Data Protection Policy

  1. Introduction

The Oregon RFID EU GmbH (“Oregon RFID EU”, “we”, “our” or “us”) is committed to ensure compliance with applicable data protection laws and regulations. This Data Protection Policy (“Policy”) is based on the principles and requirements of the EU General Data Protection Regulation (“GDPR”). By means of this Policy we would like to inform you, the data subject, about how and why we collect, process and use personal data, and about your rights as a data subject in regard to the processing of your personal data.

  1. Scope and Supplement

This Policy applies to all companies, dependent group companies, affiliated companies, offices and business units of Oregon RFID EU. This Policy covers all forms of processing of personal data. It describes how Oregon RFID EU collects, uses, and shares personal data obtained directly from the user, customer, supplier, business partner, or other, or obtained indirectly from other sources. It applies to the processing of personal data obtained through any channel of communication or by any means, including but not limited to email, file transfer, feeding personal data into applications and tools, websites or mobile apps, social media pages and platforms.

This Policy may be supplemented by specific data protection and privacy notices and statements that relate to specific forms or purposes of data processing. Anonymized data (non-personal data), e.g. for statistical evaluations or studies, is not subject to this Policy.

In countries where the data of legal entities is protected to the same extent as personal data, this Policy applies equally to data of legal entities.

  1. Application of national laws

While the GDPR is applicable throughout the EU, there may be laws and regulations in some countries which specify further data protection requirements, in particular conditions for lawful data processing. If so, it has to be verified on a case-to-case basis whether these laws can prevail.

  1. Personal Data we process, Purposes and Legal Basis

This section of our Policy describes what personal data we collect and process and for what purposes and on what legal basis. The amount of personal data we process depends on the context and circumstances of your interaction with us.

  1. Handling orders and fulfilling contractual obligations

When you place orders to purchase goods or services from us, or if you request information about products and services prior to placing an order, or if you request support regarding the product or services you have ordered, we will process personal data that is necessary to negotiate and execute a contract and to fulfill any contractual obligations, and to exercise our rights under the contract. This also includes advisory services under the contract if this is related to the contractual purpose. Prior to the conclusion of a contract personal data can be processed to prepare bids or tenders or to fulfill other requests of the prospect that relate to contract conclusion.

For this purpose, we process personal details (including name, title, email, telephone, postal address, shipping and billing address), order and customer information (including goods and services ordered and provided, instructions regarding the order, customer business activities and interests and order history), financial information (including invoice data, preferred payment options, term of payment, bank account and credit card information).

The legal basis for processing personal data for the purpose of handling orders and fulfilling contractual obligations and exercising contractual rights is Article 6 (1) b) GDPR (contractual necessity). The legal basis for processing personal data for the purposes of understanding customer business activities and interests and order history is Article 6 (1) f) GDPR (legitimate interests). The legal basis for processing and keeping personal data for the purpose of complying with record keeping obligations (including commercial accounting standards and tax and fiscal retention obligations) is Article 6 (1) c) GDPR (legal obligation).

  1. Browsing or registering on our websites, social media pages or platforms

When you browse our websites, social media pages or platforms, we may use Cookies and other tracking technologies to capture and understand how you use our websites, social media pages and platforms.

Not all our websites employ Cookies and tracking technology that collect personal data. Depending on the Cookies and tracking technologies in use, we collect information about your online browsing behavior on our websites, social media page or platform, including information how react to adverts and offers. We may also collect information about the device you have used to access our websites, social media pages or platforms, (including device model and operating system, browser type, IP-address, mobile device identifiers).

Specific information regarding the Cookies and tracking technology in use on our respective websites, social media pages and platforms is being provided in our Cookie Policy. This includes information how to disable Cookies in your browser and how to prevent tracking of your browsing behavior.

When you register on one of our websites, social media pages or platforms we will additionally process personal details (including name, title, email, telephone), and account details (including username, password, login-/logoff data), except where registration under an alias or pseudonym is permitted.

