Data Protection Information for Business Partners of Applause App Quality UK Ltd.
In connection with our business activities we, Applause App Quality UK Ltd., process personal data of our potential business partners (leads), our existing business partners and their employees.
The protection of personal data is important to us. We process personal data only in accordance with the applicable data protection requirements, in particular the UK General Data Protection Regulation (UK GDPR).
In Section A of this Data Protection Information we provide you with information about the controller responsible for the processing of your personal data and the controller’s data protection officer.
In Section B we provide you with information about the processing of your personal data.
In Section C we also provide you with information about your rights regarding the processing of your personal data.
The technical data protection terms used in this Data Protection Information have the meanings used in UK GDPR. You will find more detailed information on this in Section D.
TABLE OF CONTENTS
A. Information on the controller
I. Identity and contact details of the controller
II. Contact details of the controller’s data protection officer
B. Information on the processing of personal data of potential business partners (leads), our existing business partners and their employees.
I. Details on personal data which are processed.
II. Details on the processing of personal data.
III. Details on the recipients of personal data and the transfer of personal data to third countries and/or international organisations.
C. Information on the rights of data subjects.
I. Right of access.
II. Right to rectification.
III. Right to erasure (“right to be forgotten”)
IV. Right to restriction of processing.
V. Right to data portability.
VI. Right to object
VII. Right to withdraw consent
VIII. Right to lodge a complaint with a supervisory authority.
D. Information about the technical terms of the General Data Protection Regulation used in this Data Protection Information.
E. Effective date and changes to this Data Protection Information.
A. Information on the controller
I. Identity and contact details of the controller
Applause App Quality UK Ltd.
3rd Floor, 12 Gough Square, London, England, EC4A 3DW
EMAIL: Jan Wolter at jwolter@applause.com
PHONE: +49 30 57700400
II. Contact details of the controller’s data protection officer
Applause Data Protection Officer
c/o Applause GmbH, Obentrautstr. 72, 10963 Berlin, Deutschland
PrivacyDPO@applause.com
+49 (0)30 57700400
B. Information on the processing of personal data of potential business partners (leads), our existing business partners and their employees
In connection with our business activities, we process the personal data of potential business partners (leads), our existing business partners and their employees.
Business partners are all natural or legal persons with which we maintain business relations. These in particular include our customers, suppliers and distribution partners. Data of our business partners can be personal data if the business partners are natural persons. Personal data are also data concerning employees of our business partners.
We process data of potential business partners (leads), our existing business partners and their employees for the following purposes:
- Determination of potential business partners (leads) and initiation of business relationships,
- taking steps prior to entering into a contract, including pre-contractual communication and preparation of offers,
- performance of contracts with our business partners, including invoicing and payment processing,
- provision of the web-based Applause platform for the performance of contracts with our customers, in particular for our contractual communication between our customers, our testers and us in the context of our Applause community testing and quality services,
- ensuring the security of the IT infrastructure used for the provision of the web-based Applause platform, in particular for the detection, elimination and conclusive documentation of faults (e.g. DDoS attacks),
- proper accounting and document retention in order to comply with statutory, in particular commercial and tax law document retention obligations, as well as for evidence purposes for the establishment, exercise and defence of legal claims,
- establishment, exercise or defence of legal claims, including cooperation with external lawyers,
- cooperation with external tax advisors and/or public accountants in order to comply with statutory obligations,
- cooperation with supervisory authorities, courts and other public bodies in order to comply with statutory obligations,
- business relationship management, including establishing contact to our business partners and maintaining the relationship with our business partners and adapting our services to the needs and wishes of our business partners.
