[Yara Australia Pty Ltd.] operates the Site and is the controller for the processing of your personal data when you use the Site.
For more information about how Yara processes personal data, please see the public version of Yara's Data Privacy Directive for Customer, Supplier and Business Partner Data which form a part of Yara's Binding Corporate Rules.
1. How and when we collect personal data
We collect information about you when you use the Site and when you otherwise interact with us. We receive your information from the following sources, depending on how you interact with us:
· From our websites or mobile applications: As a point of departure, you can use the Site without revealing your identity. When you visit the Site or otherwise interact with us online, we collect information about your computer and your use of our website and applications by using cookies. We use this information for measuring, at an aggregated level, use of the Site in order to improve its content. We also collect personal data when you use our mobile applications or contact us through the website or application, such as for customer service purposes. Please see the section below about Cookies and similar technologies[JSV1] .
· Directly from you: We collect personal data directly from you when you interact with us, and choose to submit certain information to us, such as when you register a profile on our websites, sign up to receive a newsletter, login in to one of our websites or apps, fill out one of our web forms online, make a purchase, place an order or upload information to one of our portals.
We may also collect your personal data when we receive an inquiry from you (for example in relation to customer service) and when processing your orders. Note that we are legally required to process some information (such as in relation to certain purchases) and sometimes we must ask you to provide certain information in order to be able to enter into and perform a contract with you.
On some occasions we conduct online surveys to gain a better understanding of the needs and preferences of our visitors. Prior to conducting a survey, we will inform you of how we will use your personal data. Participating in a survey is voluntary and you are free to participate and provide your consent to the processing. You have the right to withdraw your consent at any time by contacting us at firstname.lastname@example.org[JSV2] . [YIAU3]
· From our group of companies, dealers, business partners and other third parties: When you purchase a product, we may collect personal data relating to the transaction from our dealers for fulfilling the transaction. On your request, we may also import information from our dealers, business partners and other third parties.[YIAU4]
2. Types of information and data we collect
When you use the website, we collect personal data and device information to the extent permitted by law. Personal data is information, or a combination of pieces of information, that can be used to identify you on an individual basis. Depending on the services you use and how you use the Site, we may collect the following categories of data: [ 5]
3. How Yara uses personal data
We use your personal data for the following purposes:
4. What is the legal basis on which Yara relies to process your data?
5. Why personal data are disclosed by Yara
We do not sell your personal data to marketing companies outside of Yara. We may only share your personal data as follows:
We may also share aggregated data with our business partners and group of companies for various purposes, such as for improving our recommendations for your business, for developing the Site, further developing the equipment, for system administration, statistics, research and analyses.
If you do not wish to provide your personal data to us, we may not be able to provide the products and services you request, or to inform you about other products and services offered by Yara.
6. Cookies and similar technologies
We use first party cookies, third party cookies and third party requests. First party cookies are cookies set by us and can only be read by our site. By default, first-party cookies are allowed in every web browser. If you disable first-party cookies, a web site cannot keep track of your activity as you move from page to page. We use these types of first party cookies: session, http only, secure and persistent.
Third party requests are made from a user to an external service. Despite the fact that these requests don't set any cookies, they can still transfer information to third parties. For example, Google Analytics – a common tool for website analysis – which works through third party requests.
You may manage cookies in the settings of your web browser. Note that blocking cookies might stop our website from functioning properly.
7. Your choices
We give you choices about how we communicate with you.
Please note that we will honor your request to stop receiving promotional electronic communications from Yara. However, we may continue to send you service-related communications such as emails confirming purchases through our websites. And we may keep information for record keeping, such as to ensure we fulfil the consumer requests and to send particular types of messages.
Note that you can manage how your mobile device can share location information with Yara, as well as how your mobile browser handles cookies and related technologies by adjusting your mobile device privacy and security settings. Please refer to the instructions provided by your mobile service provider or the manufacturer of your device to learn how to adjust your settings.
