ELO PARTNERPORTAL ONLINE PRIVACY POLICY

I. Information about collecting personal data on the ELO PartnerPortal, the ELO Community, and the ELO Online Academy

The ELO PartnerPortal at partner.elo.com ("Partner Portal" in the following) is the central platform for ELO Business Partners and other authorized persons (customers using the applications ELOprofessional and ELOenterprise). The Partner Portal, which is operated exclusively by ELO Digital Office GmbH, Tübinger Str. 43, 70178 Stuttgart, Germany, offers information from the development, sales, product management, and marketing departments, and the ELO Academy. Furthermore, the Partner Portal is a web interface in which ELO Business Partners can maintain and manage their partner profile, references and events. 

The Partner Portal also gives users access to the ELO Community and the ELO Online Academy. Access to the ELO Community or the ELO Online Academy is conditional upon the user registering for the Partner Portal and accepting the Privacy Policy; this also applies to these platforms, hereinafter referred to as "portal(s)" or "website(s)". The logon credentials for the Partner Portal can also be used to gain access to the ELO Community or the ELO Online Academy. 

The following section contains information on how your personal data is processed:

What is personal data?
Personal data is all information referring to an identified or identifiable natural person (see Art. 4 No. 1 General Data Protection Regulation, "GDPR" in the following). This includes information such as your name, e-mail address, usage behavior, or postal address. Information that cannot be directly linked to your identity, for example, the number of users of a website, is not considered personal information.
 

II. Name and address of the controller
a) The controller as per Art. 4 Sec. 7 GDPR is:

ELO Digital Office GmbH
Tübinger Str. 43
70178 Stuttgart
Germany
Tel.: +49 711 80 60 89 0
dsb[at]elo.com

www.elo.com

b) Name and address of the data protection officer
You can contact our Data Protection Officer at the e-mail address above or at our mailing address to the attention of the "Data Protection Officer".

 

III. General information on processing data
a) Scope of processing personal data
We process your personal data only to the extent necessary to provide a functional website and for our content and services, and only data that are needed to carry out the stated purpose (principle of data minimization). Your personal data will only be processed if it constitutes a justified interest pursuant to Art. 6 GDPR or it is expressly allowed by law.

b) Data deletion and storage period
Your personal data will be deleted or blocked as soon as the purpose for which it was collected and saved and the reason for the storage no longer applies, or if you request us to delete or block it. For more information, refer to the section on the rights of data subjects. 

 

IV. Processing personal data when visiting our website
a) Proper processing of personal data

When using the website for information purposes only, i.e. if you do not register or otherwise provide us with information by entering data, we only collect the personal data your browser automatically transmits to our server via log files. The log files contain

  • the IP address of the user • date and time of access/request
  • time zone difference to Greenwich Mean Time (GMT)
  • access status/HTTP status code
  • website that the request originates from
  • language and version of the browser software.

b) Legal basis for processing data
The legal basis for temporary storage of data and log files is Art. 6 para. 1 lit. f GDPR.

c) Purpose of processing data
Temporary storage of the IP address by the system is necessary for delivery of the website to your computer. The IP address must remain stored for the duration of the session. It is stored in log files in order to ensure the functionality of the website. This data also helps us to optimize the website and to ensure the security of our information technology systems. In this context, the data is not analyzed for marketing purposes.

d) Storage duration
The data is stored in log files for seven days. Data can also be stored beyond this period. In this case, user IP addresses are deleted or disguised so that it is no longer possible to associate them with the respective client.

e) Right to object and right to erasure
We are required to collect and store specific data in log files for the purpose of delivering the website and to ensure it works properly. While the user does not have the right to object to this, you will find other rights of data subjects at the end of this page. 

 

V. Use of cookies

We use cookies to store information that allows us to customize our site according to your individual interests and make our website more user-friendly. A cookie is a small piece of data that stores configuration information (e.g. language setting, logon credentials) on your end device.

The cookies used on the website are broadly classified into strictly necessary cookies and optional cookies. The legal basis for collecting strictly necessary cookies (functional cookies) is Art. 6 (1) lit. f GDPR. We will not set optional cookies (e.g. tracking cookies) unless we have an active indication of your consent (via the cookie consent banner) in accordance with Art. 6 (1) lit. a GDPR.

For more information about the types of cookies, what they are used for, how long they are stored, and how you can block or delete them, click here.

