Employee Privacy Statement

Effective February 4, 2020

Introduction

Suzuki Motor of America, Inc. ("SMAI") respects your privacy and is committed to protecting it through compliance with this Employee Privacy Statement (“Employee Statement”). Please read this Employee Statement carefully to understand SMAI's policies and practices regarding your information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household, or as "Personal Information" may otherwise be defined by law ("Personal Data") and how SMAI treats it. This document provides a general statement to establish a consistent understanding of SMAI's business practices for collecting, using, maintaining, protecting, and disclosing Personal Data of current, past, or prospective employees of SMAI. SMAI processes Personal Data from employees in order to execute, administer, and manage SMAI's human resources systems and programs, business processes and internal controls, safety and security programs, ethics and compliance programs, training programs, internal audit requirements, and to comply with legal obligations.

This Employee Statement may change from time to time. All Employee Statement provisions are subject to state and local laws and statutory requirements.

Information SMAI Collects About You and How SMAI Collects It

Generally

The Personal Data collected varies based on factors such as requirements or limitations of the state where the employee works, job position, or salary grade.

SMAI collects, creates, and processes several types of information from and about SMAI employees in line with applicable local laws:

Category	Examples of Personal Data Collected, Created, and Retained
General Employment Data	Name, address, age, date of birth, gender, contact information (such as your address, telephone numbers and email address), marital status, Curriculum Vitae, resumes, information on family members such as name and contact information, emergency contact information, credit reports, background checks, reference checks, training and evaluation records, attendance records and timesheets, performance appraisals, vacation and sickness absence time, accident records and disciplinary reports or investigations related to workplace conduct, trade union membership, religious affiliation (in some countries), race/ethnicity, health information, citizenship/immigration information (including visa numbers), bank account numbers, driver’s license and vehicle license numbers, social security number.
Business Personal Data	Business contact information (such as business title, business address, business telephone numbers (land line and mobile phone) and business email address), representations of your place in the business (including organizational charts), photo, business systems or processes that you are authorized to utilize and business systems or processes that SMAI has established for business communication, information sharing or business travel. Records relating to emails, the internet or telephones may also be collected and retained.
Compensation and Benefits Data	Salary, salary grade, job title, health benefits information and benefit numbers, and educational information.

SMAI collects this information:

Directly from you when you provide it to SMAI.
From third parties who help SMAI manage its business.
When you use SMAI's information technology systems or access SMAI's facilities.
SMAI also creates this information during the course of your employment.

The following describes how SMAI collects these different types of Personal Data.

Information You Provide to SMAI

SMAI collects information directly from you before, after, and during your employment with SMAI. Specifically, SMAI collects your name, address, social security number, work history, educational history, personal and work preferences (and any other information you may voluntarily disclose on your application or resume), date of birth, marital status, photo, citizenship/immigration status and visa information, gender, emergency contact information, personal email, banking information (for salary purposes), number of tax exemptions (where applicable), and personal phone number. SMAI will also collect a list of your beneficiaries, dependents (and their dates of births and social security numbers) emergency contact information, place of birth, passport number, drivers’ license number, vehicle registration number, nationality, tax ID number, criminal history, and trade union membership, ethnicity, veteran status, disabilities, or religious affiliation.

Some of the Personal Data SMAI collects from you is required to enter into an employment relationship with SMAI, and for SMAI to perform in that relationship. If you refuse to provide such Personal Data, then in some cases SMAI may not be able to enter into the employment relationship or fulfill SMAI’s obligations to you under it.

Information SMAI Creates About You

In addition to the Personal Data that you may provide to SMAI, SMAI also creates certain Personal Data about you and associates it with you. Specifically, SMAI creates the Business Personal Data listed above as well as the following Personal Data about you: job title, employee number, badge number, salary, expense, and other types of compensation details, employment status, information regarding mandatory training, vacation/holiday pay and other paid time off, attendance records and timesheets, performance appraisals, accident records and disciplinary reports or investigations related to workplace conduct system access information such as your user id, email address, password (which you may change) and the Compensation and Benefits Data as listed above. SMAI may also create and process information specifically related to your job function, such as evaluation records, sales and production volumes. SMAI may use photographs of you for internal and external company purposes, such as to include in an employee directory and to issue you a badge to access and be identified at SMAI facilities.