The legal basis for processing information about online browsing behavior, if it contains personal data, is Article 6 (1) a) GDPR (consent), if we ask you to provide consent and to agree to the processing of your personal data. Specific other provisions in laws relating to data processing in an online context may require your consent as well. Under some circumstances e.g. when we process a limited amount of personal data which, by type and nature does not significantly affect your rights and freedoms, the legal basis for processing your personal data in the context of your browsing or registering on our websites, social media pages or platforms is Article 6 (1) f) GDPR (legitimate interests).

  1. Communication, marketing, taking part in promotions, events and feedback

When you contact us for any sort of inquiry or request, we will process your personal details (including name, title, company or organization you work for, email, telephone, other contact information), as far as this is necessary to deal with your inquiry or request and to respond to.

When you have purchased goods or services from us, or if you have indicated to us that you are interested in certain goods or services, we may process your personal details (including name, title, company or organization you work for, email, telephone, other contact information) to contact you and to send you information about our or our business partners’ goods and services, new technological developments, special offers and business opportunities.

When you take part in promotions or events hosted or sponsored by us, we will process your personal details (including name, title, company or organization you work for, email, telephone, other contact information) to manage your participation in the promotion or event, to provide you with information about our or our business partners’ goods and services, new technological developments, special offers and business opportunities. We will also process your personal details to ask for your feedback regarding the promotion or event, your satisfaction with our or our business partners’ goods or services and performance. We may also ask you for contributions to improve and enhance our goods and services and collaboration with our business partners.

The legal basis for processing personal data for the purpose of communicating with you and to respond to any sort of inquiry or request is Article 6 (1) b) GDPR (contractual necessity), as far as it occurs in the context of preparing or facilitating the conclusion of a contract or to answer to inquiries and requests in connection with a contract. As far as personal data is processed for communicating with you on other matters the legal basis is Article 6 (1) f) GDPR (legitimate interests).

When we process personal data to contact you and to send you information about our or our business partners’ goods and services, new technological developments, special offers and business opportunities the legal basis is Article 6 (1) a) GDPR (consent) if we ask you to provide consent and to agree to the processing of your personal data for that purpose. Under some circumstances e.g. when we process a limited amount of personal data which, by type and nature does not significantly affect your rights and freedoms, the legal basis for processing your personal data to contact you and to send you information about our or our business partners’ goods and services, new technological developments, special offers and business opportunities is Article 6 (1) f) GDPR (legitimate interests).

When we process personal data to manage your participation in a promotion or event, or to provide you with information about our or our business partners’ goods and services, new technological developments, special offers and business opportunities, or to ask for your feedback or for contributions, the legal basis is Article 6 (1) a) GDPR (consent) if we ask you to provide consent and to agree to the processing of your personal data for that purpose. Under some circumstances e.g. when we process a limited amount of personal data which, by type and nature does not significantly affect your rights and freedoms, the legal basis for processing your personal data is Article 6 (1) f) GDPR (legitimate interests).

  1. Legal obligations and compliance

As a business serving many countries we are subject to various laws and regulations that impose legal obligations on us. Some of these laws and regulations may require the collection and processing of personal data (e.g. tax laws, commercial laws, trade and export compliance regulations, customs codes, anti-money-laundering laws). Where such legal obligations are based on EU or EU Member State laws and regulations, the legal basis for processing personal data is Article 6 (1) c) GDPR. Where such legal obligations are based on laws and regulations of third countries (non-EU), compliance with these legal obligations may represent a legitimate interest. If so, the legal basis for processing personal data is Article 6 (1) f) GDPR. The latter applies also to the processing of personal data for the purpose of ensuring compliance with our policies, codes of conduct and regulations.

  1. Personal Data of Children

Oregon RFID EU’s operations are focused on business-to-business (B2B). Therefore, we do not intentionally solicit personal data from children or send them requests for personal data. While users of all ages may navigate through our websites, social media pages or platforms, they are for B2B purposes only and are not targeting children. If we notice, following a notification by a parent or guardian, or after discovery by other means, that a child under 16 years has been inappropriately registered on one of our websites, social media pages or platforms, we will cancel the account and registration and delete the child's personal data from our records.

