Privacy Information
Magna Supplier Portal eRFX
As part of our commitment to Data Privacy and Protection, Magna Steyr Fahrzeugtechnik GmbH & Co KG and its affiliates (also referred to as “Magna”, “us” or “we”) may process your Personal Data to provide, operate and administer the Magna Supplier Portal eRFX as a communication platform for supplier information, inquiries and tenders, and the initiation and administration of supplier relationships and related contracts.
In connection with the cloudification of eRFX, the relevant application and related services may be delivered as QAD Cloud Services in a hosted environment operated and maintained by QAD, including hosting, management, operation, support and maintenance of the software.
The purpose of this Privacy Information is to provide comprehensive information about how and for what purposes your Personal Data is processed by Magna in connection with this activity.
Note that this Privacy Information applies globally and is designed to provide a uniform compliance standard. It has been developed through a global review process and takes into account applicable data protection laws, including the EU General Data Protection Regulation (GDPR), China’s Personal Information Protection Law (PIPL), Brazil’s Lei Geral de Proteção de Dados (LGPD), Thailand’s Personal Data Protection Act (PDPA), India’s Digital Personal Data Protection Act (DPDPA) as well as other applicable local regulations. Where local laws require specific or additional information, or impose particular obligations, such requirements will apply in addition to this Privacy Information.
1. Data Controller
The controller of your Personal Data is the Magna entity that determines the purposes and means of processing your Personal Data in connection with the relevant activity, including the entity with which you have entered into, or intend to enter into, a legal relationship (e.g. contractual), and/or whose premises or websites you are accessing.
Central responsible department is:
Magna Steyr Fahrzeugtechnik GmbH & Co KG
Liebenauer Hauptstrasse 317
8041 Graz, Austria
You can contact Magna’s Data Privacy and Protection Team at the email address below. In jurisdictions where required by law, Magna has also appointed Data Protection Officers, local representatives or contact points to support data protection compliance. Depending on the nature of your request, it may be forwarded to the appointed individual.
Email: [email protected]
Please note that the Magna entities share infrastructure, systems and technology to process your information, to ensure efficiency and security, as permitted by the applicable law and in accordance with this Privacy Information.
2. Processing of Personal Data
Personal Data is any information relating to an identified or identifiable natural person. When we process Personal Data, this means that we collect, store, transmit, delete, or otherwise use this data.
Your Personal Data may be collected directly from you, generated in the context of your interaction or relationship with Magna, or obtained from other sources where permitted by applicable law.
This concerns in particular the following categories of Personal Data:
- Name, company, job title and/or area of responsibility
- Email address, phone number
- User account and access information, authentication-related data
- Technical access data, usage and activity logs, server log files
- Any information entered, uploaded or generated in connection with the use of the Magna Supplier Portal eRFX, to the extent such information relates to an identified or identifiable individual
Please note that this is not an exhaustive list, and the specific categories of Personal Data processed may vary depending on the circumstances and applicable laws and regulations.
3. Processing Purposes and Legal Basis
We process your Personal Data to establish and administer supplier relationships with Magna, provide and operate the supplier portal as a communication platform for supplier information, inquiries and tenders, support the initiation and administration of contracts, and ensure the technical provision, hosting, administration, maintenance, support, security monitoring and continuous operation of the cloud-based Magna Supplier Portal eRFX.
The legal basis for processing your Personal Data in relation to the use and administration of the Magna Supplier Portal eRFX is Magna’s legitimate interest in establishing, administering and managing supplier relationships, operating and securing the supplier portal, facilitating supplier-related communication, inquiries, tenders and contract initiation, and providing a secure, efficient and reliable cloud-based supplier portal environment.
4. Recipients or Categories of Recipients of Personal Data
For the purposes described above, your personal data may be accessed by:
- Authorized personnel within Magna and its affiliates, including the MAGNA Group, for the purposes described above
- Third-party service providers acting as authorized data processors, including QAD Europe GmbH and, where applicable, QAD Inc., companies within the QAD group of companies and authorized sub-processors engaged by QAD for the provision, hosting, maintenance, support, administration and security of the Cloud Services
- Where necessary, third-party providers engaged for extended supplier master data processing
5. Storage Duration
Your Personal Data is retained only for as long as necessary to fulfil the purposes described above or to comply with legal retention requirements, after which it is deleted or anonymized in accordance with Magna’s retention policies and applicable law. Magna takes appropriate technical and organizational measures to secure the information you provide.
In addition, we also store your data after the original purpose of collection has ceased to apply if we are obliged under applicable laws and regulations to store the data for other reasons, e.g. for archiving purposes. It is also possible that personal data may be stored for the time during which claims can be made against us (statutory limitation periods set by your local laws and regulations).
6. Transmission or Transfer of Personal Data to Third Parties and Third Countries
Your Personal Data may be transferred to and accessed by Magna, its affiliates, and authorized service providers in countries outside of your country of residence. These countries may have data protection laws that differ from and may not provide the same level of protection as the laws in your home country.