You receive more detailed information on this below:
[For a multi-layer presentation of the information (“layered information”), the following information may be hidden in the first layer]
I. Details on personal data which are processed
| Categories of personal data processed | Personal data included in the categories | Sources of data | Obligation to provide the data | Storage duration |
|---|---|---|---|---|
| Lead data. | Company name, industry, name function and business contact details (address, e-mail address, telephone number) of lead. | Leads. | Provision is not a statutory or contractual requirement, or a requirement necessary to enter into a contract. There is no obligation to provide the data. However, if the data is not provided, it may not be possible to initiate a business relationship. | We store the data until the purpose of processing these data specified below has been achieved. We also store these data if any statutory, in particular commercial and tax law document retention obligations exists. Depending on the document type, document retention requirements under commercial or tax law is generally up to seven years in the UK, and where applicable can be between six and ten years (sec. 147 German Tax Code (Abgabenordnung – AO), sec. § 257 German Commercial Code (Handelsgesetzbuch – HGB). |
| Lead data. | Company name, industry, name function and business contact details (address, e-mail address, telephone number) of lead. | (Existing) business partners, other third parties, publicly accessible sources (e.g. websites, trade directories). | - | We store the data until the purpose of processing these data specified below has been achieved. We also store these data if any statutory, in particular commercial and tax law document retention obligations exists. Depending on the document type, document retention requirements under commercial or tax law is generally up to seven years in the UK, and where applicable can be between six and ten years (sec. 147 German Tax Code (Abgabenordnung – AO), sec. § 257 German Commercial Code (Handelsgesetzbuch – HGB). |
| Master data. | Company name, register number, VAT ID number, Business Identification Number, industry of our business partners. | Business partners. | Provision is not a statutory or contractual requirement, or a requirement necessary to enter into a contract. There is no obligation to provide the data. However, if the data is not provided, it may not be possible to enter into or fulfil a contract. | We store the data until the purpose of processing these data specified below has been achieved. We also store these data if any statutory, in particular commercial and tax law document retention obligations exists. Depending on the document type, document retention requirements under commercial or tax law is generally up to seven years in the UK, and where applicable can be between six and ten years (sec. 147 German Tax Code (Abgabenordnung – AO), sec. § 257 German Commercial Code (Handelsgesetzbuch – HGB). |
| Master data. | Customer number(s), supplier number(s) or our business partners. | Generated by us. | - | We store the data until the purpose of processing these data specified below has been achieved. We also store these data if any statutory, in particular commercial and tax law document retention obligations exists. Depending on the document type, document retention requirements under commercial or tax law is generally up to seven years in the UK, and where applicable can be between six and ten years (sec. 147 German Tax Code (Abgabenordnung – AO), sec. § 257 German Commercial Code (Handelsgesetzbuch – HGB). |
| Contact data. | Name, function and business contact data (address, e-mail address, telephone number, fax number) of the contact persons at our business partners. | Business partners. | Provision is not a statutory or contractual requirement, or a requirement necessary to enter into a contract. There is no obligation to provide the data. However, if the data is not provided, it may not be possible to enter into or fulfil a contract. | We store the data until the purpose of processing these data specified below has been achieved. We also store these data if any statutory, in particular commercial and tax law document retention obligations exists. Depending on the document type, document retention requirements under commercial or tax law is generally up to seven years in the UK, and where applicable can be between six and ten years (sec. 147 German Tax Code (Abgabenordnung – AO), sec. § 257 German Commercial Code (Handelsgesetzbuch – HGB). |
| Bank account data. | Account holder, bank, IBAN, BIC of our business partners. | Business partners. | Provision is not a statutory or contractual requirement, or a requirement necessary to enter into a contract. There is no obligation to provide the data. However, if the data is not provided, it may not be possible to enter into or fulfil a contract. | We store the data until the purpose of processing these data specified below has been achieved. We also store these data if any statutory, in particular commercial and tax law document retention obligations exists. Depending on the document type, document retention requirements under commercial or tax law is generally up to seven years in the UK, and where applicable can be between six and ten years (sec. 147 German Tax Code (Abgabenordnung – AO), sec. § 257 German Commercial Code (Handelsgesetzbuch – HGB). |
| Communication data. | Content of business communication with our business partners, in particular by our web-based Applause platform, e-mail, post, fax, telephone. | Business partners. | Provision is not a statutory or contractual requirement, or a requirement necessary to enter into a contract. There is no obligation to provide the data. However, if the data is not provided, it may not be possible to enter into or fulfil a contract. | We store the data until the purpose of processing these data specified below has been achieved. We also store these data if any statutory, in particular commercial and tax law document retention obligations exists. Depending on the document type, document retention requirements under commercial or tax law is generally up to seven years in the UK, and where applicable can be between six and ten years (sec. 147 German Tax Code (Abgabenordnung – AO), sec. § 257 German Commercial Code (Handelsgesetzbuch – HGB). |