  1. Sharing Personal Data with Third Parties

Not all processing of your personal data will be carried out by Oregon RFID EU itself. Sometimes we will make use of service providers who will process personal data for us, on our behalf and under our instructions. Such processors can be external companies or affiliates of Oregon RFID EU (group companies). Any such outsourcing of data processing will follow a service provider due diligence and monitoring protocol and will be governed by a Data Processing Agreement.

As far as we use service providers as processors to process personal data on our behalf, your personal data may be shared with the following categories of recipients:

IT service providers, application service providers, Internet service providers, platform and website host service providers, data disposal companies, marketing agencies, market research agencies, advertising partners, order and account management service providers, payment service providers, logistics service providers, customer care service providers.

Apart from sharing personal data with service providers and vendors it may be necessary to share your personal information with third parties, because there is a legal obligation to do so, or because there is a legitimate interest to ensure compliance with polies and regulations, or to facilitate business cooperation and collaboration. In such cases your personal data may be shared with the following categories of recipients:

Public authorities and administrative bodies, law enforcement and fraud prevention agencies, courts, lawyers, tax accountants, accounting and auditing firms, credit reference agencies, payment card and insurance providers, manufacturers and resellers, retailers.

If you use our websites, social media pages or platforms and if you choose to link your social media accounts to us or if you are logged in into your social media account, your personal data may be shared with the operators of those social media pages and platforms.

If we sell or buy any business or assets or transfer an area of our business to a new owner, we will disclose your personal data to the prospective seller or buyer of such business or assets or any third party who acquires our assets or who the business is transferred to.

We may share information with affiliated or unaffiliated third parties on an anonymous, aggregate basis. While this information will not identify you personally and insofar not contain personal data, in some instances these third parties may be able to combine this aggregate information with other data they have about you, or that they have collected from you or received from third parties, in a manner that allows them to identify you personally. Where we do share such data with third parties, we take steps to ensure that they use appropriate safeguards to protect your data.

  1. Storing periods for Personal Data

Generally, we keep personal data for no longer than is necessary for pursuing or achieving the purposes for which the personal data is processed. However, in most circumstances personal data is processed for more than one purpose, e.g. if the data processing takes place in the context of a purchase we process personal data for handling and fulfilling your order, delivering the goods or services, invoicing and payment, and providing customer care afterwards. Yet, as a corporation we are also subject to record keeping obligations and must comply with tax laws and commercial laws that require much longer retention of certain documents and files that may contain personal data.

If we process personal data for the purpose of handling orders and fulfilling contractual obligations, we will keep your personal data for as long as you have a customer or business relation with us. Personal data that is included in documents or files that are subject to tax laws will be kept for 10 years (unless statutory provisions or pending lawsuits or tax proceedings require longer retention), personal data that is included in documents or files that are subject to commercial laws will be kept for 6 years (unless statutory provisions or pending lawsuits require longer retention).

If we process personal data for understanding your online browsing behavior we will keep personal data only for as long as necessary to create user statistics and analytics reports that use aggregate data (non-personal data). Specific information as to how long such personal data will be kept is being provided in our Cookie Policy.

If we process personal data for the purpose of communication, marketing, promotion, event and feedback purposes, we will keep the data for as long as we need the data to communicate with you, or for as long as we have a legitimate interest to provide you with business, product and service information, or marketing, event and promotion materials, except where you have objected to the processing of your personal data for such purposes.

If we process personal data for compliance with laws and regulations that impose legal obligations on Oregon RFID EU, we keep personal data for as long as such laws and regulations require.

  1. Security of Personal Data

We have implemented technical and organizational security measures to protect personal data we process against accidental or unlawful manipulation, destruction or loss, alteration, and against unauthorized disclosure or access by third parties. Such security measures include authentication tools, firewalls, monitoring of IT systems and networks, pseudonymization and encryption of personal data.

