PRIVACY POLICY
Feilo Sylvania Group Privacy Policy
1. Background
This privacy policy (“Policy”) informs you what happens to any Personal Data that you give to us, or we may collect or otherwise process from or about you.
It applies to Data Processing related to all of our products and services, and instances where we collect or otherwise process your Personal Data.
This Policy applies to Personal Data processed by or on behalf of the Feilo Sylvania Group (“FS Group”) or any of its members.
We highlight that this Policy especially highlights compliance with the GDPR and provides detailed information on how to exercise data protection rights and remedies under the GDPR. The definitions below under Art. 2 are also given in accordance with the GDPR. We highlight, however, that depending on where you reside or use our products and service, other Third Countries laws can apply, which use different terms and definitions, regulate privacy and data protection matters differently, or guarantee other or less data protection rights and remedies.
2. Definitions
a) Data Controller: The party (person or legal entity) that determines the purpose and means of the processing of Personal Data.
b) Data Processing: Any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
c) Data Processor: The party (person or legal entity) that processes Personal Data on behalf of a Data Controller. The Data Processor acts under or according to the instructions of a Data Controller (including cases, where the purpose and the means of Data Processing are defined by the Data Controller, but the Data Processor takes care of everyday operation in line with such purpose and means).
d) Data Subject: A natural person identified or identifiable by Personal Data.
e) EEA: European Economic Area, which includes the members of the European Union (EU), as well as Iceland, Liechtenstein and Norway.
f) FS Group: The Feilo Sylvania Group as specified under Art. 3 of this Policy below.
g) GDPR: General Data Protection Regulation (Regulation 2016/679/EU).
h) Personal Data: Any information relating to a living individual (Data Subject), who can be identified directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that Data Subject.
i) Personal Data Breach: Means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data transmitted, stored or otherwise processed by FS Group (including any temporary or permanent loss of control of, or inability to access, Personal Data).
j) System(s): Means the relevant IT system operated by the FS Group or one or more of its member(s) for storing Personal Data.
k) Third Country: Country outside of the European Union (EU), Norway, Liechtenstein and Iceland (EEA).
l) Third Party: A natural or legal person (as well as public authority, agency or body) other than the Data Subject, the Data Controller, the Data Processor and the persons who, under the direct authority of the Data Controller or the Data Processor, are authorised to process Personal Data.
m) Website: the https://www.sylvania-lighting.com/ website and its subsites.
3. The Feilo Sylvania Group
The Feilo Sylvania Group is held by Feilo Malta Limited (Level 2 West Mercury Tower, the Exchange Financial and Business Center, Elia Zammit St. Julians, STJ 3155 Malta). The Feilo Sylvania entity or entities (FS Group member(s)) which provide products or services to you are named on our Website or in the contract concluded with you or the person/entity represented by you or in a document or additional information provided to you by the FS Group or one of its members. The Feilo Sylvania entity that processes your Personal Data in accordance with the above will be regarded as the Data Controller. You can contact such Data Controller using the details on our website or in the contract concluded with such Data Controller or document or information provided by such Data Controller.
Based on the above and unless otherwise provided by this Policy, under “we”, the Data Controller is understood in the following points. Unless otherwise provided by us, in case of any conflict with this Policy, the information provided by the Data Subject separately (e.g. information provided in a local policy or in the specific contract concluded with such Data Subject or in its annex) is regarded as governing.
4. What kinds of Personal Data do we process about you (scope of Personal Data processed)?
Personal Data that we process in connection with our relevant products and services – and related activities, which include:
- Personal and contact details, such as title/position, full name, contact details and contact details history (only relevant if necessary to verify contact details used previously or needs to be kept in order to comply with local laws).
- Your date of birth, gender and/or age, as far as it is necessary for complying with local laws or to verify whether you are entitled to use a given service or product (age, and date of birth, if necessary), and to address you or address specific marketing or other offers to you (gender). It is highlighted in this respects that we respect everyone’s right not to identify gender or refrain from answering, unless local laws require us to collect or otherwise process such Personal Data.
