Privacy Policy
Privacy Policy for Business Partners
1. About this Policy
This privacy policy (“Policy”) applies to the processing of personal data by YKK AP Europe GmbH (“YKK AP Europe,” “we,” “our,” or “us”) in connection with our business partners.
We process personal data in compliance with applicable laws, including the General Data Protection Regulation (EU Regulation 2016/679 – the “GDPR”), the Federal Data Protection Act (the “BDSG”) and any laws that may replace them in the future. “Personal data” refers to any information relating to an identified or identifiable natural person and “processing” means any activity or operation that is carried out in respect of this personal data, such as collecting, storing, using, transferring, or deleting it.
2. Identity and Contact Details of Controller
YKK AP Europe is the entity determining how and for what purposes we process your personal data, and thus the controller of your personal data. Please find the contact details of YKK AP Europe below.
If you have any questions about this Policy, your rights, or any other matters relating to the protection of personal data, please contact us or our data protection officer at:
YKK AP Europe GmbH
Niederkasseler Lohweg 181-183,
40547 Duesseldorf, Germany
Telephone number: +4915144236459
Our data protection officer:
Email address: DataPrivacy@eu.ykkap.com
Categories of Personal Data and How We Collect It
We collect your personal data directly from you as our business partner when you get in contact with us regarding our Services. This personal data mainly includes your contact details, such as name, email address, postal address and phone number.
In certain situations, we may also collect additional data from you, such as criminal records and (alleged) misconduct.
You may refuse to provide personal data to us; however, in such cases, you may not enter into a contract with us or the availability of all or part of our services may be limited.
3. Purposes and Legal Bases of Processing Your Personal Data
We will process your personal data based on one or more of the following legal bases for the purposes set forth below:
(1) Contract performance: Where it is necessary for us to process your personal data for performing a contract to which you as data subject are a party or to be able to take steps at the request of you as data subject prior to entering into a contract with you;
(2) Legitimate interests: Where it is necessary for us to process your personal data to pursue our legitimate interests or those of a third party, and your interests or fundamental rights do not prevail over the aforementioned interests;
(3) Legal obligation: Where it is necessary for us to process your personal data for the purpose of complying with legal obligations to which YKK AP Europe as controller is subject.
We will process your personal data only to the extent necessary to fulfill the following purposes based on the respective legal basis:
(1) Carrying out and optimizing our business transactions
(Legal basis: (i) contract performance, or (ii) our legitimate interest of carrying out and optimizing business transactions);
(2) Investigation of alleged misconduct and carrying out related actions
(Legal basis: our legitimate interest in managing our work environment and carrying out related appropriate actions such as disciplinary actions);
(3) To comply with obligations under laws and regulations applicable to us, to respond to court orders and legal procedures, or to establish, exercise, or defend against legal claims
(Legal basis: (i) legal obligation or (ii) our or a third party’s legitimate interests in establishing, exercising or defending against legal claims or cooperating with regulatory and judicial authorities).
In certain exceptional cases, the above may also involve processing of personal data, that is additionally protected under the GDPR and the BDSG for being particularly sensitive. In such cases we will make sure that we will only process this sensitive data if and to the extent legally allowed, for example where we have certain legal obligations to do so or when we need to establish, exercise or defend against legal claims, or, in case of personal data relating to criminal convictions and offences, when such processing is additionally authorized by EU or German law providing for appropriate safeguards.
4. Disclosure of Personal Data to Third Parties
We may share your personal data with our affiliates, including our headquarters in Japan, and our suppliers to the extent necessary to fulfil the purposes referred to in Section 4.
We may also disclose your personal data to third parties, including public authorities, if such disclosure is required to comply with legal obligations to which we are subject, to cooperate with relevant governmental authorities and agencies, or to establish, exercise, or defend against legal claims.
5. Transfers of Personal Data Outside the EEA
Your personal data may be transferred to, and stored by, third-party recipients (as mentioned in Section 5) outside the European Economic Area (EEA), in particular our headquarters in Japan. Where we transfer your personal data outside the EEA, we will ensure that:
(1) the recipient destination has been recognized by the European Commission as ensuring an adequate level of protection for the rights and freedoms that you possess in respect of your personal data; or
(2) the recipient enters into a contract with us using standard data protection clauses that have been approved by the European Commission.
6. Storage Period for Personal Data
We will retain your personal data that we collect only for the period necessary to achieve the purposes mentioned in Section 4 above. However, this does not apply if we are required by laws or regulations to retain your personal data for a longer period of time, for example based on retention requirements for documents and information under German commercial or tax law.
7. Your Rights
You have a number of legal rights in relation to your personal data that we process, the extent of which may depend on your individual situation as defined by the GDPR and the BDSG:
(a) right to obtain information regarding the processing of your personal data and to access your personal data;
(b) right to request that we rectify your personal data if it is inaccurate or incomplete;
© right to request that we erase your personal data in certain circumstances;
(d) right to request that we restrict our processing of your personal data in certain circumstances;
(e) right to receive your personal data in a structured, commonly used, and machine-readable format and/or to request that we directly transmit such personal data to a recipient in certain circumstances;
(f) in the event that we separately request your consent as basis for our data processing beyond Section 4, the right to withdraw this consent at any time. Please note, however, that the withdrawal of your consent shall not affect the lawfulness of processing performed based on the consent before your withdrawal;
and additionally, where relevant:
(g) right to object to our processing of your personal data under certain circumstances in the case of processing of personal data based on a legitimate interest.
Our processing of your personal data will not subject you to a decision based solely on automated processing, including profiling, where such decision would produce legal or similarly significant effects concerning you.