Data Privacy Notice

DATA PRIVACY NOTICE

1. WHO WE ARE
Rexel Finland Oy (0980994-9), Varastokatu 9 (PL360), 05800 Hyvinkää (“we”, “us”) is a multichannel distributor of electrical supplies and energy solutions for professionals. Pursuant to the applicable law, including the European Union General Regulation on Data Protection, we are acting as Data Controller when processing your Personal Data. We are thus accountable of the usage of your Personal Data made by us or on our behalf.

2. OUR COMMITMENT
Ensuring data privacy is the foundation of trustworthy business relationships between you and us. Therefore, we take your privacy seriously when conducting business on any channel of our webshops or at our branches.
This Data Privacy Notice explains you how we collect and process your Personal Data.
We may update it from time to time and will publish the new version on our website. This notice was last updated on May 14th, 2018.

3. WHAT INFORMATION WE PROCESS
You provide us some of your Personal Data when interacting with us on any of our sales channels, such as when you submit your details to create a Rexel customer account or contact us with a query. We get some of them by recording how you use our websites or applications, for example, using technologies like cookies.
Please note that we will process only relevant information collected from you in order to provide you with the products or the services you expect.
You have control over what Personal Data we process. When asked to provide Personal Data, you may decline. However, if you choose not to provide Personal
Data that is necessary to provide a product or service, we may not be able to provide that product or service.
Personal identification: your first and last name, gender, your signature.
Contact information: your business email address, business postal address, business phone number and other similar contact data, such as delivery address.
User account information: your account creation date, account number, username, account passwords and security information used for authentication and account access.
Details of your contract when contracting with us as service/product provider or a customer: information necessary to handle our business relationship.
Financial data: data necessary to process your payment if you make purchases, such as your bank account information or your credit card information. Credit card numbers, expiration date and the security code associated with your payment instrument are processed by our payment service providers. If you apply for a credit account, we will collect your information to assess credit rating and thresholds with credit reference agencies.
Purchases: data about the quotes you request, the orders you place and purchases you make. If you have an account with us, we also hold information about your balance and any overdue payment.
Location data: information about location for delivery purpose and management of your contact details.
Your interactions with us: the content of messages, e-mails, letters or phone calls you send us, such as feedback and product reviews you write, or questions and information you provide for customer support. When you contact us, phone conversations may be monitored and recorded as part of improvement of our relationship.
CCTV. If you enter our branches or other Rexel buildings, your image may be captured by our security cameras. Some of our CCTV facilities are handled directly by Rexel, whilst other cameras are monitored by a third-party provider. We will regularly delete CCTV footage, unless it is being used to investigate an alleged crime or an incident.

4. WHY WE USE PERSONAL DATA
We use your Personal Data in order to conduct our business relation with you. This includes:
- Sales
- Improvement of our products and services
- Marketing (Directory, newsletters, direct marketing, Profiling)
- Loyalty plans (Cards, events, challenges, lottery)
- External Communication
- Compliance with legal obligations
- Litigation
For more details, please see following sections.

4.1 Sales
We use your Personal Data to perform essential business operations as:
• Providing our products and services: we use your Personal Data from the collection of your orders, their delivery, their invoicing until their payment recovery.
• Account opening & credit management: we use your Personal Data for your account subscription and activation, your contract(s) management and for the award of credit lines.
• Payment transactions: we share payment data with banks and other entities that process payment transactions or provide other financial services.
• After sales and product returns: we use your Personal Data from the activation of the product warranty at order, the receipt, registration and management of a customer claim and/or product return, until the handling of the claim reporting file.
• Customer support. We use your Personal Data to answer to your queries and follow the sale of our products and services.

4.2 Improvement of our products and services
We use Personal Data to:
• Conduct surveys or ask you for feedback on our products and services: we use your responses and contributions to these for the purposes of quality
control and improvement of our products and services.
• Analyse your use of our websites, apps and your response to our communications to improve the products and services we offer.
• Maintain records of our activities and services, which may include communications exchanged with you or concerning you.

