Primetals Technologies

Primetals Technologies Austria GmbH ............................................................................................ 2
Primetals Technologies Belgium nv/sa ............................................................................................ 7
Primetals Technologies Germany GmbH ....................................................................................... 12
Primetals Technologies Japan, Ltd................................................................................................. 17
Primetals Technologies, Limited .................................................................................................... 23

1/27

May 25th, 2018

Primetals Technologies Austria GmbH
データプライバシーポリシー

1. 一般情報
Primetals Technologies Austria GmbH（以下「PTAT」という）は、お客様の個人デー
タ（以下「データ」という）を保護するよう真摯に取り組んでいます。当社は、適用される法律のデータ保護要件に従い、以下の目的でお客様のデータを処理します。本プラ
イバシーポリシーにおいて、個人データとは、お客様個人に関連するすべての情報を意味します。関連するデータとは、具体的にはお客様の個人データ（お名前、ご住所、ご連絡先情報、生年月日）、請求データ（銀行データなど）を意味します。以下では、当社によるこれらのデータの取り扱い方法について説明しています。処理されるデータの詳細および使用方法は、主としてその用途に依存します。そのため、これらの情報の一部はお客様に適用されない場合があります。

2. 担当オフィスおよび連絡先
お客様のデータの処理の責任を負う「管理者」は以下の通りです：
Primetals Technologies Austria GmbH, Turmstraße 44, 4031 Linz, Austria、メール：
contact@primetals.com
PTAT のデータ保護に関するご質問またはご意見がある場合（情報およびお客様のデー
タの更新）、当社のデータ保護担当者 contact@primetals.com までご連絡いただくこともできます。

3. 当社が使用する情報源およびデータ
当社は、当社のビジネス関係の枠組み内（事前契約段階を含む）の顧客、サプライヤー、
ビジネスパートナー、またはその他のデータ主体から受け取る個人データを処理します。
また当社は、当社のサービス提供に必要な範囲において、公開されている情報源（会社
登記簿、商業登記簿、土地登記簿、債務者登記簿、プレス資料、インターネットなど）から取得できる個人データ、または他の Primetals グループ会社により当社に正当に転送された個人データを処理します。
関連する個人データには、マスターデータ（名前、住所、その他の連絡先データ）、注
文データ（注文に関する個人データなど）、契約上の義務の履行により得られるデータ

2/27

May 25th, 2018

（支払い処理に関するデータなど）、文書データ（ビジネス通信、会議議事録など）、
および上記のカテゴリーに該当するその他のデータが含まれます。

4. 当社がお客様のデータを収集、処理する目的と法的根拠
4.1 契約上の義務の履行のため（GDPR第6条第1項(b)）
PTATは、お客様との契約を履行するため、または通常ご要望により契約前の措置を実施するため、お客様の個人データを処理します。実際の処理はそれぞれのビジネス関係に依存し、これらにはコミュニケーション、通信、ニーズ分析、コンサルティング、プ
ロジェクトの実施とサポート、請求、支払いプロセス、および取引の実施が含まれます。
これらのデータを処理しない場合、当社は契約を締結または履行することはできません。
4.2 正当な利益を鑑みる文脈において（GDPR第6条第1項(f)）
必要に応じ、当社は、当社の正当な利益を保護するため、実際の契約履行の枠を超えてお客様のデータを処理します。この場合の例は以下の通りです：- 訴訟における法的要求の主張および抗弁のため- PTATのITセキュリティおよびIT運営を保証するため- 刑事犯罪を防止、調査するため、財産権保護の目的でビデオ監視を行うため、盗難および詐欺事件の証拠を収集するため。所有権を保護するためのその他の措置- ビルおよびシステムの安全を保証するための措置（アクセス制御など）- ビジネスの管理およびサービスと製品のさらなる開発のための措置- Primetalsグループでのリスク管理のため

4.3 お客様の同意に基づく（GDPR第6条第1項(a)）
お客様が、特定の目的（Primetalsグループ内でのデータの受け渡し、イベントでの写真、ニュースレターの発送、広告の素材など）のために個人データ処理の同意を当社に与えている場合、当社は、お客様の同意を根拠としてかかる情報を合法的に処理します。お客様は、理由を提示することなく随時同意を撤回することができます。またこれは、GDPRが効力を持つ前、すなわち2018年5月25日以前に与えられた同意の撤回にも適用されます。同意の撤回は将来に対してのみ有効であり、同意の撤回前に処理されたデー
タの合法性には影響を与えません。
4.4 法的要件による（GDPR 第 6 条第 1 項(c)）

