Yamato General PrivacyTerms
1Introduction

These Privacy Terms set out how Yamato Transport Europe B.V. (”we”, “our”, “us”, “Yamato”) handles thePersonal Data of its customers, suppliers and other third parties. Yamato is the Controller for this Processing,unless expressly stipulated otherwise.
2

Personal data protection principles

We adhere to the principles relating to Processing of Personal Data set out in Applicable Privacy Legislation
which require Personal Data to be:
a.
b.
c.
d.
e.
f.

g.
h.

Processed lawfully, fairly and in a transparent manner (Lawfulness, Fairness andTransparency).
Collected only for specified, explicit and legitimate purposes (Purpose Limitation).
Adequate, relevant and limited to what is necessary in relation to the purposes for which it isProcessed (Data Minimization).
Accurate and where necessary kept up to date (Accuracy).
Not kept in a form which permits identification of Data Subjects for longer than is necessary forthe purposes for which the data is Processed (Storage Limitation).
Processed in a manner that ensures its security using appropriate technical and organizational
measures to protect against unauthorized or unlawful Processing and against accidental loss,destruction or damage (Security, Integrity and Confidentiality).
Not transferred to another country without appropriate safeguards being in place (TransferLimitation).
Made available to Data Subjects and Data Subjects allowed to exercise certain rights in relation totheir Personal Data (Data Subject’s Rights and Requests).

We are responsible for and must be able to demonstrate compliance with the data protection principles
listed above (Accountability).
3

Legal grounds for processing

We only Process Personal Data for specific purposes, which are set out below:••••

4with the prior consent of a Data Subject(s);the Processing is necessary for the performance of a Contract with a Data Subject;
to meet our legal compliance obligations; and/orto pursue our legitimate interests for purposes where they are not overridden because theProcessing prejudices the interests or fundamental rights and freedoms of Data Subjects.

Data processing related to the provision of Yamato services

The provision of our services requires the Processing of Personal Data.
We Process Personal Data which you provide to us and Personal Data obtained in the course of providing
our services. When you provide Personal Data to Yamato, please do not provide information that is irrelevant,not accurate and/or unnecessary for the services provided

1

International Removal service
The Processing of Personal Data for the provision of removal services (including customs clearance services)
may include but are not limited to:
••

•
•
•

•

Contact and payment details of the customer (such as name, company name, address, email,telephone or fax number);
Information related to the person(s) being removed;
o name, first names, initials, title, gender, date of birth, address, postal code, place ofresidence, telephone number;o information about family structure;o occupation / company employment letter;o reason for removal;
o removal dates (date of departure, removal date; entry date);o copy of passport / residence card/contract, permits or visa;
o power of attorney for customs.
Travel/fare/ticket information;
Insurance application/claim form;
Information considering goods/cargo to be moved (such as name and address shipper andconsignee, cargo size, weights, description and value, pickup date and delivery date, tracking no.,bill of lading no., (signature for) proof of delivery, prepaid or collect, invoice & packing list, contentof work covered and method of payment);
Physical location data.

We are processing the abovementioned Personal Data in as far as it is necessary for the performance of aContract with a Data Subject and/or to meet our legal compliance obligations. We only process special
categories of Personal Data with the explicit consent of a Data Subject(s) and to comply with a legal
obligation.
Freight forwarding / Logistics, Parcel delivery and Storage services
The Processing of Personal Data for the provision of delivery and storage services (including customsclearance services) may include but are not limited to:••••Contact and payment details of the customer (such as name, company name, address, email,telephone or fax number) ;Information considering goods/cargo to be moved (such as name and address shipper andconsignee, cargo size, eights, description and value, pickup date and delivery date, tracking no., billof lading no., (signature for) proof of delivery, prepaid or collect, invoice & packing list, content ofwork covered and method of payment);Insurance application/claim form;
Physical location data.

