We will process your personal data in compliance with every applicable law and any laws that replace them in the future (including the European Union’s General Data Protection Regulation, Regulation (EU) 2016/679).

In this notice, we provide information based on such laws related to processing your personal data. This notice sets out the basis on which any personal data that you provide to us, or that we obtain about you from other sources, will be processed by us. Please take the time to read and understand this notice.

For the purpose of data protection law, we QON Inc.("we", "us" and "our") are a data controller in respect of your personal data. And we are committed to respecting your privacy.

1. (a) Our main office address: Freund Mita, 2-14-5, Mita, Minato-ku, Tokyo, Japan
2. (b) Our phone number: None
3. (c) Our email address: privacy@q-o-n.com

In this notice:

1. (a) your "personal data" means any data which relates to you and from which you can be identified. It may include contact details, other personal information, photographs, expressions of opinion about you or indications as to our intentions about you;
2. (b) our "affiliates" includes our subsidiaries, our parent companies, and any subsidiaries of our parent companies; and
3. (c) "processing" means any activity or operation that is carried out in respect of your personal data, such as collecting, storing, using, transferring or deleting it.

We will collect and process the following personal data about you:

1. (a) Information you give us. This includes information about you that you give us by writing or communicating with us, whether face-to-face, by phone, e-mail or otherwise. The information you give us are;
   1. (i) if you are an employee: your name, birthday, sex, contact data (address, e-mail, phone number, FAX number), emergency contact data (address, e-mail, phone number, FAX number), CV (educational and professional history), visa, residence permit, pictures, tax information (including tax identification number, social security information including social security identification number), health insurance information, banking account, "My Number" (an individual number given to every person living in Japan), lease contract documents of employees’ houses, health data. You are obliged to make this information available on the basis of your ancillary obligations under the employment contract. Without this data we would not be able to carry out the employment relationship;
   2. (ii) if you are a business partner (current or potential) or representative of a business partner: your name, contact data (e-mail, phone number), company name, address, position. This information is necessary to enter into a contract. Otherwise such a contract cannot be concluded. Where this information is provided to network and explore cooperation in the future the provision of personal data is no statutory or contractual requirement and you are not obliged to provide the personal data. If you do not provide the personal data, we cannot stay in touch with you ; and
   3. (iii) if you are an outsourcing contractor: your name, contact data (e-mail, phone number), company name, address, position. This information is necessary to enter into a contract. Otherwise such a contract cannot be concluded.
   4. (iv) if you are an emergency contact person of an employee: contact data (address, e-mail, phone number, FAX number)
2. (b) Information we collect about you. We will collect the following information about you:
   1. (i) if you are an employee: performance data, compliance (information on infringement of law, internal policies or employment contract), payment data, time, working hours (including holidays and absences), record of training course;
   2. (ii) if you are a client (current or potential): None;
   3. (iii) if you are an outsourcing contractor: None; and
   4. (iv) if you are an emergency contact person of an employee: None.
3. (c) Information we obtain from other sources. None.

We use the personal data that we hold about you for the following purposes:

1. (a) Employee’s data: HR management and HR development, Compliance, Operational planning;
2. (b) Current or potential business partner’s data: establishing and maintaining relationship with business partner;
3. (c) Outsourcing contractor’s data: Establishing contact list of relocation service providers or payroll outsourcing contractors.
4. (d) Emergency contact person of an employee: HR management

The legal basis for the processing of your personal data is:

1. (a) Employee’s data: processing of employees' personal data in the employment context in accordance with Art. 88 (1) GDPR in connection with Section 26 (1) German Federal Data Protection Act;
2. (b) Current or potential business partner’s data: performance of a contract or in order to take steps at the request of the data subject prior to entering into a contract in accordance with Art. 6 (1)(b) GDPR or where your data is provided for networking purposes the pursuance of our legitimate interests (establishing a business relationship and networking) in accordance with Art. 6 (1)(f) GDPR ;
3. (c) Outsourcing contractor’s data: performance of a contract or in order to take steps at the request of the data subject prior to entering into a contract in accordance with Art. 6 (1)(b) GDPR; and,
4. (d) Emergency contact person of an employee: pursuing legitimate interests in accordance with Art. 6 (1)(f) GDPR (the legitimate interest is supporting the (first) aid given to the employee in case of an emergency).

