Privacy Policy

MAHALO, INC.'S USE OF PERSONAL DATA

1. THIS PRIVACY NOTICE

1.1 Our Privacy & Cookies Notice

Mahalo, Inc. (Mahalo) takes its obligations to protect privacy and personal data very seriously. Please read this Privacy & Cookies Notice ("the Notice") carefully as it sets out important information relating to how we handle your personal data.

1.2 Mahalo Notice

This Notice sets out how we, as data controller, will collect and use personal data, and the choices and rights available to you in connection with our use of your personal data. Mahalo as the data controller is responsible for responding to requests to exercise data subject rights. In all cases, any complaints and requests to exercise data subject rights should be addressed to the Data Privacy Officer listed below and at privacy@mahalohq.com.

1.3 To whose personal data does this Notice apply?

This Notice describes our practices when using the personal data of:

the business contacts, suppliers and employees of clients (including customers of our clients);
persons who provide it to us during the recruitment process; and
other persons who (1) may visit our website ("website users") or (2) who may visit our Mahalo pages on social media sites.

This Notice will apply whether you have provided the information directly to us or we have obtained it from a different source, such as a third party.

2. BUSINESS CONTACTS

2.1 Sources of business contact information

We collect personal data from our business contacts directly or from the following sources:
Third party referrals;
Client checking and verification processes such as due diligence checks;
Social media sites such as LinkedIn and other public internet sites;
Credit reference agencies, insurance information bureaus and government or financial institutions; and
Other public resources such as telephone directories, newspapers, internet sites, commercially available marketing lists, registries or public records.

2.2 What personal data we collect about business contacts

The categories of information we collect about business contacts includes:

Personal details including name, home address, employer, office address, personal and work telephone numbers and home and work email addresses;
Financial details including payments made and received and VAT/sales tax;
Goods or services provided or purchased;
Communications with our business contacts;
Where business contacts have online accounts, log-in and similar credentials and information about use of these services;
Image capturing, such as photos taken at events, videos, and CCTV footage; where permitted by applicable law.

We may collect this information directly from you, automatically from you or your device, or from third-party sources.

2.3 How we use the personal data we collect about business contacts

We use this information for certain activities, including:

Facilitating smooth running of the business through communication with customers and suppliers;
Maintaining and building upon customer and supplier relationships;
Business planning;
To fulfill a transaction initiated by a business contact;
To fulfill a transaction initiated by Mahalo such as the engagement of suppliers;
To fulfill a transaction with, or for, Mahalo customers;
Keeping accounts related to any business or other activity carried on by Mahalo;
Deciding whether to accept any person as a customer or supplier;
Keeping records of purchases, sales or other transactions for the purpose of ensuring that the required payments and/or deliveries are made or services provided;
Completion of customer satisfaction surveys;
Marketing and related activities, including Development services, business development, and event management including inviting our business contacts to events and exhibitions;
Database management;
Running competitions;
Security and crime prevention;
For fraud and theft prevention or investigation, or other risk management purposes;
Compliance with contractual, legal and regulatory obligations;
Enabling business contacts to access their online accounts; and
For internal analysis and research to help us improve our services.

2.4 Why we use the personal data of business contacts

We use this information because:

It is necessary for performing our obligations, or exercising our rights, under our contracts with customers or suppliers;
It is necessary for compliance with any legal or regulatory obligations that we are subject to;
We have a legitimate business interest to:
Manage our business and brand;
Provide and improve our services; and
Operate our business.

A legitimate interest above will only apply where we consider that it is not outweighed by a business contact's interests or rights which require protection of their personal data. In limited circumstances, such as in the case of marketing, a business contact's consent may be required under applicable law. Where we rely upon a business contact's consent, they will have the right to withdraw their consent by contacting the Data Privacy Officer.

If a business contact requires further information regarding our legitimate interests as applied to their personal data, they may contact the Data Privacy Officer.

In certain circumstances, where a business contact does not provide personal data which is required, we will not be able to perform our obligations under the contract with them or may not be able to provide them with products and services. We will make it clear if and when this situation arises and what the consequences of not providing the information will be for the business contact.

