Sonarworks is committed to protecting your privacy. This privacy statement (“Privacy Statement”) describes why and how we collect and use personal data and provides information about individuals’ rights.

Personal data is any information relating to an identified or identifiable living person. When we use “you” or “your” in this Privacy Statement, we are referring to the relevant individual who is the subject of the personal data.

We process personal data in accordance with applicable legislation, including the General Data Protection Regulation (the "GDPR") and the applicable national data protection laws.

We process personal data for numerous purposes, and the means of collection, legal basis of processing, use, disclosure, and retention periods for each purpose may differ.

To find out more about our specific processing activities, please choose the relevant sections of this Privacy Statement.

One or more data processing activities may apply simultaneously.

1. Customers, potential customers and former customers and software users
2. Website visitors
3. Recruitment applicants
4. Distributors
5. Affiliates
6. Suppliers and service providers
7. Endorsers
8. Persons involved in researches
9. Recipients of the personal data
10. Individuals’ rights and how to exercise them
11. Scope of the Privacy Statement

1. Customers, potential customers and former customers and software users

Purposes of the data processing

We process your personal data to:

• Provide products and services that you have requested and perform deliveries in accordance with an end user license agreement (“EULA”) or purchase agreement;
• Identify users who have difficulties using the program;
• Offer support for our products and services;
• Carry out security activities, including detecting and preventing security threats and malicious use of our products and services;
• Carry out quality and risk management activities;
• Administer, manage and develop our products and services and improve quality of our products, services by analyzing data;
• Inform you about our products and services that are closely related to the products and services you already use or have tried to use;
• Communicate information that is relevant for our deliveries in particular and our customer relations in general;
• Publish your review if your consent for that is received;
• Process orders, invoices, payments and perform financial follow-ups;
• Comply with the legal obligation we are subject to.

Legal basis for the data processing

Legal basis for processing your personal data for the purposes mentioned above are:

• Performance of a contract or to take steps at your request prior to entering into a contract;
• Legitimate interests, namely, to ensure security conditions, to provide quality of our products and services, and to promote our business;
• Necessity to comply with legal obligations that apply to us;
• Consent (in case when it is necessary to receive it according to the GDPR).

Categories of personal data we process

To ensure the conclusion of a contract, performance of the contract, and to accomplish other purposes stated above, we process the following categories of personal data:

• Name, phone number, email address, postal address;
• Contact details, such as name of the company you work for, your position, email address, phone number;
• Payment information;
• Data you provide to Sonarworks to be able to provide services, resolve issues;
• Computer ID (CID), IP, computer name, computer type, headphone name, headphone profile, microphone profile name, input/output device name and ID, calibration profile name;
• Unique user information for user accounts such as email address, password and security question;
• Specific information, such as student or teacher certificate, personal identification number, educational establishment where you work or study, to get discounts offered by Sonarworks;
• Other information you have provided to us.

The provision of data is mandatory for customers based on contractual regulations. The contractual relationship cannot be established and carried out without providing data.

Data retention

All your data relevant to contracts and bookkeeping shall be stored for a period of ten calendar years after the contract expires.

2. Website visitors

Purposes of the data processing

We process your personal data for the following purposes:

• Tto administer and manage our website;
• To confirm and authenticate your identity;
• To prevent unauthorized access to restricted areas of the site or restricted content;
• To conduct quality and risk management reviews;
• To develop our products, services and web sites by analyzing how people use our websites;
• To personalize your browsing experience by displaying content that is more likely to be relevant and of interest to you;
• To monitor and enforce compliance with our terms and conditions;
• Tto communicate with you in order to distribute requested information or materials or ask for further information;
• Any other purposes for which you provided your personal data to us.

Legal basis for the data processing

The legal basis for processing your personal data for the purposes mentioned above are the following:

• Legitimate interests, namely, the demand-oriented design of the website, developing our products and services, ensuring network and information security;
• Consent for the processing of personal data or for processing of personal data for purposes for which the consent of the data subject is required by law.

Collection of personal data

We process your personal data which you have provided when using our website, such as name, email address, as well as any additional information you have included in the message.

