1. INTRODUCTION

1. This Privacy Notice explains the types of personal data ZDHC may collect about you when you interact with the ZDHC Group (this Privacy Notice applies to the activities of the ZDHC Group including Stichting ZDHC Foundation, Implementation Hub B.V. and any other wholly or majority owned legal entities of either, hereafter "ZDHC Group" and or "ZDHC"). It also explains how ZDHC collects, stores and handles personal data, and keeps it safe.
2. While this Privacy Notice contains much information, ZDHC's aim is to fully inform you on what personal data ZDHC collects, how ZDHC uses your data and importantly your rights in connection with your personal data. We hope the following Sections will answer any questions you have but if not, please get in touch with us. See Section 3 "WHO WE ARE" for details of how to get in contact with us.
3. It is likely that ZDHC will need to update this Privacy Notice from time to time. ZDHC will notify you of any significant changes, and you are welcome to come back and check it whenever you wish.

2. PRIVACY POLICIES OF OTHER WEBSITES

The ZDHC main organisational website (roadmaptozero.com) contains links to other websites. ZDHC Privacy Notice applies only to ZDHC website(s) and platforms, so if you click on a link to another website, you should read the applicable privacy notice.

3. WHO WE ARE

1. The mission of the ZDHC Group is to lead the global value chain to achieve the highest standard for sustainable chemical management, driving resource efficiency and circularity. The ZDHC Foundation oversees the implementation of the Roadmap to Zero Programme and is a global industry collaboration of brands, value chain affiliates, and associates within the sports, fashion, luxury and outdoor industry. Its vision is a world in which better chemistry leads to the protection of life, land, air and water. ZDHC takes a holistic approach to sustainable chemical management and enables tangible progress in the wider industry through a number of reference guides, practical tools, capacity building and innovation projects. More information about ZDHC at www.roadmaptozero.com.
2. 2. In connection with these activities, ZDHC collects and processes different kinds of information and data from a range of different stakeholders including, but not limited to ZDHC Suppliers, ZDHC Sigantores, ZDHC Brands and ZDHC Friends, industry partners and individuals acting on behalf of those organisations. With regard to the personal data ZDHC collects and processes, ZDHC acts as a data controller. As such ZDHC is fully responsible for compliance with the requirements of Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (also known as "GDPR" and referred to as such hereinafter) and places outmost importance on adhering to the requirements and data protection standards set out in the GDPR.
3. ZDHC's Full Contact Details:
   • Stichting ZDHC Foundation
   • Oudezijds Voorburgwal
   • 316-B, 1012 GM Amsterdam
   • The Netherlands
   • E-Mail: legal@zdhc.org

4. ZDHC'S BASIS FOR PROCESSING PERSONAL DATA

1. The GDPR sets out a number of different reasons for which an organisation may collect and process your personal data, including the following:
2. Consent:
3. In specific situations, ZDHC can collect and process your data with your consent. For example, when you tick (check or select) a box to receive e-mail newsletters. When collecting your personal data, ZDHC will always make clear which data is necessary in connection with particular activities, platforms and solutions. You also have the possibility to opt out at any time.
4. Contractual obligations:
5. In certain circumstances, ZDHC needs your personal data to comply with its contractual obligations. Information such as your name, contact details or place of work may be needed as part of creating a contract with one of the ZDHC Group entity.
6. Legal compliance:
7. If the law requires, ZDHC may need to collect and process your personal data. For example, ZDHC may need to hold onto your name, address, organisation data, and information on payments made to any of the DHC Group entities for auditing and tax purposes.
8. Legitimate interest:
9. In specific situations, ZDHC may require your data to pursue its legitimate interests in a way which might reasonably be expected as part of operating the ZDHC Group activities and any related activities and serviceswhich does not materially impact your rights, freedom or interests. For example, if you set up an account in ZDHC event registration tool and purchase an event ticket from ZDHC, ZDHC will:
   • collect your address details and VAT number to generate an invoice;
   • pass your name and job title onto a printer for printing an event name badge for attending an event ZDHC is hosting;
   • use your e-mail address details to send you the event agenda and any updates on the event;
   • ask for your feedback after the event.

