Informacja o ochronie danych osobowych

• Qualifications such as qualifications and certifications including current and previous positions, education and training courses, resume/CV, records of education and work achievements, in some cases: contact details of referees and results of capability assessments and interview assessment/feedback.
• Job information and work metrics such as position, title, employment contract, payroll ID, line manager, job band, performance history, employment status, leave of absence information, working time logging, training records, performance targets and development goals. In some cases, we may also record results of capability assessments, safety reports and incidents, professional feedback.
• Compensation, allowances, benefits and expense related information such as salary data, payroll data, pension plan number and contributions, non-salary benefits, bonus, compensation, share options, dependents, beneficiaries or health benefit nomination, bank statements, expense claims and receipts, bank account details, credit card data, phone expenses and insurance data.
• Electronic identification data and information (where employee has access or is affected by such systems or applications) such as access logs, IT and internet usage, device identifiers (mobile device ID, PC ID etc.), registration and login credentials, IP address, tracking and analytics data, recordings (e.g. voice mail/call recordings), posts on corporate platforms (e.g. Yammer), password recovery data, information obtained via IT security tools.
• Financial and other details such as account information, credit checks, payment details and transactions, investigation information and disciplinary history.
• Other personal data (which may include special categories of information as mentioned below) namely where you or others (such as your colleagues) may register these data on or in our systems, programs and application such as business documents containing personal information (e.g. queries, questions, complaints, orders and related records; emails; reports; contracts; presentations, minutes; work products), photos, images and/or videos.

The below mentioned types of personal data are only collected and processed, if at all, in accordance with applicable local laws in your country of residence.

• Special categories of personal data such as:
  • membership of religious congregations (e.g. if required for tax purposes);
  • health and medical information, including disability status, special working conditions (such as use of a standing desk) and medical devices needed on the premises, work related injury and illness information, data for travel emergency support (blood type, medical history, allergies);
  • race or ethnicity (e.g. where this is used for diversity purposes);
  • in some cases: trade union membership, political opinions and sex life or sexual orientation (e.g. where this is used for investigations of non-equal treatment).
• Data about criminal convictions and offences such as criminal background information and sanction list information to the extent required for the purposes of criminal background screening and Know Your Customer (“KYC”) and Anti Money Laundering (“AML”) obligations.
• To the extent necessary to fulfil our obligations, data obtained from publicly accessible sources or which are legitimately transmitted by other third parties (e.g. a credit agency) such as data in public professional social media (e.g. LinkedIn), background check data.

We process personal data about our employees for the following purposes:

• human resources management including organization and personal administration, working hours management, improving and maintaining effective staff administration, internal workforce analysis, reporting and planning;
• staff transfer management from different affiliates and succession planning;
• payroll, compensation and benefits management including providing staff benefits and maintaining salary, compensations including intellectual property, allowances, benefits, insurances, pensions and performance reviews;
• talent management and acquisition including recruitment, assessing suitability and working capacity, background checks and verification of qualifications, obtaining and providing references;
• learning and development management including certifications, training staff and performing assessments and employee satisfaction surveys;
• processes related to joining and leaving including internal moves and terminations;
• sickness and other leave and vacations management;
• internal health and safety programs including health and safety and accident records or reporting and managing process quality;
• travel and expenses management and organization of business trips including monitoring of travelers to provide support during security or medical emergencies; providing travel security, health and safety training and on a voluntary basis assistance in giving security support during emergencies;
• carrying out the obligations and exercising specific rights in the field of employment and social security law or a collective agreement;
• internal and external communication of Hitachi Energy's organization and representation of Hitachi Energy including commercial register and assigning powers of attorney;
• organizing Hitachi Energy events and documentation of such events including managing and organizing internal non-marketing related campaigns, events and meetings;
• managing Hitachi Energy assets including pictures and videos depicting employees or other individuals available for download on our  intranet, website, etc.;
• finance and shared accounting services providing record to report, order to cash and purchase to pay services;
• reorganization, acquisition and sale of activities, business units and companies;
• business reporting, statistics and analytics;
• monitoring and auditing compliance of employees’ activities in the workplace with Hitachi Energy's corporate regulations and policies, contractual obligations and legal requirements including disciplinary actions;
• carrying out audits, reviews and regulatory checks to meet obligations to regulators;
• governance, risk and compliance, including compliance with laws, law enforcement, court and regulatory bodies’ requirements (such as for the process of verifying the identity of customers, called as Know Your Customer ("KYC")/ Anti Money Laundering ("AML") monitoring purposes), customs and global trade compliance, conflict of interest and security obligations) and prevention, detection, investigation and remediation of crime and fraud or prohibited activities or to otherwise protect legal rights and to establish, exercise or defend legal claims;
• managing the customer relationship, processing customer orders and providing customer support, processing, evaluating and responding to requests and inquiries;
• managing the suppliers, contractors, advisers and other professional experts including contact interaction, processing and fulfilling purchases and invoices, and contract lifecycle management;
• making use of work performance and products and for references on documents, such as drawings, purchase orders, sales orders, invoices, reports;
• access control system providing electronically controlled ingress and/or egress for authorized individuals to locations that have access restrictions and a registry of personnel on site in case of emergencies;
• intrusion detection including 3rd party monitoring of duress, perimeter, internal security points and ancillary supervisory monitors for site maintenance/automated systems;
• maintaining and protecting the security of products, facilities, services, systems, networks, computers and information, preventing and detecting security threats, fraud or other criminal or malicious activities, and ensuring business continuity; and
• managing IT resources, including infrastructure management including data back-up, information systems’ support and service operations for application management, end user support, testing, maintenance, security (incident response, risk, vulnerability, breach response), master data and workplace including user accounts management, software licenses assignment, security and performance testing and business continuity.