- Your nationality, if needed for the product or service or required by local laws.
- Your company details, if relevant for the supply of goods or services.
- Records of your contact with us such as via phone and, if you get in touch with us online using our online services or via our smartphone app, details such as your mobile phone location data, IP address and MAC address. It is highlighted that we do not collect location data, IP address or MAC address without your consent, unless you cannot be identified by our related data collection, or unless compliance with local laws require such collection.
- Products and services you hold with us, as well as your inquiry or interest indicated earlier concerning our products and services, and the associated payment methods used.
- The order and delivery/provision of our products and services, any purchase orders and invoices.
- Personal Data related to marketing offers and data analysis, including previous purchases and orders, marketing communications, and whether you open them or click on related links, and information about products or services we think you may be interested in, and data analysis undertaken to help target offers to you that we think are of interest or relevance to you (for example: based on your consent, we may collect your age, gender and the region where you live, so we can send offers to you, which might be interesting for you based on such Personal Data and our related analysis).
- Information about your use of products or services held by our business partners, such as, financial services and products, as far as relevant and applicable with respect to local laws.
- Information we obtained from third parties with your consent.
- Information about your property or site, such as location, number of rooms, property type and installation work undertaken at the property, photos of the site if relevant. Such data are relevant for certain services we provide for homeowners and concerning certain real estates (e.g. office buildings). We do not use such data to assess your financial situation and wealth.
- Financial details about you, such as your payment method(s), which are important for us to be paid for our services and to pay or repay you with regard to the relevant contractual terms.
- Information we buy or rent from Third Parties, including demographic information, details of outstanding finance, marketing lists, publicly available information, and information to help improve the relevance of our products and services. Usually, such data do not involve Personal Data, and we only process Personal Data collected from such sources, if we identify a relevant legal basis or in cases, where such data are regarded as public data and such nature of the data are kept in the course of our processing.
- Insights about you and our customers gained from analysis or profiling of customers, cookies, usage data. It is underpinned that generally, such data are collected in aggregate or in an anonymous form, therefore no Data Subject can be identified based on such data
5. What is the source of Personal Data?
We collect Personal Data from the following sources:
- From you directly.
- From suppliers of products and services as far as they are identifiable to you in accordance with local laws.
- Information generated about you when you use our products and services.
- From an agent or distributor who we work with to provide products or services or quote to you.
- Other FS Group member if you already bought a product from them, or have applied for one.
- Business partners (for example, financial services institutions) or others who are a part of providing your products and services or operating our business.
- We buy or rent information about you or other customers generally from third parties including demographic information, marketing lists, publicly available information and other information to help improve the sale of our products and services or our business. It is underpinned, that generally, such sets of information do not identify you or other customers uniquely and therefore, they are generally not regarded as Personal Data.
6. What do we use your Personal Data for (purpose of processing)?
We use your Personal Data, including any of the Personal Data listed in section 4 above, for the following purposes:
- Assessing an application for a product or service, including considering whether or not to offer you the product or service, the price, the risk of doing so, availability of payment method and the terms.
- Managing products and services or related applications.
- Updating your records.
- Tracing your whereabouts (based on your consent).
- Recovering debt (especially including contractual debts, such as purchase prices or service fees),
- Managing other aspects of the product or service.
- Making automated decisions on whether to offer you a product or service, or the price, payment method, risk or terms of it.
- Performing and/or testing the performance of our products and services.
- Improving the operation of our business and that of our business partners.
- Managing and auditing our business operations including accounting.
- Monitoring and keeping records of our communications with you and our staff in accordance with relevant telephone solicitation, consumer protection and recording laws.
- For market research and analysis and developing statistics.
- For direct marketing communications and related profiling to help us to offer you relevant products and services, including deciding on whether or not to offer you certain products and services. We may send marketing offers to you by text message (SMS), email, via phone call, our applications, by post, social media and digital channels (for example, using Facebook Custom Audiences and Google Custom Match).
