Data Protection Information
Processing of business partner data (customer, suppliers and other business contacts)
We are committed to protect your personal data and comply with applicable data protection
law, in particular the EU General Data Protection Directive ("GDPR"), and we only process
your personal data on the basis of a statutory provision or if the data subject has declared consent.
In this data protection information, we explain which information (including personal data)
are processed by us in connection with the business relationship between you and us.
I.

Who is responsible for the processing of personal data?
The controller responsible for the processing of personal data is Hodogaya ChemicalEurope GmbH, Immermannstr.13, 40210 Duesseldorf / Germany, telephone +49 211
935 0508, telefax +49 211 935 0509, email kikkawa@hodogaya.de. Any reference to"we" or "us" in this data protection information is a reference to the aforementioned entity.

II.

Which data do we process?
The performance of our business relationships requires the processing of data related toour customers, suppliers and other business contacts (collectively "business partners").
If this data concern a natural person (e.g. if you are a single trader and enter into a business relationship with us), it is considered as personal data. Regardless of the legal formof our contract partners, we process data concerning the contact persons acting for abusiness partner.
Please make this data protection information available to the persons within your organization that are involved in the business relationship with us ("contact persons")

1.

Basic data: We process certain general data concerning our business partners and thecontact persons as well as the business relationship with us, collectively "basic data".
Basic data includea)

any information provided to us in the course of establishing a business relationship or requested by us from our business partner or a contact person (e.g., name,address and other contact details;b)

any information collected and processed by us in connection with the establishment of the business relationship (e.g., the details of the agreements entered into)

Seite 1

2.

3.

Performance data: We process personal data collected in the course of the business relationship other than by merely updating basic data and that we refer to as "performancedata". Performance data includea)

Information on the performance of contractual obligations by our business partners on the basis of the agreements entered into;b)

Information on the performance of contractual obligations by us on the basis oft
he agreements entered into;c)

Information provided by a business partner or a contact person in the course of
our business relationship, be it actively or upon our request; [and]To the extent permitted by law, we can add personal data provided by third parties tothe aforementioned basic and performance data. Such data may include information regarding the commercial standing / rating of our business partners if necessary for the assessment of financial risks (e.g. late payments)

III. For which purposes and on which legal basis do we process your personal data?
1.

We process basic and performance for the performance of the contractual relationships
with our business partners or for pre-contractual measures on the basis of Article
6 para 1 b) GDPR. Regardless of the legal form of our business partners, we process
basic and performance data concerning one or more contact persons for the purpose of
our justified interest in the performance of the business relationship on the basis of Article 6 para 1 f) GDPR.

2.

We may process basic, performance and usage data also for compliance with legal obligations to which we are subject; this processing is based on Article 6 para 1 c) GDPR.
Legal obligations may in particular include the mandatory disclosure of personal data to(tax) authorities.

3.

To extent necessary, we process personal data (in addition to the processing for the purposes of the business relationship or to comply with legal obligations) for the purposesof our justified interests or the justified interests of a third party on the basis of Article
6 para 1 f) GDPR. Justified interest may includea)group-wide processes for internal administration of business partner datab)

the establishment of or defence against legal claims;c)the prevention and investigation of criminal offences;d)the maintenance of security for our information technology systems;

Seite 24.

e)the maintenance of security of our premises and infrastructure; andf)

the management and further development of our business operations including
risk management.

If we provide to a natural person the option to declare a consent in the processing ofpersonal data (e.g. to receive an email newsletter from us), we process the personal data
covered by the consent for the purposes specified in such consent on the basis of Article
6 para 1 a) GDPR.
Please note thatIV.

-the declaration of consent is voluntarily,-

that failure to declare consent or the withdrawal of a consent may, nevertheless,have consequences, and we will inform about such consequences before you are
given the option to declare your consent-consent may be withdrawn at any time with effect for the future, e.g. by providing
notice to us via mail, fax, email using the contact information specified on the firstpage of this data protection notice

Is there an obligation to provide personal data?
The provision of the basic and performance data specified in section II above is necessary for entering into and maintaining a business relationship with us, unless specified
otherwise before or at collection of the data. Without the provision of these data, were
are not able to enter into and maintain a business relationship.
If we collect additional data, we will indicate if the provision of such information isbased on a legal or contractual obligation or necessary for the performance of an agreement. We usually indicate which information may be provided voluntarily and is neither
based on a legal or contractual obligation nor necessary for the purposes of an agreement.

