myBASFWorld

Privacy policy

BASF is pleased about your visit to our website and your interest in our company.

The topic of data protection has the highest priority at BASF. Therefore, we would like to inform you in detail about it in the following:

A. Who is responsible for data processing and who is our data protection officer?

For the provision and maintenance of this website, the responsible BASF company for the data processing is BASF SE, Carl-Bosch-Str. 38, 67056 Ludwigshafen/Rhine, Germany.

If you purchase products via this website, the local BASF company entering the contract with you or the business you represent, is responsible for the data processing to the extent the performance of the concluded contract is concerned. Please see the applicable concluded contract for data processing information including any applicable privacy statements. You can identify the responsible BASF company in the terms of sale in your shopping cart.

Hereinafter, BASF SE and companies of BASF Group are referred to as “BASF”.

B. What data do we process, for what purposes, for how long and on what legal basis?

In the following, we inform you about the data processing on our site (a), its purposes and legal basis (b) as well as the respective storage period and, if applicable, specific objection and removal options (c).

1. log files

a. Data processing

If you visit our website for information purposes only, i.e. if you do not register or transmit data in any other way (e.g. via a contact form), the following information is automatically transmitted from your browser to our server:

IP address of your device
Information about your browser
Name of the website from which you visit us
Name of the visited page (URL) or the opened file
Date and time of your visit
Status information such as error messages
Transferred data volume and the access status (file transferred, file not found, etc.)
Operating system and version of your computer's operating system and the name of your access provider

b. Purposes and legal basis

When you visit the BASF web site, we use the IP address and other information automatically transmitted to our server by your browser under B. 1. a. to:

(i) provide you with the requested content

(ii) ensure the security and stability of our website and to trace unauthorized use

(iii) enable a comfortable use of our website

The legal basis for the data processing is our legitimate interest, which follows from the above listed purposes for data processing. Under no circumstances do we use the collected data for the purpose of drawing conclusions about your person.

c. Storage period

The data will be deleted as soon as they are no longer necessary for the purpose for which they were collected. In the case of the collection of data for the provision of the website, this is the case when the respective session is ended. In the case of storage of the data in log files, this is the case after seven days at the latest. Storage beyond this period is possible. In this case, the IP addresses are anonymized by deleting the last eight bits, so that an identification of you is no longer possible.

2. Cookies

a. Data processing and respective legal basis

We use cookies on our website. These are text information that can be stored in the browser on the device of the viewer to a visited website (web server, server). The cookie is either sent from the web server to the browser or generated in the browser by a script (JavaScript). The web server can read this cookie information directly from the server when the user visits this page again or transfer the cookie information to the server via a script of the website. Cookies do not cause any damage to your device, do not contain viruses, trojans or other malware. Information is stored in the cookie that is related to the specific device used. This does not mean, however, that we obtain direct knowledge of your identity.

We generally use the following cookies:

Strictly necessary cookies

These cookies are necessary for the functioning of the website. In general, these cookies are only set in response to actions you take in response to a service request, such as setting your privacy preferences, logging in, or filling out forms. You can set your browser to block these cookies or to notify you about these cookies. However, some areas of the website may not function properly.

The legal basis for the processing of these cookies is our legitimate interest, which follows from the data processing purposes listed under B.1.b.

Performance cookies

These cookies enable us to count visits and traffic sources so that we can measure and improve the performance of our website. They help us answering questions about which pages are most popular, which are least used and how visitors move around the site. All information collected by these cookies is aggregated and therefore anonymous. If you do not allow these cookies, we cannot know when you visited our website.

The legal basis for the processing of these cookies is your consent, which you have given us by making your selection in the cookie banner or in our Privacy Preference Center.

You have the right to revoke your consent at any time, without affecting the lawfulness of the processing carried out on the basis of the consent until revocation. To do so, please change the settings in the Privacy Preference Center.

Functional cookies

These cookies enable the website to provide enhanced functionality and personalization. They may be set by us or by third parties whose services we use on our pages. If you do not allow these cookies, some or all of these services may not function properly.

The legal basis for the processing of these cookies is your consent, which you have given us by making your selection in the cookie banner or in our Privacy Preference Center.

Cookies for marketing purposes

These cookies can be set via our website. They may be used by our marketing partners to profile your interests and show you relevant ads on other websites. If you do not allow these cookies, you will experience less targeted advertising.

The legal basis for the processing of these cookies is your consent, which you have given us by making your selection in the cookie banner or in our Privacy Preference Center.

b. Specific use of cookies, purposes and storage period

Specifically, we use the following cookies, depending on the cookie preferences you set in the Privacy Preference Center. Only the strictly necessary cookies are activated by default. If you do not want this either, you have the option of generally rejecting cookies in your browser. In this case, the functionality of the visited website may be impaired.

You can reset the cookie settings via this button.

Further details about the respective cookie providers can be found in the Privacy Preference Center, under the respective cookie categories.

The personal data of the person concerned will be deleted or made unavailable as soon as the purpose of the storage does no longer apply. Furthermore, data may be stored if this has been provided for by the European or national legislator in EU regulations, laws or other regulations to which the person responsible is subject. Data will also be deleted or made unavailable when a storage period prescribed by the above-mentioned provisions expires, unless there is a need to continue storing the data for the purpose of concluding or fulfilling a contract.