3/27

May 25th, 2018

また当社は、様々な法律の規定（租税管理、報告義務の履行など）に従うためにお客様のデータを処理することが要求されます。当然ながら、かかる処理は、関連する法律の規定に従うために必要とされるデータに限定されます。

5. お客様の個人データの受領者
5.1 第三者と処理業者
またお客様の個人データは、PTAT（処理業者）に代わって業務を行う他の会社により、またはPTATのビジネスパートナーシップ（第三者）の文脈において使用される場合があります。これらの会社には、Primetalsグループ（PTグループ）会社または外部の会
社およびパートナー（PTATパートナー）が含まれます。PTグループ会社の全リストはこちらをご覧ください：https://www.Primetals.com/contact-us/locations。さらに、お客様のデータ受領者には、ITサービス、ロジスティクス、電気通信などの分野の会社が含まれます。
5.2 欧州連合（EU）圏外の受領者
PTATは、ITの運営を保証するITサービスプロバイダーなど、欧州経済地域圏外（第三国）に所在するサービスプロバイダーを慎重に選定し、サービス業務を委託しています。
この場合、情報は第三国に転送されます。
これらのデータ処理権限を持つ人物は、すべての関連する情報の機密を保持する義務を追っています。さらに当社は、お客様のデータを保護するために最新の措置を講じています。
また当社は以下の場合、第三国にデータを転送します：- 当社の契約上の義務を履行するために必要な場合- 法律により義務付けられる場合（税の報告義務など）、または- お客様が当社に同意を与えている場合。

法律により要求される範囲において、お客様のデータを十分に保護するため、PTATは、
データに十分なレベルの保護を提供するため、EU標準契約条項を含む法的要件に準拠する保証を使用します。この場合、お客様のデータにはEUと同じレベルの保護が提供されます。この件に関する詳細については、第2項に記載された連絡先情報を使用し、PTATまでお問い合わせください。

4/27

May 25th, 2018

6. データの保管と削除
PTAT は、当社の契約上および法律上の義務を履行するために必要な期間にわたり、お客様の個人データを処理、保管します。お客様との契約上の関係が終了した場合、すべての相互協議申立ては解決され、その他の法律上の保管義務または保管のための正当な法的根拠は消滅し、お客様のデータは削除されます。
ただし、契約上の関係が終了した後も、当社は、当社の正当な利益を追加の根拠として
お客様のデータをさらに処理する場合があります。この場合の当社の正当な利益には、
再度当社の製品およびサービスに対するお客様の関心を引くことなどが含まれます。当社とビジネス関係にあるお客様に直接広告を送信する上での当社の利益を鑑み、契約後の広告の目的のためにお客様のデータを使用する際には当社の利益が優先されます。お客様が異議を申し立てる場合、お客様にはいつでもこの処理を停止する選択肢があります。PTATは、上述の処理目的に従い、かかるデータを適切に使用します。

7. 自動処理による決定
GDPR第22条に従い、当社は、当社のビジネス関係の確立および履行のために完全な自動処理による決定を使用することはありません。

8. プロファイリング
GDPR第22条に従い、当社はプロファイリングを行いません。

9. お客様の個人データの提供
当社とのビジネス契約の範囲において、お客様は、ビジネス関係の確立、履行、終了、
および関連する契約上の義務の履行に必要な個人データ、または当社が法律により収集する権限を有する個人データを提供する必要があります。これらのデータがない場合、当社はお客様との契約を締結または履行することはできません。

10. お客様のプライバシー権
10.1 アクセス、訂正、削除、処理を制限する権利
お客様は、お客様の個人データにアクセスする権利を有します。また特定の条件下では、お客様のデータを訂正および削除する権利を有します。さらに、法的前提がある場合、データの処理を制限する権利を有します。

5/27

May 25th, 2018

10.2 異議申し立ての権利
お客様は、随時、GDPR第6条第1項(e)（公共の利益に基づくデータ処理）およびGDPR
第6条第1項(f)（利益を鑑みることを根拠とするデータ処理）に従い、お客様の特定の状況に起因する理由により、いつでもお客様の個人データの処理に異議申し立てを行う権利を有します。お客様が異議申し立てを行う場合、当社は、お客様の利益、権利、自由に優先する説得力のある正当な処理理由がない限り、または法的要求の主張、行使、または弁護のために処理が行われる場合を除き、お客様の個人データの処理を停止します。
お客様は、随時、広告を目的とするお客様のデータの処理に異議申し立てを行う権利を有します。お客様が直接広告を目的とした処理に異議申し立てを行う場合、当社は、これらの目的でのお客様の個人データの処理を停止します。
10.3 撤回の権利
お客様がPTATに対し、データ処理に対する明示的な同意を与えている場合、お客様は、理由を提示することなく、随時同意を撤回することができます。同意の撤回は、同意の撤回前に処理されたデータの合法性には影響を与えません。

