LG Hausys Europe GmbH General Privacy Policy

LG Hausys Europe GmbH (“LG Hausys Europe” or the “Company”), a Germany subsidiary of LG Hausys, Ltd. (“LG Hausys”) in South Korea, collects, uses and is responsible for certain personal information about you. When we do so we are regulated by the General Data Protection Regulation (‘GDPR’) which applies across the European Union, and thereon, we may be responsible as controller of that personal information for the purposes of those laws.

LG Hausys is in the business of manufacturing, buying, selling and servicing of certain goods and services, and LG Hausys Europe is a sales subsidiary for some of those goods and services for Europe. LG Hausys Europe currently services for Solid Surface Materials (aka HI-MACS), Automotive and Deco Films. In response to the relevant laws and regulations and foremost, by furtherance of good business ethics, LG Hausys Europe is committed to safely protecting your personal data given to us, and we promise that we will only use your personal data for the purpose(s) accepted by you.

LG Hausys Europe collects and processes the minimum personal data required for the furtherance of its commercial interest only. Thereon, LG Hausys Europe will process all personal data only for the purpose specifically stated or otherwise permitted by law. All personal data entrusted with LG Hausys Europe will forever remain confidential to unrelated third parties.

What is personal data?

"Personal data" means any information relating to an identified or identifiable natural person ("data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier;  or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.  [GDPR Clause 1, Article 4]

HIMACS.EU (the “Website”)

Types of Requests Available on the Website ("Contact Us"):

*To provide customers with excellent services, the Company may share certain customer information with its contracted distributor and other business partners. Rest assured, the Company has an internal policy of processing all personal data for the specific purpose as stated or permitted by law. For certain business cases or requests, the Company’s Country Manager or Project Manager will make reasonable business decisions to transfer relevant personal information to the distributors and other business partners for the furtherance of commercial objectives. To adequately comply with your request, the Company may ask you for more information as it becomes necessary.

• GENERAL: Questions related to HI-MACS products and/or services (there is no required format for this request). The Company will do its best to comply with your reasonable commercial requests to further the common interest.
• CONTACT YOUR DISTRIBUTOR: The Company will share your information and input with a distributor in your area, and if you choose to provide us with optional information, such as your phone number, such information will be used to expeditiously process your request.
• ASK FOR A SAMPLE: A particular sample of the Company’s product is being requested. In order to adequately process your request, the Company requires relevant information, such as your full name and address. Based on availability or capacity, your request may be fulfilled by a distributor by LG Hausys in Korea. A representative of the Company or its distributor may contact you to verify the information provided herein.
• ASK US TO PERFORM A TEST:  If you are in need of a particular certification or testing related to the Company’s products and services, you are recommended to leave your contact information for expeditious processing.
• ASK FOR AN EXPERT VISIT: If you want to request a visit by a person with product and service knowledge, then the Company will comply with your request by sending a representative of the Company or an employee of the Company’s distributor or other business partner. In order to facilitate to your request, the Company will require your contact information, inclusive of an address.
• BECOME A HI-MACS FABRICATOR/INSTALLER NOW: If you are interested in becoming a certified HI-MACS fabricator/installer or would like to make an inquire thereof, please input your information in the applicable boxes/fields. Providing additional contact information, such as your phone number, will allow us to expeditiously process your request.
• HI-MACS WARRANTY: You can make an inquiry related to a product warranty and ask for other relevant information.

Providing Newsletters to Subscribers ("Request for Newsletter")

• LG Hausys Europe provides its newsletter service only to those who voluntarily and explicitly subscribed thereto.
• The periodic e-Mail newsletter is delivered/serviced by MailChimp in the U.S.

SALESFORCE.COM (the “CRM”)

* Salesforce.com is a U.S.-based CRM (Customer Relationship Management) system used by the Company. All personal data collected via himacs.eu or over the ordinary course of business for HI-MACS will be either automatically uploaded by means of an automatic connection between the databases (himacs.eu and Salesforce) or direct input by an authorized personnel.

