” (i.e. it does not contain software, viruses or spyware and it cannot access information from the user’s hard drives).

Cookies are a central point of efficient Internet operation, helping generate a friendly browsing experience that is adapted to the preferences and interests of every user. If Cookies are deactivated, this may render certain website functionalities impossible to use.

Do Cookies contain personal data?

Generally, cookies may collect data concerning the device you are using (e.g. MAC address, operating system), data concerning your browsing activity on the website, interests or other information that you have provided. According to recital 30 of the GDPR, data collected by cookies must be considered as personal data. The data that are collected by Cookies are encrypted in a way that renders impossible the access of unauthorized persons to them.

What are Cookies used for?

https://processlab.tech/ uses Cookies in order to improve the navigation experience. To this end, Cookies render possible the user’s terminal recognition and user preference storage, and facilitate the presentation of content in a relevant manner, which is adapted to user preferences.

Please note that, if the Cookies that are strictly necessary for website operation are blocked, this may render the website impossible to use.

You can delete the Cookies by accessing the corresponding settings in your web browser. In this case, your data will no longer be processed until your next access of our websites.

What Cookies do we use?

We use several types of Cookies, which may be classified as session Cookies or persistent Cookies, depending on their term of storage. Session Cookies are temporary files that remain in the user’s device until the session ends or the web browser is closed when they are permanently deleted. Persistent Cookies remain on the user’s terminal for a term that is defined by Cookie parameters or until they are deleted manually from the web browser.

A visit on our website can place the following types of cookies on your terminal:

Strictly necessary Cookies

These Cookies are necessary for our website to operate under optimal conditions, by supporting basic functions, such as webpage browsing or accessing secured areas of the website. Without these Cookies, our website could not function properly. You will not be able to restrict the use of these cookies.

Name	Supplier	Purpose	Retention Policy	Third Party Policy
cookie-disclaimer	Process Lab	Are used to determine whether or not the information box on the use and consent of cookies is displayed.	Permanent
cookie-choices	Process Lab	Are used to determine your preferences regarding type of cookies you opt for this website	Permanent
wordpress_logged_in_[hash]	Wordfence	This cookie indicates when you’re logged in, and who you are, for most interface use.	Permanent	https://www.wordfence.com/help/general-data-protection-regulation/
cerber_groove	WordPress	These cookies are security cookies used in various scouts. It does not store any personal information	Permanent	https://wordpress.org/support/topic/cerber_groove-cookie-purpose/

Performance Cookies

These cookies are necessary for us to understand how visitors interact with our website by collecting and reporting information anonymously for the purpose of preparing certain aggregate statistics that help us understand how a user benefits from the services we offer through our web pages, allowing us to improve website structure.

Concretely, Cookies are used for measurement, improvement and analytics features (e.g. confirmation of a certain level of traffic on a website, analysis of the type of content that is viewed, analysis of the manner in which a user reaches a website). Based on these Cookies, exclusively anonymous reports are generated concerning the use of our web page.

Name	Supplier	Purpose	Retention Policy	Third Party Policy
Google Analytics: ga, _gid, _utma, _utmx, _utmxx, _utmz, __gads, _gat_gtag_UA[id], SID	Google	These cookies collect information about how visitors interact with this site and to detect possible navigation issues. Google Analytics stores information about the pages visited, the duration of the site’s navigation, the way the site was visited, and the sections accessed within the pages. No personal information is stored, so this information cannot be used to identify the user. The site uses Google Analytics to be able to track whether the site meets user requirements and prioritize the improvement of the processes being carried out. Google provides more information about cookies on the Privacy Policy and Cookie Policy page. Google also provides an “add-on” that gives you the ability to quit Google Analytics regardless of the pages you visit.	Session	https://policies.google.com/privacy?hl=en
Facebook Tracking pixel, xs, datr	Facebook	It collects information about the interaction of the users that arrive on this website through Facebook links (page views, fill in Facebook login form, page actions like clicks on buttons).	Session	https://www.facebook.com/policies/cookies/

Advertising and Tracking Cookies

These cookies may be placed on your device directly by ourselves, or by our third-party service providers on our behalf. These cookies may remember that you visited our websites, your browsing activity on our website and the interests you expressed. We use such cookies to deliver content which is much more relevant to you and your interest. Furthermore, such cookies are used to deliver targeted advertising, to limit the number of times you see an advertisement and to measure the effectiveness of the advertising campaigns on our website and third-party websites.

