This Notice covers how we collect and use your data, e.g.

• when you visit or use our consumer and customer-directed websites, applications or social media channels;
• purchase and use our products, services, systems or applications;
• subscribe to our newsletters or other marketing communications;
• provide to us your goods or services;
• contact our customer support;
• join our business events; or otherwise interact with us (directly or indirectly) in your capacity as consumer, business customer, partner, (sub) supplier, contractor or other person with a business relationship with us.

This Privacy Notice only applies to you in case we are considered to be the Data Controller for the processing of personal data. In case we are acting as a Data Processor, the Privacy Notice shared by  the Data Controller will govern your personal data.

As Signify, we are a global organization leader in the general lighting market with a unique competitive position and recognized expertise in the development, manufacturing and application of innovative lighting products, systems and services.

When this Notice mentions “we,” “us,” or the “Company,” it refers to the controller of your data under this Notice, namely the Signify affiliate with which you had, have or will have a business relationship or that otherwise decides which of your data are collected and how they are used, as well as Signify Netherlands B.V. (Registration number 17061150 - High Tech Campus 48, 5656 AE, Eindhoven, The Netherlands). Please note that the Signify affiliates include the subsidiary companies in which Signify N.V. has control, either through direct or indirect ownership. You may obtain a list of Signify affiliates by contacting the Signify Privacy Office (you will find the contact details in the below section “what are your choices?”).

Depending on who you are (e.g. customer, consumer, supplier, business partner, etc.) and how you interact with us (e.g. online, offline, over the phone, etc.) we may process different data about you. We may collect your data, for example, when you visit or use our consumer and customer-directed websites, applications or social media channels, purchase and use our products, services, web-based tools, mobile applications, systems, subscribe to our newsletters, install a software update, provide to us your goods or services, contact our customer support, join our business events, participate to our contests, promotions and surveys or otherwise interact with us. The data collected through your interaction with and use of our services and websites, may not, standing alone, reveal your specific identity or directly relate to an individual, but could, when combined with other data, link back to you.

Below you will find an overview of the categories of data that we may collect:

Information you provide to us directly

Lastly, if you visit our premises, for security reasons we might also record your data through video or other electronic, digital or wireless surveillance system or device (e.g. CCTV).

Information we collect automatically

When you visit or use our websites or applications, subscribe to our newsletters or otherwise interact with us through our digital channels, in addition to the information you provide to us directly, we may collect information sent to us by your computer, mobile phone or other access device. For example, we may collect: 

Information we may collect from other sources

To the extent permitted by applicable law, in addition to our websites, applications and other digital channels, we may also obtain information about you from other sources, such as public databases, joint marketing partners, social media platforms and other third parties.

Information we may aggregate from different sources to your profile

If you have indicated to us that you wish to receive personalized direct marketing communications, we might aggregate data from different sources (both internally and externally) to have a better understanding of your preference and interests, and be able to serve you with more relevant communications. You can always object to these activities by opposing  this. In particular, you can always opt-out from receiving marketing-related emails by following the unsubscribe instructions provided in each email. If you can sign-in to a Signify account, you might be given the option to change your communication preferences under the relevant section of our website or application. You can always contact us (you will find the contact details in the below section “What are your choices?”) to opt-out from receiving marketing-related communications.

When you visit or use our websites and/or apps we may register your IP address, browser type, operating system, referring website, your general geographic location as indicated by your IP address, web-browsing behaviour, app behavior and whether and how you interact with content available on our websites and within our apps. We use different methods to collect this information, including our own cookies and third-party cookies. For more information on how we use cookies and other tracking technologies, read our Cookie Notice. To the extent you have shared your consent, we may receive your location data or gain access certain data stored on your mobile phone, such as photographs, voice instructions and contacts.

For more information on how we use cookies and other tracking technologies, read our Cookie Notice (which can be found in the website of the Signify Privacy Center, see “Legal information” section). Via our cookie preference functionality, you are in control of your preferences.

We may use your data for different legitimate reasons and business purposes.

Below you will find an overview of the purposes for which we may process your data:

You may choose to participate in sweepstakes, contest games or other competitions (“Competition”) via our website. When you participate in a Competition, we use your data to allow you to participate, to identify you, to prevent/detect fraud and to fulfill the prize to you (if you win) and we consider the processing of this data in the above context to be necessary for the performance of the contract.  Please read the terms and conditions of the respective Competition for further information.

