1. Who are we?

NLMK as a controller

Through this statement (hereinafter referred to as the “Statement”), we wish to inform you about the purposes of and processing of your personal data when using our website https://toolsteels.nlmk.com;

Several European entities of NLMK group are involved in the processing of your personal data and must be, thus, considered as controllers (hereinafter referred to as “we”, “us” or “NLMK”). You may find the details of the different controllers (European entities of NLMK) in Annex 1.

You may contact the data controller regarding this website and/or this statement by using the following email address: info@eu.nlmk.com

As controllers, we are responsible for the processing of the personal data that we collect and use. Through this privacy statement, we take the necessary steps in order for you to:

• be informed of the processing of your personal data and your rights;
• retain control over the personal data that we process;
• be able to exercise your rights with regard to personal data. You can find more information about your rights in point 9 of this Statement.

Data protection officer

NLMK has also appointed a Data Protection Officer (DPO) for each European entities. The DPO’s task is to inform everyone about the personal data that are processed. The DPO also advises and monitors whether there is compliance with the General Data Protection Regulation (GDPR).

You may contact the DPO about any matters relating to the processing of your personal data and the exercise of your rights in this context.

Contact details of the DPO:

• Email: DPO@eu.nlmk.com
• Address:
  NLMK Belgium holdings SA
  Rue des Rivaux 2,
  7100 La Louvière
  Belgium

Should this contact details change, you will be informed as soon as possible.

2. Definitions

For the purposes of this Statement, the following terms shall have the following meaning :

Personal data means information relating to an identified or identifiable person (the data subject).

Processing means any operation (or set of operations) which is performed on personal data. It may be the collection, recording, organisation, storage, adaptation or alteration, consultation, use, disclosure by transmission, restriction, erasure or destruction for example.

Data subject means a person who may be identified or identified, directly or indirectly, by personal data.

Controller means the physical or moral person which determines, alone or jointly with others, the purposes and means of the processing of personal data and processes personal data in its own interest and on its own behalf.

Processor means a natural or legal person which processes personal data on behalf of the controller.

Data protection officer means a person or a team charged to inform everyone about the personal data that are processed. It also advises and monitors whether there is compliance with the General Data Protection Regulation (GDPR).

GDPR means the Regulation (EU) 2016/679 of the European Parliament and of the Council of 26 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

3. For what purposes do we need your personal data?

3.1. Information and communication

What does this purpose consist of?

We may use your personal data to inform you about our activities, services or newsletters, which we believe may be of interest to you.

We will contact you if you explicitly ask us to do so, or if we believe that you may be interested in a service or that a given service could benefit your company/organisation.

If you do not yet have a business relationship with us, you will only receive our marketing communication if you have explicitly given us your permission to contact you based on your explicit consent.

If you already have a business relationship with us or have already provided your contact details you could receive advertisements from us without your explicit permission, based on our legitimate interest to promote our activities.

What Personal Data do we process in this context?

We collect and process the following personal data: your name, profession, email address and telephone number.

3.2 Use of social Media

NLMK uses social media such as Facebook, LinkedIn, Youtube and Twitter in order to share information about ourselves and promote our activities.

By visiting our social media accounts, you may, if you want/consent to, comment, like and/or send us messages. By doing this, we will collect the personal data that you shared with us on a voluntary basis.

We will only delete your message and/or comment if you or a third party request so based on a possible prejudice of human rights and freedoms (eg. injuries, etc.).

Moreover, we encourage you to read the privacy statement published by the concerned social media platform on its website in order to be informed about the way it processes your personal data in its capacity of controller.

3.3 Cookies

We use cookies (and similar technologies) on our websites and applications. With these small files that save information in your computer’s browser, we can keep certain data about you (e.g. choice of language).

Some cookies are automatically installed on your browser when you visit our website. We will do so concerning the cookies which are necessary for the website to operate properly. On the other hand, the other cookies will only be installed on your browser if you explicitly consent to. For instance, we will only install analytics cookies if you have explicitly consented to.

