NDC Technologies takes privacy serious. We see it as our duty of care to protect your personal data and to ensure that all personal data is used in accordance with applicable data protection laws.

This Privacy Notice explains what kind of personal data is collected and how it is being used in view of our third-party due diligence process. NDC Technologies only wants to engage third parties that are trustworthy and for that purpose subjects third parties to a due diligence process on a case by case basis.

This Privacy Notice may be changed over time and was last changed in February 2021.

For which purposes do we process personal data?

NDC Technologies has to take informed decisions about the potential risks presented by third parties we consider conducting business with. Personal data is processed for this purpose. By implementing a due diligence process NDC Technologies aims to minimize the risks of acting in breach of its own Code of Business Ethics and applicable laws and regulations.

On what basis do we process personal data?

We process personal data in the context of the due diligence process to ensure our compliance with applicable laws and on the basis of our legitimate interest to ensure that we only conduct business with trustworthy third parties that meet our company standards. Our company standard follows directly from our Code of Business Ethics. 

Which personal data do we process?

In the context of the due diligence process, we might process the following personal data:

(1) We use your contact details such as first name, last name and email address to send you our due diligence questionnaire and to communicate with you in relation to the completion of our due diligence.

(2) In the due diligence questionnaire, we may for example ask for:

• names of the owners of your company, members of the board of directors, CEO, CFO and COO.
• evidence of existence and registration, which incorporation documents may include personal data like name, date of birth and home addresses.
• Details and copy of relevant licenses or permits required to conduct business with us. These may include picture, name and date of birth.

We encourage you to remove or strike through any personal data irrelevant for the verification of your company’s registration or for our verification of your license or permit (which, depending on the specific circumstances, may for example be home addresses).  

(3) We may screen companies we consider conducting business with and our screening tool shows records found of the company screened, including the individuals affiliated with that company, such as CEO’s or CFO’s, if such information is indeed publicly available.

(4) If we deem it required for the purposes mentioned above, we may screen an individual related to your company in our screening tool. For this, we process first name and last name and to the extent available to us other personal data that can eliminate you from the positive hits provided by our screening tool, such as middle name, alias(es), email address, date of birth, gender, job title, employer, address details, country of citizenship and exceptionally social security number or tax ID (and the latter numbers only to the extent allowed by the applicable laws).

For how long do we retain personal data?

Personal data processed in the context of the due diligence process will generally be retained by us for the duration of three years after (a) the decision to not enter into a relationship; or (b) the end of the business relationship with the third party. Personal data may be retained longer than the retention period if legal or regulatory requirements so dictate or if such longer retention is required in case of a (potential) legal dispute.

Personal data obtained from third parties

We work closely with third parties (including business partners, sub-contractors in technical, payment and delivery services, advertising networks, analytics and search information providers) and may receive personal data about you from them. Such data obtained from third parties will be kept in accordance with the same duty of care as described in this Privacy Notice, and with any additional restrictions imposed by the third party that shared your personal data.               

Your Rights

You have a number of rights under applicable data protection law in respect of our processing of your personal data. These include:

• the right to request access to your personal data;
• the right to request rectification of any personal data that we hold;
• subject to certain conditions:

- the right to request erasure of your personal data;

- the right to request restriction of processing of your personal data;

- the right to have your personal data transferred to another controller;

• where we rely on your consent for processing, the right to withdraw such consent; and
• the right to lodge a complaint with a data protection authority.