Global Privacy Policy

1. Categories of personal information subject to processing

The Company collects and processes the following personal information. Some of it may be collected automatically.

(1) Personal information relating to customers

The Company collects and processes the following personal information of customers of the Company (Collectively, “customers”), including, but not limited to, potential customers and customers who access the website of the Company (the “Website”) , and who inquire of the Company through the Website.

• Name, e-mail address, address, postal code, territory or country of residence, phone number, type of your business, your company`s name, your department, and phone number of your company, position in the company, record of products or services you have considered (or are interested in), bank account information, credit card information, ID, and password of customers.
• Cookies, ADID, IDFA and other terminal identifiers and attribute information of customers who access the Website (such as age, gender, interests categories, affinity categories, in-market segments, purchasing tendency inferred from Website browsing history and level of interest inferred from information on Website the customers stay. For more information about interests categories, affinity categories, in-market segments, visit About Demographics and Interests - Analytics Help (google.com)
• IP addresses, provider information, terminal information, web browser information and access area information (location data) of customers who access the Website.
• Questionnaire information and inquiry details, products for which you wish to obtain IES information, categories of inquiry (specifications, price, inventory, request for brochure, sample, proposal, etc.) of customers who inquiry of the Company.
• Other personal information required to pursue purpose of use in Article 2 below.

(2) Personal information relating to directors and employees etc. of business partners

The Company collects and processes the following personal information of directors and employees etc. of business partners which they provide.

• Name, e-mail address, address, postal code, phone number, type of the business partners’ business, the business partners’ name, department the directors and employee belong to, and phone number of the business partners, position of the directors and employee, record of products or services the business partners have considered (or are interested in), bank account information
• Questionnaire information and inquiry details (specific inquiries such as UV LEDs, infrared LEDs, visible light LEDs, etc., inquiries regarding requests for information materials, etc.), categories of inquiry (specifications, price, inventory, request for brochure, sample, proposal, etc.) and
• other personal information required to pursue purpose of use in Article 2 below.

(3) Personal information relating to shareholders

The Company collects and processes the following personal information of shareholders which they provide.

• Name, address, e-mail address, number of shares held, date of acquisition of shares, shareholder number, dividend payment history, dividend payment account, and other information necessary to contact shareholders or for administration in accordance with the Companies Act and other laws and regulations
• other personal information required to pursue purpose of use in Article 2 below.

(4) Personal information relating to applicants for employment by the Company

The Company collects and processes the following personal information of applicants for employment by the Company which they provide.

• Name, alias, age, gender, e-mail address, phone number, educational and in-house background, qualification, academic transcript of their former school, bank account information, work history, signature, social insurance information, transcripts of academic results, married/unmarried, health condition, military service record, origin of country, personnel evaluations, resumes, face photo, family information
• other personal information required to purse purpose of use in Article 2 below.

2. Purpose of use of personal information

The Company may process your personal information for the following purposes:

(1) Personal information relating to customers

• to respond to inquiries from customers
• to send quotations, product introductions, performance reports, catalogues, etc. and provide information on B to C products, LED products, and IES data to customers, and otherwise communicate with you through various means, which may include by email, telephone, post, or by other means as communicated to you from time to time
• direct marketing
• targeted advertising based on the preference and interest inferred from the browsing and purchasing history
• to provide services, operate, and improve services
• to analyze the use of the Website
• to make de-identified or aggregated information from personal information
• for compliance with law
• for other purposes permitted under applicable laws and regulations.

(2) Personal information relating to directors and employees etc. of business partners

• to respond to inquiries from business partners
• to send quotations, product introductions, performance reports, catalogues, etc. to business partners, and otherwise communicate with you through various means, which may include by email, telephone, post, or by other means as communicated to you from time to time
• to receive services and goods (contracts, inquiries, orders, etc.)
• to contact suppliers to deal with bankruptcy, etc. of suppliers
• to confirm schedule adjustments and changes in delivery dates, etc.
• to confirm that business operations are being handled properly
• QCDE operations and management with business partners
• to make de-identified or aggregated information from personal information
• to register internal account to start transaction
• for compliance with law
• for other purposes permitted under applicable laws and regulations.