If we ask you to provide us with your data, but you chose not to, in some cases we will not be able to provide you with the full functionality of our products, services, systems or applications. Also, we might not be able to respond to requests you might have.

It is your responsibility to ensure that information you share with us does not violate any third party’s rights.

Signify Netherlands B.V. and other relevant Signify affiliates may send you regular promotional communications about their products, services, events and promotions.

Such promotional communications may use, amongst others, the “PHILIPS”, “HUE”, “SIGNIFY” and/or “INTERACT” brand and may be sent to you via different channels such as: email, phone, SMS text messages, postal mailings, third party social networks. Please find our current list of brands here.

We may also contact you regarding information, products, services, events and promotions from Signify as well as from other third-parties providers of products and services complementing our products and services that we believe can be relevant to you because of your usage of our products or to expand your functionality; mainly when we find this third-party has specific services or solutions to meet your needs, or to optimize your use of our products and services. We will not share your registration data with our trusted partner unless we have sufficient grounds to do so.

When permitted and/or required by applicable law or where we have your consent, to be able to tailor the communications to your preferences and behavior and provide you with the best, personalized experience, we may analyze and combine all information associated with your data and data about your interactions with us. We may also use this information to create segments of our audience showing which of our products and/or services users are interested in and track success of our marketing efforts. We may keep records of whether you open our electronic communication, as well as the links you click on our electronic communication.

When you interact or communicate on social media channels/pages/promotions and blogs (e.g. when you click on ‘like’ or ‘share’, when you post and share comments and when you submit ratings and reviews) your data is processed by a third party that provides social listening services to us. This means that the third party that provides social listening services will retain a copy of your online publicly available interactions to which the third party has provided us access. Your data we collect includes publicly available data provided in the social media context by you from the relevant social media provider via a third party that provides social listening services. We use your data to gain a general view of the opinion of people about us and our brands, to resolve issues and/or improve our products and services and/or start a promotional conversation with you. If you do not want to share this information with us as described above, do not interact with us on social media channels.

From our social media pages and campaigns, we receive visitor statistics. Although Signify and our social media service provider are responsible for those visitor statistics, the respective social media service provider is your primary point of contact and handles requests to exercise your rights and any complaints you may have. Where necessary, we assist, the respective social media service provider in responding to your requests or complaints. For more information on the personal data that we receive from social media network providers and how to change your settings, please check the websites and privacy policies of the social media network providers.

Customer Survey communications: We are constantly working to improve our services and to make them more in line with what customers want. That is why we can use your data (customer ID and e-mail address) to invite you for a customer or market research campaign. We can also have these investigations carried out by third parties. In this way you help us to become even better. We only send you these types of communications with your prior consent, unless this is not necessary according to the applicable law.

Solicited communications: In some instances, you might want Signify to inform you about a specific matter via electronic communications – but do not want to consent to our marketing communications. In these cases, we will communicate with you in regards to the solicitude you have made.

Administrative, service and transactional communications: You will always receive administrative, service and transaction communications from us, such as technical and/or security updates of our products, order confirmations, notifications about your account activities, and other important notices. You cannot opt-out from this type of communication.

• Your consent (only when legally required or permitted). If we rely on your consent as a legal basis for processing your data, you may withdraw your consent at any time;
• The necessity to establish a contractual relationship with you and to perform our obligations under a contract;
• The necessity for us to comply with legal obligations and to establish, exercise, or defend against legal claims;
• The necessity to pursue our legitimate interests, including:

o   To ensure that our networks and information are secure

o   To administer and generally conduct business within the Company

o   To prevent or investigate suspected or actual violations of law, breaches of a business customer contract, or non-compliance with the Signify Integrity code or other Signify policies;

o   To optimize or extend our marketing reach and communication relevance;

• The necessity to respond to your requests;
• The necessity to protect the vital interests of any person;
• Any other legal basis anyhow permitted by local laws.

