SAP Global Physical Security 

Updated on 6th June 2025.

Protecting an individual's privacy is crucial to the future of business. SAP has created this Privacy Statement to demonstrate our firm commitment to the individual`s right to data protection and privacy. This Privacy Statement outlines how we handle information that can be used to directly or indirectly identify an individual.

 

Video Surveillance installations at the SAP premises in the People's Republic of China (excluding Hong Kong Special Administrative Region, Macao Special Administrative Region and Taiwan) (“China”).

 

Video surveillance cameras (also known as closed-circuit televisions, or CCTV) are directed at viewing and/or recording the images of individuals to ensure an adequate level of security for and at a company´s premises in preventing and/or investigating break-ins, destruction, or other malicious activities.

 

The surveillance cameras are installed:

• at the various entry and exit points of the SAP buildings;

• at security relevant areas in the SAP buildings; 

• at parking entrances or parking areas located at the SAP Campus; 

• at the outer area of the SAP buildings within SAP Campus.

All locations where your Pemrsonal Information may be captured are clearly marked by warning signs.

 

 

Who is the Personal Information Handler ?

 

The Personal Information Handler for video surveillance is SAP (China) Co., Ltd. . The data protection officer can be reached at privacy@sap.com.

 

Depending on the specific location, this will include one of the following legal entities:

• Beijing (BJG07) 6F &7F &8F &10F &12F, Building 3, World Profit Center No. 16, Tianze Road, Chaoyang District"

• Chengdu (CTU02) Rm 19-28, 8F, E5 Area, Building 2, #1366 Middle Tianfu Ave, TFSP, Chengdu 610040

• Dalian (DLN02) 4F & 5F, DLSP16, International Information Service Center NO.269 Wuyi Road, Shahekou Dist Dalian China 116021

• Dalian (DLN03) 5F & 6F, DLSP17, International Information Service Center NO.269 Wuyi Road, Shahekou Dist Dalian China 116021

• Guangzhou (GZU02) Room 5709, No.6 Zhujiang East Road, Tian He district, 510613 Guangzhou

• Shanghai Labs Campus (PVG01-05) #1001 Chenhui Road,Shanghai, PRC 

• Shanghai (PVG06) 3-8F, Building W2, #1000 Chenhui Road, Shanghai, PRC

• Shanghai (PVG07) Building W3, #1000 Chenhui Road, Shanghai, PRC

• Shanghai Wheelock (PVG10) 1-5F, 47F & 55F, 1717 Nanjing West Road, Jing'an District, Shanghai

• Shanghai (PVG11) No. 112, Liangxiu Rd, Shanghai, PRC

• Shanghai Chamtime (PVG12) Building D, No. 2889, Jinke Road, Shanghai

• Shenzhen (SZX01) Room 01, 03, 04, 24F, Tower Three, Kerry Building Plaza, Zhong Xin Si Road, Futian District, Shenzhen

• Xi'an (XIY02) No.201, Tower D, Area 1, Xi'an National Service Demonstration Base, 11 Jin Ye Yi Road, High-tech Zone, Xi'an

• Shanghai 4 (SHA4) No.101 Baoshan Area West Changjiang Road, Shanghai, 200431, CN-China

• Shanghai 6 (SHA6) No.6 Hua Jing Road, Shanghai, 200131, CN – China

 

What Personal Information does SAP collect?

 

If you move about SAP´s campus or access SAP´s premises, we collect your images via video surveillance cameras, consisting of a recording of your activities except sound or voice. In addition, we collect a picture of your license plate in the parking areas (your "Personal Information").

 

 

Why does SAP need your Personal Information?

 

SAP processes your Personal Information in order to ensure an adequate level of security for and at SAP´s premises. 

 

This process allows SAP to provide you with access to SAP facilities and to ensure the security and safety of all SAP employees, suppliers, visitors, and assets across all global SAP locations. This allows SAP to comply with statutory obligations, including identification verification prior to or during access to any SAP-owned or leased facility.

 

Although providing Personal Information is voluntary, without your Personal Information, SAP cannot provide you with access to SAP-owned or leased facilities.

 

 

How long does SAP store my Personal Information?

 

SAP will store your Personal Information for a period of maximum 90 days. If the video surveillance recording is required for the investigation of an incident it can be kept for as long as necessary to conclude the investigation. 

 

SAP will also retain your Personal Information for additional periods if it is required by mandatory law to retain your Personal Information longer or where your Personal Information is required for SAP to assert or defend against legal claims, SAP will retain your Personal Information until the end of the relevant retention period or until the claims in question have been settled. 

 

 

Who are the recipients of my Personal Information and where will it be processed?