- Developing new products and services and reviewing and improving our current products and services.
- Complying with legal obligations and requirements.
- Providing insight and analysis of our customers both for ourselves and for the benefit of business partners either as part of providing products or services, helping us improve products or services, or assessing or improving the operation of our businesses.
- Sharing information, as needed with business partners (for example, financial services institutions), service providers or as part of providing and administering our products and services or operating our business.
- Facilitating the sale of one or more parts of our business.
- Enabling other FS Group companies to perform any of the above purposes.
7. What is the legal basis for our processing of your P Personal Data (including when we share it with others)?
We rely on the following legal bases to process your Personal Data:
A. Data Processing is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract with us (unless otherwise provided or permitted by local laws, this especially includes business-to-consumer contracts and such business-to-business contracts concluded by us, which are concluded with Data Subjects, such as natural person entrepreneurs or free agents, directly; contractual relationships in this respect also include contractual relationships based on general terms and conditions), such as:
- Assessing an application for a product or service in the pre-contractual phase, including the consideration of whether or not to offer you the product, as well as the assessment of the price, the payment methods available and the conditions.
- Managing products and services you hold with us, or an application for one (based on a contract concluded with you).
- Providing services based on a contract, including updating your related records, tracing your whereabouts, if such Data Processing is necessary for performing the given contract (e.g. a contract concluded for certain location services).
- Sharing your Personal Data with business partners and service providers when you apply for a product to help manage your product – in this respect, unless otherwise provided by local laws, your Personal Data is only shared with the above partners and providers for the performance of the given contract, if a) you gave prior informed consent for such sharing, b) you contracted with both the Data Controller and such partners and providers, c) such partners and providers act as Data Processors or sub-processors, d) sharing is based on the legitimate interest of the Data Controller and such partners and providers.
- All stages and activities relevant to managing the product or service including enquiry, order requests, additional contractual communication, supply and delivery, contractual claims handling, warranty claims, administration and management of accounts.
B. Where Data Processing is based on our legitimate interests or on the legitimate interests of a Third Party, such as:
- Recovering debt, defending against claims (especially related to torts, breaches of contract or similar non-compliance) and protecting our interests in the relevant court procedure and other procedure of a competent authority .
- Maintaining network and data security (including the making of backups from our Systems).
- Performing and/or testing the performance of our products and services.
- Managing and auditing our business operations.
- Keeping records of our communications (especially including non-contractual communications) with you and our staff to defend against possible claims, as well as in procedures at competent courts and authorities.
- Marketing offers and requests to take part in surveys or give feedback to the extent that you reasonably expect such requests. Unless otherwise provided by local law, this especially includes communications sent to business customers/clients, as well as existing or recent natural person customers, who used products and services of the Data Controller similar to those, which appear in the communication, or where reasonable cooperation is required related to such recent use of services or products.
- Facilitating the sale of one or more parts of our business, including mergers and acquisitions.
C. To comply with our legal obligations:
- Complying with our legal and related regulatory obligations and requirements set out by laws and authorities, especially including taxation, accounting, auditing, money laundering and other applicable requirements and regulations.
- Where we need to share your Personal Data with competent entities in order to comply with legal and/or regulatory obligations (e.g. authorities investigating certain matters).
- Following guidance and recommended best practices of government and regulatory bodies.
D. With your consent or explicit consent:
- For direct marketing communications, unless you reasonably expect such direct marketing communication (as specified above), or in cases, where a marketing communication is deemed intrusive – with respect to local laws and authority practices –, such as marketing by telephone solicitation or by post (unless you reasonably expect such marketing communications with respect to local laws and your previous communication with us).
- Profiling and other automated decision-making (especially in case of marketing offers and offering certain services based on profiling) as relevant, as well as location services (unless such services are necessarily based on a contract concluded with you).
- Requiring feedback and the use of Personal Data related to recent transactions to help develop new products and services (if such Data Processing is not reasonably expected by you, as highlighted above).
