If you are a resident of the European Union (“EU”), the European Economic Area (“EEA”) or the United Kingdom (“UK”), you may have additional rights under the EU and UK General Data Protection Regulations (“GDPR”).  This addendum supplements our Employee and Contractor Privacy Policy and addresses your rights under the GDPR, the legal basis we may use to process your information, how we process special categories of Personal Information, our use of automated decision-making, and transfers of personal data outside of the EEA and UK.  

1. Your Rights As They Pertain to Your Personal Information 

You are entitled by law to access, correct, amend, or delete Personal Information about you that we hold.  A summary listing these rights appears below.  Please note that these rights are not absolute and certain exemptions may apply to specific requests that you may submit to us.  To exercise any of these rights, please contact us in accordance with the Contact Us section of this Policy.  

• The right to access: You have the right to ask us for copies of your Personal Information.  In some instances, Toho may be required to limit access to Personal Information to comply with statutory or regulatory requirements.  However, Toho will make all reasonable efforts to comply with the Personnel’s request for access and correction to the extent of what is allowed by statute or regulation.  The Company may refuse access to portions of the Personal Information of Personnel where it is found to contain Personal Information pertaining to another identifiable individual. 

• The right to rectification: We will make reasonable efforts to ensure that your Personal Information is at all times complete and accurate for its stated purpose.  However, should you have reason to believe that the information we possess is inaccurate, you have the right to ask us to rectify such information.  You also have the right to ask us to complete information you think is incomplete. 

• The right to erasure: You have the right to ask us to erase your personal data in certain circumstances, such as when it is no longer needed for the purpose for which it was collected. 

• The right to restrict processing: You have the right to ask us to restrict the processing of your information in certain circumstances, such as where you contest the accuracy of the information that we hold about you while we verify its accuracy.  

• The right to object to processing: You have the right to object to our processing of your Personal Information if it is based on our legitimate interest or your consent.   

• The right to data portability: This only applies to information you have given us.  You have the right to ask that we transfer the information you gave us from one organization to another. 

• The right to lodge a complaint with the supervisory authority: If you believe your rights under the GDPR have been violated, the GDPR gives you the right to file a complaint with your supervisory authority.  These authorities include the Data Protection Authorities of the EU, the Swiss Federal Data Protection and Information Commissioner, and the UK Information Commissioner’s Office. 

Toho will endeavor to respond promptly to any reasonable request. 

2. Legal Bases for Processing Your Personal Information  

We will only process your Personal Information when we have a lawful basis for doing so.  The legal basis for collecting and using the Personal Information will depend on the Personal Information concerned and the specific context in which we collect it.   Generally, we will process your Personal Information in order to perform the employment contract with you, to comply with a legal obligation, based on your consent, and based on our legitimate interest.  

• To Perform our Contract.  As your current or potential employer, we need to keep and process Personal Information about you for normal employment purposes.  The Personal Information we hold and process will be used for our management and administrative uses only.  We will keep and use it to enable us to run the business and manage our relationship with you effectively, lawfully and appropriately, during the recruitment process, while you are working for us, at the time when your employment ends and after you have left.  This includes using Personal Information to enable us to comply with the employment contract and to comply with any legal requirements (associated with the employment or service relationship).  This Personal Information we collect from you is necessary for the management of the employment or service relationship.  If you do not provide this information, we may be unable to comply with our obligations in some circumstances and may not be able to employ you. 

• To Enable Us to Comply With a Legal Obligation.  We may process your Personal Information to comply with legal obligations to which we are subject.  This may include any requirement to produce audited accounts, any legal obligation to share information with law enforcement agencies, public or governmental authorities, and to comply with legal process.  It may also include processing your demographic information in order to monitor compliance with equal opportunity and non-discrimination policies and processing information related to your health to comply with applicable laws and our occupational health and safety obligations.  

• Necessary for the Exercise or Defense of Legal Claims.  If you bring a claim against us or we bring a claim against you, we may process your Personal Information in relation to that claim.  We may also store your Personal Information to defend against or prepare for any potential future claim, in accordance with our internal recordkeeping policies and procedures. 

• Consent.  We may process your Personal Information based on your consent, such as when you provide your information to use in connection with voluntary benefits programs you may participate in during your employment with us.  You have the right to withdraw your consent at any time without affecting the lawfulness of the processing based on consent before its withdrawal. 

• Our Legitimate Interests.  We may process your Personal Information if doing so is necessary for our legitimate interests relating to our relationship with you, and your rights as an individual do not override those legitimate interests.  For example, our legitimate interests include but are not limited to when we process your Personal Information to carry out fraud prevention activities and activities to increase network and information security, identify usage trends, and determine and improve the effectiveness of our systems and business.  

3. Special Categories of Personal Information 

As described above, we may collect certain information that reveals your racial or ethnic origin, religious or philosophical beliefs, trade union membership, biometric data, health related data, and data concerning a person’s sex life or sexual orientation.  We will only process this data where it is required by applicable law, where you provide your express consent, or where it is necessary for our performance of the employment contract with you.  Where we process special categories of Personal Information on the basis of your consent, you are not required to provide this information.  If you do not provide consent, it will not affect your application or employment.  Furthermore, we will not make the information available to any staff outside our recruitment team, including hiring managers, in a way that can identify you.  Any information you provide will be used to produce and monitor equal opportunity statistics. 

4. Automated Decision-Making 

You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making.  There will always be human intervention into decisions based on automated processing, including automated analytics, testing, and profiling.   

If this position changes, or there is a need and lawful base to do so, we will notify you in writing. 

5. Transferring Information Outside the EU or UK 

As an international company with operations in the United States, we may store or transfer the Personal Information we collect about you to Toho entities or systems in the United States.   

We ensure that appropriate safeguards are in place, which provide adequate levels of protection to your Personal Information as required by applicable data protection laws.  All transfers outside the EU and UK not made to countries which are considered by the European Commission or Information Commissioner’s Office to provide an adequate level of protection of Personal Information are safeguarded with an agreement based on Standard Contractual Clauses approved by the European Commission or other such mechanisms that have been recognized and approved by the relevant authorities from time to time.  If you have any questions about the transfer, please contact us at [email protected].