In the following, we will inform you about how personal data is collected when you use the website www.itochu.de (hereinafter referred to as “Website”) or contact us by e-mail or by phone. Personal data is all data that can be personally related to you, e.g. name, address, email addresses, user behaviour.
I. Name and contact information of the controller and the data protection officer
1. The data controller, as defined in Art 4 no. 7 of the EU General Data Protection Regulation (GDPR)
ITOCHU Deutschland GmbH
Fritz-Vomfelde-Straße 14
40547 Düsseldorf
telephone: 0211 5290-0
e-Mail: kontakt@itochu.de
2. You can contact our data protection officer by sending an e-mail to kontakt@itochu.de or a letter to our address (please add: “Der Datenschutzbeauftragte” (the data protection officer)).
II. Information on the collection and disclosure of personal data
1. When you contact us by email or using a contact form, we store the data you give us (your email address, your name and phone number if applicable) in order to respond to your queries. When storage is no longer necessary, we will delete the applicable data or restrict the processing of it if legal retention requirements apply.
2. If we use contracted service providers for individual functions of our offering, or if we wish to use your data for advertising purposes, we will inform you in detail about the respective processes as described below. We will also specify the criteria determining the period for which your data will be stored.
3. Your personal data will not be disclosed to any third party for purposes other than those specified below. We only disclose your personal data to third parties if you have expressly consented to us doing so as per Art. 6 no.1 lit. a) GDPR, if the disclosure of your personal data is necessary to establish, exercise, or defend legal claims pursuant to Art. 6 no. 1 lit. f) GDPR and there is no reason to assume that you have an overriding interest in the non-disclosure of your data that is worthy of protection, if your data has to be disclosed to fulfil a legal obligation as per Art. 6 no. 1 lit. c) GDPR, or if the disclosure of your data is permitted by law and necessary for the performance of a contract to which you are a party, as described in Art. 6 no. 1 lit. b) GDPR. Your data may also be transferred to ITOCHU Europa PLC, based in Great Britain, for the aforementioned purposes and under the conditions specified above.
4. We have no intention of sending your data to any recipient in any third country (i.e. a country that is not a member of the EU / EEA) or to any international organisation. One exception is the transfer of data for the aforementioned purposes and under the conditions specified above to ITOCHU Corporation based in Japan. The European Commission, as part of implementing decision (EU) 2019/419 pursuant to Art. 45 no. 3 GDPR, decided that Japan provides an adequate level of data protection which means that personal data can be transferred to Japan without a special authorisation in accordance with Art. 45 no. 1 GDPR.
III. Collection of personal data through our website
1. Visiting our website
1.1 If you are only using the website for information purposes and do not register or transfer information to us in any other way, we only collect the personal data that your browser transmits to our server. If you wish to view our website, we collect the following data; this is technically necessary for us to display our website to you and to guarantee its stability and security. This data is also stored in our system’s log files. It is not stored together with any other personal data pertaining to the user. This data includes the IP address, the timestamp of the browser request with the date, time and time zone, the URL path accessed, the HTTP status code, the data volume transmitted, the website from which the request originated (referrer), and the user agent. The last-mentioned item contains information on the browser name and version, the operating system, and the language preferred.
1.2 The legal basis for the temporary storage of this data and these log files is Art. 6 no. 1 lit. f) GDPR.
1.3 The temporary storage of the IP address by the system is necessary to ensure that the website can be displayed in your browser. For this purpose, your IP address must be stored for the duration of the session. The data is stored in log files in order to guarantee the functionality of the website. We also use this data for the purpose of optimising our website and ensuring that our information technology systems are secure. This purpose constitutes our legitimate interest in processing your data pursuant to Art. 6 no. 1 lit. f) GDPR. Data collected in this context is not evaluated for marketing purposes. If there are specific indications that the website was used unlawfully, we reserve the right to subsequently review the log files of the server.
1.4 This data is erased as soon as it is no longer required for the purpose for which it was collected. If the data was collected for the purpose of displaying the website, it is erased when the respective session ends. Log files are erased within 14 days of the website being accessed.