5. IN WHICH INSTANCES ZDHC COLLECTS YOUR PERSONAL DATA

1. ZDHC collects your personal data in a range of circumstances, amongst others:
   When you visit ZDHC websites and platforms, and use your user account to:
   • Participate in ZDHC Group offered programmes, platforms and solutions e.g. assessment platforms such as the Leaders to Zero Programmes; stakeholder management platforms for Signatories and ZDHC Approved Solution Providers; and collaboration/engagement platforms such as the ZDHC Intranet.
   • The ZDHC Submission Platform, and other platforms such as the ZDHC Supplier Platform.
   • Buy tickets to and participate in an event, training or meeting, for example the ZDHC Annual Meeting, other ZDHC Group Meetings or other events.
2. When you create an account with ZDHC on ZDHC platforms (or other systems) and/or when you update or change your personal details in said platforms.
3. When your organisation applies to become and, if approved becomes, one or more of the following types of organisations, ZDHC requests personal contact information which is in support of the organisational information and which is necessary for efficient management of (non-exhaustive list):
   • ZDHC Signatories or Friends of ZDHC;
   • ZDHC Signatory Approved Solution Providers such as ZDHC Approved Training Providers or ZDHC Approved Wastewater Laboratories.
4. When you download or install any apps ZDHC works with.
5. When you register to attend a ZDHC hosted webinar or other virtual meeting or event being hosted remotely, digitally.
6. When you contact ZDHC by any means with queries, complaints etc.
7. When you ask one of ZDHC staff member or other relevant stakeholders to send you information or answer a query on ZDHC activities including and not limited to ZDHC Roadmap to Zero Programme or Implementation Hub activities, platforms and solutions.
8. When you choose to complete any ZDHC surveys ZDHC sends to you and requests you to complete.
9. When you agree to collaborate on creating a (case) study, project or any other marketing material, or participate in a pilot.
10. When you download the official "Detoxing the Fashion Industry for Dummies” book.
11. When you use and interact with any of our Artficial Intelligence ("AI") Chatbots on one of ZDHC Platforms (see Section 13 "WHAT IS ARTIFICAL INTELLIGENCE AND HOW ZDHC USES IT" for more information).
12. ZDHC also wants to be clear that ZDHC does not collect the following personal data: when you engage with us on ZDHC's social media channels; about children; the great majority of personal data falling with the following categories of sensitive data: physiological data, mental identity, economic identity, social identity, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, sex life, sexual orientation, genetic data, biometric data or criminal offences/convictions; sell personal data to any third parties.

6. WHAT PERSONAL DATA ZDHC COLLECTS

1. If you have a web account with ZDHC, e. g. on any of the following (non - exhaustive list) ZDHC Gateway, ZDHC Supplier Platform, ZDHC Academy, ZDHC Solution Provider Platform, the ZDHC Intranet, ZDHC Glossary or Roadmap Event Platform; ZDHC will collect your name, billing/delivery address, e-mail and telephone number. For your security and to reset your password (when requested by you) ZDHC also keeps an encrypted record of your login password.
2. Details of your interactions with ZDHC through e-mail, face to face, telephone/conference calls/webinars/virtual meetings and events will be stored on ZDHC customer relationship management system.
3. When you make a purchase on ZDHC event tool, ZDHC will see some encrypted information on your credit or payment card number.
4. Where the law requires this, copies of documents you provide to ZDHC to prove your age or identity for example through your passport/driver's licence. This is likely to include details of your full name, address, date of birth and a facial image, gender and nationality. All such provided data is not stored by ZDHC and is deleted after having been used, and,only for any potential legally required purposes.
5. Details of your visits to ZDHC websites or applications by way of an IP address (so-called metadata).
6. Information gathered by the use of cookies in your web browser (see Section 12 "WHAT COOKIES ARE AND HOW ZDHC USES THEM" for more information).

