Kuehne+Nagel Group - Privacy notice for the supply chain risk platform React.Inform.Network.Go. (“R.I.N.G.”)

Compliance with Data Protection and Privacy Laws is an integral part of of conducting business in a trustworthy manner. Kuehne+Nagel acknowledges and protects the security and privacy of personal data of Kuehne+Nagel’s customers, subcontractors, suppliers and other business partners. Therefore, Kuehne+Nagel processes personal data in compliance with applicable laws on data protection and data security, including the General Data Protection Regulation (“GDPR”). With this privacy notice we would like to inform you about how we process your data and your rights in connection with supply risk platform React.Inform.Network.Go. (“R.I.N.G.”)

Purpose of the processing and legal basis

R.I.N.G. platform

R.I.N.G. is a platform which provides users with an up-to-date overview of supply chain risks such as freight theft, truck theft, smuggling offences, warehouse burglaries and other similar instances. This overview will be displayed in a short text form with a picture, which also includes location information; the platform also visualizes risk locations and areas.

Existing customers who have a Kuehne+Nagel SSO account and have signed up for R.I.N.G. can login to the platform via SSO. After logging in, both the Privacy Policy and the Terms of Service have to be accepted and additional personal data has to be provided (see paragraph “for external participants”).

Other customers and third parties who do not have a Kuehne+Nagel SSO account yet, can register to the R.I.N.G. platform with the “Register now” button on the login page. The same personal information has to be provided as required for the existing customers (see paragraph “for external participants”). Terms of Service and Privacy Policy have to be accepted.

During the registration process, a KN SSO account and an account in the R.I.N.G. platform will be created. The KN SSO account is needed for authentication and R.I.N.G. account is needed for authorization. After registration the access to the platform will be done by “Login via SSO” button.

Subscription levels

Currently, there are three subscription levels: Trial subscription, Level 1 and Level 2.

Trial subscription

The trial subscription is given to any new R.I.N.G. user by default for the period of one (1) month and gives access to all data within the platform (feed with events and their full description, map with events, possibility to subscribe to email notifications). It is given to the user to explore the capability of the system. After one month of usage, the trial subscription has to be either replaced with a Level 1 or Level 2 subscription or it will automatically be terminated.

Level 1

The Level 1 subscription gives access to signing up to receiving email notifications and to the My Account tab on the portal. The Feed and the Map modules, including the full description of events, are not accessible.

Level 2

The Level 2 subscription gives access to signing up to receiving of email notifications and to the portal itself (the Feed and the Map modules, including the full description of events and My Account tab), and could be limited by countries / regions / events’ categories visible to user.

To prolong or to change the subscription level the user has to contact the R.I.N.G. team by the “Contact us” module within the tool.

Terminating the subscription

There are two cases of how the subscription is terminated:

1. Self-cancelation of subscription by account deletion

Subscription can be terminated at any moment by account deletion. The respective button can be found in the My Account tab (“Delete Account”). After pressing that button, the account is deleted and subscription is cancelled automatically. The user will no longer have access to the platform (including “My Account” tab) nor receives email notifications from the platform.

2. Subscription expiration

Subscription has an expiration date of one (1) month. Once the expiration date is reached, the user no longer has access to the feed and map and no longer receives email notifications. Access to My Account tab remains. User either can delete an account via that tab for account deletion or contact the R.I.N.G. team to prolong the subscription.

The trial subscription by default has an expiration date of one (1) month after the registration date.

R.I.N.G. notification emails

For all users of the R.I.N.G. platform there is also the possibility to sign up for receiving email notifications by ticking the respective checkbox in the My Account tab (“I would like to receive RING newsletters about happened events”). At any time you can update your preference in the same menu.

This tab can be entered either in the platform directly or via the email notification received from the R.I.N.G. platform. The “Unsubcscribe from Emails” link leads to the My Account tab where the user can change the email notification preference.

Legal basis for processing

The legal basis for processing your personal data is Art. 6 para. 1 lit. b and c GDPR. If you have signed up for the notification emails, your consent, in accordance with Art. 6 para. 1 lit. a) GDPR, is the legal basis for data processing. The retention period of 3 years regarding your emailaddress - in order to prevent repeated usage of the trial subscription - is based on Art. 6 para 1 lit. f) GDPR (legitimate interests).

