Who? 

Categories of personal data 

Purposes of processing 

Legal basis 

Retention periods 

Customers and their employees  

First and last name, gender, address, phone number, e-mail address, job title, and place of work. 

To carry out ordinary customer relationship i.e.: administration of payments, general communication, management of day-to-day operations in accordance with legitimate and fair business practice (incl. planning, execution. and management of the cooperation; statistics, analyses). 

Performance of a contract (Article 6 (1) (b) GDPR). 

6 years from end of financial year after the last purchase of our products or services. (Customer Statements are held for 2 years from end of financial year after the last purchase of our products or services). 

To provide general customer service and support (including follow-up surveys). 

Legitimate interests in ensuring customer satisfaction and improving our products and services (Article 6 (1) (f) GDPR). 

To gain customer insights and knowledge of how our products and services are used (e.g., by sending satisfaction surveys or market surveys). 

To prevent fraud. 

Legitimate interests in protecting interests of the company (Article 6 (1) (f) GDPR). 

To establish, defend or assert legal claims. 

Prospective Customers and their employees 

First and last name, gender, address, phone number, e-mail address, title, and place of work. 

To create business leads. 

Legitimate interests in promoting ROCKWOOL and selling our products and services (Article 6 (1) (f) GDPR). 

5 years from obtained or your last interaction. 

For statistical purposes.  

Legitimate interests in measuring effectiveness of our activities (Article 6 (1) (f) GDPR). 

To pursue business leads. 

Taking steps prior to entering into a contract (Article 6 (1) (b) GDPR). 

Suppliers and their employees 

First and last name, company phone number, e-mail address, title, and place of work 

To carry out ordinary supplier relationship, i.e. administration of payments, general communication, management of day-to-day operations in accordance with legitimate and fair business practice (incl. planning, execution, and management of the cooperation, performing credit ratings, as well as carry out statistics, and analyses). 

Performance of a contract (Article 6 (1) (b) GDPR) – if you are self-employed, legitimate interest in performing the contract concluded with your employer (Article 6 (1) (f) GDPR). 

6 years from the end of the financial year to which the data relate if the data is considered accounting material.  (Supplier statement are only held for the current year in which they relate) 

6 years from obtained for non-accounting materials if there was no activity with the supplier. 

To source and locate suppliers. 

Legitimate interest in fulfilling business needs and conducting regular business activities (Article 6 (1) (f) GDPR). 

Visitors to physical locations 

First and last name, phone number, e-mail address, place of work, license plate, if applicable, date and time of your visit. 

To ensure the safety of our physical locations and to prevent and solve crime in our physical locations. 

Legitimate interest in ensuring safety on premises and to protect employees, visitors and property (Article 6 (1) (f) GDPR) and in accordance with HMRC rules and regulations. 

4 years from registration  

CCTV recordings (photos and videos) of your activity at our physical locations. 

Legitimate interest in ensuring safety on premises/physical locations and if necessary, protecting ROCKWOOL’s interests in criminal offence cases (Article 6 (1) (f) GDPR) and Information Commissioner’s CCTV Code of Conduct  

30 days from the day of the visit or as long as necessary in relation to an ongoing case. 

Receiver of e-mail and/or SMS - direct marketing. 

First and last name, gender (salutation), job title, place of work, e-mail address and/or phone number. 

To distribute marketing communication based on collected information and consent given. 

Legitimate interest in providing interested parties with direct marketing consent based on valid e-communication consent (Article 6 (1) (f) GDPR) and where relevant, the Privacy and Electronic Communications Regulations 2003 

Until the marketing consent has been withdrawn. A copy of the marketing consent will be stored 2 years after withdrawal for evidentiary purposes. 

Users of contact forms 

First and last name, email address, phone number, what your inquiry is about, date of your inquiry. 

To communicate with you to market, promote and sell ROCKWOOL products and services, as well as to provide support. 

If your inquiry concerns a (potential) formation of contract, the legal basis will be taking steps necessary to enter into an agreement or execute an existing one (Article 6 (1) (b) GDPR). 

If your inquiry does not concern a contract, the legal basis will be our legitimate interest in handling your inquiry, communication with you, marketing, promoting, and developing our products and services (Article 6 (1) (f) GDPR). 

2 years after obtained or from your last interaction if your personal data has not been used in connection with a purchase of our products or services. 

Account users 

First and last name, e-mail address, username, digital footprints, password as well/and as your profile activity. 

To deliver our services on the/our websites or apps to you. 

Performance of a contract for the provision of electronic services (Article 6 (1) (b) GDPR). 

Until closing of the account. 

To manage created user accounts; for statistical and analytical purposes. 

Legitimate interest in conducting statistics and analyses for the purpose of improving the user experience (Article 6 (1) (f) GDPR). 

Until closing of the account. 

Visitors of social media profiles      

Information available on your profile, including your name, gender, civil status, workplace, interests, image, and your city; whether you “like” or have applied other reactions to our profile; comments you leave on our posts; content your shared with ROCKWOOL with intention of interacting; 
that you have visited our profile; IP address. 

To improve our products and services, including our social media profiles and pages; 
for statistical and analytical purposes; 
to communicate with you if you engage with our content (comments, reviews, messages); to reshare content shared with us. 

* platform providers may process your personal data for their own purposes – please keep in mind this is outside of our control 

Legitimate interests in being able to communicate with and direct marketing communication to you on our social media profiles, as well as our legitimate interest in improving our products and services (Article 6 (1) (f) GDPR). 