10.4 データポータビリティ権
お客様は、構造化され、一般的に利用され、機械により読み取り可能な形式でお客様の個人データを受け取る権利を有します。またお客様は、これらのデータを他の管理者に移転する権利を有します。また、技術的に可能な場合、これらのデータを当社から直接他の管理者に移転させる権利を有します。
第10項に規定された権利を行使するには、第2項に記載された連絡先情報を使用し、PTATまでお問い合わせください。
10.5 質問または苦情
お客様は、ご質問または苦情がある場合、管轄当局であるオーストリアデータ保護当局に連絡する権利を有します。連絡先は以下の通りです：dsb@dsb.gv.at または郵送の場
合の連絡先は以下の通りです： Wickenburggasse 8, 1080 Vienna.

11. 当社のデータプライバシーポリシーの更新
データ保護法またはビジネスニーズが変化した場合、当社は、必要に応じて随時当社のデータプライバシーポリシーを更新します。

2018年5月25日

6/27

May 25th, 2018

Primetals Technologies Belgium nv/sa
Data Privacy Policy

1. General information
Primetals Technologies Belgium nv/sa (hereinafter also referred to as PTBE) takes theprotection of your personal data (hereinafter also referred to as data) very seriously. We
process your data in accordance with the applicable legal data protection requirements
for the purposes listed below. Personal data in the sense of this privacy policy is all
information that is related to you personally. Relevant data are in particular yourpersonal data (e.g. name, address, contact data, date of birth), your billing data (e.g.
bank data) etc. In the following you will learn how we handle this data. What data isprocessed in detail and how it is used depends largely on the intended use. Therefore,
not all parts of this information may apply to you.

2. Responsible office and contact
The "Controller" responsible for the processing of your data is
Primetals Technologies Belgium nv/sa, W.A Mozartlaan 4, 1620 Drogenbos, Belgium, email: secretariat.BE@primetals.com.
If you have any questions or comments about PTBE's data protection (e.g. about
information and updating your data), you can also contact our data protection person
responsible at secretariat.BE@primetals.com.

3. What sources and data do we use?
We process personal data that we receive from our customers, suppliers, business
partners or other data subjects within the framework of our business relationship(including pre-contractual phase). In addition, we process personal data to the extent
necessary for the provision of our services, which we may obtain from publicly
accessible sources (e.g. company registers, commercial registers, land registers, debtor
registers, press, internet) or which is legitimately transmitted to us by other companies of
the Primetals Group.
Relevant personal data are master data (name, address and other contact data), orderdata (e.g. personal data for the order), data from the fulfilment of our contractual
obligations (e.g. data for payment processing), documentation data (e.g. businesscorrespondence, minutes of meetings) and other data comparable with the categories
mentioned.

7/27

May 25th, 2018

4. The purposes for which your data are collected and processed and their legal
bases
4.1 For the fulfilment of contractual obligations (Art. 6(1) point (b) GDPR)PTBE processes your personal data to fulfil the contract with you or to carry out precontractual measures, which are generally taken upon request. The actual processing
depends on the respective business relationship and can include communication,correspondence, needs analyses, consulting, project execution and support, billing,
payment processing as well as the execution of transactions. Without this dataprocessing we cannot conclude or fulfil the contract.
4.2 Within the framework of the weighing of interests (Art. 6(1) point (f) GDPR)
If necessary, we process your data above and beyond the actual performance of thecontract to protect our legitimate interests. Examples of this could be:

4.3-

To assert legal claims and for defence in legal disputes;-

To guarantee IT security and the IT operation of PTBE;-

To prevent and investigate criminal offences, video surveillance for theprotection of property rights, to collect evidence in cases of robbery and fraud.
Other measures to secure property rights;-

Measures to ensure building and system security (e.g. access controls);-

Measures for managing the business and further developing services andproducts;-

For risk management in the Primetals Group;
On the basis of your consent (Art. 6(1) point (a) GDPR)

If you have given us your consent to the processing of personal data for certain
purposes (e.g. passing on of data within the Primetals Group, photographs within theframework of events, newsletter dispatch, advertising material), the lawfulness of thisprocessing is given on the basis of your consent. A given consent can be withdrawn at
any time and without providing reasons. This also applies to the withdrawal of
declarations of consent issued to us prior to the validity of the GDPR, i.e. before 25 May
2018. The withdrawal of consent is only effective for the future and does not affect thelawfulness of the data processed before your withdrawal of consent.
4.4

Due to legal requirements (Art. 6(1) point (c) GDPR)

In addition, we are required to process your data in order to comply with various
statutory provisions (e.g. fulfilment of tax control and reporting obligations). This
processing is of course limited to the data required to comply with the relevant statutory
provisions.