Categories of personal data processed

For external participants

If you use the platform as an external participant (e.g. as a business partner, supplier) we process the following personal data: first name, last name, your business e-mail address, job role, industry and organization, login data as date of registry and date of last login.

For employees and staff of the Kuehne+Nagel Group

We process personal data originally collected as part of your employment. This includes surname and first name and your company-mail address. For further information on the processing of your personal data within the scope of your employment, please refer to the applicable privacy policy.

Transfer of data and Categories of recipients

We will process the personal data transmitted to us for the provision of access to the R.I.N.G. platform and, if signed up for, its risk alert emails.We may transfer personal data to other Kuehne+Nagel group companies, but only if and to the extent such transfer is required for the purposes mentioned above. All data collected with this tool will be hosted within our own KN servers, stored in Hamburg, Germany.

Recipients of personal data may possibly be located in countries outside of the European Economic Area which ensure an adequate level of protection or in countries outside of the European Economic Area in which applicable laws do not offer the same level of data protection as the laws of your home country. In such cases and unless permitted otherwise by applicable laws, we have ensured compliance with an adequate level of data protection within the meaning of Art. 46 GDPR.

We will not transfer personal data collected through this particular tool to any third parties.

We will treat your data confidentially. Within Kuehne+Nagel and the group companies, only those departments and employees who need to access your data in order to fulfill the above-mentioned purposes will have access to it.

Retention periods

After you have terminated your subscription (see paragraph “Terminating the subscription”) your personal data will be erased without undue delay but latest after one month. Deletion will only take place if there are no statutory retention obligations under applicable law that require us to further retain the data.

Data that is deleted latest after one month from the R.I.N.G. database: first name, last name, job role, industry and organization, login data as date of registry and date of last login.

Your business e-mail address remains in the R.I.N.G. database (if not deleted earlier) for the period of 3 years and is needed to prevent the repeated usage of the Trial subscription.

The aforementioned process of deletion takes place only in the R.I.N.G. database.

You can exercise the full deletion request from all Kuehne+Nagel platforms at any time via the following link https://privacy.kuehne-nagel.com/dsar-form/.

Right to withdraw consent

You have the right to withdraw the consent at any time with future effect, i.e. the withdrawal of the consent does not affect the lawfulness of processing based on the consent before its withdrawal. In case consent is withdrawn, Kuehne+Nagel may only further process the personal data where there is another legal ground for the processing.

Your rights as data subject

You have the right of access to personal data concerning you. You can contact us for information at any time.

We delete personal data in principle when there is no need for further storage. A purpose can exist in particular if the data is still needed to fulfil contractual services, to check and grant or ward off warranty and, if applicable, guarantee claims. In the case of legal storage obligations, deletion is only possible after the expiry of the respective storage obligation. You can exercise your rights at any time via the following link https://privacy.kuehne-nagel.com/dsar-form/.

Furthermore, you have the right to correction or to limitation of the processing, insofar as you are legally entitled to this.

You have the right to object to the processing within the scope of the legal requirements.

You also have a right to data transfer within the scope of data protection regulations.

You can exercise your rights at any time via the following link https://privacy.kuehne-nagel.com/dsar-form/.

Right to lodge a complaint with a supervisory authority

You have the right to complain to a supervisory authority for data protection.

Rights, complaints and Data Protection Contact

Any requests including those concerning access to, rectification or erasure of personal data restriction of processing, right to object to processing or any complaints can be addressed under https://privacy.kuehne-nagel.com/dsar-form/.

The Data Protection Officer and the data controller can be reached using the following contact details:

Kuehne + Nagel Management AG

Kuehne + Nagel Haus

P.O. Box 67

8834 Schindellegi

Switzerland

Email: privacy@kuehne-nagel.com

Our Privacy Notice as well as the information about our data processing in accordance with Article 13, 14 and 21 GDPR may change from time to time. It is therefore recommended to revisit this Privacy Notice in regular intervals. This Privacy Notice does not apply if there are country-specific Privacy Notices in place and/or conflicting local privacy laws and regulations.

Version: May 2023