(3) Personal information relating to shareholders

• to exercise rights or perform obligations under the Companies Act and other laws and regulations
• to manage the Company in accordance with laws and regulations
• to make de-identified or aggregated information from personal information
• otherwise communicate with you through various means, which may include by email, telephone, post, or by other means as communicated to you from time to time
• for other purposes permitted under applicable laws and regulations.

(4) Personal information relating to applicants for employment by the Company

• to implement and manage operations related to recruitment
• to provide or communicate employment information, etc. to applicants for employment
• to make de-identified or aggregated information from personal information
• for compliance with law
• for other purposes permitted under applicable laws and regulations.

3. Legal basis, etc. for processing

The Company processes your personal information in accordance with applicable personal information protection regulations. Please refer to the country-specific addenda regarding the Company’s legal basis for processing.

You may be required to provide the Company with certain personal information because the provision of personal information is a statutory or contractual requirement, or a requirement necessary to enter into a contract or for other reasons. In this case, if you do not provide your personal information, the Company may not be able to provide to you our service.

For example, customer’s IP addresses, provider information, terminal information and web browser information is a requirement necessary for the customer to access the Website.

4. Retention period for personal information

We retain personal information for as long as necessary to fulfil the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements, to establish or defend legal claims, or for compliance and protection purposes. To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal requirements.

5. Sources of personal information

The Company collects your personal information directly when you provide your personal information and the Company may also collect personal information from you automatically.
The Company may also collect your personal information indirectly from third parties. Specifically, the Company collects attribute information of customers who accesses the Website which the Company obtains from the Website Traffic Analysis Service Provider such as Google LLC. The Company may also infer your preference and interests from the information collected from you. In addition, as for the personal information relating to applicants for employment by the Company, the Company may collect personal information from school you are graduating from or have graduated from. Furthermore, the Company may collect personal information from Group companies of the Company (Stanley’s Locations | STANLEY ELECTRIC CO., LTD.).

6. Sharing and disclosure of personal information

The Company shares with and discloses your personal information to the following third parties in order to fulfil the purpose of processing personal information as set out above.

I Sharing with Processors (service providers)

(1) Personal information relating to customers

• Server management company
• Homepage management companies
• Website maintenance service provider
• EC shopping service provider
• The Website Traffic Analysis Service Provider (such as Google LLC); and
• Other contractors of the Company

(2) Personal information relating to directors and employees etc. of business partners

• Server management company
• Other contractors of the Company

(3) Personal information relating to shareholders

• Server management company
• Stock transfer service providers
• Japan Securities Depository Center, Inc.
• Lawyer, tax accountant, certified public accountant
• Other contractors that provide services necessary for the Company's business activities

(4) Personal information relating to applicants for employment by the Company

• Server management company
• Affiliates necessary to archive the purpose, unemployment office, organizations related to schools to which applicants belong to and agencies for recruitment
• Website maintenance service provider
• Recruitment agency company
• Other contractors of the Company

II Sharing with Group companies

(1) Personal information relating to customers

• Group companies of the Company (Stanley’s Locations | STANLEY ELECTRIC CO., LTD.)

(2) Personal information relating to directors and employees etc. of business partners

• Group companies of the Company (Stanley’s Locations | STANLEY ELECTRIC CO., LTD.)

(3) Personal information relating to applicants for employment by the Company

• Stanley Electric Co., Ltd.
• StanleyPal Inc.,

III Legal compliance, etc.

In some instances, the Company may be required to disclose your personal information to public and governmental authorities within or outside your country of residence in accordance with law and/or requests from such authorities. The Company will also disclose your personal information if the disclosure is necessary or appropriate, due to the purposes of law enforcement or handling other issues of public importance. The Company will also disclose your personal information if the disclosure is reasonably necessary to protect the Company’s rights, to pursue available remedies, to enforce the Company’s terms of use, to investigate fraud, or to protect the Company’s operations or you.

