1. PERSONAL DATA WE COLLECT AND HOW

Generally, we do collect Personal Data in different ways when you are browsing the Website, subscribe to and receive our Newsletters or use the Supplier Hotline.

Information we collect via cookies and tracking technologies:

We employ cookies or other technology to track your usage of the Website and Newsletters. You can always manage your cookie preferences when you land on the Website for the first time or by clicking the cookie button at the bottom left of the Website.

Personal Data we collect directly from you on the Website:

Only in case that you send an inquiry to the contact e-mail provided on some of the pages or use a contact form on the Website:

• your e-mail address;
• any input in each specific field of our contact or inquiry forms;
• any other information that you include in your inquiry, such as your name and the content of your messages; and
• any follow up exchanges that we might have in connection with your original report.

Personal Data we collect directly from you in connection with the Newsletters:

When you sign up to our Newsletters (for example via the Website or during attendance to events held or sponsored by Rakuten Symphony) and open our Newsletter, we collect the information that you provide us:

• your name;
• your e-mail address;
• usage statistics such as number of Newsletters received or opened;
• links clicked in the Newsletter; and
• timestamp of the actions described above.

Personal Data we collect from a company member of Rakuten Symphony in order to inform your company about the Supplier Hotline:

When your company is acting as a supplier of one or more member companies of Rakuten Symphony, these Symphony companies are sharing with us the following Personal Data about the point of contact (“PIC”) handling the business relationship:

• name of the PIC;
• professional e-mail of the PIC;
• position of the PIC; and
• company of the PIC.

Personal Data we collect directly from you via the Supplier Hotline:

• your e-mail address;
• any input in each specific field of our contact or inquiry forms;
• any other information that you include in your inquiry, such as your name and the content of your messages; and
• any follow up exchanges that we might have in connection with your original report.

2. HOW WE USE YOUR PERSONAL DATA AND THE BASIS ON WHICH WE USE IT

We always need a proper reason to process your Personal Data

The basis for the collection of your Personal Data is one of the following:

• complying with our legal obligations, specifically when a company member of Rakuten Symphony is legally obligated to create a reporting and whistleblowing scheme;
• fulfilling our legitimate interests, only when we have a valid interest that shall not override yours, specifically in order to secure and optimize the Website and the Newsletters, or to make available to you the Supplier Hotline when a whistleblowing scheme is not mandatory under applicable laws but spontaneously applied by a company member of Rakuten Symphony;
• processing Personal Data based on your consent, when you voluntarily request us to process your Personal Data with a clear action, specifically subscribing to the Newsletters or accepting certain cookies. If we ask for your consent to process your Personal Data, you can always withdraw your consent easily at any time in the “Contact Us” section below, by using the interface and menus of the Website, or directly in each of our message sent as part of the Newsletters; or
• processing “Personal Data” regarded as “sensitive”, when it is necessary for Rakuten Symphony to establish, exercise or defend against legal claims, specifically if you are providing such Personal Data via the Supplier Hotline.

Automated decision making

We do not make automatic decisions about you.

‍

3. YOUR RIGHTS AND CHOICES OVER YOUR PERSONAL DATA

The rights and choices about your Personal Data are different depending on your location. These include the following rights to:

• access your Personal Data;
• rectify the Personal Data we hold about you;
• erase your Personal Data;
• restrict our use of your Personal Data;
• object to our use of your Personal Data;
• withdraw your consent easily at any time. If you do so, the processing of your Personal Data will stop for the future, but this will not impact the processing that took place before;
• receive your Personal Data in a usable electronic format and transmit it to an external party (right to data portability);
• learn more about the sources from which we collect Personal Data, the purposes for which we collect and share them, the Personal Data we hold about you, and the categories of parties with whom we share them;
• opt out of certain disclosures of Personal Data that law defines as “sales” even if no money is exchanged. Rakuten Symphony does not sell your data;
• exercise rights without fear of being denied goods or services; and
• lodge a complaint with your local data protection authority.

If you would like to discuss or exercise such rights, please contact us via the method described in section 8 below. We will contact you if we need additional information from you in order to honor your requests.

