Privacy Policy

1Overview

Lean Lab Company Limited is a company, incorporated under the laws of Country of Malta, with a company number C 96476, registered with the Malta Business Registry (MBR) in the Country of Malta, member of the EU.

Lean Lab Company Limited values your privacy. We are committed to safeguarding the privacy of our employees, Customers, website visitors and job applicants.

This Privacy Policy has been prepared in order to explain how we collect, use, protect, and disclose information and data when you use Lean Lab Company Limited's website located at https://riskcherry.com or you apply for a vacant position.

This Privacy Policy outlines the responsibilities of Lean Lab Company Limited concerning the protection of Personal Information entrusted to the company by our Customers and Partners.

The Policy also explains your rights for managing your information preferences, including opting out of certain uses of your Personal Information (as defined below).

Lean Lab Company Limited's privacy practices are developed in accordance with applicable legislation relating to privacy and information security. If you have any requests concerning your personal information or any queries with regard to these practices, please do not hesitate to contact our Data Protection Officer at privacy@riskcherry.com.

2What Personal Data Do We Collect?

Under the GDPR (Article 4.1), 'Personal Data' is defined as any information relating to an identified or identifiable Individual. It may include obvious identifiers like your name but also identification numbers, online identifiers and/or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person.

'Special category data' includes data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and genetic data, biometric data, data concerning health or data concerning a person's sex life or sexual orientation.

Every time you visit our website, move from page to page, read pages, or download content onto your computer, we learn which pages are visited and what content is downloaded. However, this is measured only in aggregate and not on an individual basis.

When you send us an e-mail or ask us to respond to you by e-mail, we learn your e-mail address and the information that you have included in the email form shown on our website.

Every time you apply to one of the vacant positions, you send us your CV and we learn everything you have chosen to include in it. We may collect additional information from or about you when you communicate with us, contact our customer support teams or respond to a survey.

3Purpose And Legal Basic For Collecting and/ or Processing Personal Data

We collect and process personal data based on one or more of the following legal bases:

• Consent: the individual has given clear consent for us to process their personal data for a specific purpose;
• Contract: the processing is necessary for a contract we have with the individual or their organization, or because they have asked us to take specific steps before entering into a contract;
• Legal obligation: the processing is necessary for us to comply with the law (not including contractual obligations);
• Vital interests: the processing is necessary to protect someone's life.

We use the aggregate statistical information to determine how many people visit our website and which sections of the site are visited most frequently. This helps us to know what type of information is most popular so that we can improve our website and make it easier for you to access this information.

We record the statistical information on the number of visitors to our website but no information about you in particular is kept or used.

We use the data you have included in your CV for Recruitment purposes.

In relation to the data we gain when you email us, we may use your e-mail address to acknowledge your comments and/or reply to your questions and we may store your communication and our reply in case we need to correspond at a later date.

We will not provide your e-mail address to anyone. You can withdraw your consent at any time and free of charge. Please refer to the section on " What Are Your Rights" or "Contact us" for more information on how to do that.

4Do We Share Your Personal Data?

We may share your Personal Data or information about you with other parties for Lean Lab Company Limited's business purposes or as permitted or required by law, including:

• if we need to do so to comply with a law, legal process or regulations;
• to law enforcement authorities or other government officials, or other third parties pursuant to a subpoena, a court order or other legal process or requirement applicable to Lean Lab Company Limited;
• if we believe, in our sole discretion, that the disclosure of Personal Data is necessary or appropriate to prevent physical harm or financial loss or in connection with an investigation of suspected or actual illegal activity;
• to protect the vital interests of a person;
• to investigate violations of or enforce a user agreement or other legal terms applicable to any Service;
• to protect our property, Services and legal rights;
• to facilitate a purchase or sale of all or part of Lean Lab Company Limited's business;
• to help assess and manage risk and prevent fraud against us, our Users and fraud involving our Sites or use of our Services, including fraud that occurs at or involves our business partners, strategic ventures, or other individuals, and merchants;
• to companies that we plan to merge with or be acquired by; and
• to support our audit, compliance, and corporate governance functions.

We may disclose some Personal Information between two or more of our group companies; including companies in other countries, inside the European Union, in order to ensure that we are dedicating the appropriate group resources to Customer requirements, as well as for certain of our business purposes, such as for internal record keeping, accounting and regulatory compliance.

5Why Do We Retain Personal Data?

We retain Personal Data in an identifiable format for the least amount of time necessary to fulfill our legal or regulatory obligations and for our business purposes.

We may retain Personal Data for longer periods than required by law if it is in our legitimate business interests and not prohibited by law.

The cookies we use have defined expiration times; unless you visit our Site within that time, the cookies are automatically disabled and retained data is deleted.

6International Transfers

Our operations are supported by a network of computers, cloud-based servers, and other infrastructure and information technology, including, but not limited to, third-party service providers.

The parties mentioned above may be established in jurisdictions other than your own and outside the European Economic Area. These countries do not always afford an equivalent level of privacy protection.