2.5 Recipients of business contact information

We may disclose personal data of business contacts to third parties as follows:
Business associates and other professional advisers;
Third parties including for the purpose of event management;
Claimants, beneficiaries, assignees and payees;
To suppliers and/or providers of goods and services and other third parties who work on our behalf to service or maintain business contact databases and other IT systems, such as suppliers of the IT systems which we use to process personal data, or who provide other technical services;
To third parties providing services to us, such as our professional advisors (e.g. auditors and lawyers);
To competent authorities such as tax authorities, courts, regulators and security or police authorities where required or requested by law or where we consider it necessary; and
Subject to applicable law, in the event that Mahalo is merged, sold, or in the event of a transfer of some or all of our assets (including in bankruptcy), or in the event of another corporate change, in connection with such transaction.

2.6 Further Information

Please see sections 4 to 8 below for further information concerning our use of personal data.

3. WEBSITE USERS AND WEB-RELATED PRIVACY ISSUES

3.1 What personal data we collect about website users and visitors to Mahalo social media pages

The categories of information we collect about users of our website and Mahalo webpages on social media sites such as Facebook, Instagram, LinkedIn and Twitter include:

Information users provide when they enter information on our website, such as when they provide contact details, answer online questionnaires, feedback, forms or applications for employment or submit CVs;
Information provided when users subscribe to email newsletters such as name, email address, job title;
Information users provide when registering for an online account through our website;
Information users provide when posting content on social media sites.

We also automatically collect personal data about the use of our website from users, including:

Information captured in our web logs such as device information (e.g. device brand and model, screen dimensions), unique identification numbers (e.g. IP address and device ID), and browser information (e.g., URL, browser type, pages visited, date/time of access);
Advertising information (such as size/type of ad, ad impressions, location/format of ad, data about interactions with ad);
Behavioural information (such as information on the behaviour or presumed interests of individuals which are linked to those individuals and may be used to create a user profile); and
Information captured by our cookies (see Cookies section below).

If a website user does submit their data via one of our forms and they have cookies installed on their browser, all behavioural and web log data will be associated back to them. The website user will be informed of this when completing our forms.

3.2 How we use the personal data of website users and visitors to Mahalo social media pages:

We use personal data of users of our website and Mahalo webpages on social media sites such as Facebook, Instagram, LinkedIn and Twitter for certain activities, including:

Personalizing the experience of our website;
Providing products and services that website users have requested;
Administering the website, investigating any complaints and providing customer services;
Providing website users and individuals accessing our web pages on social media sites with information and offers on products or services that may be of interest to them; and
Monitoring social media content to manage relations with our customers and promote our business and brand.

We use personal data about the use of our website for certain activities, including:

Administering the website; and
Performing statistical and trend analysis to improve the user experience and performance of our website.

3.3 Why we use the personal data of website users and visitors to Mahalo social media pages:

We use personal data of users of our website and Mahalo webpages on social media sites such as Facebook, Instagram, LinkedIn and Twitter because:

It is necessary for compliance with any legal or regulatory obligations we are subject to;
We have a legitimate business interest to:

Promote our brand and business through our website and through social media tools; and
Monitor, investigate and report any attempts to breach the security of our websites.

In the case of marketing, a user's consent maybe required under applicable law. Where we rely upon a user's consent, they will have an option to "Unsubscribe" and will also have the right to withdraw their consent by contacting the Data Privacy Officer.

We use personal data about the use of our website because:

It is necessary for compliance with any legal or regulatory obligations that we are subject to;
We have a legitimate business interest to:

Monitor, investigate and report any attempts to breach the security of our websites;
Improve the performance and user experience of our websites;

In certain circumstances, where a website user does not provide personal data which is required (for example, in relation to our online services), we will not be able to perform our obligations under the contract with them or may not be able to provide them with products and services. We will make it clear if and when this situation arises and what the consequences of not providing the information will be for the website user.

3.4 Recipients of personal data of website users and visitors to Mahalo social media pages

We may disclose website and social media users' personal data to third party recipients, as follows:

to third parties who work on our behalf to service or maintain our business and website, including suppliers of the IT system which we use to process personal data, or third parties who provide other technical services;
to third parties providing services to us, such as our professional advisors (e.g. auditors and lawyers);
to competent authorities such as tax authorities, courts, regulators and security or police authorities where required or requested by law or where we consider it necessary;
subject to applicable law, in the event that Mahalo is merged, sold, or in the event of a transfer of some or all of our assets (including in bankruptcy), or in the event of another corporate change, in connection with such transaction.

3.5 Further Information

Our websites and online services are for individuals who are at least 18 years of age. Our online services are not designed to be used by children under the age of 18.