We do not sell your personal data.  We also do not share any of your personal data except in the limited cases described here. If it is necessary for the fulfillment of the purposes described in this Notice, we may disclose your data to the following entities:

• Signify affiliates: due to our global nature, your data may be shared with certain Signify affiliates. Access to your data within Signify will be granted on a need-to-know basis;
• Service providers: like many businesses, we may outsource certain data processing activities to trusted third party service providers to perform functions and provide services to us, such as ICT service providers, consulting providers, shipping providers, payment providers, electronic communication service platforms, Competition service providers;
• Business partners: we may share your data with trusted business partners so they can provide you with the services you request, including chat service providers;
• Public and governmental authorities: when required by law, or as necessary to protect our rights, we may share your data with entities that regulate or have jurisdiction over Signify.
• Professional advisors and others: we may share your data with other parties including professional advisors, such as banks, insurance companies, auditors, lawyers, accountants, other professional advisors.
• Other parties in connection with corporate transactions: we may also, from time to time, share your data in the course of corporate transactions, such as during a sale of a business or a part of a business to another company, or any reorganization, merger, joint venture, or other disposition of our business, assets, or stock (including in connection with any bankruptcy or similar proceeding);
• Upon your request in case of a personal data portability request.

We may share anonymized information, reports and analyses based on anonymized information. We may disclose aggregated, anonymized information, and analyses and reports derived from such information with our service providers, suppliers, advertisers, merchants, consumer and market research companies and other organizations. This anonymized, non-personal information, may also be shared with other users to help them better understand their lighting usage compared to others in our community, raise awareness about safety issues, help us generally improve our system, or other informational purposes.  We take steps to keep this non-personal information from being associated with you, and we require our partners to do the same.

Due to our global nature, data you provide to us may be transferred to or accessed by Signify affiliates and trusted third parties from many countries around the world. As a result, your data may be processed outside the country where you live, if this is necessary for the fulfillment of the purposes described in this Notice.

If you are located in a country member of the European Economic Area, we may transfer your data to countries located outside of the European Economic Area. Some of these countries are recognized by the European Commission as providing an adequate level of protection. With regard to transfers from the European Economic Area to other countries that are not are recognized by the European Commission as providing an adequate level of protection, we have put in place adequate measures to protect your data, such as organizational and legal measures (e.g. binding corporate rules and approved European Commission standard contractual clauses). You may obtain a copy of these measures by contacting the Signify Privacy Office (you will find the contact details in the below section “What are your choices?”).

We keep your data for the period necessary to fulfill the purposes for which it has been collected (for details on these purposes, see above section “How do we use your data?”). Please keep in mind that in certain cases a longer retention period may be required or permitted by law. The criteria used to determine our retention periods include:

• How long is the data needed to provide you with our products or services or to operate our business?
• Do you have an account with us? In this case, we will keep your data while your account is active or for as long as needed to provide the services to you.
• Are we subject to a legal, contractual, or similar obligation to retain your data? Examples can include mandatory data retention laws in the applicable jurisdiction, government orders to preserve data relevant to an investigation, or data that must be retained for the purposes of litigation, or protection against a possible claim.

To protect your data, we will take appropriate measures that are consistent with applicable data protection and data security laws and regulations, including requiring our service providers to use appropriate measures to protect the confidentiality and security of your data.  Unfortunately, no data transmission or storage system can be guaranteed to be 100% secure. Depending on the state of the art, the costs of the implementation and the nature of the data to be protected, we put in place technical and organizational measures to prevent risks such as destruction, loss, alteration, unauthorized disclosure of, or access to your data. If you have reason to think that your interaction with us or your Data is no longer processed in a secure manner, please reach out to the Signify Privacy Office immediately in accordance with “What are your choices?” as described below.

We would like to remind you that it is your responsibility to ensure, to the best of your knowledge, that the data you provide us, are accurate, complete and up-to-date. Furthermore, if you share with us data of other people, it is your responsibility to collect such data in compliance with local legal requirements. For instance, you should inform such other people whose data you provide to us, about the content of this Notice and obtain their prior consent.