We may also collect limited personal data automatically including via the use of cookies.

Cookies are small files that websites save to your hard disk or to your browser's memory. Our website may use them to track the number of times you have visited the website, to track the number of visitors to the website, to determine and analyze visitors' use of our websites, to store data that you provide (such as your preferences), and to store technical information related to your interactions with our website. We may also use session cookies, which are deleted when you close your browser, to store your user ID, to facilitate your movement around our websites (particularly in connection with information searches and order placement) and other information useful in administering the session.

You can find out more details regarding our use of cookies on our Cookies Policy.

The use of the website is not possible without disclosure of personal data, such as the IP address. Communication via the website without providing data is not possible.

Data retention

We will retain personal data collected via our website as long as it is necessary for communication with you, but not longer than 5 years. The retention period for data which are collected via the use of cookies is determined in our Cookies Policy.

3. Recruitment applicants

Purposes of the data processing

We process your personal data for the following purposes to:

• Screen and select employees by evaluating your suitability for employment with Sonarworks, including through interviews and assessments and conducting background checks;
• Hire and onboard employees by making an offer to successful applicants and carrying out pre-employment screening checks.

Legal basis for the data processing

The legal basis for processing your personal data for the purposes mentioned above are the following:

• In connection with recruitment activities, we process your personal data for our legitimate interests to attract and hire the best candidate to work with us;
• If you are a successful candidate and we are planning to conclude an employment contract with you, we process your data to take steps at your request prior to entering into a contract.

Categories of personal data we process

Personal data we process for the purposes of recruitment activities are the following:

• Name, date of birth, nationality;
• Contact details: email address(es), telephone number(s), postal address;
• Professional experience and knowledge, such as experience, education, academic and professional qualification included in CVs and motivation letter;
• Areas of interest: hobbies etc.;
• Any information provided as references from your named referees;
• Vverification of information provided during the recruitment process by contacting relevant third parties (for example, previous employers, education and qualification providers) or using publicly available sources (for example, to verify your experience, education and qualifications);
• If you have indicated - disabilities, which necessitate any special arrangement in the context of the selection procedure;
• Interview and assessment results and feedback;
• Bank account details if your application is successful.

Provision of personal data is required for examination of your application and, if applicable, conclusion of an employment contract. Without personal data, an application cannot be considered.

Data retention

We retain your personal data processed in connection with recruitment activities as follows:

• If your application is successful we will retain relevant personal data as part of your employee record after the end of your employment with Sonarworks for a period specified in the applicable law;
• If your application is unsuccessful, we will retain and use the information you provided as part of your application for a period of 5 years to deal with any matter which may arise in connection with your application, for purposes of contacting you regarding other employment opportunities.

4. Distributors and dealers

Purposes of the data processing

We may process your personal data for the following purposes:

• To ensure the company you work for could distribute our products and services;
• To provide information about us and our range of services;
• To advertises our products and services;
• To process payments.

Legal basis for the data processing

Legal basis of processing your as contact person’s or representative’s personal data is legitimate interests, namely communication with you in relation to the conclusion of a contract or execution of a contract and documentation of the communication processes.

Legal basis for data processing may also be legal obligations.

Categories of personal data we process

To ensure the conclusion of a contract, performance of the contract, and accomplish other purposes stated above, we process your contact details, such as name, name of the company you work for, your position, email address, phone number.

Processing of contact data of distributors is necessary to conclude and execute a contract or an order. If data is not provided, communication may be considerably impaired.

Data retention

We retain your personal data for a period of ten years after the contract expires.

5. Affiliates

Purposes of the data processing

We may process your personal data for the following purposes:

• To ensure you could promote our products and services;
• To provide information about us and our range of services;
• To advertise our products and services;
• To process payments.

Legal basis for the data processing

Legal basis for the processing of your personal data mostly is preparation for the conclusion of a contract or execution of a contract.

Legal basis for data processing may also be legal obligations, in particular accounting, tax and commercial law provisions.

