Privacy Notice VirGeo® Platform

1. Introduction

This privacy notice ("Privacy Notice") describes how Fugro Technology B.V., located at Prismastraat 3, 2631 RT Nootdorp, The Netherlands, ("Fugro", "we" or "us") collects and processes your personal data via the VirGeo Platform ("Platform"). Fugro acts as data controller for the processing of your personal data.

We are committed to handling your personal data in a lawful, fair and transparent manner, in accordance with applicable laws and regulations, including the General Data Protection Regulation ("GDPR"). This Privacy Notice explains which categories of personal data we process and for what purpose, and what your rights are. This Privacy Notice applies to all users of the Platform (“Users” or “you”).

2. Personal data that we collect and use

• When we send you an invitation (on request) to use the Platform, or when you sign up or onboard to the Platform, the following personal data is processed, which is provided by you or by your company (our client):
  - Name, surname, business email address, organization and passcode.

When you visit or interact with the Platform, we automatically collect personal data about you and your interaction with the Platform, through cookies and other web technologies which are necessary to operate and improve the Platform. More specifically, we use these technologies to analyze the use and functioning of our Platform, as well as to monitor the security of our Platform.

The data we process via these technologies include:

Your IP address, web browser type, operating system, technical SSO usage information, screen size and language of browser.

- Geo-IP (containing city name, postal code, country name, continent name estimated from visiting IP address).

- The date and time and duration of your visit to the Platform.

• When you have questions or need help, we process personal data to provide you with user support. The following personal data is processed:
  - Your name, surname, business email address, organization.
  - Any other information you share with us.

3. The purpose and lawful basis of processing your personal data

4. When and with whom we share your personal data

We may share your personal data with third parties for the purposes described below. We will only disclose your personal data to those with a legitimate (business) need and after we have taken steps to ensure that your personal data is processed in a manner consistent with this Privacy Notice. 

• Users designated as project owners: Users who are designated as owners of a project will be able to view the names of other users who are enabled access to such project.

• Other entities within the Fugro group: We may share your personal data internally with other Fugro entities for internal administrative purposes, management purposes or other business related purposes.

• Third party service providers: Your personal data may be disclosed to our service providers who perform services on our behalf (such as hosting). Our service providers are subject to contractual obligations to safeguard your personal data and to only process the personal data as instructed by us.

• Third parties when necessary pursuant to legal/regulatory obligations: We may disclose your personal data with third parties to comply with court orders, requests from public or government authorities or other legal obligations.

• Third parties in case of corporate transactions: Such as companies involved in mergers, sales or re-organizations or companies that we acquire.

5. Transfers outside the European Economic Area

The storage location of your personal data depends on where you are located.

If you are based in Europe and Africa your personal data will be primarily stored on Amazon Web Services in the European Economic Area ("EEA"). In limited circumstances it might be possible that we use third party service providers that are established outside the European Economic Area. As a consequence, it might be necessary for us to transfer your personal data outside of the EEA. In such cases, we will implement adequate safeguards (and, where necessary, supplementary measures) to ensure that your personal data is afforded a level of protection which is essentially equivalent to the level of protection guaranteed within the EEA, such as entering into Standard Contractual Clauses as approved by the European Commission with recipients of your data. Personal data required for identification and management of users is stored in EEA, regardless of your location. If you are located outside the EEA, we may store part of your personal data within your region to provide you with region specific modules. Where needed, we will implement adequate safeguards to ensure your personal data is afforded the level of protection as required by local requirements.

You can request a copy of the documentation about the relevant safeguards that have been implemented by contacting our privacy team at dataprivacy@fugro.com.

6. How we protect your personal data

We have implemented adequate technical and organizational measures to safeguard the personal data we process, including encryption techniques at rest and in transit. We update and test our security technology on an ongoing basis. In addition, we restrict access to your personal data to employees on a need-to-know basis and train all staff about the importance of confidentiality and maintaining the privacy and security of your information. Nevertheless, if you suspect unauthorized use or access of your accounts, please immediately inform us by email at Ask-security@fugro.com.

7. How long we keep your personal data

We will not retain your personal data longer than necessary in relation to the purposes for which the data are processed, unless a longer period is necessary to comply with legal obligations or to defend a legal claim.

We retain name information for all users so long as they are collaborating on resources within the Platform. This allows users to understand whom they are collaborating with. Additionally, we retain name information for users as long as they are signed up via email One Time Password flow, until they are explicitly offboarded from that sign in method. This is to ensure the proper function of identity and access management

Unless the VirGeo Terms of Use state otherwise, the retaining period for all personal data in relation to the Platform is dictated by their engagement with the Platform plus 90 days post expiry period.

Security logs (IP address, web browser and operating system) will be retained in accordance with Fugro's cybersecurity standards, for a maximum of twelve months.

8. Data subject rights

Subject to applicable laws, you are entitled to a number of rights over the processing of your personal data. You may exercise these rights at any point by contacting us via dataprivacy@fugro.com. We will consider all such requests and, in accordance with the applicable laws, will provide our response within a reasonable period, or within the period prescribed by law. If we require an extension due to the complexity of the request, we will inform you, indicating the reason for the delay. We may request you to provide us with information necessary to confirm your identity before responding to any request you make.

You have the following rights, subject to applicable laws:

• The right to access: subject to exceptions, you have the right to request access to the personal data we hold about you

• The right to rectification: if the personal data we hold is inaccurate you are entitled to have it updated or rectified

• The right to deletion: subject to exceptions, you can ask us to delete your personal data

• The right to object: under certain circumstances, you have the right to ask us to stop processing your personal data (unless we can demonstrate compelling legitimate grounds to continue processing your personal data)

• The right to withdraw consent: where we rely on your consent to process personal data, you have the right to withdraw consent at any time. Withdrawal of consent shall not affect the lawfulness of processing carried out on the basis of prior consent

• The right to restriction of processing: under certain circumstances you have the right to restrict the processing of your personal data such as if you believe (i) the personal data we have about you is inaccurate; (ii) the personal data is not being processed lawfully, but instead of deleting the personal data, you would prefer us to restrict processing instead; or (iii) we no longer need your personal data for the purposes we collected it, but you require the data in order to establish, exercise or defend legal claims

• The right to data portability: under certain circumstances you have the right to obtain personal data you've provided us with (in a structured, commonly used and machine-readable format) and to reuse it elsewhere or to ask us to transfer this to a third party of your choice

• The right to lodge a complaint with a supervisory authority: you also have the right to file a complaint to the data protection authority in the country where you usually live or where the alleged infringement of applicable data protection laws has taken place. A list of these EU authorities can be found here.

9. Changes to this Privacy Notice

We may change this Privacy Notice from time to time by posting the updated version of the Privacy Notice on the Platform. We will give you reasonable notice on the Platform or via email of any material change. The “effective date” at the top of this Privacy Notice indicates when such changes will take effect. We encourage you to visit frequently to stay informed about how we use your personal data.

10. Contacting us

If you have any questions or concerns about this Privacy Notice or the processing of your personal data in general, please email us at: dataprivacy@fugro.com.