In case of a consent, you have the right to revoke such consent at any time, without affecting the lawfulness of the processing carried out on the basis of the consent until revocation. To do so, please change the settings in the Privacy Preference Center.

3. Contact form and e-mail

a. Data processing

Our web pages contain contact forms as well as links to send us an e-mail directly. If you use one of these contact forms, the data which you provide in such forms will be transmitted to us and processed. The mandatory data that must be filled in for electronic contact via the respective contact form are marked with (*). If you provide us with additional data, this is done voluntarily.

If you send us an e-mail, we will process the associated metadata and the content of the message.

b. Purpose and legal basis

Your data will be processed to enable us to contact you, to process your request and to provide you with our respective services, to prevent misuse of the contact form and to ensure the security of our information technology systems.

The legal basis for the processing of data classified as being mandatory is our legitimate interest in managing your inquiry. The aforementioned purposes also include a legitimate interest in the processing of the data. If the purpose of the contact is the conclusion of a contract, the additional legal basis for the processing is the negotiation and conclusion of the contract. The legal basis for the processing of the data that you have voluntarily provided us with is your consent.

c. Storage period

The personal data of the person concerned will be deleted or made unavailable as soon as the purpose of the storage does no longer apply. Furthermore, data may be stored if this has been provided for by laws or other regulations to which BASF is subject. Data will also be deleted or made unavailable when a storage period prescribed by the above-mentioned provisions expires, unless there is a need to continue storing the data for the purpose of concluding or fulfilling a contract.

4. User Account

If you have been registered via the BASF registration process, we will process the following personal data for the purposes of providing you with access to our website and to administrate your user account:

First Name
Last Name
Email address
Telephone
Cellphone (optional)
Company
Country
City
Address/street and number
Zipcode
Industry
Department
Function

The legal basis for this data processing is our legitimate interest, which consists of the purposes as mentioned above.

5. Orders

If you order goods and products via our webshop, we process the following personal data:

First Name
Last Name
Email address
Company Name
Country
City
Street
Number
Zipcode
Tax ID

We consider the TaxID as personal data if you represent a one-person company.

We process the aforementioned personal data for the purpose of recording and processing the order, including payment and shipping.

We forward your order to the respective BASF company responsible for you as our customer and for your order.

The legal basis for the aforementioned data processing is the conclusion and performance of your order and the corelating contract.

6. Direct marketing

If you have given us your consent to do so, we will process your personal data to provide you with personalized information on BASF products, events, web seminars and services we consider relevant for you and to conduct customer surveys via the communication channels you have selected.

In order to determine your professional needs and interests, we combine and analyse the personal data that we have collected about you in the course of your relationship with BASF as a customer or user of BASF products and services (in particular your contract and master data, the products you have purchased, samples, demos, brochures or whitepapers that you have requested or downloaded, webinars for which you have registered, surveys that you have completed, etc.).

The legal basis for the processing of your personal data for the above-mentioned purposes is your consent.

Due to the global nature of BASF’s marketing teams, BASF will share your personal data with the relevant BASF entities and therefore transmit your personal data to the following BASF companies being the regional Marketing Headquarters:

