Last Updated 30 September 2019

Protecting the individual's privacy on the Internet is a crucial responsibility of all Internet-based businesses. We have developed this Privacy Statement to demonstrate our strong commitment to the protection of data and privacy of individuals, and to those rights of individuals that underpin this protection and privacy. This privacy statement outlines how we handle information that can be used, directly or indirectly, to identify an individual.

Protection of personal privacy is a hallmark of NirSan. Since its inception in 2015, NirSan has maintained the confidentiality of each respondent of its surveys unless an individual has consented to the release of the individual's Personal Information or individual results. Similarly, NirSan protects the identity of individuals who access NirSan’s website.

NirSan's data protection officer can be contacted on [email protected].

A. General information

1. When does this privacy statement apply?

We may collect data, including Personal Information, about you as you use our websites and products and interact with us. By using the term "Personal Information" in our Privacy Statement, we refer to information that you individually provide to NirSan either directly or indirectly that can be used to identify you or make you identifiable, on its own or in conjunction with other information. Personal Information could include, for example, your name, mailing address, phone number, name of your employer organisation, personal and official email address, login information (account number, password), and marketing preferences. If we link other data with your Personal Information, then we will treat this data as Personal Information.

2. Why am I required to provide Personal Information?

We collect Personal Information for a range of reasons, such as:

• • Processing your transaction order, including payments.
  • Enabling the use of certain features of our products.
  • Enabling you to fruitfully participate in any of our surveys.
  • Creating an experience that is personalized for you.
  • Providing you with a subscription of our newsletter.
  • Creating a user account with us.
  • Providing you with customer service.
  • Sending marketing communications related to our products.
  • Collecting information during a certification process when a computer-based certification test is administered to you.

We and the third parties we engage may combine the information we collect from you over time and across our website and products and solutions with information obtained from other sources. This allows us to improve the accuracy of the information, and helps us better customize our product delivery and interactions with you.

Except for certain information that is required by law or by NirSan policies, your decision to provide any Personal Information to us is voluntary. Therefore, you will not be subject to adverse consequences if you do not wish to provide us with your Personal Information. However, if you decide not to provide certain information, we may not be able to achieve some or all of the objectives outlined in this privacy statement. In such situations, you may not be able to use certain products and solutions that require the use of such personal data.

If you provide us with personal data of a third party, you are responsible for ensuring that the third party is made aware of the contents of this privacy statement. Moreover, you should ensure that the third party has given you his/her consent for sharing the information with NirSan. Examples include forwarding marketing materials to a colleague and sending job referrals.

3. Legal requirements of providing the requested goods or services

If you order goods from NirSan, we will use the Personal Information that you enter into the order or registration form only to process your order or to provide the requested goods or service. This may include taking the necessary steps prior to entering into the contract, responding to your related inquiries, and providing you with billing information and to process customer feedback and support.

If you participate in trainings provided by NirSan, then NirSan may track your learning progress in order to make this information available to you. Furthermore, we communicate on a regular basis by email with users who subscribe to our services, and we may also communicate by phone to resolve customer complaints. We may use your email address to confirm your opening of an account, to send you notice of payments, and to send notices and other disclosures as required by law. Generally, users cannot opt out of these communications, which are not marketing-related but merely required for the relevant business relationship.

4. How is my data collected?

NirSan collects Personal Information at its websites in two ways. We collect Personal Information directly when, for example, you provide information to sign up for a newsletter or transact for a product purchase. Our website collects Personal Information indirectly, for example, through the website's technology.

We may collect and process the following Personal Information:

• • Personal Information that you provide by filling in forms on our website. This includes forms for registering to use the website, requesting information of our products and services, registering to receive our newsletters and notifications, registering for an event and requesting for our perspectives or a white paper.
  • If you contact us, we may keep a record of that correspondence.
  • We may ask you to complete surveys that we use for our research and knowledge creation, although your response to such surveys is entirely voluntary.
  • Any postings or content that you upload or post to a NirSan website.
  • Our website collects personal data about your computer, including your IP address, operating system and browser type. Such information collection is conducted for the purposes of system administration, filtering traffic, looking up user domains and reporting user and visitor statistics.
  • Details of your visits to our website, the pages you view and resources you access or download. Such information includes but is not limited to traffic information, location information and other communication data. The Cookies section below provides more information in this regard.

