Your data will generally be stored in your country, and on systems in the United Arab Emirates and Singapore. We will comply with all applicable legal requirements, including the legal requirements of the place where the data is collected and the place where the data is transferred to, where your personal data has to be transferred to a country other than your own. This will include ensuring that following any transfer, your personal data is given the same level of protection which we are required to provide in your country.
It should be noted that the collection, storage, use, processing, transfer (including offshore transfer), disclosure or erasure of personal data by the Borouge Group's holding companies, the Abu Dhabi National Oil Company and Borealis AG, will be covered by the policies of these respective entities and these entities operate independently of the Borouge Group. Kindly refer to section 7 of this Data Protection Notice for further details on this.
3. What is personal data
In this Data Protection Notice, “personal data” means any information which can be used to identify you or any other individual, directly or indirectly, or which otherwise describes your behaviour or that of any individual, including but not limited to the data set out in section 4 below.
In some countries, certain types of personal data may be classified as "sensitive personal data". " (i.e. personal data revealing or concerning (directly or indirectly) your (or any other individual's) racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership and health and sex life). Borouge generally does not collect sensitive personal data, unless otherwise permitted by law, or where required by a local authority. However, where such information is required such as where we collect passport or identification numbers where you seek employment with us, your separate express consent will be obtained, and we will comply with any applicable legal requirements in relation to such sensitive personal data.
4.Types of personal data collected
Borouge may collect personal data about you either directly from you, from your authorised representatives (i.e. persons who you have authorised and persons who have been validly identified as being you or your authorised representative), from third parties, or publicly available sources.
Subject always to applicable legal requirements, personal data which we may collect includes but is not limited to:
(a) Personal information such as your name, passport or identification numbers, date of birth, marital status or gender;
(b) Contact information such as postal addresses, email addresses, telephone, mobile phone and fax numbers;
(c) Employment information such as employment history and references, resumes, organisation name, organisation type, industry sector, job function and responsibilities, designation, business telephone and fax numbers, business email addresses;
(d) Education information and academic qualifications such as schools attended, courses of study, the period of study and academic results;
(e) Financial information such as bank account details;
(f) Records from discussions or correspondences, including details obtained through customer satisfaction or other surveys;
(g) Details of your transactions with Borouge for the provision of any products;
(h) Information derived from cookies (small text files which uniquely identify your browser) where you visit any website or use any application created by or on behalf of Borouge; and
(i) Information you provide to Borouge in relation to the provision of any products from Borouge to you or in relation to your employment with Borouge.
5.Collection of personal data
We may collect personal data from you in the following ways:
(a)when you submit an application form or registration form, or other forms (for example, relating to any of our products);
(b)when you enter into any agreement or provide other documentation or information in respect of your interactions with us, or when you transact with us for our products;
(c)when you interact with our employees, agents, representatives or officers, for example, via telephone calls, letters, face-to-face meetings, social media platforms and emails;
(d)when you use our electronic services, or interact with us via any of our websites or use services on any of our websites; /p>
(e)when you request that we contact you or request that you be included in an email or other mailing list;
(f)when you respond to our promotions, initiatives or to any request for additional personal data;
(g)when your images are captured by us via CCTV cameras while you are within our premises, or via photographs or videos taken by us or our representatives when you attend events at our premises or events sponsored by us at other locations;
(h)when you are contacted by, and respond to, our marketing representatives and customer service officers;
(i)when we receive references from business partners, sales contacts and/or other third parties, for example, where you have been referred by them;
(j)when you fill up surveys administered by our third-party surveying service providers;
(k)when we seek information from third parties about you in connection with the products you have applied for; and/or
(l)when you submit your personal data to us for any other reason, to the extent that it is permissible by applicable laws.
When you browse our websites, or use our applications and/or digital services, we may collect and store certain information automatically. Please see the section below on cookies for additional detail.
If you provide us with any personal data relating to a third party (e.g. information relating to your spouse, children, parents, and/or employees), you represent and warrant to us that you have obtained the prior consent for the respective purposes set out above, and for us to use such data for the purposes and in the manner set out in this Data Protection Notice.