| Communication data. | Circumstances of business communication with our business partners, in particular those involved, time and duration. | Generated by us. | - | We store the data until the purpose of processing these data specified below has been achieved. We also store these data if any statutory, in particular commercial and tax law document retention obligations exists. Depending on the document type, document retention requirements under commercial or tax law is generally up to seven years in the UK, and where applicable can be between six and ten years (sec. 147 German Tax Code (Abgabenordnung – AO), sec. § 257 German Commercial Code (Handelsgesetzbuch – HGB). |
| Applause platform http data | Protocol data which accrue when using our web-based Applause platform via the Hypertext Transfer Protocol (Secure) (HTTP(S)) for technical reasons. These include IP address, type and version of your internet browser, operating system used, last site accessed before visiting the site (referrer URL), date and time of visit. | User of the web-based Applause platform. | Provision is not a statutory or contractual requirement, or a requirement necessary to enter into a contract. There is no obligation to provide the data. If the data is not provided, we cannot provide our web-based Applause platform. | We store the data until the purpose of processing these data specified below has been achieved. Data are stored in server log files in a form allowing the identification of data subject for a maximum period of 14 days, unless any security related event occurs (e.g. a DDoS attack). If there is a security related event, server log files are stored until the security relevant event has been eliminated and resolved in full. |
| Applause platform login data | Login data which is used for accessing our web-based Applause platform. These include usernames (e-mail address) and password. | User of the web-based Applause platform. | Provision is not a statutory or contractual requirement, or a requirement necessary to enter into a contract. There is no obligation to provide the data. If the data is not provided, we cannot provide our web-based Applause platform. | We store the data until the purpose of processing these data specified below has been achieved. Data are stored in server log files in a form allowing the identification of data subject for a maximum period of 12 months unless any security related event occurs (e.g. a DDoS attack). If there is a security related event, server log files are stored until the security relevant event has been eliminated and resolved in full. |
| Contract data. | Information we receive from our business partners in order to take steps prior to entering into a contract and/or to fulfil contracts with our business partners. | Business partners. | Provision is not a statutory or contractual requirement, or a requirement necessary to enter into a contract. There is no obligation to provide the data. However, if the data is not provided, it may not be possible to enter into or fulfil a contract. | We store the data until the purpose of processing these data specified below has been achieved. We also store these data if any statutory, in particular commercial and tax law document retention obligations exists. Depending on the document type, document retention requirements under commercial or tax law is generally up to seven years in the UK, and where applicable can be between six and ten years (sec. 147 German Tax Code (Abgabenordnung – AO), sec. § 257 German Commercial Code (Handelsgesetzbuch – HGB). |
| Contract data. | Data from written (including electronic) contract documents that we receive from our business partners. | Business partners. | Provision is not a statutory or contractual requirement, or a requirement necessary to enter into a contract. There is no obligation to provide the data. However, if the data is not provided, it may not be possible to enter into or fulfil a contract. | We store the data until the purpose of processing these data specified below has been achieved. We also store these data if any statutory, in particular commercial and tax law document retention obligations exists. Depending on the document type, document retention requirements under commercial or tax law is generally up to seven years in the UK, and where applicable can be between six and ten years (sec. 147 German Tax Code (Abgabenordnung – AO), sec. § 257 German Commercial Code (Handelsgesetzbuch – HGB). |
| Contract data. | Information that we may receive from third parties in order to take pre-contractual steps and/or to fulfil contracts with our business partners. | Third parties. | - | We store the data until the purpose of processing these data specified below has been achieved. We also store these data if any statutory, in particular commercial and tax law document retention obligations exists. Depending on the document type, document retention requirements under commercial or tax law is generally up to seven years in the UK, and where applicable can be between six and ten years (sec. 147 German Tax Code (Abgabenordnung – AO), sec. § 257 German Commercial Code (Handelsgesetzbuch – HGB). |
| Contract data. | Data from written (including electronic) contract documents that we create. | Generated by us. | - | We store the data until the purpose of processing these data specified below has been achieved. We also store these data if any statutory, in particular commercial and tax law document retention obligations exists. Depending on the document type, document retention requirements under commercial or tax law is generally up to seven years in the UK, and where applicable can be between six and ten years (sec. 147 German Tax Code (Abgabenordnung – AO), sec. § 257 German Commercial Code (Handelsgesetzbuch – HGB). |
