We may collect information about you in various ways:

• You may provide us with the information directly (e.g. by contacting us via email or telephone, by submitting a form or survey, by signing a contract, or by visiting our offices).
• We may receive your data from third parties, including your employer and publicly available sources (e.g. your employer’s website, internet searches, or professional social media platforms).
• We may collect information automatically (e.g. when you access a Valora system, or through video (CCTV) recording and building access logs).

We may collect various types of personal data about, or relating to, you:

• Information necessary for the purpose of managing our business relationship with you, your employer or your representative, contacting you, and informing you of updates, promotions and events (e.g. your name, position, contact details).
• Information necessary to fulfil our contractual obligations and pay you for products, services and expenses (e.g. banking details, commission accounting data).
• Information necessary to sell our products to you and provide sales-related services, including fulfilling your orders and processing your payments (e.g. billing details, purchase orders).
• Information necessary to verify information you’ve provided us with for purposes of complying with our regulatory obligations and undertaking ‘know your supplier’ checks (e.g. an identity document to verify your identity, an excerpt from the commercial registry to verify your authority to act on behalf of your employer).
• Information necessary for the purpose of registering you on a Valora site, tool or system (e.g. email-address, password) and logs of that site, tool or system for information security purposes.
• Video surveillance data and visitor records if you visit our offices, stores or production sites for purposes of ensuring the security or our personnel, business partners and our property.

Whenever we process your personal data, we rely on a specific lawful basis. Depending on the purpose of the processing, one of the following legal bases applies:

• Compliance with a legal obligation to which we are subject (e.g. tax and business accounting obligations, legal and regulatory disclosure, retention of contracts and associated documents).
• Performance of a contract to which you are a party (e.g. payment processing, administration of master file data).
• A legitimate interest of Valora or a third party that is not overridden by interests you may have in the data not being processed for such purpose (e.g. CCTV security monitoring, access controls and logs relating to Valora systems).
• Where none of the above applies, we may rely on your consent (which we will ask for before we process your personal data).

We may share your personal information, if so necessary, with others:

• We may share some of your data with other companies of the Valora Group if necessary to achieve the applicable processing purposes. The Valora Group has an intra-group data transfer and processing agreement in place which regulates any transfers and further processing of your personal data within it.
• Where a data processor or a third party partner (e.g. a SaaS provider, logistics provider) or a third party partner (e.g. payment service provider, professional advisor) provides products or services to Valora, that provider may be able to access your data. We have entered into data processing agreements with any data processors, or respectively – if necessary – into appropriate data sharing clauses with any third party partners.
• In the event that we receive a lawful request for disclosure, we may also share your personal data with a court, regulator or law enforcement agency.
• If we are involved in a merger, joint venture, a sale or acquisition of a business or assets, we may share your information with a transaction partner.

If transfer of your information is required into a country the national laws of which do not provide for an appropriate level of data protection, we will ensure appropriate guarantees by concluding the recognized standard contract clauses with the recipient.

Valora retains your personal data only for as long as it believes is necessary to fulfill the purposes for which the personal data were collected. After that we will delete the data. Please note that we are legally obliged to retain certain information related to our business (e.g. for tax and accounting purposes).

• Business and payment records: We keep records of invoices, sales, purchases, payments made and received and any supporting documents (e.g. contracts, correspondence) for typically 10 years.
• Visitor records and system audit logs: If you visit our offices or production sites, or if you access Valora systems, we may retain log files for several months.
• CCTV: CCTV records are typically retained for a few days only, unless an event has been identified which requires further investigation. In such cases the video recordings are retained until the investigation has been closed.

Should you have any questions relating to this data privacy notice, your ability to exercise your right to access your data or to otherwise rectify, erase, restrict processing of, or object to the processing of, or benefit from the portability of your data, you may contact Valora’s Data Protection Officer by sending an email to dataprivacy@valora.com.

We reserve the right to change this data privacy notice at any time. Therefore, please visit this website regularly.