Please see sections 4 to 8 below for further information concerning our use of personal data.

4. INTERNATIONAL TRANSFERS

Mahalo is a global company and, as such, we may transfer personal data to suppliers outside your home jurisdiction. Mahalo will take all reasonable steps to ensure that personal data is protected and any such transfers comply with applicable law.

Mahalo may transfer and maintain the personal data of individuals covered by this Notice on servers or databases outside the European Economic Area (EEA). Some of these countries may not have the equivalent level of protection under their data protection laws as in the EEA. Mahalo, acting as controller is liable for onward data transfers to third parties.

Mahalo complies with the EU-U.S. Privacy Shield Framework and Swiss-U.S. Privacy Shield Framework as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of personal data transferred from the European Union and Switzerland to the United States. Mahalo has certified to the Department of Commerce that it adheres to the Privacy Shield Principles. If there is any conflict between the terms in this privacy policy and the Privacy Shield Principles, the Privacy Shield Principles shall govern. To learn more about the Privacy Shield program, and to view our certification, please visit https://www.privacyshield.gov/

If you would like to obtain the details of such safeguards, you can request these from the Data Privacy Officer.

5. RETENTION PERIODS

We will retain your personal data for as long as required to perform the purposes for which the data was collected, depending on the legal basis for which that data was obtained and/or whether additional legal/regulatory obligations mandate that we retain your personal data. We may also retain personal data for the period during which a claim may be made in relation to our dealings with you.

In general terms, this will mean that your personal data will be kept for the duration of our relationship with you and:

the period required by tax and company laws and regulations; and
as long as it is necessary for you to be able to bring a claim against us and for us to be able to defend ourselves against any legal claims. This will generally be the length of the relationship plus the length of any applicable statutory limitation period under local laws

In certain circumstances, data may need to be retained for a longer period of time, for example, where we are in ongoing correspondence or there is a continuing claim or investigation.

If you wish to obtain further information about the retention periods as applied to your personal data, you may find this in the retention schedule maintained by Mahalo or can contact the Data Privacy Officer.

6. DATA SUBJECT RIGHTS

Individuals have the following rights, in certain circumstances, in relation to their personal data:

Right to access personal data;
Right to rectify personal data;
Right to restrict the use of personal data;
Right to request that personal data is erased;
Right to object to processing of personal data;
Right to data portability (in certain specific circumstances); and
Right to lodge a complaint with a supervisory authority.

If you wish to exercise any of the above rights, please contact the Mahalo Data Privacy Officer. Such requests should include appropriate identity verification information (such as your name, address, email address or other information reasonably required).

Where we receive a request to exercise one of these rights, we shall provide information on the action we take on the request without undue delay and in any event within one month of receipt of the request. This may be extended by a further two months in certain circumstances, for example where requests are complex or numerous.

The information will be provided free of charge, except where requests are manifestly unfounded or excessive, in particular because of their repetitive character. In these circumstances we may charge a reasonable fee or may refuse to act on the request. We will advise an individual of any fees prior to proceeding with a request.

We may ask for additional information to verify an individual's identity before carrying out a request.

Where we do not carry out a request, we shall inform the individual without delay and within one month of receipt of the request, providing our reasons for not taking the action requested.

6.1 Right to access personal data

Individuals have the right to confirm the following with us:

Whether or not we process personal data about them
Certain specified information about the processing

Individuals also have a right to access the personal data and be provided with a copy.

6.2 Right to restrict processing of personal data

Individuals have the right to request that we restrict processing of their personal data where one of the following applies:

An individual contests the accuracy of the personal data. The restriction will apply until we have taken steps to verify the accuracy of the personal data;
The processing is unlawful but an individual does not want the personal data to be erased and requests restriction instead;
We no longer require the personal data for the purposes of processing, but it is still required by an individual in connection with a legal claim;
An individual has exercised their right to object to the processing. The restriction will apply until we have taken steps to verify whether we have compelling legitimate grounds to continue processing.

6.3 Right to object to processing of personal data

Where personal data is used to target marketing to an individual, they have the right to object to this at any stage.

An individual also has the right to object to processing of their personal data where the legal basis of the processing is our legitimate interests. We will have to stop processing until we are able to verify that we have compelling legitimate grounds for processing which override the individual's interests, rights and freedoms, or alternatively that we need to continue processing for the establishment, exercise or defense of legal claims.