7. WHY AND HOW ZDHC USES YOUR PERSONAL DATA

1. ZDHC wants to give you the best possible experience of dealing with the ZDHC Group. One way to achieve that is to create a detailed picture of you by combining the data collected from you. ZDHC then uses this to offer you opportunities to engage and/or collaborate that are most likely of interest to you. By gathering a certain amount of information, ZDHC can communicate and engage with you more effectively. The data privacy law allows this as part of ZDHC's legitimate interest in understanding ZDHC's stakeholders and providing the highest levels of service.
2. If you wish to change how ZDHC uses your data, you will find details about how to do that in Section 15 "WHAT YOUR RIGHTS ARE UNDER THE GDPR".
3. If you choose not to share your personal data with ZDHC or refuse certain contact permissions, ZDHC might not be able to provide some services. For example, if you have asked ZDHC for updates on events, but withdraw your e-mail address data, may not be able to provide you this information. Or if you have registered to attend a ZDHC Group webinar or digitally hosted meeting or event and then removed contact details through which we would send you the link to join it.
4. Here is some more specific information on how ZDHC will use your personal data and why:
5. To process any orders you make to attend a ZDHC Group hosted or co-hosted paid for event by using ZDHC Group event registration tools. If ZDHC does not collect your personal data during checkout, ZDHC will not be able to process your order and comply with our legal obligations. Your details may need to be passed to a trusted third party to provide a payment gateway for you to purchase an event ticket. ZDHC may keep your details for a reasonable period afterwards only to fulfil any contractual obligations such as refunds.
6. To respond to your queries, refund requests and complaints. Handling the information you send enables ZDHC to respond. ZDHC may also keep a record of these to inform any future communication with us and to demonstrate how ZDHC communicated with you throughout. ZDHC does this on the basis of our contractual obligations to you, ZDHC's legal obligations and ZDHC's legitimate interests in providing you with the best service and understanding how ZDHC can improve our service based on your experience.
7. To protect ZDHC's business and your account from fraud and other illegal activities. This includes using your personal data to maintain, update and safeguard your account. ZDHC will also monitor your browsing activity to quickly identify and resolve any problems and protect the integrity of ZDHC's websites. ZDHC will do this on the basis of legitimate interest.
8. To process payments and to prevent fraudulent transactions. ZDHC does this on the basis of legitimate business interests. This also helps to protect ZDHC's customers from fraud.
9. If ZDHC discover's any criminal activity or alleged criminal activity, ZDHC will process this data for the purposes of preventing or detecting unlawful acts.
10. ZDHC always strives to protect the brand equity of any organisations who support the work of the ZDHC Group and will act immediately in the event of a breach of ZDHC Group guidelines thereof.
11. With your consent, ZDHC will use your personal data, preferences and details of your transactions to keep you informed by e-mail, web, telephone or otherwise about relevant events, meetings, sponsorships and so forth that may be of interest to you.
12. To send you communications required by law or which are necessary to inform you about ZDHC's changes to the services ZDHC provides. For example, updates to this Privacy Notice, and legally required information relating to your activities with the ZDHC Group. These messages will not include any promotional content and do not require prior consent when sent by e-mail or text message. If ZDHC does not use your personal data for these purposes, ZDHC would be unable to comply with ZDHC's legal obligations.
13. To develop, test and improve the systems, services and offerings ZDHC provides to you. ZDHC will do this on the basis of ZDHC's legitimate business interests. For example, ZDHC will record your browser’s Session ID to help ZDHC understand more when you leave us online feedback about any problems you are having.
14. To comply with ZDHC's contractual or legal obligations to share data with law enforcement. For example, when a court order is submitted to share data with law enforcement agencies or a court of law.
15. To send you survey and feedback requests to help improve ZDHC's services and activities. These messages will not include any promotional content and do not require prior consent when sent by e-mail. ZDHC has a legitimate interest to do so as this helps make ZDHC's products or services more relevant to you. You are free to opt out of receiving these requests from ZDHC at any time by updating your preferences in your online account.
16. To build a detailed picture of your preferences and to inform our business decisions, ZDHC will combine data captured from across ZDHC and third parties such as ZDHC's data processors and as described in Section 6 "WHAT PERSONAL DATA ZDHC COLLECTS". ZDHC does this on the basis of legitimate business interest. For example, by combining this data, this will help ZDHC decide which activities or content to share with you.
17. Sometimes, ZDHC will need to share your details with a third party who is providing a service (such as a payment gateway). ZDHC does so to maintain ZDHC's (contractual) obligation to you – for example to host and deliver a paid for event. Without sharing your personal data, ZDHC would be unable to fulfil your request.