Where Personal Data is transferred internationally, Magna ensures that such transfers are carried out in accordance with applicable data protection laws and that appropriate safeguards are implemented to protect your Personal Data. Depending on the relevant jurisdiction, these safeguards may include adequacy decisions issued by competent authorities, the use of approved contractual protections (such as standard contractual clauses), or other legally recognized transfer mechanisms.
A copy of the Standard Contractual Clauses (SCC) for the European Union (EU) and Brazil (BR) can be found below. Where required by applicable law, information about the safeguards used for international data transfers, including copies of relevant contractual protections, may be made available upon request.
Magna ensures that third parties processing Personal Data on its behalf do so only for specified purposes and in line with applicable legal requirements.
7. Data Security
Magna has implemented appropriate technical, organizational, and physical measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or unauthorized access.
Access to Personal Data is limited to individuals who require it for legitimate business purposes and who are subject to confidentiality obligations. External service providers are required to implement appropriate security measures and may process Personal Data only in accordance with Magna’s instructions and applicable law.
8. Your Data Subject Rights
Depending on the data protection laws applicable in your country or region of residence, you may have certain rights in relation to your personal data, including:
- Right of access – to obtain information about whether and how your personal data is processed
- Right to rectification – to request correction of inaccurate or incomplete personal data
- Right to erasure or anonymization – where permitted under applicable data protection laws
- Right to restrict processing – to request limitation of the processing of your personal data
- Right to data portability – to receive certain personal data in a structured, commonly used, and machine-readable format, where applicable
The availability and scope of these rights may vary depending on the applicable laws in your jurisdiction. Certain countries may provide additional or different rights, and these will be taken into account when responding to your request.
You may submit such a request without any specific form. You may submit a data subject rights request via our Data Subject Rights Request webform, or contact us directly using the contact details provided in this notice.
If you have concerns about how your personal data is handled, you also have the right to lodge a complaint with the competent data protection or privacy supervisory authority in your country or region, where applicable. We encourage you to contact us directly first to allow us to address your concern before contacting a supervisory authority.
9. Revocation of Consent (Where Applicable)
Where the processing of your personal data is based on your consent, you have the right to withdraw your consent at any time, in accordance with applicable data protection laws.
The withdrawal of consent will not affect the lawfulness of any processing carried out before your consent is withdrawn. Once consent is withdrawn, Magna will stop processing your personal data for the relevant purpose, unless the processing is permitted or required under applicable law on another legal basis.
You may withdraw your consent without any specific form. You may submit a request via our Data Subject Rights Request webform, or contact us directly using the contact details provided in this notice.
10. Right to Object or Restrict Processing (Where Applicable)
Where provided for under applicable data protection laws, you have the right to object to or request the restriction of the processing of your personal data, where the processing is based on:
- The performance of a task carried out in the public interest or under official authority, or
- The legitimate interests of Magna or a third party, unless such interests are overridden by your interests or fundamental rights and freedoms requiring the protection of personal data
Where you validly object or request restriction, we will assess your request and, where required by law, stop or limit the processing of your personal data, unless we can demonstrate compelling legitimate grounds or the processing is necessary to establish, exercise, or defend legal claims, or otherwise permitted under applicable law.
You may submit such a request without any specific form. You may submit a request via our Data Subject Rights Request webform, or contact us directly using the contact details provided in this notice.
11. Children’s Personal Data (If Applicable)
This privacy information is not intended for children or minors, unless expressly stated otherwise as part of a specific processing activity.
Where the processing of personal data of children or minors is required, such processing is carried out in accordance with applicable data protection laws and may require the consent or authorization of a parent or legal guardian, where applicable.
If you believe that personal data relating to a child has been processed without appropriate authorization, please contact us directly using the contact details provided in this notice.
12. Cookies (If Applicable)
Cookies are small files that a website – when visited by you – asks your browser to store on your device to remember information about you. When using the cloud-based supplier portal, technical access information and user activity data, including server log files, may be collected to enable secure access, authentication, session management, system stability, troubleshooting, misuse prevention and the detection of security incidents.
What Strictly Necessary Cookies do we use and when do they expire?
- Strictly necessary cookies or comparable technical identifiers may be used to enable secure access, authentication, session management and the basic operation of the Magna Supplier Portal eRFX. These cookies generally expire at the end of the session or within the technically required retention period.
13. Possible Consequences of Failure to Provide Data
Within the scope of our contractual relationship, you only need to provide us with those personal data that are necessary for the establishment, implementation, and termination of this contractual relationship or that we are legally obliged to collect. Without this data, we will usually have to refuse to conclude the contract or execute the order or will not be able to execute an existing contract and may have to terminate it.
Other personal data may be provided voluntarily. Failure to provide optional personal data will not result in adverse consequences, unless otherwise specified at the time of collection.
14. Automated Decision-Making
We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects on you.
15. Updates and Changes
Please note that we may update this Privacy Information periodically. It is advisable to review this Information occasionally to stay informed about any recent changes.
This Privacy Information was last updated in August 2026.