Privacy Policy

1. Introduction
voestalpine Metsec plc is committed to preserving your privacy. Please read the following voestalpine Metsec privacy policy to understand what personal data we collect, why we collect it, how we use and protect the information that you provide.

When we refer to “Metsec”, “we”, “us” or “our”, we are referring to voestalpine Metsec, and as applicable any member of the voestalpine group. voestalpine Metsec are the data controllers. This privacy policy applies to our processing of personal data when you use our services, visit our websites or mobile applications or otherwise interact with us.

It is important for us to process and use your data only in accordance with the Data Protection Act (DPA) 2018 and your expectations, and to be transparent with you in how we process and use your data.

This privacy policy will explain what data is collected, why it is collected, how the collected data is used and your options and rights regarding the collection of your personal data.

2. Who We Are
voestalpine Metsec is the UK’s largest specialist cold roll-forming company providing products for the construction and manufacturing industries. Established 90 years ago, voestalpine Metsec is owned by the voestalpine group, a leading steel and technology group. We are part of voestalpine Metal Forming division, the world’s leading provider of high-quality metal processing solutions with production facilities all around the globe.

3. What Personal Data We Collect
Personal data means any information that can be used to identify directly or indirectly a specific individual.

You are not required to provide voestalpine Metsec with personal data we request, but if you choose not to, we may not be able to provide you with our products or services, or with a high quality of service or respond to any queries you may have. In connection with the different ways we may interact with you and the various services that we provide, we collect the following categories of data:

We may collect personal data from a variety of sources. This includes:

Personal data you give us directly,
Personal data we collect automatically, and
Personal data we collect from other sources.
Types of data collected include:

Contact information including name, address, telephone number and e-mail address, and payment data such as credit card numbers.

Communication data between you and us, including recordings of calls to our service centres, e-mail communication, online chats, comments and reviews collected through surveys or posted on our channels and on social media platforms.

Digital information data collected when you visit our websites, applications or other digital platforms, including IP-addresses, browser data, traffic data, social media behaviour, and user patterns. If you subscribe to our newsletters, we may collect data regarding which newsletters you open, your location when opening them and whether you access any links inserted in the newsletters.

4. Where We Collect Your Data
Most of the data that we have about you are provided by you, digital information data is collected from our websites, applications and similar digital platforms. Data may be collected from publicly available sources, information databases and credit agencies.

5. Use of your Information

Communication

Description: We use contact information and communication data to ensure that we can supply the goods or services you have requested. We may provide such information by electronic or other means.

Legal basis: We use such data as part of our business relationship. Further, we use such data to provide you with other information necessary to fulfil our legitimate interests, including to ensure that we process invoices and to contact you, where necessary, concerning any orders you may place with voestalpine Metsec, process payments, for accounting, billing and collection purposes, to make deliveries, to settle disputes, enforcing our contractual agreements and establishing, exercising or defending legal claims. Also, processing is necessary for the performance of the contract to which the data subject is party, or for pre-contractual measures. For, ensuring compliance with legal obligations (such as record keeping obligation in accordance with tax and commercial law) and voestalpine Metsec policies.

Disclosure: We may disclose contact information data to our corporate partners, as they may need this information to communicate with you and to provide support and assistance.

Direct Marketing

Description: We use contact information and digital information data to provide you with newsletters from us about our products and services.

Legal basis: Our use of such data is based on our legitimate interests in providing you with relevant information to promote our products and services. You may at any time opt out of receiving such information.

Disclosure: We may process your data to enable us to send you relevant information to promote our products and services.

Profiling

We also create profiles by analysing the information about your online surfing, searching and buying behaviour and your interactions with our brand communications by building segments (creating groups that have certain common characteristics) and by placing your personal data in one or more segments. We use this data to provide you with customised information about services and offers that you may appreciate.

Legal basis: We carry out profiling to fulfill a legitimate interest, which is to customise our services for your benefit. You may at any time object to our use of your personal data for profiling purposes.

Disclosure: We will not disclose the profiles we have generated based on your data to third parties other than any member of our group.

Security

Description: We may carry out video surveillance on premises and store digital information data to prevent crime and ensure your safety.