DIRECT SALES

*"Direct Sales" refers to any and all traditional and ordinary course of business taken off-line. However, some referral may be made directly by a source using e-mail system. Any and all referrals and traditional business methods, such as exchanging of business cards, phone calls, on-the-ground business transactions, exhibitions and trade shows, etc., will be considered as direct sales.

• For the furtherance of its commercial interest, the Company will process all personal information received from direct sales into the CRM. However, such personal data, unless a specific purpose or appropriate consent has been documented, will be only used when and if the Company receives consent or specific instruction from the respective data subject. Such method will be carried out by the aforementioned “Thank You” or confirmatory e-mail.
• Absent appropriate consent or a specific purpose provided, the Company shall delete all collected personal information from the database within 30 days of the initial input into the CRM.

NEWSLETTER SERVICES / MEDIA ALERTS

• The newsletter service is offered to you at no-cost  for informational purposes and may be unsubscribed at any time.
• The Company sends out newsletters using the e-mail service provider, MailChimp. To enable such services, your email information and the language you choose will be provided to MailChimp and the CRM.
• You are free to unsubscribe from the newsletter service at any time, for any reason, by clicking the “Unsubscribe” link provided in each newsletter or by contacting the Company via e-Mail or by calling (49)-69-583-029 469.
• Media Alerts are offered to you at no-cost for press-related purposes and may be unsubscribed at any time.
• You are free to unsubscribe from the media alerts at any time, for any reason, by making such withdrawal request to the e-mail address of Mariana Fredes (mfredes@lghausys.com) or by calling (49)-69-583-029 469.
• The Company sends out media alerts using the e-mail service provider, MailChimp. To enable such services, your email information, name, and other information you input will be provided to MailChimp and the CRM.

GENERAL APPLICABILITY

The Company collects and processes your personal data on the grounds of one or more of the lawful bases permitted under the laws and regulations (such as performance of contract, legitimate interest of the Company, required by law, etc.).

• If the data subject does not provide the Company with sufficient personal data to fulfill a data subject’s request, then the Company will not be able to proceed.
• If you made consent to specific use, then you are free to withdraw your consent at any time. Please refer to https://himacs.eu/en/rights-data-subject  for more details on withdrawal, unless specified otherwise hereunder.
• The Company does not collect or process personal data of a minor child. The Company sets, as its internal policy, the age of consent to be 18. However, if the minor has a legitimate interest in doing business with the Company and is permitted to do so by the applicable laws and regulations (such as obtaining authorization from a parent or legal guardian), he or she may be able to submit certain personal information for the furtherance of a mutual commercial interest. There are no other exceptions.
• The Company currently does not use any features or services related to automated decision-making or profiling.
• The Company, unless required by law, does not collect or process any specially categorized personal data as set forth in the GDPR.

2. Personal Data Retention Policy

The Company conforms to the data retention period as permitted or required by law. However, if one is not clearly specified or managed by law or regulation, then the Company shall reasonably set the retention period as its internal policy. When and if the data subject makes a request for deletion of some or all of his or her personal data, then the Company will do so without undue delay unless other reasonable ground exist.

Please refer to the Company Personal Data Retention Policy for further details. As a general standard, LG Hausys Europe does not retain personal data for longer than the period necessary. As a general rule, the three-year mark is considered as the point of deletion for unused personal data, absent other reasonable grounds to further retain such data. In short, if LG Hausys Europe does not use your personal data for 3 years, then it will be deleted automatically.

For statistical purposes, in the interest of commercial objectives, the Company may safely archive expired or terminated personal data by anonymizing such data (meaning no one will be able to identify the data subject).