We save them in order to best adapt our sites and applications to your wishes via the use of analytics cookies and to save your preferences for a future visit. As such, we can very quickly increase your user comfort and present you with relevant offers.

For further information on cookies, especially concerning the retention period, we encourage to read our cookie policy.

3.4 Use of your images (pictures and videos)

As part of our events, NLMK may takes pictures and videos of you (hereafter referred to as “images”).

These images may be further published on our websites, on social media, on our Intranet and/or in other publications (e.g. reports, newsletters, ect.) if you have explicitly consented to this use.

Should you want us to delete your image and/or to stop publishing an image where you appear, please contact us by using the contact details referred to in point 11.

3.5 Legal obligation

• What does this purpose consist of?

NLMK may be obliged to process personal data pursuant to a legal obligation, in which case it will comply with the law.

4. Do we request your consent before starting personal data processing?

We are only authorised to use and process your personal data if one of the following conditions is met:

• We have your free and explicit consent to use your personal data for a certain purpose.
  Specifically, if you do not already have a relationship with us we will ask for your permission to contact you for direct marketing purposes, as stated in points 3.1, 3.2, 3.3 and 3.4 of this Statement.
• The use of your personal data is carried out in line with our legitimate interests and in accordance with your interests and rights.
  The processing that is necessary for sending direct marketing emails to existing customers, as described in point 3.1 of this Statement and in order to install cookies which are necessary for our website (hereinafter referred to as “functional cookies”) to operate properly, as described in point 3.4 of this Statement.
• We have a legal obligation to process certain personal data and communicate them to the competent authorities, such as the privacy protection authority (e.g. in the context of an audit), as described in point 3.5 of this Statement.

5. Which other people do we share your personal data with?

• The employees of the group companies who must have access to personal data to carry out their professional duties can access such personal data. These people act under our supervision and responsibility.
  To the extent that our group is international and that our headquarter is located in Russia, your personal data may be transferred outside the EU and/or EEA, as described in point 7 of this Statement.
• We also call on external suppliers who handle certain types of processing so that we can offer you our products and services, namely IT, legal, financial, accounting and other services. Given that these third parties have access to personal data in the context of the performance of the requested services, we have taken technical, organisational and contractual steps in order to ensure that your personal data are only processed and used for the purposes mentioned in point 3 of this Statement.
• When we have a legal obligation to do so, we may provide your personal data to supervisory authorities, tax authorities and any other public authority (e.g. police).

6. Where do we store and process your personal data?

Your personal data will be transferred outside the EU, EEA and Switzerland, especially to Russia, for the following reasons :

• some of our host servers are located in Russia,
• each NLMK entities may transmit web visitors’ personal data to its headquarter, NLMK PJSC, located in Russia as part of our centralised communication policy.

In order to guarantee that your personal data will be protected by an adequate level of protection we have concluded with NLMK IT and NLMK PJSC, both located in Russia, standard contractual clauses based on the model approved by the European Commission.

Should you want a copy of this contract, please contact us as explained in point 10 of this Statement.

7. How long do we retain your personal data?

We will not keep your personal data for no longer than the time required to achieve the objectives mentioned in point 4 of this Statement. Any derogations from or clarifications of this principle are explicitly indicated under the different purposes mentioned in point 4 of this Statement.

Given that the need to retain personal data depends on the type of personal data we process and the purpose of the processing, retention periods may vary considerably.

Below you will find the criteria we use as a basis to define the length of retention periods:

• how long do we need your personal data to be able to provide the requested service?
• have we defined and announced a specific retention period?
• have we been granted permission to extend the retention period?
• are we subject to a legal or contractual obligation, or a comparable obligation?

As soon as we no longer need your personal data and are no longer legally obliged to retain them, we will permanently delete them or, if this is not possible, anonymise them in our systems.

