Protecting an individual's privacy is crucial to the future of business. We have created this privacy statement to demonstrate the firm commitment of SAP (China) Co., Ltd. (hereinafter referred to as “SAP” or “We”) in how We handle information that relates to any identified individual or to an identifiable individual (hereinafter referred to as “Personal Information”).
Visitor registration and identity management systems at SAP are used to ensure the security of personnel and assets at SAP's premises.
General Information
Who is the Personal Information Handler?
The Personal Information Handler for visitor registration and identity management is identified as SAP (China) Co., Ltd. Depending on the specific location, this will include one of the following legal entities:
Beijing (BJG07) 6F &7F &8F &10F &12F, Building 3, World Profit Center No. 16, Tianze Road, Chaoyang District"
Chengdu (CTU02) Rm 19-28, 8F, E5 Area, Building 2, #1366 Middle Tianfu Ave, TFSP, Chengdu 610040
Dalian (DLN02) 4F & 5F, DLSP16, International Information Service Center NO.269 Wuyi Road, Shahekou Dist Dalian China 116021
Dalian (DLN03) 5F & 6F, DLSP17, International Information Service Center NO.269 Wuyi Road, Shahekou Dist Dalian China 116021
Guangzhou (GZU02) Room 5709, No.6 Zhujiang East Road, Tian He district, 510613 Guangzhou
Shanghai Labs Campus (PVG01-05) #1001 Chenhui Road,Shanghai, PRC
Shanghai (PVG06) 3-8F, Building W2, #1000 Chenhui Road, Shanghai, PRC
Shanghai (PVG07) 1-5 F Building W3, #1000 Chenhui Road, Shanghai, PRC
Shanghai Wheelock (PVG10) 47F & 55F, 1717 Nanjing West Road, Jing'an District, Shanghai
Shanghai (PVG11) No. 112, Liangxiu Rd, Shanghai, PRC
Shanghai Chamtime (PVG12) Building D, No. 2889, Jinke Road, Shanghai
Shenzhen (SZX01) Room 01, 03, 04, 24F, Tower Three, Kerry Building Plaza, Zhong Xin Si Road, Futian District, Shenzhen
Xi'an (XIY02) No.201, Tower D, Area 1, Xi'an National Service Demonstration Base, 11 Jin Ye Yi Road, High-tech Zone, Xi'an
The data protection officer can be reached at privacy@sap.com.
Employees and contractors within appropriate SAP functions are authorized to operate the system and access the information it contains. These team members are located in all regions and follow SAP Global Security (SGS) policies and procedures.
What Personal Information does SAP collect?
As a visitor to SAP’s premises, we may collect the following information.
Contact Data
SAP processes the following categories of Personal Information as contact data: first name, last name, email address and telephone number.
Personal Information related to the business relationship with SAP (if appropriate)
SAP processes the following category of Personal Information in the context of established business relationships: company name.
SAP Visitor Identity Data
SAP processes the following categories of Personal Information as visit data: visit location, visit registration date and time, date and time of check-in/check-out, visitor photo, visitor Confidentiality Disclaimer signature, host name(s), visitor type (i.e., Visitor, SAP VIP, Event), visitor sub-type (i.e., Auditor, Business Meeting, Contractor/Vendor, Customer, Event, Government, Job Interview, Personal, Sales Partner, Tenant, Training, VIP, VIP (non-SAP)) and visit reason.
Why does SAP need your Personal Information?
SAP processes your Personal Information to ensure an adequate level of safety and security for and at SAP's premises.
This process allows SAP to provide appropriate access to SAP premises and to ensure the security and safety of all SAP employees, suppliers, visitors, and assets across all global SAP locations. This process supports SAP to comply with relevant duty of care or other/ statutory obligations which may apply, including identification verification prior to or during access to any SAP-owned or leased premises.
Although providing Personal Information during a visitor registration process is voluntary, without your Personal Information, SAP cannot provide you with access to SAP premises.
How long does SAP store my Personal Information?
SAP does only store your Personal Information for as long as it is required:
To fulfill SAP’s purposes as further described in this Privacy Statement unless you object to SAP’s use of your Personal Information for these purposes.
SAP may retain your Personal Information for additional periods if necessary for compliance with legal obligations to process your Personal Information or if the Personal Information is needed by SAP to assert or defend itself against legal claims. SAP will retain your Personal Information until the end of the relevant retention period or until the claims in question have been settled.
Who are the recipients of my Personal Information and where will it be processed?
Your Personal Information will be passed on to the following categories of third parties to process your Personal Information:
Companies within the SAP Group, available at this Link, as this is a global organization with global security obligations
Third-party service providers, including contracted security agencies that are contracted to provide security services at SAP
Law enforcement agencies, insurance companies etc. as appropriate in terms of any corporate criminal or other security investigations
As part of a global group of companies operating internationally, SAP has affiliates (the “SAP Group”) and third-party service providers outside of China or from a region with a legal restriction on international data transfers and will transfer your personal information to countries outside of China. SAP uses the EU standard contractual clauses to contractually require that your personal information receives a level of data protection consistent with China. You can obtain a copy (redacted to remove commercial or irrelevant) of such standard contractual clauses by sending a request to privacy@sap.com.