| Invoice data. | Data from invoices and payment reminders that we receive from our business partners, in particular date, invoice items and invoice amounts. | Business partners. | Provision is not a statutory or contractual requirement, or a requirement necessary to enter into a contract. There is no obligation to provide the data. However, if the data is not provided, invoicing may not be possible. | We store the data until the purpose of processing these data specified below has been achieved. We also store these data if any statutory, in particular commercial and tax law document retention obligations exists. Depending on the document type, document retention requirements under commercial or tax law is generally up to seven years in the UK, and where applicable can be between six and ten years (sec. 147 German Tax Code (Abgabenordnung – AO), sec. § 257 German Commercial Code (Handelsgesetzbuch – HGB). |
| Invoice data. | Data that we generate automatically for invoicing purposes, in particular the content of internal time records and activity reports. | Generated by us. | - | We store the data until the purpose of processing these data specified below has been achieved. We also store these data if any statutory, in particular commercial and tax law document retention obligations exists. Depending on the document type, document retention requirements under commercial or tax law is generally up to seven years in the UK, and where applicable can be between six and ten years (sec. 147 German Tax Code (Abgabenordnung – AO), sec. § 257 German Commercial Code (Handelsgesetzbuch – HGB). |
| Invoice data. | Data from invoices and payment reminders that we create, in particular data, invoice items and invoice amounts. | Generated by us. | - | We store the data until the purpose of processing these data specified below has been achieved. We also store these data if any statutory, in particular commercial and tax law document retention obligations exists. Depending on the document type, document retention requirements under commercial or tax law is generally up to seven years in the UK, and where applicable can be between six and ten years (sec. 147 German Tax Code (Abgabenordnung – AO), sec. § 257 German Commercial Code (Handelsgesetzbuch – HGB). |
| Payment data. | Data concerning payment processes, in particular data and payment amounts. | Generated by us. | - | We store the data until the purpose of processing these data specified below has been achieved. We also store these data if any statutory, in particular commercial and tax law document retention obligations exists. Depending on the document type, document retention requirements under commercial or tax law is generally up to seven years in the UK, and where applicable can be between six and ten years (sec. 147 German Tax Code (Abgabenordnung – AO), sec. § 257 German Commercial Code (Handelsgesetzbuch – HGB). |
| Record data. | Data from records concerning the business content of appointments and meetings with our business partners that we prepare for the maintenance of the business relationship. | Generated by us. | - | We store the data until the purpose of processing these data specified below has been achieved. We also store these data if any statutory, in particular commercial and tax law document retention obligations exists. Depending on the document type, document retention requirements under commercial or tax law is generally up to seven years in the UK, and where applicable can be between six and ten years (sec. 147 German Tax Code (Abgabenordnung – AO), sec. § 257 German Commercial Code (Handelsgesetzbuch – HGB). |
| Analysis data. | Data from analyses of the business structure of the companies of our business partners that we prepare for the strategic alignment of our business relationships. | Generated by us. | - | We store the data until the purpose of processing these data specified below has been achieved. We also store these data if any statutory, in particular commercial and tax law document retention obligations exists. Depending on the document type, document retention requirements under commercial or tax law is generally up to seven years in the UK, and where applicable can be between six and ten years (sec. 147 German Tax Code (Abgabenordnung – AO), sec. § 257 German Commercial Code (Handelsgesetzbuch – HGB). |
| Survey data. | Responses to our surveys for the voluntary assessment of the business relationship from the business partner’s perspective. | Business partners. | Provision is not a statutory or contractual requirement, or a requirement necessary to enter into a contract. There is no obligation to provide the data. If the data is not provided, we will not be able to take any survey results of this business partner into account. This does not otherwise affect the business relationship. | We store the data until the purpose of processing these data specified below has been achieved. We also store these data if any statutory, in particular commercial and tax law document retention obligations exists. Depending on the document type, document retention requirements under commercial or tax law is generally up to seven years in the UK, and where applicable can be between six and ten years (sec. 147 German Tax Code (Abgabenordnung – AO), sec. § 257 German Commercial Code (Handelsgesetzbuch – HGB). |
II. Details on the processing of personal data
| Purpose of processing the personal data | Categories of personal data processed | Automated decision-making | Legal basis and, where applicable, legitimate interests | Recipient |
|---|---|---|---|---|