We are processing the abovementioned Personal Data in as far as it is necessary for the performance of aContract with a Data Subject and/or to meet our legal compliance obligations. We do not process special
categories of Personal Data for the provision of the abovementioned services.
Processing personal data under your control
In as far as we are requested to Process Personal Data of your customers on your instruction and under yourcontrol, we are considered data processor. Under circumstances, this will be the case with respect to ecommerce parcel delivery. In that event, Applicable Privacy Legislation requires you to conclude a processor
agreement with us2Customs consultancy
The Processing of Personal Data for the provision of customs consultancy services may include but are notlimited to:•••Contact and payment details of the customer (such as name, company name, address, email,telephone or fax number);
Signature for representation;
Tax-identification number if this is required for the services requested.

We are processing the abovementioned Personal Data in as far as it is necessary for the performance of aContract with a Data Subject and/or to meet our legal compliance obligations. We do not process special
categories of Personal Data for the provision of the abovementioned services.
5Direct marketing

We will always request your prior consent to use your Personal Data for electronic direct marketing, except
where we have obtained contact details in the course of a sale to that you and it involves marketing similar
products or services. In that event the Processing is necessary for purposes of a legitimate interest pursued
by Yamato, namely to conducts its normal business. You may always object to direct marketing.
6Sharing with third parties

We only share the Personal Data we hold with third parties, such as our service providers, if:a. they have a need to know the information for the purposes of providing the contracted services;b. the third party has agreed to comply with the required data security standards, policies andprocedures and put adequate security measures in place;c. the transfer complies with any applicable cross border transfer restrictions.
For the provision of our services we will provide Personal Data to:• The authorities of the country of transit or destination for customs clearance in as far asrequired by the laws of the respective country. This includes name and address shipper andconsignee, cargo size, weights, description and value, tracking no., bill of lading no., (signature for)
proof of delivery, prepaid or collect, invoice & packing list, etc.;• Group entities / agents operating on behalf of Yamato, such as the entities of the Yamato Holding
Group and agents in countries if no affiliate company. This includes all personal data mentionedabove;• Subcontractors and service providers involved in providing the services, such as airlines,shipping lines, trucking companies, depots.
7Transfer to countries outside the EEA

The third parties involved in providing the services may be located outside of your jurisdiction. We also share
Personal Data of you within the Yamato Group. This will involve transferring your data to countries outside
the European Economic Area (EEA), such as Japan.
If and insofar as we transfer Personal Data with parties in countries outside the EEA that do not have anadequate level of protection, we will agree with these parties data protection provisions set by the EuropeanCommission, so called Standard Contractual Clauses. A copy of the agreed standard provisions can berequested by you at Yamato. Please contact us if you would like to obtain additional information on thetransfer of Personal Data out of the EEA.

3

8Security

We take appropriate organizational and technical security measures to protect your Personal Data and toprevent misuse, loss or alteration thereof. In addition, we limit access to Personal Data to those employees,agents, contractors and other third parties who have a need to have access. Also the aforementioned persons
involved are bound by a confidentiality obligation, either in their employment agreements or (data processor)
contracts.
We have internal safety guidelines in place including a data breach policy in which it is described how to deal
with a suspected Personal Data breach. We will notify the relevant supervisory authority and the data
subjects involved if required under Applicable Privacy Legislation.
We store Personal Data which we collect during the provision of our services on servers in and outside theEEA, including Japan. The storage will involve transferring your data outside the EEA. Reference is made toarticle 7 of these Privacy Terms.
9Retention Periods

We do not store your Personal Data any longer than strictly necessary for the purposes for which we collectthe Personal Data. You may request Yamato to delete the Personal Data at any stage. If the Personal Data
are no longer required for the purposes for which we collected or otherwise Processed the Personal Data, wewill remove the Personal Data.
Yamato has in place Retention guidelines to ensure Personal Data is deleted after a reasonable time for thepurposes for which it was being held, unless a law requires such data to be kept for a minimum time.
10Data Subject’s rights