8/27

May 25th, 2018

5. Recipients of your personal data
5.1 Third parties and processors
Your personal data will also be used by other companies working on behalf of PTBE
(processors) or in the context of PTBE's business partnerships (third parties). These canbe companies of the Primetals Group (PT Group) or external companies and partners(PTBE partners). You can find a list of all companies of the PT Group here:
https://www.Primetals.com/contact-us/locations. Furthermore, possible recipients of yourdata are companies in the categories of IT services, logistics, telecommunications, etc.
5.2 Recipients outside the European Union (EU)PTBE has outsourced individual services by carefully selected and commissioned
service providers based outside the European Economic Area (third country), e.g. IT
service providers to guarantee IT operations. In these cases transfer to a third country
takes place.
We would like to point out that the persons authorised to process the data are obliged tomaintain confidentiality regarding all related information. Furthermore, we ensure thatstate-of-the-art measures are taken to protect your data.
We also intend to transfer data to locations in third countries in the following cases:-

if it is necessary to fulfil our contractual obligations;-

if required by law (e.g. tax reporting obligations) or-

if you have given us your consent.

To the extent required by law to provide an adequate level of protection for your data,
PTBE uses guarantees that comply with the legal requirements to establish an
adequate level of data protection, including EU standard contractual clauses. In thiscase your data will have the same protection as in the EU. If you wish to receive further
information on this subject, you can contact PTBE using the contact details mentioned
under point 2.

6. Data storage and data erasure
PTBE processes and stores your personal data as long as this is necessary to fulfil ourcontractual and legal obligations. If the contractual relationship with you is terminated, allmutual claims are fulfilled and no other legal storage obligations or legal justification
bases for storage exist, your data will be deleted.
However, our legitimate interests may constitute an additional legal basis for the further
processing of your data after termination of a contractual relationship. Our legitimate
interests are, for example, to interest you once again in our products and services. In

9/27

May 25th, 2018

line with the weighing of interests in sending you direct advertising during our business
relationship with you, our interests also prevail when using your data for this postcontractual advertising purpose. If you object, you have the option of stopping thisprocessing at any time. PTBE uses this data appropriately in accordance with theprocessing purpose described above.

7. Automated decisions
We do not use any fully automated decisions in accordance with Art. 22 GDPR toestablish and implement our business relationships.

8. Profiling
We do not do profiling pursuant to Art. 22 GDPR.

9. Provision of your personal data
Within the framework of our business relationship, you must provide those personal data
which are necessary for the establishment, execution and termination of a business
relationship and for the fulfilment of the associated contractual obligations or which weare legally entitled to collect. Without this information, we will usually not be able to enter
into, execute and terminate a contract with you.

10. Your privacy rights
10.1 Access, rectification, erasure, restriction of processing
You have the right to have access to your personal data. Under certain conditions, youalso have the right to rectification and erasure of your data. Furthermore, you have theright to restrict processing if the legal prerequisites are given.
10.2 Right to object
You have the right to object at any time for reasons arising from your particular situation
to the processing of personal data concerning you under Art. 6(1) point (e) GDPR (public
interest data processing) and Art. 6(1) point (f) GDPR (data processing on the basis of aweighing of interests). If you object, we will no longer process your personal data unless
we can prove compelling legitimate reasons for the processing which outweigh yourinterests, rights and freedoms, or the processing serves to assert, exercise or defend
legal claims.
You have the right to object to the processing of your data for advertising purposes at
any time. If you object to the processing for direct advertising purposes, we will no

10/27

May 25th, 2018

longer process your personal data for these purposes.
10.3 Right of withdrawal
If you have given PTBE express consent to the processing of your data, you can
withdraw this consent at any time and without stating any reasons. The lawfulness ofthe processing of your data before your withdrawal of consent remains unaffected by
the withdrawal.
10.4 Right to data portability
You have the right to receive the personal data concerning you in a structured, common
and machine-readable format. You are entitled to transfer this data to other controllers.
If technically feasible, you have the right to obtain a transmission from us directly toanother controller.
To exercise the rights referred to in point 10, you may contact PTBE using the contact
details referred to in point 2.
10.5 Questions or complaints
You have the right to contact the competent supervisory authority, the Belgian dataprotection authority, with questions or complaints. You can reach them at the following
e-mail address: contact@apd-gba.be or at the following address: Drukpersstraat 35,
1000 Brussel or via their website: https://www.dataprotectionauthority.be/contact-us

11. Updating of our data privacy policy
We will update our data privacy policy accordingly, if necessary, in case data protection
regulations or business needs change.