We generally do not collect personal data from children and minors and will take reasonable measures to remove such personal data from our systems. If you believe that a child or minor has provided us with personal data, please contact us in accordance with section 12 below
You should ensure that all personal data submitted to us is complete, accurate, true, current and correct. Please update us if there are changes to your personal data by informing our Data Protection Officer in writing or via email at the contact details provided in section 12 below.
6.Purposes for the collection, use and disclosure of personal data
We may collect, store use, process, transfer (including offshore transfer) disclose and erase your personal data for the following purposes:
(a)verifying and authenticating your identity for the purpose of providing you with our products, or where you provide products and/or services to us;
(b)responding to, processing and handling your complaints, queries, requests, feedback and suggestions;
(c)managing the administrative and business operations of Borouge and complying with internal policies and procedures;
(d)facilitating business asset transactions (which may extend to any mergers, acquisitions or asset sales) involving any of the entities of the Borouge Group of companies;
(e)matching any personal data held which relates to you for any of the purposes listed herein;
(f)requesting feedback or participation in surveys, as well as conducting market research and/or analysis for statistical or other purposes;
(g)preventing, detecting and investigating crime and analysing and managing commercial risks;
(h)managing the safety and security of our premises (including but not limited to carrying out CCTV surveillance and conducting security clearances);
(i) archival of documents and records in both electronic and physical form for record-keeping purposes for no longer that is required by any applicable law;
(j)in connection with any claims, actions or proceedings (including but not limited to drafting and reviewing documents, transaction documentation, obtaining legal advice, and facilitating dispute resolution), and/or protecting and enforcing our contractual and legal rights and obligations;
(k)conducting investigations relating to disputes, billing or fraud;
(l) complying with any applicable local or foreign statute, rule, law, regulation, judgment, decree, directive, code of practice, guideline, administrative requirement, sanctions regime, court order, or contractual agreement to which any Borouge entity is a party;
(m) any other purposes which are permitted under applicable law and for which your consent is not expressly required on the basis that we have a legitimate interest and such interests are not otherwise overridden by your fundamental rights or compelling legitimate interests under any applicable law;
(n)any other purposes for which you have provided information;
(o)sharing of personal data with other entities as set forth in this Notice; and/or
(p)to the extent permitted by any applicable laws, any other commercial or non-commercial purposes related to or in connection with the above.
In addition, we may collect, store, use, process, transfer (including offshore transfer), disclose and erase your personal data for the following purposes depending on the nature of our relationship:
(a) User / Visitor on Website
If you browse, use or visit our websites, applications and/or any digital services,
(i) to aggregate anonymised statistical data and gather feedback to enable us to continually improve our website and your user experience;
(ii) to administer our website, including for troubleshooting;
(iii) to personalise and tailoring your experience on our website; and/or
(iv) to the extent permitted by any applicable laws, any other commercial or non-commercial purposes related to or in connection with the above.
(b) Customer / Consumer
If you are an employee, business partner, sole proprietor, director, nominee director or guarantor, agent, distributor or representative of an organisation that is a customer (including prospective customer) or otherwise has a corporate relationship with Borouge:
(i) to assess and process any requests, applications or orders made by you for any products;
(ii) to facilitate the continuation or termination of your business relationship with any of the entities of the Borouge Group;
(iii) creating and maintaining the profile or account in our system database for internal records and reference;
(iv) to provide you with customer service and support;
(v) to facilitate and carry our due diligence checks;
(vi) to facilitate marketing and promotional activities;
(vii) to comply with any applicable rules, laws and regulations, codes of practice or guidelines or to assist in law enforcement and investigations by relevant authorities (including but not limited to disclosures to regulatory bodies, conducting audit checks, surveillance and investigation, or customer due diligence; and/or
(viii) to the extent permitted by any applicable laws, any other commercial or non-commercial purposes related to or in connection with the above.
