At InnoVites B.V, we’re committed to being transparent about how we handle your personal information, to protecting the privacy and security of your personal information and meeting our obligations as a ‘Data Controller’ under the General Data Protection Regulation (“GDPR”) and the Data Protection Act 2018.

The purpose of this privacy notice is to make you aware of how and why we will collect and use your personal information. We are required under the GDPR to notify you of the information contained in this privacy notice.

The Company has appointed a Data Compliance Officer to over see compliance with this privacy notice. If you have any questions about this privacy notice or about how we handle your personal information, please send an email to gdpr@innovites.com or by writing to:

Data Compliance Officer
InnoVites B.V
Galileilaan 23f, 6716 BP Ede
The Netherlands

Data Protection Principles

Under the GDPR, there are six data protection principles that the Company must comply with. These provide that the personal information we hold about you must be:

1. Processed law fully, fairly and in a transparent manner.
2. Collected only for legitimate purposes that have been clearly explained to you and not further processed in a way that is incompatible with those purposes.
3. Adequate, relevant and limited to what is necessary in relation to those purposes.
4. Accurate and, where necessary, kept up to date.
5. Kept in a form which permits your identification for no longer than is necessary for those purposes.
6. Processed in a way that ensures appropriate security of the data.

The Company is responsible for, and must be able to demonstrate compliance with, these principles. This is called accountability.

Legal Bases for Processing

The GDPR requires that each processing activity is based on a lawful basis. To enhance clarity and compliance, we explicitly state the legal bases for each processing activity in the table below, such as consent for marketing communications or legitimate interest for CRM usage. The following table outlines the legal basis for InnoVites’ data processing activities:

Cookie Consent Mechanism

InnoVites uses cookies on our website to provide a tailored browsing experience. Non-essential cookies (e.g., for analytics) will only be placed after obtaining your explicit consent via our cookie consent banner. You can modify your preferences or withdraw consent at any time via our cookie settings panel.

Learn more about cookies used on our website in our Cookie Policy and access the settings here.

What types of personal information do we collect about you?

Innovites will collect personal information, which is information about an individual from which that person can be directly or indirectly identified, to enable and support business activities or discussions. This is different InnoVites Privacy Policy from anonymised data, i.e. where all identifying particulars have been removed.

There are also “special categories” of personal information, and personal information on criminal convictions and offences, which requires a higher level of protection. Innovites will never request or collect sensitive personal information of this type.

The personal data we collect includes:

• Name & Job Title
• Contact information including official email address
• Demographic information such as postcode, preferences and technical interests
• Other information relevant to customer surveys and/or offers

How do we collect your personal information?

The Company collects personal information about you in order to support business activities or discussions between yourself and Innovites. This could be through our website, face-face meetings, phone calls, emails, conference calls, industry events, direct contact etc.

Innovites use Cookies on our website (www.innovites.com ). A cookie is a small file which asks permission to be placed on your computer’s hard drive. Once you agree, the file is added and the cookie helps analyse web traffic or lets you know when you visit a particular site. Cookies allow web applications to respond to you as an individual.

We use traffic log cookies to identify which pages are being used. This helps us analyse data about webpage traffic and improve our website in order to tailor it to customer needs. We only use this information for statistical analysis purposes.

Overall, cookies help us provide you with a better website by enabling us to monitor which pages you find useful and which you do not. A cookie in no InnoVites Privacy Policy way gives us access to your computer or any information about you, other than the data you choose to share with us.

You can choose to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer. This may prevent you from taking full advantage of the website.

Why and how do we use your personal information?

Here at Innovites we take your privacy seriously. We will use your personal information to administer your account and to provide the information, products or services you have requested from us.

We may also send you direct marketing in relation to relevant products and services. Electronic direct marketing will only be sent where you have given your consent to receive it, or (where this is allowed) you have been given an opportunity to opt-out. You will continue to be able to opt-out of electronic direct marketing at any time by following the instructions in the relevant communication.

It is Innovites’s policy to only send marketing communications to corporate email addresses and not to individual personal email addresses.

Who has access to your personal information?