We have taken specific steps, in accordance with EEA data protection law, to protect your Personal Data.

7What Are Your Rights?

Your principal rights under GDPR are:

• the right to access - You have the right to confirmation as to whether or not we process your Personal Data and, where we do, access to the Personal Data, together with certain additional information. That additional information includes details of the purposes of the processing, the categories of Personal Data concerned and the recipients of the Personal Data. Providing the rights and freedoms of others are not affected, we will supply to you a copy of your personal data.
• the right to rectification - You have the right to have any inaccurate Personal Data about you rectified and, taking into account the purposes of the processing, to have any incomplete Personal Data about you completed.
• the right to erasure - In some circumstances you have the right to the erasure of your Personal Data without undue delay. Those circumstances include:
• the Personal Data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; you withdraw consent to consent-based processing; you object to the processing under certain rules of applicable data protection law; the processing is for direct marketing purposes; and the Personal Data have been unlawfully processed. However, there are exclusions of the right to erasure. The general exclusions include where processing is necessary: for exercising the right of freedom of expression and information; for compliance with a legal obligation; or for the establishment, exercise or defense of legal claims.

the right to restrict processing - In some circumstances you have the right to restrict the processing of your Personal Data. Those circumstances are:

• you contest the accuracy of the Personal Data; processing is unlawful but you oppose erasure; we no longer need the Personal Data for the purposes of our processing, but you require Personal Data for the establishment, exercise or defense of legal claims; and you have objected to processing, pending the verification of that objection.
• the right to object to processing - You have the right to object to our processing of your personal data on grounds relating to your particular situation, but only to the extent that the legal basis for the processing is that the processing is necessary for the performance of a task carried out in the public interest or in the exercise of any official authority vested in us; or the purposes of the legitimate interests pursued by us or by a third party. If you make such an objection, we will cease to process the Personal Information unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is for the establishment, exercise or defense of legal claims.
• the right to data portability - In that context you have the right to receive the Personal Data you have provided to Lean Lab Company Limited in a structured, commonly used and machine readable format. It also gives you the right to request that we transmit this data directly to another controller. The right to data portability only applies when:
• our lawful basis for processing this information is consent or for the performance of a contract; and if we are carrying out the processing by automated means (excluding paper files).

the right to complain to a supervisory authority - If you consider that our processing of your personal information infringes data protection laws, you have a legal right to lodge a complaint with a supervisory authority responsible for data protection. You may do so in the EU member state of your habitual residence, your place of work or the place of the alleged infringement.

• the right to withdraw consent - To the extent that the legal basis for our processing of your personal information is consent, you have the right to withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing before the withdrawal.

8Can Children Use Our Services?

The Site is intended for users who are of legal age within the country they access the Site from. We do not knowingly collect Personal Information from children under the age of 14 or young adults under the age of 18. If we become aware that we have inadvertently received Personal Information from a child under the age of 14 or a young adult under the age of 18, we will delete such information from our records without any delay.

9Do We Process Special Categories Of Personal Data?

Lean Lab Company Limited does not process any personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying an individual, data concerning health or data concerning an individual's sex life or sexual orientation.

10How Do We Protect Your Personal Data?

We maintain technical, physical, and administrative security measures designed to provide reasonable protection for your Personal Data against loss, misuse, unauthorized access, disclosure, and alteration. The security measures include firewalls, data encryption, physical access controls to our data centers, and information access authorization controls.

We are not responsible for protecting any Personal Data that we share with a third-party based on an account connection that you have authorized.

11Cookies

When you visit this website, we may send one or more cookies - a small text file containing a string of alphanumeric characters - to your computer that uniquely identifies your browser. A cookie may also convey information to us about how you use the website (e.g., the pages you view, the links you click, or your preferred browsing language), and allow us to provide a better web browsing experience to you over time.

The cookies we send do not give us access to your computer or allow us to collect or process any personal information. You can also learn more about cookies by visiting www.allaboutcookies.org which includes additional useful information on cookies and how to block cookies using different types of browser. Some of our Service Providers may use their own cookies in connection with the services they perform on our behalf.

With your consent, we use Google Analytics, provided by Google Ireland Limited, to understand how visitors use the Site, such as which pages are viewed and how visitors arrive. Google Analytics sets cookies named _ga and _ga_ followed by an identifier, which expire after up to 2 years. They are not set, and Google Analytics is not loaded, unless you choose "I agree, allow analytics" on the privacy banner. Advertising features and Google signals are switched off. You can withdraw consent at any time from the Cookie preferences link at the foot of every page, which also removes those cookies.

12What Else Should You Know?

If we decide to change this Privacy Policy, we will inform you by posting the revised Privacy Policy on the Site. Those changes will become effective on the revision date, shown in the revised Privacy Policy.

13Contact Us

You may contact us if you have general questions or concerns about this Privacy Policy and supplemental notices or the way in which we handle your Personal Data. If you want to execute any of your rights, as defined above, do not hesitate to contact us.

Our Data Protection Officer can be contacted at privacy@riskcherry.com