IV Other

In addition, we may also share your personal information with other parties, including the following.

• As part of a corporate sale, merger, or acquisition, or other transfer of all or part of our assets, including as part of a bankruptcy proceeding;
• Cases in which there is a need to protect a human life, body or fortune, and when it is difficult to obtain a principal's consent;
• With your consent
• Other cases permitted under applicable laws and regulations.

7. Overseas transfer of personal information

As a result of the above sharing and disclosure, your personal information may be transferred to the following countries.

• United States of America
• Thailand
• Korea
• China
• India
• Germany
• France
• England
• Hungary
• Singapore
• Taiwan
• Hong Kong
• Indonesia
• Philippine
• Vietnam
• Australia
• Brazil
• Mexico

In such cases, the Company will take proper protection measures required by the personal information protection regulation of each country. For the protection measures of each country, please refer to the country-specific addenda.

8. Joint use of personal information

We will use personal information jointly with specific parties as follows on the basis of joint use clause under the Act on the Protection of Personal Information in Japan (APPI). However, if it is necessary to obtain your consent under applicable personal information protection regulations other than the APPI, we will obtain your consent.

(1) Categories of the jointly utilized personal information

Following personal information of directors and employees etc. of business partners

• Name, e-mail address, address, postal code, phone number, type of the business partners’ business, the business partners’ name, department the directors and employee belong to, and phone number of the business partners, position of the directors and employee, record of products or services the business partners have considered (or are interested in),
• Questionnaire information and inquiry details (specific inquiries such as UV LEDs, infrared LEDs, visible light LEDs, etc., inquiries regarding requests for information materials, etc.), categories of inquiry (specifications, price, inventory, request for brochure, sample, proposal, etc.)

(2) Scope of a jointly utilizing person

Affiliates of Stanley Electric Co. Ltd.
(Stanley’s Locations | STANLEY ELECTRIC CO., LTD.)

(3) Purpose of use for the jointly utilizing person

Purpose of Use as described in 2(2)

(4) Appelation and address, and the name of its representative of a person responsible for controlling the said personal information

Stanley Electric Co., Ltd.
2-9-13, Nakameguro, Meguro-ku, Tokyo, Japan
President and Representative Director YASUAKI Kaizumi

9. Safety management measures

For safety management of your personal information, the Company takes the following safety management measures:

• Formulation of basic policies: to secure proper processing of personal information, the Company will form basic security policies e.g. “compliance with related laws, regulations, guidelines, and the like”, “questions and complaints processing center”, etc.
• Preparation of procedures related to processing of personal information: in each of the steps of acquiring, using, storing, providing, deleting, disposing etc., the Company will form processing procedures for personal information regarding processing methods, responsible persons, persons in charge and their duties etc.;
• Organizational safety management measures: the Company will, as well as identifying persons responsible for the processing of personal information, clarify which employees will process personal information and the scope of personal information that such employee will process, and prepare a reporting and communication system if a breach of such access rights is found or a breach of any personal information is found (in accordance with applicable personal information protection regulations).
• Human safety management measures: The Company will conduct regular training for employees for important matters regarding processing of personal information.
• Physical safety management measures: In the areas that personal information will be processed, the Company will, as well as managing employees’ access of rooms and limiting devices that would be brought into the room, take measures to prevent access to personal information by persons without authority. The Company will, take measures to prevent robbery, loss or unauthorised access etc. devices, electronic media, documents and anything else containing personal information.
• Technical safety management measures: The Company will limit the number of persons in charge and the scope of personal information databases accessible by persons. The Company will install systems to protect information systems that process personal information from unauthorized access and unauthorized software from outside.
• Grasping the external environment: The Company will take safety management measures after grasping systems regarding protection of personal information in the foreign countries where personal information is stored.