Categories of personal data we process

To ensure the conclusion of a contract, performance of the contract, and accomplish other purposes stated above, we process the following personal data:

• Name, personal identification number, address, telephone number and email address, password for user account;
• Payment information.

Processing of contact data of distributors or affiliates is necessary to execute a contract or an order. If data is not provided, communication may be considerably impaired.

Data retention

We retain your personal data for a period of ten years after the contract expires.

6. Suppliers and service providers

Purposes of the data processing

We may process your personal data for the following purposes:

• To receive products which are necessary for our business;
• To receive services from you or from your organization including marketing services, services for maintaining and administering our organization and business, IT services, services for managing our website and systems;
• To ensure we comply with legal obligations imposed on us by law;
• To process payments.

Legal basis for the data processing

Legal basis for processing your as supplier or service provider personal data mostly is preparation for conclusion of a contract or execution of a contract. If the contract will be or is concluded with legal person the legal basis of processing your as contact person’s or representative’s personal data is legitimate interest, namely communication with you in relation to the contract and documentation of communication processes.

Legal basis for data processing may also be legal obligations, in particular accounting, tax and commercial law provisions.

Categories of personal data we process

To ensure the conclusion of a contract, performance of a contract, and to accomplish other purposes stated above, we process the following personal data:

• Name, address, name of the company you work for, your position, telephone number and email address;
• Personal identification number if supplier or service provider is a natural person;
• Payment information.

The processing of contact data of the supplier service provider is necessary to execute the contract or order. If the data is not provided, the communication may be considerably impaired.

Data retention

We retain your personal data for a period of ten years after the contract expires.

7. Endorsers

Purposes of the data processing

We process your personal data to publish your opinion and photo or video accurately and in high quality.

Legal basis for the data processing

The legal basis for processing your personal data for the above purpose is your consent.

Categories of personal data we process

To provide fulfillment of the purpose mentioned above we process the following personal data:

• Your contact details such as name, address, telephone number and email address;
• Content you have agreed to publish by Sonarworks including photos and videos.

Data retention

We retain your personal data processed in connection with publishing your opinion and photo or video on our website for no more than 5 years from the time of their receipt.

8. Persons involved in research

Purposes of the data processing

The purposes of the processing your personal data are the following:

• Researching of healthy human hearing;
• Create a hearing profile to evaluate hearing impairment;
• Carrying out quality and risk management activities;
• Improving the quality of our products and services;
• To process payments.

Legal basis for the data processing

Legal basis for processing your personal data for purposes mentioned above is your consent.

When a research contract is concluded, the legal basis for the processing of the personal data is also the conclusion of a contract or preparatory contract.

Categories of personal data we process

The categories of personal data processed by us in relation with research are:

• Name, address, telephone number and email;
• Interview data in written form;
• Age, gender;
• Measurements of the person's hearing threshold;
• Video, audio;
• Payment and billing information.

Data retention

We retain your personal data processed in connection with research activities for no more than 5 years from the time of their receipt.

9. Recipients of the personal data

Recipient of your personal data primarily is Sonarworks and its employees.

To be able to offer you the best possible services and remain competitive in our business, we share certain data with other organizations. As a result, personal data may be transferred outside the countries where we or the data subject is located. This includes countries outside the European Union (“EU”).

We use contractual arrangements and security mechanisms as appropriate to protect the data and to comply with applicable laws including GDPR.

Where we transfer personal data outside the EU to a country not determined by the European Commission as providing an adequate level of protection for personal data, the transfers will be under an agreement which covers the EU requirements for the transfer of personal data outside the EU, such as the European Commission approved standard contractual clauses. Please contact us to receive more detailed information about our processors!

Personal data processed by us may be transferred to:

• Third party organizations that provide applications/functionality, data processing or IT services to us, ensure the execution of sales transactions of our products and services or otherwise assist us in providing goods, services or information.