What are your data protection rights?
Right to access, correct and delete
You can request from SAP at any time, access to information about which Personal Information SAP processes about you and, if necessary, the correction or deletion of such Personal Information. Please note, however, that SAP can or will delete your Personal Information only if there is no statutory obligation or prevailing right of SAP to retain it. If you request from SAP to delete your Personal Information, you may not be able to continue to use any SAP service that requires SAP ’s use of your Personal Information.
Right to explain
You can request SAP to explain the Personal Information processing rules.
Right of portability
If you request SAP to transfer your Personal Information to certain designated Personal Information Handler, SAP will provide the channel of transfer provided that the conditions specified by the applicable laws and regulations are met.
Right to obtain a copy of Personal Information
You can request from SAP a copy of the Personal Information you provided to SAP. In this case, please contact SAP-Physical-Sec-Privacy@sap.com. and specify the information or processing activities to which your request relates, the format in which you would like to receive the Personal Information, and whether it should be sent to you or another recipient. SAP will carefully consider your request and discuss with you how it can best be fulfilled.
Right to stop or restrict
You can request from SAP to stop or restrict your Personal Information from further processing in certain circumstances such as: (i) you state the Personal Information about you is incorrect, subject to the time SAP requires to check the accuracy of the relevant Personal Information; (ii) there is no legal basis for SAP to process your Personal Information and you demand SAP to stop or restrict your Personal Information from further processing; or(iii) SAP no longer requires your Personal Information, but you state you require SAP to retain such information to claim or exercise legal rights or to defend against third party claims.
Right to object to automated decision-making
You can request not to be subject to a decision based solely on automated processing.
Right to revoke consent
Wherever SAP is processing your Personal Information based on your consent, you may at any time withdraw your consent by providing SAP with a respective notice of withdrawal. In case of withdrawal, SAP will not process Personal Information subject to this consent any longer unless legally required to do so. In case SAP is required to retain your Personal Information for legal reasons your Personal Information will be restricted from further processing and only retained for the term required by law. However, any withdrawal has no effect on past processing of Personal Information by SAP up to the point in time of your withdrawal.
Furthermore, if your use of an SAP offering requires your prior consent, SAP will no longer be able to provide the relevant service (or services, if you revoke the consent for SAP to use your profile under the SAP Identity Authentication Service for multiple SAP offerings), offer or event to you after your revocation.
Right to lodge a complaint
If you take the view that SAP is not processing your Personal Information in accordance with the requirements in this Privacy Statement or under applicable data protection laws, you can at any time, to the extent required by applicable law, lodge a complaint with competent data protection authority.
Right to object
You can at any time object to SAP’s use of your Personal Information as set forth in this section by sending an email to SAP-Physical-Sec-Privacy@sap.com. In this case, SAP will carefully review your objection and cease further use of the relevant information, subject to SAP’s compelling legitimate grounds for continued use of the information, which override your interest in objecting, or if SAP requires the information for the establishment, exercise or defense of legal claims.
In addition, SAP can use your Personal Information based on a legal obligation (Article 13(3) PIPL) to support the rightful and valid requests of public authorities for support in an investigation.
How will SAP verify requests to exercise data protection rights?
SAP will take steps to ensure that it verifies your identity to a reasonable degree of certainty before it will process the data protection right you want to exercise. When feasible, SAP will match Personal Information provided by you in submitting a request to exercise your rights with information already maintained by SAP. This could include matching two or more data points you provide when you submit a request with two or more data points that are already maintained by SAP.
SAP will decline to process requests that are manifestly unfounded, excessive, fraudulent, or are not otherwise required by local law. Visitor Registration and Identity information, by its nature can include Personal Information related to many individuals which would need to be removed or redacted before any request can be processed. As this process is extremely burdensome, SAP may consider such requests as excessive by default depending on the circumstances and nature of your request.
What are my rights to lodge a complaint?
If you take the view that SAP is not processing your Personal Information in accordance with the requirements in this Privacy Statement or under applicable data protection laws, you can lodge a complaint at any time with the relevant data protection authority.
Why does SAP need to use my Personal Information?
SAP can use your Personal Information for the following purposes:
to control access to SAP's premises;
to ensure adequate security for and at SAP's premises;
to ensure the safety of SAP employees and visitors to SAP's premises;
to prevent, deter, and if necessary, investigate unauthorized physical access, including unauthorized access to secure premises and protected rooms, IT infrastructure, or operational information;
to prevent sabotage, theft and material damage; and
support the rightful and valid requests of public authorities for support in an investigation.
You can object to SAP's use of your Personal Information at any time as set forth in this section by sending an email to SAP-Physical-Sec-Privacy@sap.com . In this case, SAP will carefully review your objection and cease further use of the relevant information, subject to SAP's compelling legitimate grounds for continued use of the information, which override your interest in objecting, or if SAP requires the information for the establishment, exercise, or defense of legal claims.
