IDD - Privacy Information Notice 

In accordance with Regulation (EU) 2016/679 ("GDPR"), the Kuehne+Nagel Group ("KN" or the "Data Controller") provides you with the privacy information notice on the processing of your personal data collected in the context of anti-corruption due diligence (Integrity Due Diligence, “IDD”). The anti-corruption due diligence process constitutes an essential instrument of the KN anti-corruption compliance program and is aimed at verifying third parties that want to enter into a contractual relationship with KN or other companies under the control of KN (hereafter “Counterparty”) comply with ethical and anti-corruption principles as applicable by law and regulation.

This Privacy Information Notice is aimed at informing you about the nature, purpose, legal basis of the processing, eventual categories of recipients and rights you can exercise.

1. Identity of the Data Controller

The Data Controller is Kuehne + Nagel Management AG, with registered office Dorfstrasse 50, 8834 Schindellegi, Switzerland.

2. Contact details of the Data Protection Officer

KN has appointed a Data Protection Officer who can be contacted at the following email address privacy@kuehne-nagel.com.

3. Categories of personal data

The categories of personal data (hereinafter “Data”) that will be processed include

(i) the Data collected in the context of our IDD procedures and

(ii) autonomously obtained by the Data Controller through consultation of information in publicly available databases, internet sources and media news and other company information databases.

In case you will not provide some of the aforementioned Data, the anti-corruption due diligence process – necessary to the establishment of business relationships with KN or other companies within the scope of control of KN – may not be successfully completed.

4. Purposes of data processing and its legal basis

a. Data processing is required to pursue the legitimate interest of the data controller of fraud prevention and, more generally, of corruption.

Your Data may be processed without your consent, in cases where this is necessary to pursue the legitimate interest of the Data Controller for preventing frauds and, specifically, corruption crimes that could expose the Data Controller to serious reputational risks and to fines resulting from failure to comply with the anti-corruption laws and regulations to which the Data Controller is bound. This processing will be put in place according to purpose, relevancy, adequacy, and limitation principles.

b. Defense of a legal claim

In addition, your Data will be processed whenever it is necessary to ascertain, exercise or defend a legal claim on the part of the Data Controller or another company within KN's scope of control.

c. Legal obligations

Hence your data will be processed to comply with the anti-corruption laws and regulations to which the Data Controller is bound (e.g. Foreign Corrupt Practices Act, UK Bribery Act, Legislative Decree 231/2001).

d. Consent

A processing of your personal data for specific purposes can also take place on the basis of your consent. In general, you can revoke this consent at any time.

5. Recipients of personal data

For the purposes indicated in point 4, the Data Controller may disclose your Data to third parties, such as, for example, those belonging to the following categories:

• companies specialized in the conduction of due diligence activities on behalf of KN or another company within KN's scope of control;
• other companies contractually bound to the Data Controller that provide audit activities for ISO certification, statutory and accounting audit;
• police forces, the armed forces and other government bodies, for the fulfilment of the obligations envisaged by law, regulations or international / EU legislation. In this case, according to applicable data protection legislation, the prior consent of the data subject is not required;
• KN Group companies for the execution of processing for purposes related to those referred to the point 4.

Your data will be not communicated to third parties, except as provided for the above and, in any case, within the limits specified here. Finally, please note that your Data will not be disclosed to undetermined subjects in any form whatsoever, including the availability or simple consultation.

6. Transfer of Data

KN, for some of the purposes indicated in Section 4 above, could transfer your Data, comprising through inclusion in databases shared and managed by third parties both within and outside of KN's scope of control. The management of the database and the processing of this data are performed only for the purposes for which it was collected and with maximum respect for the privacy and security standards described in applicable personal data protection laws. Whenever your Data is transferred, the Data Controller shall take every suitable and necessary contractual measure to guarantee an adequate level of personal data protection in accordance with this Privacy Information Notice.

7. Data retention period

The data will be kept for no longer than required for the purposes for which it has been collected or processed, in accordance with the applicable legislation.

Your data will be kept for the longer between (i) ten (10) years from the first collection in the context of anti-corruption due diligence and (ii) ten (10) years from the termination of the contractual relationship. At the end of this period, all data will be deleted or otherwise duly encrypted, unless the continued retention of some or all of the data is required by law. In the case of explicit consent personal data may be stored longer and processed for later business assessments.

8. Rights of data subjects

As data subject, you have the following rights concerning the Data collected and processed by the Data Controller for the purposes listed at Section 4 above:

(i) right to access, in particular by obtaining, at any moment, confirmation whether or not personal data relating to you exist in the Data Controller’s files or databases and intelligible communication of such information, and information concerning the nature and source of your Data, the purposes, methods and logic of the processing as well as the identity of the data controller, data processor/s, if appointed, persons in charge of the processing and entities or categories of entity to which the data may be communicated;

(ii) to obtain the updating, rectification or, where interested therein, integration of the data (excluded evaluation data), erasure, anonymization or blocking of data processed unlawfully, including collected data not necessary for the purposes of the processing; and

(iii) subject to specific conditions, the restriction of processing and data portability. Under the law you are also entitled to lodge a complaint with the Data Protection Authority, in case you believe there has been a violation of your rights under the GDPR.

You may exercise your rights under https://privacy.kuehne-nagel.com/dsar-form/

In case of questions, please contact privacy@kuehne-nagel.com.