4.3 Marketing
We use Personal Data for:
• Directory: we may set up of the customer/prospective contact list.
• Newsletters: we may send you newsletters about our products and services.
• Direct marketing: we may send you communications (including by email and SMS) about products and services offered by us and third parties, which we believe may be of interest to you (for example because they relate to other products and services which you have purchased or in which you have shown an interest). We may also share your Personal Data with other companies within the REXEL Group for marketing purposes. This may include sharing your name, phone number, email, so that they may contact you to offer you products or services.
• Customised content: we may use your Personal Data to provide you customised content and ads.
• Loyalty program (Cards, events, challenges, lottery): we may onboard you on our loyalty programs from your subscription or attendance and provide you with special awards.

If you do not consent to any of these marketing activities, you may still receive feedback requests, surveys and other customer care communications from us.
You may withdraw your consent to these marketing activities at any time or opt out of receiving feedback requests and surveys using our website in your account, by answering to a marketing e-mail or by using the contact details at section “How to exercise your rights” below.

4.4 External Communications
We process your Personal Data to inform you about:
- The energy markets
- Our events or innovative products and services
- Our corporate strategy, governance or values

4.5 Compliance with our legal obligations
We process or share your Personal Data with third parties where required by applicable law such as:
- Tax law
- Accounting law
- Fraud prevention law
- Credit risk reduction law
- Insurance law
- Human resources law
- Compliance with our legal obligations

4.6 Disputes and litigations
We may process your Personal Data to:
- Resolve any potential or actual disputes
- Defend our legal rights
- Answer to court proceedings
- Answer to requests from a competent law enforcement agency
- And more generally, to protect our rights, our privacy, our security or our property.

4.7 Legal Basis
For each of these purposes Rexel collects, uses and discloses your Personal Data as long as there is a legal basis. Legal bases are the following reasons:
• Because we need it to execute or take steps to enter into a contract with you. For instance: to deliver goods you have ordered. We may also collect your information because you requested us to take steps prior to entering into a contract with us, for instance when you ask us to give you a quote.
• Because we need it to comply with the law. In some cases, we will need to retain your information because we are compelled to do so by law. For instance: to ensure general safety and security, for tax issues, etc.
• Because you have agreed. For instance: when you fill in paper or online forms and choose to provide us with your information.
• Because it is in our legitimate interest. For instance: to prevent fraud, etc. When we process your information on that basis, we always make sure that we balance our interest in having the information with your rights and reasonable expectations.

5. SHARING YOUR INFORMATION AND OUR RELATIONSHIP WITH OTHER PARTIES
We share your Personal Data with your consent if necessary for any of the purposes listed in paragraph “Why we use Personal Data”.

5.1 Service providers
When we share your Personal Data with providers for any of the purposes listed in paragraph “Why we use it”.
Our partner companies must abide by our data privacy and security requirements and are not allowed to use Personal Data they receive from us for any other purpose.

5.2 Trade suppliers
Information about your purchases may be disclosed to our business partners from whom you purchased a product or a service, such as for delivery purpose and product availability.

5.3 Other companies in the REXEL Group
We may share some of your Personal Data with other companies within the REXEL Group. These entities will act on our behalf, and we remain responsible for how they use your Personal Data for these purposes. When a transfer out of the European Economic Area and Switzerland is involved, we will ensure appropriate measures are put in place to safeguard your Personal Data.

5.4 Other recipients
We may also disclose your Personal Data to the following parties:
• Legal authorities or regulatory bodies
• Parties involved in legal actions, such as lawyers, claimers, defendants, etc. to defend or exercise our legal rights

6. INTERNATIONAL GENERAL PERSONAL DATA TRANSFERS
In cases where we could be led to transfer your Personal Data to a location outside Finland and the European Economic Area we will implement any procedure
required to obtain the guarantees necessary to secure such transfers.

7. RETAINING YOUR INFORMATION
We retain your Personal Data as long as needed to fulfil the purposes of the processing. Retention period varies for different types of Personal Data as it depends on:
• The business need to keep the Personal Data
• The contractual and business partner requirements
• Legal requirements (Data protection, Insurance, Fiscal, Human Resources …)
• Rules and Recommendations issued by Data Protection Authorities
Rexel may retain some Personal Data following the end of such period, for example to resolve any potential disputes and for ongoing or prospective legal
proceedings, to maintain records of our services, and otherwise to comply with our legal obligations and to defend our legal rights.

