Kikusui Electronics Europe GmbH (“Kikusui”, “we”, “us” or “our”) takes the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the applicable data protection legislation, in particular the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and the German Federal Data Protection Act (Bundesdatenschutzgesetz, “BDSG”), and this privacy notice (“Privacy Notice”). This Privacy Notice explains how we collect, use, disclose and otherwise process personal data in connection with our employment relationships, recruitment activities and business customer relationships. It does not apply to the processing of personal data through our website, which is governed by a separate privacy notice available at our website. Unless otherwise defined herein, all terms used in this Privacy Notice shall have the meanings ascribed to them in the GDPR.
1 Controller
The controller responsible for the processing of your personal data within the meaning of the GDPR is:
Kikusui Electronics Europe GmbH
Großenbaumer Weg 8
40472 Düsseldorf, Germany
Telephone: +49 (211) 54257600
E-Mail: support@kikusui-europe.com
2 General Information on Data Processing
We process personal data only where we have a lawful basis to do so. Depending on the circumstances, the legal basis for our processing activities may be one or more of the following:
2.1
Performance of a contract or pre-contractual measures (Article 6(1)(b) GDPR): where processing is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract, including the performance of employment contracts and the conduct of recruitment procedures.
2.2
Compliance with a legal obligation (Article 6(1)(c) GDPR): where processing is necessary for compliance with a legal obligation to which we are subject, including obligations under tax, social security and employment law.
2.3
Legitimate interests (Article 6(1)(f) GDPR): where processing is necessary for the purposes of the legitimate interests pursued by us or by a third party, except where such interests are overridden by your interests or fundamental rights and freedoms.
2.4
Consent (Article 6(1)(a) GDPR): where you have given your consent to the processing of your personal data for one or more specific purposes. You have the right to withdraw your consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
3 Processing of Employee Personal Data
This section applies to employees of Kikusui, including expatriates from Kikusui Electronics Corp. (Japan) (“Kikusui Japan”) and locally hired employees.
3.1 Categories of Personal Data Processed
We process the following categories of personal data in connection with your employment:
- name,
- contact details,
- evaluation and salary information,
- and other data necessary for employment management.
3.2 Purposes and Legal Bases of Processing
We process your personal data for the following purposes:
- Employment management, personnel evaluation, salary payment and social insurance management: The legal basis for this processing is Article 6(1)(b) GDPR (performance of the employment contract).
- Sharing of personal data with our parent company and affiliated companies for legitimate group-wide HR management and reporting purposes: The legal basis for this processing is Article 6(1)(f) GDPR (legitimate interests). Our legitimate interest lies in the efficient administration and management of our corporate group.
3.3 Recipients of Personal Data
Your personal data may be disclosed to the following recipients:
- Kikusui Japan, which acts as a processor on our behalf for certain support functions, including marketing activities conducted in our name and under our instruction. Kikusui Japan does not use this data for its own independent purposes.
- Kikusui Holdings Corp. (Japan) and Kikusui EMZ Corp. (Japan) (together “Kikusui Japan Affiliates”), for group-wide HR management and reporting purposes.
- Third-party service providers, including payroll processors and insurance providers, who process personal data on our behalf or as independent controllers in connection with the administration of your employment.
3.4 International Data Transfers
In connection with the processing described above, your personal data may be transferred to Japan (Kikusui Japan and Kikusui Japan Affiliates), where the HR department is located). Japan has been recognised by the European Commission as providing an adequate level of data protection (adequacy decision pursuant to Article 45 GDPR).
3.5 Retention Period
Your personal data will be retained for the duration of your employment and thereafter for the applicable statutory retention periods. Payroll records are retained for up to ten (10) years following the end of the employment relationship in accordance with German tax law (Section 147 of the German Fiscal Code (Abgabenordnung)). Other employment records are retained in accordance with applicable statutory requirements.
4 Processing of Job Applicant Personal Data
This section applies to individuals who apply for employment with Kikusui.
4.1 Categories of Personal Data Processed
We process the following categories of personal data in connection with your application:
- name,
- contact details and
- personal data provided with your application (including your resume/CV).
