Privacy policy

This Addendum applies to the European Economic Area (“EEA”) and Swiss residents.

I. Who are Rebura’s Supervisory Authorities and EU Representative for Data Protection Purposes?

Rebura is not established in the EEA or Switzerland. Therefore, the supervisory authority for Rebura in the EEA is located in the EEA country in which you reside or where your Personal Data is processed under this Addendum as defined in Section III(L) below (the, “EEA SAs”). If you live in Switzerland, Rebura’s supervisory authority is the Federal Data Protection and Information Commissioner (“FDPIC”). Collectively for this Addendum, the EEA SAs and the FDPIC are the “SAs”). Rebura has appointed its Dutch affiliate, Frank Recruitment Group B.V., as its European Union Representative (“EU Rep.”).

II. How do we lawfully process your data?

In order to process your Personal Data lawfully Rebura must have a legal basis to do so.  Rebura relies on three main legal bases for processing your Personal Data:

• where we obtain your affirmative consent to use your Personal Data in this way;
• where we have a legitimate interest in processing your Personal Data, which we have balanced against your rights and freedoms and concluded that our processing is justifiable; or
• where our handling of your Personal Data is necessary for us to perform the obligations under your company’s or employer’s contract with Rebura.

We may rely on one or more legal bases to process your Personal Data.

A. All users of the Websites and/or our services

Legitimate Interests: Rebura uses Personal Data that we collect for the following general purposes in the performance of our legitimate interests as a business: to provide the services to our clients; to enhance their experience, to improve our services and to contact clients.

B. Individuals who work for Rebura clients (i.e. a client contact)

Consent: If you would like to receive general marketing and other communications from us, you will have the option to affirmatively check a box consenting to Rebura processing your Personal Data for this purpose. Rebura may also ask you via email or telephone for your affirmative consent to receive marketing and other communications from us.

Legitimate Interest: Rebura has a legitimate interest in processing your Personal Data in order to provide AWS services at your company or employer, and provide you with other products and services relevant to your company or employer and to market its products and services to you in order to grow our business, to demonstrate our knowledge of the AWS services marketplace and relevant technologies and to enhance the standing and recognition of our brands. Rebura also has legitimate interest to process your Personal Data if you seek or obtain further information about Rebura or an Rebura client.

Necessary for the performance of a contract: Rebura can process your Personal Data in the performance of its contract with your company or employer.

With respect to actual or prospective client contacts, if Rebura obtains your Personal Data from someone other than you, Rebura shall inform you of the identity and contact details of the person or entity from whom Rebura obtained your Personal Data, whether Rebura obtained your Personal Data from publicly available sources, the categories of Personal Data that Rebura obtained and, if Rebura is processing your Personal Data based on its legitimate interest (see Section III below), the nature of Rebura’s legitimate interest.  Rebura shall provide you with the information listed in this paragraph by the earlier of (1) one month after Rebura obtains your Personal Data or (2) if Rebura uses your Personal Data to communicate with you, the first time that Rebura communicates with you.

Rebura shall not provide you with the information described in the paragraph immediately above if you already possess this information, providing you with such information is against applicable law, is subject to an obligation of professional secrecy, proves impossible, would involve a disproportionate effort or would render impossible or seriously impair the achievement of the objectives of the processing, in which case, Rebura shall take appropriate measures to protect your rights, freedoms and legitimate interests.

III. Your Special Rights under Data Protection Laws

A. Do I have a right to be erased (forgotten)?

Yes. You have the right to request that Rebura deletes or removes your Personal Data where there is no compelling reason for us to continue to process it. You can exercise this right, free of charge, by sending an email to Rebura at privacy@rebura.com.

Please note that your right to erasure is not absolute.  Rebura will remove your Personal Data when:

1. the Personal Data is no longer necessary in relation to the purpose for which Rebura originally collected and/or processed it;
2. if Rebura is processing your Personal Data on the basis of your consent and you withdraw consent;
3. you object to the processing of your Personal Data and there is no overriding legitimate interest for us to continue to process it;
4. the Personal Data was unlawfully processed; and
5. the Personal Data must be erased to comply with a legal obligation.

Rebura can refuse to comply with an erasure request in the following limited circumstances:

(a) to exercise Rebura’s right of freedom of expression and information;

(b) to comply with a legal obligation or for the performance of a public interest task;

(c) for archiving purposes in the public interest, scientific research, historical research or statistical purposes; or

(d) for the establishment, exercise or defence of legal claims.