1.5 The collection of data when users visit the website and the storage of data in log files are essential for the operation of the website. This means you are unable to object to it.
2. Other functions and offers on our website
2.1 In addition to the purely informational use of our website, we offer various services that you may use if they interest you. For this, you usually have to provide further personal data, which we use to provide the respective service and to which the above-mentioned principles of data processing apply.
2.2 We sometimes use external service providers to process your data. These are carefully selected and commissioned by us, bound to our instructions, and monitored on a regular basis.
2.3 We may also disclose your personal data to third parties if we offer the execution of contracts or similar services together with partners. You will find more information below in the description of the offer; it is also provided when you enter your personal data.
2.4 If our service providers or partners are based in a country outside of the European Economic Area (EEA), we will inform you about the consequences of this fact in the description of the offer.
3. Use of contact forms
3.1 Additional personal data is only collected if you provide this data when using our contact form. Here we collect the personal data supplied when you contact us. This specifically includes the names and contact data transmitted along with the date and reason for the contact. We will only use the personal data collected from you to provide the products or services required (legal basis Art. 6 no. 1 lit. b) GDPR), or for other purposes to which you have given your consent (legal basis Art. 6 no. 1 lit. a) GDPR) and which are described in this data protection declaration. You can also give your consent, for example to the placement of cookies by third-parties or to web tracking by third parties, by choosing the respective settings in your browser. You may withdraw your consent to the processing of your personal data at any time.
3.2 This data is erased as soon as it is no longer required for the purpose for which it was collected. In the case of personal data entered into and collected from the contact form, this is the case when our correspondence with you is terminated. Our correspondence is understood to have been terminated when circumstances indicate that the matter in question has been finally settled.
4. Embedding of YouTube videos
4.1 We may have embedded YouTube videos on our website which are stored at www.YouTube.com and can be played directly from our website. All of them are embedded in the “privacy-enhanced mode” which means that the website will not transmit any data about you, as the user, to YouTube if you do not play the videos. The data specified in paragraph 2 is only transmitted if you play the videos. We have no control over this data transmission.
4.2 When you visit the website, YouTube will be notified that you accessed the respective page of our website. The website also transmits the data specified in Section III. 1.1 of this data protection declaration. This is done regardless of whether YouTube provides a user account where you are logged in or if there is no user account. If you are logged into Google, your data is allocated to your account directly. If you do not want your data to be allocated to your YouTube profile, you need to log out before clicking on the button. YouTube stores your data as a user profile and uses this data for advertising, market research and/or for designing its website in a way that meets users’ needs. Data is analysed this way in particular (even with respect to users that are not logged in) in order to provide advertising that meets users’ needs and in order to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles. If you wish to exercise this right, you need to contact YouTube.
4.3 Further information on the purpose and scope of the collection and processing of data by YouTube is provided in the data protection declaration. It also includes further information on your rights and settings options for protecting your privacy: https://www.google.de/intl/de/policies/privacy. Google also processes your personal data in the USA and has self-certified to the EU-US Privacy Shield: https://www.privacyshield.gov/EU-US-Framework.
5. Further use of data and your right to object
Furthermore, we reserve the right to store your first name, surname, postal address and – insofar as we have received this additional information from you in the context of our contractual relationship with you – your title, academic degree, year of birth, as well as your profession, industry or business, in aggregated lists and to use this data for our own advertising purposes. You can object to the storage and use of your data for these purposes at any time by sending a message to the contact whose information is provided below.
6. Data security
6.1 When you visit our website, we use the commonly used SSL (Secure Sockets Layer) protocol in combination with the highest level of encryption that your browser supports. Usually this is 256-bit encryption. If your browser does not support 256-bit encryption, we use 128-bit v3 technology instead. You can tell whether a specific page of our website is transmitted in encrypted form as the key or lock symbol displayed in the lower status bar of your browser will be closed.
