Effective: November 14, 2018
In the context of your contacts and dealings with Yamashin-Filter Corp. and its affiliates (hereinafter referred to as Yamashin), Yamashin will receive and collect a range of information regarding our customers. Some of this information is confidential, and we handle all confidential information entrusted to us by our customers with utmost care. In addition, where such information is personal data (i.e. it relates to an identified or identifiable individual), it is also important not only for the individual to whom it relates, but also for Yamashin. That is why Yamashin establishes the management system to protect personal data handled in business and comply with not only the Act on Protection of Personal Information of Japan but also European Union (EU) data protection rules to achieve clear business activities which satisfy the trust of the person who provides the personal data to Yamashin.
Yamashin-handles personal data in accordance with the following GDPR Privacy Policy.
YAMASHIN-FILTER CORP.
Atsuhiko Yamazaki, Representative Director and President
When Yamashin processes (collects, uses, transfers, etc.) personal data of the individuals located in the European Economic Area (EEA), it does so for purposes that it determines, and is considered to be a data "controller" within the meaning of the GDPR (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)).
In this context, when handling personal data, Yamashin undertakes to comply with its obligations as controller set forth in the GDPR as well as, if applicable, the requirements prescribed by the Act on Protection of Personal Information of Japan and various other laws and regulations relating to data protection, and handle all obtained personal data properly and strictly as follows.
1. Personal data we collect and process
Yamashin processes the following personal data:
a. Personal data related to customers and suppliers
Name, place of work, contact information such as telephone number or email address
b. Personal data related to recruitment/internship applicants and prospective employees
Name, date of birth, address, telephone number, email address, educational background and qualified licenses, job experience
c. Personal data related to retired employees and shareholders
Name, address and contact information such as telephone number
d.Others
Name, place of work and contact information
2. How we use the personal data we collect
(1) Yamashin processes the collected personal data only to the extent necessary for its business activities for the following business purposes.
a. Personal data of customers and suppliers
Based on Yamashin's legitimate interests in promoting and improving its products and services (except where indicated otherwise):
• Marketing
Based on Yamashin's legitimate interest in managing the relationship with its customers or suppliers and in performing its contract with them (or based on performance of a contract with the individual, if the supplier or customer is an individual):
• Product shipping and after-sale service of Yamashin’s product
• Conducting test and analysis requested by suppliers or customers and reporting on the results thereof
• Credit management relating to suppliers and customers
• Exercising rights and fulfilling obligations under the laws and regulations or the agreement with suppliers and customers
• Any other purpose to perform the management of suppliers and customers incidental to the above-mentioned purposes
b. Personal data related to recruitment/internship applicants and prospective employees
Based on the steps needed to lead to the conclusion of a contract with the applicant and prospective employee, and based on consent where the processing concerns health-related data or national identifiers:
• Providing information and notice of company information or result of employment selection
• Recruitment activities for recruitment and employment selections
c. Personal data related to retired employees and shareholders
Based on Yamashin's legitimate interest in maintaining a rapport with its retired employees:
• Sending notice to retired employees from Yamashin
Based on Yamashin's legitimate interest in keeping data for litigation management purposes:
• Managing record of duty, salary, health information, etc. during the tenure
Based on compliance with Yamashin's statutory obligations:
• Responding to inquiries related to social security matters
• Exercising rights and fulfilling obligations under the laws and regulations
• Operating, managing and keeping record of the shareholder’s meeting
Based on Yamashin's legitimate interests in developing its business and in promoting its products and services and in maintaining the relationship with its shareholders:
• Reporting and announcing Yamashin’s contents of the business and providing information related to the contents of the business
• Implementing various policy for smooth relationship between shareholders and Yamashin
• Issuing notice to the shareholders for various information
d. Others
Based on Yamashin's legitimate interest in keeping data for litigation management purposes:
• Handling inquiries and complaints
(2) Yamashin shall notify you if Yamashin conducts processing activities other than described above to the extent that those activities are permissible under applicable laws.