The Website

• All personal data collected from the Website is automatically transferred to the CRM. Once the transfer is successfully completed, the respective information will be deleted from the databases of the Website within one week, unless an error arose and the respective transfer was not made.
• Absent a request made in the name of applicable rights of the data subject (afforded under the GDPR), all personal data collected via "Contact Us" shall be maintained until unused for 3 years dfrom its last modification, access, or use date, will be deleted. However, the Company may retain any personal data when it has an overriding legitimate interest or is otherwise permitted by law.
• When you subscribe to the newsletter service via ‘Contact Us’ page, your data provided therein will be excepted from the deletion. If you unsubscribe from the newsletter service, such service will immediately stop. Thereon, your remaining personal data obtained from the "Contact Us" page will be deleted in accordance with the Company's internal policy as stated above, absent a separate request made by you to immediately delete.
• Absent a request made in the name of the applicable rights of the data subject, all personal data collected via "Request Newsletter" shall be maintained until unsubscribed. If you unsubscribe from the newsletter service, such service will immediately stop.  Thereon, applicable personal data will be deleted within 30 days of the unsubscribe request.
• If a data subject requests a regular e-mail service via the Newsletter Menu, the respective personal data will be excepted from the data targeted for deletion even after three days. If the data subject withdraws consent or makes a request to delete, all respective personal data will be deleted within 30 days or 60 days, as deemed permissible.
• All personal data collected and processed in relation solely to the "Partners" page will be promptly deleted upon termination, cessation, or expiration of commercial or other types of business relationship. Absent other reasonable grounds, the period for deletion shall not exceed 30 days from the last day of such relationship.

Newsletter Service / Media Alerts

• When you subscribe to the newsletter service via the "Contact Us" page or by other means in combination with another commercial request, your data provided therein will be excepted from the deletion. If you unsubscribe from the newsletter service, such service will immediately stop. Thereon, your remaining personal data obtained from the "Contact Us" page will be deleted in accordance with the Company's internal policy as stated above, absent a separate request made by you to immediately delete.
• If you only subscribed to the newsletter service (using the Newsletter tab and not through ‘Contact Us’) and you choose to unsubscribe, the newsletter service will immediately stop, and your personal data provided therein will be all deleted within 30 days.
• If you made a request to only receive applicable media alerts (using the Website's "Newsroom" or via direct request to the Company’s marketing manager) and you choose to no longer receive such alerts, the media alerts will immediately stop, and your personal data provided therein will be all deleted within 30 days.
• To avoid any doubt, if you made any other type of request, then your duplicate personal information may be excepted for the purpose provided therein.

The CRM

• Unless specified herein or subject to a request made by an applicable data subject, all personal data collected and processed in relation to business partners (inquirers, requesters, distributors, fabricators, etc.) will be deleted in accordance with the Company’s internal policy (generally three years unused or longer, as deemed necessary).
• The personal data of a point-of-contact, signatory, or person-in-charge related to a commercial or other type of similar contractual relationship shall be stored for 10 years, upon termination, expiration, or cancellation of such contractual relationship.
• Absent a request made in the name of applicable rights of the data subject, all personal data collected for the use of the newsletters service (input of data by the Company’s employees after direct sales) shall be maintained until unsubscribed. If you unsubscribe from the newsletter service, such service will immediately stop.  Thereon, applicable personal data will be deleted within 30 days of the unsubscribe request.

3. Matters Regarding Transfer of Your Personal Data to a Third-Party

The Company, in order to efficiently process and safeguard data, processes or transfers applicable data to its affiliates and external service providers. All personal data provided hereunder shall only be collected and processed for the purpose(s) accepted by you.

For any personal data being processed and transferred to a third party or internationally, absent unique situation, the Company shall process only under the Article 6(1)(b), ("processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a Contract") and/or Article (6)(1)(f), ("processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child"), or by other meands permitted by law.