BASF SE, Carl-Bosch-Str. 38, 67056, Ludwigshafen, Country: Germany
BASF Corporation, 100 Park Avenue, 7932 Florham Park, New Jersey, Country: USA
BASF South East Asia Pte. Ltd., 128 Beach Road. Guoco Midtown #18-01, 189773, Country: Singapore
BASF S.A., Avenida Nacoes Unidas 14171, 10 ao 12 e 14 ao 17, 04794-000, São Paulo, Country: Brazil
BASF Hong Kong Ltd., 45th Floor, Jardine House, No. 1 Connaught Place, Country: Hong Kong
BASF South Africa (Pty.) Ltd., 852 Sixteenth Road, 1685, Midrand, Country: South Africa
BASF FZE, Floor 15, Tower B, JAFZA One, Exit 17, Sheikh Zayed Road, PO Box 61309, Dubai, Country: United Arab Emirates
BTC Europe GmbH, Rheinpromenade 1, 40789, Monheim am Rhein, Country: Germany
BASF Digital Farming GmbH, Im Zollhafen 24, 50678, Cologne, Country: Germany
CA Pesquisa e comércio de sementes Ltda., Rua José Lopes, S/N, Zona Rural, 13.833-612, Santo Antonio de Posse, Country: Brazil
BASF France S.A.S., 49, Avenue Georges Pompidou, 92593, Levallois-Perret Cedex, Country: France
BASF plc, Railway Road 2, SK1 3GG, Stockport, Country: United Kingdom
BASF Italia S.p.A., Via Marconato 8, 20811, Cesano Maderno, Country: Italy
BASF Espanola S.L., Calle Can Ràbia, n. 3-5, 08017, Barcelona, Country: Spain
BASF S.R.L., Soseaua Pipera Nr.43, Cladirea A, Etaj 1, Sector 2, 14254, Bukarest, Country: Romania
BASF A/S, Kalvebod Brygge 45, 1560, Kopenhagen, Country: Denmark
BASF Oy, Tammasaarenkatu 3, 00180, Helsinki, Country: Finland
BASF AB, Sven Hultins Plats 5, 41258, Göteborg, Country: Sweden
BASF AS, Lilleakerveien 2B, 0283, Oslo, Country: Norway
BASF Australia Ltd., Level 12, 28 Freshwater Place, 3006, Southbank, Country: Australia
BASF India Limited, The Capital, 'A' Wing, 1204-C, 400051, Mumbai, Country: India
Chemetall US Inc., 675 Central Ave, 07974, New Providence, New Jersey, Country: USA
Chemetall Mexicana S.A. de C.V., Cerro del Tepeyac 1420, Fraccionamiento Real del Marqués, Parque Industrla O´donnel, 76250, Santiago de Querétaro, Country: Mexico
Chemetall Canada Limited, 5025 Creekbank Road, Building A, Floor 2, L4W 0B6, Mississauga, Ontario, Country: Canada
BASF Belgium Coordination Center CommV, Drève Richelle 161 E boîte 43, 1410, Waterloo, Country: Belgium
BASF Polyurethanes GmbH, Elastogranstraße 60, 49448, Lemförde, Country: Germany
BASF Canada Inc., 5025 Creekbank Road, Building A, Floor 2, ON L4W 0B6, Mississauga, Ontario, Country: Canada
BASF Mexicana Inc., Avenida Insurgentes Sur No. 975, Colonia Ciudad de los Deportes, 03710, Alcaldía Benito Juárez, Ciudad de México, Country: Mexico
Nunhems Italy S.r.l., S.Agata Bolognese BO Italy, 40019, S.Agata Bolognese, Country: Italy
Nunhems Spain Srl, Avda. de El Treinta nº 178, 04710, Almeria, Country: Spain
Nunhems India Pvt Ltd, Kandlakoya Village, Medchal to Miyapur by pass road, S-196, 501403, Kandlakoya, Country: India
BASF Personal Care and Nutrition GmbH, Rheinpromenade 1, 40789, Monheim am Rhein, Country: Germany
BASF East Asia Regional Headquarters Ltd., Two Taikoo Place, 979 King's Road 36/F, Country: Hong Kong
BASF Construction Additives GmbH, Dr.-Albert-Frank-Strasse 32, 83308, Trostberg, Country: Germany

In addition, BASF will share your personal data between those BASF companies which are responsible for you as a (prospective) business partner. Both of the aforementioned transfers serve the purpose of administration of customer data across the BASF Group and preparation of global marketing campaigns and sales-related activities.

The legal basis for this data sharing is our legitimate interest in maintaining your personal data in our company group.

We will share your personal data with other affiliated companies of the BASF Group if they provide IT services for us or if this is necessary for operational reasons, such as follow ups from sales managers or developing personalized marketing materials and content. Furthermore, we will pass on your personal data to the technical IT service providers we use from whom we obtain services. Our IT service providers are carefully selected and regularly checked by us. They process personal data only on our behalf and strictly in accordance with our instructions on the basis of corresponding contracts for order processing.

We store your personal data collected within the scope of your consent for the above-mentioned purposes until your consent is revoked.

You can revoke your consent at any time with effect for the future by notifying us of your revocation under our consent preference center. Each marketing mail we will send to you based on this consent, will contain a separate link to revoke your consent.

You are at liberty to grant or withhold consent. This has no effect on your visit of this website and platform.

If you revoke your consent, we will no longer use your personal data for marketing purposes unless we have another legal basis for this. The revocation of your consent does not affect the legality of the data processing that has taken place up to that point.

7. Processing last login information

We process information about your last login by running a JavaScript which collects information from your device about when you logged into myBASFWorld the last time. We process your last login for the following purposes:

to trigger reminder messages due to inactivity, as inactive users will be deactivated and deleted.
to check if onboarded user(s) require support, such as special training or answer questions you as a customer may have.
to monitor whether your company as a customer complies with defined business or contractual rules which require you to use myBASFWorld for order placement / self-service as part of doing business with BASF.

We allocate the last login information with your user account to achieve these purposes. The legal basis for the aforementioned data processing is para. 25 sec. 2 no. 2 German Act on Data Protection and the Protection of Privacy in Telecommunications and Digital Services (Gesetz über den Datenschutz und den Schutz der Privatsphäre in der Telekommunikation und bei digitalen Diensten – TDDDG).

If you provide us with your consent, we will additionally process information about your last login for the purpose providing you with special offers due to your inactivity on myBASFWorld. In such a case, we will provide you with these special offers based on your marketing consent, if you have declared such in the favor of us. You can withdraw your consent about the processing of your last login at any time by clicking on the corresponding link contained in every marketing message or visit the My Profile Area in myBASFWorld. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. The legal basis for this data processing is your consent in accordance with para 25 sec. 1 TDDDG.