Name	Supplier	Purpose	Retention Policy	Third-party Policy
BizoID, lang, lidc, bcookie, _ga, AMCVS_14215E3D5995C57C0A495C55%40AdobeOrg, liap, _lipt, UserMatchHistory, ELOQUA, sdsc	LinkedIn	LinkedIn insights and ads tags, used to store language preferences, potentially to serve up content in the stored language, enable LinkedIn sign-in functionality, track user behavior, gather LinkedIn advertising analytics.	6 months	https://www.linkedin.com/legal/cookie-policy
Facebook: c_user, datr, fr, pl, sb, spin, xs	Facebook	Facebook uses these cookies to collect user information and to manage the user’s login data to its network. This data can be used by Facebook to customize the advertising offered to the user.	Session	https://www.facebook.com/policies/cookies/
GPS	Google	Used by Google for Google Maps preferences	Session	https://policies.google.com/privacy
VISITOR_INFO1_LIVE, PREF, YSC	Google	Used by YouTube (Google) for storing user preferences and other unspecified purposes	Session	https://policies.google.com/privacy

Cookie management and deletion

You can restrict, block and remove cookies via your web browser settings. Generally, the web browser used to access web pages implicitly allows Cookie saving on the terminal. These settings can be changed in such a way that the automated management of cookies is blocked by the web browser or the user is informed each time Cookies are sent to their terminal. Detailed information on the possibilities and manners of managing Cookies can be found in the settings area of the app (web browser) and they vary depending on the type of browser that is used.

Please note that any limitation of Cookie use may affect certain web page functionalities. Furthermore, deactivating advertising/targeting Cookies would not prevent you from further receiving advertisements. However, such advertisements may not be relevant for your particular interests.

For more information on Cookies and how you can activate/deactivate them, you can access the following websites (available only in English) https://www.aboutcookies.org/ and http://www.youronlinechoices.com/ or you can check out the Help section from your web browser. Please note that the list of cookies provided on these websites will include all cookies placed on your terminal, not only those found on our website.

GDPR Compliance

The purpose of this page is to help you have a clear view of the legal implications when licensing one or more solutions from our Process Lab.

What is GDPR?

The General Data Protection Regulation (GDPR) is a legal framework that sets guidelines for the collection and processing of personal information of individuals within the European Union (EU). Article 5 of the GDPR sets out the six principles of data protection. These principles are the foundation of the GDPR and require that personal data is:

processed lawfully, fairly and in a transparent manner;
used for the purpose for which it was collected (and that purpose is expressly specified and legitimate);
relevant and limited to what is necessary in relation to the purposes for which they are processed;
accurate and, where necessary, kept up to date;
stored for no longer than is necessary for the purpose for which the personal data is processed; and
processed in a manner than protects the security and confidentiality of the personal data.

We operate within this framework, where the controller of the personal data is responsible to comply with the above six principles. Furthermore, the controller of the personal data will be required to demonstrate compliance with these principles, so it is important that appropriate policies are in place.

Privacy By Design & Privacy By Default

We implement technical and organizational measures at the earliest stages of the design of the processing operations, in such a way that safeguards privacy and data protection principles right from the start (‘data protection by design’). We ensure that personal data is processed with the highest privacy protection (for example only the data necessary is processed, short storage period, limited accessibility) so that by default personal data isn’t made accessible to an indefinite number of persons (‘data protection by default’).

Privacy by Design states that any action a company undertakes that involves processing personal data must be done with data protection and privacy in mind at every step. This includes internal projects, product development, software development, IT systems, and much more. In practice, this means that the IT department, or any department that processes personal data, must ensure that privacy is built in to a system during the whole life cycle of the system or process.

Privacy by Default means that once a product or service has been released to the public, the strictest privacy settings should apply by default, without any manual input from the end user. In addition, any personal data provided by the user to enable a product’s optimal use should only be kept for the amount of time necessary to provide the product or service. If more information than necessary to provide the service is processed, then “privacy by default” has been breached.

Data Controller / Data Processor Relation

The data controller determines the purposes for which and the means by which personal data is processed. So, if your company decides ‘why’ and ‘how’ the personal data should be processed it is the data controller.

