Global Access Center Privacy Notice
Global Access Center (the "GAC") shall comply with this privacy notice (this "Notice") when processing your personal data for purposes of providing GAC services.
Personal Data We Collect About You and How We Collect It
Toyota Motor Corporation (hereinafter "we," "our," or "us") collects employee data provided in connection with the GAC application form and with the Toyota Authentication apps and similar applications, including name, email address, company name, department, job title, country/location of residence, and supervisor contact information.
Data Controller and Data Protection Contact Point
We are responsible for the processing of your personal data as a data controller. Further, we have set up a data protection contact point as below that handles any questions or requests concerning this Notice or the protection of your personal data. For any questions, requests, or complaints concerning this Notice, the protection of your personal data, or the exercise of your rights, as described in this Notice, please contact the data protection contact point below.
Toyota Motor Corporation
1 Toyota-cho, Toyota City
Aichi 471-8571, Japan
Name of representative: Koji Sato
Data Protection Contact Point:
Contact: GAC Support
E-mail: support.gac@ml.toyotasystems.com
Purposes and Legal Basis for the Processing of Your Personal Data
We only process your personal data for the following specific, explicit, and legitimate purposes. Further, the legal basis for the processing of personal data that may be required under applicable data protection laws are as set forth as follows.
| Purpose of Processing | Legal Basis for Processing |
|---|---|
|
For synchronization and registration to the system. For authentication to the application. To respond to your inquiries. |
Processing is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract. |
Disclosure of Personal Data to Recipients
We will share your personal data with the following categories of recipients:
- GAC service/system operating companies – this includes our group companies such as Toyota Systems Corporation and Toyota Motor North America, and our system vendors such as Microsoft Corporation. We will share your personal data to the extent necessary to fulfil the purposes referred to in Section 3.
- Application owner companies – when the company that hires you requests and authorizes data transfer to an application owner company for the use of a specific application, we will share your personal data to the extent necessary to fulfil the purposes referred to in Section 3.
Storage Period for Your Personal Data
We retain your personal data for the duration that the company that employs you has a GAC participating contract with us. However, if retaining personal data for a longer period is necessary under applicable laws or regulations or for establishing, exercising, or defending legal rights, we will retain such personal data for the period necessary to take necessary actions. If, for technical reasons, it is not possible to completely delete personal data from our systems, we will take appropriate measures to prevent further use of your personal data.
Your Rights
You have certain legal rights in relation to the processing of your personal data. These rights may vary depending on which data protection laws apply to the processing of your personal data, but typically include the following:
- the right to obtain information regarding the processing of your personal data and to access your personal data;
- the right to request that we rectify your personal data if it is inaccurate or incomplete;
- the right to request that we erase your personal data in certain circumstances;
- the right to request that we restrict the processing of your personal data in certain circumstances;
- the right to receive your personal data in a structured, commonly used, and machine-readable format and/or to request that we directly transmit such personal data to a recipient where this is technically feasible;
- where the processing is based on consent pursuant to applicable data protection laws, the right to withdraw your consent to the processing of your personal data at any time (the withdrawal of your consent does not affect the lawfulness of processing performed based on the consent before your withdrawal); and
- the right to object to the processing of your personal data, if your personal data is processed based on legitimate interests.
You may exercise any of your rights by contacting us, using the contact details set forth in Section 2 above. You also may lodge a complaint with a competent data protection supervisory authority if you believe that any of your rights have been infringed by us.
Security Control Measures
We take necessary and appropriate measures to maintain the security of personal data, including preventing any leakage or loss of, or damage to, your personal data to be processed. Specifically, in addition to establishing rules for the processing of your personal data, we conduct periodic self-inspections of the status of personal data processing, regular training of employees on the processing of personal data, prevention of theft or loss of equipment used to process your personal data, and access control. We also exercise appropriate supervision over our service providers and employees who process your personal data, and if we process your personal data outside Japan, we comply with the country's legislation to protect your personal data and implement appropriate security control measures.
Personal Data Transfer Outside Your Country of Residence
When providing personal data to a third party located outside the country in which you reside, we will comply with applicable data protection laws, such as by ensuring either of the following or by obtaining your consent:
- the country or region to which the personal data will be transferred has been designated as a country or region that provides an adequate level of protection for rights and freedoms that you have with respect to personal data under applicable data protection laws; or
- the third party has entered into a personal data transfer agreement with us as required by applicable data protection laws.
By contacting us using the contact details set forth in Section 2 above, you may confirm additional details of safeguards implemented by us in relation to data protection in the event of personal data transfers.