If we remove your Personal Data per your request for erasure, then we will confirm this with you.

If we have disclosed any of your Personal Data to a third party and you submit an erasure request to us, then we will inform (1) you about the recipients and (2) any such third parties of your erasure request unless doing so is impossible or involves disproportionate efforts.

We will respond to your erasure request without undue delay.  Please note that, for your and Rebura’s protection, we cannot respond to an erasure request until we have verified the identity of the person making the request.  This verification process may extend the response timeframes set forth in this paragraph.

B. Do I have a right of access to a copy of my Personal Data?

Yes. You have the right to:

• obtain confirmation that your Personal Data is being processed;
• a copy of your Personal Data being processed;
• the purposes of the processing;
• the categories of personal data being processed;
• the recipients or categories of recipients to whom Rebura has disclosed your Personal Data; and
• the criteria Rebura uses to determine how long it will store your Personal Data.

You can exercise this right by sending an email to Rebura at privacy@rebura.com.

This right is in place to ensure that you are aware of and can verify the lawfulness of the processing. In most cases, we will provide you with a copy of your Personal Data free of charge. However, we may charge you a reasonable fee if your request is manifestly unfounded, excessive or repetitive. With respect to unfounded, excessive or repetitive requests, in rare cases, Rebura may refuse to respond to your request but will explain the reason(s) for its refusal to you without undue delay and within one month of its receipt of your request. If Rebura so refuses, you have the right to file a complaint with the SAs and to seek a judicial remedy.

If you submit your access request to Rebura electronically, Rebura will provide you with its response, and a copy of your Personal Data (if applicable) via email or other commonly used electronic form.

If Rebura did not collect your Personal Data from you, Rebura will inform you about the source from which it obtained your Personal Data. Your right of access does not adversely affect your right of erasure (forgotten) and right of rectification, both of which are described in this Privacy Notice.

Generally, Rebura will provide you with a copy of your Personal Data without undue delay and within one month of its receipt of your request, provided that Rebura may extend this time period for up to two additional months if your request is complex or numerous. If Rebura exercises this extension of time, Rebura will inform you of its decision to exercise the extension within one month of its receipt of your request, and will explain the reason(s) for the extension. If your request is large or complex, Rebura may ask you to specify the particular information or category of information you seek.

Please note that, for your and Rebura’s protection, Rebura cannot respond to an access request until it verifies the identity of the person making the request for your Personal Data. This verification process may extend the response timeframes set forth in the paragraph above.

C. Do I have a right to object to the processing of my Personal Data, including the processing of my Personal Data by Rebura for direct marketing?

Yes, you have a right to object to the processing of your Personal Data where:

• Rebura’s processing is based on its legitimate interest; or
• where Rebura is using your Personal Data to directly market to you.

You can exercise this right, free of charge, by sending an email to Rebura at privacy@rebura.com.

If Rebura receives an objection request from you for reasons unrelated to direct marketing, Rebura will stop processing your Personal Data unless we can show compelling legitimate ground(s) for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of any legal claims.

If Rebura receives an objection request from you for reasons related to direct marketing, we will stop processing your Personal Data.

If you receive a direct marketing communication from Rebura and you do not wish to receive future direct marketing communications from Rebura, you may request to unsubscribe from future marketing communications by sending Rebura an email at privacy@rebura.com  In addition, if the direct marketing communication you received was via email and has an “Unsubscribe” link, you can click the “Unsubscribe” link at the bottom of the email and fill out the required form. Whether through email or by clicking the “Unsubscribe” link, Rebura will process your unsubscribe request.  Please allow up to ten (10) business days for your unsubscribe request to take effect.

D. Do I have a right to restrict processing of my Personal Data?

Yes, you have a right to restrict, the processing of your Personal Data.  You can exercise this right, free of charge, by sending an email to Rebura at privacy@rebura.com.  When you exercise this right, Rebura may continue to store your Personal Data but cannot further process it.  Rebura will cease processing your Personal Data in the following circumstances:

1. when you file a rectification request with Rebura (see the “Do I have a right to have any inaccurate or incomplete Personal Data rectified?” section below) in accordance with this Privacy Notice and applicable law. The restriction shall remain in place until such time as Rebura has verified the accuracy of the Personal Data that is the subject of your rectification request;
2. where Rebura is processing your Personal Data based on its legitimate interest and you file a notice with Rebura objecting to the processing of your Personal Data (see the “Do I have a right to object to the processing of my Personal Data?” section above) in accordance with this Privacy Notice and applicable law, Rebura will cease processing your Personal Data until such time as Rebura has made a determination as to whether its legitimate grounds for continued processing override your reasons for objecting to the processing;
3. when the processing is unlawful and you do not seek or want erasure and you file a restriction request with Rebura in accordance with this Privacy Notice and applicable law instead; and
4. if Rebura no longer needs the Personal Data and you require the data to establish, exercise or defend a legal claim.

