TOKYO ELECTRON EUROPE Ltd.
Tokyo Electron Europe Limited
STATEMENT ON COMPLIANCE WITH LAWS ON
DATA PROTECTION AND PRIVACYDELLORDT
ENTONICRNPUNEHW
21 April 2021

Tokyo Electron Europe Limited

TOKYO ELECTRON EUROPE Ltd.
CONTENTS

1. Overview of Compliance with Relevant Legislation and Regulations
2. Transparency
3. Co-operation
4. Purpose Limitation
5. Legal Basis for Processing
6. Data Minimization
7. Accuracy
8. Storage Limitation
9. Integrity and Confidentiality
10. Data Subject Rights
11. Processor Agreements
12. Privacy Notice / Data Policy
13. Security
14. Location of Data
15. Communication with Authorities
16. Data Breach
17. Israeli specific provisions

TOKYO ELECTRON EUROPE Ltd.
1. Overview of Compliance with Relevant Legislation and Regulations
1.1.

Tokyo Electron Europe and its branches, TEL Magnetic Solutions Limited, and Tokyo
Electron Israel Limited (together referred to as “the Company”) is committed toensuring the security and protection of the personal information that the Company
processes (“Personal Data”), and to provide a compliant and consistent approach todata protection.

1.2.

All definitions used in the present document on data protection shall have the same
meaning as defined in the relevant Data Protection Legislation as set out in section
1.3.

1.3.

The applicable Data Protection Legislation are as follows:

1.3.1. General Data Protection Regulation (GDPR) 2016/679 of the European Parliamentand of the Council of 27 April 2016 on the protection of natural persons with regard tothe processing of personal data and on the free movement of such data.
1.3.2. Data Protection Act 2018 (DPA 2018)
1.3.3. UK General Data Protection Regulation (UK GDPR) the retained EU law version of theGeneral Data Protection Regulation ((EU) 2016/679)
1.4.

If and when the Company can be qualified as a Data Controller or Data Processor on
behalf of the Customer, the Company will only process Personal Data:
As a Data Controller for the performance of the Agreement orAs a Data Processor under the instructions of the Customer
In accordance with this and the applicable Data Protection Legislation.

1.5.

The Company will ensure that all Personal Data held is processed in accordance withthe principles of the applicable Data Protection Legislation.

2. Transparency
2.1.

Personal Data is processed lawfully, fairly and in a transparent manner. This meansthat individuals should have full information about how their personal data isprocessed.

TOKYO ELECTRON EUROPE Ltd.
3. Co-operation
3.1.

The Company will work together in good faith with any contractual party to ensure theinformation referred to within Data Protection Legislation including Articles 13 and 14
GDPR is made available to relevant data subjects in relation to the processing byeither Party when acting as a Data Controller (which may include the provision by
Customer to Data Subjects, on behalf of the Company, of information relating to theCompany’s processing activities), and the information is in a concise, transparent,intelligible and easily accessible form, using clear and plain language as required by
Data Protection Legislation including GDPR Article 12.

4. Purpose Limitation
4.1.

Personal Data is obtained only for specified, explicit and legitimate purposes andshould not be further processed in any manner incompatible with these purposes.

5. Legal Basis for Processing
5.1.

The Company reviewed all processing activities to identify the legal basis forprocessing and ensures that each basis is appropriate for the activity it relates to.
Where applicable, the Company also maintains records of processing activities.

6. Data Minimization
6.1.

Personal Data is adequate, relevant and limited to what is necessary in relation to thepurposes for which it is processed.

7. Accuracy
7.1.

Personal Data is accurate and, where necessary, kept up to date.

8. Storage Limitation
8.1.

Personal Data is not kept in a form which permits identification of Data Subjects forlonger than is necessary for the purposes for which the data is processed.

TOKYO ELECTRON EUROPE Ltd.
9. Integrity and Confidentiality
9.1.

Personal Data is processed in a manner that ensures appropriate security of the
Personal Data using appropriate technical and organisational measures to protect
against misuse.