The technical and organizational security measures are reviewed and adjusted on a regular basis, considering the state of the art of technology, the nature, scope, context and purposes of processing and the risks and probability of occurrence. However, given the dynamic context of security measures, state of the art of technology, vulnerabilities, threats and risks, absolute security cannot be guaranteed.

  1. Your Rights over your Personal Data

You have many rights over your personal data and how it is used. These rights are summarized below.

  1. Right to access your Personal Data

You have the right to request a confirmation as to whether we process personal data concerning you.

If we process personal data about you, you have the right to request access to the personal data and to obtain further information regarding the purpose of the processing; the categories of personal data concerned; who else outside Oregon RFID EU might have received the data, including recipients in Third Countries; any available information what the source of the data was, if you did not provide it directly to us; the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period. You may also request a copy of the personal data undergoing processing.

  1. Right to rectify your Personal Data

You have a right to rectify (correct) the record of your personal data processed by us, if it is inaccurate or incorrect.

  1. Right to erase your Personal Data

You have the right to request erasure (deletion) of your personal data. However, there may be reasons and legal grounds for keeping your personal data despite your request, e.g. if you still have a business relation with us and we need the data to fulfill orders or other contractual obligations, or if record keeping obligations prevent the erasure, or when we handle an ongoing complaint. If we need to continue to process your personal data, we will tell you why we need to do this when we respond to your request.

  1. Right to object to the processing of your Personal Data

You have the tight to object to the processing of your personal data on grounds relating to your situation and circumstances. However, there may be reasons and legal grounds for processing your personal data despite your objection. If we refuse your request, we will provide you with information explaining why we have refused your request.

  1. Right to restrict the processing of your Personal Data

You have the right to restrict the processing of your personal data. This means that under certain conditions you can limit the way we process and use your personal data. The right to restrict the processing may in particular be exercised if you have issues with the content of the personal data we hold or how it is processed, e.g. if you contest the accuracy of the personal data we hold, and we are verifying the accuracy of the data, the processing may be restricted for the time of verification.

  1. Right to withdraw Consent to process your Personal Data

Where consent is the legal basis for the processing of your personal data, you have the right to withdraw your consent at any time. However, withdrawal of consent takes typically effect for the future only. Any past processing of personal data that was legitimately based on consent may be subject to other provisions or obligations that require and legitimize further processing of the personal data.

  1. 7.Right to portability of your Personal Data

You have the right to request us to move, transfer or copy personal data you have provided to us so that you can use the personal data in a different service or with a different provider. You can request to receive a copy of the personal data in a commonly used and machine-readable format, so you can store it for further personal use. You can also request that we transmit it directly to another organization.

However, the right to data portability may be subject to limitations due to the technical feasibility of a transmission. The right to data portability does not create an obligation for us to adopt or maintain processing systems which are technically compatible with those of other organizations.

  1. Right to lodge a complaint with the Data Protection Authority

You have the right to lodge a complaint with the relevant Data Protection Authority if you believe that we have not handled your personal data correctly and lawfully or if you believe that we have not dealt appropriately with your requests.

The relevant Data Protection Authority where the complaint should be made is the one that is competent for the place of your habitual residence or place of work, or the one that has jurisdiction over the place where the alleged infringement has occurred. When you have lodged a complaint, the Data Protection Authority will inform you of the progress and outcome of the complaint.

  1. Data Controller and Responsibility

Unless indicated otherwise, Oregon RFID EU GmbH, Remsstr. 16, 73630 Remshalden, Germany, Commercial Register Number: HRB 762508, is the controller of your personal data. It determines the purposes and means for processing your personal data and is responsible for compliance with applicable data protection laws and regulations and the requirements of this Policy.

  1. Amendments to this Policy

We reserve the right to amend this Policy at any time.

Last updated: July 2018