Your personal data will, however, be retained and used for the period necessary for the fulfilment of our legal obligations, the settlement of disputes or the conclusion of contracts.

8. How do we secure your personal data?

Your personal data are considered strictly personal. We take appropriate technical and organisational steps to protect the personal data provided and collected from any accidental destruction, loss or alteration, as well as from any damage or accidental or unlawful access, or other unwarranted data processing.

9. What are your rights?

Below you will find an overview of your rights as a data subject.

Note that these rights are not absolute and may depend on the fulfilment of certain conditions.

The right of access to your personal data

You have the right to access and inspect the personal data processed by NLMK at all times. At your request, NLMK will provide a copy of these personal data.

The right to have your personal data rectified

You have the right to have inaccurate, incomplete, inappropriate or outdated personal data erased or rectified without undue delay t.

The right to obtain the erasure of your personal data

You have the right to obtain from NLMK the erasure of your personal data where one of the following grounds applies:

• the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
• the personal data were unlawfully processed;
• you object to the processing for justified reasons.

The right to limit certain processing operations

You have the right to obtain from NLMK restriction of processing where one of the following applies:

• you contest the accuracy of your personal data, for a period enabling NLMK to verify the accuracy of your personal data;
• the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead;
• NLMK no longer needs the personal data for the purposes of the processing, but you require your personal data for the establishment, exercise or defence of legal claims;
• you have objected to processing pending the verification whether the legitimate grounds of NLMK override yours.

The right to transfer personal data

You have the right to receive your personal data processed by NLMK in a structured, commonly used and digital form so that you can retain them for personal (re)use, or transmit those personal data to another controller without hindrance from NLMK. This right applies insofar as this is technically possible for the controller (NLMK).

The right to object to certain processing operations

You are entitled at all times to object to processing for reasons relating to your specific situation.

NLMK will no longer process your personal data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

Right to lodge a complaint with the supervisory authority

If you are of the opinion that the processing of your personal data does not comply with the legislation and/or if we do not grant (correctly) your rights request, you can lodge a complaint before your local data protection authority (depending of your residential country).

Right to withdraw your consent

NLMK may, from time to time, ask you to consent for a specific processing. Should this situation take place, you have the right to withdraw your consent, at any time, without having to give a specific reason.

10. How can you exercise you rights?

To exercise the privacy rights mentioned above, your request must be dated and signed and a copy of your identity must be included. This request is sent either:

• by email to DPO@eu.nlmk.com or ;
• by post to the following address:
  NLMK Belgium holdings SA
  Rue des Rivaux 2,
  7100 La Louvière
  Belgium

This request is free of charge, except where NLMK considers the request to be manifestly unfounded or excessive (as in the case of a repeated request).

For any additional copy requested, we may also request payment of a reasonable fee based on administrative costs.

Your request will be processed within one month. This period of time may be extended by two months, taking into account such factors as the complexity and number of requests. In the event of an extension of the term, you are informed of this and of the reasons for the extension.

Where necessary, we will notify the third parties to whom your personal data were communicated of any rectification, erasure or limitation that has been carried out unless this is not possible or requires a disproportionate effort.

11. How can you ask a question or lodge a complaint?

If you have any question or wish to lodge a complaint concerning the processing of your personal data, you may contact us via

• by email to DPO@eu.nlmk.com or ;
• by post to the following address:
  NLMK Verona S.p.A.
  Via Antonio Salieri, 22
  37050 Oppeano VR
  Italy

If you are not satisfied with our response, if you have comments regarding the exercising of your rights or if you believe that the processing does not comply with legislation, a complaint may be lodged before your local data protection authority (depending of your residential country).

12. Modification of this Statement

NLMK reserves the right to modify this Statement and update it at any time.

In the case of significant changes, you will be informed accordingly.

We encourage you to consult this Privacy Statement periodically in order to learn how we process and protect your personal data by consulting our websites.