4.2 Purposes and Legal Bases of Processing
We process your personal data for the following purposes:
- General recruitment management, including communication with human resources, officers, department managers and persons in charge of candidate departments, interaction with job seekers and communication with recruitment agents: The legal basis for this processing is Article 6(1)(b) GDPR (steps taken prior to entering into a contract, including the decision on the establishment of an employment relationship).
- Retention of application data following rejection for the purpose of defending against potential legal claims, including discrimination claims: The legal basis for this processing is Article 6(1)(f) GDPR (legitimate interests). Our legitimate interest lies in the ability to defend against potential legal claims arising from the recruitment process.
- Inclusion in our talent pool for consideration for future vacancies: The legal basis for this processing is Article 6(1)(a) GDPR (consent). Inclusion in the talent pool is voluntary and requires your express consent, which you may withdraw at any time.
4.3 Recipients of Personal Data
Your personal data may be disclosed to the following recipients:
- Kikusui Japan and Kikusui Japan Affiliates: Data is shared only for key positions (e.g., senior management, sales roles). A Japan-based employee who is legally registered as a Director of the German entity may access applicant data as necessary to perform their management duties and make final hiring decisions.
- Recruitment agencies (e.g., Fischer HRM for executive search services): Recruitment agencies act as independent controllers. We may receive personal data from recruitment agencies but do not transfer applicant personal data to them.
4.4 International Data Transfers
In connection with the processing described above, your personal data may be transferred to Japan (Kikusui Japan and Kikusui Japan Affiliates) for the purposes of review and decision-making on key positions. Japan has been recognised by the European Commission as providing an adequate level of data protection (adequacy decision pursuant to Article 45 GDPR). We carry out international data transfers only at a later stage of the recruitment process, when executives from Japan need to review applications and provide comments.
4.5 Retention Period
Your application data will be retained as follows:
- Up to six (6) months after the conclusion of the recruitment process (for the purpose of defending against potential legal claims).
- Up to two (2) years for inclusion in the talent pool (with your express consent). Upon withdrawal of consent, your data will be irrevocably deleted from the talent pool, unless statutory retention obligations apply.
- If your application is successful, the data submitted by you will be stored in our data processing systems for the purpose of performing the employment relationship on the basis of Article 6(1)(b) GDPR.
5 Processing of Business Customer Personal Data – Direct Acquisition
This section applies to business contacts (B2B) whose personal data we collect directly, for example through the exchange of business cards at trade exhibitions or in the course of business dealings. Our customer data is B2B data; personal data related to customers is limited to the contact details of the relevant contact person.
5.1 Categories of Personal Data Processed
We process the following categories of personal data:
- company name,
- name,
- department/position and
- contact details.
5.2 Purposes and Legal Bases of Processing
We process your personal data for the following purposes:
- Customer support related to existing contracts with the data subject: The legal basis for this processing is Article 6(1)(b) GDPR (performance of a contract).
- Customer support related to existing contracts to which the data subject is not a party; customer referrals and general business relationship management, including initial contact following the exchange of business cards at trade exhibitions: The legal basis for this processing is Article 6(1)(f) GDPR (legitimate interests). Our legitimate interest lies in maintaining business relationships and providing customer service.
5.3 Recipients of Personal Data
Your personal data may be disclosed to the following recipients:
- Kikusui Japan, which acts as a processor on our behalf for certain support functions, including marketing activities (e.g., email distribution) conducted in our name and under our instruction.
- Kikusui Japan Affiliates.
- Overseas affiliated companies in the United States and China, on an ad-hoc basis only and subject to your explicit consent (e.g., where a customer contact is referred to the appropriate person in charge of the relevant geographic area).
- Third-party service providers, including CRM (Customer Relationship Management) software vendors, who process personal data on our behalf in connection with the administration of data related to business customers.
5.4 International Data Transfers
- Kikusui Japan and Kikusui Japan Affiliates: Japan has been recognised by the European Commission as providing an adequate level of data protection (adequacy decision pursuant to Article 45 GDPR).