8. Anonymisation of log files for business intelligence purposes

We also process the above-mentioned log files to create aggregated analyses of the use of our services, for example to find out how often our web stores are accessed and what sales they have generated. The aim is to gain a better understanding of the use and performance of our offers and websites and thereby adapt our service portfolio to the needs of our customers. The analyses are carried out exclusively at an aggregated level, without it being possible to draw conclusions about individual users. To ensure this, the log files are anonymised before being analysed. All personal characteristics (e.g. IP addresses, user IDs, time stamps that could enable identification) are removed so that individual persons cannot be identified. After anonymisation, it is no longer possible to draw conclusions about your person. The anonymisation of the log files is based on our legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR in the analysis and improvement of our services and in the creation of usage statistics. Our interest lies in being able to understand and optimise the use of our services without knowing or needing to know your identity.

9. Social media hyperlink

We have included hyperlinks to the following social media services on our website: LinkedIn, Facebook, Twitter, Vimeo, YouTube, Slideshare, flickr and Instagram.

These hyperlinks are designed in the form of the corresponding logos and are stored on our own server. This means that when our website is loaded for the first time, no data about you as a user are transferred to the respective provider. You will be directed to the respective website only if you click on the logos. Further data about you may be processed on this website.

We have no influence on this data processing on the respective linked websites.

C. Are you obliged to provide us with this data?

When you visit our website, the information specified in section B. 1. a. as well as the information from the cookies classified as strictly necessary is processed automatically. The transfer of this information is voluntary. Without the provision of this personal data, we cannot display the requested page. If you

allow us to use cookies that are not classified as strictly necessary,
want to contact us and send us an e-mail or use our contact form or
want to see embedded YouTube videos the transfer of the information is voluntary.

If you contact us, we cannot answer your inquiry in the chosen way without the provision of the personal data required in the individual case. As far as cookies are concerned, the lack of consent can lead to a restriction of the functionality of the website or parts of it. Embedded videos cannot be played without your consent.

D. To whom do we pass on your personal data?

Within our company, only persons and departments are granted access to your personal data as far as they need it to fulfil the abovementioned purposes. We also involve service providers, such as hosting services and commercial infrastructure services, e.g. CRM providers. These service providers will only act on our instructions and are contractually obliged to comply with the applicable data protection requirements.

Otherwise, we will only pass on your data to third parties if:

you have given your express consent,
the disclosure is necessary for the assertion, exercise or defense of legal claims and there is no reason to assume that you have an overriding interest worthy of protection in not disclosing your data,
there is a legal obligation for us to pass on the data, or
this is legally permissible and necessary for the fulfilment of contractual relationships with you.

A transfer of your personal data to service providers in a third country will only take place if special requirements, if given, are fulfilled.

E. How do we secure your personal data?

BASF uses technical and organizational security measures to protect your personal data from accidental or intentional manipulation, loss, destruction or access by unauthorized persons. Our security measures are continuously revised in line with technological developments.

F. What rights do you have?

You have certain rights under the General Data Protection Regulation including the right to request a copy of the personal information we hold about you, if you request it from us in writing:

Right to access: the right to obtain access to your information (if we’re processing it), and certain other information (like that provided in this Privacy Policy);

Right to correct: if your personal information is inaccurate or incomplete you have the right to have your personal information rectified;

Right to erasure: this is also known as ‘the right to be forgotten’ and, in simple terms, enables you to request the deletion or removal of your information where there’s no compelling reason for us to keep using it. This is not a general right to erasure; there are exceptions. For example, we have the right to continue using your personal data if such use is necessary for compliance with our legal obligations or for the establishment, exercise or defense of legal claims;

Right to restriction of processing: the right to suspend the usage of your personal information or limit the way in which we can process it. Please note that the right to block or limit (“restrict”) processing is limited in certain situations. When we are processing your personal information that we collected from you with your consent you can only request restriction on the basis of: (a) inaccuracy of data; (b) where our processing is unlawful and you do not want your personal information erased; (c) you need it for a legal claim; or (d) if we no longer need to use the data for the purposes for which we hold it. When processing is restricted, we may still store your information, but will not use it further. We keep a list of individuals who have requested restriction of the use of their personal information to ensure the restriction is respected in the future;

Right to data portability: the right to request that we move, copy or transfer (where technically feasible) your personal information in a structured, commonly used and machine-readable format, for your own purposes across different services;

Right to object: the right to object to our processing of your personal information including where we process it for our legitimate interests, direct marketing;

Right to withdraw consent: if you have given your consent to anything we do with your personal information, you have the right to withdraw your consent at any time (although if you do so, it does not mean that anything we have done with your personal information with your consent up to that point is unlawful).

Exercising these rights is free of charge. However, you are required to prove your identity by means of a two-factor-authentication. We will engage reasonable efforts consistent with our legal duty to supply, correct or delete personal information about you. To exercise your rights, please contact us, for example by e-mail or by post. You will find the contact details in section A.
E-Mail: poststelle@datenschutz.rlp.de

G. Additional country and regional provisions

I. Where BASF is subject to the European General Data Protection Regulation (GDPR)

You can contact the Data Protection Officer of BASF SE and of BASF companies within the EEA via data-protection.eu@basf.com.