5. Duration of processing of Personal Information.

We will retain your Personal Information for the period that is needed to perform the objectives for which the information was collected. The duration is also dependent on the legal basis under which the information was obtained. In general terms, this means that the Personal Information will be retained for the duration of our relationship with you

We will retain your Personal Information for as long as required to perform the purposes for which the data was collected, depending on the legal basis for which that data was obtained and/or whether additional legal/regulatory obligations require us to retain it.

In general terms, this will mean that your Personal Information will be kept for:

• • The duration of our relationship with you, and
  • The period required by tax and company laws and regulations; and
  • As long as it is needed for you to be able to bring a claim against us and for us to be able to defend ourselves against any legal claims. This duration will generally be the combination of the length of the relationship and the length of any applicable statutory limitation period under local regulations.

6. Recorded communications

We may ask to record telephone calls for the purposes of training, quality assurance and research purposes. All recordings ate treated as confidential. If you do not want us to record your call, we will provide you with a chance to opt out of the call. You can also ask us to turn off the recording at the beginning of the call.

7. General benchmarking and research purposes

NirSan may use information obtained through surveys or diagnostics or otherwise provided to or generated by NirSan (collectively “Research Data”) for the purposes of validation, research and benchmarking, and product development. Unless otherwise specified prior to the collection of data, Research Data will be disclosed in the aggregate and presented in anonymous form. It will not include, either directly or by inference, any information identifying participating organizations or any identifiable individual as the source of such data. Access to Research Data will be restricted to those designated individuals who need such access to deliver NirSan products and/or services.

B. Marketing

1. Sources of marketing data

Most of the Personal Information we collect and use for marketing purposes relates to individual employees of our customers and other companies with which we have an existing business relationship. We may also obtain contact information from public sources, including content made public at social media websites, to make a first contact with a relevant individual at a customer organisation or other company.

2. Sending targeted e-mails

We send commercial e-mail to individuals at our customers or other companies with whom we want to develop or maintain a business relationship in accordance with applicable marketing laws. Our targeted e-mail messages typically include web beacons, cookies, and similar technologies that allow us to know whether you open, read, or delete the message, and links you may click. When you click a link in a marketing e-mail you receive from NirSan, we will also use a cookie to log what pages you view and what content you download from our websites.

Targeted e-mails from NirSan may include additional data privacy information, as required by applicable laws.

3. Maintaining Customer Relationship Management (CRM) databases

Like most companies, NirSan uses CRM database technology to manage our marketing efforts. Our CRM databases include Personal Information belonging to individuals at our customer organisations and other companies with whom we already have a business relationship or want to develop one. The Personal Information used for these purposes includes relevant business information, such as: contact data, publicly available information (e.g. board memberships, published articles), your responses to targeted e-mail efforts, website activity on our website, and other business information incorporated by NirSan professionals based on their personal interactions with you. If you wish to be excluded from our CRM databases, please contact us.

4. News about Products and Services

NirSan may use your name, email and postal address, telephone number, job title and basic information about your employer (name, address, and industry) as well as an interaction profile based on prior interactions with NirSan in order to keep you up to date on the latest product announcements, software and product upgrade, special offers, and other information about NirSan’s products and services. In connection with these marketing-related activities, NirSan may provide a hashed user ID to third party operated social networks (such as Twitter, LinkedIn, Facebook, Instagram or Google) where this information is then matched against the social networks’ data in order to display to you more relevant information.

C. Cookies policy

Strictly necessary cookies are required for the operation of our website. Cookies for functionality help to recognise you when you return to our website. These cookies simply store a user code so that the user does not have to feed in their information when revisiting the website. Cookies for targeting record your visit on our website and the pages you have visited. This information helps us make our website more relevant to your interest.

The use of cookies is standard practice on the Internet. While most Web browsers automatically accept cookies, the decision of whether to accept or not is yours. You have the choice to accept or decline cookies. You may adjust your browser settings to prevent cookies from being received, or to provide notification whenever a cookie is sent to you. You may select the appropriate settings on your browser to refuse the use of cookies. However, please note that in such a case you may not be able to access the full functionality of our website. Cookies placed by our website will expire upon the termination of the website session or after a reasonable period of inactivity.

Tracking data is the information of the traffic volume and patterns on a website. It includes information items such as the number of visitors to a given website or page. To obtain such tracking data, NirSan uses Google Analytics – a third-party analytic provider. Google Analytics is a service from Google, Inc. (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) using cookies which are saved on your computer. The information generated by the cookie is transferred to and stored on a Google server. Google uses this information on our behalf to analyse the usage of our website. You can prevent Google Analytics' collection and use of data by downloading and installing one of several available browser plug-ins. Further information about Google Analytics can be found in the Google Analytics Terms of Service.