10. Cookies and similar technologies

When a customer accesses the Website and such customer enables cookies, etc. (including tracking technologies such as flash cookies and web beacons, and other technologies; “Cookies, etc.”), the Company may automatically acquire information about the PC, mobile phone, tablet, or other information regarding the communication devices used by the customer etc.

Please see the following URL for more information on our cookie policy of the corporate website.

https://www.stanley.co.jp/e/cookiepolicy.html

11. Regarding acquisition of information accompanied by service tools provided by third parties

I Analytics tool

We may work with third parties that collect data about your use of the Website over time for non-advertising purposes. For example, the system may use Google Analytics for analytics and marketing purposes.

In Google Analytics, user information will be collected by using Cookies, etc. For more information about how Google Analytics collects and uses data when you use our Site, visit https://policies.google.com/technologies/partner-sites?hl=en, and to opt out of Google Analytics, visit https://tools.google.com/dlpage/gaoptout?hl=en.

Google Analytics advertising function that the Company uses is as follows:

• Reports on user attributes and interest categories of Google Analytics

II Links to third-party websites or apps

The Website may provide links to third-party websites or apps. We do not control the privacy practices of those websites or apps, and they are not covered by this Privacy Policy. You should review the privacy policies of other websites or apps that you use to learn about their data practices.

12. Rights of data subjects

The Company will respect the rights you hold regarding personal information protection regulations applicable to you. You may require disclosure of personal information (including records of the provision of personal information to third parties), correction, addition, and elimination of content, suspension and erasure of usage, and suspension of provision to third parties in accordance with Japanese laws regarding protection of personal information. In addition, in personal information protection regulations of each country that will be applied, rights may be granted to you. For rights granted in each country, please refer to the country-specific addenda. If you wish to exercise your rights, please make an inquiry using the contact in Article 14 (Contact Details) of this Privacy Policy.

13. Languages

This Privacy Policy is described in English and translated in Japanese. If any matter set forth herein is inconsistent or in conflict with the Japanese translation version, the provisions of the English prevail with respect to such matter.

14. Contact Details

For questions and inquiries regarding this Privacy Policy, please contact the consultation center stated below:

Stanley Electric Co., LTD.
Legal Affairs and Intellectual Property Department
Legal Affairs/IP Management Section
Email: privacy@stanley-electric.com
TEL: 03-6866-2779

If you assert your rights, we may ask a copy of your ID or equivalent details to identify you. In addition, if the request is submitted by a person other than you, submission of power of attorney may be required.

15. Changes to the Global Privacy Policy

The Company may, in making changes to the Global Privacy Policy (including country-specific addenda), change or add all or part of the Global Privacy Policy by publishing on the Website, sending e-mail to you, or giving notice by any other method that the Company deems appropriate (subject to applicable laws and regulations, if any). If there are any necessary procedures in personal information protection regulations that will be applied, such procedures will be taken.

1. Applicability

This Addendum applies to you if you are in the EEA or UK (or if EEA or UK data protection law applies).

2. Purposes of process and legal basis for processing

We have to have a legal basis to process your data. For the categories of data listed in Section 1 of the Global Privacy Policy, we process the data on the following bases to meet the purposes listed in Section 2 of the Global Privacy Policy:

(1) Personal information relating to customers

Purpose of the processing	Lawful basis of the processing
to respond to inquiries from customers	Contract performance (Art. 6.1 (b) GDPR)
to send quotations, product introductions, performance reports, catalogues, etc. and provide information on B to C products, LED products, and IES data to customers, and otherwise communicate with you through various means, which may include by email, telephone, post, or by other means as communicated to you from time to time	Legitimate interest (Art. 6.1 (f) GDPR)
direct marketing	Consent (Art. 6.1 (a) GDPR)
targeted advertising based on the preference and interest inferred from the browsing and purchasing history	Consent (Art. 6.1 (a) GDPR)
to provide services, operate, and improve services	Contract performance (Art. 6.1 (b) GDPR) to provide and operate services Legitimate interest (Art. 6.1 (f) GDPR) to improve services
to analyze the use of the Website	Consent (Art. 6.1 (a) GDPR)
to make de-identified or aggregated information from personal information	Legitimate interest (Art. 6.1 (f) GDPR)
for compliance with law	Legal obligation (Art. 6.1 (c) GDPR) for compliance with EEA, EEA member state, and UK law Legitimate interest (Art. 6.1 (f) GDPR) for compliance with other laws including Japanese laws
for other purposes permitted under applicable laws and regulations	applicable lawful basis under Art.6 GDPR

