Introduction

While visiting our website https://koreafloatingwind.kr (‘the Website’), you may provide us with personal data, such as connection data (IP address, event logs) but also contacts, names, location data, addresses, commercial or professional information, and others. We will process such information in a lawful, fair, and transparent manner.

In accordance with Article 13 of the Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (‘GDPR’), we are required to inform users on how we process the personal data that we collect through their use of the Website, or otherwise when they interact with us, including any data they may provide when they contact us via our online form or through any other communication channel available.

Data Controller and contact details

• Data controller: Korea Floating Wind
• Contact details of the Manager: procurement@koreafloatingwind.kr

If, at any time, you have any questions concerning our Privacy Notice or our Data Protection Policy, or you want to exercise your data rights, please feel free to contact us at one of the addresses above.

Types of data processed

Personal data processed include identification data (such as name and surname), contact details (e-mail and telephone number), country of residence, information on professional activity (such as business contacts, company name, profession) and any other information you decide to provide when you contact us through the Website or by email or other channel.

Purpose of processing

Personal data may be processed to manage and answer your queries, doubts, or requests, or to send, including through electronic means, communications and information about the services we provide and the activity we conduct, when you agree so, or for the purposes of maintaining commercial relations, including management of pre-contractual and contractual relations, as well as resolution of complaints addressed to KFW.

Your personal data will not be processed further in any way that is incompatible with the purposes described above or with the law. The processing does not involve automated decision-making.

Please note that while provision of your data is not a requirement necessary to enter into a contract and you are not obliged to provide any of the personal data this notice refers to, in case of failure to provide your data, we may not be able to get in touch with you.

Legal basis for processing

Personal data are processed on the basis of:

• Your consent, expressed through the submission of the request for information, through the means of contact available on the Website, after having read and accepted this Privacy Notice. You may withdraw your consent at any time, without prejudice to the lawfulness of the processing carried out up to the moment of withdrawal. However, as a result, your request for information may not be addressed.
• The execution of contractual relationships.
• The legitimate interest of KFW in maintaining professional contact and commercial relations with third parties such as suppliers. You may object at any time to the processing of your data for this purpose, as explained in the section on the exercise of rights.
• Compliance with applicable law.

Retention period

We store your information for as long as its processing is necessary for the purpose for which it was collected for.

This means that data collected for professional contact and commercial relation purposes will be kept for as long as the relationship with the data subject subsists and, once ended – or when you request to erase your data before date, during the limitation periods of the obligations arisen from the data processing. Regarding users subscribed to our commercial communications, we will process their data until they decide to unsubscribe or cancel their subscription.

Your information that is no longer needed is either irreversibly anonymized or destroyed securely.

Security and confidentiality

To guarantee personal data’s security and integrity, and protect personal information against unauthorized access or disclosure, accidental loss, use, alteration or destruction, we maintain rigorous physical, electronic and procedural safeguards and have adopted all the technical and organisational measures necessary, in compliance with the law.

We restrict access to your information to only those persons who need to use it for the relevant purpose and all our staff, regardless the stage of processing they are involved in, undertake to process your information with the utmost care, secrecy, and confidentiality and in accordance with the law.

Data recipients

We will not communicate your data to third parties unless strictly necessary, if needed to comply with a legal obligation and/or with your prior authorization.

We may disclose your data with competent authorities who have a right of access recognised by law, if legally required to do so, or if requested by a governmental entity or regulatory authority or when we believe in good faith that such action is necessary to comply with legal requirements or processes, prevent a crime or protect national security.

Information may be also given to third-party contractors or other persons or entities that we engage when outsourcing certain functions. Personal data will be shared with such third-party contractors, persons, or entities only to the extent reasonably necessary for them to perform services on our behalf and not for any other purpose and pursuant to reasonable confidentiality obligations.

When we rely on the cooperation of third-party service providers who may have access to your personal data and who will process the data on our behalf as part of their provision of services, we adhere to strict criteria for their selection and undertake to enter into corresponding data processing agreements with them, in compliance with applicable law, ensuring they implement appropriate technical and organisational measures to guarantee data security, and they process the personal data for the agreed purposes and only in accordance with our instructions.

Finally, we reserve the right to transfer any information that we collect about you through your use of the Website to any acquirers of KFW’s business or in the event that we sell or otherwise transfer some or all of our assets, and to entities resulting from merger processes or any other type of transformation affecting our company.

International data transfers

Being a company with international presence, we may transfer your personal data to the companies in our Group, in accordance with our legitimate interests and for internal administrative purposes. Such companies can be based in or outside the European Union (EU).

In case of transfer of personal data outside the EU and the European Economic Area (EEA), we will make sure that appropriate and adequate safeguards to protect your information are implemented, ensuring an adequate level of security.

This entails that transfers are only made:

• to countries that the European Commission has formally recognised as offering an adequate level of protection of personal data, or
• to receiving countries not considered as having sufficient guarantees in place in terms of data privacy, only upon establishing appropriate safeguards, as required by the law, by means of Standard Contractual Clauses or Binding Corporate Rules, as well as putting in place additional guarantees, as necessary, for the best protection of your personal data.

Other Websites

This Website may contain links to third-party websites over which we have no control. KFW is not responsible for the privacy policies or practices of such other websites and we encourage you to review the privacy policies, if any, on such web pages.

Your rights in relation to data processing

In accordance with applicable regulations, you are entitled to all rights recognised to data subjects regarding personal data and you may exercise them by contacting our Manager at procurement@koreafloatingwind.kr. Among others, you may:

• Access your personal data and obtain confirmation as to whether your personal data is being processed and information on how it is processed (including the purposes of the processing, recipients to whom it has been or will be disclosed, the source of information from where we obtained it, the retention period applied, any right that you may have concerning the processing, where personal data are transferred, the appropriate safeguards implemented, etc.) and request copies of such data.
• Rectify inaccurate or incomplete data.
• Object to the processing of your data, where you believe that it is non-compliant with applicable personal data protection legislation and where the processing is based on legitimate interest.
• Withdraw your consent at any time.
• Request the erasure of all or any of your data when they are no longer needed for the purposes they were collected for when (i) processing was based on your consent and you have withdrawn your consent and there is no other legal ground for the processing, (ii) processing was based on legitimate interest but you have objected to the processing and there are no overriding legitimate grounds for the processing, (iii) you believe that the personal data have been unlawfully processed, or (iv) the data have to be erased for compliance with a legal obligation. Where applicable, in such cases data shall be anonymised or blocked in accordance with applicable law.
• Restrict the processing of your data when you contest its accuracy (during the period necessary for KFW to verify its accuracy), when (i) the processing is unlawful and you oppose the erasure of the data and requests the restriction of its use instead, (ii) we no longer need the personal data for the purposes we collected it for but they are required by you for the establishment, exercise and defence of legal claims, or (iii) you have objected to the processing (until it is verified whether our legitimate interests in the processing overrides those of the data subject).
• Request the portability of the data (i.e., receive your personal data) that you provided based on consent or on a contract, either for yourself or for transfer to another Data Controller. In the latter case you may transmit such data yourself or have it transmitted directly from us, where technically feasible.

In addition, as a data subject, should you consider that our processing of your personal data infringes the applicable data protection regulations, you have the right to lodge a complaint with the competent supervisory authority, in the country of your habitual residence, place of work or place of the alleged infringement.