6.2 We also use appropriate technical and organisational security measures to protect your data against accidental or deliberate manipulation, partial or total loss, destruction and unauthorised third-party access. We continually improve our security measures in line with the latest technological developments.
IV. Collection of personal data through contact by e-mail, post, telephone, or in person
1. We only collect your personal data as a customer, interested party or supplier if you provide it to us by e-mail, post, telephone, or in person (e.g., if you give us your business card). Here we collect the personal data supplied when you contact us. This specifically includes the names and contact data transmitted along with the date and reason for the contact. The personal data we collect from you is only used to provide the products or services required (legal basis Art. 6 no. 1 b) GDPR), or for other purposes to which you have given your consent (legal basis Art. 6 no. 1 a) GDPR) and which are described in this data protection declaration. You may withdraw your consent to the processing of your personal data at any time.
2. You are not obliged to provide the personal data specified above. The data provided may be required for the conclusion of a contract. Unless you provide this data, it may not be possible to communicate with you or to conclude and execute a contract.
3. Based on the statutory regulations or a contractual agreement, the data that is relevant in each individual case is transferred to public bodies where overriding legal requirements exist, to external service providers or other contractors, and to other external bodies where you have given your consent or where the transfer of your data is permitted on grounds of overriding legitimate interest. Your data may also be transferred to ITOCHU Europa PLC, based in Great Britain, for the aforementioned purposes and under the conditions specified above. We have no intention of sending your data to any recipient in any third country (i.e. a country that is not a member of the EU / EEA) or to any international organisation. One exception is the transfer of data for the aforementioned purposes and under the conditions specified above to ITOCHU Corporation based in Japan. The European Commission, as part of implementing decision (EU) 2019/419 pursuant to Art. 45 no. 3 GDPR, decided that Japan provides an adequate level of data protection which means that personal data can be transferred to Japan without a special authorisation in accordance with Art. 45 no. 1 GDPR.
4. This data is erased as soon as it is no longer required for the purpose for which it was collected. In the case of the personal data provided, this is the case when our correspondence with you is terminated. Our correspondence is understood to have been terminated when circumstances indicate that the matter in question has been finally settled. If the data provided is subject to statutory retention periods under fiscal or commercial law, it will be stored for the obligatory ten-year retention period and then erased unless you have consented to it being stored for a longer period or your data has to be processed further for the purpose of establishing, exercising, or defending legal claims. The legal basis for processing personal data in order to comply with statutory archiving and retention obligations is Art. 6 no. 1 sentence 1 lit. c) GDPR.
V. Processing of the personal data of applicants
1. Applications relating to a specific job posting and/or unsolicited applications
1.1 We collect your personal applicant data if you provide it to us by post, e-mail, telephone or in person, both for applications relating to job postings and for unsolicited applications (hereinafter referred to as “Application” or “Application Documents”). In this case, we process the personal data you provide in the context of the application procedure. This specifically includes your name, date of birth, contact information, interests, qualifications, education, and professional career. In this case, we may also collect additional personal data from publicly available sources, in particular the social networks XING and LinkedIn. The personal data we collect from you is used solely for the purpose of processing the application (legal basis: Art. 6 no. 1 sentence 1 lit. b) or lit. f) GDPR, Section 26 of the German Federal Data Protection Act (BDSG)).
1.2 You are not obliged to provide the personal data specified above. However, the data provided may be required to conclude a contract after the application procedure is complete. If you do not provide this data, it may not be possible to communicate with you, process the application, or execute a contract.
1.3 If you submit an application relating to a specific job posting and your application is rejected, we will store your personal data for a period of two months after communicating the rejection to you. If you submit an unsolicited application, we will store your personal data for a period of 14 days after receiving your Application Documents in which we will check whether we have an opening that matches your professional profile. Where this is the case, the periods specified for applications relating to a specific job posting apply.