While the processing of your Personal Data is restricted, Rebura may continue to process such data by storing it, processing it with your consent or processing it for the establishment, exercise or defence of legal claims.

Rebura will inform you if it decides to lift a restriction on processing.

If Rebura has disclosed any of your Personal Data to a third party and you submit a request to restrict processing, Rebura will inform (1) you about the recipients if you so request and (2) any such third parties of your restriction request unless doing so is impossible or involves disproportionate efforts.

Rebura will act on your restriction request in accordance with this Privacy Notice without undue delay. Please note that, for your and Rebura’s protection, Rebura cannot act on a restriction request until it verifies the identity of the person making the request. This verification process may extend the timeframe in which Rebura acts on your restriction request.

E. Do I have a right to Personal Data portability?

Yes. You can exercise this right, free of charge, by sending an email to Rebura at privacy@rebura.com. This right exists to allow you to obtain and use your Personal Data for your own purposes across different services. Under this right, you can move, copy or transfer your Personal Data from Rebura to another data controller.

This right applies where Rebura is processing your Personal Data with your consent or for the performance of a contract. It also applies if we process your Personal Data by automated means. If your portability request concerns someone other than you, Rebura will have to consider whether providing or porting the Personal Data would prejudice the other person’s or people’s rights.

Generally, Rebura will respond to your portability request without undue delay and within one month of its receipt of your request, provided that Rebura may extend this time period for up to two additional months if your request is complex or numerous. If Rebura exercises this extension of time, Rebura will inform you of its decision to exercise the extension within one month of its receipt of your request, and will explain the reason(s) for the extension. Where technically feasible, you may request that Rebura transmit your Personal Data to another data controller.

F. Do I have a right to object to decision been taken by automated means?

If Rebura uses automated (i.e. non-human) methods to process your Personal Data to make decisions that could potentially have a damaging legal or similarly significant effect on you (each, an “Automated Decision”), you have the right not to be subject to the Automated Decision. This right is inapplicable to any Automated Decision made by Rebura that is necessary for entering into or the performance of a contract between you and Rebura, is authorized by law or is based on your explicit consent.

If Rebura makes any Automated Decisions to which this right applies, Rebura will ensure that you are able to obtain human intervention, express your point of view and obtain an explanation of the decision and challenge it.

If Rebura engages in “profiling” by automated means, Rebura will ensure that appropriate safeguards are in place including (1) ensuring that the processing is fair and transparent by providing you with meaningful information about the logic involved and the significance and consequences of the outcome of the decision, (2) using appropriate mathematical or statistical procedures for the profiling, (3) implementing appropriate technical and organizational measures to enable inaccuracies to be corrected and minimize the risk of errors and (4) securing the Personal Data in a way that is proportionate to the risk to your interests and rights and prevents discriminatory effects.

G. Do I have a right to have any inaccurate or incomplete Personal Data rectified?

Yes. You can exercise this right, free of charge, by sending an email to Rebura at privacy@rebura.com.

Generally, Rebura will respond to your rectification request within one month of its receipt of your request, provided that Rebura may extend this time period for up to two additional months if your request is complex. In rare cases, Rebura may refuse to respond to your request but will explain the reason(s) for its refusal to you within one month of its receipt of your request. If Rebura so refuses, you have the right to file a complaint with the SAs and to seek a judicial remedy.

If Rebura has disclosed any of your Personal Data to a third party and you submit a rectification request to Rebura that Rebura is going to honor, Rebura will inform (1) you about the recipients and (2) any such third parties of your rectification request as well as any corrected Personal Data, unless doing so is impossible or involves disproportionate efforts.

We will use reasonable endeavours to ensure that your Personal Data is maintained and up to date.

H. What are my rights if the Security of my Personal Data is breached?

A breach of Personal Data (a “Breach”) means a breach of security leading to the destruction, loss, alteration, unauthorized disclosure of, or access to, your Personal Data for which we are responsible under applicable law.

If the Breach is likely to have a significant detrimental effect on your rights and freedoms (such as resulting in discrimination, damage to reputation or financial loss), Rebura will notify the SAs without undue delay, and if feasible, within one business day of Rebura’s becoming aware of the Breach. Rebura will assess the determination of “significant detrimental effect” on a case by case basis.