8. When do we share your Personal Data with other persons and organisations?
We may share information with the following Third Parties, as well as other persons and organisations for the purposes listed above:
- FS Group companies.
- Business partners acting as Data Processors of the Data Controller or the FS Group (including sub-processors of such Data Processors), such as backup and server hosting providers, IT software and maintenance providers, document storage providers, suppliers of other back office functions, debt recovery agencies acting as agents of the Data Controller (depending on the case and the applicable law, they can act as Data Controllers, especially if they bought the claim or they act in their own name).
- Business partners acting as joint controllers (for example, certain marketing service providers who may also use your Personal Data for their own purposes) acting jointly with the Data Controller or the FS Group.
- Business partners acting as sole controllers (for example, financial institutions, insurers) or others who are a part of providing your products and services or operating our business.
- Governmental and regulatory bodies.
9. How and when can you withdraw your consent?
Where we rely on your consent to process your Personal Data, you can withdraw such consent freely, at any time by contacting us. Please note that the withdrawal of your consent does not affect the lawfulness of the Data Processing carried out before such withdrawal.
10. Is your Personal Data transferred outside the EU?
We are a global organisation covering mainly Europe, the Middle East and Africa (EMEA), Latin America (LATAM) and Southeast Asia. Our head office is based in Hungary and our supporting back offices are based in the UK and in Belgium. Your Personal Data may therefore be transferred outside the EU. If we transfer your Personal Data outside of the EU, or one of our partners does so, we make sure that suitable safeguards are in place, for example by using standard contractual clauses, unless certain exceptions apply.
In accordance with the above, the Data Controller only transfers your Personal Data to a Third Country from the EU on the basis of an adequacy decision of the European Commission (for the list of countries affected by the adequacy decisions of the European Commission, please see: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en), for example, in case of the UK or EEA countries not part of the EU, subject to other appropriate safeguards, or in certain other cases, where a derogation for a specific situation applies. It is also highlighted that certain other data transfer requirements can apply in the case of transfer between a Third Country and another Third Country; however, we take reasonable steps to comply with every relevant data transfer requirement.
You may request information of such safeguards by contacting us by using the contact details on our Website or in the contract concluded with the Data Controller or in the document or information provided by the Data Controller.
11. What should you do if your Personal Data changes?
You should tell us if it is relevant for contacting you and for processing your Personal Data fairly and reasonably, so that we can update our records and keep your Personal Data up-to-date.
12. Do you have to provide your Personal Data to us?
We are unable to provide you with our products or services if you do not provide certain Personal Data to us. In cases, where providing some Personal Data is optional, we make this clear.
13. Do we do any monitoring involving processing of your Personal Data?
In this article monitoring means any: listening to, recording of, viewing of, or taking and keeping records (as the case may be) of calls, email, text messages, social media messages, in person (face to face) meetings and other communications in line with relevant, local consumer protection, solicitation, recording and other laws.
We may monitor – only where permitted by applicable laws –, and we do this where the law requires it, or to comply with regulatory rules, to prevent or detect crime, in the interests of protecting the security of our Systems and related communications systems and procedures and for quality control and staff training purposes. This information may be shared for the purposes described above.
14. For how long is your Personal Data retained by us?
Unless we explain otherwise to you, we store or otherwise process your Personal Data with respect to the following applicable retention periods or based on the following criteria:
- For as long as it is necessary to perform a contract concluded with us and to comply with our contractual communications.
- Until the statute of limitations for the relevant civil law claims lapses in accordance with the applicable law (this can also be applicable in cases, where Personal Data were collected based on contract).
- Until the statute of limitation for a specific felony or misdemeanor or other crime lapses in accordance with the applicable law or if this is shorter, until a reasonable time passes for detecting such a crime and reporting it to the competent authority (this is especially relevant in cases where we operate a CCTV or in cases where we reasonably suspect that a crime may have been committed, such as in the case of theft at an event or burglary in a premise).
- Until a relevant procedure at the competent court or authority can be initiated against us for violation of consumer protection, product safety or equal protection laws or similar requirements.