8. COMBINING YOUR PERSONAL DATA FOR DIRECT MARKETING

1. ZDHC wants to send you information most relevant to your interests at particular times. To help ZDHC form a better, overall understanding of your needs, ZDHC combines your personal data gathered across ZDHC Group as described above, for example your event ticket purchasing history. For this purpose, ZDHC combines the data that ZDHC collects directly from you with data that ZDHC obtains from third parties to whom you have given your consent to pass that data onto us. By doing so, ZDHC practices automated decision-making within the meaning of GDPR.
2. If you have agreed to receive marketing, you can always opt out later. You have the right at any time to stop ZDHC from contacting you for marketing purposes or giving your data to other members of the ZDHC Group.
3. If you no longer wish to be contacted for marketing purposes, please click here.

9. HOW ZDHC PROTECTS YOUR PERSONAL DATA

1. ZDHC knows that data security matters to all of ZDHC's stakeholders. ZDHC treats your personal data with the utmost care and takes all appropriate steps to protect it.
2. ZDHC secures access to all transactional areas of the ZDHC intranet and apps using “https” technology.
3. Access to your personal data is password-protected, and sensitive data such as payment card information is secured and tokenised to ensure it is protected.
4. ZDHC monitors its system for possible vulnerabilities and attacks, continuously enhances its data protection processes and carrys out penetration testing to identify ways to further strengthen security.

10. HOW LOND ZDHC KEEPS YOUR PERSONAL DATA

1. Whenever ZDHC collects or processes your personal data, ZDHC will only keep it for as long as is necessary for the purpose for which it was collected. Put another way, ZDHC will not hold onto or store personal data that is no longer needed.
2. At the end of an appropriate and reasonable retention period, your data will either be deleted completely or anonymised, for example by aggregation with other data so that it can be used in a non-identifiable way for statistical analysis and business planning.
3. Here are some examples of customer data retention periods:
   • Event Tickets - when you buy an event ticket, ZDHC will keep the personal data you give us for a maximum of one year so ZDHC can comply with ZDHC's legal and contractual obligations.
   • Newsletter Subscriptions - when you have a regular subscription with ZDHC Group, ZDHC will keep the personal data you give us for a maximum of three years so ZDHC can comply with any legal and contractual obligations.

