DE Third Party Privacy Notice

This English version is provided for convenience. The German version is legally binding.

This privacy notice explains how Glen Dimplex B.V. collects, uses, stores and shares personal data of people who interact with Glen Dimplex B.V. in a professional or business capacity. This includes representatives of service providers, contractors, suppliers, partners, distributors, professional advisers and visitors to our premises (referred to in this notice as "you").

This notice does NOT apply to employees of Glen Dimplex B.V., job applicants or consumers who buy products; separate privacy notices apply to them.

Who is responsible for your personal data?

Glen Dimplex B.V. Saturnus 8, NL-8448 Heerenveen

What personal data do we collect and why?

Data is processed only for the purposes stated, only to the extent necessary, and in line with applicable data protection laws. Where we rely on legitimate interests, we do so only where the interests or fundamental rights of the person concerned do not override them.

Purposes and legal bases (summary):

1) Organising/managing the procurement and contractor selection process (RFP/RFI)
Legal basis: performance of a contract; legitimate interest in selecting suppliers.

2) Background checks (is working with the person/company permitted?)
Legal basis: outside the listed countries legal obligation/legitimate interest; China: consent.

3) Managing the business relationship
Legal basis: performance of a contract/legitimate interest; China: consent.

4) Payment for products/services
Legal basis: performance of a contract.

5) Access to information systems, internal platforms, applications, loan equipment
Legal basis: performance of a contract.

6) Secure access to premises, events, cooking activities
Legal basis: performance of a contract.

7) Prevention, detection and investigation measures (physical security, cyber security)
Legal basis: legitimate interest (protection against fraud/threats).

8) Monitoring compliance with laws/policies
Legal basis: legitimate interest.

9) Business analysis and financial reporting
Legal basis: outside the listed countries performance of a contract/legitimate interest; China: consent.

10) Protecting intellectual property rights, legal disputes
Legal basis: legitimate interest; legal obligation where applicable.

11) Archiving/retention to meet legal obligations
Legal basis: legal obligation; legitimate interest.

12) Financial and accounting obligations (sharing with auditors, law firms etc.)
Legal basis: legal obligation; legitimate interest.

13) Sale/restructuring of parts of the business/assets
Legal basis: legitimate interest.

14) Processing procurement and invoice documents with AI-assisted tools (before entry into financial management systems)
Legal basis: performance of a contract; legitimate interest in efficient/accurate financial administration.

15) Managing the relationship via AI-assisted business platforms (CRM, call recording/transcription)
Legal basis: performance of a contract; legitimate interest in managing relationships effectively.

Categories of data collected:

contact details (name, home/business address, phone numbers, email addresses)
identity documents, signature, title, position, role, company information, photo, professional experience, educational background
attendance data, and video recordings when entering premises where applicable
email correspondence
electronic identification data (login, password, IP address, other online identifiers)
contract, invoice and bank account information
procurement and financial documents (orders, invoices, supplier reference data)
data from interactions with AI-assisted business platforms (communication history, relationship management data)
results of background checks where applicable (including past criminal proceedings/convictions, only where permitted by national law)

When and how might we collect your personal data?

Data is processed only to the extent strictly necessary for the purposes; if it is not provided, we may not be able to meet contractual or legal obligations.

Data is collected, among other things, when:

you visit our sites (visitor registration, online NDA process, video surveillance)
you are engaged directly to provide products/services or take part in a procurement process
you communicate by email, Microsoft Teams or other electronic means
you take part in online meetings (recording/transcript only with consent at the start of the call)
you submit invoices/orders/procurement documents (possibly with AI-assisted document processing before entry into financial management systems)
you interact with AI-assisted business platforms
we consult public registers as part of procurement/anti-corruption checks (checking for criminal proceedings/convictions)

How long do we keep your personal data?

As a rule only as long as necessary for the purposes, in line with our retention policy; periods vary by type of business relationship and data. General guidelines:

contract and financial records: duration of the business relationship plus the period required by legal/tax/accounting rules
correspondence/communication data: duration of the business relationship plus a reasonable period afterwards
background checks: only until the relevant procurement/onboarding process is complete
AI-processed data (invoice processing, interaction logs): according to the purpose of collection, then deleted/anonymised

Longer retention is possible where required by law or necessary to establish or defend legal claims.

How do we protect your personal data?

Technical and organisational measures: access controls and authentication, encryption in transit and at rest, regular security monitoring/testing, controls on third-party data processing.

Anyone accessing our premises/systems/platforms must comply with the Glen Dimplex B.V. cyber security policies. If you suspect a threat or compromise, contact us immediately.

International transfers of personal data

We operate worldwide; data may be transferred to other Glen Dimplex B.V. companies or approved third-party providers worldwide, always for the stated purposes and with appropriate safeguards.

Intra-group transfers are covered by an internal data sharing agreement.

For transfers outside your country of residence, depending on the jurisdiction, these include:

standard contractual clauses approved by the European Commission (EEA transfers)
International Data Transfer Agreement / UK Addendum
other mechanisms recognised under local law

AI-assisted platforms may process data in several jurisdictions; contractual safeguards and transfer mechanisms apply here too.

Who might we share your personal data with?

Glen Dimplex B.V. and affiliated companies
delivery services, fulfilment companies, transaction partners
IT service providers, auditors, lawyers, other professional advisers
providers of AI-assisted document processing, CRM and business platforms
data analytics providers (anonymised data only)
law enforcement, regulators, government bodies, courts, lawyers (where legally required or to protect our rights)
parties involved in a sale/restructuring of parts of the business (for example potential buyers and their advisers)

All recipients are contractually bound to process data only for the stated purpose and on instruction. Third-party providers are contractually prohibited from using data to train or develop their own or third-party AI models.

Do we sell your personal data?

No sale to third parties. Data is shared only with carefully selected, contractually bound service providers to fulfil the purposes.

Where sharing could count as a "sale" under Californian or other law: you can object by contacting us by email.

Your data protection rights

Depending on the applicable jurisdiction: the right of access, rectification, erasure, restriction of processing, objection, data portability; and where applicable rights relating to automated processing/profiling.

Where processing is based on legitimate interests: you have the right to object, and processing will stop unless there are compelling overriding grounds or it is needed to defend legal claims.

Right to lodge a complaint

You have the right to complain to the competent data protection supervisory authority/regulator in your jurisdiction. Contact details of the local authority are on its website. For information on Glen Dimplex B.V.'s regulatory registrations: contact us by email or via the data subject rights request form

Contact

Ways to contact us: email & post

Postal addresses:

Glen Dimplex B.V. Saturnus 8, NL-8448 Heerenveen

Changes to this privacy notice

Reviewed and updated regularly when processing activities, legislation or business operations change. For material changes: notice on the website or direct contact (where we hold contact details).

Last reviewed and updated October 2026.