If the Breach is likely to result in a “high risk” to your rights and freedoms, Rebura will notify you without undue delay. To be clear, the threshold requiring Rebura to notify you of a Breach is higher than the threshold requiring Rebura to notify the SAs of a Breach so it is possible that Rebura will notify the SAs of a Breach but not you. Rebura will assess the determination of “high risk” on a case by case basis.

Any Breach notice issued by Rebura will contain, where possible, (1) the categories and approximate number of individuals and Personal Data records effected by the Breach, (2) the name and contact details of the information security manager (“ISM”) (or other Rebura contact representative if Rebura does not have a ISM at the time that Rebura issues the Breach notice), (3) a description of the likely consequences of the Breach, (4) a description of the measures that Rebura has taken, and may take, to stop the Breach and, where appropriate, to mitigate the adverse effects of the Breach and (5) recommendations on actions you can take to protect yourself in light of the Breach.

I. Will my Personal Data be transferred outside the EEA or Switzerland?

Rebura may transfer your Personal Data to third parties described in this Privacy Notice who are located outside of  Switzerland or EEA. If so, Rebura will take reasonable steps to ensure that your Personal Data is protected and treated in accordance with this Privacy Notice and local applicable law. Some of the countries outside  Switzerland or EEA where your Personal Data may be transferred will be on the EU Commission or Swiss Federal Data Protection and Information Commission’s list of countries that it has deemed to have adequate security controls in place (for this Addendum, the “Approved List”). Given the European Court of Justice’s decision in Data Protection Commissioner v. Facebook Ireland and Maximilian Schrems, Case C-311/18 (July 16, 2020) (“Schrems II”) as well as the September 8, 2020 Swiss Federal Data Protection and Information Commissioner’s Policy paper on the transfer of personal data to the USA and other countries lacking an adequate level of data protection within the meaning of Art. 6 Para. 1 Swiss Federal Act on Data Protection, and absent consent from the Data Subject (or any other reason provided in GDPR Article 49(1)(b)-(f),  Swiss law as may be amended from time to time), if Rebura transfers your Personal Data to processors (which could be external third party vendors or suppliers) that store, transfer, process, or control your Personal Data in a country not on the Approved List or not in  Switzerland or EEA (for this Addendum, “Third Countries”), then Rebura shall determine whether each processor (and each subprocessor that a processor has provided Rebura formal notice of) can store, transfer, process, or control the Personal Data solely within  Switzerland, EEA, or a country on the Approved List.

• If Rebura determines that the processor (and each subprocessor that a processor has provided Rebura formal notice of) can store, transfer, process, or control the Personal Data solely within a country on the Approved List or in Switzerland or EEA, we will require such processor (and will require the processor to require each of its applicable subprocessors) to do so.
• If Rebura determines that the processor (and each subprocessor that a processor has provided Rebura formal notice of) cannot store, transfer, process, or control the Personal Data in a country on the Approved List or in Switzerland or EEA, then:
  • Rebura will require such processor (and will require the processor to require each of its applicable subprocessors) to be bound by the model clauses promulgated by the European Commission as provided here: https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32021D0914&from=EN (or any updated link which the European Commission may supply from time to time) (for this Addendum, the “Model Clauses”). When relying on the Model Clauses, Rebura shall (a) monitor the laws and regulations of Third Countries for the adequate protections of UK, Swiss, or EEA Data Subjects as required by the GDPR or other local laws and regulations; and (b) terminate the storage, transfer, processing , or control of Personal Data by a processor (or a subprocessor where the process has informed Rebura of the country in which such subprocessor is processing your Personal Data) when (i) such laws and regulations of Third Countries are incompatible with the GDPR or other local laws and regulations, or (ii) access to Personal Data is requested by the public authorities of Third Countries and such access is lawful under the laws of the Third Countries but is prohibited under the GDPR or other local laws and regulations. If the events described in III(I)(b)(i)(b)(i) or (ii) occur, Rebura will confer with the appropriate supervisory authority regarding appropriate actions to safeguard your Personal Data.
• Rebura shall also require the processor (and will require each processor to require its applicable subprocessors) to determine whether each processor or subprocessor can store, transfer, process, or control the Personal Data solely within Switzerland, EEA, or a country on the Approved List.