Certain personal data collected from you relates to your next of kin and emergency contacts. In these cases, you are requested to inform such persons about this Notice.

In case you are working at a third-party site (for example at a customer location or facility), such third party may need to process your personal data for their purposes acting as a data controller. In these cases, you will receive or may request a separate privacy notice from the relevant data controller.

Legal grounds for processing personal data of employees

• We process your personal data for the fulfilment of obligations in your employment contract with us and similar collective employment agreements, or as part of pre-contractual measures to establish employment and related contracts;
• In some cases, we rely on our legitimate interests to process your personal data insofar as this is not overridden by your own privacy interests. Such interests may include:
  • monitoring (for example through IT systems), investigating and ensuring compliance with legal, regulatory, standard and Hitachi Energy internal requirements and policies;
  • prevention of fraud and criminal activity including investigations of such activity, misuse of Hitachi Energy assets, products and services, and as strictly necessary and proportionate for ensuring network and information security; and
  • transmitting personal data within the Hitachi Energy group for internal administrative purposes as necessary, for example to provide centralized services.
• In some cases, we process your personal data on the basis of statutory requirements, for example, on the basis of labor and social security law, allowances, tax or reporting obligations, cooperation obligations with authorities or statutory retention periods in order to carry out our contractual responsibilities as an employer;
• In exceptional circumstances we may ask your consent at the time of collecting the personal data, for example photos, communications materials and events. If we ask you for consent in order to use your personal data for a particular purpose, you are free to withdraw your consent at any time and we will tell you how you can do this.

With regard to special categories of personal data we will only process such data in accordance with applicable law and:

• with your explicit consent for specific activities in accordance with applicable law;
• when necessary for exercising rights based on employment, social security or social protection law or as authorized by collective agreement, or for preventive and occupational medicine or and evaluation of working abilities; or
• where necessary for establishment, exercise and defense of legal claims.
• With regard to personal data concerning criminal convictions and offences, we will only process such data where such processing is permitted by applicable (local) law.

• Expense related information such as bank statements, payment details, transactions, expense claims and receipts, bank account details, credit card data.
• Electronic identification data and information collected by the communications systems, IT applications and website browser (where contractor has access or is affected by such systems or applications and in accordance with the applicable law) such as information technology usage (system access, IT and internet usage), device identifier (mobile device ID, PC ID), registration and login credentials, IP address, login data and log files, Analytics ID, digital alias/signature, time and url, searches, website registration and cookie data recordings (e.g. voice mail/phone recordings, Skype recordings).
• Other personal data namely where you or others (such as your colleagues) may register these data on or in our systems, programs and application such as business documents containing personal information (e.g. queries, questions, complaints, orders and related records, emails, reports, contracts, presentations, minutes, work products),
• photos, images and/or videos.

The personal data referenced below is only collected and processed, where applicable, in accordance with applicable local laws in your country of residence and where relevant depending on your work assignment. 

