Supplemental EEA+ Privacy Statement

January 1, 2023

Supplemental EEA+ Privacy Statement

Last updated: 1 January 2023

Introduction

This Supplemental EEA+ Privacy Statement applies only if you are located in the European Economic Area ("EEA"), the United Kingdom ("UK") or Switzerland. This Statement should be read in conjunction with the Alida Privacy Notice.

1. What laws apply?

If you are located in the EEA, the EU General Data Protection Regulation applies to the processing of your personal data. If you are located in the UK, the UK General Data Protection Regulation applies to the processing of your personal data. References to the “GDPR” below are references to the General Data Protection Regulation as it applies in the country where you are located.

If you are located in Switzerland, the provisions of the Swiss Federal Data Protection Act (the “FDPA”) apply to you. References to the GDPR below shall be interpreted analogously for the purposes of applying the FDPA. If we use a term that the GDPR defines, the term has the same meaning as under the GDPR.

2. Who is the data controller?

Alida Inc. ("we") is the data controller. Our address is 200 Granville Street, Mezzanine Floor, Vancouver, BC V6C 1S4.

Our EU GDPR-specific representative is Vision Critical GmbH, Kaiser-Wilhelm-Ring 17-21, 50672, Cologne, Phone: +49 221 65088931. Our UK GDPR-specific representative is is Alida Solutions Limited. Email privacyofficer@alida.com.

Our Data Protection Officer may be contacted at privacyofficer@visioncritical.com.

3. On what legal bases does Alida process personal data?

We process the personal data of users of our Site on several different legal bases, as follows:

Contract Performance: Use of our Site and various features thereof (such as our forum boards) is subject to our Terms of Use and other applicable terms and conditions. We process the personal data of users of our Site as necessary to perform contractual obligations in respect of such users or take steps at such users’ request prior to entering into a contract, as may be applicable, pursuant to Article 6(1)(b) of the GDPR.
Legitimate Interests: We process the personal data of users of our Site as necessary to pursue the following legitimate interests, pursuant to Article 6(1)(f) of the GDPR: To provide a good user experience, to maintain and secure our Site, to tailor our communications, marketing and services to our users, and to support and provide requested services.
Legal Obligations: If we are subject to a lawful access request, engaged in a legal proceeding or suspect a user of illegal conduct, we may need to process your personal data to comply with relevant laws, regulatory requirements and to respond to lawful requests, court orders, and legal process, pursuant to Article 6(1)(c) of the GDPR.
Consent: If we are required to obtain your consent to send you marketing communications, place certain cookies on your device, or engage in other processing activities associated with the Site, we may perform such processing on the basis of your consent if you have provided it, pursuant to Article 6(1)(a) of the GDPR. In such cases, you may withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal. Providing your consent is voluntary, however we will not be able to provide you with a service for which we require your consent unless it is Provided.
Vital Interests: In extenuating circumstances, we may need to process your personal data to protect the vital interests of you or another natural person, pursuant to Article 6(1)(d) of the GDPR.

4. Where does Alida transfer personal data and how are the transfers protected?

We disclose your personal data to recipients in the following jurisdiction or jurisdictions outside of the EEA+ which provide adequate protection to personal data according to the European Commission: Canada and Israel. In each case, the transfer is thereby recognized as providing an adequate level of data protection from a European data protection law perspective (see Article 45 of the GDPR).

We disclose your personal data to recipients in the following jurisdiction or jurisdictions outside of the EEA which do not provide adequate protection to personal data according to the European Commission: Australia, the United States, South Africa, Singapore, Hong Kong, Japan and India. By entering into appropriate data transfer agreements based on Standard Contractual Clauses as referred to in Article 46(5) of the GDPR, or other adequate means, and performing data protection assessments of data transfer arrangements as appropriate, we take the position that all such recipients will provide an adequate level of data protection and that appropriate technical and organizational security measures are in place to protect personal data against accidental or unlawful destruction, loss or alteration, unauthorized disclosure or access, and against all other unlawful forms of processing. Any onward transfer (including to our affiliates outside the EEA+) is subject to appropriate onward transfer requirements as required by the applicable contract or applicable law. You can ask for a copy of such appropriate data transfer agreements by contacting privacyofficer@visioncritical.com.

5. What Data Subject Rights do I have?

Under the conditions set out under the GDPR and any other national data protection laws in the EEA+, you have the following rights:

Right of access: You have the right to obtain from us confirmation as to whether your personal data is being processed, and, where that is the case, to request access to the personal data. The access information includes, among other things, the purposes of the processing, the categories of personal data concerned, and the recipients or categories of recipients to whom the personal data have been or will be disclosed. You have the right to obtain a copy of the personal data undergoing processing. Subject to applicable law, we may charge a reasonable fee for copies, based on administrative costs.
Right to rectification: You have the right to obtain from us the rectification of inaccurate personal data concerning you. Depending on the purposes of the processing, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
Right to erasure: You have the right to ask us to erase your personal data to the extent it is not required for legally required purposes.
Right to restriction of processing: You have the right to request restriction of processing of your personal data, in which case, it would be marked and processed by us only for certain purposes.
Right to data portability: You have the right to receive your personal data which you have provided to us in a structured, commonly used and machine-readable format and you have the right to transmit the personal data to another entity without hindrance from us.
Right to object: You have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data by us and we can be required to no longer process your personal data. If you have a right to object and you exercise this right, your personal data will no longer be processed for such purposes by us. Exercising this right will not incur any cost. Such a right to object may not exist, in particular, if the processing of your personal data is necessary to take steps prior to entering into a contract or to perform a contract already concluded.
Right to Submit Complaints: You have a right to lodge a complaint with a supervisory authority. You may view a list of the contact details of the supervisory authorities in the EEA, UK and Switzerland at the links below:

Please note that these rights may be limited under the applicable national data protection law.

To exercise your rights please contact us at privacyofficer@alida.com.

6. Am I required to provide my personal data?

You are not required to provide any personal data to us, but if you do not provide any personal data to us, you may not be able to use certain features of the Site, such as those available to account holders, participants on our platform, or job applicants, among others. You can use the Site without consenting to cookies that are not strictly necessary; which will mean that your experience on the Site will be less tailored to you and certain features of the Site may not function as intended. You can also use the Site without consenting to receiving marketing communications from us; which will mean that you may not receive marketing communications that you may be interested in.