- Until you withdraw your consent (if Data Processing is based on consent).
- Until you object to the Data Processing (if Data Processing is based on legitimate interest, and an overriding interest of the Data Controller or a Third Party does not exist).
- Until the purpose of processing becomes obsolete, and the related Personal Data are not needed anymore (this is especially true in cases, where the purpose of processing ceases).
- Until another retention period prescribed by the applicable law, guidance or decision of authority lapses.
15. What are your rights under data protection laws?
Here is a list of the data protection rights that all Data Subjects have under the GDPR:
- The right to be informed about the processing of your Personal Data
- The right to have your Personal Data corrected if it is inaccurate and to have incomplete Personal Data completed
- The right to object to processing of your Personal Data
- The right to restrict processing of your Personal Data
- The right to have your Personal Data erased (the “right to be forgotten”)
- The right to request access to your Personal Data and to obtain information about how we process it
- The right to move, copy or transfer your Personal Data (“data portability”)
- Rights in relation to automated decision making which has a legal effect or otherwise significantly affects you.
It is highlighted that data protection laws in Third Countries may provide for less, additional or different data protection rights and remedies. It is also underpinned, that such rights do not apply in all circumstances. If you wish to exercise any of them, we recommend reading the information below. In case you have a question concerning your data protection rights and remedies in your country, you can also contact us and we provide more information.
15.1. Data protection rights and remedies under the GDPR:
Answering your data protection inquiries or completing your request is free of charge. However, if your request to exercise your data protection rights is manifestly unfounded or excessive (e.g. in the case of frequent repetition without any reasonable basis), we are entitled to either charge a reasonable fee, taking into account the administrative costs of providing the information or communication or taking the action requested or refuse to act on the request.
The data protection rights and remedies of the Data Subjects (including yours) are listed in the relevant provisions of the GDPR (in particular Art. 15, 16, 17, 18, 19, 20, 21, 77. 78, 79, 80 and 82 of the GDPR). The following is a summary of the key provisions and, accordingly, the Data Controller will inform Data Subjects about their rights and remedies regarding Data Processing.
The Data Controller shall provide information on action taken on a request under Articles 15 to 22 of the GDPR to the Data Subject without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. The Data Controller shall inform the Data Subject of any such extension within one month of receipt of the request, together with the reasons for the delay. Where the Data Subject makes the request by electronic form means, the information shall be provided by electronic means where possible, unless otherwise requested by the Data Subject.
If the Data Controller does not take action on the request of the Data Subject, the Data Controller shall inform the Data Subject without delay and at the latest within one month of receipt of the request of the reasons for not taking action and on the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.
The information shall be provided in writing, or by other means, including, where appropriate, by electronic means. When requested by the Data Subject, the information may be provided orally, provided that the identity of the Data Subject is proven by other means.
15.2 Right of access
You shall have the right to obtain from the Data Controller confirmation as to whether or not Personal Data concerning you are being processed, and, where that is the case, access to the Personal Data and the following information:
a) the purposes of the Data Processing;
b) the categories of Personal Data concerned;
c) the recipients or categories of recipient to whom the Personal Data have been or will be disclosed, in particular recipients in Third Countries or international organizations;
d) where possible, the envisaged period for which the Personal Data will be stored, or, if not possible, the criteria used to determine that period;
e) the existence of the right to request from the Data Controller rectification or erasure of Personal Data or restriction of processing of Personal Data concerning you or to object to such processing;
f) the right to lodge a complaint with a supervisory authority;
g) where the Personal Data are not collected from you, any available information as to their source.
Where Personal Data are transferred to a Third Country, you shall have the right to be informed of the appropriate safeguards relating to the transfer.
The Data Controller shall provide a copy of the Personal Data undergoing processing. For any further copies requested by you, the Data Controller may charge a reasonable fee based on administrative costs. Where you make the request by electronic means, and unless otherwise requested by you, the information shall be provided in a commonly used electronic form.