(2) Personal information relating to directors and employees etc. of business partners

Purpose of the processing	Lawful basis of the processing
to respond to inquiries from business partners	Contract performance (Art. 6.1 (b) GDPR)
to send quotations, product introductions, performance reports, catalogues, etc. to business partners, and otherwise communicate with you through various means, which may include by email, telephone, post, or by other means as communicated to you from time to time	Legitimate interest (Art. 6.1 (f) GDPR)
to receive services and goods (contracts, inquiries, orders, etc.)	Contract performance (Art. 6.1 (b) GDPR)
to contact suppliers to deal with bankruptcy, etc. of suppliers	Legitimate interest (Art. 6.1 (f) GDPR)
to confirm schedule adjustments and changes in delivery dates, etc.	Contract performance (Art. 6.1 (b) GDPR)
to confirm that business operations are being handled properly	Legitimate interest (Art. 6.1 (f) GDPR)
QCDE operations and management with business partners	Legitimate interest (Art. 6.1 (f) GDPR)
to make de-identified or aggregated information from personal informatio	Legitimate interest (Art. 6.1 (f) GDPR)
to register internal account to start transaction	Contract performance (Art. 6.1 (b) GDPR)
for compliance with law	Legal obligation (Art. 6.1 (c) GDPR) for compliance with EEA, EEA member state, and UK law Legitimate interest (Art. 6.1 (f) GDPR) for compliance with other laws including Japanese laws
for other purposes permitted under applicable laws and regulations	applicable lawful basis under Art.6 GDPR

(3) Personal information relating to shareholders

Purpose of the processing	Lawful basis of the processing
to exercise rights or perform obligations under the Companies Act and other laws and regulations	Legal obligation (Art. 6.1 (c) GDPR) for compliance with EEA, EEA member state, and UK law Legitimate interest (Art. 6.1 (f) GDPR) for compliance with other laws including Japanese laws
to manage the Company in accordance with laws and regulations	Legal obligation (Art. 6.1 (c) GDPR) for compliance with EEA, EEA member state, and UK law Legitimate interest (Art. 6.1 (f) GDPR) for compliance with other laws including Japanese laws
to make de-identified or aggregated information from personal information	Legitimate interest (Art. 6.1 (f) GDPR)
otherwise communicate with you through various means, which may include by email, telephone, post, or by other means as communicated to you from time to time	Legitimate interest (Art. 6.1 (f) GDPR)
for other purposes permitted under applicable laws and regulations	applicable lawful basis under Art.6 GDPR

(4) Personal information relating to applicants for employment by the Company

Purpose of the processing	Lawful basis of the processing
to implement and manage operations related to recruitment	Legitimate interest (Art. 6.1 (f) GDPR)
to provide or communicate employment information, etc. to applicants for employment	Legitimate interest (Art. 6.1 (f) GDPR)
to make de-identified or aggregated information from personal information	Legitimate interest (Art. 6.1 (f) GDPR)
for compliance with law	Legal obligation (Art. 6.1 (c) GDPR) for compliance with EEA, EEA member state, and UK law Legitimate interest (Art. 6.1 (f) GDPR) for compliance with other laws including Japanese laws
for other purposes permitted under applicable laws and regulations	applicable lawful basis under Art.6 GDPR

*List of legal basis

• Contractual performance – we have obligations under our service agreement with you, depending on the nature of the contract. To fulfil these obligations we have to use your data.

