On May 25th 2018, the General Data Protection Regulation (GDPR, is due to take effect. The GDPR imposes new rules on companies, government agencies, non-profits, and other organisations that offer goods and services to people in the European Union (EU), or that collect and analyse data tied to EU residents. The GDPR applies no matter where you are located.

Our Commitment

ELANTRA is committed to the preservation of its reputation and integrity through compliance with applicable laws, regulations and ethical standards in each of the markets in which it operates. All employees are expected to adhere to these laws, regulations and ethical standards, and management is responsible for ensuring such compliance.

ELANTRA are committed to ensuring the security and protection of the personal information that we process, and to provide a compliant and consistent approach to data protection. We have a robust and effective data protection program in place which complies with existing law and abides by the data protection principles.

ELANTRA are dedicated to safeguarding the personal data as both a Data Controller and Data Processor. Our preparation and objectives for GDPR compliance have been summarised in this statement and include the development and implementation of new data protection roles, policies, procedures, controls and measures to ensure maximum and ongoing compliance.

What is ELANTRA doing?

ELANTRA is undergoing an extensive project to address the GDPR principles and how it impacts our Regions, Employees, Suppliers and Customers.

ELANTRA has taken the following steps to further the stringent data privacy controls already in place:

Assurance

ELANTRA will conduct regular internal and external company-wide audits to identify and assess what information we process, how and where it is processed, and who has access.

Data Collection

ELANTRA will undergo further assessments to understand, classify and validate what personal data we process, and regularly update our Data Asset Register.

Data Retention

ELANTRA will update the Data Retention policy and review all schedules to ensure the ‘data minimisation’ principle is applied and personal data is kept for no longer than is necessary for the purposes for which it is being processed.

Policies & Procedures

ELANTRA is reviewing all applicable privacy policies and procedures to ensure they are aligned to GDPR, all policies and procedures will be reviewed on a periodic basis.

Awareness

All ELANTRA staff has access to and will be enrolled on applicable education and awareness learning modules. This will ensure that all ELANTRA employees will be aware and understand how vital it is to comply with the GDPR regulations.

Privacy Policy

Our current privacy policy is located on our website: https:// elantragroup.com/privacypolicy.html

This privacy policy has been updated to ensure it complies with the GDPR regulations.

Information Security

Cyber security is a growing concern for many businesses, and one we take very seriously at ELANTRA. We have strong cyber security measures in place means that we are not only protecting ourselves but our suppliers and customers as well. We have dedicated Security professionals and use a managed service for our Security Operations Centre.

GDPR Roles & Responsibilities

At group level ELANTRA has appointed a Group Data Protection Officer. For any additional queries concerning how ELANTRA market to our customers or if you have any question about our preparations for GDPR, please contact:

Data Protection Compliance Officer
Elantra House
2 Yates Street, Oldham OL1 4AP
or
Data.Protection@elantragroup.com

1. Introduction

This is the ELANTRA Privacy Statement for customer, supplier and business partner data. This Privacy Statement provides information on the processing of personal data by ELANTRA and its group companies, hereafter ELANTRA, we or us.

The primary purpose of this Privacy Statement is to be a dynamic resource and business tool so that we can offer our services to you in the best possible way. We want you to feel secure when visiting our site and are committed to maintaining your privacy when doing so.

This Privacy Statement may be changed over time. The most up-to-date Privacy Statement is published on our website. This Privacy Statement was last changed on 23/05/2018.

2. When does this privacy statement apply?

This Privacy Statement is applicable to the processing by ELANTRA of all personal data of its customers, suppliers and business partners and other individuals. This Privacy Statement does not address the processing of personal data of employees in the context of their employment relationship with ELANTRA.

3. Who is responsible for your personal data?

ELANTRA and/or its group companies are the controllers of the processing of all personal data that fall within the scope of this Privacy Statement. This Privacy Statement indicates what personal data are processed by ELANTRA and for what purpose, and to which persons or entities the data will or may be provided. ELANTRA may share your personal data with third parties.

4. For which purposes do we process your personal data?

4.1. When you interact with ELANTRA (online or offline)

a) For answering your questions

i. What does this purpose entail?

If you get in touch with us via email or via the contact form on one of the ELANTRA group websites (each a Website), we will use your personal data in order to reply to and answer your question.

ii. On what legal ground do we process personal data for this purpose?

We process your information for this purpose based on our legitimate interest to adequately answer your questions.

iii. Which personal data do we process for this purpose?

For this purpose, we process your contact details such as your address and email address, personal details such as your name and credit information and details of your correspondence with us.

iv. For what period do we retain your personal data for this purpose?