• All personal data collected from the Website is transmitted to and processed by Salesforce.com, a CRM (Customer Relationship Management) system that the Company elects to use.
• The management of the Website's system operantions is consigned to two external service providers, Royalkomm and Internet X. These service providers, as part of their service related to the Website, will be able to access your personal information collected through the Website.
• As mentioned above, ‘Salesforce.com’ is a CRM system interfaced with the database of the Website and is currently being serviced by Salesforce to provide you with excellent services. The Company may share your personal information, only for the purpose(s) accepted by you, with a contracted distributor or other adequate business partner located near you to further such purpose. For certain requests, the involvement of a contract distributor is necessary.
• For requests or matters that cannot be handled solely by the Company, they may be provided to LG Hausys, Ltd. in Korea (LG Hausys HQ) for additional assistance. Such requests will only be transferred to fulfill the purpose(s) accepted by you.
• The Company uses an internal e-mail system called "e.com Inc." This service provider, as part of its service related to the CRM, will be able to access your personal information collected through the Website.
• The Company's newsletter service is delivered by MailChimp. This service provider, as part of its service related to the newsletter service, will be able to access your personal information collected through the Website.
• To better provide system provided by LG Hausys, Ltd. and its service provider for such system is LG CNS. This service provider, as part of its service related to the internal e-mail system, will be able to access your personal information collected.
• When and if the relationship with an aforementioned service provider ends, absent lawful reasons to retain it, all personal data processed in the course of the relationship will be deleted by such service provider as soon as the relationship ceases to exist.
• The Company collects and processes your personal data on th egrounds of one or more of the lawful bases permitted under the laws and regulations (such as performance of contract, legitimate interest of the Company, required by law, etc.). If you do not provide the Company with sufficient personal data to fulfill for your request, then the Company will not be able to proceed with your request.
• If you do not feel comfortable using the Website or another online method (i.e. e-mail) to submit your personal data, then you may choose to reach out to the Company by making a phone call to the Company’s main phone number. However, for certain requests, a the third-party transfer is unavoidable.

5. Matters Regarding Automated Decision-Making and Profiling

The Company currently does not use any type of automated decision-making such as profiling or others having similar or substantial effects on a data subject.  If this should change, this General Privacy Policy shall be revised accordingly to notify the users of the details of such changes.

6. Complying with Requests Related to the Rights of the Data Subject under Privacy/Data Protection Laws and Regulations.

In accordance with the rights provided by the GDPR and other relevant laws and regulations, you can request the following from the Company:

1. Access to your personal data ("Access to Personal Data")
2. Rectification of your personal data ("Rectification of Personal Data")
3. Deletion of some or all of your personal data ("Deletion of Personal Data")
4. Restriction of processing of your personal data ("Restriction" of Processing of Personal Data")
5. Data Porting of your personal data ("Personal Data Portability")
6. Objection to processing of your personal data ("Objection to the Processing of Personal Data")
7. Action on automated decision-making based on your personal data ("Action on Automated Decision-Making")
8. Withdrawal of your consent to personal data processing ("Withdrawal of Consent to Personal Data Processing’)

The above forms are only applicable when and if the Company has any personal data related to you. The Company may refuse to comply with your request when there is a need to process your personal data for certain lawful purposes (performance of contract, required by law, etc.) or the Company has an overriding legitimate interest to process it.

If you want to make a request as mentioned above, you can download the respective form from https://himacs.eu/en/rights-data-subject and submit such a request to the gdprweb@lghausys.com. In order for us to process your request, you must fill-in all required information and are strongly encouraged to fill-in additional information reasonably related to your request.

For all requests, the Company is to use only the contact information already within the CRM or in other applicable databases. As the Company requires an e-mail address for all commercial requests, such e-mail address will be the primary contact information to be used. If additional contact information is available, such as a phone number or address, then such methods may be used to verify the identity of the requester. When an e-mail address is used that is different from the one the Company has, then the Company will ask for verification of the requester’s identification.

In the case of a request received from a proxy, the Company will only process such request once the identity of the proxy has been verified (photo ID, etc.) and a lawful power of attorney has been received.

The standard processing time permitted by law is to respond within 30 days of the request. If the Company cannot process such a request within the permitted time period, then you will be notified with the reasons for the delay and the anticipated delivery date. When abusive, excessive, and/or repetitive requests are made, the Company may charge reasonable administrative fees to process such requests. 