- United States and China (overseas affiliated companies): Transfers to the United States or China occur only on a rare, ad-hoc basis (e.g., where a customer attending an exhibition in Europe provides a business card and their contact details need to be referred to the appropriate affiliate in the relevant geographic area). Given the very limited and ad-hoc nature of such transfers, the legal basis for these transfers is your explicit consent pursuant to Article 49(1)(a) GDPR, which you may withdraw at any time. Where you do not provide or withdraw your consent, the transfer will not take place.
5.5 Retention Period
- Your personal data will be retained for the duration of the business relationship and thereafter for the applicable statutory retention periods (typically six (6) to ten (10) years under German commercial and tax law for business correspondence, in accordance with Section 257 of the German Commercial Code (Handelsgesetzbuch) and Section 147 of the German Fiscal Code (Abgabenordnung)).
6 No Automated Decision Making
We do not use your personal data for automated decision-making, including profiling, within the meaning of Article 22 GDPR. All decisions that may affect you are made by natural persons with appropriate authority.
7 Your Rights as a Data Subject
Under the GDPR, you have the following rights with respect to your personal data. To exercise any of these rights, please contact us using the contact details set out in Section 1 above.
- Right of access (Article 15 GDPR): You have the right to obtain confirmation as to whether personal data concerning you is being processed and, where that is the case, access to the personal data and certain related information.
- Right to rectification (Article 16 GDPR): You have the right to obtain the rectification of inaccurate personal data concerning you without undue delay.
- Right to erasure (Article 17 GDPR): You have the right to obtain the erasure of personal data concerning you without undue delay where one of the grounds set out in Article 17 GDPR applies, unless processing is necessary for compliance with a legal obligation or for the establishment, exercise or defence of legal claims.
- Right to restriction of processing (Article 18 GDPR): You have the right to obtain restriction of processing where one of the conditions set out in Article 18 GDPR applies, including where you contest the accuracy of the personal data, where the processing is unlawful, or where you have objected to processing pursuant to Article 21(1) GDPR pending verification of whether our legitimate grounds override yours.
- Right to data portability (Article 20 GDPR): You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and have the right to transmit that data to another controller, where the processing is based on consent or on a contract and is carried out by automated means.
- Right to object (Article 21 GDPR): You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Article 6(1)(e) or (f) GDPR, including profiling based on those provisions. We shall no longer process the personal data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.
- Where personal data is processed for direct marketing purposes, you have the right to object at any time to processing of personal data concerning you for such marketing, including profiling to the extent that it is related to such direct marketing. Where you object to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.
- Right to withdraw consent (Article 7(3) GDPR): Where processing is based on your consent, you have the right to withdraw your consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
- Right to lodge a complaint (Article 77 GDPR): Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the GDPR.
8 General Information on Storage Duration
Unless a more specific storage period has been stated in this Privacy Notice, your personal data will remain with us until the purpose for the data processing no longer applies. If you assert a legitimate request for deletion or withdraw your consent to data processing, your data will be deleted, unless we have other legally permissible grounds for storing your personal data (e.g., retention periods under tax or commercial law); in the latter case, the deletion will take place after these grounds cease to apply.
9 Data Security
We employ appropriate technical and organisational measures to protect your personal data against unlawful processing, including accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data transmitted, stored or otherwise processed. We draw your attention to the fact that data transmission over the Internet (e.g., communication by e-mail) may be subject to security vulnerabilities. Complete protection of data against access by third parties is not possible.
10 Data Processing Agreements and Processor Relationships
Kikusui Japan acts as a processor on our behalf for certain support functions, including marketing activities (e.g., email distribution) conducted in our name and under our instruction. A data processing agreement pursuant to Article 28 GDPR governs this relationship.
Recruitment agencies (e.g., Fischer HRM) provide executive search and candidate selection services and act as independent controllers. We may receive personal data from recruitment agencies in the course of the recruitment process.
For the processing of personal data in connection with our website, please refer to our website privacy policy.
11 Changes to this Privacy Notice
We reserve the right to amend this Privacy Notice from time to time to reflect changes in our processing activities or applicable legal requirements.