(3) Notwithstanding the above, Yamashin might use the personal data beyond the scope necessary for the achievement of the specified purpose of use in the following cases.
i. Cases as prescribed by law
ii. Cases in which the handling of personal data is necessary for protection of the life, body or property of an individual and in which it is difficult to obtain the consent of the person
iii. Cases in which the handling of personal data is specially necessary for improving public health or promoting the sound growth of children and in which it is difficult to obtain the consent of the person
iv. Cases in which the handling of personal data is necessary for cooperating with a state organ, a local government, or an individual or a business operator entrusted by either of the former two in executing the affairs prescribed by laws and regulations and in which obtaining the consent of the person is likely to impede the execution of the affairs concerned
(4) We keep this personal data for as long as is necessary for the purposes described above, and afterwards erase or anonymize it. In particular:
i. where any personal data needs to be kept as evidence in case of potential claims or litigation (e.g. information relating to the performance by an employee of his or her employment contract, or exchanges with customer representatives regarding customer contracts), we keep the personal data during the entire applicable statute of limitations (i.e. for as long as such a dispute can legally arise)
ii. we erase the resumes of job applicants whose applications are unsuccessful.
For more information on the retention periods, please contact Personal Data Support Center.
3. Transfer to a third party
Yamashin processes this personal data internally, and may request a third party to process it on its behalf (as processor). This includes:
i. For all data subjects: information technology and communications service providers and mailing services
ii. For employee and job applicant personal data: payroll service providers and recruitment agencies
iii. For customer and supplier personal data: delivery service providers
Yamashin does not provide any personal data supplied by its customers to third parties without the consent of the person concerned, except in the cases set out under 2(3) of this GDPR Privacy Policy.
Yamashin does not provide (or transfer) the obtained personal data to third parties. This is without prejudice to the normal use of personal data within the Yamashin group and the outsourcing of the personal data management (consignment of operation), in accordance with Japanese laws and EU data protection rules. Yamashin only transfers personal data between countries and entities where it can ensure that there are measures in place for the protection of such personal data in accordance with applicable data protection rules. In particular, for international data transfers, Yamashin ensures the applicability of adequacy decisions or Standard Contractual Clauses of the European Commission (a copy of which can be obtained by contacting Personal Data Support Center).
4. Your rights
Under applicable data protection rules, you may benefit from various rights as "data subject". You can exercise any of the rights listed hereunder by submitting your request to Personal Data Support Center.
Please include your personal details as well as some means of verifying your identity. Please note that we may reject requests that are excessive or a misuse of the relevant right.
i. Access right and data portability: You have the right to access your personal data processed by us, as well as the portability of data you have provided to us to the extent applicable.
ii. Right of rectification: At all times, you have the possibility to request the rectification of your personal data, provided that the legal requirements are met.
iii. Right of erasure: At all times, you have the possibility to request the erasure of your personal data, provided that the applicable legal requirements are met.
iv. Limits to processing:
• Right to object: You have the right, if applicable legal provisions are met, to object to the processing of personal data based on our legitimate interests in specific circumstances. In particular, in relation to the processing of personal data for direct marketing purposes, you have the right to object at any time thereto.
• Right to restriction: You have the right to obtain the restriction of certain forms of processing in specific circumstances.
• Consent withdrawal: Where any processing is based on consent, you have the right to withdraw such consent at any time (without affecting the lawfulness of processing prior to the consent withdrawal).
We will in each case examine your request an check whether you meet the requirements for the processing to be stopped.
Also, you have the right to file a complaint with the data protection authorities having jurisdiction over your place of residence about the processing of your personal data.
5. Continuous improvement
Yamashin shall regularly review the personal data protection management system to implement improvements corresponding to the change of the social circumstances and the advance of the information technology. Yamashin will regularly review the GDPR Privacy Policy to ensure the appropriate processing of personal data and announce the GDPR Privacy Policy after the change promptly if it is changed.
6. Contact us
Please contact the following Personal Data Support Center if you have any questions, inquiries, concerns or complaints regarding our compliance with this GDPR Privacy Policy, or if you wish to exercise your rights (see section 4 above):
General Affairs Department, YAMASHIN-FILTER CORP.
16th Floor, Nisseki-Yokohama Bldg., 1-1-8 Sakuragi-cho, Naka-ku, Yokohama 231-0062, Japan
Phone: 81-(0)45-680-1671
Message to: web-info@yamashin-filter.co.jp