V.

Who has access to personal data?
Personal data are generally processed within our company. Depending on the categories
of personal data, only dedicated departments / organizational units are granted access toyour personal data. Based on a role / rights management concept, access to personal data is limited to the functions and the extent necessary for the respective purpose of theprocessing.
If and to the extent permitted by law, we may transfer your personal data to recipientsoutside of our company. Such external recipients may include
Seite 3VI.

-affiliated companies within Hodogaya group, to which we may transfer personal data for the purpose of internal group-wide administration of business partner data;-service providers that – on the basis of separate agreements with us – provide certain
services possibly including the processing of personal data, as well as approved subcontractors of our service providers; and-private or public bodies, to the extent we are obliged to transfer your personal dataon the basis of a legal obligation to which we are subject;

Do we use automated decision-making?
In the course of the business relationship we generally do not use automated decisionmaking (including profiling) within the meaning of Article 22 GDPR. If we apply suchprocesses in the future, we will inform data subjects separately in accordance with theapplicable statutory provisions.

VII. Are data transferred to countries outside the EU / the EEA?
We intend to transfer your personal data also to "third countries", i.e. countries outside
the European Union or the Agreement on the European Economic Area that do not necessarily ensure an adequate level of data protection comparable to the level in the European Union. This applies, in particular, to the transfer of personal data to and processing
by other Hodogaya group entities located outside the EU or the EEA.
Prior to such third country transfer, we apply appropriate safeguards to ensure the necessary level of data protection at the recipient or in the recipient's country. Appropriate
safeguards may, in particular, consist in an adequacy decision in which the EuropeanCommission has decided that the country ensures an adequate level of protection. Alternatively, we may transfer personal data on the basis of the EU Model Clauses or – incase of recipients in the U.S – its adherence to the "EU US Privacy Shield" principles.
We provide additional information on the appropriate or suitable safeguards upon request; our contact information can be found on the first page of this data protection informations. Information on the participants in the EU US Privacy Shield can also befound here www.privacyshield.gov/list.
VIII. How long are your data stored?
We generally store personal data as long as we have a justified interest in the retentionof such data and there the interest of the data subject in refraining from the further processing do not prevail.
Even without a justified interest, we may continue to store the data if there is a legal obligation (e.g. to comply with statutory retention obligations). We delete personal data
Seite 4even without an action by the data subject as soon as further retention is no longer necessary for the purposes for which the data were collected or otherwise processed or if
further retention is not permitted by law otherwise.
In general, basic data and the additional data collected in the course of the business relationship at least until the end of the respective business relationship. The data are deleted in any case if the purposes for the collection or processing were achieved. This point
in time may be after the end of the business relationship with us. If personal data need
to be stored to comply with a legal obligation, such data is retained until the end of therespective retention period. If personal data are only processed to comply with a statutory retention obligation, the access to such data is usually restricted so that the data are
only accessible if needed for the purpose of the retention obligation.
IX.

What are the rights of a data subjects?
A data subject may-

request access to his/her personal data, Article 15 GDPR;-

request the rectification of incorrect personal data, Article 16 GDPR;-

request the erasure of his/her personal data, Article 17 GDPR;-

request the restriction of the processing of his/her personal data, Article 18 GDPR;-exercise the right to data portability, Article 20 GDPR;-object the processing of his/her personal data, Article 21 DSGVO.

The aforementioned rights may be asserted against us, e.g. by providing notice to us via
the contact details specified on the first page of this data protection information.
In addition, the data subject is entitled to lodge a complaint regarding the handling ofpersonal data with the competent supervisory authority, Article 77 GDPR.
***

Seite 5