We use third parties to support us in providing our services and to help provide, run and manage our internal IT systems. and execute sales transactions. For example, providers of information technology, cloud based software as a service providers, identity management, website hosting and management, data analysis, data back-up, security and storage services, as well as organizations which provide us marketing activities or events and manage customer communications, prepare reports and statistics, printing materials and designing products, place advertisements on apps, websites and social media, online payment service providers.
In order to offer you Klarna’s payment methods, we might in the checkout pass your personal data in the form of contact and order details to Klarna, in order for Klarna to assess whether you qualify for their payment methods and to tailor those payment methods for you. Your personal data transferred is processed in line with Klarna’s own privacy notice.

• Auditors and professional advisers.

We may share your data with our auditors if it is necessary for the provision of audit, with professional advisers, for example, law firms, as necessary to establish, exercise or defend our legal rights and obtain advice in connection with the running of our business.

• Government authorities.

To comply with our regulatory obligations we may disclose data to the relevant authorities to check that we are complying with applicable law and regulation, for example supervisory authorities, tax authorities, judicial/investigative authorities such as police, public prosecutors, courts on their express and legal request.

In all of these cases, we ensure the third parties can only access personal data that is necessary for their specific tasks.

10. Individuals’ rights and how to exercise them

You as a data subject have certain rights over your personal data and we as controllers are responsible for fulfilling these rights. Please see below further information about these rights, when they are available and how to exercise them.

Your right of access to personal data

You have the right to obtain a copy of your personal data as well as other supplementary information. It helps you to understand how and why we are using your data, and check we are doing it lawfully.

Your right to rectification / amendment of personal data

You have the right to request for your personal data to be amended or rectified where it is inaccurate (for example, if you change your name or address) and to have incomplete personal data completed.

Your right to erasure / right to be forgotten

You have the right to have personal data erased, but this right is not absolute and only applies in certain circumstances.

You have the right to have your personal data erased if:

• The personal data is no longer necessary for the purpose which we originally collected or processed for;
• We are relying on consent as legal basis for holding the data, and you withdraw your consent;
• We are relying on legitimate interests as legal basis for processing, and you object to the processing of your data, and there is no overriding legitimate interest to continue this processing;
• We are processing the personal data for direct marketing purposes and you object to that processing;
• Your personal data have been processed unlawfully;
• Your personal data must be erased to comply with a legal obligation which we are subject to.

Your right to restrict processing

You have the right to restrict the processing of your personal data, that is, to limit the way that we use your data, in the following circumstances:

• For a period enabling us to verify the accuracy of your personal data where you have contested the accuracy of the personal data;
• The data has been unlawfully processed and you request restriction instead of erasure;
• When your personal data are no longer necessary in relation to the purposes for which they were collected and processed you can request restriction to establish, exercise or defend legal claims;
• For a period enabling us to verify whether the legitimate interests relied on by us override your interests where you have objected to the processing based on legitimate interests.

Your right to object to processing

The right to object to processing allows you to ask us to stop processing your personal data.

You have the absolute right to object to the processing of your personal data if it is for direct marketing purposes.

You have the right to object to the processing of your personal data also when there are other legitimate interests for processing, but then we have to verify whether your interests override the legitimate interests relied on by us.

Your right to data portability

The right to data portability gives you the right to receive your personal data you have provided to us in a structured, commonly used and machine readable format. It also gives you the right to request that we transmit this data directly to another controller.

The right to data portability only applies when:

• Legal basis for processing these personal data is consent or for the performance of a contract;
• We are carrying out the processing by automated means.

Your right to withdraw consent

Where we process personal data based on your consent, you have a right to withdraw consent at any time.

Your right to lodge a complaint

If you have a complaint on how we use your personal data, please contact us here. We will review and respond to all complaints received.

You also have the right to lodge a complaint with the supervisory authority in your country of residence, place of work or the country in which an alleged infringement of data protection law has occurred. The data protection supervisory authority in the Republic of Latvia is the Data State Inspectorate, contact information:

• Blaumaņa iela 11/13-11,
• Riga, LV-1011, Latvia
• E-mail: info@dvi.gov.lv
• web page: www.dvi.gov.lv

12. Scope of the Privacy Statement

We may amend the Privacy Statement to remain compliant with any changes in law and/or to reflect changes in the processing of personal data by us.

Privacy Statement was last updated on 28th of February 2022.