The ELO Community and ELO Online Academy websites only use strictly necessary cookies. These are session cookies, that is cookies that are saved during the session and automatically deleted after the session is ended. These enable us to set the language and time zone for the duration of your website session, or to keep your session active so that you don't need to sign in again if you switch to another page, for example. These cookies are necessary to provide the portal functions. They do not store any information that could serve to identify the user, but instead act as a session ID. Session cookies are deleted when you log off from the website, your session expires automatically, or you close the browser. 

VI. Processing data when using the Partner Portal, the ELO Community, and the ELO Online Academy

a) Description and scope of processing data
To use our portal, you must register by specifying your e-mail address, a custom password, and a user name of your choice. The following information must also be provided: 

  • Form of address
  • First name
  • Last name

Use of a real name is mandatory; anonymous accounts are not permitted.

You can provide all other information on a voluntary basis while using our portals. This pertains to information such as: 

  • Address
  • Postal code
  • Town/City
  • Country
  • Telephone
  • Mobile
  • Image uploads

Your logon credentials will be linked to the ELO Community and to the ELO Online Academy website, enabling you to use these portals with the same logon credentials. The following data will be processed when using the ELO Online Academy website:

  • When the user answers multiple choice questions at the end of a course for self-assessment purposes or to complete a course (see "Skill management" under VII for more details).
  • When the user gives feedback at the end of a course
  • When community posts are linked to the user in the Academy section of the ELO online community

Visibility of your profile
Your entire profile is not visible to other users of the Partner Portal. 
This does not apply when you use the ELO Community community.elo.com with your ELO PartnerPortal login credentials. In this case, your user name, job title, and company are visible to other members. To prevent third parties from gaining unauthorized access to your personal data, the connection is encrypted. 

b) Legal basis for processing data
Registration serves to fulfil a contract or to carry out pre-contractual duties that the user (you) are bound to by contract. The legal basis for processing data is Art. 6 para. 1 lit. b GDPR. The legal basis for processing further (voluntary) data as part of the registration process, as well as when submitting feedback or posts, is user agreement as per Art. 6 para. 1 lit. a GDPR, as you are neither legally nor contractually obliged to provide this information.

c) Purpose of processing data
Your registration is mandatory to fulfil a contract or to carry out pre-contractual duties. The data collected is required to set up a Partner Portal account and use the services available there and well as to provide access to the ELO Online Academy and the ELO Community. We store data you have provided voluntarily (including posts and feedback) to optimize our offering, including support, portal services, and integration of the community features on and between the individual portals.

d) Storage duration
If you use our portal, we save your data required to fulfill the contract until you delete your account permanently. Furthermore, we store the data you have provided voluntarily for as long as you use the portal, unless you delete it first or request its deletion. You can manage and change all information in the Partner Portal. The lawfulness of processing previously collected data remains unaffected by deletion or processing. 

e) Right to object and right to erasure
You have the option to delete your registration on the Partner Portal at any time. You can request changes to the data stored on your person at any time.

  • When creating an account on the Partner Portal, the data you enter is stored and can be revoked. You can delete all data, including your user account, in the ELO PartnerPortal yourself.
  • If data is required to fulfil a contract or carry out pre-contractual duties, it is only possible to delete data prematurely provided no contractual or legal obligations would disallow deletion. 

You can also edit your profile in the ELO Online Community, as long as it relates to voluntary information. Changes to master data must be made on the Partner Portal. 

f) Disclosure to third parties and third countries
This data will not be passed on to third parties or any third countries. 

 

VII. Information relating to skill management in the ELO Online Academy

ELO manages the contents and materials offered on the platform through a skill management system. This enables users to track their progress and attain levels of expertise. Skill management is based, among other things, on the analysis of access to e-learning, the results achieved in final tests, the blended learning offer, and the number of virtual classrooms that the user attends. This information is automatically compared with the classification level set by ELO. The user's level of expertise is assigned based on this. The level changes in accordance with the user activity. The user can see which level they are currently at on the dashboard. 

a) Description and scope of processing data
The skill management system tracks the user activity on the platform and allocates qualifications or skills in accordance with the activities carried out. The acquired qualifications and skills are mapped as levels, meaning that the learning history is deleted once the user has reached the level. The learning history only contains records of completed courses and attended trainings.