1. If processor (or its applicable subprocessors) can store, transfer, process, or control the Personal Data solely within Switzerland, EEA, or a country on the Approved List, then Rebura shall contractually require the processors (and require processor to require its subprocessors to) do so.
2. If processor (or its applicable subprocessors) must store, transfer, process, or control the Personal Data in a Third Country, then Rebura shall require its processors (and require processor to require its subprocessors to) to be bound by the Model Clauses. When relying on the Model Clauses, Rebura shall contractually require such processors (and shall also require processors to require their subprocessors) to agree to (a) monitor the laws and regulations of Third Countries for the adequate protections of Swiss or EEA Data Subjects as required by the GDPR or other local laws and regulations; and (b) terminate the transfer, processing, or control of Personal Data when (i) such laws and regulations of Third Countries are incompatible with the GDPR or other local laws and regulations, or (ii) access to Personal Data is requested by the public authorities of Third Countries and such access is lawful under the laws of the Third Countries but is prohibited under the GDPR or other local laws and regulations. If the events described in III(I)(c)(2)(b)(i) or (ii) occur with respect to your Personal Data (and if Rebura has formal notice that the events described in III(I)(c)(2)(b)(i) or (ii) have occurred), Rebura will confer with the appropriate supervisory authority regarding appropriate actions to safeguard your Personal Data.

Under certain circumstances, Rebura may share your Personal Data with one or more of its group companies who may be located in a Third Country. In such cases, Rebura will comply with its DPAs. The DPAs are incorporated by reference into this Addendum

J. How long will Rebura store my Personal Data for?

We are required by law to store your Personal Data for as long as is necessary to comply with our legal, regulatory and contractual obligations.

With respect to GDPR (and similar laws), we will store and process your Personal Data that we obtain via: (i) your consent, until the earlier of (a) the purpose for which we obtained such information has been fully accomplished or (b) you inform us that you have withdrawn your consent; (ii) our legitimate interest until the earlier of (a) your Personal data is no longer necessary for the purpose for which it is being processed, or (b) Rebura concludes that your rights and freedoms outweigh our right to process your Personal Data; and (iii) our necessity for the performance of a contract, until the termination or expiration of the contract including the termination or expiration of Rebura’s and your employer’s or company’s duties or obligations that survive any such termination or expiration.

Furthermore, we will store your Personal Data in special circumstances related to the issuance or defense of legal proceedings, outstanding invoices or in connection with any investigation by or of a government authority.

K. What Protections do I have if Rebura transfers my Personal Data to the U.S.?

In short, you have the protections of the Model Clauses, defined above. In addition to the Model Clauses, Rebura has additional contractual clauses that may apply to its United States clients and vendors which are in the United States of America Addendum below.

Rebura discloses Personal Data to third party service providers in connection with the operation of their respective businesses, including their provision of services to clients.

Rebura may be required to disclose Personal Data to law enforcement, regulatory or other government agencies, or to other third parties, in each case to comply with legal, regulatory, or national security obligations or requests.

Any questions, complaints, or requests to access, correct, amend, delete, or limit the use or disclosure of Personal Data (opt out) may be directed to privacy@rebura.com. If Rebura has not been able to satisfactorily resolve the issue, then you may raise it with your data protection authority (see paragraph immediately below).

L. EEA residents. Should your complaint remain unresolved and you reside in the EEA, then you should contact the EEA Supervisory Authorities (the “EEA SAs”) who act as an independent recourse mechanism to settle all such disputes. Such complaints can be directed either to the EEA SAs panel secretariat or individual EEA SAs.

Currently, the contact information relevant to the submission of the EEA standard complaint form is as follows: Commission Européenne, Directorate General Justice, Directorate C (Fundamental Rights and Union Citizenship) of the European Commission, Data Protection Panel, B-1049 Brussels, Belgium, Telephone: (32-2) 299 11 11, Fax: (32-2) 298.80.94, email: ec-dppanel-secr@ec.europa.eu.

You can find the standard compliant form at https://edps.europa.eu/data-protection/our-role-supervisor/complaints/edps-complaint-form_en.

The contact information for individual EEA SAs can be found at: http://ec.europa.eu/justice/data-protection/bodies/authorities/eu/index_en.htm

1. Swiss residents. Should your complaint remain unresolved and you reside in Switzerland, then you should contact the FDPIC of Switzerland with whom Rebura has agreed to cooperate regarding such disputes.

The contact information for the Swiss FDPIC can be found at: https://www.edoeb.admin.ch/edoeb/en/home/the-fdpic/links/data-protection—switzerland.html