8. SECURITY OF YOUR INFORMATION
We regularly review the technical and organizational security measures we have in place on our information and communications systems in order to adapt them to the risks for you and to prevent the loss, misuse or unauthorized alteration of your Personal Data.
You are responsible for keeping the password you use for accessing our website confidential. We will not ask you for your password, except when you log in to our website.
We cannot be held responsible for any damage that may result from the access or use of our website, including any damage or virus that may infect your computer equipment or any other asset.
Even though we have taken every measure to ensure the reliability of the information contained on our website, we may incur no liability for errors, omissions, or results that may be obtained, transmitted, retransmitted, or collected by the use of such information.
In particular, the use of hypertext links during your visit to our website may lead you to other third-party websites for access to the information sought. We have no control over such servers and are not responsible for privacy policies and practices of third party websites.

9. YOUR RIGHTS
You can exercise any of your Data Subject rights. You have rights to:

Access. You have the right to know whether we hold Personal Data about you. Obtain a copy of the Personal Data we hold about you, together with other
information about how we process it;

Request rectification of inaccurate Personal Data, and, in some circumstances, to request us to erase or restrict our use of your Personal Data, or otherwise to object to our processing of your Personal Data for direct marketing purposes or for reasons relating to your particular situation;

Object to the use of your Personal Data for some purposes (e.g. marketing purpose);

Restriction. You have a right to ask us to restrict our use of your Personal Data in some circumstances, for example whilst we investigate a complaint that the Personal Data we hold about you is inaccurate (subject to conditions);

Request erasure of your Personal Data (subject to conditions);

Portability. Where applicable, you may have the right to receive a copy or have a copy transmitted to another company (in a machine-readable format) of Personal Data which you have provided to us;

Withdraw any consent you have given relating to use of your Personal Data, at any time. This includes consents to receiving direct marketing communications (see section “Why we use Personal Data” Paragraph “Marketing”).

10. Cookies
A cookie is a small file saved on your computer when you visit a website. It is especially designed to collect information about your navigation on the website and send you personalized services. On your computer, cookies are managed by your Internet browser.
We use cookies to help you navigate our website efficiently and to perform certain functions, including website traffic analysis. Cookies may also recognize you on your next log-in and offer you content tailored to your preferences and interests.
Some cookies can collect Personal Data, including information you disclose like your username, or where cookies track you to deliver more relevant advertising content.

As on most websites, this website uses cookies that can be classified into the following categories:

- Strictly Necessary cookies: these are cookies that are essential for our website to work correctly.
- Functionality cookies: these cookies are used to enhance and simplify your user experience. For example, they may record information about previous choices you have made or remember your password.
- Analytics and Performance cookies: these are used for internal purposes to help us provide you with an improved user experience e.g. to assess the performance of a website, or to test different design ideas for the website. We often work with third party research companies to perform these services for us, so these cookies may be set by a third party.
- Targeting and advertising cookies: these cookies are used to deliver relevant and tailored content (including advertising content) to you, and also to evaluate the effectiveness of that content. This content may be delivered on our websites, or on a third-party website. We often work with third parties to deliver this content, so some of these cookies may be set by a third-party.

All cookies used on this website are detailed below:

STRICTLY NECESSARY COOKIES

Type of cookie Name of cookie Purpose of the cookie

FUNCTIONALITY COOKIES

Type of cookie Name of cookie Purpose of the cookie

ANALYTICS AND PERFORMANCE COOKIES

Type of cookie Name of cookie Purpose of the cookie

TARGETING/ADVERTISING COOKIES
Type of cookie Name of cookie Purpose of the cookie

It is possible at any time to change the setting applicable to cookies. By modifying the parameters of your internet browser (click on the "help" button of your browser to see how to do it) you can be warned before accepting cookies or simply refuse them, but in the latter case, know that it you may not be able to access certain features of our website.
The configuration of each browser is different, the links below will show you the procedure for each browser:
- Internet Explorer
- Chrome
- Mozilla Firefox
- Safari

Also remember that if you use different computers in different places, you will need to make sure that each of your browsers are configured according to your cookie preferences.

11. HOW TO EXERCISE YOUR RIGHTS
To send us requests to exercise the rights listed above or to get further information about them, you can either:
- Use the General Enquiry Form available on www.rexel.com
- Or use the contact details below:

Group Data Protection Officer
Dataprotection@rexel.com