6.4 Right to rectification of personal data

If an individual believes that the personal data we hold on them is inaccurate, they may request that it be amended. They may also request that incomplete personal data be completed, including by providing a supplementary statement.

6.5 Right to request erasure of personal data ("right to be forgotten")

An individual may also request the erasure of their personal data in certain circumstances, including the following (this is not an exhaustive list):

The personal data is no longer necessary in relation to the purposes for which they were collected or otherwise processed;
The processing was based on consent which has been withdrawn and there is no other legal basis for processing;
There are also certain exceptions where we may refuse a request for erasure, for example, where the personal data is required to comply with a legal obligation or for the establishment, exercise or defense of legal claims.

If an individual does request erasure of their personal data, this will potentially remove records which we hold for their benefit, such as their presence on a suppression list and they will have to contact us to provide personal data if they wish for us to hold this in future.

6.6 Right to Data Portability

Where we are relying upon the legal basis either of consent or that the processing is necessary for the performance of a contract to which an individual is a party, and that personal data is processed by automatic means (e.g. electronically), an individual has the right to receive all the personal data which they have provided to us in a structured, commonly used and machine-readable format and to transmit this to another controller directly, where this is technically feasible.

6.7 Supervisory Authority

An individual also has a right to lodge a complaint with a supervisory authority, in particular in the Member State in the European Union where they are habitually resident, where they work or where an alleged infringement of data protection laws has taken place.

7. MISCELLANEOUS

7.1 Security

We have put in place reasonable technical and organizational security measures designed to prevent the loss or unauthorised access of your personal data. We train our employees in the proper handling of personal data. However, whilst we have used our best efforts to ensure the security of your data, please be aware that we cannot guarantee the security of information transmitted over the Internet. If you have reasons to believe that your interaction with us is no longer secure, please immediately notify us of the problem by contacting us as set out below.

7.2 Links

Our Website may contain links to other "non-Mahalo" websites. We do not control and assume no responsibility for the content, security or the privacy policies and practices on those websites. Mahalo encourages all users to read the privacy policies of those sites to determine how they protect and use personal data.

7.3 Changes to this Notice

From time to time, we may change and/or update this Notice. If this Notice changes in any way, we will post an updated version on this website. We recommend you regularly review this website to ensure that you are always aware of our information practices and any changes to such. Any changes to this Notice will go into effect on posting to this page.

8. COOKIES AND SIMILAR TECHNOLOGIES

A cookie is a small text file which includes a unique identifier that is sent by a web server to the browser on your computer, mobile phone or any other internet enabled device when you visit an on-line site. Cookies and similar technologies are widely used to make websites work efficiently and to collect information about your online preferences. For simplicity, we refer to all these technologies as "cookies".

Some of our website pages may contain electronic images known as web beacons (also known as clear gifs, tags or pixels) that allow us to count users who have visited our pages. Web beacons collect only limited information, e.g. a cookie number, time and date of a page view, and a description of the page on which the web beacon resides. We may also carry web beacons placed by third party advertisers. These beacons do not carry any information that could directly identify you.

8.1 How do we use cookies?

We use cookies and other tracking technologies to customize content and advertising, provide social media features and to see how our visitors move through our website. We use this information to make decisions about ways to improve the services we offer you.

We may engage third party tracking and advertising providers such as those named below to act on our behalf to track and analyse your usage of our website through the use of cookies. These third parties collect, and share with us, usage information about visits to our website and, sometimes by correlating this information with other information (e.g. your IP address), measure and research the effectiveness of our advertisements, track page usage, help us target our recommendations and advertising, and track use of our recommendations and advertisements. These third parties may collect information, including personal data, about your online activities over time and across different websites and other online services. We do not control these third parties’ tracking technologies or how they may be used. You can find more information about cookies, behavioural advertising and online privacy at www.allaboutcookies.org or www.youronlinechoices.eu.

8.2 How do I reject cookies?

If you do not want to be tracked by Google Analytics cookies you can opt-out by installing a browser plug-in here: https://tools.google.com/dlpage/gaoptout/

At any time, you can prevent cookies from being set on your browser. For instructions on how to block, delete or disable any cookies, please consult your browser's 'Help' or 'Support' section. Please note that by deleting our cookies or disabling future cookies you may not be able to access certain areas or features of our website.

Please consult the following links for information on cookie management and blocking according to your browser:

You can also find more information and manage cookie storage at: www.youronlinechoices.eu