The purpose of this privacy policy (hereinafter the "Policy") is to inform visitors or users (hereinafter "you", "your" or the "User") of the website \[www.veolia.com.hk\] (hereinafter the "Site") of the terms and conditions for the protection of their personal data in accordance with the Personal Data (Privacy) Ordinance (Cap. 486) ('PDPO’)\] on the protection of individuals with regard to the processing of personal data and on the free movement of such data (hereinafter collectively the "Regulation"). The publisher of the Site and the controller of your personal data is Veolia Hong Kong Holding Limited, a company incorporated under the laws of Hong Kong, with its registered address at 40/F, One Taikoo Place, Taikoo Place, 979 King’s Road, Quarry Bay, Hong Kong (hereinafter referred to as "we", "us", "our", "the Publisher" or "Veolia"). The data controller may also be the Veolia entity named on the webform, depending on the purpose of the webform. The Policy may be modified at any time by Veolia, in particular in order to comply with any regulatory, legal, editorial or technical developments. This Privacy Policy is an integral part of the Terms and Conditions of Use of the Site. You do not have to provide your personal data to us, but if you fail to provide certain information when requested, we may not be able to enter into or perform the contract we propose to enter into with you, process your application, or provide all or any part of our services to you, or we may be prevented from complying our legal obligations. We are committed to protecting the privacy, confidentiality and security of the personal information we hold by complying with the requirements of Personal Data (Privacy) Ordinance with respect to the management of personal information. We are equally committed to ensuring that all our employees and agents uphold these obligations. We pledge to comply with the requirements of the Personal Data (Privacy) Ordinance. In doing so, we will ensure compliance by our staff with the strictest standards of security and confidentiality. ### **What personal data do we process, why and what is our lawful** **basis?** | **What data?** | **Why do we** **process it?** | **What's our lawful** **basis?** | |---|---|---| | **Clients, Stakeholders, Suppliers and Business Partners** | | Contact data including your name, email address, postal address, social media handle and telephone number. | We collect and process this where you make requests for assistance, have questions about the Veolia brand or are finding contact points or partnership. | We do this as necessary for our legitimate interest to respond appropriately to you in a timely manner. | | Where you are a supplier, we do this to take steps to enter into a contract with you. | | We collect and process this where you register or take steps to register online. | We do this to take steps to enter into a contract with you or to fulfil our contractual obligations with you when you register with us via our Site. | | Any contact information as well as additional personal data provided in in the free text zones provided for this purpose in the webform(s), namely "Subject of the request" and "Message". | We do this in order to respond quickly and effectively to your comments. | We do this as necessary for our legitimate interest to process your request and respond appropriately to you. | | We may process your name and email address to send you marketing communications in line with your specified preferences. | We do this in order to keep you up to date with our products and services in line with your preferences. | We do this where you have provided us with your consent for us to contact you. | | Where you are a professional or are already an existing customer of Veolia, we do this under our legitimate interest to keep you updated. | | **Job Applicants** | | Contact data including your name, email address, postal address and telephone number as well as any information you provide to us that forms part of your job application. This may include information on your CV/resume whether provided directly or through a recruitment agent, such as your employment history and qualifications. | In order to review your suitability for our roles and vacant employment positions. | We do this as necessary to review your suitability for one of our roles and take steps to enter into an employment contract with you. | | We may process this in order to comply with our legal obligations to ensure our applicants have the right to work. | ### How do we collect your personal data? We collect data where you submit it to us through a webform on our Site. We also collect technical data about you and your device that is submitted to us when you use the Site. This data is collected through cookies and similar trackers. The methods of collecting and processing information collected by means of cookies are set out in the "Cookies Policy" ### Who do we share your personal data with? The data collected through the webforms on our Site is intended for the internal services of the entity responsible for processing, in order to respond to your request. This may include, for example, the "Human Resources" department, and the "Communication" department, Veolia personnel in charge of publishing content and technical administration of the Site, and their superiors, Veolia personnel in charge of processing requests received via the webforms, authorized service providers, Users of the Site, the personnel responsible for supervising the security of Veolia's information systems. We may share your personal data with the following entities and for the following purposes: | **What personal data?** | **Who do we** **share it with?** | **Why do we share it?** | **What's our lawful basis?