For this purpose, your personal data will be retained for 1 year. After this term, your personal data will be deleted from our systems.

b) For the conclusion and execution of agreements

i. What does this purpose entail?

When you have purchased a product or service from us as a customer, or when you work together with us as a supplier or business partner, we process your personal data for administrative purposes such as sending invoices and making payments. We also use your personal data in order to deliver or receive and administer our or your products or services. ELANTRA will process your personal data in order to further execute our agreement, including for the delivery of customer services. When you require access to ELANTRA's premises, we process your personal data for screening purposes.

ii. On what legal ground do we process personal data for this purpose?

We process personal data for this purpose because this is necessary for the conclusion of a contract between you and us. ELANTRA cannot enter into contracts without obtaining the required information.

iii. Which personal data do we process for this purpose?

For this purpose, we process your contact details such as your address and email address, personal details such as your name and payment and credit information, order history and other data stored in our customer, supplier and business partner database.

iv. For what period do we retain your personal data for this purpose?

For this purpose, your personal data will be retained for 1 year. After this term, your personal data will be deleted from our systems.

c) For relationship management and marketing

i. What does this purpose entail?

ELANTRA uses the information stored in its customer database to send you suitable offers, as well as to provide customer services, perform account management and communicate recalls. We also use your personal data for the development, execution and analysis of market surveys and marketing strategies.

ii. On what legal basis do we process personal data for this purpose?

When sending you relationship management and marketing communications, we process personal data based on your consent. In addition, we process personal data for this purpose based on our legitimate interest to improve our marketing strategies.

iii. Which personal data do we process for this purpose?

For this purpose, we process your contact details such as your address and email address, personal details such as your name, payment information, order history and correspondence with us.

iv. For what period do we retain your personal data for this purpose?

For this purpose, your personal data will be retained for 1 year after the relationship ended. After this term, your personal data will be deleted from our systems.

d) For business process execution and internal management

i. What does this purpose entail?

We process your personal data in the performance and organisation of our business. This includes general management, order management and management of ELANTRA assets. ELANTRA also processes your personal data for its internal management. We provide central processing facilities in order to work more efficiently. We conduct audits and investigations, implement business controls, and manage and use customer, supplier and business partner directories. Also, we process your personal data for finance and accounting, archiving and insurance purposes, legal and business consulting and in the context of dispute resolution.

ii. On what legal ground do we process personal data for this purpose?

We process personal data for this purpose based on our legitimate interest to maintain and improve sound business operations.

iii. Which personal data do we process for this purpose?

For this purpose, we process your contact details such as your address and email address, personal details such as your name, payment and credit information, payment and order history, correspondence with ELANTRA and data generated during the performance of the agreement between you and ELANTRA.

iv. For what period do we retain your personal data for this purpose?

For this purpose, your personal data will be retained for 1 year. After this term, your personal data will be deleted from our systems.

5. Cookies

We also collect information through the use of cookies. Cookies are small files of information which save and retrieve information about your visit to this website – for example, how you entered our site, how you navigated through the site, and what information was of interest to you.

6. Who has access to your personal data?

6.1 Access to your personal data within ELANTRA

Data we collect may be exchanged with the ELANTRA group, shareholders and associated companies. We exchange your data for administrative purposes and so that we can have a complete overview of your contacts and contracts with the ELANTRA group. We may also exchange your data in order to offer you a complete package of services and products.

ELANTRA employees are authorised to access personal data only to the extent necessary to serve the applicable purpose and to perform their jobs.

6.2 Access to your personal data by third parties

The following third parties have access to your personal data, where relevant, for the provisioning of their products or services to ELANTRA: banks, insurance companies, IT suppliers, accountants, forensic specialists, and consultants.

When third parties are given access to your personal data, ELANTRA will take the required contractual, technical and organisational measures to ensure that your personal data are only processed to the extent that such processing is necessary. The third parties will only process your personal data in accordance with applicable law.

If your personal data are transferred to a recipient in a country that does not provide an adequate level of protection for personal data ELANTRA will take measures to ensure that your personal data are adequately protected, such as entering into EU Standard Contractual Clauses with these third parties.

In other cases, your personal data will not be supplied to third parties, except where required by law.

7. Questions or requests for access, correction and removal

You can request access, correction, restriction, portability or removal of the data that ELANTRA processes about you at any time by sending a request to:
Data.Protection@elantragroup.com

If you feel that we do not comply with applicable privacy rules you have the right to lodge a complaint with a competent data protection authority

8. Contact information

If you have any questions regarding the processing of your personal data, send a request relating to any of your data protection rights, please contact our Privacy Officer at:

Data Protection Compliance Officer
Elantra House
2 Yates Street, Oldham OL1 4AP
or
Data.Protection@elantragroup.com