A transfer of your personal data to service providers in a third country will only take place if the special requirements of Art. 44 ff. GDPR are fulfilled. If and to the extent service providers are located in a third country, it may be that either the servers of the respective service provider are located in the third country or that the servers are located in the EU, but accessed in cases of support from a third country. Some third countries do not have a level of data protection adequate to that of the EU, e.g. the USA or China, as authorities might have simplified access to personal data in a simplified manner or that there are limited rights to such actions. If and to the extent you give consent, you expressly give consent to the transfer of personal data into the respective third country.

You have the right to lodge a complaint with our data protection officer (for contact details see Section A) or with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. In either case, you can contact our Lead Data Protection Authority:

State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz)
Hintere Bleiche 34
55116, Mainz
https://www.datenschutz.rlp.de/service/kontakt

II. Where BASF is subject to the Protection of Personal Information Act (POPIA) in South Africa

The POPIA applies to the processing of personal information where BASF is domiciled in the Republic; or not domiciled in the Republic, but makes use of automated or non-automated means in the Republic, unless those means are used only to forward personal information, Section 3 (1) POPIA.

A transfer of your personal data to service providers in the Republic of South Africa will only take place if the special requirements of the POPIA are fulfilled.

According to Section 72 (1) POPIA BASF will not transfer personal information about a data subject to a third party who is in a foreign country unless the third party who is the recipient of the information is subject to a law, binding corporate rules or binding agreement which provide an adequate level of protection that effectively upholds principles for reasonable processing of the information that are substantially similar to the conditions for the lawful processing of personal information relating to a data subject who is a natural person and, where applicable, a juristic person; and includes provisions, that are substantially similar to this section, relating to the further transfer of personal information from the recipient to third parties who are in a foreign country.

Also, BASF will not transfer personal information about a data subject to a third party who is in a foreign country unless the data subject consents to the transfer; the transfer is necessary for the performance of a contract between the data subject and the responsible party, or for the implementation of pre-contractual measures taken in response to the data subject's request; the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the data subject between the responsible party and a third party; or the transfer is for the benefit of the data subject, and it is not reasonably practicable to obtain the consent of the data subject to that transfer; and if it were reasonably practicable to obtain such consent, the data subject would be likely to give it.

III. Where BASF is subject to the Personal Information Protection Act in South Korea

This Section applies to the extent that BASF is subject to the Personal Information Protection Act in South Korea. This section supplements and should be read in conjunction with the other sections of this Privacy Policy.

Retention Period of Personal Data

Regardless of the retention period explained in Section B, certain personal data may still be retained if required by applicable laws.

Destruction of Personal Data

We will destroy personal data as follows:

Destruction procedure: We will select the personal data subject to destruction and destroy it after obtaining approval from the Data Protection Officer.
Destruction method: We will destroy personal data recorded and stored in electronic files in an irrevocable manner, and shred or incinerate personal information recorded and stored in paper documents.

Additional Use and Provision

We may additionally use or provide your personal data without your consent after considering the below issues:

Whether the additional use or provision of personal data is related to the original purpose of collection;
Whether the additional use or provision of personal data is foreseeable in light of the circumstances in which personal data is collected or practices of processing personal information;
Whether the additional use or provision of personal data unduly infringes on the interests of users; and
Whether necessary measures have been taken to ensure security, such as pseudonymization or encryption

We will carefully determine whether to additionally use or provide your personal data by comprehensively taking into account various circumstances, including the applicable laws and regulations such as the Personal Information Protection Act, the purpose of use and provision of personal data, method of use and provision of personal data, items of personal data to be used and provided, details of the consent you have given or matters notified to or disclosed to you, impact of use and provision of personal data on you, and measures taken to protect your personal data

Overseas Collection of Personal Data

We collect and process personal data from overseas for purposes set forth in Section B.

Countries where personal information is collected and processed

Overseas Transfer of Personal Data

We provide your personal data to third parties located overseas as follows:

Recipient (Contact Information)	Country to Which Personal Data is Transferred	Time and Method of Transfer	Items of Personal Data Transferred	Recipient’s Purpose of Using Personal Data	Recipient’s Period of Retention and Use	Grounds for Overseas Transfer
BASF Group (See [link] for the full list of entities and their contact information) data-protection.eu@basf.com	See [link] for the full list of entities and countries they are located in	[Ongoing; Transfer via dedicated network ]	Personal data as described in Section B	[Administration of customer data across the BASF Group, global marketing campaign, sales-related activities]	As long as it is necessary to fulfill the purpose of the transfer.	[*]

Recipient

(Contact Information)

Country to Which Personal Data is Transferred

Time and Method of Transfer

Items of Personal Data Transferred

Recipient’s Purpose of Using Personal Data

Recipient’s Period of Retention and Use

Grounds for Overseas Transfer

BASF Group (See [link] for the full list of entities and their contact information)

data-protection.eu@basf.com

See [link] for the full list of entities and countries they are located in

[Ongoing; Transfer via dedicated network ]

Personal data as described in Section B

[Administration of customer data across the BASF Group, global marketing campaign, sales-related activities]

As long as it is necessary to fulfill the purpose of the transfer.