** | |---|---|---|---| | **Clients, Stakeholders, Suppliers and Business Partners** | | Contact data including your name, email address, postal address and telephone number as well as any contact information as well as additional personal data provided in in the free text zones provided for this purpose in the webform(s), namely "Subject of the request" and "Message". | Service providers which may include (the Site's host, Veolia's IT and/or technical service providers. | To ensure your request is processed by the appropriate party in accordance with your reasonable expectations including as to the performance of our Site. | We do this as necessary for our legitimate interest to process your request and ensure the appropriate party responds appropriately to you. | | Other members of the Veolia Group | | Lawyers and accountants and other similar external advisors | Where we need to take steps to defend ourselves in respect of a legal claim or to comply with our legal obligations. | Where we share personal data in order to comply with our legal obligations or to defend legal claims made against us. | | Regulators, authorities and governmental bodies | | **Job Applicants** | | Contact data including your name, email address, postal address and telephone number as well as any information you provide to us that forms part of your job application. This may include information on your CV/ resume whether provided directly or through a recruitment agent, such as your employment history and qualifications. | Other members of the Veolia Group | In order to review your suitability for our roles and vacant employment positions. | We do this as necessary to review your suitability for one of our roles and take steps to enter into an employment contract with you. | | Recruitment agents | | Lawyers and accountants and other similar external advisors | Where we need to take advice or comply with our legal obligation for example in regards to your right to work. | We may process this in order to comply with our legal obligations to ensure our applicants have the right to work. | | Regulators, authorities and governmental bodies | Please note that where you share pages that you are interested in on social media networks by clicking on the share buttons the collection of information through social network sharing buttons is subject to the privacy policies of those third parties. ### Data Retention and Archiving Your personal data will not be retained beyond the period strictly necessary for the purposes set out herein and in accordance with the Regulations. At the end of this period, your personal data will be permanently deleted unless deletion is legally prohibited, or the data is otherwise required or permitted to be retained under applicable law. Subject to the foregoing: ● The data collected in order to respond to Users' requests for information and questions will be kept for no longer than 18 months from the registration of the User's request; and ● The data collected for recruitment purposes will be kept for no longer than 2 years. In addition, Veolia may keep data permanently anonymised, for the purpose of producing statistical studies. These studies do not identify Users and are only based on trends derived from their aggregated data. ### Exercise of user rights You have various rights under applicable data protection laws that may be available to you including the right to: ● access your personal data; ● correct incomplete/ inaccurate data; ● erase the personal data we hold about you; ● restrict how we handle your personal data; ● ask us to transfer your personal data to a third party; ● object to how we process your personal data; ● ascertain our policies and practices in relation to personal data and to be informed of the kind of personal data held by us; and ● withdraw your consent at any time. For all processing operations carried out within the framework of the Site and only within this framework, regardless of the entity responsible for processing, the User may exercise his/her rights as follows: ● by writing to our Hong Kong Data Protection Officer, hk.hkbu.data-privacy@veolia.com ● by post to : Veolia - Communication Department, 40/F, One Taikoo Place, Taikoo Place, 979 King’s Road, Quarry Bay, Hong Kong by sending proof of identity or any other official document. It is specified that if the User exercises some of the above rights, Veolia may be unable to carry out the actions necessary to achieve the purposes described above, or the User may not be able to use all or part of the Services. In accordance with the provisions of the PDPO, we have the right to charge a reasonable fee for the processing of any Personal Data access request. Nothing in this Privacy Policy shall limit your rights as a data subject under the PDPO. ### Security Veolia takes appropriate technical and organizational measures to ensure the security of the data and to prevent unauthorized access or disclosure of your personal data. The database created when a User sends a request through the webform is strictly confidential. Veolia undertakes to take all useful precautions, organizational and technical measures appropriate to preserve the security, integrity and confidentiality of the data and, in particular, to prevent it from being distorted, damaged or accessed by unauthorized third parties. ### Transfer of data to other jurisdictions In the event we transfer your personal data to a subsidiary of the Veolia Group or to a third party located outside the jurisdiction of the Veolia to which the User provided such User Data, including the European Union, United Kingdom or Hong Kong, Veolia ensures that the recipient country has been the subject of an adequacy decision by the European Commission or UK government, as applicable. If this is not the case, Veolia undertakes to use the appropriate legal instruments, including in particular the European Commission's Standard Model Contractual Clauses (together with the UK Addendum to those Clauses where applicable) and relevant model clauses as published by the Office of the Hong Kong Privacy Commissioner for Personal Data, to govern the transfer. If the User wishes to obtain more information on how Veolia protects his/her data or wishes to obtain a copy of the legal instruments implemented, the User may make a request to our Hong Kong Data Protection Officer, hk.hkbu.data-privacy@veolia.com ### Updates We may update this notice from time to time by posting an updated version. This version was last updated 8 December, 2023.