10. Data Subject Rights
10.1. The Company provides all information necessary to Data Subjects, in case of arequest and allows to exercise certain rights in relation to their Personal Data.
11. Processor Agreements
11.1. Where the Company uses a third party to process Personal Data, the Company hasentered into Data Processing Agreements to ensure that third parties meet andunderstand their Data Protection Legislation obligations. In addition, the Company
carries out initial and ongoing reviews of:•

The service provided•

The necessity of the processing activity•The technical and organisational measures in place•

Compliance with the Data Protection Legislation

12. Privacy Notice / Data Policy
12.1. The Company revised its Privacy Notice(s) to comply with Data Protection Legislation,
ensuring that all Data Subjects whose Personal Data are processed have been
informed of why the Company needs it, how it is used, what their rights are, who theinformation is disclosed to and what safeguarding measures are in place to protect
their information.
13. Security
13.1. The Company takes the privacy and security of Data Subjects and their Personal Datavery seriously and takes every reasonable measure and precaution to protect andsecure the Personal Data that the Company processes. the Company has robust
information security policies and procedures in place to protect Personal Data from

TOKYO ELECTRON EUROPE Ltd.
unauthorised access, alteration, disclosure or destruction and have several layers ofsecurity measures.
14. Location of Data
14.1. The Company will not transfer Personal Data to another country outside of Israel, theUnited Kingdom and European Economic Area (“EEA”), which does not offer a level ofdata protection considered as adequate under the applicable Data Protection
Legislation, without appropriate safeguards being in place.
15. Communication with Authorities
15.1. If the Company receives any complaint, notice or communication from a Supervisory
Authority which relates directly or indirectly to the Customer’s processing of Personal
Data or in relation to a Customer’s failure or potential failure to comply with Data
Protection Legislation, the Company will, to the extent permitted by law, promptly
forward the complaint, notice or communication to the Customer and provide theCustomer with reasonable co-operation and assistance in relation to the same.
16. Data Breach
16.1. If the Company becomes aware of a Personal Data Breach involving the Customer’s
Personal Data, it shall notify the Customer without undue delay, and will co-operatewith the Customer, to the extent reasonably requested, in relation to any notifications
to Supervisory Authorities or to Data Subjects which the Company is required to makeunder Data Protection Legislation.
16.2. For more information please contact the Data Protection Representative.
17. Israeli specific provisions
17.1. With respect to the processing of Personal Data by Tokyo Electron Israel Limited("TEY"), the following provisions shall apply in addition to the provisions of the above
Statement.
17.2. Overview of Compliance with Relevant Legislation and Regulations
The applicable Data Protection Legislation are the Protection of Privacy Law, 1981
and the regulations enacted thereunder.

TOKYO ELECTRON EUROPE Ltd.
17.3. Co-operation
The information referred made available to relevant data subjects in relation to theprocessing of their Personal Data by TEY shall also include indication as to whether
data subjects are under a legal obligation to deliver the Personal Data or whether suchdelivery is made with their own free will and consent and the purposes for which
Personal Data is transferred to recipients, if any.
17.4. Processor Agreements•TEY will assess, prior to entering an agreement with a data processor, whether
it is permitted to disclose Personal Data to the data processor, the previous
data processing experience, background and reputation of the data processor
and the data security risks involved in the engagement;•TEY shall request that the processor will, on annual basis at least, report toTEY regarding the implementation by the processor of the technical andorganisational measures in place under the Data Security Regulations and theagreement with TEY.

17.5. Security
TEY has robust information security policies and procedures in place to protect
Personal Data from unauthorised access, alteration, disclosure or destruction andhave several layers of security measures, in accordance with the requirements of theIsraeli Protection of Privacy Regulations (Data Security), 2017 (the "Data SecurityRegulations").
17.6. Location of Data
TEY will not transfer Personal Data to another country outside of Israel, unless: (i) thereceiving country in question ensures a level of protection of data which is not lower
than the level of protection provided for under the Israeli law or upon the fulfilment of
any of the conditions set out under the Protection of Privacy Regulations (The Transferof Data to a Database outside the State Borders), 2001, and (ii) TEY has entered intoa written agreement with the recipient according to which the latter undertakes to takesteps to ensure the privacy of the data subject, and that Personal Data shall not betransferred to any person other than himself/herself, whether such person be in thesame country or not.
17.7. Data BreachTOKYO ELECTRON EUROPE Ltd.
TEY shall assess whether it has an independent obligation to report the Personal Data
Breach to the applicable Supervisory Authority.