Retention periods are set out by social media platform providers and can be found in their privacy policies: 

Meta (Instagram, Facebook) 

Google (YouTube) 

LinkedIn 

X (formerly Twitter) 

Description 

When? 

Categories
of personal
data 

Purposes of
processing 

Legal basis 

Retention
periods 

Cookies, pixels, social media tools and other technologies 

When you visit our websites or apps and have provided us with your cookie consent. 

IP-address, MAC address,
type of browser 
and devices, 
webpage that
led you to the
website or app,
search terms
entered in a
search engine
which led you
to our website,
browsing history,
click-behaviour
and use and
navigation of
websites and
apps* 

* the categories
depend on the
consent given
in the cookie
banner.
This can be
changed at
any time here 

To run
marketing
activities,
especially to
facilitate your
use of the
websites and
apps; for
service
development,
statistics, and
analysis; to
deliver
personalised
content and
search 

Legitimate
interests in
providing a
website and
app that
works,
marketing,
developing,
and
providing
statistics,
evaluating,
promoting
and selling
our products
and services
through
first-party
cookies,
(Article 6
(1) (f) GDPR).  

Consent for
the
processing
of personal
data in
relation to
marketing
cookies
and
third-party
statistical
cookies
(Article 6
(1) (a) GDPR).  

In addition,
we always
obtain a
valid cookie
consent with
exemption
of strictly
necessary
cookies
and other
technologies. 

Personal data
obtained
through cookies,
pixels, similar
technologies,
and social media
tools are deleted
as described in the
cookie declaration.

Facebook custom / lookalike audiences 

When you sign up for our newsletters, create a user account and accept our cookies, pixels, or similar technologies, we will in some cases send non-reversible hashed information to Facebook (Meta). 

E-mail
address and
in some
cases,
information
about your
interest in
one or more
of our
products 

To create
audiences for
subsequent
advertising
via Facebook. 

Legitimate
interest in
spreading
awareness
of our
products
and services,
including to
other persons
who may
have similar
interests in
our products
and services
(Article 6 (1)
(f) GDPR). 

Until you 
object to the
processing of
your personal
data.  

You can
change
settings in
your Facebook
account. 

Tracking of e-mail 

E-mails that we forward for marketing purposes based on your marketing consent or for events you have signed-up for may include tracking technologies that tell us whether you have received or opened the email or clicked a link in the e-mail. 

Tracking
information
on your
interaction
with our
e-mail. 

To deliver
personalised
content,
analysis,
and statistics. 

Legitimate
interests
in developing,
evaluating,
promoting,
and selling
our products
and services
(Article 6 (1)
(f) GDPR). 

If you
consented
to marketing:
until the
marketing
consent has
been
withdrawn.
A copy of
the marketing
consent will
be stored 2
years after
withdrawal for
evidentiary
purposes. 

If you did not
consent to
marketing:
2 years after
the/your last
interaction
(e.g., from
participating
in the event
or when
clicking on
e-mail). 

Categories of recipients  

Type of personal data  

Legal basis 

Public authorities, law enforcement authorities, courts, lawyers, and external auditors.  

Relevant information in relation to a specific dispute, including in some cases purchases made. 

Article 6(1)(f) GDPR (legitimate interest). 

Article 6(1)(c) GDPR (legal obligation to report descriptions of damage to authorities). 

Payment acquirers. 

Payment information. 

Article 6(1)(b) (contract) GDPR. 

Categories of personal data 

Personal data elements 

Purposes of processing 

Legal bases 

Retention periods 

Personal information 

First and last name, age, gender, citizenship, place of birth, date of birth, marital status, military or veteran status, nationality, signature, contact information (home address, phone number) 

To conduct the recruitment process 

 
To agree on conditions and to make an offer 

 
To verify your skills and qualifications  

Legitimate interest in running the recruitment process (Article 6 (1) (f) GDPR) 

Upon making the offer – taking necessary steps to enter into a contract (Article 6 (1) (b) GDPR) 

Legitimate interest in assessing if you fit the requirements (Article 6 (1) (f) GDPR) 

Consent for keeping your personal data in our database to be used for future recruitment processes (Article 6 (1) (a) GDPR) 

If you are offered a position with ROCKWOOL, your personal data obtained during the recruitment process will be stored in your employee file. 

If you are not offered a position, we will delete your data two (2) years after the end of the recruitment process.  

Education & Skills 

Academic transcripts, education and training history, educational degrees, grade, languages, results of assessments (e.g., personality tests, skills and abilities, etc.) 

References from previous and/or current employers 

Financial 

Back account information 

To reimburse you for agreed costs incurred in relation to the recruitment  

Consent for processing your personal data (Article 6 (1) (a) GDPR) 

If you are not offered a position, we will delete your data two (2) years after the end of the recruitment process.  

If you are hired information will be stored in your employee file. 

Other 

Photo and other non-mandatory information you include in your application 

Criminal background checks if required by the position you are applying for 

To conduct the recruitment process 

To comply with legal requirements for the position 

Consent for processing your personal data (Article 6 (1) (a) GDPR) 

Legal obligation (Article 6 (1) (c) GDPR) 

If you are offered a position with ROCKWOOL, your personal data obtained during the recruitment process will be stored in your employee file.  

If not, we will delete your data two (2) years after the end of the recruitment process.