1.4 Upon the expiry of the periods for applications relating to a specific job posting or unsolicited applications, we will erase your personal data unless you have given your consent to the continued processing of your data (legal basis: Art. 6 no. 1 sentence 1 lit. a) DSGVO, Section 26 BDSG) or unless the continued processing of your data
- is required to comply with legal obligations applicable to us or our client – in particular to prove that we comply with legal obligations in the context of filling vacancies (e.g. pursuant to the German General Equal Treatment Act) or retention obligations under tax or commercial law – (legal basis: Art. 6 no. 1 sentence 1 lit. c) GDPR) or
- is necessary for the purposes of our legitimate interests (legal basis: Art. 6 no. 1 sentence 1 lit. f) GDPR).
In the latter case, your personal data is only stored for a longer period of time if our interest in such storage is not overridden by your interests or fundamental rights and freedoms which require the protection of personal data. If the continued processing of your data is for a purpose other than the one for which the personal data was collected, we will comply with Art. 6 no. 4 GDPR and will notify you of this change in purpose in accordance with Art. 13 no. 3 GDPR.
VI. Withdrawal of consent or objection to the processing of your data
1. If you have consented to the processing of your data, you can withdraw your consent at any time. Once you have sent it to us, your withdrawal will affect the permissibility of processing your personal data.
2. If the processing of your personal data is based on the balancing of interests, you are entitled to object to this processing. This is the case, in particular, if processing is not necessary for fulfilment of a contract with you, which is always outlined by us in the subsequent description of the functions. If you exercise your right of withdrawal, we will ask you to specify the reasons why we should not continue processing your personal information as before. If your withdrawal is justified, we will investigate the situation and either stop or adjust the data processing or inform you of the compelling, legitimate grounds on which we are obliged to continue.
3. Of course you can object to the processing of your personal data for advertising and data analysis purposes at any time. The withdrawal of your consent does not affect the lawfulness of any processing carried out before the withdrawal.
4. You can use the following contact data to notify us of your withdrawal or your objection: ITOCHU Deutschland GmbH, Fritz-Vomfelde-Straße 14, 40547 Düsseldorf, telephone: +49 (0)211 5290-0, e-mail: kontakt@itochu.de.
VII. Your Rights
1. Pursuant to Art. 15 GDPR, you have the right to request information from us about the personal data we are processing. In particular, you may request information about the purposes for which your data is processed, the categories of personal data processed, the categories of recipients to whom your data has been or will be disclosed, the planned storage period, the existence of a right to rectification, erasure, restriction of processing, the existence of a right to object, the existence of a right of appeal, the source of your data if it was not collected by us, the existence of automated decision-making processes including profiling and, if applicable, meaningful detailed information about what these involve.
2. Pursuant to Art. 16 GDPR, you have the right to request that inaccurate personal data held by us about you be rectified or incomplete data be completed without undue delay. Pursuant to Art. 17 GDPR, you have the right to request that we erase personal data held by us about you unless this data needs to be processed to exercise the right of freedom of expression and information, to comply with a legal obligation, for reasons of public interest, or to establish, exercise or defend legal claims.
3. Pursuant to Art. 18 GDPR, you have to right to request that the processing of your personal data be restricted if you contest its accuracy, if the processing of your data is unlawful but you oppose its erasure, if we no longer need your data but you need it to establish, exercise, or defend legal claims, or if you have objected to the processing of your data in accordance with Art. 21 GDPR.
4. Pursuant to Art. 20 GDPR, you have to right to request that the personal data you provided be placed at your disposal in a structured, commonly used and machine-readable format or that it be transferred to another controller.
5. Pursuant to Art. 7 no. 3 GDPR, you have the right to withdraw your consent to our processing of your personal data at any time. If you do so, we will in future cease the data processing on which your consent was based.
6. Pursuant to Art. 77 GDPR, you also have the right to lodge a complaint about our processing of your personal data with a supervisory authority.
VIII. Validity of and amendments to this data protection declaration
1. This data protection declaration is currently in effect and was last updated in February 2020.
2. As our website and the services we offer on this website develop or due to changes in statutory or regulatory requirements, it may become necessary to amend this data protection declaration. You can access the current data protection declaration at any time on our website under the menu item “Data Protection”, and you can print it from there.