11/27

May 25th, 2018

Primetals Technologies Germany GmbH
Data Privacy Policy

Information on data protection pursuant to Art. 13 and Art. 14 GDPR
1. General information
Primetals Technologies Germany GmbH (hereinafter also referred to as PTDE) takes
the protection of your personal data (hereinafter also referred to as data) very seriously.
We process your data in accordance with the applicable legal data protection
requirements for the purposes listed below. Personal data in the sense of this privacy
policy is any personal data that is related to you. Relevant data include in particular yourpersonal data (e.g. name, address, contact details, date of birth), your billing data (e.g.
bank details) etc. Below you will learn how we handle this data. The data which we
process in detail and how it is used will depend largely on the intended purpose of use.
Therefore, not all parts of this Data Privacy Policy may apply to you.
2. Responsible office and contact
The "Controller" responsible for the processing of your data is
Primetals Technologies Germany GmbH, Bunsenstraße 43, 91058 Erlangen, Germany,e-mail: contact@primetals.com .
If you have any questions or comments about PTDE's data protection (e.g. about
information and updating your data), you can also contact our data protection officer at
e-mail: datenschutz.de@extprimetals.com.
3. What sources and data do we use?
We process personal data that we receive from our customers, suppliers, business
partners or other persons concerned during our business relationship (including theprecontractual phase). In addition, we process personal data to the extent necessary forthe provision of our services, which we may obtain from publicly accessible sources (e.g.
company registers, commercial registers, land registers, debtor registers, press, Internet)
or which is legitimately transmitted to us by other companies of the Primetals Group.
Relevant personal data consist of master data (name, address and other contact data),
order data (e.g. personal data for the order), data arising from the fulfilment of ourcontractual obligations (e.g. data for payment processing), documentation data (e.g.
business correspondence, minutes of meetings) and other data comparable with theafore-mentioned categories.
4. The purposes for which your data is collected and processed and the legal bases
for such data collection and processing
4.1 For the fulfilment of contractual obligations (Art. 6 (1) point (b) GDPR1)

12/27

May 25th, 2018

PTDE processes your personal data to fulfil the contract with you or to carry out
precontractual measures, which, in principle, are only taken upon request. The actual
processing depends on the respective business relationship and can include
communication, correspondence, needs analyses, consulting, project execution andsupport services, billing, payment processing as well as the execution of transactions.
Without this data processing we cannot conclude or fulfil the contract.
4.2 In the context of a weighing of interests (Art. 6 (1) point (f) GDPR)
To the extent necessary, we may process your data beyond the actual performance ofthe contract to protect our legitimate interests. Examples of this could be:--

To assert or defend legal claims in legal disputes;
To guarantee IT security and the IT operations of PTDE;
To prevent and investigate criminal offences, video surveillance for the protectionof property rights, to collect evidence in cases of robbery and fraud. Other
measures to secure property rights;
Measures to ensure building and system security (e.g. access controls);
Measures for managing the business and further development of services andproducts;
For risk management in the Primetals Group.

4.3 On the basis of your consent (Art. 6 (1) point (a) GDPR)
If you have given us your consent to the processing of personal data for certain
purposes (e.g. passing on of data within the Primetals Group, newsletter dispatch,advertising material), the lawfulness of this processing is given on the basis of yourconsent. Consent given can be revoked at any time and without stating reasons. This
also applies to the withdrawal of declarations of consent issued to us prior to the validityof the GDPR, i.e. before 25 May 2018. The revocation of consent is only effective for the
future and does not affect the lawfulness of the data processed prior to your revocationof consent.
4.4 Due to legal requirements (Art. 6 (1) point (c) GDPR)
In addition, we are required to process your data in order to comply with various
statutory provisions (e.g. fulfilment of tax control and reporting obligations). This
processing is, of course, limited to the data required to comply with the relevant statutory
provisions.
4.5 General data processing as part of your job application
We process data from your job application that we need in the context of the application.
This may include contact details, as well as all data related to the application (CV,certificates, qualifications, answers to questions, etc.). The legal basis for this arises
from section 26 of the German Federal Data Protection Act as well as from Art. 6 (1)point (b) of the GDPR for initiating or performing contractual relationships. Furthermore,
we may process personal data from you during your job application process, provided
this is necessary for the compliance with legal obligations on the legal basis of Art. 6 (1)