Data Subject’s rights:•••••••

In so far as the Personal Data Processing is based on consent, a Data Subject has the right towithdraw consent at any time.
A Data Subject has the right to request access to your Personal Data. This enables you to receive a
copy of the Personal Data we hold about you.
Data Subjects have the right to request rectification of the Personal Data that we hold about you.
This enables you to have any incomplete or inaccurate data we hold about you corrected.
Data Subjects have the right to request erasure of your Personal Data. This enables you to ask us
to delete or remove Personal Data where there is no good reason for us continuing to Process it.
Data Subjects have the right to object to Processing of your Personal Data where we are relying ona legitimate interest. Insofar as the Processing of your Personal Data takes place for direct marketing
purposes, we will always honour your request. For Processing for other purposes, we will also ceaseand desist Processing, unless we have compelling legitimate grounds for the Processing which
override your interests, rights and freedoms or that are related to the institution, exercise orsubstantiation of a legal claim.
Data Subjects have the right to request restriction of Processing of your Personal Data.
Data Subjects have the right to request to transfer of your Personal Data to you or to a thirdparty (right to data portability). We will provide Data Subjects, or a third party chosen,
Personal Data in a structured, commonly used, machine-readable format. Note that this rightonly
applies to automated information which you initially provided consent for us to use or where weused the information to perform a Contract with you.

4We may request specific information from you to help us confirm your identity and your right to access,and to provide you with the personal data that we hold about you or make your requested changes.
The exercise of the abovementioned rights is free of charge.
We will provide you with information about the follow-up to the request immediately and in any case within
one month of receipt of the request. Depending on the complexity of the request and on the number ofrequests, this period can be extended by another two months. We will notify you of such an extension within
one month of receipt of the request. Applicable law may allow or require us to refuse your request. If wecannot provide you with access to your personal data, we will inform you of the reasons why, subject to any
legal or regulatory restrictions. If requests are manifestly unfounded or excessive, in particular because of
the repetitive character, we will either charge you a reasonable fee or refuse to comply with the request.
11Contact details

For any questions, complaints or in the event that you wish to make use of one of the rights mentioned
above, you may contact us at the contact details below:
Email address:
Telephone number:s.geerts@yamatoeurope.com+31-20-3166803

Yamato has also appointed a Data Protection Officer,
AKD N.V., Eliëtte Vaal (dpo@akd.nl or +31-88-2535908).
12

Data protection Authority

In addition to the above mentioned rights you have the right to lodge a complaint with a supervisory authority,
in particular in the EU Member State of your habitual residence, place of work or of an alleged infringementof the GDPR at all times. However, we would appreciate the chance to deal with your concerns before you
approach the supervisory authority so please contact us beforehand.
13

Miscellaneous

If provisions from these Privacy Terms are in conflict with the law, they will be replaced by provisions of
the same purport that reflects the original intention of the provision, all this to the extent legallypermissible. In that case, the remaining provisions remain applicable unchanged.
Yamato reserves the right to change these Privacy Terms on a regular basis. It is your responsibility toregularly review the applicable conditions. These Privacy Terms are last amended and revised in May
2018.

5

14 Definitions
In these Privacy Terms, the following definitions apply:
Applicable Privacy Legislation:

Applicable Privacy Legislation, including the General Data
Protection Regulation (“GDPR”) and the relevant national
implementation acts.

Contract:

The Contract between a Customer and Yamato
concerning the purchase and delivery of products orservices.

Personal Data:

Personal Data concerns any information concerning anidentified or identifiable natural person that is Processedby Yamato as described in these Privacy Terms.

Privacy Terms:

The present Privacy Terms.

Processing :An operation or set of operations which is performed on
Personal Data or sets of Personal Data, whether or notby automated means, such as collection, recording,organization, structuring, storage, adaptation or alteration,retrieval, consultation, use, disclosure by transmission,dissemination or other wise making availabe, alignment orcombination, restriction, erasure or destruction.

Controller :The natural or legal person, public authority, agency orother body which, alone or jointly with others, determines
the purposes and means of the processing of Personal
Data.

Yamato :Yamato Transport Europe B.V.
Capronilaan 221119 NS SCHIPHOL-RIJK
The Netherlands
Chamber of Commerce number: 24172596

6