Privacy Statement

What personal data do we process?

The type of personal data that Elari processes about you may be:

• Basic personal information such as name, address, telephone number, email and demographic information
• User and web traffic information such as login ID, username, and IP address
• Financial information such as invoice-related information
• Content you have uploaded or provided such as photos, comments, articles and videos
• Statistics that show how the users use our software and consume content we offer
• Information provided through job applications

For the purposes mentioned in the section “Why do we process personal data?”, Elari does not process sensitive personal data about you.

How is personal data collected?

In general, Elari collects personal data directly from you or other persons linked to our Customer. If the Customer you work for purchases Elari products or services via an Elari partner company, we may collect information about you from the partner company.

We will also use cookies and other tracking technologies when you use Elari websites, use our applications/services and interact with us via email, in order to optimise your experience of Elari, our products and our sites. Please see our cookie policy for more information.

In some cases, we may also collect information about you from other sources. These sources may be third-party data aggregators, Elari’s marketing partners, public sources or third-party social networks.

Why do we process personal data?

This Elari Privacy Statement applies when Elari and its affiliated companies (Elari) process your personal data for various purposes when you interact with us, such as:

Buy and deliver

• Facilitate customer orders, agreements, payments
• Offer services directly to you, such as e-learning, webinars, reports, etc.
• Provide requested offers on products and services to Customers
• Create and facilitate accounts for users of our services

Support and improve

• Improve and develop the quality, functionality and user experience of our products, services and Elari Sites
• Offer customer support of our products and services
• Operate user communities to educate and enable interaction between users and Elari

Security

• Detect, mitigate and prevent security threats and abuse, and perform maintenance and debugging

Marketing

• Manage and send marketing preferences and content
• Create interest profiles in order to promote relevant products and services (profiling)

Recruiting

• Manage recruitment processes and process job applications
• Evaluate submitted documentation, conduct interviews and call references

Information regarding how personal data is processed in one of our many services is outlined in the respective data processing agreement for that service. In such cases, Elari acts as a data processor and processes the data on behalf of and according to instructions given by the Customer. For more information regarding this, please contact customer support for that specific service.

What is the legal basis for processing your personal data?

We process data based on several legal grounds.

Agreement with you

We process your personal data on the basis of a legally binding contract with you. This will typically be when you apply for a job at Elari. Processing your personal data such as CV, application and references is necessary for Elari to handle jobseekers’ requests before a contract is entered into.

Your consent

Elari might process your personal data based on consent. You will always be able to withdraw your consent, after you have given the consent.

Legitimate interest

Elari has a legitimate interest when we process your data for security, support and improvement purposes, or when you act as customer contact/lead for our existing and potential customers, including in customer support. Your personal data is processed from a business perspective in a manner that we believe does not conflict with your privacy rights or freedoms.

Further, Elari processes data based on legitimate interest if you are signing up for a webinar, downloading reports or other content from our web pages, and using our Elari communities. The legitimate interest is to provide you with correct content, hold webinars, do marketing and administrate your requests. Read more about how Elari processes your personal data for marketing purposes based on legitimate interest, and your rights when we process your personal data for such purposes, under the section called “Marketing and profiling” in this privacy statement.

How is your personal data shared?

Within the Visma Group

As the Visma Group consists of many different subsidiaries, it is important for us that we provide the best possible overall experience for you. In order to maintain an overview and insight, Elari may share your personal data across companies in the Visma Group.

Outside of the Visma Group

Elari may also share your personal data with external third parties in the following contexts:

Elari user communities
If you make a post, comment or similar on Elari user communities or other forums on Elari Sites, such information can be read and used by anyone with access to such forums. Elari is not responsible for any information you submit on such forums or Elari Sites.

Business partners
Elari may share your personal information with our partners in the event this is legitimate from a business perspective and according to applicable privacy legislation.

Public authorities
The police and other authorities may request access to our information. This may include both personal and non-personal data. In such cases, we follow internal policies and procedures to assess the access request and consult with legal counsel. We only share information that is strictly required by law, and only based on valid court orders or similar legal documents from government agencies. To prevent unauthorised access to the information we process, we also implement technical measures such as encryption and access controls. The Visma Security Program ensures high security standards and confidentiality. Furthermore, we ensure legal obligations in contracts with our subcontractors that they also implement organisational and security measures similar to ours. If we receive access requests from authorities outside the EEA, we ensure compliance with Article 32 of the GDPR. Our internal policies and procedures are compliant with this regulation.

When do we use processors?

Elari uses processors to process personal data. These processors are typically vendors of cloud services or other IT hosting services.

When using processors, Elari will enter into a data processing agreement in order to safeguard your privacy rights. If processors are located outside the EU/EEA, Elari ensures legal grounds for such international transfers on your behalf, including by using the EU Model Clauses.