(c) Vendor / Service Provider
If you are an agent, employee, officer or owner of an external service provider or vendor outsourced or prospected by Borouge:
(i) to manage project tenders or the supply of goods;
(ii) to process and pay vendor invoices;
(iii) to comply with any applicable rules, laws and regulations, codes of practice or guidelines or to assist in law enforcement and investigations by relevant authorities (which includes disclosure to regulatory bodies or audit checks); and/or
(iv) to the extent permitted by any applicable laws, any other commercial or non-commercial purposes related to or in connection with the above.
(d) Candidate for employment
If you submit an application to us as a candidate for employment:
(i) to respond to, and process, your application for employment with a Borouge Group company;
(ii) to conduct the interview process;
(iii) to process your application which includes pre-recruitment checks involving your qualifications and facilitate the interview process;
(iv) to provide or obtain employee references and for background screening;
(v) for evaluative purposes such as assessing your suitability for the position applied for;
(vi) to process staff referrals under our internal referral scheme; and/or
(vii) to the extent permitted by any applicable laws, any other commercial or non-commercial purposes related to or in connection with the above.
Where permitted by any applicable law, we may also collect, store, use, process, transfer (including offshore transfer), disclose and erase your personal data for the following additional purposes:
(a) for providing or marketing our products, including but not limited to any special events and promotions organised by Borouge;
(b) for conducting market research, analytics and surveys to enable Borouge to understand and determine customer preferences and demographics for us to offer you our products as well as marketing programmes; and/or
(c) to the extent permitted by any applicable laws, any other commercial or non-commercial purposes related to or in connection with the above.
In relation to particular products or in your interactions with Borouge, we may also have specifically notified you of other purposes for which we collect, store, use, process, transfer (including offshore transfer), disclose or erase your personal data. If so, we will collect, use and disclose your personal data for these additional purposes as well, unless we have specifically notified you otherwise.
7. Disclosure of personal data
We may share your personal data with other companies in the Borouge Group.
Depending on the products you require, we may also need to share your personal data with other companies, including our holding companies, the Abu Dhabi National Oil Company and Borealis AG, and their respective subsidiaries. Any transfer or sharing of your personal data with our holding companies, and/or related processing, will be carried out proportionally in accordance with the purposes stated in section 6. In this regard, please be assured that our holding companies implement an adequate, equivalent or comparable level of protection towards your personal data.
Your personal data may also be disclosed for the purposes listed in section 6 to the following third parties:
(a) agents, contractors or third-party service providers who provide services to the Borouge Group;
(b) banks, financial institutions, credit card companies and their respective service providers;
(c) any business partner, , assignee or transferee (actual or prospective) to facilitate business asset transactions (which may extend to any merger, acquisition or asset sale) involving a Borouge Group company;
(d) our professional advisers such as our auditors and lawyers;
(e) any judicial, administrative or regulatory body, any government or public or government agency, instrumentality or authority, any domestic or foreign tax, revenue, fiscal or monetary authority or agency, securities or futures exchange, self-regulatory organization, trade repositories, central counterparties, court, central bank or law enforcement body or any agents thereof; and/or
(f) any other party to whom we are authorised to disclose your personal data to.
In relation to customers / consumers, we will share the following items of personal data with the third parties listed above:
(a) Personal details, including information that identifies the customer or consumer such as name, address, and contact details; and
(b) Goods or services provided and related information, including details of the goods or services supplied, licences issued, and contracts.
Where any of your personal data is required to be disclosed to a third party, we will take all reasonable steps to ensure that your personal data will be handled safely, securely, and in accordance with your rights, our obligations, and the obligations of the third party under any applicable law.
Some third-party processors may be located in countries with differing data protection or privacy requirements. You explicitly consent to a data transfer to processors or other entities in these countries. Where we share your personal data with these entities in other jurisdictions, we will take steps to ensure that your data is provided with an adequate, equivalent or comparable level of protection, for example, through contractual data transfer agreements. We will also require third parties to whom we transfer and/or disclose personal data to enter into non-disclosure agreements with us and comply with applicable data protection, privacy and confidentiality laws when processing such data. Third parties to whom we transfer and/or disclose your personal data shall not be entitled to further disclose such data.
We may request a separate consent from you where we need to share your personal information with other third parties and/or for purposes other than those listed above. You will have the option to indicate whether or not you consent to such processing activities.
