Privacy Policy and processing of personal data

Supplier: One Click LCA Ltd, Sörnäistenkatu 1, 00580 Helsinki, FINLAND; or when so agreed, SimaPro BV, Stationsplein 121, 3818 LE Amersfoort, The Netherlands, and their Affiliates.

1. This Privacy Policy (Policy) applies to Supplier’s processing of personal data, that is, how we collect and use personal data about users of our services, visitors to our websites, people who register to our activities fill out forms to receive further information, and supplier and partner contacts. Personal data is processed in line with the GDPR, Finnish Data Protection Act or Dutch UAVG and other applicable laws.

2. We do notsell personal data. Affiliates are a part of the Supplier. Supplier shares marketing and customer relationship systems. For marketing and sales, we act as joint data controllers. We have agreed between us who handles which obligations, and you can exercise your rights with One Click LCA or SimaPro. We share limited business data (job title and company name) as part of analytical data, as defined in 16.

3. The Supplier may share Personal Data with its Resellers when they manage the Customer relationship.

4. The Supplier uses technical and organisational measures appropriate to the risk to protect personal data. These include access controls, role-based permissions, encryption and contractual obligations on our service providers. The Supplier shall not be held liable by any third party, including the User, in any event of unauthorized access, use and/or disclosure of any information in Service. If a personal data breach is likely to result in a high risk to you, we will inform you without undue delay.

5. Personal Data requests shall be sent to support@oneclicklca.com.

6. The Supplier is an independent data controller. Within our organisation, personal data is available only to staff who need it for their role, such as sales, marketing, customer support, administration and IT. All staff with access are bound by confidentiality.

7. We use personal data for the purposes described in this Policy, on the legal basis stated for each purpose. Our Affiliates, contractors, and Resellers may process personal data for us, or as set out in this Policy.

8. Supplier does not collect special personal data (e.g. political opinions). Please do not share them with us.

9. Personal data is stored on secure servers. Supplier stores personal data inside the EU.

10. Some service providers of the Supplier are outside the EU or EEA, causing data transfer outside the EEA. All these transfers are performed under appropriate safeguards and implement necessary technical, organisational, or contractual measures to ensure that personal data has the same protection as in EEA.

11. The Supplier keeps personal data only as long as we need it for the purpose we collected it for. However, we may keep relevant data longer where needed to establish, exercise, or defend legal claims. The data retention duration depends on the data type: a) User data: for as long as you have access to the Service and as long as linked to a project afterwards. User accounts are removed by User deleting their account or by making a support request to do so. b) Marketing data: until you unsubscribe or object, or until a set period since your last interaction. c) Newsletter opt-outs: we keep your email address on a suppression list,so we don't contact you again. d) Records we must keep by law: such as invoices and contracts, for as long as law requires. e) Cookies and analytics data: as per cookie declaration oneclicklca.com/tracking/cookie-declaration.

12. The Supplier's websites use cookies and similar technologies. Necessary cookies keep the websites and the Service working, for example your login, and do not require consent. We use analytics, preference, and marketing cookies only with your consent. You give or refuse consent in our cookie banner. With your consent, these cookies may collect your IP address, device and browser details, cookie identifiers, pages visited, and actions taken. We use them to understand how visitors use our websites and to improve their experience. We also use them to show you relevant ads on other platforms, based on the content you've viewed. If you've filled in one of our forms, we link your website activity to your contact record. You can change your choice at any time in the Cookie settings. Our cookie declaration oneclicklca.com/tracking/cookie-declaration lists all cookies and their providers. For data collected through advertising pixels, we and the advertising platform are joint data controllers for the collection and transfer of that data. Each platform's own privacy policy covers its further use.

13. Delivery of the Service and legitimate interest: The Supplier processes personal data to provide the Service under the contract with you. This includes your user account, customer support, training, and the Academy, the community forum, online purchases and payments, and service notifications such as password resets and licence notices. We also collect data on how the Service is used to keep it secure and improve it. The legal basis is performance of our contract. We process name, business email, phone One Click LCA and SimaPro General Service Terms 14 (23) number, company, and usage and support records. Service notifications cannot be unsubscribed from while your account is active.

14. Enquiries, sales meetings, demos, quotes and agreements: Supplier processes name, business email, phone number, company, and job title for these. Sales meetings may be recorded for notes and training; the User is told beforehand and may decline. For webinars and events, the Supplier processes registration and attendance details. Recordings, including questions and chat messages, may be shared with registrants, and registration details are shared with any co-host named on the form. The legal basis is legitimate interest, or steps taken at the User's request before entering into a contract.

15. User requests for data: if the User requests for data (e.g. EPD data) from a third party (e.g. manufacturer) in the Service, the Supplier is authorized to transfer the business contacts, business name and job title, as well as relevant information about the request of the User to that third-party to respond to request.

16. Manufacturer feedback: based on its legitimate interest, the Supplier processes job titles and company name to provide analytical services to manufacturers about the use and evaluation of their products within the Service. Such analytical service may be shared with manufacturers under contract.

17. Marketing and newsletters: With the User's consent, the Supplier sends newsletters and other marketing emails, such as product news, event invitations, and offers. The Supplier may share contact details in coded form with advertising platforms to show the User relevant ads. It processes name, business email, company, job title, and interactions with The Supplier’s emails, events, and websites. The User can withdraw consent at any time via any email's unsubscribe link.

18. Contacting prospects: Based on its legitimate interest in promoting its services, the Supplier may contact professionals relevant to its products. It processes name, business email, and phone number, company, job title and professional profile URL, partly obtained from business data providers. Marketing emails may track opens and clicks, with consent where law requires it. The Supplier may score contacts based on their company, role and interactions with its content and communications to decide whom to follow up with. The User can object to direct marketing and related profiling at any time by contacting support.

19. Sources of personal data: The Supplier collects personal data directly from you, for example when you create an account, fill in a form, register for a webinar, email us, or meet with us. We also receive personal data from business contact data providers, who give us professional details: name, business email, business phone number, job title, seniority, company and professional profile URL; event organisers and co-marketing partners, when you register for an event or a webinar we co-host with a partner; and our websites and emails, through cookies and similar technologies.

20. To deliver its obligations, the Supplier works with data sub-processors who are contracted for specific tasks. The Supplier reserves the right to modify the list of sub-processors at any time without notice. The list: https://help.oneclicklca.com/en/articles/275997-one-click-lca-personal-data-processors.

21. Data subject rights: The User may access, correct, delete, restrict, or receive a copy of their personal data, and object to processing based on legitimate interest. The User can always object to direct marketing, including related profiling, and withdraw consent at any time. Requests shall be sent to support@oneclicklca.com.

22. Where Customer or User enjoy statutory data protection rights in the UK, the UK GDPR and DPA 2018 apply to them on a statutory basis. The Supplier’s UK representative is One Click LCA UK Ltd, contactable at support@oneclicklca.com.

23. The competent supervisory authority for personal data processing for One Click LCA is the Office of the Data Protection Ombudsman and for SimaPro it is the Dutch Data Protection Authority.