13/27

May 25th, 2018point (c) of the GDPR) or on the legal basis of Art. 6 (1) point (f) of the GDPR to defend
against asserted claims against us. The legitimate interest in this case is, for example, aburden of proof in proceedings under the German General Equal Treatment Act (AGG).
If there is an employment relationship between you and us, we may, in accordance with
Art. 88 of the GDPR in conjunction with section 26 of the German Federal Data
Protection Act (BDSG) further process the personal data already received from you forpurposes of the employment relationship, insofar as this is necessary for the
performance or termination of the employment relationship or for the exercise or thefulfilment of the rights and obligations of the employee's representation of interests
arising from a law or a collective wage agreement, a works or service agreement(collective agreement).
5. Recipients of your personal data
5.1 Third parties and processors
Your personal data will also be used by other companies working on behalf of PTDE
(processors) or in the context of PTDE's business partnerships (third parties). These canbe companies of the Primetals Group (PT Group) or external companies and partners(PTDE partners). You can find a list of all companies of the PT Group at:https://www.Primetals.com/contact-us/locations. Furthermore, other possible recipientsof your data include IT service, logistics and telecommunications companies, etc.
5.2 Recipients outside the European Union (EU)PTDE has outsourced individual services by carefully selected and commissioned
service providers based outside the European Economic Area (third country), e.g. IT
service providers to guarantee IT operations. In these cases transfer to a third country
takes place.
We would like to point out that the persons authorised to process the data are obliged tomaintain confidentiality regarding all related information. Furthermore, we ensure thatstate-of-the-art measures are taken to protect your data.
We also intend to transfer data to locations in third countries in the following cases:-

if it is necessary to fulfil our contractual obligations;
if required by law (e.g. tax reporting obligations) or
if you have given us your consent.

To the extent required by law to provide an adequate level of protection for your data,
PTDE grants the appropriate guarantees in accordance with the legal requirements inorder to establish an adequate level of data protection, including EU standard
contractual clauses. In this case your data will have the same protection as in the EU. If
you wish to receive further information on this topic, you can contact PTDE at thecontact address specified in paragraph 2.
6. Storage of data and data erasure

14/27

May 25th, 2018

PTDE processes and stores your personal data as long as this is necessary to fulfil ourcontractual and legal obligations. If the contractual relationship with you is terminated, allmutual claims are fulfilled and no other legal or statutory basis for storage obligations
exist, your data will be deleted.
However, our legitimate interests may constitute an additional legal basis for the further
processing of your data after termination of a contractual relationship. Our legitimate
interests include, for example, to convince you anew of the benefits of our products andservices. In accordance with the balance of interests, we may send you directadvertising during our business relationship, our interests also prevail when using yourdata for this post-contractual advertising purpose. You may object to the processing ofdata for such purpose at any time. PTDE uses this data appropriately in accordance withthe processing purpose as described above.
7. Automated decisions
We do not use any fully automated decisions in accordance with Art. 22 GDPR toestablish and implement our business relationships.
8. Profiling
Profiling pursuant to Art. 22 GDPR does not occur.
9. Provision of your personal data
During our business relationship, you must provide personal data which is necessary forthe establishment, execution and termination of the business relationship and for thefulfilment of the associated contractual obligations or personal data which we are legally
entitled to collect. Without this information, we will usually not be able to enter into,
execute and terminate a contract with you.
10. Your privacy rights
10.1 Access, rectification, erasure, restriction of processing
You may exercise your rights of access to your personal data. Under certain conditions,
you also have the right to rectification and erasure of your data. Furthermore, you havethe right to restrict processing if the legal prerequisites are given.
10.2 Right to object
You have the right to object at any time for reasons arising from your particular situation
to the processing of your personal data under Art. 6 (1) point (e) GDPR (public interest
data processing) and Art. 6 (1) point (f) GDPR (data processing on the basis of aweighing of interests). If you object, we will no longer process your personal data unless
we can prove compelling legitimate reasons for the processing which outweigh yourinterests, rights and freedoms, or the processing serves to assert, exercise or defend
legal claims.

15/27

May 25th, 2018

You have the right to object to the processing of your data for advertising purposes at
any time. If you object to the processing for direct advertising purposes, we will nolonger process your personal data for such purposes.
10.3 Right to withdraw consent
If you have given PTDE express consent to the processing of your data, you can
withdraw this consent at any time and without stating any reasons. The lawfulness of theprocessing of your data before your withdrawal of consent remains unaffected by thewithdrawal.
10.4 Right to data portability
You have the right to receive the personal data concerning you in a structured, common
and machine-readable format. You are entitled to transfer this data to other controllers. If
technically feasible, you have the right to obtain a transmission from us directly toanother controller.
To exercise the rights referred to in paragraph 10, you may contact PTDE at the contact
address referred to in paragraph 2.
10.5 Questions or complaints
You have the right to contact the competent supervisory authority, the Data Protection
Authority of Bavaria for the Private Sector, with questions or complaints at the following
address:
Street Address:
Promenade 18
91522 Ansbach
Germany

Postal address:
Postfach 1349
91504 Ansbach
Germany

Contact information
Phone: +49 (0) 981 53 1300
Fax: +49 (0) 981 53 98 1300
E-Mail: poststelle@lda.bayern.de
11. Updating of our data privacy policy
If necessary, we will update our Data Privacy Policy accordingly, in the event that thedata protection regulations or our business requirements change.

