Data Protection Information for Business Partners
At ROHM Semiconductor GmbH, we take the protection of personal data and the confidential
treatment of such data very seriously. We hereby inform you about the processing of yourpersonal data in the context of the business relationship with you or your employer and the rights
to which you are entitled. Your personal data will be processed only within the framework of theapplicable statutory provisions relating to data protection law, in particular, the General Data
Protection Regulation (hereinafter referred to as “GDPR”) and the German Federal Data
Protection Act [Bundesdatenschutzgesetz] (“BDSG”).
I. Who is responsible for data processing and who is the data protection officer?
1. The controller that is responsible for the processing of your personal data is:
ROHM Semiconductor GmbH
Karl-Arnold-Str. 1547877 Willich
Germany
00492154-9210
0049-2154-921400
info@de.rohmeurope.com

2. You may reach our data protection officer as follows:
Mr. Dr. Gregor Scheja
Scheja und Partner Rechtsanwälte mbB
Adenauerallee 136
53113 Bonn
Germany
telephone number: (+49) 0228-227 226 0
https://www.scheja-partner.de/kontakt/kontakt.html
www.scheja-partner.deII. What is the subject matter of data protection?
The subject matter of data protection is personal data. This covers all information referring to an
identified or identifiable natural person (who is called a data subject). This includes informationas, e.g., name, postal address, e-mail address, or telephone number.
III. Which of my personal data will be processed?
In the course of the business relationship with you or your employer, we only process those
personal data of yours which are related to the business relationship. In detail, this may include:•••

Contact data, including your name, your business email address, your business telephone
number and your business address
Data relating to the customer history
Contractual data

IV. For which purposes are my personal data processed and what is the legal basis for this?
Below, we provide you with an overview on the purposes and legal bases of the processing of yourpersonal data in the context of the business relationship with you:1

1. Data processing for purposes relating to the performance of the contract within thebusiness relationshipWe process your personal data for the preparation and performance of the business relationship.
The purposes depend on the specific contract and include in particular:••••

Administration of your contact details in our customer management system
Communication with contact persons of our business partners
Preparation, conclusion and performance of contracts
Creation of offers, order confirmations and invoices

Provided that the business relationship exists or will be entered into with you personally, the dataprocessing is affected on the basis of Article 6 (1) (b) of the GDPR. If you act on behalf of a thirdparty, especially your employer, the data processing is affected on the basis of Article 6 (1) (f) ofthe GDPR, as far as it is compatible with your fundamental rights and freedoms, see the further
explanations in paragraph IV. no. 4.
Your personal data, which constitute special categories of personal data within the meaning ofArticle 9 (1) of the GDPR, are processed by us exclusively on the basis of Article 9 (2) of the GDPR,i.e., only in cases where a legitimization based on statutory law exists for the intended processing.
We delete your personal data when they are no longer required for the purposes pursued by us
for preparation and performance of the business relationship and when no other legal bases, inparticular statutory or contractual periods of retention, apply.
2. Consent
We may process your personal data also on the basis of an explicit consent you have given. The
purpose pursued with the processing arises from the content of the corresponding declaration ofconsent that was given in each case. This may apply in the following cases:••

You have subscribed to our newsletter
You have provided us with data for a specific reason after we have been informed (e.g.
for a factory tour that requires you to wear safety shoes and a working helmet, so that wehave to process information about your shoe size and head circumference

The data processing is affected on the basis of Article 6 (1) (a) of the GDPR.
You may withdraw your consent at any time. However, please note that the withdrawal only takes
effect for the future, i.e. that the withdrawal will not affect the lawfulness of the processing ofyour personal data that was already implemented until the point in time of the withdrawal of theconsent.
We will delete the data when they are no longer required for the purposes pursued by us, when
the storage period which is specified in the consent has expired or when you have withdrawn yourconsent, provided no other legal basis applies. In the latter case, we will delete the data after theother legal basis ceases to apply.
3. Fulfilment of legal obligations
We may process your personal data also in order to comply with statutory obligations which may
arise pursuant to commercial law, tax law, finance law, or criminal law. The purposes of theprocessing arise from the corresponding statutory obligation. Usually, the processing is affected
in order to comply with governmental monitoring obligations and information obligations.
The data processing is affected on the basis of Article 6 (1) (c) of the GDPR.
2

We delete the data after the legal obligation ceases to apply and provided that no other legal
bases, in particular statutory or contractual periods of retention, apply.
4. Processing necessary for the purposes of legitimate interests
To the extent to which this is necessary, we process your personal data also in order to protect
our legitimate interests. We only process your personal data if, after evaluation of our interests toperform the data processing with your possibly contradictory interests, fundamental rights andfreedoms, we consider our interests to prevail. This may apply in the following cases:••