Your company is a joint controller when together with one or more organizations it jointly determines ‘why’ and ‘how’ personal data should be processed. Joint controllers must enter into an arrangement setting out their respective responsibilities for complying with the GDPR rules. The main aspects of the arrangement must be communicated to the individuals whose data is being processed.

The data processor processes personal data only on behalf of the controller.

Specific to our solutions, the activities we undertake are legally framed as data processing for Omnichannel CRM, Location Based Marketing and Loyalty App and as joint controller for Ecosystem Analytics. The duties of the processor towards the controller and the joint controller role must be specified in a contract or another legal act. We propose specific Data Processing Agreements that clarifies the role of every company involved.

Data processing for marketing purposes

For the purposes of direct marketing, personal data are often gathered from the data subject (customer). For instance, when shopping for some items, an individual leaves his/her contact details and wishes to be notified about new merchandises.

Personal data must be processed legally and fairly, in an amount which is necessary to achieve the purpose of direct marketing. GDPR states that processed data must be adequate to the purpose and must be proportionate. Authenticity and accuracy of the data must be ensured. Data must be kept for a term which is required for achieving direct marketing purposes.

Direct marketing provider (the controller) is obliged to:

Provide complete information to the customer about the sources of data;
Provide the customer with its contact information;
Provide the customer with the opportunity to request termination of the use of data in a form, which is used for direct marketing and/or define available and adequate means for such a request (e.g. when sending a commercial notification, indicate telephone number or a website, where one can refuse to receive such notifications);
Take organizational or technical measures, which allow for protection of data from accidental or illegal destruction, amendment, disclosure, obtaining, any other form of illegal use or accidental or illegal loss.
Cease processing of customer’s personal data for direct marketing purposes at request (cease data processing even in case when direct marketing is carried out via advertising agencies), which includes deletion of data from the database and termination of notifications.

What is personal data?

Personal data is defined in the GDPR as: “‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person”.

The GDPR covers the processing of personal data in two ways:

personal data processed wholly or partly by automated means (information in electronic form) – that is our case
personal data processed in a non-automated manner which forms part of, or is intended to form part of, a ‘filing system’ (manual information in a filing system).

Examples of types of personal data collected in an electronic form by our tools:

Classic Data: Name, Surname, Date/Place of Birth, Address, Telephone, Profession, etc.
Digital Data: Email, Social Media Profiles, etc.
Sensible Data: Biometric Data (Photos of the user)

Legal ground for processing

There are six available lawful bases for processing. No single basis is ’better’ or more important than the others – which basis is most appropriate to use will depend on your purpose and relationship with the individual. You must determine your lawful basis before you begin processing, and you should document it. Take care to get it right first time – you should not swap to a different lawful basis at a later date without good reason. If you are processing special category data you need to identify both a lawful basis for general processing and an additional condition for processing this type of data.

Processing of personal is lawful if it is based on one of a limited the following legal grounds:

necessary for the purposes of legitimate interest pursued by the controller;
consent of the data subject;
processing is necessary for the performance of a contract with the data subject or to take steps preparatory to such a contract;
necessary for compliance with a legal obligation
necessary to protect the vital interests of a data subject or another person;
necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

For processing activities relating to special categories of data, different grounds are applicable. Processing of special categories of personal data must be based on one of a limited set of legal grounds:

explicit consent of the data subject;
necessary for carrying out obligations under employment, social security or social protection law, or a collective agreement;
necessary to protect the vital interests of a data subject or another individual where the data subject is physically or legally incapable of giving consent;
processing carried out by a not-for-profit body with a political, philosophical, religious or trade union aim provided the processing relates only to members or former members;
personal data manifestly made public by the data subject;
necessary for the establishment, exercise or defense of legal claims or where courts are acting in their judicial capacity;
necessary for reasons of substantial public interest;
necessary for the purposes of preventative or occupational medicine, for assessing the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or management of health or social care systems and services or a contract with a health professional;
necessary for reasons of public interest in the area of public health;
necessary for archiving purposes in the public interest, or scientific and historical research purposes or statistical purposes.

Sharing the data with third party apps

At this moment we use three types of integrations:

Integration with client owned digital properties (websites, loyalty apps, other data collectors)
Integration with direct marketing apps that are delivering emails and SMS messages to clients (Telcor & Campaign Monitor)
Integration for remarketing and reporting purposes with Facebook, Google and LinkedIn services (through Process Lab App or API).