Only designated data administrators of NirSan can access the information gathered by Google Analytics, and the information is used only for administrative and planning purposes with the sole and explicit objective of fulfilling the needs of our users.

D. Data security and protection

1. Data Security

We intend to protect the Personal Information entrusted to us and treat it securely in accordance with this Privacy Statement. NirSan has put in place physical, administrative, and technical safeguards designed to protect your Personal Information from unauthorized access, use, or disclosure. We also contractually require that our suppliers protect such information from unauthorized access, use, and disclosure. The Internet, however, cannot be guaranteed to be 100% secure, and we cannot ensure or warrant the security of any Personal Information you provide to us.

2. Sharing of data with 3rd parties

We may disclose your Personal Information to third parties as follows:

• • When we have your consent to do so;
  • To third parties who work on our behalf to maintain business contact databases and other IT systems, or who provide other technical services, such as printing;
  • To third parties providing services to us or on our behalf who have a need to access your information, (e.g., our professional advisors such as auditors and lawyers);
  • To comply with applicable laws; protect rights, safety and property; and respond to lawful requests from public authorities (e.g., disclosing data in situations involving national security or law enforcement);
  • Subject to applicable law, in the event that NirSan is merged, sold, or in the event of a transfer of some or all of our assets (including in bankruptcy), or for pre-transaction review in relation to such transactions.
  • Your Personal Information may be shared if we anonymize and/or aggregate it, as in these circumstances the information will cease to be Personal Information.

3. Links to other websites

We provide links to other websites or resources that are not part of the products or services run by NirSan. We do not control these websites or their privacy practices, and any information you provide to these sites is subject to the Privacy Policies of those sites and not this Policy.

E. User’s rights

1. Data subjects’ rights

In certain circumstances, you have certain rights regarding your Personal Information. A summary of these rights and how you can exercise it is set out below. To exercise any of these rights, please contact us. Such requests should include information that will allow us to verify your identity (e.g., your name, address, email address, organisation details, or other information that is reasonably required). We may ask for additional information to verify your identity before carrying out a request.

Where we receive your request to exercise one of these rights, we will respond within one month of receipt of the request.

We will provide the information free of charge, except where requests are manifestly unfounded or excessive. In these circumstances we may refuse to act on the request or charge a fee. We will advise you of any fees prior to proceeding with a request.

Your rights and how you can exercise these are outlined as follows:

1. Right to access and/or correct your Personal Information: You have the right to access Personal Information we hold about you. You also have the right to correct any information we may hold about you that is inaccurate.
2. Right to restrict use of your Personal Information: You have the right to ask us to restrict processing of your Personal Information where one of the following conditions applies:
   • • The processing is unlawful and you want us to restrict use of the data instead of removing it;
     • Where you contest the accuracy of your Personal Information, the restriction will apply until we have verified the accuracy or corrected your Personal Information;
     • We no longer require the Personal Information for the purposes of processing, but are required to keep it in connection with a legal claim;
     • You have exercised your right to object to the processing. The restriction will apply until we have taken steps to verify whether we have legitimate grounds to continue processing of the information.
3. Right to request deletion of your Personal Information: You have the right to ask us to delete your Personal Information in certain circumstances. If you want to opt-out from receiving marketing communications, the best way to do so is to allow us to retain your information with a “do not contact” tag so we know not to contact you in the future.There are certain exceptions where we may refuse a request for information deletion. Such instances include situations where the Personal Information is required to comply with a legal obligation or for the defense of legal claims.
4. Right to object to processing of your Personal Information: You may object to our use of your Personal Information for marketing purposes.You may also object to processing of your Personal Information in cases where we have used legitimate interests as the basis for processing. In such cases, we will stop processing your Personal Information until we verify that we have compelling legitimate grounds for processing that outweigh your interests and rights in asking us to stop processing the data.
5. Right to lodge a complaint with a supervisory authority: If you object to our processing of your Personal Information, you have the right to complain to the data protection authority in the country where you reside, where you work, or where the alleged infringement of data protection laws has taken place.

F. Miscellaneous

1. Use of this website by children

Our website does not contain content that is generally considered unsuitable for children. NirSan encourages parents and guardians to spend time with their children online and to be fully familiar with the online activity of their children.

2. Contact us

We value your opinions. Should you have questions or comments related to this Privacy Statement, or have complaints or questions arising out of this Privacy Statement, please email our privacy team at [email protected]. In case of a complaint, we will respond to you within 30 days of receiving the complaint.

3. Updates to the privacy policy