11. WITH WHOM ZDHC SHARE YOUR PERSONAL DATA

1. ZDHC sometimes shares your personal data with trusted third parties such as contracted data processors. For example, payment gateways. Here is the policy ZDHC applys to these organisations to keep your data safe and protect your privacy:
2. ZDHC provides only the information they need to perform their specific contractually agreed services.
3. They may only use your data for the exact purposes ZDHC specifies in ZDHC's contract with them.
4. ZDHC works closely with them and monitor their activities to ensure your privacy is respected and protected at all times.
5. If ZDHC stops using their services, any of your data held by them will either be deleted or rendered anonymous
6. Examples of the kind of third parties ZDHC works with are:
   1. IT companies who support ZDHC's websites, platforms and other business systems.
   2. Operational companies such as delivery couriers.
   3. Companies who help ZDHC manage ZDHC's electronic communications with you or through whom ZDHC delivers virtually hosted online ZDHC Group meetings and events.
   4. Payment gateway providers to facilitate handling payments for event tickets and other payments within ZDHC's platforms and services.
7. ZDHC generally does not share your data with third parties for their own purposes and when ZDHC does, it is in very specific circumstances, for example:
   • With your consent, given at the time you supply your personal data, ZDHC may pass that data to a third party such as a collaboration partner for their direct marketing purposes. For example, if ZDHC runs a joint event with another party, and you agree to receive direct communications from them e.g. following the Cascale-ZDHC Manufacturer Forums.
   • For fraud management, ZDHC may share information about fraudulent or potentially fraudulent activity in ZDHC's premises or systems. This may include sharing data about individuals with law enforcement bodies.
   • ZDHC may also be required to disclose your personal data to the police or other enforcement, regulatory or Government body, in your country of origin or elsewhere, upon a valid request to do so. These requests are assessed on a case-by-case basis and take your privacy into consideration.
8. To help personalise your journey through ZDHC's websites and platforms ZDHC may transfer and your data to Service Providers located in countries outside of the EEA (European Economic Area).
9. ZDHC takes steps to ensure that your personal data receives an adequate level of protection, even if it is transferred to a country that does not provide the same level of data protection as the EEA. These steps include:
   • Standard Contractual Clauses (SCCs):
     ZDHC uses standard contractual clauses approved by the European Commission, which provide safeguards for personal data transferred outside the EEA.
   • Data Protection Agreements:
     ZDHC has agreements in place with ZDHC's service providers in the U.S. to ensure that your personal data is protected in compliance with GDPR standards.
   • Privacy Shield:
     Where applicable, ZDHC may rely on Privacy Shield certification for data transfers to the U.S.A. in storing your data with ZDHC's Service Providers.

12. WHAT COOKIES ARE AND HOW ZDHC USES THEM

1. Cookies are text files placed on your computer to collect standard Internet log information and visitor behavior information. When you visit ZDHC's websites and platforms, ZDHC may collect information from you automatically through cookies or similar technology.
2. For further information, visit allaboutcookies.org.
3. ZDHC uses Cookies in a range of ways to improve your experience on ZDHC's websites, including understanding how you use ZDHC's websites and platforms and which preferences you have in using ZDHC's website and improving your experience on ZDHC's websites and platforms.
4. What Types of Cookies ZDHC Uses:
   1. There are a number of different Cookies that ZDHC's websites and platforms use. ZDHC uses Cookies for example the following purposes:
   2. Functionality:
      ZDHC uses these Cookies so that ZDHC recognises you on ZDHC's websites and platforms and remembers your previous preferences. A mix of first-party and third-party Cookies are used.
   3. Analytics:
      ZDHC uses these Cookies to collect information about your visit to ZDHC's webistes and platforms, the content you viewed, the links you followed and information about your browser, device, and your IP address. ZDHC sometimes shares some limited aspects of this data with third parties for website improvement purposes with selected partners.
5. How You Can Manage Your Cookies
   You can select your browser not to accept cookies, and the website referred to tells you how to remove Cookies from your browser. However, in a few cases, some of ZDHC's website features may not function as a result.
6. Cookie Information
   One of the Cookie services ZDHC uses is Google Analytics. When using Google Analytics, Google is the data processor and does not use the information for their own purposes. The information is stored at Google’s servers. These are located in the USA, where the information is protected by the EU standard contractual clauses (SCCs), which you may read more about here: https://policies.google.com/privacy/frameworks?hl=en&gl=de. The legal basis for the use of Cookies is your consent through your web browser settings.

13. WHAT IS ARTIFICAL INTELLIGENCE AND HOW ZDHC USES IT

1. Artificial Intelligence ("AI") refers to technology that enables computers and systems to perform tasks that typically require human intelligence. This includes data analysis, pattern recognition, and decision-making processes.
2. How ZDHC Uses AI
   At ZDHC, we utilise AI to enhance ZDHC's services and improve user experience. As an example, ZDHC may use AI for the following purposes:
   • Data Analysis:
     To analyse user data and interactions to better understand ZDHC's audience and improve ZDHC's offerings.
   • Personalisation:
     To tailor ZDHC's communications and services to better meet the needs and preferences of ZDHC's users based on their behavior and interactions with ZDHC's websites and platforms.
   • Customer Support:
     To provide automated responses to common queries (for example via an AI Chatbot), improving response times and efficiency. Fraud Detection: To identify and prevent fraudulent activities by analyzing patterns and anomalies in user behavior.