You have the right to:

• Confirmation: Obtain confirmation from us as to whether we process your personal data.
• Access: Obtain a copy of your personal data being processed by us.
• Rectification: Have your personal data rectified.
• Erasure: Have your personal data anonymized or erased.
• Restriction: Have your personal data restricted.
• Object to:

o   (General) the use of your personal data on grounds relating to your situation, unless we can demonstrate prevailing compelling legitimate grounds for the processing of your personal data.

o   (Direct marketing) receiving direct marketing communications. If you object to the processing of your personal data for direct marketing purposes, the relevant personal data shall no longer be processed for such purposes.

o   (Automated decision making) the use of your personal data which is based solely on automated personal data (including profiling), and which produces adverse legal or similarly significant effects concerning you.

• Data Portability: the right to receive your personal data in a structured, commonly used, and machine-readable format and have the right to transmit that personal data to another company.
• File a complaint or contact us at any time: with privacy-related questions and/or complaints regarding the application or violation of our Privacy Rules or Privacy Notice by us.

You also have the right to obtain a copy of our Signify Privacy Rules and make use of your third-party beneficiary rights and/or claim damages. Additionally, the General Data Protection Regulation also gives you right to lodge a complaint with your local supervisory authority. For more detailed information on your rights, please see our Signify Privacy Rules.

The above rights are not absolute and can be reasonably limited, for example when the exercise of such right by the adversely affects the rights and freedoms of others.

For any questions or reasonable inquiry related to the protection of your data in Signify or regarding this Notice in general, you can contact the Signify Privacy Office:

• Mail: Signify - Attn: Privacy Office – Basisweg 10, 1043 AP Amsterdam, the Netherlands; or
• Online: privacy request form

The California Consumer Privacy Act (hereafter: 'CCPA') and the California Privacy Rights Act (hereafter: ‘CPRA’) provide California consumer residents who reside in California with specific rights regarding their personal information (which we also refer to as personal data). In addition to the above this section describes your CCPA/CPRA rights and explains how to exercise those rights.

The following does not apply to de-identified or aggregated personal data or data publicly available.

In the execution of our services and/or when visiting our websites, we collect information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or device . The purposes for which we process your personal data can be found above under the section " HOW DO WE USE YOUR DATA?”. Information about retention periods can be found under the section “HOW LONG DO WE KEEP YOUR DATA??”.

We might have collected and/or disclosed for an aforementioned purpose the following categories of personal data from our consumers in the last twelve (12) months before the effective date of this Notice the following categories of personal data from you:

We disclose your data for a business purpose to the following categories of third parties:

• Signify group companies.
• Service providers.
• Third parties to whom we disclose your personal data in connection with products or services we provide to you, and to accomplish our business purposes and objectives as outlined in the notice.

We do not intentionally collect information from children under the age of sixteen (16) years as we do not offer services to them. Parents who set up a profile holding information about children under the age of sixteen (16) years can only do so by granting parental consent which consent choices can be changed by the adults in the family. We do not direct services to children under the age of thirteen (13) years old. As a result, we do not knowingly process data or information from children under thirteen 13 years old.

We do not respond to “Do Not Sell” requests as we do not sell your personal data to third parties. In the twelve months before the effective date of this Privacy Notice, we have not sold any personal data of Customers, as per the definition of the CCPA/CPRA.

After receiving your opt-in consent, we sometimes disclose personal data collected via cookies for cross-contextual behavioral advertising purposes, which may qualify as sharing your personal data under the CCPA/CPRA. To opt out, you can adjust your cookie preferences on our website to block our advertising cookies, or you can change your device settings to block cookies or install a third-party plugin to control how cookies interact with your device. For more information on how we use cookies and other tracking technologies, read our Cookie Notice.

• Right to Know": You may have the right to request that we disclose to you what personal data of yours we collect, use, and/or disclose. 
• "Right to Delete": You may have the right to request the deletion of your personal data collected or maintained by us. Depending on your Choices, certain offerings may be limited or unavailable. Upon verifying the validity of a deletion request, we will delete your personal data from our records and instruct any service providers or third parties to delete your information, when applicable. 
• “Right to Control Use”: You may have the right to control or limit the use of your personal data, including: 
• Right to Opt-Out of Sales/Sharing/cross-context behavioral advertising. 
• Right to Object to or Opt Out of automated decision-making/profiling. 
• Right to Opt-Out of processing/Limit Use of Sensitive personal data. 
• “Right of Access”: You may have the right to access your personal data, and to transmit it to another entity.  
• “Right of Correction”: You may have the right to request amendments to your personal data if it is inaccurate or outdated in any way. Upon verifying the validity of a verifiable correction request, we will use commercially reasonable efforts to correct your personal data as directed, considering the nature of the personal Data and the purposes of maintaining your personal data.