The answers to the multiple-choice questionnaires for self-assessment purposes are not visible to anyone except the user. The multiple-choice questionnaires used to complete a course are tracked for the purpose of awarding the corresponding level.

b) Purpose and legal basis
The skill management system maps the user's learning progress to facilitate better resource planning and improve the quality of product knowledge and the application. This in turn enables the ELO Business Partner, the user, and authorized persons at ELO to plan more effectively, acquire projects to suit their requirements and to get continuous training. The legal basis for this is the legitimate interest pursuant to Art. 6 sec. 1 (f) GDPR.

c) Storage period and deletion
The levels that the user achieves on the skill management system are stored in the learning history until no longer required. This is the case after two years if ELO has not previously received instructions to delete the user profile or the user has not registered with a new account. Further, the learning history will be deleted if the user requests this from ELO. 

d) Disclosure to third parties and third countries
The data will not be passed on to any third party or third country. However, data is disclosed by means of transmission (pursuant to Art. 4 GDPR). Such data is only disclosed to persons at ELO or the ELO Business Partner who are involved in planning training measures. Further, only the information about the skill status is transmitted, but not the tracked data.

e) Automated decision-making
There is an automated decision-making process pursuant to Art. 22 para. 1 and 4 GDPR which, however, has no legally binding force (see "Purpose"). Suggestions for courses may be made to the user but accepting or rejecting them does not have any disadvantages for the user in relation to ELO.

The controller (ELO) processes your personal data in accordance with the rights of data subjects under GDPR.

 

VIII.    Rights of data subjects

Provided your personal data is processed, you are considered the data subject as per GDPR and are entitled to the rights listed below with regard to the controller.
a)    Right to be informed
You can demand a confirmation of whether personal data related to you is processed. Should this be the case, you can demand the following information:

(1) The purposes for which the personal data is processed;

(2) The categories of the personal data processed;

(3) The recipients/categories of recipients receiving the personal data related to you;

(4) The planned storage period for the personal data related to you or, if no concrete information is possible, criteria for determining the storage period;

(5) Existence of a right to rectification or erasure of the personal data related to you, a right to restrict processing by the controller, or a right to object to this processing;

(6) The existence of a right to appeal to the authorities;

(7) All available information on the origin of the data if the personal data is not collected from the associated individual;

(8) The existence of an automated decision-making solution including profiling, as per Art. 22 Sec. 1 and 4 GDPR and – at least in these cases – meaningful information on the involved logic as well as the reach and target effect of such processing for the data subject.

You have the right to be informed of whether the personal data related to you is transmitted to a third country or an international organization. In this context, you can request to be informed of appropriate safeguards as per Art. 46 GDPR in conjunction with the transmission of your data.

b) Right to rectification
You have the right to rectification and/or completion provided the processed personal data related to you is incorrect or incomplete. The controller must promptly rectify the issue.

c) Right to restrict processing
You can exercise your right to restrict processing of the personal data related to you provided the following conditions are met:

(1) If you dispute the accuracy of the personal data related to you for a period that enables the controller to verify the accuracy of the data;

(2) Processing is wrongful and you reject the deletion of your personal data, instead exercising your right to restrict the use of your personal data;

(3) The controller no longer requires the personal data for processing, but you need it to assert, exercise, or defend legal claims;

(4) If you have exercised your right to object to processing as per Art. 21 Sec. 1 GDPR and it has not been determined whether the the legitimate interest of the controller outweighs your interest.

If processing of the personal data related to you has been restricted, this data may only be processed (besides storage) with your express consent or to assert, exercise, or defend legal claims, or to protect the rights of other natural or legal persons, or for reasons of an important public interest of the European Union or a member state.

If restriction of processing was lifted based on the requirements above, you will be notified by the controller before this restriction is lifted.

d) Right to erasure
i.    Obligation of erasure
You can demand that the controller delete any personal data related to you right away and the controller is required to delete this data provided one of the following reasons applies:

(1) The personal data related to you is no longer needed for the purpose for which it was collected or processed in any other way.

(2) You withdraw your consent for processing based on Art. 6 Sec. 1 a or Art. 9 Sec. 2 a GDPR and there is no other legal basis for processing.

(3) As per Art. 21 Sec. 1 GDPR, you object to processing and there are no superior legitimate reasons for processing; or, you object to processing as per Art. 21 Sec. 2 GDPR.

(4) The personal data related to you was processed unlawfully.

(5) Deletion of the personal data related to you is required to fulfil a legal obligation in line with EU law or law of member states to which the controller is subject.

(6) The personal data related to you was collected as per Art. 8 Sec. 1 GDPR with regard to the services offered by the information society.

ii.    Information to third parties
If the controller has published your personal data and is obligated to delete this data as per Art. 17 Sec. 1 GDPR, the controller shall take suitable measures taking into account the available technology and implementation costs, including those of a technical nature, to inform the party responsible for processing the personal data that you as data subject have requested the deletion of all links to this personal data or of copies or replications of this personal data.

iii.    Exceptions
The right to erasure does not apply if processing is required.