• Consent – in certain limited cases, we ask for your consent to use your data. Whenever we ask for your consent as a legal basis to process data we will explain the situations where we use your data and for what purposes.

• Legitimate interest – we process your data when this is necessary for us to achieve a legitimate business purpose, or where this is necessary for someone else to achieve their legitimate purpose.

• Legal obligation – as an organisation we have obligations to comply with legal, regulatory and other requirements under EEA or UK laws. In certain cases we will have to use your data to meet these obligations.

**For details of the balancing test for legitimate interests, please contact us using the contact details specified in Section 14 (Contact Details) of the Global Privacy Policy.

3. Overseas transfer of personal information

As a Japanese headquartered company, most of our IT systems are hosted in Japan and all the personal information held by the Company listed at Section 1 of the Global Privacy Policy is hosted in Japan. The European Commission and UK government have determined that Japan offers an adequate level of protection – you can find out more in the adequacy decision(s) here and here. We rely on these decisions for EEA-Japan and UK-Japan transfers and explain below what happens when there is not an adequacy decision covering a transfer.

We also transfer personal information to some third parties which host or access personal information outside of the EEA/UK. In the event such an organisation is in a country which is not subject to an adequacy decision by the European Commission or UK government or considered adequate as determined by applicable data protection laws, we take steps to ensure your personal information is adequately protected by the use of approved Standard Contractual Clauses, or by vendor's Processor Binding Corporate Rules, or by relying on such other data transfer mechanisms as available under applicable data protection laws

A copy of the relevant mechanism can be obtained for your review on request by using the contact details at section 14 of this Policy.

4. Rights of data subjects

You have the right to ask us for a copy of your personal information; to correct, delete or restrict processing of your personal information; and to obtain the personal information you provide in a structured, machine-readable format. You also have the right to object where we are processing your data for direct marketing.
In addition, you can object to the processing of your personal information in some circumstances (in particular, where we don’t have to process the data to meet a contractual or other legal requirement). Where we have asked for your consent, you may withdraw consent at any time. If you ask to withdraw your consent to Stanley processing your data, this will not affect any processing which has already taken place at that time. When you exercise your rights, we will ask for information to check your identity; this will only involve official ID documents if this is necessary given the risk posed by the data processed.

These rights may be limited, for example if fulfilling your request would reveal personal information about another person, or if you ask us to delete information which we are required by law or have compelling legitimate interests to keep. If you have unresolved concerns, you have the right to complain to a data protection authority. In the UK, this will be the Information Commissioner. In the EEA, this will be your Data Protection Authority which you can find here.

1. Applicability

This Addendum (“California Privacy Policy”) applies to you if you are California residents (or if California Consumer Privacy Act as amended by the California Privacy Rights Act applies).

California Privacy Policy explains your California privacy rights and describes our personal information collection practices when the Company is acting as the business.

Especially, information on the categories of Personal information we collect and whether we sell or share personal information is contained in Section “2. Categories of Personal information collected within the past 12 months and its and its Source” and Section “5. Categories of Personal information Stanley Electric has sold and / or Shared within the past 12 months & Categories of Third Parties to whom Such Information was Sold and/or Shared” below. Information on the length of time the business intends to retain personal information is contained in Section “7. Retention Period” below, and information on your rights is contained in Section “8. Your Privacy Rights” below.

California Privacy Policy supplements the Stanley Electric Global Privacy Policy (“Global Privacy Policy”). The definitions in the Global Privacy Policy apply to this California Privacy Policy.

If this California Privacy Policy and any provision in the Global Privacy Policy conflict, then this California Privacy Policy controls for the processing of personal information of California residents pursuant to California law.