| Determination of potential business partners (leads) and initiation of business relationships, including establishing initial contact with the objective of establishing a business relationship. Depending on the potential business partners, we may cooperate with other Applause companies for these purposes. | Lead data. | No automated decision-making takes place. | The legal basis for the determination of potential business partners and the initiation of business relationships is in principle a balancing of interests Article 6 paragraph 1 point (f) of the UK General Data Protection Regulation (balancing of interests).Our legitimate interest is the establishment of new business relationships. The legal basis for establishing contact with leads can, depending on the circumstances of the relevant individual case, in particular the type of initial contact with the relevant lead, either be Article 6 paragraph 1 point (a) of the UK General Data Protection Regulation (Consent), Article 6 paragraph 1 point (b) of the UK General Data Protection Regulation (performance of a contract to which the data subject is party or taking steps at the request of the data subject prior to entering into a contract) or Article 6 paragraph 1 point (f) of the UK General Data Protection Regulation (balancing of interests). Our legitimate interest is the establishment of new business relationships. | Applause, Inc., Applause Germany, Customer relationship management services provider, Communication and collaboration services provider. |
| Taking steps prior to entering into a contract, including pre-contractual communication and preparation of offers. Depending on the scope of the services, we may cooperate with other Applause companies for these purposes. | Master data, contact data, communication data, contract data. | No automated decision-making takes place. | If the data subject is our (potential) business partner, the legal basis is Article 6 paragraph 1 point (b) of the UK General Data Protection Regulation (performance of a contract to which the data subject is party or taking steps at the request of the data subject prior to entering into a contract).If the data subject is not our (potential) business partner, the legal basis is Article 6 paragraph 1 point (f) of the UK General Data Protection Regulation (balancing of interests). Our legitimate interest is taking steps prior to entering into a contract at the request of our (potential) business partner. | Applause, Inc., Applause Germany, Customer relationship management services provider, Communication and collaboration services provider Shipping services providers. |
| Performance of contracts with our business partners, including contractual communication, exchange of services, invoicing and payment processing. Depending on the scope of the services, we may cooperate with other Applause companies for the performance of contracts with our business partners. | Master data, contact data, bank account data, communication data, contract data, invoice data, payment data. | No automated decision-making takes place. | If the data subject is our business partner, the legal basis is Article 6 paragraph 1 point (b) of the UK General Data Protection Regulation (performance of a contract to which the data subject is party or taking steps at the request of the data subject prior to entering into a contract). If the data subject is not our business partner, the legal basis is Article 6 paragraph 1 point (f) of the UK General Data Protection Regulation (balancing of interests).Our legitimate interest is the performance of the contract with our business partner. | Applause, Inc., Applause Germany, Customer relationship management services provider, Communication and collaboration services provider Shipping services providers, Invoicing and payment processing service providers, Bank. |
| Provision of the web-based Applause platform for the performance of contracts with our customers, in particular for our contractual communication between our customers, our testers and us in the context of our Applause community testing and quality services. | Applause Platform Http data, Applause Platform login data, communication data. | No automated decision-making takes place. | If the data subject is our business partner, the legal basis is Article 6 paragraph 1 point (b) of the UK General Data Protection Regulation (performance of a contract to which the data subject is party or taking steps at the request of the data subject prior to entering into a contract). If the data subject is not our business partner, the legal basis is Article 6 paragraph 1 point (f) of the UK General Data Protection Regulation (balancing of interests).Our legitimate interest is the performance of the contract with our business partner. | Hosting services provider. |
| Ensuring the security of the IT infrastructure used for the provision of the web-based Applause platform, in particular for the detection, elimination and conclusive documentation of faults (e.g. DDoS attacks). | Applause Platform Http data, Applause Platform login data, communication data. | No automated decision-making takes place. | Article 6 paragraph 1 point (f) of the UK General Data Protection Regulation (balancing of interests). Our legitimate interest is the security of the IT infrastructure used for the provision of the web-based Applause platform. | Hosting services provider. |
| Proper accounting and document retention in order to comply with contractual and statutory, in particular commercial and tax law document retention obligations. | Master data, contact data, bank account data, communication data, contract data, invoice data, payment data. | No automated decision-making takes place. | Article 6 paragraph 1 point (c) of the UK General Data Protection Regulation (Compliance with a legal obligation), in particular compliance with statutory requirements for proper accounting and statutory, in particular professional, commercial and tax law document retention obligations. If the data subject is our business partner, the legal basis is Article 6 paragraph 1 point (b) of the UK General Data Protection Regulation (performance of a contract to which the data subject is party or taking steps at the request of the data subject prior to entering into a contract). If the data subject is not our business partner, the legal basis is also Article 6 paragraph 1 point (f) of the UK General Data Protection Regulation (balancing of interests).Our legitimate interest is the performance of the contract with our business partner. | Accounting services providers. |