Information SMAI collects Through Automatic Data Collection Technologies

As you use SMAI's information technology systems, SMAI may collect information about your use necessary to protect SMAI's information technology and infrastructure. Specifically, SMAI collects time, date, and location information of access to SMAI's information technology systems and the data contained on those systems. To the extent permitted by the local law where you work, SMAI may also monitor, intercept, and review your activities when you use SMAI's information technology resources and communications systems, including but not limited to email (both outgoing and incoming), telephone conversations, and voice mail recordings, and instant messages. SMAI's facilities may also deploy video and other similar recording technologies which may be operated by a third party owner or operator of the buildings where SMAI's facilities are located.

Information SMAI collects From Third Parties

SMAI also collects Personal Data about you from third parties. Specifically, if permitted in your jurisdiction SMAI may collect Personal Data that is disclosed in background checks (including any criminal convictions), drug testing (if taken by you), credit reports (when applicable), and any information that is disclosed from your former employers, educational institutions, and other references you list on your application materials or that are referred to SMAI.

Uses of Your Personal Data

SMAI collects and uses the Personal Data of its employees to comply with SMAI’s legal obligations, and to execute, administer, and manage various programs.

As described in further detail below, SMAI collects, uses, transfers, and discloses Personal Data for the purposes listed below based on one or more of the following reasons: (i) because SMAI is required to do so by local applicable law; (ii) because such information is necessary to fulfill the employment relationship; (iii) because such information is of particular importance to SMAI and SMAI has a specific legitimate interest under law to process it; or (iv) where necessary to protect the vital interests of any person. Regarding (iii) above, SMAI has a legitimate interest in collecting and processing Personal Data, for example: (1) to ensure that SMAI’s networks and information are secure; (2) to administer and conduct business within SMAI and across the organization; and (3) to prevent fraud.

CATEGORY	PURPOSE
Human Resources Systems and Programs	Recruiting, delivering pay and benefits, managing performance, managing careers (including succession planning, performance management, rotations and assignments), delivering training programs and measuring and recording the results of training, administering employee benefits and communicating with employees or their representatives. Maintaining information regarding your work history, work performance, training records and disciplinary actions at SMAI. Managing company restructuring, reorganizations, redundancies and terminations. Carrying out pre-employment and during employment employee screening, background and compliance checks and maintaining records on such screening. Providing employment programs such as occupational and private health services, company cars, pension schemes and stock options and maintaining records on those employees who participate in such programs. Complying with applicable legal requirements. SMAI will engage in these activities to manage SMAI’s relationships with employees. Where there is no employment relationship, SMAI will ensure that SMAI has a legitimate interest to engage in the activity or legal obligation to do so.
Business Processes and Internal Controls	Carrying out activities to run and manage business operations, including scheduling work, managing the business organization, managing company assets, travel and expense reimbursement, managing corporate credit cards and card payment history, maintaining employee contact directories and organizational charts, managing and storing records, and processing for the efficient running of a global IT infrastructure including email, internet, social media systems, and file shares. SMAI will engage in these activities as far as this is necessary to manage SMAI’s relationship with you, based on SMAI’s legitimate interests and/or to comply with a legal obligation.
Safety and Security Programs	Conducting security and safety programs including authenticating employee status to authorize access to SMAI resources and facilities. Performing environment, health, and safety management and reporting. Managing export control and other trade regulation compliance. Protecting data, facilities and other assets. Archiving emails and other records for disaster recovery purposes. Monitoring content of email, internet, social media, and telephone usage in accordance with SMAI’s IT policies and as permitted by local law. SMAI will engage in these activities as far as this is necessary to manage SMAI’s contractual relationship with you, based on SMAI’s legitimate interests and/or to comply with a legal obligation.
Ethics and Compliance Programs	Managing SMAI’s Code of Ethics, SMAI’s Ethics Training, conducting investigations, and managing ethics and compliance training, policies, and procedures. SMAI will engage in these activities as far as this is necessary to manage SMAI’s relationship with you, based on SMAI’s legitimate interests and/or to comply with a legal obligation.
Training Programs	Providing instructional materials, and delivering compliance and product/services training. Maintaining records of training providers and participants, evaluations and results. Analyzing training activities and results as permitted by local law. SMAI will engage in these activities based on SMAI’s legitimate interests and/or to comply with a legal obligation.
Internal Audit and Governance Requirements	Managing activities to assess and report compliance with company policies as well as contractual and legal obligations. Documenting and reporting official corporate decisions and actions. Conducting investigations. SMAI will engage in these activities to manage SMAI’s relationships with employees. Where there is no employment relationship, SMAI will ensure that SMAI has a legitimate interest to engage in the activity or legal obligation to do so.
Workforce Analytics	Using workforce analytics for succession planning, workforce management, data security. For instance, using workforce analytics to assist in planning succession and to ensure business continuity, to design employee retention programs and diversity initiatives, to offer training opportunities and to identify patterns in the use of technology systems to information entrusted to SMAI as well as to protect SMAI’s people and property. SMAI will engage in these activities as far as this is necessary to manage SMAI’s relationship with you, based on SMAI’s legitimate interests.

