Epiroc’s Data Privacy Governance Information

Our responsibility for your rights. In the capacity of data controller, we are responsible for ensuring that personal data is processed in compliance with applicable laws and that you can exercise your rights. You may contact us at any time if you wish to exercise your rights. We have an obligation to respond to your requests to exercise your rights within one month of receiving your request. If the request is complex or if we have received many requests, we have the right to extend this deadline to two more months. If we are unable to take the action requested within one month, we will inform you of the reason for the delay and of your right to lodge a complaint with a supervisory authority and to seek judicial remedy. You will not be charged for requesting information, for communication or measures that we carry out. However, if your request is manifestly unfounded or excessive, we may charge an administrative fee for providing the information or taking the action requested or refuse to act on your requests altogether.

Your right to access to your personal data. This means that you have the right to request access to the personal data that we hold about you. You also have the right to be provided, at no cost, a copy of the personal data about you that we are processing. We have the right to charge a reasonable administration fee if you request further copies. If you make a request in electronic form, e.g. via email, we will provide you with the information in a commonly used electronic format. Moreover, you have the right to request a copy of the European Commission’s standard contractual clauses and its appendices that we use with any third parties, as mentioned in Clause 1. 

Your right to erasure of your personal data. You have the right to request that we delete your personal data if there is no compelling reason for us to continue processing the data. Personal data should therefore be erased if (i) it is no longer needed for the purpose for which we collected it; (ii) we process personal data based on consent provided by you and you withdraw your consent; (iii) you object to our processing of your personal data based on a legitimate interest assessment and we have no compelling interest that overrides your interests and rights; (iv) we have processed the personal data unlawfully; or (v) we have a legal obligation to erase the personal data. However, there may be legal requirements or other compelling reasons that prevent us from immediately erasing your personal data. We will then stop processing your personal data for purposes other than in compliance with the law or where there are no compelling legitimate grounds for doing so.

Your right to restriction of processing. This means that we temporarily restrict the processing of your personal data. You have the right to request restriction when (i) you consider your data to be inaccurate and you have requested rectification as defined above, while we establish the accuracy of the data; (ii) the processing is unlawful and you do not want the data to be erased; (iii) as the personal data controller, we no longer need the personal data for our processing purposes, but you need you to be able to establish, exercise or defend a legal claim; or (iv) you have objected to the processing as defined below, while waiting for us to consider whether our legitimate interests override yours.

Notify others. We will take all reasonable measures possible to notify everyone who has received personal data as stated in above in this Clause if we have rectified, erased or restricted access to your personal data after you have requested us to do so. If you request information on recipients of your personal data, we will inform you about the recipients.

Your right to object to processing. You have the right to object to the processing of your personal data if our processing is based upon legitimate interests. If you object to such processing, we will only continue to process your data if we have compelling reasons for doing so that override your interests.  If you do not wish that we use your personal data for direct marketing, you have the right to object to such processing by contacting us. We will cease to use your personal data for that purpose when we have received your objection.

Your right to withdraw your consent. When we need your consent in order to process your personal data, you always have the right to withdraw such consent at any time by contacting us.

Your right to data portability. You have the right to data portability. This means the right to receive your personal data in a structured, commonly used and machine-readable format, and to request that these data are transferred to another personal data controller. The right to data portability only applies when the processing is being carried out by automated means and our lawful basis for processing of your personal data is (i) the performance of an agreement between you and us, or (ii) your consent.

Your right to complain. If you are not satisfied with our processing of your personal data, you should not hesitate to contact us. For more information and contact details, see Clause 9. You also have the right to lodge a complaint with the supervisory authority if you are not satisfied with our processing of your personal data. For EU and EEA countries, the local supervisory authorities can be found here.

If you want to make use of your rights or if you are not satisfied with how the Company processes your personal data, you may contact us. Please see Clause 9 for contact details.

Please note that the Company may contact you and ask you to confirm your identity to ensure that the Company does not disclose your personal data to any unauthorized person, and that the Company may ask you to specify your request before the Company performs any actions. Once the Company has confirmed the identity of you, the Company will handle the request in accordance with applicable law. Please note that even if you object to certain processing of personal data, the Company may still continue the processing if permitted or required to do so by law, for example to be able to fulfil legal or contractual requirements. You can also lodge a complaint with the relevant supervisory authority such as where you live, work or where an alleged infringement of the applicable data protection law has occurred. For EU and EEA countries, the local supervisory authorities can be found here.