 

Your Personal Information will be passed on to the following categories of third parties to process your Personal Information: 

• SAP legal or local or law enforcement agencies, as the result of any corporate criminal or other security investigations

 

 

What are your Personal Information protection rights?

 

Right to access, correct and delete

You can request from SAP at any time, access to information about which Personal Information SAP processes about you and, if necessary, the correction or deletion of such Personal Information. Please note, however, that SAP can or will delete your Personal Information only if there is no statutory obligation or prevailing right of SAP to retain it. If you request from SAP to delete your Personal Information, you may not be able to continue to use any SAP service that requires SAP ’s use of your Personal Information.

 

Right to explain

You can request SAP to explain the Personal Information processing rules.

 

Right of portability

If you request SAP to transfer your Personal Information to certain designated Personal Information Handler, SAP will provide the channel of transfer provided that the conditions specified by the applicable laws and regulations are met.

 

Right to obtain a copy of Personal Information

You can request from SAP a copy of the Personal Information you provided to SAP. In this case, please contact  privacy@sap.com. and specify the information or processing activities to which your request relates, the format in which you would like to receive the Personal Information, and whether it should be sent to you or another recipient. SAP will carefully consider your request and discuss with you how it can best be fulfilled.

 

Right to stop or restrict

You can request from SAP to stop or restrict your Personal Information from further processing in certain circumstances such as: (i) you state the Personal Information about you is incorrect, subject to the time SAP   requires to check the accuracy of the relevant Personal Information; (ii) there is no legal basis for SAP   to process your Personal Information and you demand SAP   to stop or restrict your Personal Information from further processing; or(iii) SAP   no longer requires your Personal Information, but you state you require SAP   to retain such information to claim or exercise legal rights or to defend against third party claims.

 

Right to object to automated decision-making

You can request not to be subject to a decision based solely on automated processing.

 

Right to revoke consent

Wherever SAP is processing your Personal Information based on your consent, you may at any time withdraw your consent by providing SAP with a respective notice of withdrawal. In case of withdrawal, SAP will not process Personal Information subject to this consent any longer unless legally required to do so. In case SAP is required to retain your Personal Information for legal reasons your Personal Information will be restricted from further processing and only retained for the term required by law. However, any withdrawal has no effect on past processing of Personal Information by SAP up to the point in time of your withdrawal.

 

Furthermore, if your use of an SAP offering requires your prior consent, SAP will no longer be able to provide the relevant service (or services, if you revoke the consent for SAP   to use your profile under the SAP Identity Authentication Service for multiple SAP offerings), offer or event to you after your revocation.

 

Right to lodge a complaint

If you take the view that SAP is not processing your Personal Information in accordance with the requirements in this Privacy Statement or under applicable data protection laws, you can at any time, to the extent required by applicable law, lodge a complaint with competent data protection authority.

 

Right to object

You can at any time object to SAP’s use of your Personal Information as set forth in this section by sending an email to SAP-Physical-Sec-Privacy@sap.com. In this case, SAP will carefully review your objection and cease further use of the relevant information, subject to SAP’s compelling legitimate grounds for continued use of the information, which override your interest in objecting, or if SAP requires the information for the establishment, exercise or defense of legal claims.  

 

In addition, SAP can use your Personal Information based on a legal obligation (Article 13(3) PIPL) to support the rightful and valid requests of public authorities for support in an investigation.

 

 

How will SAP verify requests to exercise data protection rights?

 

SAP will take steps to ensure that it verifies your identity to a reasonable degree of certainty before it will process the data protection right you want to exercise.  When feasible, SAP will match  Personal Informationprovided by you in submitting a request to exercise your rights with information already maintained by SAP. This could include matching two or more data points you provide when you submit a request with two or more data points that are already maintained by SAP.  

 

SAP will decline to process requests that are manifestly unfounded, excessive, fraudulent, or are not otherwise required by local law. 

 

Please direct any requests to exercise your rights to SAP-Physical-Sec-Privacy@sap.com.

.

 

Why does SAP need to use my Personal Information and on what legal basis is SAP using it?

 

SAP can use your Personal Information based on 1) its necessary to conduct human resources management according to lawfully formulated labor rules  and regulations and lawfully concluded contracts (Article 13 (2) PIPL) ,for SAP employees; and 2) the consent (Article 13(1) PIPL) , for visitors ,as follows: 

• to control access to SAP´s campus and premises; 

• to ensure adequate security for and at SAP´s campus and premises;  

• to ensure the safety of SAP employees and visitors SAP´s campus and premises;  

• to prevent, deter, and if necessary, investigate unauthorized physical access, including unauthorized access to secure premises and protected rooms, IT infrastructure, or operational information; 

• to prevent sabotage, theft and material damage.