‍

4. INFORMATION SHARING

We may disclose your Personal Data for business purposes to the following parties:

• service providers and business partners. We may share your Personal Data with our service providers and business partners that perform business operations for us. For example, we may partner with other companies to support email and messaging services as well as electronic signature and document storage services;
• Rakuten Group companies. Rakuten Group, Inc. is our parent company. We work closely with Rakuten Group, Inc. and other businesses and companies that fall under the Rakuten Group family. We may share certain information about you with Rakuten Group, Inc. and other Rakuten Group companies if your inquiry requires it;
• law enforcement agencies, courts, regulators and government authorities. We may share your Personal Data with these parties where we believe this is necessary to comply with a legal or regulatory obligation, or otherwise to protect our rights or the rights of any third party; and
• asset purchasers. We may share your Personal Data with any third party that purchases, or to which we transfer, all or substantially all of our assets and business. Should such a sale or transfer occur, we will use reasonable efforts to try to ensure that the entity to which we transfer your Personal Data uses it in a manner that is consistent with this privacy notice.

5. INFORMATION SECURITY AND STORAGE

We implement technical and organizational measures to ensure a level of security appropriate to the risk to the Personal Data we process. These measures are aimed at ensuring the on-going integrity and confidentiality of Personal Data. We evaluate these measures on a regular basis to ensure the security of the processing.

‍

6. RETENTION

We will keep your Personal Data for as long as necessary to fulfill the purposes described in this privacy notice:

For the use of our Website and subscription to our Newsletter:

• as long as required to respond to your inquiry;
• we keep your e-mail address for the Newsletters until you unsubscribe; and
• after this time only if we are required to do so to comply with the law, or if there are outstanding claims or complaints that will reasonably require your Personal Data to be retained.

For the use of our Supplier Hotline:

• as long as needed to investigate and assess if we follow-up on your report, and in any event within 3 months;
• for reports that are assessed to either not be in scope of the Supplier Hotline, or not susceptible of depicting a violation of our Code of Conduct, Personal Data will be deleted within 2 months of the assessment;
• for reports that are assessed to be susceptible of depicting a violation of our Code of Conduct, Personal Data will be kept as long as necessary to enquire; and
• after this time only if we are required to do so to comply with the law, or if there are outstanding claims or complaints that will reasonably require your Personal Data to be retained.

7. INTERNATIONAL DATA TRANSFERS

Rakuten Symphony is an international business, and your Personal Data may be transferred to, stored, and processed in a country that is not regarded as ensuring an adequate level of protection for Personal Data in relation to the country you are located in. Specifically, Personal Data collected for our Supplier Hotline will be accessed from Japan and India (where our personnel is located) as well as transferred in Germany (electronic signature of our Supplier pledge) and in the US (final storage).

We have put in place appropriate safeguards (such as contractual commitments) in accordance with applicable legal requirements to ensure that your Personal Data is adequately protected. For more information on the appropriate safeguards in place, please contact us at the details described in section 8 below.

As part of the Rakuten Group, we rely on the Rakuten Group Binding Corporate Rules to legitimize international data transfers within the Group. The Rakuten Group Binding Corporate Rules can be found at https://corp.rakuten.co.jp/privacy/en/bcr.html.

‍

8. CONTACT US

Rakuten Symphony Singapore, Pte. Ltd. is the controller responsible for the Personal Data we collect and process on the Website and for the Newsletters. Rakuten Symphony Japan is the controller responsible for the Supplier Hotline.

If you have questions or concerns regarding the way in which your Personal Data has been used, please contact mobile-SymwarePrivacyPolicy@mail.rakuten.com.

We are committed to working with you to obtain a fair resolution of any complaint or concern about privacy. If, however, you believe that we have not been able to assist with your complaint or concern, you have the right to make a complaint to your data protection authority or to the data protection authority of Luxembourg, using their website https://cnpd.public.lu/en.html.

‍

9. CHANGES TO THE NOTICE

We may modify or update this privacy notice from time to time. Please check back here for any updates.

Last modified: March 31st 2023