[*]

We delegate the processing of your personal data to delegatees located overseas as follows:

Recipient (Contact Information)	Country to Which Personal Data is Transferred	Time and Method of Transfer	Items of Personal Data Transferred	Recipient’s Purpose of Using Personal Data	Recipient’s Period of Retention and Use	Grounds for Overseas Transfer
[Name and contact information of IT Service Provider]	[Country]	[Ongoing; Transfer via dedicated network ]	Personal data as described in Section B	[Storage in and management of database]	As long as it is necessary to fulfill the purpose of the transfer	[*]
[*]	[*]	[*]	[*]	[*]	[*]	[*]

Recipient

(Contact Information)

Country to Which Personal Data is Transferred

Time and Method of Transfer

Items of Personal Data Transferred

Recipient’s Purpose of Using Personal Data

Recipient’s Period of Retention and Use

Grounds for Overseas Transfer

[Name and contact information of IT Service Provider]

[Country]

[Ongoing; Transfer via dedicated network ]

Personal data as described in Section B

[Storage in and management of database]

As long as it is necessary to fulfill the purpose of the transfer

[*]

You may have the right to request that your personal information not be transferred overseas as described above. If so, you may request this by contacting us at [*]. However, in doing so, we may not be able to provide you with all or any of the services we make available through our website.

Rights of Data Subjects

In addition to your rights set forth in Section F, you have a right to reject or request an explanation on automated decisions we take.

Contact

In order to protect your personal data and handle complaints related to it, we have designated the following Chief Privacy Officer and department in charge of personal information protection:

Chief Privacy Officer: Dong-Jin Kim, Head of Head of Labor and Business Support Division (Tel: 02-3707-7514, Fax: 02-3707-7887; E-mail: Dongjin.kim@basf.com)
Department in Charge of Personal Information Protection: Labor Relations Support Division; Person in Charge: Seung-Sik Lee (Tel: 02-3707-7887, E-mail: Seungsik.lee@basf.com)

Remedy for Infringement on Rights

You may file an application for resolution of disputes and consult with the Personal Information Dispute Mediation Committee, the Personal Information Infringement Reporting Center of the Korea Internet Security Agency and other agencies to seek remedies for personal data infringement. For reports or consultation on any other personal data infringement, please contact the following agencies.

Personal Information Dispute Mediation Committee: 1833-6972 (no regional code required; www.kopico.go.kr)
Personal Information Infringement Reporting Center: 118 (no regional code required; privacy.kisa.or.kr)
Supreme Prosecutors’ Office: 1301 (no regional code required; www.spo.go.kr)

National Police Agency: 182 (no regional code required; ecrm.cyber.go.kr)

IV. Where BASF is subject to Personal Data Protection Law (“PDPL”) in the United Arab Emirates, the following applies:

The UAE Federal Decree Law No. 45 of 2021 defines “personal data” as any data related to a specific natural person or related to a natural person that can be identified directly or indirectly by linking the data, through the use of identification elements.

Pursuant to Article 22 of the UAE Federal Decree Law No. 45 of 2021 concerning the protection of personal data, BASF will only transfer your personal data to a third country if the country receiving your data has been deemed by the UAE Data Office to provide an adequate level of data protection or if such measures are not in place in the third country, if there are appropriate safeguards, like binding corporate rules or standard contractual clauses, approved to ensure your data is protected similarly to how it would be within the UAE.

Your personal data might also be transferred to a third country if it is necessary for the performance of a contract you are part of, for public interest reasons and legal claims when you cannot provide consent.

Your rights include being informed about any cross-border transfers, accessing your data, and knowing the safeguards in place.

If you believe your data has been transferred unlawfully or your data protection rights have been violated, you can file a complaint with the UAE Data Office via the Telecommunications And Digital Government Regulatory Authority (TDRA):

TDRA, Al Wuheida St – Deira, P.O.Box : 116688, Dubai, United Arab Emirates
Email: Info@tdra.gov.ae; Phone: +971 800 12; International Calls: +971 4 7774444

V. Where BASF is subject to Thailand Personal Data Protection Act

The contact details of our data protection representative in Thailand, along with the right to lodge a complaint with our data protection officer or a supervisory authority, are specified in Article 10 of BASF Thailand Privacy Policy.

VI. Where BASF is subject to Personal Information Protection Law (“PIPL”) of People’s Republic of China, the following applies

As PIPL does not specify and recognize “legitimate interest” as the legal basis for personal data processing, as a general principle the consent should be obtained from the data subjects for the processing of their personal data as envisaged by this Privacy Policy when the data subjects are located within the territory of China.

And also separate consent is required to be obtained from those data subjects located within the territory of China for transferring their personal data to overseas data recipient(s), by informing the name and contact information of the overseas recipient(s), the purpose and method of data processing, and the type of personal data involved, as well as the way for the data subject to exercise his/her rights provided for by the PIPL against the overseas recipient(s).

VII. Where BASF is subject to Decree 13/2023/NĐ-CP regarding Protection of Personal Data in Vietnam

BASF will not transfer your personal information to a third party who is located outside the territory of the Socialist Republic of Vietnam or using a location outside the territory of the Socialist Republic of Vietnam to process your personal data unless you expressly give consent to the transfer. In particular, our Sites are hosted on servers outside thẻ territory of Vietnam, the transfer of Personal Data is necessary to provide you with the requested information and/or to perform any requested transaction. When you submit personal information to us you are transferring your data across borders.