14. DATA PROCESSING AND PRIVACY

1. When ZDHC uses AI, we ensure that any personal data processed is done in compliance with applicable data protection laws, including the GDPR and the Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence ("AI Act"). ZDHC takes measures to safeguard your privacy and ensure that AI systems are designed to minimise any impact on your personal data.
2. If you have any questions about how ZDHC uses AI or the implications for your personal data, or if you wish to exercise your rights under applicable data protection laws and as laid out in Section 15 "WHAT YOUR RIGHTS ARE UNDER THE GDPR", please contact ZDHC at deschrijver@zdhc.org and legal@zdhc.org.

15. WHAT YOUR RIGHTS ARE UNDER THE GDPR

1. Applicable data protection legislation gives you various rights related to the personal data ZDHC has collected about you and use in ZDHC's processing in connection with ZDHC's services.
2. You have the following data protection rights. Please note, these rights are not absolute and in certain cases are subject to conditions set out in applicable law:
   • Access:
     You have the right to request information about how ZDHC processes your personal data and to obtain a copy of that personal data.
   • Rectification:
     You have the right to request the rectification of inaccurate personal data about you and for any incomplete personal data about you to be completed.
   • Objection:
     You have the right to object to the processing of your personal data, which is based on ZDHC's legitimate interests.
   • Right to erasure:
     You have the right to request the right to erasure of your personal data (subject to certain conditions).
   • Automated decision-making:
     You have the right not to have a decision made about you that is based solely on automated processing if that decision produces legal effects about you or significantly affects you. We do not use automated individual decision-making, such as profiling.
   • Restriction:
     You have the right to ask ZDHC to restrict ZDHC's processing of your personal data, so that ZDHC no longer processes that information until the restriction is lifted.
   • Portability:
     You have the right to receive your personal data, which you have provided to ZDHC, in a structured, commonly used and machine-readable format and to have that information transmitted to another organisation in certain circumstances
   • Complaint:
     You have the right to file a complaint with the Dutch Data Protection Authority (DPA) if you have reason to believe that the processing of your personal data does not comply with applicable data protection legislation. See Ssection 18 "CONTACTING THE REGULATOR" below.

16. HOW YOU CAN STOP THE USE OF YOUR PERSONAL DATA FOR DIRECT MARKETING PURPOSES

1. There are several ways you can stop receiving direct communications e.g. ZDHC's newsletters from ZDHC:
   Click the “unsubscribe” link in any e-mail communication that ZDHC sends you. ZDHC will then stop any further e-mails from us. Please note that you may continue to receive communications for a short period after changing your preferences while ZDHC's systems are fully updated.

17. CHANGES TO ZDHC'S PRIVACY NOTICE

ZDHC keeps its Privacy Notice under regular review and places any updates on this webpage. This Privacy Notice was last updated on 23 October 2024.

18. CONTACTING THE REGULATOR

1. Finally, if you feel that your personal data has not been handled correctly by ZDHC, or you are unhappy with ZDHC's response to any requests you have made to ZDHC regarding the use of your personal data, you have the right to lodge a complaint with the Dutch Data Protection Authority (Dutch DPA):
   Postal address:
   Autoriteit Persoonsgegevens
   Postbus 93374
   2509 AJ DEN HAAG
   Telephone number: +31 70 888 85 00
   Fax: +31 70 888 85 01
   If you are based outside the Netherlands, you have the right to lodge your complaint with the relevant data protection regulator in your country of residence.

19. FURTHER QUERIES

1. We hope this Privacy Notice has been helpful in setting out the way ZDHC collects and handles your personal data and your rights to control it.
2. If you have any questions or concerns, please contact the ZDHC Data Protection Officer: Caroline De Schrijver, by sending an e-mail to both deschrijver@zdhc.org and legal@zdhc.org