You are about to participate in the SUSE Loyalty Program available through https://susecollective.suse.com (“SC”). In order to facilitate your participation and to administer SC , SUSE Software Solutions Germany GmbH and its corporate affiliates (“SUSE Group”) must process certain personal data which you provide (“Personal Data”).
The controller of the processing for the purposes of Article 4(7) GDPR is SUSE Software Solutions Germany GmbH, Maxfeldstraße 5, 90409 Nuremberg, Germany. SUSE’s Data Protection Officer is Mr. Andrew Colyer. The SUSE Group privacy policy is available at https://www.suse.com/company/legal/#privacy-policy.
We need to process your Personal Data to provision and administer SC, to audit/monitor your use of the services to ensure fairness of usage with other users, to allow you to request and be provided with support (if applicable) and to allow you to collaborate within SC. Additionally, if you choose to redeem any points that you earn in SC, in order to ship your chosen item to you, we may need to process your address and any other data needed to ensure we can deliver to you. Finally, we may use your personal data to contact you either directly or through one of our partners, regarding our products and services.
We expect to process Personal Data such as your chosen username, your email, your location (including your address in order to deliver any redeemed items) as well as any information you share with us through the chat/free-text functions. However, please be aware that Personal Data entered in comments, free text fields etc cannot be effectively anonymised or deleted. We ask you to never include sensitive categories of Personal Data (see Art 9 GDPR) when you use SC.
We are processing your Personal Data according to Art 6 1(a) GDPR, under which we require your fully informed consent. This notice provides the necessary information about the processing of your Personal Data. In some cases we process your Personal Data according to Art 6 1(f) GDPR. For example, if you are a SUSE customer or partner, we consider it to be within our legitimate interest to ensure you receive up to date information about our company as well as our products and services. We ensure that we balance this interest against your personal rights by limiting the personal data that we process under Art 6 1(f) to the minimum necessary and by ensuring that adequate data processing agreements are in place with any vendors that we use to process your data.
Some Personal Data (e.g. server and application logfiles retained for security purposes) will be processed by the SC platform vendor, Influitive, Inc. The Influitive privacy policy is available at https://influitive.com/privacy-policy/. A data processing agreement is in place between SUSE and Influitive, Inc which incorporates the standard contractual clauses as well as additional guarantees pursuant to CJEU 311/18. Further, transfer of your Personal Data to SUSE Group entities outside the EEA is covered by a multi-entity data processing agreement which incorporates the Standard Contractual Clauses (“model clauses”).
We will permanently and irrevocably delete your Personal Data six (6) months after the date on which your participation in the SC is terminated or on request.
pursuant to Article 7 (3) GDPR, to revoke your consent to us at any time, for Personal Data shared externally. Thereafter, we will not be allowed to continue the data processing based on your revoked consent for the future.
pursuant to Article 15 GDPR, to request information about your Personal Data processed by us. In particular, you may request information about the processing purposes, the categories of Personal Data, the categories of recipients to whom your data has been disclosed, the planned retention period, the right of rectification, deletion, limitation of processing or opposition, the existence of a right to complain, the source of their data, if not collected from us, and the existence of automated decision-making, including profiling, and – if necessary - meaningful information about their details.
pursuant to Article 16 GDPR, to immediately demand the correction of incorrect or completed Personal Data stored by us.
pursuant to Article 17 GDPR, to demand the deletion of your Personal Data stored by us, except where the processing is necessary for the exercise of the right to freedom of expression and information, for the fulfilment of a legal obligation, for reasons of public interest or for the assertion, exercise or defence of legal claims.
pursuant to Article 18 GDPR, to demand the restriction of the processing of your Personal Data, insofar as the accuracy of such Personal Data is disputed by you; or the processing is unlawful, you reject the deletion of such unlawfully processed Personal Data and we no longer need the Personal Data, but where you assert, exercise or defence of legal claims or you have objected to the processing in accordance with Article 21 GDPR.
pursuant to Article 20 GDPR, to receive the Personal Data that you have provided to us in a structured, standard and machine-readable format or to request the transfer to another controller.
pursuant to Article 77 GDPR, to complain to a supervisory authority. For example, you can contact the supervisory authority of your location or workplace or our corporate office. To exercise any of the rights listed above, please contact privacy@suse.com. For Personal Data shared externally, you can revoke your consent at any time, effective for the future by sending email to privacy@suse.com. This will not affect the legitimacy of processing under the consent up to the time of revocation.
You have the right at any time, for reasons arising out of your particular situation, to object to the processing of your Personal Data pursuant to Article 6 (1)(e) GDPR (Data Processing in the Public Interest) and Article 6 (1)(f) GDPR (Data processing on the basis of a balance of interests). This also applies to profiling based on this provision within the meaning of Article 4 (4) GDPR. Should you object, we will not further process your Personal Data unless we can demonstrate compelling legitimate grounds for processing that outweigh your interests, rights and freedoms, or the processing is for the purpose of enforcing, pursuing or defending legal claims. Your objection should be directed to privacy@suse.com.