Legal basis: We carry out video surveillance that is necessary to fulfil a legitimate interest which is to prevent crime and ensure your safety while you are on our premises.

Disclosure: We will not disclose video surveillance footage to third parties unless required by law or on request from authorities.

6. How Long We Store your Data for
We will keep your personal data for as long as we need it for the purpose it is being processed for. We will store your personal data from the point for the duration of our contractual relationship and up to a period of after our contractual relationship has ended, if we believe this is necessary to handle potential complaints or claims. We may store your data longer if you wish for us to keep your data and you have consented to this.

We will store digital information data as required by applicable law.

We will store your personal data for as long as you wish to receive information and marketing communications from us.

We store video surveillance footage for a period of 1 month. If we deem it necessary to deliver video surveillance footage to the police due to a criminal incident or similar, we may store the video surveillance footage for 3 months.

7. International Transfer of Data
voestalpine Metsec plc provides products and services worldwide. We have affiliates, branch offices, agents and corporate partners that are established in these jurisdictions outside of the European Economic Area to which we may transfer data, as described in section 5 above. We will ensure that your data is adequately protected by the receiving parties in such countries. Adequate protection may typically be to impose on the receiving party contractual obligations that ensure that it maintains the same level of privacy and data security as practised by us. You may ask for further information or a copy of the safeguards that we have in place to ensure lawful transfer of your data.

8. Disclosure of your Information
The information you provide to us will be held on our systems and may be accessed by companies within our group of companies who act for us for the purposes set out in this privacy policy or for other purposes approved by you. Those parties process information, fulfil and deliver orders, process credit card payments and provide support services on our behalf.

Finally, if our business or part of it enters into a joint venture with or is sold to or merged with another business entity, your information may be disclosed to our new business partners or owners.

Unless required to do so by law, we will not otherwise share, sell or distribute any of the information you provide to us without your consent.

9. Security
We take appropriate measures to ensure that any personal data is kept secure, including security measures to prevent personal data from being accidentally lost, or used or accessed in an unauthorised way. We limit access to your personal data to those who have a genuine business need to know it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality.

10. How you can Access, Rectify or Erase your Data and File Complaints
Under the DPA 2018, you have a number of important rights. In summary, those include rights to:

• access to your personal data and to certain other supplementary information that this privacy policy is already designed to address;
  
• require us to correct any mistakes in your information which we hold;
  
• require the erasure of personal data concerning you in certain situations;
  
• receive the personal data concerning you which you have provided to us, in a structured, commonly used and machine-readable format and have the right to transmit the data to third parties in certain situations;
  
• object at any time to processing of personal data concerning you for direct marketing;
  
• object in certain other situations to our continued processing of your personal data;
  
• otherwise restrict our processing of your personal data in certain circumstances;
  
• claim compensation for damages caused by our breach of any data protection laws.

For further information on each of those rights, including the circumstances in which they apply, see the guidance from the UK Information Commissioner’s Office (www.ico.org.uk) on individual’s rights under the DPA 2018.

If you would like to exercise any of those rights, please contact us via the details below. We will ask you to provide us with confirmation of your identity, for example, by sending us an electronic copy of your ID.

11. Cookies
We use cookies on the websites to ensure functionality on the website, analyse website traffic and to see which areas of the website you have visited. Please read our cookie policy for more information.

12. Complaints
If you wish to make a complaint about how your personal data is being processed by voestalpine Metsec (or third parties), or how your complaint has been handled, you have the right to lodge a complaint directly with the supervisory authority (ICO) and voestalpine Metsec Information Security Team. Please see the relevant contact details below.

13. voestalpine Metsec Contact Details
voestalpine Metsec plc, Broadwell Road, Oldbury, West Midlands, B69 4HF.

Tel: +44 (0) 121 601 6000

Metsec.dataprotection@voestalpine.com

Supervisory authority contact details:

The Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, SK9 5AF.

Tel: +44 (0) 303 123 1113

14. Changes to our Privacy Policy
Any changes to our privacy policy in the future will be posted to our website and, where appropriate, through e-mail notification.