| Document retention for evidence purposes for the establishment, exercise and defence of legal claims. | Master data, contact data, bank account data, communication data, contract data, record data, invoice data, payment data. | No automated decision-making takes place. | Article 6 paragraph 1 point (f) of the UK General Data Protection Regulation (balancing of interests). Our legitimate interest is the establishment, exercise or defence of legal claims. | Accounting services providers, Customer relationship management services provider, Communication and collaboration services provider. |
| Establishment, exercise or defence of legal claims, including cooperation with external lawyers. | Master data, contact data, bank account data, communication data, contract data, invoice data, payment data. | No automated decision-making takes place. | Article 6 paragraph 1 point (f) of the UK General Data Protection Regulation (balancing of interests). Our legitimate interest is the establishment, exercise or defence of legal claims. | Courts, lawyers. |
| Cooperation with external tax advisors and/or public accountants in order to comply with statutory obligations. | Master data, contact data, bank account data, communication data, contract data, invoice data, payment data. | No automated decision-making takes place. | Article 6 paragraph 1 point (c) of the UK General Data Protection Regulation (Compliance with a legal obligation). | Tax advisors, public accountants. |
| Cooperation with supervisory authorities, courts and other public bodies in order to comply with statutory obligations. | Master data, contact data, bank account data, communication data, contract data, invoice data, payment data. | No automated decision-making takes place. | Article 6 paragraph 1 point (c) of the UK General Data Protection Regulation (Compliance with a legal obligation). | Supervisory authorities, courts and other public bodies. |
| Business relationship management, including establishing contact to inform our business partners and maintaining the relationship with our business partners and adapting our services to the needs and wishes of our business partners. Depending on the business partners, we may cooperate with other Applause companies for these purposes. | Master data, contact data, communication data, contract data, record data, analysis data, survey data. | No automated decision-making takes place. | The legal basis for the business relationship management is in principle Article 6 paragraph 1 point (f) of the UK General Data Protection Regulation (balancing of interests). Our legitimate interest is the maintenance and strategic alignment of the relationship with our business partners and the adapting of our services to the needs and wishes of our business partners. The legal basis for establishing contact to inform our business partners can, depending on the circumstances of the individual case, in particular the type of contact, either be Article 6 paragraph 1 point (a) of the UK General Data Protection Regulation (Consent) or Article 6 paragraph 1 point (f) of the UK General Data Protection Regulation (balancing of interests). Our legitimate interest is informing our business partners. | Customer relationship management services provider, Communication and collaboration services provider, Survey services provider. |
III. Details on the recipients of personal data and the transfer of personal data to third countries and/or international organisations
| Recipient | Recipient’s role | Recipient’s location | Adequacy decision or appropriate or suitable safeguards for transfers to third countries and/or international organisations |
|---|---|---|---|
| Applause App Quality, Inc. 100 Pennsylvania Ave., Framingham MA 01701 United States | Controller. | US. | There is no UK adequacy decision for the third countries in question. Transfers to the third countries in question take place on the basis of standard contractual clauses of the European Commission for the transfer of personal data to processors in third countries. You can obtain the European Commission's decision on standard contractual clauses here: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32010D0087 A copy of the standard contractual clauses can be obtained from our Data Protection Officer (Section A.III.). |
| Applause Germany: Applause GmbH Obentrautstr. 72 10963 Berlin Germany | Controller. | Germany. | -The UK adequacy decision in respect of EEA countries. |
| Tax advisors. | Controller. | UK. | - |
| Banks. | Controller. | UK. | - |
| Lawyers. | Controller. | UK. | - |
| Public accountants. | Controller. | UK. | - |
| Supervisory authorities, courts and other public bodies. | Controller. | UK. | - |
| Shipping services providers. | Controller. | UK. | - |
| Hosting services provider: Applause App Quality, Inc. 100 Pennsylvania Ave., Framingham MA 01701 United States Subcontractor: Amazon Web Services, Inc. 410 Terry Avenue North Seattle WA 98109 United States | Processor. | US. | There is no UK adequacy decision for the third countries in question. Transfers to the third countries in question take place on the basis of standard contractual clauses of the European Commission for the transfer of personal data to processors in third countries. You can obtain the European Commission's decision on standard contractual clauses here: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32010D0087 A copy of the standard contractual clauses can be obtained from our Data Protection Officer (Section A.III.). |
| Accounting services provider: Applause App Quality, Inc. 100 Pennsylvania Ave., Framingham MA 01701 United States Subcontractor: NetSuite Inc. 2955 Campus Drive Suite 100 San Mateo, CA 94403 United States | Processor. | US. | There is no UK adequacy decision for the third countries in question. Transfers to the third countries in question take place on the basis of standard contractual clauses of the European Commission for the transfer of personal data to processors in third countries. You can obtain the European Commission's decision on standard contractual clauses here: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32010D0087 A copy of the standard contractual clauses can be obtained from our Data Protection Officer (Section A.III.). |