You may also make a verifiable request to exercise your rights by contacting us via this link or the toll-free telephone 1-800-555-0050.

Please note that the above rights are not absolute, and we may be entitled to refuse requests, wholly or partly, where exceptions under the applicable law apply. If you have questions about the foregoing or how to execute your rights in our Notice or specifically with regard to categories and specific data processed, categories of sources from which your data is collected by us, categories of Third Parties with whom we share your data, and/or the business or commercial purpose for collecting please contact our Privacy Office (see section "WHAT ARE YOUR CHOICES?"). 

If we cannot verify you (or your authority to act on behalf of another person) we have the right to deny the requests. While verifying your identity we shall generally avoid requesting additional information from you for verification purposes. If, however, we cannot verify your identity from the information already maintained by us, we may request additional information from you, which shall only be used to verify your identity while you are seeking to exercise your rights under the CCPA/CPRA, and for security or fraud-prevention purposes. We shall delete any new personal data collected for verification as soon as practical after processing your request, except as required to comply with applicable legislation.

An "authorized agent" means a natural person, or a business entity registered with the Secretary of State that you have authorized to act on your behalf, conditioned you have:

1. Provided the authorized agent written permission to do so, and we could verify this; and 
2. Verified your own identity directly with the business.

Subsection 1 does not apply when you have provided the authorized agent with a valid power of attorney.

We do our utmost to timely respond to a verifiable Individual, and in a portable format unless it is excessive, repetitive, or materially unfounded. If we require more time, we will inform you of the reason thereof and the extension period in writing.

We will not discriminate against you for exercising your rights under the CCPA/CPRA.

Based on the complexity of the request and the applicable regulations, we may charge a fee for your request. We may offer a CCPA/CPRA-permitted financial incentive, participation in a financial incentive program requires your prior opt-in Consent, which you may revoke at any time.

The Virginia Consumer Data Protection Act (hereafter “VCDPA”) provides Virginian consumer residents who reside in Virginia with specific rights regarding their personal data. In addition to the general privacy notice, this section supplements it, describes your VCDPA rights and explains how to exercise those rights.

The following does not apply to de-identified or aggregated personal data or data publicly available.

As a Virginia resident, you have the following rights, subject to some exceptions, regarding your personal data effective as of January 1^st, 2023:

1. Right to Confirm if a Controller is processing your personal data and to access personal data. 
2. Right to Correct inaccurate personal data. 
3. Right to Delete. 
4. Right to Obtain a copy of personal data in a portable format. 
5. Right to Opt-Out of the processing of personal data for purposes of targeted advertising, sale, or profiling with legal or other significant effects. 
6. Right to Appeal – Consumers have the right to appeal a controller's (i.e., business) denial to act within the time outlined in the VCDPA.

You may also make a verifiable request to exercise your rights by contacting us via this link or the toll-free telephone 1-800-555-0050.

Please note that the above rights are not absolute, and we may be entitled to refuse requests, wholly or partly, where exceptions under the applicable law apply. If you have questions about the foregoing or how to execute your rights in our notice or specifically concerning categories and specific data processed, categories of sources from which your data is collected by us, categories of third parties with whom we share your data, and/or the business or commercial purpose for collecting please contact our privacy office (see section "WHAT ARE YOUR CHOICES?"). 

We do not respond to “Do Not Sell” requests as we do not sell your personal data to third parties. In the twelve months before the effective date of this notice, we have not sold any personal data of customers, as per the definition of the VCDPA.

After receiving your prior consent, we sometimes disclose personal data collected via cookies for cross-contextual behavioral advertising purposes, which may qualify as sharing your personal data under the VCDPA. To opt out, you can adjust your cookie preferences on our website to block our advertising cookies, or you can change your device settings to block cookies or install a third-party plugin to control how cookies interact with your device. For more information on how we use cookies and other tracking technologies, read our Cookie Notice.

This privacy notice might change from to time.

The most current version of this Notice will govern our use of your data and can be found in the website of the Signify Privacy Center, see “Legal information” section.

- Signify -