• Special categories of personal data such as data for travel emergency support (blood type, medical history, allergies).
• Data about criminal convictions and offences such as criminal background information for the purposes of criminal background screening.
• To the extent necessary to fulfil our obligations, data obtained from publicly accessible sources or which are legitimately transmitted by other third parties (e.g. a credit agency) such as data transferred to Hitachi Energy by your employer or the company through which you are assigned to Hitachi Energy, commercial register data, creditworthiness data.

We process personal data about contractors for the following purposes:

• human resources management as relevant to your work assignment and the services you are providing under the work assignment/statement of work directly to Hitachi Energy including organization and personal administration, working hours management, improving and maintaining effective staff administration, internal workforce analysis, reporting and planning;
• supplier and service provider management throughout the procurement, logistics and supply chain including contact interaction including tendering, engagement, processing orders, process and fulfilment of purchases, administration and management of suppliers, vendors, contractors, advisers and other professional experts including contact interaction, processing and fulfilling purchases and invoices, and contract lifecycle management;
• staff transfer management from different affiliates and succession planning;
• training contractors;
• internal health and safety programs;
• travel and expenses management and organization of business trips including monitoring of travelers to provide support during security or medical emergencies, providing travel security, health and safety training and on a voluntary basis assistance in giving security support during emergencies, insurance management;
• finance and shared accounting services providing record to report, order to cash and purchase to pay services;
• making use of work performance and products and for references on documents, such as drawings, purchase orders, sales orders, invoices, reports;
• reorganization, acquisition and sale of activities, business units and companies;
• monitoring and auditing compliance with Hitachi Energy corporate regulations and policies, contractual obligations and legal requirements;
• carrying out audits, reviews and regulatory checks to meet obligations to regulators;
• maintaining and protecting the security of products, facilities, services, systems, networks, computers and information, preventing and detecting security threats, fraud or other criminal or malicious activities, and ensuring business continuity; and
• managing IT resources, including infrastructure management including data back-up, information systems’ support and service operations for application management, end user support, testing, maintenance, security (incident response, risk, vulnerability, breach response), master data and workplace including user accounts management, software licenses assignment, security and performance testing and business continuity.

We collect only the personal data from you that we need for the purposes described above. For statistical purposes, improvement of our services and testing of our IT systems we use as much as reasonably possible anonymized data. This means that these data can no longer (in)directly identify you or single you out as an individual.

Legal grounds for processing personal data of our contractors are:

• We process your personal data for the fulfilment of contractual obligations resulting from your work assignment, or as part of pre-contractual measures we take;
• In some cases, we rely on our legitimate interests to process your personal data insofar as this is not overridden by your own privacy interests. Such interests include:
  • conduct, management, development and furtherance of our business in the broadest sense possible including supply of products and services, performance of agreements and order management with suppliers, process and fulfilment of purchases, process quality management and improvement of products or services, analytics and market intelligence, reduction of default risks in our procurement processes and reorganization, acquisition and sale of activities, business divisions and companies;
  • monitor, investigate and ensure compliance with legal, regulatory, standard and Hitachi Energy internal requirements and policies;
  • prevent fraud and criminal activity including investigations of such activity, misuse of Hitachi Energy’s assets, products and services, and as strictly necessary and proportionate for ensuring network and information security; and
  • transmitting personal data within the Hitachi Energy group for internal administrative purposes as necessary for example to provide centralized services.
• In some cases, we process your personal data on the basis of legal obligations and statutory requirements, for example, on the basis of tax or reporting obligations, cooperation obligations with authorities, statutory retention periods or the disclosure of personal data within the scope of official or judicial measures may be required for the purposes of taking evidence, prosecution or enforcement of civil law claims.

With regard to special categories of personal data we will only process such data in accordance with applicable law and:

• We will ask your explicit consent for specific activities in accordance with applicable law; or
• Where necessary for establishment, exercise and defense of legal claims.

With regard to personal data concerning criminal convictions and offences, we will only process such data where such processing is permitted by applicable (local) law.

In connection with our recruitment activities including applications and onboarding, we also collect special category data from candidates where we have an employment law obligation to do so. This information is relevant to their future working environment at Hitachi Energy or the future provision of employment benefits, or with the individual's explicit consent, where collecting such information is permitted by law. For example, where allowed under applicable law, we will collect information about an individual’s disabilities in order to analyze the diversity of our workforce. Once onboarded, an individual’s provision of information regarding disabilities will also be used to provide a suitable working environment. We will also need to conduct criminal background checks for certain candidates to assess their eligibility to work at Hitachi Energy or for Hitachi Energy customers. In certain countries, we will also ask candidates to provide diversity information (for example about their race and ethnicity) for diversity monitoring purposes, although the provision of this information will be entirely voluntary. However, where a candidate does not voluntarily provide such information, we could be required by law to make our own assessment of such criteria.