2. Categories of Personal information collected within the past 12 months and its and its Source

We have collected the following categories of Personal Information within the past 12 months:

• Identifiers (e.g., name, mailing address, email address, phone number).
• Personal information described in subdivision (e) of Section 1798.80. (e.g. name, mailing address, phone number, bank account information)
• Characteristics of protected classifications under California or federal law with regards to applicants for employment by the Company (e.g. married/unmarried, national origin, signature, educational background, work history, information related to health condition)
• Commercial information (e.g., questionnaire information and inquiry details, products for which you wish to obtain IES information, categories of inquiry (specifications, price, inventory, request for brochure, sample, proposal, etc.) of customers who inquire of the company).
• Internet or other electronic network activity information (e.g., cookies, ADID, IDFA and other terminal identifiers and attribute information of customers who access the Website, IP addresses, provider information, terminal information, web browser information, and access area information of customers who access the Website).
• Professional or employment-related information
• Education information, defined as information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act (20 U.S.C. Sec.1232g; 34 C.F.R. Part 99) with regards to applicants for employment by the Company
• Inferences drawn from any of the information above (e.g. purchasing tendency inferred from Website browsing history and level of interest inferred from information on Website the customers stay)
• Sensitive personal information with regards to applicants for employment by the Company
  　✓ personal information collected and analyzed concerning a consumer’s health
  　✓ a consumer’s social security number

For a complete list of personal information we collect from you as a consumer, please visit the Global Privacy Policy.

We gather this information directly from you when you engage with us or our services. For device and technical information, we gather this directly from you when you interact with us, and from third party analytics and service providers who assist us with providing our services, as well as from our affiliated companies.

3. Business or Commercial Purposes

We collect the information for the business and commercial purposes set forth in Section 2 “Purpose of Use of Personal Information” of the Global Privacy Policy, such as to fulfil or meet the purpose for which the personal information was provided, to audit Site usage; for internal research; detecting security incidents; and undertaking activities to verify or maintain the quality or safety of our services, including any service or device that is owned, manufactured, manufactured for, or controlled by us, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by us.

4. Categories of Personal Information we have disclosed to third parties in the past 12 months & Categories of Third Parties to whom Such Personal Information was disclosed

Within the past 12 months, we have disclosed all categories of personal information described above with parties set forth in Section 6 “ Sharing and Disclosure of Personal Information” of the Global Privacy Policy and for the purposes set forth in this California Privacy Annex.

5. Categories of Personal information Stanley Electric has sold and / or Shared within the past 12 months & Categories of Third Parties to whom Such Information was Sold and/or Shared

• Internet or other electronic network activity has been sold and/or shared with advertising networks, internet service providers, data analytics providers, operating systems and platforms, and network partners. The purpose is to analyze traffic and content within our sites and services, which helps the Company to better tailor its services to its customers.

The Company does not knowingly collect or sell the personal information of minors under the age of 16.

6. Whether Stanley Electric uses or discloses sensitive personal information for purposes other than those specified in section 7027, subsection (m) of CCPA regulations.

Stanley Electric does not uses or discloses sensitive personal information for purposes other than those specified in section 7027, subsection (m) of CCPA regulations.

7. Retention Period

We retain personal information for only so long as necessary for our commercial and business purposes further described in California Privacy Policy as explained in Section 4 “Retention period for personal information” of the Global Privacy Policy.

8. Your Privacy Rights

If you are a California resident, you may exercise the following rights regarding your personal information, subject to certain exceptions and limitations:

• The right to know the categories and specific pieces of personal information we collect, use, disclose, and sell about you; the categories of sources from which we collected your personal information; our purposes for collecting or selling your personal information; the categories of your personal information that we have either sold or disclosed for a business purpose; and the categories of third parties with which we have shared personal information;
• The right to request that we delete the personal information we have collected from you or maintain about you;
• The right to correct inaccurate personal information we maintain about you;
• The right to opt out of our sale(s) or sharing of your personal information; and
• The right not to receive discriminatory treatment for the exercise of the privacy rights conferred by the CCPA.
• Shine the Light. California’s “Shine the Light” law permits California residents to request a notice disclosing the categories of personal information about you that we have shared with third parties for their direct marketing purposes during the preceding calendar year, or providing a mechanism by which you can opt out of such sharing. At this time, the Company does not share personal information with third parties for their direct marketing purposes.