8. Your rights
You have the right to request access, rectification, restriction and deletion of your personal data held by Yara and receive a copy of your personal data in a structured machine-readable format. If you have a registered profile, you may at all times update, correct or delete information you have provided to us by using the Site. Inquiries regarding processing of personal data and access request shall be directed to the point of contact provided below.
You also have rights to object to some processing and, where we have asked for your consent to process your data, to withdraw this consent. Where we process your data because we have a legitimate interest in doing so (as explained above), you also have a right to object to this. These rights may be limited in some situations - for example, where we can demonstrate that we have a legal requirement to process your data.
Where we require personal data to comply with legal or contractual obligations, then provision of such data is mandatory: if such data is not provided, then we will not be able to manage our contractual relationship, or to meet obligations placed on us. In all other cases, provision of requested personal data is optional.
Your personal data will be retained for the length of any contractual relationship you have with us, and, to the extent permitted, after the end of that relationship for as long as necessary to perform the services set out in this notice. You can at any time send us a request to email@example.com ask us to delete your user account.
9. Information security
Yara is concerned about your privacy and are committed to keeping personal data secure. We have implemented appropriate technical, physical and organizational measures to protect your personal data from loss, misuse or alteration. We limit access to personal data to those who have a business need.
Transfer of personal data to a third country outside of the EEA that does not provide adequate protection will only take place if appropriate safeguards are provided, e.g., by Binding Corporate Rules, entering into EU Standard Contractual Clauses or if the receiving party is certified under the EU-US Privacy Shield.
When disclosing information to other parties as described in Section 5, we sometimes need to transfer personal data to a country outside the EEA, in order to be able to fulfil one of the purposes set out in Section 5. As an example, we may use a sub-processor established in the US when you fill out an online form, in order to meet your request. Such transfer will only take place provided that appropriate safeguards are adduced, as described above[ 19] .
If you have any questions relating to this, please contact us at the contact point provided below.
Yara may transfer aggregated data to third parties (domestic and/or foreign) for the purposes of i) improving or developing the Site or any equipment related to specific services and ii) for the proper functioning of the Site and of the equipment.
11. Privacy Policies of third parties
12. Changes and amendments to this policy
If you do not want to continue your use of the Site following the said changes, you must discontinue your use of the Site and request Yara to close your account by contacting us at firstname.lastname@example.org[JSV21] or through the relevant portal, where applicable.
13. Jurisdiction and applicable law
14. How to contact us
[Level 1, 6 Holt Street, McMahons Point, Syndey NSW 2060]
If you have unresolved concerns you also have the right to complain to the supervisory authority competent to resolve such concerns according to applicable law or the public version of Yara's Data Privacy Directive for Customer, Supplier and Business Partner Data.
Effective date: 21/06/2018 / Last updated: 21/06/2018
[JSV1]To Yara: We assume you provide more information about cookies somewhere else, for example in point 4 on Cookies? If yes, then it is OK to delete the reference to the Cookies Settings.
Yara is legally obliged to inform about the functionality and purpose of the cookies and according to Nkom information should also be provided about which cookies are used (and at least their functionality). Some fulfil the cookie-consent requirement by providing the user the possibility to adjust the cookie settings in his/her web browser. If this is the case, we must also inform about this.
[JSV2]To Yara: Following dialogue with the Salesforce team, we have received this e-mail address as the correct one for withdrawing consent.
[YIAU3]A.G.: How is this facilitated?
To Yara: See comment above.
[YIAU4]A.G.: How is this related to the websites? For RFQ we don’t track the transaction, only the request.
To Yara: We inserted this in case a customer has not received this information about the fact that Yara has collected the customer’s information for this purpose, to fulfil the information obligation.
[ 5]To Yara: Please note that according to the A29WP's guidelines on the matter, that terms such as "we may" may be deemed not to be clear enough to meet the transparency requirements under the GDPR.