The entity responsible for the sharing shall be the Borouge Group Company responsible for your data as indicated in section 2.
8.Our use of cookies
A cookie is a small file of letters and numbers that we store on your browser or the hard drive of your computer if you agree. Cookies contain information that is transferred to your computer's hard drive.
When you browse our websites, or use our applications and/or digital services, we may use cookies to distinguish you from other users of our websites, applications and digital services. This helps us to provide you with a good experience when you browse our websites and also allows us to improve our websites applications and digital services.
Before cookies are placed on your computer or device, you will be shown a pop-up message requesting your consent to let us place, set and use those cookies. By continuing to browse our website, or use our applications and/or digital services, you are agreeing to our use of cookies.
We may use any of the following cookies or all of them:
• Strictly necessary cookies: These are cookies that are required for the operation of our website. They include, for example, cookies that enable you to log into secure areas of our website, or use services provided by Borouge.
• Performance cookies: These allow us to recognize and count the number of visitors and to see how visitors move around our website when they are using it. This helps us to improve the way our website works, for example, by ensuring that users are finding what they are looking for easily. Information used for such purposes is generally stored as anonymised information from which individuals cannot be identified.
• Functionality cookies: These are used to recognize you when you return to our website. This enables us to personalize our content for you, greet you by name and remember your preferences (for example, your choice of language or region).
Borouge does not market its products to individual consumers. As such, we do not use cookies for marketing purposes. We do not use cookies which track or monitor your behaviour for targeted advertising, or for the offering of any products.
You may refuse placement and/or block cookies by activating the setting on your browser that allows you to refuse the setting of all or some cookies. However, if you use your browser settings to block all cookies (including strictly necessary cookies) you may not be able to access all or parts of our website.
Cookies are destroyed once they are no longer necessary for their purpose.
Our websites, applications and/or digital services may contain links to other websites some of which may also use cookies, for which we have no access to or control over. This Data Protection Notice does not cover non-Borouge websites which will be subject to their own privacy and cookie policies. We do not have access to or control over cookies or other features used by such websites. Please contact them directly for more information about their privacy practices. If you follow a link, please note that the other website will have its own privacy notice and you should check its content before you submit any personal data on that website. We are not responsible for the content of other websites or their use of your personal data.
9.Protection of personal data
Security of your personal data is important to us. Borouge will take reasonable efforts to protect personal data in our possession or our control by making reasonable security arrangements to prevent unauthorised access, collection, use, processing, transfer, disclosure, copying, modification, disposal or similar risks.
We have put in place appropriate technical and organisational measures steps to protect your personal data against unauthorised or unlawful processing and against accidental loss or destruction of, or damage to your personal data, including:
• technical and physical access controls;
• data protection and cybersecurity awareness and training;
• data protection and cybersecurity breach procedures and other forms of emergency planning;
• penetration testing of our systems;
• back-up arrangements for systems and data;
• audit controls;
• secure disposal; and
• other measures required under any applicable law of a relevant jurisdiction.
While we strive to protect your personal data, we cannot ensure the security of the information you transmit to us via the Internet, when you browse our websites, or use our applications and/or digital services, and the method of electronic storage. We urge you to take every precaution to protect your personal data when you are on the Internet, when you browse our websites, or use our applications and/or digital services.
Where we have given you (or where you have chosen) a username and password which enables you to access certain parts of our websites, applications or digital services, you undertake to keep your username and password secure and confidential and shall not disclose or permit it to be disclosed to any unauthorised person, and to inform us as soon as reasonably practicable if you know or suspect that someone else knows your username and password or believe the confidentiality of your username and password has been lost, stolen or compromised in any way or that actual or possible unauthorised transactions have taken place. We are not liable for any damages resulting from any security breaches, on unauthorised and/or fraudulent use of your username and password.
We will put in place measures such that your personal data in our possession or under our control is destroyed and/or anonymised as soon as it is reasonable to assume that (a) the purpose for which that personal data was collected is no longer being served by the retention of such personal data; and (b) retention is no longer necessary for any other legal or business purposes.