For more information on the reasons for the processing of your Personal Data, please also see the next Section (Lawful Basis for Processing Your Personal Data).

Lawful Basis for Processing Your Personal Data

SMAI has a lawful basis for each of SMAI's processing activities (except when an exception applies as described below):

Legitimate Interests. If the processing might not already be based on SMAI's relationship with you, SMAI will process your Personal Data as necessary for SMAI's legitimate interests. SMAI's legitimate interests are balanced against your rights and freedoms and SMAI does not process your Personal Data if your rights and freedoms outweigh SMAI's legitimate interests. Specifically, SMAI's legitimate interests are to:
(a) Manage SMAI's workforce and its business, including processing your Personal Data to performworkforce analysis and planning, project assignment, review employment decisions, managing business expenses and reimbursements, plan and track compliance with training requirements and career development activities and skills, and creating and maintaining internal employee directories and address lists (which may include your photo);
(b) Manage SMAI's assets, including by processing your Personal Data to allocate company assets and human resources, perform strategic planning, project management, business continuity, maintain records related to business activities, budgeting, financial management, and reporting activities, communications and to manage mergers, acquisitions, sales, re-organizations, and other business activities;
(c) Facilitate SMAI's communication with you and SMAI's customers, including by sharing your professional email and contact information with SMAI's customers and potential customers in electronic and other communications;
(d) Protect the health and safety of SMAI's employees and others, including by reviewing the results of background checks;
(e) Safeguard SMAI's IT infrastructure and its intellectual property; and
(f) Communicate with you or your designated contacts in the event of an emergency.

To Fulfill SMAI's Obligations to You under SMAI's Contract. SMAI processes your Personal Data to fulfill SMAI's obligations to you as an Employee of SMAI, including for recruiting, administering benefits (including medical, retirement and other benefits, and the eligibility of your dependents), administering your salary and processing your expenses, payment administration, reviews and performance appraisals, wages and other awards such as bonuses, commissions, and incentive plans, career planning, training, promotions, transfers, temporary assignments, skills monitoring, managing sickness and other types of leave, and honoring other benefits that you may be entitled to based on your work location with SMAI.

As Required by Law. SMAI may also process your Personal Data when SMAI is required or permitted to by law. Specifically, SMAI may process your Personal Data to comply with government inspection, audits, reporting requirements, and other valid requests from government or other public authorities; to respond to legal process such as subpoenas; or as necessary for SMAI to protect SMAI’s interests or otherwise pursue SMAI's legal rights and remedies (for instance, when necessary to prevent or detect fraud, attacks against SMAI's network, or other criminal and tortious activities), defend litigation, and manage complaints or claims.

Consent. SMAI may, from time to time, request your consent to process your Personal Data where none of these reasons apply or where consent is required by local law, your decision to provide Personal Data to SMAI is voluntary. If SMAI collects or use Personal Data based on your consent, you may withdraw your consent at any time. The purpose and nature of this processing will be described at the time SMAI seeks your consent.