As it is challenging creating a template for all countries globally that shall be clear enough, we suggest that we discuss how you wish to move forward on this point. One approach would be to replace "we may collect" with merely "we collect", but the list below should then be made as "spot on" as possible, for each country.
[ 6]Comment DN: This would likely be covered in the MyYara terms and conditions as that is when you register a user account. Suggest paragraph is removed as not needed in the general website terms/privacy. If need to keep it then can adjust wording to refer to Location data and activity at that location.
[JSV9]To Yara: Are the visitors’ IP addresses collected in this context? Please note that IP addresses are considered to qualify as personal data and thus, our advice is that we keep this text in, unless you do not collect IP-addresses or are otherwise able to recognize the visitor.
[YIAU10]A.G.: Should we say that this information is aggregated, meaning we don’t track it down to one particular user even if they have registered with their email address (yet J )
To Yara:See answer in the comment above.
[JSV11]To Yara: Following dialogue with the Salesforce team, we have received this e-mail address as the correct one for receiving such opt-out requests.
[JSV12]To Yara: Following dialogue with the Salesforce team, we have received this e-mail address as the correct one for receiving such withdrawals of consents.
[JSV13]To Yara: We received input from Luz with regard to this point, and suggests therefore to insert this sentence, for the sake of good order.
[JSV14]To Yara: Following dialogue with the Salesforce team, we have received this e-mail address as the correct one for receiving such opt-out requests.
[ 15]To Yara: Are you intending to transfer any personal data outside of the EU/EEA when visitors are using the Site?
The requirement is that information is provided where applicable about the fact that the controller (the relevant Yara entity in each case) intends to transfer personal data to a third country (outside the EEA) and the existence or absence of appropriate safeguards (such as the ones mentioned in the current clause 10).
Please note that there is a certain level of specification that is required in order to fulfill the transparency requirement. In order for the information to qualify as specific enough, all the relevant third countries to which personal data will be transferred should be mentioned (if applicable).
We wish to get your input before finalizing this section.
[ 16]From Luz Frison: In words of Joakim, Salesforce is under the EU-US Data Protection shield, referenced below:
If in the future, someone fills in a form on yara.com and this is stored and then sent to Salesforce, we need to make sure that both the CMS (yara.com) and Salesforce is GDPR compliant.
About data centre location I think is not so clear, maybe EU by default, it has to be in the agreement with SF… if you need further information, please let me know
[ 17]Comment DN: We do not intend to transfer data outside of EU. But we use data processors who may have data centres outside the EU. Google Analyics and Websites – both I understand not personal information. Salesfore CRM being another (in future if someone filled in a form on website, it would intergrate with Salesforce). Yara will check with Salesforce project on this.
[ 18]To Yara: If it is not possible to identify an individual from the data collected through Google Analytics and Websites (on its own or together with other information) then it is not personal data. If it is possible to link this data to a specific user (for example, if a person has a registered account), then this data is deemed to be personal. See question in comment below relating to this.
[ 19]To Yara: Based on the comments above, our understanding is that some personal data will be processed in the US (as Salesforce is based in the US) and that potentially, there may be cases where processors or sub-processors are processing personal data outside the EEA. We suggest therefore to insert some additional information on this point, in order to provide specific enough information.
Based on our comment above, Can you please verify whether or not personal data will be transferred to any third countries (such as due to use of processors or sub-processors), and in that case, which country/countries and in which instances? We should in that case, try to cover this here to the extent possible.
[ 20]To Yara: Please note that it is important that all fundamental changes are clearly communicated to the users of the Site/services in a way that ensures that most recipients will actually notice them. We have simplified this clause accordingly.
[JSV21]To Yara: Following dialogue with the Salesforce team, we have received this e-mail address as the correct one for receiving such requests.
[ 22]To Yara: Following a discussion with Cecilie, we inserted the dataprivacy e-mail address and suggest you also provide contact information to the local Yara office and the person that may be contacted at a local level.