We have also put in place appropriate and adequate safeguards and procedures to prevent and respond to a possible data breach. For the avoidance of doubt, data breach shall mean any unauthorised or unlawful access, disclosure, and rectification, as well as misuse, damage, or loss of personal data, due to a security breach (each event, a “data breach”). In addition, we will promptly notify any relevant authorised institution, regulator and/or affected data subject, in accordance with applicable laws and regulations. To the extent that it is permitted or prescribed by applicable laws and regulations, we may send such notification electronically.
10.Retention Limitation
When personal data is no longer required for the purpose for which it was collected and/or any other legally permissible purpose, we will either securely and permanently delete or destroy the personal data, or anonymise it such that it cannot be used to identify you or any other individual.
The specific period of retention for personal data may be affected by the legal requirements of your country. We will comply with document retention periods which may be set by your country's authorities and/or the contractual limitation periods under the laws of your country. While this would typically mean that we will delete, destroy or anonymise data within 6 years from the time it is no longer required, unless your country requires us to do so at a sooner date, local practice may vary and longer periods of retention may be permitted or required under the laws of some jurisdictions. We may also delete or destroy data where you are entitled to require us to do so, or where directed by a lawful authority in your country.
11.Your rights and how to exercise them
You shall have the following rights in respect of your personal data:
• Right to Information
You are entitled to request information on our procedures and processes in relation to our processing of your personal data, including the purposes for which your personal data is processed. Depending on the laws of your country, you may also be entitled to request disclosure of personal data where consent is not required due to our reliance on any legal exceptions.
• Withdrawal of Consent
Where you have provided personal data to us and wish to withdraw your consent for our collection, use, disclosure, storage or processing of such data, you may contact our data protection officer to notify us of such withdrawal.
Kindly note that if you withdraw your consent to any or all use of your personal data, depending on the nature of your request, Borouge may not be in a position to administer any contractual relationship in place, which in turn may, subject to the laws of your country, also result in the termination of any agreements with Borouge, and your being in breach of your contractual obligations or undertakings. Borouge’s legal rights and remedies in such event are expressly reserved.
• Access, Amendment and Rectification
You have the right to request access, amend and/or rectify any personal data that we hold about you, subject to the requirements of applicable law. If you would like to request for a copy of your personal data being held by us (such right being subject to applicable exemptions), or to update, amend and/or rectify personal data which you have previously provided to us, please write to our data protection officer at the contact details provided under section 11 below.
We treat such queries and feedback seriously and will deal with them confidentially, within a reasonable time or such time limits mandated by any applicable law. Borouge generally does not charge a fee for requests to access, amend or rectify your personal data.
Depending on the jurisdiction in which you are located, you may also have other rights, such as:
• Right to Data Portability: Right to request for the transfer of the personal data in machine readable formats to other data controllers;
• Right to Object: Right to object to the collection, usage, processing, transfer and/or disclosure of the personal data;
• Right to Erasure, Deletion and/or Anonymisation: Right to request for erasure, deletion and/or anonymisation of all personal data held by us; and/or
• Right to Restriction of or Block Processing: Right to request for suspension of or block the use of your personal data;
• Right to Seek Further Redress :We take all requests and feedback seriously and will endeavour to address such requests and feedback to your satisfaction. If you believe we have fallen short of our duties in relation to your personal data, you are entitled to lodge a complaint with your local supervisory authority. Depending on your country's laws, you may also be entitled to take legal action against us.
You should contact our data protection officer if you wish to inquire about the rights you may have in relation to your personal data and/or if you wish to exercise any rights in relation to your personal data.
12.Contact us
To contact us in order to exercise any of your rights in relation to your data, to enquire on any aspect of this Data Protection Notice or your personal data, or provide us with any feedback, please contact our Data Protection Officer by sending an email to dataprivacyofficer@borouge.com.
We will need enough information from you in order to ascertain your identity as well as the nature of your request, so as to be able to deal with your request. You may be required to provide, at least, the following details:
• Your full name and contact information; and
• A brief description of your query or feedback.
We treat such queries and feedback seriously and will deal with them confidentially and within a reasonable time