Your personal information will be stored on our CRM system, with access restricted to those members of Innovites staff with a legitimate reason to use the system – primarily the sales and marketing personnel.

We will only use your personal information for the purposes for which we collected it.

Who will it be shared with?

InnoVites ensures that all third parties processing your data, including HubSpot and marketing agencies, comply with GDPR. These third parties are bound by Data Processing Agreements (DPAs) and are required to:

• Process your data only as instructed by InnoVites.
• Implement appropriate technical and organizational measures to ensure data security.
• Comply with all relevant data protection laws.

For international transfers (e.g., to HubSpot’s systems in the U.S.), we ensure these transfers are governed by Data Processing Agreements (DPAs) and implement Standard Contractual Clauses (SCCs) approved by the European Commission to safeguard your personal data. You can request a copy of these clauses from our Data Compliance Officer.

Retention Policy Details

The retention periods are as follows:

All data retention periods are reviewed annually to ensure compliance with the principles of data minimization and storage limitation.

Personal information collected as part of our business activities can also be removed at the request of the person to have their data. This could by emailing the Data Compliance Officer at Innovites (gdpr@innovites.com) or responding to a marketing communication by asking to ‘unsubscribe’. It is also possible to modify the preferences by which marketing communications are sent out.

How does the Company protect your personal information?

The Company has put in place measures to protect the security of your personal information. It has internal policies, procedures and controls in place to try and prevent your personal information from being accidentally lost or destroyed, altered, disclosed or used or accessed in an unauthorised way. In addition, we limit access to your personal information to those employees, workers, agents, contractors and other third parties who have a business need to know in order to perform their job duties and responsibilities. You can obtain further information about these measures from our Data Compliance Officer.

Where your personal information is shared with third parties, we require all third parties to take appropriate technical and organisational security measures to protect your personal information and to treat it subject to a duty of confidentiality and in accordance with data protection law. We only allow them to process your personal information for specified purposes and in accordance with our written instructions and we do not allow them to use your personal information for their own purposes.

The Company also has in place procedures to deal with a suspected data security breach and we will notify the Information Commissioner’s Office (or any other applicable supervisory authority or regulator) and you of a suspected breach where we are legally required to do so.

Transfers to Third Countries

InnoVites transfers personal data to its subsidiary in India, where appropriate safeguards are in place. These include:

• Restricted access to named individuals with clearly defined roles.
• Data processing solely through the same secure HubSpot CRM platform used in the EEA, ensuring technical parity.
• Standard Contractual Clauses (SCCs) approved by the European Commission, providing legally binding obligations on both parties to ensure GDPR compliance.
• Regular audits and monitoring to ensure adherence to security protocols and data protection standards.

These safeguards are designed to ensure that your data remains protected to GDPR standards, even outside the EEA, mitigating risks associated with international data transfers.

Your rights in connection with your personal information

As a data subject, you have a number of statutory rights. Subject to certain conditions, and in certain circumstances, you have the right to:

• request access to your personal information
• request rectification of your personal information.
• request the erasure of your personal information
• restrict the processing of your personal information
• object to the processing of your personal data
• portability – this gives you the right to request the transfer of your personal information to another party so that you can reuse it across different services for your own purposes.

If you wish to exercise any of these rights, please contact our Data Compliance Officer.

We may need to request specific information from you in order to verify your identity and check your right to access the personal information or to exercise any of your other rights. This is a security measure to ensure that your personal information is not disclosed to any person who has no right to receive it.

If you believe that the Company has not complied with your data protection rights, you have the right to make a complaint to the Dutch Data Protection Authority (DPA) at any time. The DPA is the Netherlands supervisory authority for data protection issues.

Changes to this privacy notice

The Company reserves the right to update or amend this privacy notice at any time. We will issue a new privacy notice when we make significant updates or amendments. We may also notify you about the processing of your personal information in other ways.

Contact

If you have any questions about this privacy notice or how we handle your personal information, please contact our Data Compliance Officer at gdpr@innovites.com or write to Data Compliance Officer,

InnoVites B.V,
Galileilaan 23f, 6716 BP Ede,
The Netherlands