You have the right to lodge a complaint with our data protection officer (for contact details see Section A) or with a supervisory authority in Vietnam as below:

Department of Cyber Security and High-tech Crime Prevention (A05)
47 Pham Van Dong, Cau Giay District,
Ha Noi, Vietnam

VIII. Where BASF is subject to India’s Digital Personal Data Protection Act

Change of purpose

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.

We will seek your fresh consent, if we need to use your personal information for an unrelated purpose.

If you fail to provide personal information:

If you fail to provide certain personal information as and when requested, we may not be able to perform the contract we have entered into with you (such as providing a benefit), or we may be prevented from complying with our legal obligations (such as to ensure the health and safety.)

Data sharing

We may have to share your personal information with third parties, including third-party service providers and other entities in the BASF Group in India and abroad. In such an event, we will seek your prior consent in writing, unless you have agreed to such disclosure in a contract executed with us. We require appointed third parties to respect the security of your personal information to treat it in accordance with the law. If we do, you can expect the same degree of protection in respect of your personal information that is adhered to by us.

"Third parties" includes third-party service providers (including contractors and designated agents) and other entities within the BASF Group. We will transfer your personal information to third parties in India or abroad where required by law, or where it is necessary for the performance of a lawful contract between us, or when we have your explicit consent. We may share your personal information with other third parties, for example in the context of the possible sale or restructuring of the business. We may also need to share your personal information, without your prior consent, with government agencies mandated under the law to obtain personal information, for the purpose of verification of identity or for prevention, detection, investigation, including cyber incidents, prosecution and punishment of offences or to otherwise comply with the law or a legal obligation.

All our third-party service providers and other entities in the BASF Group are required to take appropriate security measures to protect your personal information in line with our policies. We do not allow our third-party service providers to use your personal information for their own purposes. We only permit them to process your personal information for specified purposes and in accordance with our instructions. The third-party service providers cannot disclose your personal information further.

Data security

We have put in place security practices and standards and have a comprehensive documented information security program and policies that contain managerial, technical, operational and physical security control measures to protect the security of your information.

Third parties will only process your personal information on our instructions and where they have agreed to treat the information confidentially, legally and securely. We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorized way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal information on our instructions and they are subject to a duty of confidentiality. We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

Grievance Officer

We have designated a Grievance Officer to address any discrepancies and grievances of data subjects with respect to processing of information in a time bound manner.

The Grievance Officer will redress the grievances expeditiously but within one month from date of receipt of the grievance.

The details of the Grievance Officer are as follows:

Name: Mr. Rajesh Mehta
Tel No: +91-22-6724 3844
E-mail ID: rajesh.mehta@basf.com
Postal Address: Unit no.10A, 10B & 10C (part), 10th floor, “Godrej One”, Pirojsha Nagar, Vikhroli East, Mumbai – 400079

IX. Where BASF is subject to Canadian privacy requirements

BASF uses the resources of its affiliates and third-party service providers to process and store personal information for the purposes described in this Privacy Policy. This may involve your personal information being stored or processed within Canada (but outside the province/territory in which you reside) or any other country where the service providers, BASF or BASF affiliates maintain facilities. When your personal information is transferred outside of the jurisdiction in which you reside, the personal information may be subject to the laws of the applicable outside jurisdictions, including local requirements to disclose information courts, law enforcement and national security authorities.

X. Where BASF is subject to the requirements of the Malaysian Personal Data Protection Act (“PDPA”)

TRANSFER OF YOUR PERSONAL DATA OUTSIDE OF MALAYSIA

Our information technology storage facilities and servers may be located in other jurisdictions outside of Malaysia. This may include, but not limited to, instances where your personal data may be stored on servers located outside Malaysia. In addition, your personal data may be disclosed or transferred to entities located outside Malaysia or where you access the Site from countries outside Malaysia. Please note that these foreign entities may be established in countries that might not offer a level of data protection that is equivalent to that offered in Malaysia under the laws of Malaysia. You hereby expressly consent to us transferring your personal data outside of Malaysia for such purposes. We shall endeavour to ensure that reasonable steps are taken to procure that all such third parties outside of Malaysia shall not use your personal data other than for that part of the Purposes and to adequately protect the confidentiality and privacy of your personal data.

PERSONAL DATA FROM MINORS AND OTHER INDIVIDUALS

To the extent that you have provided (or will provide) personal data about your family members, spouse, other dependents and/or other individuals, you confirm that you have explained to them that their personal data will be provided to, and processed by, us and you represent and warrant that you have obtained their consent to the processing (including disclosure and transfer) of their personal data in accordance with this Privacy Policy.

XI. Where BASF is subject to the privacy requirements of Australia and New Zealand, the following data protection rights apply:

Right to access and correct

You can request from BASF at any time access to information about which personal data BASF processes about you and, if necessary, the correction of such personal data. Please note, however, that BASF can or will delete your personal data only if there is no statutory obligation or prevailing right of BASF to retain it.