For information on sub-processors used to provide you an Elari service, please visit our Visma Trust Centre.

You are always welcome to request an overview and more detailed information on Elari’s processors. For how to contact Elari, please see the last section of this statement.

How long is your data stored?

Elari will only store your personal information as long as required to perform our contractual obligations. When processing your personal data on another legal basis, such as legitimate interest, data is stored as long as necessary to fulfil the purpose of processing. Hence, your personal data may be subject to different retention policies based on the type of data and the purpose of collecting it. One example regarding recruitment:

When recruiting, Elari will delete your personal information such as CV, application and other documents when the recruitment process is closed, typically a maximum of 6 months after the application deadline, unless otherwise agreed upon with you.

For further information regarding deletion, feel free to contact Elari (see contact information in the last section of this statement).

What are your rights?

You can invoke the following rights in relation to our processing of your personal data:

• Access. You have the right to request a copy of personal data we process about you.
• Rectification. You also have the right to request Elari to rectify inaccurate personal data concerning you. If you have an account with Elari for an Elari Site, this can usually be done through the appropriate "your account" or "your profile" sections on the applicable Elari Site or service.
• Deletion. You can request Elari to delete personal data relating to you.
• Restriction. You may ask us to restrict the processing of your personal data.
• Portability. You may ask us to provide you or others with your personal data in a structured, commonly used and machine-readable format.
• Object. On grounds relating to your particular situation, you have the right to object to our processing of your personal data on the basis of legitimate interests or for direct marketing purposes. You also have the right to object to our processing of your personal data for the performance of tasks carried out in the public interest or in the exercise of official authority or based on legitimate interests.

Please note that there may be certain exceptions or limitations to the abovementioned rights which could apply depending on the specific circumstances of your situation. In such cases, we will provide you with detailed information about the applicable exception or limitation and help you exercise your rights to the fullest extent possible, in accordance with applicable laws and regulations.

Please use privacy@elari.nl to file requests as mentioned in this section.

Finally, you also have a right to file a complaint to the data protection authorities with regard to our processing of your personal data.

Marketing and profiling

The legitimate interest

When you interact with Elari, e.g. by visiting Elari web pages, downloading content, attending webinars, and as part of using Elari’s services, Elari will be processing your personal data based on legitimate interest. One of Elari’s legitimate interests is the processing of personal data for direct marketing purposes.

Elari uses your personal data to provide relevant content to you through direct marketing on social media platforms and emails, web pages or in an Elari service, based on your preferences. The personal data processed are aggregated details about you such as IP address, interests (where you have clicked, etc.), username and device. This is done through technologies like cookies and is called profiling. Elari will also be able to combine this information with information about the customer relationship we may have with your company.

The purpose of the profiling is to provide you with tailored marketing, improve your user experience with our services/websites and deliver products our customers are satisfied with. Elari’s services are generally used as tools for work-related purposes, and your behaviour in these tools says little about your personal life. No sensitive data is processed. Your personal data is therefore processed from a business perspective in a manner that we believe does not conflict with your freedoms and rights as an individual.

Elari uses email as a tool to communicate marketing, however only if you have consented in accordance with national marketing legislation (if needed). If you have consented, you will always have the possibility to opt out as described below, or when you receive an email containing marketing.

Right to opt out of marketing communications

You have the right to opt out of receiving marketing communications from Elari and being subject to profiling. You can do this by either:

• Following the instructions for opt-out in the relevant marketing communication
• Changing preferences under the relevant edit account section if you have an account with Elari
• Contacting us via email at privacy@elari.nl

You will also always have the option to opt into/out of cookies on a particular web page, through our cookie banner.

Please note that even if you opt out from receiving marketing communications, you may still receive administrative communications from Elari, such as order confirmations and notifications necessary to manage your account or the services provided to Customers.

Changes

We encourage you to review the Statement regularly. If we make significant changes to our Statement that materially alter our privacy practices, we may also notify you by other means, such as sending an email or posting a notice on our corporate website and/or social media pages prior to the changes taking effect.

The Privacy Statement is revised at least yearly and changes are approved by the Elari Data Protection Council. Last updated: 2024-03-27.

How to contact us

Elari
Richard Holkade 9
2033 PZ Haarlem
Phone: (+31) 23 54 22 299

We value your opinion. If you have any comments or questions about our Privacy Statement, or any privacy concerns, including regarding a possible breach of your privacy, please send them to privacy@elari.nl.

We will handle your requests or complaints confidentially. Our representative will contact you to address your concerns and outline the options regarding how these may be resolved. We aim to ensure that complaints are resolved in a timely and appropriate manner.