16/27

May 25th, 2018

Primetals Technologies Japan, Ltd.
個人情報保護方針

•

•
•

•
•
•

•

•

•

•

17/27

May 25th, 2018

•

•

•

•

•

•

•
•

•
•

•

•

18/27

May 25th, 2018

•

•

•
•

19/27

May 25th, 2018

•

•

•

•

20/27

May 25th, 2018

•
•
•
•
•

•

当社のウェブサイトにおける個人情報の取扱いについて（1）個人情報入手時のセキュリティ

21/27

May 25th, 2018

（2）閲覧履歴の採取について（3）その他

22/27

May 25th, 2018

Primetals Technologies, Limited
Data Privacy Policy

1. General information
Primetals Technologies Limited (hereinafter also referred to as PTUK) takes theprotection of your personal data (hereinafter also referred to as data) very seriously. We
process your data in accordance with the applicable legal data protection requirements
for the purposes listed below. Personal data in the sense of this privacy policy is all
information that is related to you personally. Relevant data is in particular: your personal
data (e.g. name, address, contact data, date of birth) and your billing data (e.g. bankdata) etc. In this document you will learn how we handle this data. What data isprocessed in detail and how it is used depends largely on the intended use. Therefore
not all parts of this information may apply to you.

2. Responsible office and contact
The "Controller" responsible for the processing of your data is
Primetals Technologies, Limited, Building 11 Chiswick Park, 566 Chiswick High Road,
London, England, W4 5YA.
If you have any questions or comments about PTUK's data protection (e.g. about
information and updating your data), you can contact our data protection person
responsible at dataprotection.gb@primetals.com.

3. What sources and data do we use?
We process personal data that we receive from our customers, suppliers, business
partners or other data subjects within the framework of our business relationship(including pre-contractual phase). In addition, we process personal data to the extent
necessary for the provision of our services, which we may obtain from publicly
accessible sources (e.g. company registers, commercial registers, land registers, debtor
registers, press, internet) or which is legitimately transmitted to us by other companies of
the Primetals Group.
Relevant personal data is master data (name, address and other contact data), orderdata (e.g. personal data for the order), data from the fulfilment of our contractual
obligations (e.g. data for payment processing), documentation data (e.g. businesscorrespondence, minutes of meetings) and other data comparable with the categories
mentioned.

23/27

May 25th, 2018

4. The purposes for which your data are collected and processed and their legal
bases
4.1 For the fulfilment of contractual obligations (Art. 6(1) point (b) GDPR)PTUK processes your personal data to fulfil the contract with you or to carry out precontractual measures, which are generally taken upon request. The actual processing
depends on the respective business relationship and can include communication,correspondence, needs analyses, consulting, project execution and support, billing,
payment processing as well as the execution of transactions. Without this dataprocessing we cannot conclude or fulfil the contract.
4.2 Within the framework of the weighing of interests (Art. 6(1) point (f) GDPR)
If necessary, we process your data above and beyond the actual performance of thecontract to protect our legitimate interests. Examples of this could be:

4.3-

To assert legal claims and for defence in legal disputes;-

To guarantee IT security and the IT operation of PTUK;-To prevent and investigate criminal offences, video surveillance for theprotection of property rights, to collect evidence in cases of robbery and fraud.
Other measures to secure property rights;-

Measures to ensure building and system security (e.g. access controls);-

Measures for managing the business and further developing services andproducts;-

For risk management in the Primetals Group;
On the basis of your consent (Art. 6(1) point (a) GDPR)

If you have given us your consent to the processing of personal data for certain
purposes (e.g. passing on of data within the Primetals Group, photographs within theframework of events, newsletter dispatch, advertising material), the lawfulness of thisprocessing is given on the basis of your consent. A given consent can be withdrawn at
any time and without providing reasons. This also applies to the withdrawal of
declarations of consent issued to us prior to the validity of the GDPR, i.e. before 25 May
2018. The withdrawal of consent is only effective for the future and does not affect thelawfulness of the data processed before your withdrawal of consent.
4.4

Due to legal requirements (Art. 6(1) point (c) GDPR)

In addition, we are required to process your data in order to comply with various
statutory provisions (e.g. fulfilment of tax control and reporting obligations). This

24/27

May 25th, 2018

processing is of course limited to the data required to comply with the relevant statutory
provisions.

