PRIVACY POLICY

This Privacy Policy covers Vilofoss in the United States and Canada, headquartered at 457 Campbell Street, Lucknow, ON, Canada N0G 2H0 and referred to in the following as “Vilofoss.” In connection with the sale, purchase, and marketing of our products and services and in our capacity as data controller, Vilofoss collects and processes personal data about customers, suppliers, members, and users of our websites and social media. This Privacy Policy describes our processing, use, and disclosure of personal data in that connection. Categories of data and the purposes for which they are collected We collect and process the following categories of personal data about you:

• Private and work contact details
  • Name
  • Address
  • Telephone number
  • E-mail address
• Customer number
• Location
• CVR number (and Commercial Register number)
• Profession and title
• Corporate form
• Bank details and creditworthiness
• Google Analytics history (via DLG’s website)
• User name
• Fax number
• Language (in relation to recipients of newsletters)
• Property information

The purposes for which we collect and process the data are:

• Handling of customer and member relationships, including:
  • Handling of orders
  • Customer account creation and the ongoing relationship
  • Delivery of goods/products
• Conclusion and performance of contracts, including invoicing and debt collection
• Credit rating
• Handling of performance procedures
• Marketing of our products
• Product analysis
• Compliance with current legislation (e.g., the EU General Data Protection Regulation (“GDPR”) and the Danish Data Protection Act) and other legitimate interests:
  • Duty of documentation
  • Implementation and maintenance of technical and organizational security measures
  • Handling of inquiries and complaints from data subjects and others
  • Handling of inspections and inquiries from supervisory authorities
  • Handling of disputes with data subjects and third parties.

Profiling and automated individual decisions

• Profiling: Vilofoss uses profiling to offer specific and relevant products based on preferences and for marketing purposes.
• Automated individual decisions: Vilofoss uses automated individual decisions in connection with credit approval of orders to prevent financial losses for Vilofoss.

Sources Personal data are collected from you in connection with the customer and member relationship. In certain cases, personal data are collected from:

• Vilofoss’s website in connection with the completion of forms and cookies;
• RKI in connection with credit ratings;
• The Danish Environmental Protection Agency in connection with the purchase/sale of fertilizers; and
• Bisnode in connection with marketing.

Legal basis for collecting and processing personal data The legal basis for our collection, processing, and disclosure of your personal data is as follows:

• Processing is necessary for the performance or entering into of a contract to which the data subject is party; see Article 6(1)(b) of the GDPR.
• Processing is necessary for the purposes of the legitimate interests pursued; see Article 6(1)(f) of the GDPR.
• The data subject has given/will give consent to the processing; see Article 6(1)(a) of the GDPR.
• Civil registration numbers are processed in certain cases where processing is necessary for the establishment, exercise, or defense of legal claims; see Section 11(2), para. (4) of the Data Protection Act, see Article 9(1)(f) of the GDPR.
• Processing is necessary for compliance with a legal obligation to which the data controller is subject
• The Danish Registration of Property Act

When we collect personal data directly from you for the purpose of customer and membership handling, you give us personal data in order to be able to enter into a contract with us. You are obliged to give us such personal data. The consequences of not giving us the personal data will be that we cannot enter into a customer and member relationship as the data are necessary for the performance of the contract and according to the above legal basis. When we collect personal data directly from you for the purpose of marketing, you give us the personal data voluntarily. You are not obliged to give us such personal data. The consequences of not giving us the personal data will be that we cannot target our marketing to the specific need. Legal basis for the disclosure of personal data Personal data will be disclosed to and shared with the following recipients:

• The Danish Nature Agency and the Danish Business Authority
• RKI (Experian A/S)
• Banks
• Carriers / external haulers
• Lawyers

The purpose of and the legal basis for the disclosure of personal data are as follows:

• Disclosure is necessary for the performance of or entering into a contract to which the data subject is party; see article 6(1)(b) of the GDPR.
• Disclosure is necessary for the purposes of the legitimate interests pursued; see article 6(1)(f) of the GDPR.
• The data subject has given consent to the processing; see article 6(1)(a) of the GDPR.
• Civil reg. numbers are processed in certain cases where disclosure is necessary for the establishment, exercise or defense of legal claims; see section 11(2), para. (4), of the Data Protection Act, see article 9(1)(f) of the GDPR.
• Disclosure is necessary for compliance with a legal obligation to which the data controller is subject.
• The Danish Order on Agricultural Use of Fertilisers in the Plan Period
• The Danish Registration of Property Act

Consent as authority to collect, process, and disclose personal data When the processing of personal data is based on your consent, you are entitled to withdraw your consent without negative consequences for you. However, it does not affect the processing or the disclosure of personal data prior to the withdrawal of the consent. Transfer of personal data to data processors We transfer your personal data to our IT suppliers, who store the personal data. We may also transfer your personal data to the following data processors in connection with marketing:

1. Google (Google Analytics and Adwords)
2. Hotjar
3. Quill Engage
4. Facebook
5. LinkedIn
6. iPaper
7. Mailchimp

We transfer your personal data to a debt collection agency in case of non-performance. We transfer your personal data to suppliers, including suppliers of controls. Transfer of personal data to recipients outside the EU/EEA We do not transfer personal data to recipients in countries outside the EU/EEA/US/Canada. Storage period We store your personal data as long as it is necessary to meet the purposes stated above, but no longer than five years after the termination of the customer and member relationship. Your other rights Within the limitations of the law, you have certain rights, including the right of access to your personal data, the right to have incorrect information rectified, the right to have data erased, the right to have data restricted, and the right to data portability. In certain cases, you have the right to object to our otherwise legal processing of personal data, including in relation to automated individual decision-making and the processing of your data for the purpose of direct marketing. You are also entitled to complain to a competent supervisory authority, including the Danish Data Protection Agency. Contact If you have any questions regarding the processing of your personal data or the use of your rights, you are welcome to contact us by writing to the following e-mail address: GDPR-dk@vilofoss.com. Vilofoss A/S Vesterballevej 4, 7000 Fredericia, Denmark