For successful candidates, we process personal data necessary for the conclusion of the employment contract and for the employee onboarding process, such as the applicable personal identity number (tax, citizenship, social security or possibly other type of individual number applicable for you due to your country and role); data of your related persons (name of spouse/partner, children, etc.); signature; bank account details; emergency contacts; insurance data; driving license number; training records; clothing and shoe size where necessary.

Depending on the country in which you apply, Hitachi Energy collects personal data about candidates (“you”) from the following sources:

• Directly from you – for example, information that you have provided when applying for a position directly through the Hitachi Energy careers website
• From recruitment agencies – for example, when a recruitment agency with your details contacts us to suggest you as a potential candidate;
• Through publicly available sources online – for example, where you have a professional profile posted online (e.g., on your current employer's website or on a professional networking site, such as LinkedIn)
• By reference – for example, through a reference from a former employee or employer, or from a referee you have identified
• Results of assessments or background screening checks

The personal data we collect will be used for the following purposes: 

• Evaluation of your application, based on Hitachi Energy’s legitimate interest in finding the most suitable candidate for the opened job position. Hitachi Energy has to conduct assessments and interviews, which corresponds also with your interest in finding the job that suits you best;
•  Your job application for the specific position within Hitachi Energy or Hitachi, which we process as part of the precontractual measures fulfilment to establish employment and related contracts (in order to take steps prior to entering into an employment contract);
• Your job application for the purpose of potential future recruitment purposes within Hitachi Energy or Hitachi, on the basis of your consent;
• Your job application for the purpose of talent pooling, where we allocate candidates to a specialist pool and approach candidates when a suitable job becomes available, on the basis of your consent;
• In case of employment contract conclusion – to undertake steps necessary to fulfill controller obligations resulting from the employment contract and applicable legal provisions such as confirming that you meet internal and legal requirements relevant to the position, creation and signing of the employment contract and other employment documentation, creation of necessary accounts in our information systems; providing you access to the Hitachi Energy; providing mandatory notifications to governmental authorities; provide you work uniform and personal protection equipment where necessary; and performing an onboarding session necessary to provide you with equipment, training and information required for the position you have been recruited.

Legal grounds for processing personal data of our job applicants are:

• Explicit consent of the candidate
• Our legitimate interest in attracting, identifying and sourcing talent
• Our legitimate interest to process and manage applications for roles at Hitachi Energy, including the screening and selecting of candidates
• Our legitimate interest to hire and onboard candidates by making an offer to successful candidates, and carrying out pre-employment screening checks
• Our legitimate interest to manage our career websites (including conducting statistical analyses)
• Compliance with a legal or regulatory obligation (when carrying out background checks to warrant a candidate is eligible to work)

The majority of the personal data we collect and use to provide our services is supplied voluntarily by (or collected by us from third-party sources at the request of) our customers. Because of this, if you are a customer of Hitachi Energy, then it will generally be obvious to you what personal data we collect and use. This information can include:

• Basic information, such as your name, the company you work for, your position and your relationship to the company
• Contact information, such as your postal address, email address and telephone numbers
• Financial information, such as payment-related information
• Any other personal data relating to you or other third parties which you provide to us for the purpose of receiving our services

We use this information:

• To provide services to you
• To administer our relationship and maintain contractual relations
• For accounting and tax purposes 
• For marketing and business development
• To comply with our legal and regulatory obligations
• To establish, exercise or defend legal rights
• For historical and statistical purposes

Legal grounds for processing personal data of our clients are:

• Performance of a contract
• Compliance with a legal or regulatory obligation
• Our legitimate interest in providing you with our goods and services and securing prompt payment of any fees, costs and debts in respect of our services
• Our legitimate interest in safeguarding Hitachi Energy against inadvertently dealing with the proceeds of criminal activities or assisting in any other unlawful or fraudulent activities (for example, terrorism)

Visitor records and access badges
We require visitors to our offices, factories and warehouses to sign in at reception and we keep that record of visitors for a short period of time. Visitors to our buildings are provided with a temporary access badge to access our building. Our visitor records will be used to verify that access badges are returned, to look into a security incident and for emergency purposes (for example, if an office needs to be evacuated).