5. Recipients of your personal data
5.1 Third parties and processors
Your personal data will also be used by other companies working on behalf of PTUK
(processors) or in the context of PTUK's business partnerships (third parties). These canbe companies of the Primetals Group (PT Group) or external companies and partners(PTUK partners). You can find a list of all companies of the PT Group here:
https://www.Primetals.com/contact-us/locations. Furthermore, possible recipients of yourdata are companies in the categories of IT services, logistics, telecommunications, etc.
5.2 Recipients outside the European Union (EU)PTUK has outsourced individual services by carefully selected and commissioned
service providers based outside the European Economic Area (third country), e.g. IT
service providers to guarantee IT operations. In these cases transfer to a third country
takes place.
We would like to point out that the persons authorised to process the data are obliged tomaintain confidentiality regarding all related information. Furthermore, we ensure thatstate-of-the-art measures are taken to protect your data.
We also intend to transfer data to locations in third countries in the following cases:-

if it is necessary to fulfil our contractual obligations;-

if required by law (e.g. tax reporting obligations) or-

if you have given us your consent.

To the extent required by law to provide an adequate level of protection for your data,
PTUK uses guarantees that comply with the legal requirements to establish an
adequate level of data protection, including EU standard contractual clauses. In thiscase your data will have the same protection as in the EU. If you wish to receive further
information on this subject, you can contact PTUK using the contact details mentioned
under point 2.

6. Data storage and data erasure
PTUK processes and stores your personal data as long as this is necessary to fulfil ourcontractual and legal obligations. If the contractual relationship with you is terminated, allmutual claims are fulfilled and no other legal storage obligations or legal justification

25/27

May 25th, 2018

bases for storage exist, your data will be deleted.
However, our legitimate interests may constitute an additional legal basis for the further
processing of your data after termination of a contractual relationship. Our legitimate
interests are, for example, to interest you once again in our products and services. Inline with the weighing of interests in sending you direct advertising during our business
relationship with you, our interests also prevail when using your data for this postcontractual advertising purpose. If you object, you have the option of stopping thisprocessing at any time. PTUK uses this data appropriately in accordance with theprocessing purpose described above.

7. Automated decisions
We do not use any fully automated decisions in accordance with Art. 22 GDPR toestablish and implement our business relationships.

8. Profiling
We do not do profiling pursuant to Art. 22 GDPR.

9. Provision of your personal data
Within the framework of our business relationship, you must provide those personal data
which are necessary for the establishment, execution and termination of a business
relationship and for the fulfilment of the associated contractual obligations or which weare legally entitled to collect. Without this information, we will usually not be able to enter
into, execute and terminate a contract with you.

10. Your privacy rights
10.1 Access, rectification, erasure, restriction of processing
You have the right to have access to your personal data. Under certain conditions, youalso have the right to rectification and erasure of your data. Furthermore, you have theright to restrict processing if the legal prerequisites are given.
10.2 Right to object
You have the right to object at any time for reasons arising from your particular situation
to the processing of personal data concerning you under Art. 6(1) point (e) GDPR (public
interest data processing) and Art. 6(1) point (f) GDPR (data processing on the basis of aweighing of interests). If you object, we will no longer process your personal data unless
we can prove compelling legitimate reasons for the processing which outweigh your

26/27

May 25th, 2018

interests, rights and freedoms, or the processing serves to assert, exercise or defend
legal claims.
You have the right to object to the processing of your data for advertising purposes at
any time. If you object to the processing for direct advertising purposes, we will nolonger process your personal data for these purposes.
10.3 Right of withdrawal
If you have given PTUK express consent to the processing of your data, you can
withdraw this consent at any time and without stating any reasons. The lawfulness ofthe processing of your data before your withdrawal of consent remains unaffected by
the withdrawal.
10.4 Right to data portability
You have the right to receive the personal data concerning you in a structured, common
and machine-readable format. You are entitled to transfer this data to other controllers.
If technically feasible, you have the right to obtain a transmission from us directly toanother controller.
To exercise the rights referred to in point 10, you may contact PTUK using the contact
details referred to in point 2.
10.5 Questions or complaints
You have the right to contact the UK data protection authority, the Information
Commissioner’s Office, with questions or complaints.

11. Updating of our data privacy policy
We will update our data privacy policy accordingly, if necessary, in case data protection
regulations or business needs change.

27/27

May 25th, 2018