In this article 3 we have set out:

• the general categories of Personal Data that we may process relating to your capacity;
• the purposes for which we may process Personal Data;
• and the legal grounds of the processing.

‍

A. Legal obligation

‍Client data
To comply with the obligations imposed on the Data Controller in the context of legal and administrative requirements and to meet the provisions of the Civil Code and accounting legislation, we collect and process certain data such as identity and contact data, as well as financial data of our clients, their personnel and associates as part of our services.

Supplier and subcontractor data
To comply with the obligations imposed on the Data Controller in the context of legal and administrative requirements and to meet the provisions of the Civil Code and accounting legislation, we collect and process identity and contact data, as well as financial data of our suppliers and subcontractors, their subcontractors, personnel and associates as part of our services.

Personnel data
To comply with the obligations imposed on the Data Controller in the context of legal and administrative requirements and to meet the provisions of the Civil Code and accounting legislation, we process identity and contact details, as well as financial data of our employees, as part of our personnel management, our personnel and staffing services and our salary administration services.
‍

B. Necessary for the Performance of the Contract

Client data
As part of our services, we collect and process the identity and contact details of our clients and their personnel, which are necessary for the performance of the contract, the provision of our services, client management, and accounting, as well as during the pre-contractual phase, such as contacting, negotiating, providing/requesting information in connection with drafting and concluding an agreement.

Supplier and subcontractor data
We collect and process the identity and contact details of our suppliers and subcontractors, as well as their (sub)contractors and their personnel, for purposes such as the performance of the contract, supplier/subcontractor management, and accounting, as well as during the pre-contractual phase, such as contacting, negotiating, providing/requesting information in connection with drafting and concluding an agreement.

Personnel data
We process the Personal Data of our employees that is necessary for the performance of the contract in the context of our personnel management and payroll administration, such as identity and contact details and financial information.

‍
Applicants data
We process the identity and contact data, as well as the work history and other data that is usually indicated on a curriculum vitae of applicants (e.g. a photo) when they provide us with this information. The Personal Data is processed to determine whether you qualify for a job with us on the ground of our legitimate interest and the necessity to perform a contract.

‍

C. Legitimate Interest

Client data
As part of our services, we collect and process the identity and contact details of our clients and their personnel based on our legitimate interest for purposes of direct marketing activities, such as sending promotional or commercial information.

Supplier and subcontractor data
We collect and process the identity and contact details of our suppliers and subcontractors, as well as their (sub)contractors and their personnel, based on our legitimate interest to ensure the proper functioning of our operations.

Personnel data
We process the Personal Data of our employees in the context of our personnel management, background check and payroll administration based on our legitimate interest.

Regarding the processing of Personal Data for a background check of an employee, we have a legitimate interest in monitoring our employees to meet the quality criteria set by the ISO for achieving certification. Additionally, we have a legitimate interest in mitigating/avoiding the security risks associated with the energy industry in which the employee will operate.

In this case we may process:

• the identity of the employee;
• the excerpt from the employee's criminal record
• if the employee has completed labor relations with other employers:
  • the previously involved functions of work;
  • in what manner this work was performed;
  • in what manner the previous labor relations were terminated;
• whether the employee actually has the required qualifications (by verifying endorsements);
• whether the employee actually has the submitted diplomas presented (no forgery);
• whether the employee has a work permit for the country of employment;

However, during and after the Investigation, we will process the Personal Data only to the extent that is strictly necessary and proportionate to the company’s needs regarding the labor relation.

‍

D. Consent

‍Client data
As part of our services, we collect and process the identity and contact details of our clients and their personnel based on your consent for the use of cookies, the use of photos on our Website and social media pages, the use of testimonials on our Website, and direct marketing activities such as sending promotional or commercial information.

‍Personnel data
We process the Personal Data of our employees, such as photos used for commercial purposes or posted on our Website, based on their consent.‍

Applicant data
If we wish to retain the Personal Data of applicants for longer than two months after the selection process is completed, we will ask for your consent. From this point, we will process this Personal Data based on your consent.

‍
‍Other data
In addition to the data of clients, suppliers/subcontractors, employees and applicants, we also process Personal Data of others, such as possible new clients/prospects, useful contacts within our sector, network contacts, etc. This is done via our Website or other channels. The purposes of this processing are in the interest of our activities, direct marketing and public relations. The legal grounds for this processing are our legitimate interest, the execution of an agreement and, in some cases, your explicit consent.

Specifically, we may use the Personal Data we collect for the following purposes:

• to provide you with information about our products and services;
• to provide you with our services and execute any agreements with you;
• to process and respond to any complaints or requests;  
• to help us in evaluating, correcting and improving the Website and any related products or services of us;
• for direct marketing purposes;
• for internal reasons, such as corporate administration and archiving purposes.
  

‍

Collecting Personal Data

Without being exhaustive, Gorilla collects your Personal Data in the following cases:

• when you submit Personal Data via the Website through the contact form provided;
• when you request a demo via the Website through the contact form provided;
• when you subscribe to our newsletter;
• when you enter into an agreement with us;
• when you apply for a position at Gorilla;
• when you call, mail us or correspond with us in another way than via the Website.

We can combine the Personal Data we collect via the Website with information which you provide us in another way or which third parties deliver to us.

We avoid collecting Personal Data that is not relevant to the purposes outlined in Article 3.

Retaining and deleting Personal Data

Personal Data will be stored and processed by us for the duration that is required in relation to the purposes of the processing.

Client data and supplier or subcontractor data will be removed from our systems after 7 years after the termination of the agreement involved, except for the Personal Data that we have to store for a longer duration based on specific legal obligations or in case of pending litigation(s).

Personal Data of our employees will be removed 5 years after the termination of the employment agreement, except for the Personal Data that we have to store for a longer duration based on specific legal obligations or in case of pending litigation(s).

Personal Data of applicants will be removed after the relevant vacancy has been filled, and no later than 1 (one) month after the end of the application process, or after a period of 1 (one) year from when consent was obtained to inform applicants about future job opportunities.

Other data will not be stored longer than 2 years after the last useful contact between us and you, except in the case of your explicit to retain this data for a longer period of time.