| Customer relationship management services provider: Applause App Quality, Inc. 100 Pennsylvania Ave., Framingham. MA 01701 United States Salesforce.com, Inc. The Landmark @ One Market Suite 300, San Francisco CA 94105 United States Marketo, Inc. 901 Mariners Island Boulevard, Suite #500 (Reception), San Mateo CA 94404 United States Gainsight 655 Montgomery St, 7th Floor, San Francisco CA 94111 United States | Processor. | US. | There is no UK adequacy decision for the third countries in question. Transfers to the third countries in question take place on the basis of standard contractual clauses of the European Commission for the transfer of personal data to processors in third countries. You can obtain the European Commission's decision on standard contractual clauses here: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32010D0087 A copy of the standard contractual clauses can be obtained from our Data Protection Officer (Section A.III.). |
| Communication and collaboration services provider: Applause App Quality, Inc. 100 Pennsylvania Ave., Framingham MA 01701 United States Subcontractor: Google LLC 1600 Amphitheatre Parkway, Mountain View CA 94043 United States | Processor. | US. | There is no UK adequacy decision for the third countries in question. Transfers to the third countries in question take place on the basis of standard contractual clauses of the European Commission for the transfer of personal data to processors in third countries. You can obtain the European Commission's decision on standard contractual clauses here: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32010D0087 A copy of the standard contractual clauses can be obtained from our Data Protection Officer (Section A.III.). |
| Survey services provider: Applause App Quality, Inc. 100 Pennsylvania Ave., Framingham MA 01701 United States Subcontractor: Qualtrics LLC 2250 N. University Pkwy, 48-C, Provo Utah 84604 United States | Processor. | US. | There is no UK adequacy decision for the third countries in question. Transfers to the third countries in question take place on the basis of standard contractual clauses of the European Commission for the transfer of personal data to processors in third countries. You can obtain the European Commission's decision on standard contractual clauses here: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32010D0087 A copy of the standard contractual clauses can be obtained from our Data Protection Officer (Section A.III.). |
C. Information on the rights of data subjects
As a data subject, you have the following rights with regard to the processing of your personal data:
- Right of access (Article 15 of UK GDPR)
- Right to rectification (Article 16 of UK GDPR)
- Right to erasure (“right to be forgotten”) (Article 17 of UK GDPR)
- Right to restriction of processing (Article 18 of UK GDPR)
- Right to data portability (Article 20 of UK GDPR)
- Right to object (Article 21 of UK GDPR)
- Right to withdraw consent (Article 7 paragraph 3 of UK GDPR)
- Right to lodge a complaint with a supervisory authority (Article 77 of UK GDPR)
You may contact us for the purpose of exercising your rights using the contact information in Section A.
Information on any specific modalities and mechanisms that may facilitate the exercise of your rights, in particular to exercise your rights to data transferability and objection, may be found in the information on the processing of personal data in Section B of this Data Protection Information and in other specific data protection information.
Below you find more detailed information on your rights with regard to the processing of your personal data:
[For a multi-layer presentation of the information (“layered information”), the following information may be hidden at the first layer]
I. Right of access
As a data subject, you have a right to obtain access and information under the conditions provided in Article 15 of UK GDPR.
This means in particular that you have the right to obtain confirmation from us as to whether we are processing your personal data. If so, you also have the right to obtain access to the personal data and the information listed in Article 15 paragraph 1 of UK GDPR. This includes information regarding the purposes of the processing, the categories of personal data that are being processed and the recipients or categories of recipients to whom the personal data have been or will be disclosed (Article 15 paragraph 1 points (a), (b) and (c) of UK GDPR).
II. Right to rectification
As a data subject, you have the right to rectification under the conditions provided in Article 16 of UK GDPR.
This means in particular that you have the right to receive from us without undue delay the rectification of inaccuracies in your personal data and completion of incomplete personal data.
III. Right to erasure (“right to be forgotten”)
As a data subject, you have a right to erasure (“right to be forgotten”) under the conditions provided in Article 17 of UK GDPR.
This means that you have the right to obtain from us the erasure of your personal data and we are obliged to erase your personal data without undue delay when one of the reasons listed in Article 17 paragraph 1 of UK GDPR applies. This can be the case, for example, if personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed (Article 17 paragraph 1 point (a) of UK GDPR).
If we have made the personal data public and are obliged to erase it, we are also obliged, taking account of available technology and the cost of implementation, to take reasonable steps, including technical measures, to inform controllers which are processing the personal data that you have requested the erasure by such controllers of any links to, or copy or replication of those personal data (Article 17 paragraph 2 of UK GDPR) .
The right to erasure (“right to be forgotten”) does not apply if the processing is necessary for one of the reasons listed in Article 17 paragraph 3 of UK GDPR. This can be the case, for example, if the processing is necessary for compliance with a legal obligation or for the establishment, exercise or defence of legal claims (Article 17 paragraph 3 points (b) and (e) of UK GDPR).
IV. Right to restriction of processing
As a data subject, you have a right to restriction of processing under the conditions provided in Article 18 of UK GDPR.