Right to revoke consent

Wherever BASF is processing your personal data based on your consent, you may at any time withdraw your consent by unsubscribing or giving us respective notice of withdrawal. In case of withdrawal, BASF will not process personal data subject to this consent any longer unless legally required to do so. In case BASF is required to retain your personal data for legal reasons your personal data will be restricted from further processing and only retained for the term required by law. However, any withdrawal has no effect on past processing of personal data by BASF up to the point in time of your withdrawal.

XII. Where BASF is subject to privacy requirements in the Philippines, the following also applies:

Within the Philippines you have the right to:

Claim compensation as finally awarded by the National Privacy Commission or the courts if you suffered damages due to inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorized use of personal data, considering any violation of your rights and freedoms.

File a complaint with the National Privacy Commission if you are the subject of a privacy violation or personal data breach or are otherwise personally affected by a violation of the Data Privacy Act.

Your Transmissibility Rights. Your lawful heirs and assigns may invoke your rights at any time after your death or when you are incapacitated or incapable of exercising your rights.

XIII. Where BASF is subject to the requirements of Singapore’s Personal Data Protection Act (“PDPA”), the following applies:

Written inquiries, requests for access to or for correction or rectification of your Personal Data may be addressed to:

Annie Tan
Head of Human Resources
BASF South East Asia Pte Ltd
128 Beach Road, Guoco Midtown # 18-01,
Singapore 189773
Phone (65) 6432 3483
Mobile (65) 9386 8914
Email annie.tan@basf.com

XIV. Where BASF is subject to privacy requirements in Japan

Please refer to the following contact for your requests for and questions relating to notification of purposes of use, disclosure (including disclosure of records of transfer to third parties), correction / addition / deletion, discontinuance of use, erasure or discontinuance of transfer to third parties of personal information held by BASF Japan or orther requests and questions relating to such personal information

Legal and Compliance Division, BASF Japan Ltd
3F, OVOL Nihonbashi Building
3-4-4 Nihonbashi Muromachi, Chuo-ku
Tokyo 103-0022 Japan

XIV. Where BASF is subject to the requirements Brazilian General Data Protection Law (LGPD), the following applies:

Consistent with Article 3 of the LGPD, the law shall apply to personal data processing activities conducted by BASF under the following circumstances:

a. When the processing activity occurs within Brazilian territory.

b. When the processing activity is aimed at offering or providing goods or services or involves the processing of data pertaining to data subjects located within Brazilian territory.

c. When the personal data have been collected within Brazilian territory.

Pursuant to Chapter VI of the LGPD, the international transfer of personal data shall be permitted under the following conditions:

a. To countries or international organizations that provide an adequate level of personal data protection as stipulated in LGPD.

b. When the data controller provides and demonstrates guarantees of compliance with the principles, the rights of the data subject, and the data protection regime established in LGPD, in the form of: a) specific contractual clauses for a particular transfer; b) standard contractual clauses; c) global corporate norms; d) seals, certificates, and codes of conduct regularly issued.

c. When the transfer is essential for international legal cooperation between public intelligence, investigation, and prosecution bodies, according to international law instruments.

d. When the transfer is necessary for the protection of the life or physical safety of the data subject or a third party.

e. When the national authority authorizes the transfer.

f. When the transfer results from a commitment made in an international cooperation agreement.

g. When the transfer is necessary for the execution of public policy or a legal assignment of public service, being made public.

h. When the data subject has given their specific and prominent consent for the transfer, with prior information about the international nature of the operation, clearly distinguishing it from other purposes.

In accordance with Chapter III of LGPD, you possess the right to confirm the data processing activity; to access your data; to rectify any inaccurate or incomplete personal data; to request the anonymization in case of excessive or unnecessary processing activity; to request data portability to another service provider; to request the deletion of the personal data which is processed under consent and to withdraw the consent.

You may contact the Data Protection Officer of BASF SA at data-protection.br@basf.com.

Your personal data could be transferred to other BASF entities only when all the BGPL requirements be fulfilled.

XV. Where BASF is subject to privacy requirements in Argentina and Uruguay, the following applies:

In accordance with the Argentinean Data Protection Law (“ADPL”) and the Uruguayan Data Protection Law (“UDPL”), complementing the rights established in Section F of this Policy, Data Users have the following rights:

Access and information: the right to obtain access to the personal data we process (if we process it) and to other specific information (such as that provided in this Privacy Policy). This right will be exercised in accordance with the terms indicated in the ADPL and UDPL;

Rectification or update or inclusion: If your personal data is outdated, incorrect, or incomplete, you have the right to have your personal information rectified. This right will be exercised in accordance with the terms indicated in the ADPL and UDPL;

Consistent with Section 27 of the ADPL and Section 14 of the UDPL, THE HOLDER OF PERSONAL DATA HAS THE RIGHT TO EXERCISE THE RIGHT OF ACCESS FREE OF CHARGE WITHIN INTERVALS OF NO LESS THAN SIX MONTHS, UNLESS A LEGITIMATE INTEREST IS PROVEN FOR THIS PURPOSE. THE ENFORCEMENT AUTHORITY OF YOUR JURISDICTION HAS THE POWER TO ADDRESS COMPLAINTS AND CLAIMS FILED IN RELATION TO NON-COMPLIANCE WITH THE RULES ON PERSONAL DATA PROTECTION.