(1) to exercise the right to free expression of opinion and information;

(2) to meet a statutory obligation requiring processing in accordance with the law of the European Union or a member state to which the controller is subject, or to carry out a duty in the public interest or in exercising official authority assigned to the controller;

(3) for reasons of public interest in the area of public health as per Art. 9 Sec. 2 h as well as Art. 9 Sec. 3 GDPR;

(4) for archiving purposes in the public interest, economic or historical research purposes, or for statistical purposes as per Art. 89 Sec. 1 GDPR provided that the right named in a) is not expected to render attainment of the objectives of this agreement impossible or have a serious negative effect, or

(5) to assert, exercise, or defend legal claims.

e) Right to be informed
If you have exercised your right to rectification, erasure, or to restrict processing vis-à-vis the controller, the controller is obligated to notify all recipients to which your personal data was disclosed of rectification or deletion of the data, or restriction to its processing, unless this proves to be impossible or requires a disproportional amount of effort. You have the right to be informed of these recipients by the controller.

f) Right to data portability
You have the right to receive the personal data related to you that you have provided to the controller in a structured, commonly used, machine-readable format. In addition, you have the right to pass on this data to another controller without interference of the controller to which you have provided the personal data, provided

(1) Processing is based on consent as per Art. 6 Sec. 1 a GDPR or Art. 9 Sec. 2 a GDPR, or on a contract as per Art. 6 Sec. 1 b GDPR and

(2) processing is carried out by automated processes.

In exercising this right, you also have the right to demand your personal data be transferred directly from one controller to another controller, provided this is technically feasible. This must not negatively affect the freedoms and rights of other individuals.

The right to data portability does not apply to processing of personal data required or to carry out a duty in the public interest or in exercising official authority assigned to the controller;

g) Right to object
You have the right to object to the processing of your personal data based on Art. 6 Sec. 1 e or f GDPR for reasons resulting from your particular situation at any time; this also applies to profiling based on these provisions.

The controller no longer processes your personal data unless the controller can provide compelling legitimate reasons that outweigh your interests, rights, and freedoms, or processing serves to assert, exercise, or defend legal claims.

If the personal data related to you is processed to carry out direct advertising, you have the right to object to the processing of your personal data for the purpose of such advertising at any time; this also applies to profiling provided directly related to such direct advertising.

If you object to processing for purposes of direct advertising, your personal data will no longer be processed for this purpose.

You have the option to exercise your right to object by means of an automated process which uses technical specifications in connection with the use of services provided by the information society, directive 2002/58/EC notwithstanding.

h) Right to withdraw consent to use of data
You have the right to withdraw your consent to the use of your data at any time. Withdrawing your consent does not affect the lawfulness of the processing taking place based on your consent up to withdrawal.

i) Automated decision including profiling in individual cases
You have the right to not be subjected to a decision based solely on automated processing, including profiling, that has a legal effect on you or affects you significantly in a similar manner. This does not apply if the decision

(1) Is required to conclude or fulfil a contract between you and the controller,

(2) Is permissible based on legal provisions of the European Union or a member state to which the controller is subject and these legal provisions contain suitable measures to protect your rights and freedoms as well as your legitimate interests, or

(3) Is carried out with your express permission.

However, these decisions shall not be based on special categories of personal data as per Art. 9 Sec. 1 GDPR provided Art. 9 Sec. 2 a or g GDPR applies and suitable measures have been taken to protect your rights and freedoms as well as your legitimate interests.

With regard to the cases named in (1) and (3), the controller shall take appropriate measures to ensure your rights and freedoms as well as your legitimate interests, including at least the right to request an individual on the side of the controller to intervene, to present your own position, and to contest the decision.

j) Right to appeal to the authorities
Notwithstanding any other administrative or judicial decision, you have the right to appeal to the authorities, especially in the member state where you are located, of your workplace, or of the location of the alleged violation if you believe that the processing of your personal data is in violation of GDPR.
The authority receiving the appeal shall inform the appealing party of the status and result of the appeal, including the option for a legal decision as per Art. 78 GDPR.

We reserve the right to change the policy at any time subject to data privacy regulations.

IX. Contact
If you have any questions, requests, or complaints related to data privacy, please contact us at the address named in item II. 

Version: November 2019