This means that you have the right to obtain from us the restriction of processing if one of the conditions provided in Article 18 paragraph 1 of UK GDPR applies. This can be the case, for example, if you contest the accuracy of the personal data. In such a case, the restriction of processing lasts for a period that enables us to verify the accuracy of the personal data (Article 18 paragraph 1 point (a) of UK GDPR).
Restriction means that stored personal data are marked with the goal of restricting their future processing (Article 4 paragraph 3 of UK GDPR).
V. Right to data portability
As a data subject, you have a right to data portability under the conditions provided in Article 20 of UK GDPR.
This means that you generally have the right to receive your personal data with which you have provided us in a structured, commonly used and machine-readable format and to transmit those data to another controller without hindrance from us if the processing is based on consent pursuant to Article 6 paragraph 1 point (a) or Article 9 paragraph 2 point (a) of UK GDPR or on a contract pursuant to Article 6 paragraph 1 point (b) of UK GDPR and the processing is carried out by automated means (Article 20 paragraph 1 of UK GDPR).
You can find information as to whether an instance of processing is based on consent pursuant to Article 6 paragraph 1 point (a) or Article 9 paragraph 2 point (a) of UK GDPR or on a contract pursuant to point (b) of Article 6 paragraph 1 of UK GDPR in the information regarding the legal basis of processing in Section B of this Data Protection Information.
In exercising your right to data portability, you also generally have the right to have your personal data transmitted directly from us to another controller if technically feasible (Article 20 paragraph 2 of UK GDPR).
VI. Right to object
As a data subject, you have a right to object under the conditions provided in Article 21 of UK GDPR.
At the latest in our first communication with you, we expressly inform you of your right, as a data subject, to object.
More detailed information on this is given below:
1. Right to object on grounds relating to the particular situation of the data subject
As a data subject, you have the right to object, on grounds relating to your particular situation, at any time to processing of your personal data which is based on point (e) or (f) of Article 6 paragraph 1, including profiling based on those provisions.
You can find information as to whether an instance of processing is based on point (e) or (f) of Article 6 paragraph 1 of UK GDPR in the information regarding the legal basis of processing in Section B of this Data Protection Information.
In the event of an objection relating to your particular situation, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.
2. Right to object to direct marketing
Where your personal data are processed for direct marketing purposes, you have the right to object at any time to processing of your personal data for such marketing, which includes profiling to the extent that it is related to such direct marketing.
You can find information as to whether and to what extent personal data are processed for direct marketing purposes in the information regarding the legal basis of processing in Section C of this Data Protection Information.
If you object to processing for direct marketing purposes, we no longer process your personal data for these purposes.
VII. Right to withdraw consent
Where an instance of processing is based on consent pursuant to Article 6 paragraph 1 point (a) or Article 9 paragraph 2 point (a) of UK GDPR, as a data subject, you have the right, pursuant to Article 7 paragraph 3 of UK GDPR, to withdraw your consent at any time. The withdrawal of your consent does not affect the legitimacy of the processing that occurred based on your consent until the withdrawal. We inform you of this before you grant your consent.
You can find information as to whether an instance of processing is based on Article 6 paragraph 1 point (a) or Article 9 paragraph 2 point (a) of UK GDPR in the information regarding the legal basis of processing in Section B of this Data Protection Information.
VIII. Right to lodge a complaint with a supervisory authority
As a data subject, you have a right to lodge a complaint with a supervisory authority under the conditions provided in Article 77 of UK GDPR.
The supervisory authority responsible for us is:
The Information Commissioner’s Office
D. Information about the technical terms of UK GDPR used in this Data Protection Information
The technical terms relating to data protection used in this Data Protection Information have the meaning used in UK GDPR.
You will find more detailed information on the most important technical terms of UK GDPR used in this Data Protection Information below:
Anlage 1 [For a multi-layer presentation of the information (“layered information”), the following information may be hidden at the first layer]
“Personal data” means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
“Data Subject” means the respective identified or identifiable natural person, to which the personal Data refers to;
“Processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
“Profiling” means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements;
“Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;
“Processor” means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;
“Recipient” means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing;
“Third party” means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data;
“International organisation” means an organisation and its subordinate bodies governed by public international law, or any other body which is set up by, or on the basis of, an agreement between two or more countries;
“Third country” means a country which is outside the UK;
“Special categories of personal data” means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.
E. Effective date and changes to this Data Protection Information
The effective date of this Data Protection Information is 22 April 2021.
It may be necessary to modify this Data Protection Information due to technical developments and/or amendment of statutory or official requirements.
An up-to-date version of this Data Protection Information can be retrieved at any time at https://www.applause.com/documents/Data-Protection-Information-for-Business-Partners-of-Applause.pdf.