Where your personal data includes "sensitive data" (information about your race, ethnic origin, religion, physical or mental health, political opinions, sexual life, any actual or alleged criminal offences, and genetic and biometric data), we will only process it for the following purposes:

1. (a) with regard to health data: for the purpose of carrying out the obligations and exercising specific right of us or of yours in the field of employment and social security (pursuant to the Art. 9 (2) (b) GDPR); and,
2. (b) with regard to other sensitive data: for the purposes described above, but only where we have obtained your explicit consent to do so (pursuant to Art. 9 (2)(a) GDPR).

We will only use your personal data to the extent that it is necessary to do so to fulfil the purposes described above.

We may share your personal data with recipients in the situations described below:

1. (a) Employee’s data: HR department, Accounting department, Managers in each departments, and other employees who are authorised and need to access these data;
2. (b) Current or potential client’s data: Employees who are authorised and need to access these data;
3. (c) Outsourcing contractor’s data: Authorised person in management department in charge of overseas matter; and
4. (d) Emergency contact person of an employee: HR department, Managers in each department, and other employees who are authorised and need to access these data.

The personal data that we collect from you may be transferred to, and stored at, a destination outside the European Economic Area ("EEA"); this especially applies to the transfer to our corporate seat in Japan. It may also be processed by staff operating outside the EEA who work for our affiliates or for one of our suppliers.

Where we transfer your personal data outside the EEA, we will ensure that:

1. (a) the recipient destination has been subject to a finding from the European Commission that it ensures an adequate level of protection for the rights and freedoms that you possess in respect of your personal data; or
2. (b) the recipient enters into standard data protection clauses with us that have been approved by the European Commission.

You can obtain more details of the protection given to your personal data when it is transferred outside the EEA (including a copy of the standard data protection clauses which we have entered into with recipients of your personal data) by contacting us in accordance with the information about us above.

We will retain the personal data that we collect about you for a period below except to the extent that we are required by law to retain it for a longer period of time in which case, we will retain it for the period required by law.

1. (a) Employee’s data: [3 years after resignation or period demanded by applicable laws ]
2. (b) Current or potential business partner’s data: 5 years after last access of the respective data or the period which is required by applicable laws.
3. (c) Outsourcing contractor’s data: 10 years after last contract or the period which is required by applicable laws.
4. (d) Emergency contact person of an employee: [1 years after resignation or period demanded by applicable laws]

1. (a) Access, rectification, erasure, restriction, data portability
   With regard to the processing of personal data, you have the following rights:
   1. - Request from us access to your personal data pursuant to Art. 15 GDPR.
   2. - Request from us rectification of your personal data pursuant to Art. 16 GDPR
   3. - Request from us erasure of your personal data pursuant to Art. 17 GDPR
   4. - Request from us restriction of processing pursuant to Art. 18 GDPR
   5. - Right to data portability pursuant to Art. 20 GDPR
2. (b) Right to object
   You have the right to object on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Art. 6(1) (e) or (f) GDPR (see section 5 above), including profiling based on those provisions pursuant to Art. 21 (1) GDPR.
   Where personal data are processed for direct marketing purposes (see section 5 above), you have the right to object at any time to processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing pursuant to Art. 21 (2) GDPR.
3. (c) Right to withdraw consent
   Where the processing is based on your consent (Art. 6(1) (a) or Art. 9(2) (a) GDPR (see section 5 above), you have the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
4. (d) Right to lodge a complaint
   You have the right to lodge a complaint with a supervisory authority pursuant to Art. 57 (1) (f) GDPR.

The Berliner Beauftragte für Datenschutz und Informationsfreiheit regulates data protection and privacy matters in Berlin, Germany. You can find out more information about your rights by contacting them, or by searching their website https://www.datenschutz-berlin.de/kontakt.html.

Questions, comments and requests regarding this privacy notice are welcomed. Please contact us using the information about us above.