If you have a request regarding your information and would like to exercise your rights under applicable law, please contact us through the methods provided in Section 14 “Contact Details” of the Global Privacy Policy.

(Verification Process and Required Information) Please note that we may need to request additional information from you to verify your identity or understand the scope of your request, although you will not be required to create an account with us to submit a request or have it fulfilled. We will require you to provide certain personal information to countercheck with our records.

(Authorized Agent)To submit a request through an authorized agent, we may require the agent to provide proof of authorization to submit a request on your behalf.

1. Applicability

This Addendum applies to customers located in Mainland China (excluding Hong Kong and Macau, Taiwan hereinafter referred to as “China”).

In addition, when our processing of personal information of customers outside of China is subject to extraterritorial application of the Personal Information Protection Law of China, the provisions of this Addendum shall also apply.

2. Legal basis for processing

When we process personal information, we shall obtain the customer’s consent and process the information in accordance with the principles of lawfulness, legitimacy, necessity and good faith, and such consent shall include consent to the Privacy Policy and this Addendum. However, in the following circumstances, personal information may be processed without the customer’s consent based on the Personal Information Protection Law of China:

• Where it is necessary for the conclusion or performance of a contract to which the customer is a contracting party;
• Where it is necessary for performing a statutory responsibility or obligation;
• Where it is necessary for responding to a public health emergency, or for protecting the life, health or property of a natural person in the case of an emergency;
• Where the customer’s personal information is processed within a reasonable scope to carry out any news reporting, supervision by public opinion or any other activities for public interest purposes;
• Where the personal information, which has already been disclosed by the customer or otherwise legally disclosed, is processed within a reasonable scope and in accordance with the Personal Information Protection Law of China; or
• Any other circumstances as provided by law or administrative regulation.

3. Personal information transfer outside of China

We may transfer customers’ personal information to our group companies located in countries/regions other than China to the extent described in the Privacy Policy, and customer consent to the policy and this Addendum shall also include consent to such transfer of personal information outside of China.

In addition, we may take necessary measures to ensure that the activities of processing the personal information provided by customers carried out by overseas recipients meet the standards of personal information protection provided in the Personal Information Protection Law of China.

4. Customers’ rights

We ensure that customers can exercise the following rights with respect to their personal information, unless otherwise provided by law or administrative regulation:

• Right to be informed and make decisions
  Customers have the right to be informed of and to decide on the processing of their personal information, as well as the right to restrict or deny other persons from processing it.
• Right to request access and copies
  Customers have the right to request access to or copies of their personal information. If such requests are made, we shall provide access or copies in a timely manner.
• Right to transfer
  If any customers request to transfer their personal information to their designated personal information processors who meet the conditions prescribed by the national cybersecurity authority, then we shall provide the transfer method.
• Right to correct and complete
  If any customers discover that their personal information is incorrect or incomplete, they have the right to request personal information processors to correct or complete that information.
  If any customers request any personal information processors to correct or complete their personal information, we shall confirm the information and correct or complete it in a timely manner.
• Right to delete
  Customers have the right to request the Company to delete their personal information if (i) the purpose of processing has been achieved or is unable to be achieved, or the personal information is no longer necessary for achieving such purpose; (ii) the personal information processor ceases the provision of the product or service involved, or the retention period has expired; (iii) consent is withdrawn by the customer; (iv) the processing of personal information by the personal information processor is in violation of any law, administrative regulation or agreement; or (v) there are any other circumstances as provided by law or administrative regulation.
• Right to request explanation of the rules of processing personal information
  Customers have the right to request the Company to explain its rules of processing personal information.
• Right to withdraw consent
  Customers have the right to withdraw their consent to the processing of their personal information carried out based on that consent.