7. Matters Regarding Technical Protection Measures

The Company devises the following technical protection measures to implement safeguards so that your personal data does not get lost, stolen, leaked, falsified or damaged during processing.

1. Measures against hacking, etc.

The Company uses antivirus software to prevent its PCs that are processing your personal data from being infected with a virus and periodically improves weaknesses in its systems by conducting penetration testing where applicable. Furthermore, security mechanisms (SSL, etc.) are employed to transmit personal data safely over the network used by the Company.

2. Storage of access records

The Company secures traceability by storing and managing records (web logs, summarized information, etc.) of access to the personal data processing system. There is no active monitoring of such records, and such records will be used when there is an issue or to take preventative measures.

3. Restrictions on access to personal data

The Company actively manages the permissions of each access group, both of its employees and its business partners, to sufficiently implement reasonable measures against data protection. Such actions may include granting, changing, and terminating one’s access. The Company only permits a small number of authorized employees to hold such management roles. Any and all creation, deletion and changes related to access will be recorded in accordance with the Company’s internal policy.

4. Deletion of personal data

 The Company regularly deletes personal data, whose purpose of use has expired, from the applicable databases.

The above protection measures do not guarantee perfect security. However, the Company will act diligently to prevent further damage, when there is an actual or suspected personal data breach.

8. Matters Regarding Cookies

The Company uses “cookies” that store and retrieve your personal data frequently to provide you with a more comfortable homepage environment.

  - What are cookies?

Cookies are very small test files that the server used to operate a homepage sends to your browser. They are sometimes stored on your computer’s hard disk.

 - Purposes of using cookies.

To provide a faster web environment to you by storing your preferred settings, etc., and to improve services.

 - Cookies settings

You can choose whether to install cookies or not. In other words, you can allow all cookies, go through confirmation whenever cookies are to be stored, or reject storage of any cookies by means of the seetings in your web browser.

 - Google Analytics

The Website uses Google Analytics, a web analytics service provided by Google, Inc. (“Google”).  Google Analytics uses cookies, which are text files placed on your computer, to help the Website analyze how users use the site. The information generated by the cookie about your use of the Website (including your IP address) will be transmitted to and stored by Google on servers in the United States . Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activity for Website operators and providing other services related to website activity and Internet usage.  Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google's behalf. Google will not associate your IP address with any other data held by Google.  You may refuse the use of cookies by selecting the appropriate settings in your browser. However, please note that if you do this you may not be able to use the full functionality of this Website.  By using this Website, you consent to the processing of data about you by Google in the manner and for the purposes set out above.

Please see the following for more details on how to check, manage and delete cookies on your computer: http://www.allaboutcookies.org.

9. Responsibility for Data Protection

■ LG Hausys Europe GmbH

     - Address:  Lyoner Str. 15, 60528 Frankfurt am Main, Germany

     - Phone:   +49-69-583-029-469

     - E-mail:  gdprweb@lghausys.com

■ Department in charge of data processing and protection for HI-MACS products/services and the Website

     - Department: LG Hausys Europe GmbH, HI-MACS Team

■ LG Hausys Europe Data Protection Officer

     - Name:    IBS data protection services and consulting GmbH, Dr. Michael Foth

     - Address: Zirkusweg 1, 20359 Hamburg, Germany

     - Phone:    +49-(0)40-696-985-24

     - E-mail:    info@ibs-data-protection.de

■ To file a complaint with the supervisory authority in Hessen, Germany:

If you need damage relief or a consult on infringement of your personal data, you can contact the following institution.

※ The following institution is a public body and is separate from the Company. If you are not satisfied with the result of the Company’s response to your claims or complaints, or need more specific assistance, please contact the following:

 * Supervisory authority in Hessen, Germany

    - Name:  Der Hessische Datenschutzbeauftragte

    - Phone:   +49-06-11-140-80

    - Fax:       +49-06-11-14-08-900

    - E-mail:   poststelle@datenschutz.hessen.de

    - Website:   http://www.datenschutz.hessen.de

This Privacy Policy takes effect on May 25, 2018.