Protection and safety of IT resources
Protection of our domiciliary right

Our legitimate interests correspond to the aforementioned purposes.
In addition to this, data processing is affected on this basis, if you act for a third party, especially
your employer, within the purposes named in paragraph IV. no. 1. In this case, our legitimate
interests arise from the processing of our business relationship with this third party.
The data processing is affected on the basis of Article 6 (1) (f) of the GDPR.
We delete the data when they are no longer required for the purposes we pursue and no otherlegal basis applies.
V. Will my personal data also be collected from third parties?
We predominantly process the personal data that we have received directly from you in the courseof the business relationship. In some constellations, however, we may also obtain your personal
data from third parties, such as:••

From our business partners or from your business partners or business partners of youremployer
From your employer

Where necessary, we will inform you about this separately.
VI. Will there be an automated decision-making or profiling?
We don´t use an automated decision-making.
VII. Do I have to make my personal data available?
Within the business relationship you have to provide those personal data which are necessary forthe preparation and performance of the business relationship and the performance of contractualor legal obligations connected to the business relationship, or which we are obliged to process tocomply with a statutory requirement. Without these data we might not be able to perform thebusiness relationship.
VIII. Who has access to my personal data and which recipients receive them?
Within our company, only those departments and the employees who work there have access toyour personal data that absolutely need such access in order to be able to fulfil their tasks andduties. These are your direct contact persons on our site or employees who are named by ourcontact persons in order to be able to process and answer necessary inquiries on your part.
We only forward your personal data to external recipients if there is a justification under statutory
law for this or if you have consented thereto. External recipients may include:3••Processors: Service providers that we use for the provision of services in the humanresources area or which are entrusted with the maintenance of our IT systems. We selectsuch processors with due care and they are regularly audited to ensure that your personal
data are in good hands. The processors may use your personal data only for the purposesprescribed by us.
Public bodies: public authorities and government institutions, as, e.g., public prosecutors,
courts of law, or financial authorities, to which we may have to transfer personal data incertain individual cases.

IX. Will my personal data be transferred to any third countries?
Your personal data will not be transferred to third countries in the context of the business
relationship. If telephone / video conferences are necessary, your name and the number of yourcontact medium (telephone number; video IP address) would be transmitted to the participantsin order to handle and conduct the conference.
X. For how long will my personal data be stored?
Please refer to the relevant chapter relating to data processing in paragraph IV. for the durationof the storage of your personal data.
XI. To which data subject rights am I entitled?
You are entitled to the following rights in relation to the processing of your personal data:
1. Right of access
You have the right to receive a confirmation from us whether we process personal data relating
to you or not. If this is the case, you have a right of access to your personal data and to further
information with respect to the processing.
2. Right to rectification
You have the right to demand that your inaccurate personal data will be rectified and to haveincomplete personal data be completed.
3. Right to erasure (“right to be forgotten”)
In certain cases, you are entitled to demand the erasure of your personal data. This right exists,
for example, when the personal data are not needed anymore for the purposes for which they
were collected or otherwise processed, or when the personal data have been unlawfullyprocessed.
4. Restriction of processing
In certain cases, you are entitled to demand that we restrict the processing of your personal data.
In this case, we will only store those of your personal data for which you have given consent, or
personal data which the GDPR allows to be processed. For example, you may be entitled to a rightto restriction of processing if you have disputed that your personal data are correct.
5. Data portability
If you have made the data available to us based on a contract or consent, you are entitled todemand to receive the data which you provided to us in a structured, commonly used andmachine-readable format or to have them transmitted by us to another controller, provided thatthe statutory requirements are met.
6.

Withdrawal of consent

4

If you have given us your consent to the processing of your personal data, you may withdraw theconsent at any time with effect for the future. This does not affect the lawfulness of the processingof your personal data before the withdrawal of the consent.
7. Right to object
Individual right to object
You have the right to object, on grounds relating to your particular situation, at any time toprocessing of personal data concerning you which is based on Article 6 (1) (f) of the GDPR (dataprocessing based on a balancing of interests). If you object, we will no longer process yourpersonal data unless we can demonstrate compelling legitimate grounds for the processing which
override your interests, rights and freedoms or for the establishment, exercise or defence of legal
claims.

8. Right to lodge a complaint with the supervisory authority
Furthermore, if you believe that the processing of your personal data is in breach of applicablelaw, you may lodge a complaint with a supervisory authority. You may contact the data protection
authority that is the competent authority for your habitual residence, your workplace, or thelocation of the alleged breach, or the data protection authority that is the competent authority
for us. The supervisory authority in the state in which you live, work, or in which an alleged breachis supposed to have happened, which is the subject matter of the complaint.
XII. Who may I contact if I have questions or if I want to exercise my rights as a data subject?
If you have any questions about the processing of your personal data or if you want to exercise
your rights as a data subject, which are described in paragraph XI. no. 1 through 7, you may contact
us free of charge. Please use our contact data as specified in paragraph I. no. 1. If you want towithdraw a consent, you can always use the method of communication that was used when you
issued the declaration of consent.
Version: July 2021

5