Privacy Notice for the “OneTrust” platform of Kuehne+Nagel

Compliance with Data Protection and Privacy Laws is an integral part of the Kuehne+Nagel way of conducting business in a trustworthy manner. Kuehne+Nagel acknowledges and protects the security and privacy of personal data of Kuehne+Nagel’s customers, subcontractors, suppliers and other business partners (“Partner”). Therefore, Kuehne+Nagel processes personal data in compliance with applicable laws on data protection and data security, including the General Data Protection Regulation (“GDPR”).With this privacy notice we would like to inform you about how we process your data in connection with the Data Protection Management System of Kuehne+Nagel - OneTrust - and your rights in this regard. The OneTrust platform is Kuehne+Nagel´s central data protection management system, which is used, among other things, to maintain the vendor management and risk assessments processing directory in accordance with Article 28 and 32 of the GDPR.

1. Purpose of the processing and legal basis

If you use the platform as an external participant (e.g. as a supplier or business partner), we process your personal data for the purpose of documenting your information in the course of the legal obligation to maintain the vendor management and risk assessments in accordance with Article 28 and 32 of the GDPR and documenting technical and organisational measures in the course of a pre-contractual measure. The legal basis for processing your personal data is Art. 6 para. 1 letter b and c GDPR.

If you access the OneTrust platform as an employee of Kuehne+Nagel or another group company, we process your data for the purpose of documenting your information in the course of the legal obligation to maintain a register of processing activities (Art. 30 GDPR). The legal basis for processing your employee data is Section 26 Paragraph 1 Bundesdatenschutzgesetz (BDSG) in conjunction with Article 6 para. 1 letter f GDPR.

2. Categories of personal data processed

For external participants:

If you use the platform as an external participant (e.g., as a supplier or business partner), we process your personal data that you have already provided to us elsewhere, such as through your contact within Kuehne+Nagel. This may include your surname and first name, your business e-mail address and your IP address. Furthermore, we process information assigned to you, which is obtained in the course of using the OneTrust platform and which is obtained in the course of you filling out a questionnaire.

For employees and staff of the Kuehne+Nagel Group:

We process personal data originally collected as part of your employment. This includes surname and first name and your company-mail address. Furthermore, we process information that we assign to you, such as that arises in the course of your work within the OneTrust platform. This includes data that is collected when you fill out a questionnaire, data that we process to track changes, and data that identifies you as the controller or contact person for a processing activity. For further information on the processing of your personal data within the scope of your employment, please refer to the applicable privacy policy.

3. Transfer of data and Categories of recipients

In general, your data will not be transferred to third countries. For maintenance purposes and to resolve interruptions at short notice, it may be necessary for employees of our service provider OneTrust to access our environment, which may be located in third countries. In these cases, data will only be accessed if we have ensured compliance with an adequate level of data protection within the meaning of Art. 46 GDPR. However, your data will not be stored in third countries.

We will treat your data confidentially. Within Kuehne+Nagel and the group companies included in the OneTrust platform, only those departments and employees who need to access your data in order to fulfill the above-mentioned purposes will have access to it, including internal contractors, data protection managers and officers, as well as information security staff and managers and officers of affected areas. In addition, for maintenance purposes, it may be necessary for the service provider of the OneTrust platform, to access our environment for a short period of time.

4. Retention Periods

Unless explicitly indicated otherwise at the time of the collection of Partner’s personal data (e.g. within an express consent provided by the Partner), we erase personal data if the retention of the personal data is no longer necessary in relation to the purposes for which they were collected or otherwise processed and no statutory retention obligations under applicable law require us to further retain personal data.

5. Right to withdraw consent

In case a Partner declared its consent for the processing of certain personal data by Kuehne+Nagel, the Partner has the right to withdraw the consent at any time with future effect, i.e. the withdrawal of the consent does not affect the lawfulness of processing based on the consent before its withdrawal. In case consent is withdrawn, Kuehne+Nagel may only further process the personal data where there is another legal ground for the processing.

6. Rights of and complaints and Data Protection Contact

Any requests including those concerning access to, rectification or erasure of personal data restriction of processing, right to object to processing or any complaints can be addressed under https://privacy.kuehne-nagel.com/dsar-form/. The Data Protection Officer and the data controller can be reached using the following contact details:

Kuehne + Nagel Management AG

Kuehne + Nagel Haus

P.O. Box 67

8834 Schindellegi

Switzerland

Email: privacy@kuehne-nagel.com

Our Privacy Notice as well as the information about our data processing in accordance with Article 13, 14 and 21 GDPR may change from time to time. It is therefore recommended to revisit this Privacy Notice in regular intervals. This Privacy Notice does not apply if there are country-specific Privacy Notices for Business Partners in place and/or conflicting local privacy laws and regulations.