15.3. Right to rectification
You shall have the right to obtain from us the erasure of Personal Data concerning you without undue delay and we shall have the obligation to erase Personal Data without undue delay where one of the following grounds applies.
Please note that by reporting a change in your Personal Data, you can help us serve you better by giving us accurate information about you.
15.4. Right to erasure
You have the right to request that the Data Controller deleted Personal Data concerning you immediately and the Data Controller is obliged to delete Personal Data immediately if one of the following reasons applies:
a) the Personal Data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
b) you withdraw your consent on which the Data Processing is based, and where there is no other legal ground for the Data Processing;
c) you object to the Data Processing and there are no overriding legitimate grounds for the Data Processing, or you object to the Data Processing;
d) the Personal Data have been unlawfully processed;
e) the Personal Data have to be erased for compliance with a legal obligation in European Union or EU Member State law to which the Data Controller is subject;
f) the Personal Data have been collected in relation to the offer of information society services.
15.5. Right to restriction of processing
You shall have the right to obtain from the Data Controller restriction of Data Processing where one of the following applies:
a) the accuracy of the Personal Data is contested by you, for a period enabling the Data Controller to verify the accuracy of the Personal Data;
b) the Data Processing is unlawful and you oppose the erasure of the Personal Data and requests the restriction of their use instead;
c) the Data Controller no longer needs the Personal Data for the purposes of the processing, but they are required by you for the establishment, exercise or defence of legal claims; or
d) You have objected to Data Processing pending the verification whether the legitimate grounds of the Data Controller override those of you.
15.6. Right to data portability
You shall have the right to receive the Personal Data concerning you, which you have provided to the Data Controller, in a structured, commonly used and machine-readable format and have the right to transmit those Personal Data to another controller without hindrance from the Data Controller to which the Personal Data have been provided, where
a) processing is based on consent or on a contract; and
b) the processing is carried out by automated means.
The exercise of the right shall not be without prejudice to the right to erasure and shall not adversely affect the rights and freedoms of others.
15.7. Withdrawal of consent and objection
You can withdraw your consent (Art. 7 (3) of the GDPR) at any time for the future or object to our Data Processing, which is based on the Data Controller’s legitimate interests (Art. 6 (1) f) of the GDPR). You can send the withdrawal or the objection either by e-mail or by post using our contact details above.
As regards objection, the Data Controller shall no longer process your Personal Data unless the Data Controller demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims. Where Personal Data are processed for direct marketing purposes, the Data Subject shall have the right to object at any time to Data Processing concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing.
As regards the withdrawal of consent, we highlight that the withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
To exercise the above rights or to require a copy of the relevant balancing test concerning the legitimate interest of the Data Controller or the relevant Third Party, we recommend you contact us via [email protected]
15.8. Complaint
If you feel that your data protection rights have been breached, we encourage you to first contact us directly at [email protected] to resolve any concern.
However, you can also contact and lodge a complaint with the local data protection supervisory authority, in the EU in particular in the Member State of your habitual residence, your place of work or place of the alleged infringement. Please visit the following website for contact details of the data protection supervisory authorities of the member states: https://www.edpb.europa.eu/about-edpb/about-edpb/members_en.
You also have the right to initiate a court procedure at the court of your domicile or place of your residence.
16. Further information on communications
We may use your home address, phone numbers, email address and social media or digital channels (for example, Facebook, Google and message facilities in other platforms) to contact you with regard to local laws and the channel of communication you use with us.
17. Cookie Policy
The Feilo Sylvania Group uses cookies. To learn more about our detailed cookie policy, we refer to our Cookie Policy.
18. Changes to this Policy
We may change this Policy from time to time by updating this page in order to reflect changes in the law and/or our privacy practices. We encourage you to check this Policy for changes whenever you visit our Website – https:www.sylvania-lighting.com/.
19. Contact Us
If you have any questions about this Policy, or if you wish to exercise your rights, you can contact us via [email protected]
Effective: May 2018
Last updated: May 2024