In compliance with current regulations on data protection, Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 (GDPR), Organic Law of Protection of Personal Data (LOPDCP, 15/99), Development Regulation of the LOPDCP (Royal Decree, 1720/2007, of December 21), we would like to inform you about our Data Protection Policy, in what concerns to personal data processing, which is detailed below:

Personal Data Controller

The controller is the EPIC (European Photonics Industry Consortium)) which, determines the purposes and means of the processing of personal data, or what is the same, the controller decides how and with which purposes personal data are processed.

For the purposes of this Data Protection Policy, the controller of the personal data processing is:

• Business Name: EPIC (European Photonics Industry Consortium)
• Tax Identification Number / NIF: FR78480890714
• Registered Office: 17 Rue Hamelin, 75016 Paris, France
• Telephone number: +32 473 30 04 33
• Commercial Activity: EPIC (European Photonics Industry Consortium) is the world leading industry association that promotes the sustainable development of organizations working in the field of photonics in Europe.

WHAT PERSONAL INFORMATION DO WE COLLECT AND HOW IS IT PROTECTED?

“Personal data” are any information relating to an identified or identifiable natural person, who is known as “data subject”.

For the intended purposes in this Privacy Policy, the controller seeks and processes the personal data which are explained in each type of processing, that will rely on the different services you requested or the contractual relationship which you maintain with our entity.

Our organization is committed to use with total confidentiality and to apply the suitable security measures, either physical, technical and organizational for the protection of your personal data.

You guarantee and respond, in any case, of the veracity, accuracy, validity and authenticity of the personal data provided and undertakes to keep them duly updated.

"Processing of Customer data"

1. What personal data do we process?
   • Identification data: name, ID, address, telephone number, e-mail address.
   • Academic and professional data: occupation, position.
   • Data related to transactions: provided services

2. Which are the data processing purposes?

   The personal data provided will be used to manage the data of the company's clients, to maintain the commercial relationship, the accounting, administrative and billing management, as well as tax obligations.

   The personal data provided will be kept as long as the business relationship is in force. If you decide to erase your personal data, these can be stored in our databases during the time periods provided by law to be able to comply with tax and accounting obligations, and will be removed once those legal terms, or those that are applicable have expired.

3. Which are the legal grounds for the personal data processing?

   The legal basis for the processing of your data is the performance of a contract, as well as the fulfillment of a controller legal obligation.

4. Who do we share your personal data with?

   Your personal data will not be disclosed to any other organization, except those that are necessary for public bodies due to legal obligation.

   Nor, have International data transfers been foreseen.

"Processing of Contacts data"

1. What personal data do we process?
   • Identification data: name, address, telephone number, e-mail address.
   • Academic and professional data: occupation, position.

2. Which are the data processing purposes?

   The personal data provided in the questionnaire will be used for the management of business contact data and potential customers.

   The purpose of advertising and commercial prospecting has also been foreseen, for which the explicit consent of the interested party is requested.

   The personal data provided will be kept as long as the business relationship is in force. If you decide to erase your personal data, those will be removed from our Contact database.

3. Which are the legal grounds for the personal data processing?

   The legal basis of the processing of your data is the explicit consent that is requested.

4. Who do we share your personal data with?

   Your personal data will not be disclosed to any other organization.

   Nor, have International data transfers been foreseen.

"Processing of Providers data"

1. What personal data do we process?
   • Identification data: name, ID, address, telephone number, e-mail address.
   • Financial data: bank account.
   • Academic and professional data: occupation, position, qualifications.
   • Data related to transactions: provided goods and services.

2. Which are the data processing purposes?

   The personal data provided will be used to manage the data of the company's suppliers, to maintain the business relationship, the accounting, administrative and payment management, as well as tax obligations.

   The personal data provided will be kept as long as the business relationship is in force. If you decide to erase your data, these can be stored ir our database during the time periods provided by law to be able to comply with tax and accountig obligations, and will be removed once those legal terms, or those that are applicable have expired.

3. Which are the legal grounds for the personal data processing?

   The legal basis of your personal data processing is the performance of a contract, as well as the fulfillment of a controller legal obligation.

4. Who do we share your personal data with?

   The personal data will not be disclosed with any other organization, except those that are necessary for public bodies due to legal obligation.

   Nor, have International data transfers been foreseen.

"Processing of Partners data"

1. What personal data do we process?
   • Identification data: name, ID, address, telephone number, e-mail address.
   • Financial data: bank account.
   • Academic and professional data: occupation, position, professional experience, qualifications.