Wi-Fi
We monitor and log traffic on our Wi-Fi networks. This allows us to see limited information about a user’s network behavior, but will also include being able to see at least the source and destination addresses the user is connecting from and to.

CCTV
Hitachi Energy uses CCTV monitoring where permitted by law. CCTV images are securely stored and only accessible on a need-to-know basis (for example, to look into an incident). We are allowed to disclose CCTV images to law enforcement bodies. We will also share CCTV images with our insurers for purposes of processing an insurance claim as a result of an incident. CCTV recordings are typically deleted or automatically overwritten after a short period of time unless an issue is identified that requires further investigation.

Visitor Health Check / COVID-19

We ask visitors to our offices, factories and warehouses to provide health related and travel information to protect the health and safety of our staff and visitors and to prevent spreading of the CIVID-19 virus. Information we ask is whether you have potential COVID-19 symptoms (fever, cough, shortness of breath or other respiratory difficulties), whether you recently visited destinations on the Hitachi Energy HotSpot Country list and whether you have been in close contact with someone that was diagnosed with COVID-19.

Your questionnaire will be destroyed immediately (latest at the end of the day you visited us) in case you have been asked not to enter our facilities. If you are our external visitor and you have answered NO to all the questions we may keep your form for a period of 30 days in order to be able to prove that everyone who was allowed to the office was diligently screened.

Legal grounds for processing personal data of visitors to our buildings are:

• Our legitimate interest in protecting our offices, factories and warehouses, personnel, goods and confidential information
• Our legitimate interest in preventing and detecting crime, and establishing, exercising and defending legal claims

As for health check / COVID-19 related information the legal grounds we rely on are:

• To comply with the legal obligation we have as employer to protect and maintain the health and safety of our staff;
• For reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care

We do not intentionally collect sensitive personal, unless you provide us with such data. While there may be free text boxes on the site where you are able to enter any information, we do not intend to process sensitive data. You are not required to provide, and should not disclose, sensitive personal data. If you choose to provide any sensitive personal data in this manner, you acknowledge you consent to the collection and processing of this sensitive information.

If you register on our site, your personal data will be stored in our CRM system . If you have opted out of receiving marketing communications, your basic contact details will remain on our opt-out list.

Information that we collect automatically

When you visit our site, we collect certain personal data automatically from your device. Specifically, the data we collect automatically include information, such as your IP address, pixel ID, device type, unique device identification number, browser type, operating system, broad geographic location (e.g., country or city-level location) and other technical information. We also collect information about how your device has interacted with our site, including the pages accessed, current URL, time you visited the site and links clicked. Collecting this information enables us to better understand the visitors who come to our site, where they come from and what content on our site is of interest to them. We use this information for our internal analytics purposes, and to improve the quality and relevance of our site to our visitors. Information will be collected using cookies and similar tracking technology, as explained further in the Cookie Notice.

Our site uses Google Analytics and Adobe Analytics in order to provide reporting, visualizations and analysis of data, but only with your consent. Click here to learn more about Google’s privacy policies and principles. The Adobe Privacy Center is available here.

Our site also uses various social media plugins.

Purposes for which we process your personal data as a visitor to our site are:

• To administer and manage our site, including to confirm and authenticate your identity, and prevent unauthorized access to restricted areas of our site
• To personalize and enrich your browsing experience by displaying content (including targeted advertising) that is more likely to be relevant and of interest to you
• To analyze the data of visitors to our site and site traffic information
• To capture webmetrics about the journey of users within our site
• To determine the company, organization, institution or agency that you work for or with which you are otherwise associated
• To develop our business and services
• To provide you with marketing communications
• To conduct benchmarking and data analysis (for example, regarding usage of our site and demographic analyses of visitors of our site)
• To understand how visitors use the features and functions of our site
• To monitor and enforce compliance with applicable terms of use
• To conduct quality and risk management reviews
• To enable the better management of our events
• To enable teams managing events to coordinate their email campaigns and event notifications more effectively
• To allow for event and webinar sign-up
• To allow for content download and lead capturing
• To allow services and information to be delivered effectively to you
• Any other purpose for which you provided information to Hitachi Energy

Legal grounds for processing personal data of visitors of our site are:

• Our legitimate interest in the effective delivery of information and services to you, and the effective and lawful operation of our businesses
• Our legitimate interest in developing and improving our site, and your user experience
• Explicit consent of the visitor