2. Which are the data processing purposes?

   The personal data provided will be used to manage the data of the partners of the company, to maintain the contractual relationship, the accounting, administrative and billing management, as well as tax obligations.

   The personal data provided will be kept as long as the relationship is in force. If you decide to erase your personal data, these can be stored in our databases during the time periods provided by law to be able to comply with tax and accounting obligations, and will be removed once those legal terms, or those that are applicable have expired.

3. Which are the legal grounds for the personal data processing?

   The legal basis for the processing of your data is the performance of a contract, as well as the fulfillment of a controller legal obligation.

4. Who do we share your personal data with?

   The personal data provided will not be disclosed to any other organization, except those which are necessary to public bodies due to legal obligation.

   Nor, have International data transfers been foreseen.

Which rights do you have when providing us with your personal data?

In accordance with the applicable regulation on Personal Data Protection, you have the following rights in relation to your personal data. For the data subject, the exercise of these rights shall be free of charge, except those requests from the data subject which are manisfestly unfounded or excessive, in particular because of their repetitive character.

Your rights

These rights are the following:

1. Right of information: You shall have the right to be informed in a concise, transparent, intelligible and easily accessible form, using clear and plain language, about your personal data use and proccesing.
2. Right of access: You shall have the right of obtaining from the controller, at any time, the confirmation as to whether or not personal data concerning you are being processed, and, where that is the case, to access to your personal data and other information about their processing, and to be provided with a copy of the personal data undergoing processing. The copy of the personal data shall be free of charge, nonetheless, for any further copies requested the controller may charge a reasonable fee based on administrative costs. For our part, we may enquire you to prove your identity or require you more information that is necessary to manage your request.
3. Right to rectification: You shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data, non updated or incomplete concerning you. Also, you can request to have incomplete personal data completed, including by means of providing a supplementary statement.
4. Right to erasure: You shall have the right to obtain from the controller the erasure of personal data concerning you, where among other grounds applies, data are no longer necessary in relation to the purposes for which they were collected. However, this right is not absolute, so that our organization may continue to keep them duly blocked in the cases foreseen by the applicable regulations.
5. Right to restriction of processing: You shall have the right to obtain from the controller restriction of processing, what means that, we can continue to keep your data, but without processing them as long as one of the following grounds applies:
   • The accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data.
   • The processing is unlawful and you oppose the erasure of the personal data and request the restriction of their used instead.
   • Our company no longer needs the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defence of legal claims.
   • You have objected to processing, while the verification whether the legitimate grounds of the controller override those of the data subject is pending.

6. Right to data portability: You shall have the right to receive the personal data concerning you and to have your personal data transmitted directly from one controller to another in a structured commonly used and machine-readable format. This right applies when the legal grounds of the processing are the consent or the performance of a contract, and the aforementioned processing is carried out by automated means.
7. Right to object: This right allows you to object to processing your personal data, including profiling. We will not be able to attend to your right only when we process your data in the event that we accredit legitimate grounds for the processing or for the formulation, exercise or defence of claims.
8. Right not to be subject to an automated individual decision-making, including profiling: This right allows you not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This right will not apply if the aforementioned decision is necessary for entering into or performance of a contract, is authorised by law or is based on the data subject's explicit consent.
9. Right to withdraw consent: In those cases in which we have obtained your consent for the processing of your personal data in relation to certain activities (for instance, in order to send you commercial communications) you may withdraw it at any time. In this way, we will stop performing that specific activity for which you had previously consented, unless there is another reason that justifies the continuity of the data processing for these purposes in which case you will be notified of this situation.
10. Right to lodge a complaint with a supervising authority:You shall have the right to lodge a complaint with the Spanish Agency for Data Protection, located in C/Jorge Juan, 6, 28001, Madrid, 901 100 099 - 912 663 517 (www.agpd.es), or at the eletronic address: https://sedeagpd.gob.es/sede-electronica-web/vistas/formQuejasSugerencias/seleccionarQuejaSugerencia.jsf

You may exercise the rights above-mentioned by sending us a communication in writing to EPIC (European Photonics Industry Consortium), 17 Rue Hamelin, 75016 Paris, France , or by e-mail to carlos.lee@epic-assoc.com, with your identity document attached and providing us with the details which are required to manage your request.

The interested party can obtain additional information about their rights on the website of Spanish Agency for Data protection, https://ec.europa.eu/info/law/law-topic/data-protection_en.