Sensitive Information Processing

Some Personal Data processed by SMAI may be considered sensitive, including Personal Data that reveals your racial or ethnic origin, political opinions, religious, philosophical beliefs, or trade unions membership, or the processing of data concerning your health or data concerning your sexual orientation or history of criminal convictions. SMAI processes this information to the extent necessary to carry out its obligations in the field of employment, social security, and social protection law. SMAI also processes this sensitive information where it is necessary to perform SMAI's relationship with you and/or protect SMAI's legitimate interests to ensure that SMAI's employees are qualified to perform the tasks that they are employed to do when your rights and freedoms do not outweigh these interests. SMAI will process such information only where permitted by law, if needed, with your explicit consent where required and subject to appropriate confidentiality safeguards.

Automated Decision Making

SMAI does not use your Personal Data with automated decision making processes without human intervention.

Disclosure of Your Information

SMAI does not share, sell, or otherwise disclose your Personal Data for purposes other than those outlined in this Employee Statement. However, SMAI may disclose aggregated information about SMAI's employees, and information that does not identify any individual, without restriction.

SMAI may disclose Personal Data that SMAI collects or you provide as described in this Employee Statement:

With SMAI's parent company, Suzuki Motor Corporation. SMAI takes appropriate precautions to restrict access to the Personal Data of SMAI's employees to only those who need to know that information. This includes your managers and their designees, personnel in HR, IT, Compliance, Legal, Finance and Accounting and Internal Audit. All personnel within SMAI will generally have access to your business contact information such as name, position, telephone number, postal address and email address, and organization structure.

To contractors, service providers, and other third parties SMAI uses to support SMAI's business and who are bound by contractual or legal obligations to keep Personal Data confidential and use it only for the purposes for which SMAI discloses it to them. The following table contains examples of which Personal Data SMAI may share with external third parties and why:

Category	Purpose
Human Resources Administration	Retirement benefits administration (such as 401K administration), medical and dental benefits, insurance benefits, employee assistance programs, relocation services, payroll administration, recruiting firms, executive coaching, language training, performance management programs, rewards and recognition programs, law firms, audit firms, consulting firms and employee screening and background checks service providers (where permitted by local law).
Business Process Administration	Communication systems, car fleet administration, business travel and expense administration, corporate credit card administration, IT and infrastructure support, auditing, legal, advisory, and trade regulation compliance systems.
Government and Other External Reporting	Unemployment benefits, equal employment opportunity reporting, tax reporting, Health & Safety reporting, and reporting to other regulatory bodies.
Government Licensing	Occupational licensing applications, as required by state law

To a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of SMAI’s assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which Personal Data held by SMAI about SMAI’s employees is among the assets transferred.

SMAI may also disclose your Personal Data:

To comply with any court order, law, or legal process, including to respond to any government or regulatory request, to the requesting entity.
In the event you violate any law or regulation or engage in any criminal act, to the appropriate law enforcement or regulatory agency.
If SMAI believes disclosure is necessary or appropriate to protect the rights, property, or safety of SMAI, SMAI's customers, or others.

Consequences of not providing personal data

Sometimes SMAI will ask you to provide certain personal data. The reason for that could be a legal requirement, the performance of the employment relationship, or a requested service.

Some of the personal data you provide to SMAI is required by law. For example, your social security number is required in order to be able to make correct deductions on your salary.

SMAI may require you to provide other personal data, where it is necessary for SMAI or SMAI's benefits providers to fulfill SMAI's obligations to you, or for you to fulfill your obligations to SMAI, or where SMAI's use of the data is necessary in SMAI's legitimate interests. For example, if you do not provide SMAI with a timesheet, SMAI cannot pay you for the overtime hours you have worked; if you do not complete the application form for health insurance, SMAI cannot provide you with health insurance.

Please take into consideration, that if you do not provide certain required personal data SMAI might not be able to provide the requested service or to comply with SMAI's obligations to you pursuant to your employment relationship. SMAI will tell you about the particular implications of any such decision in details at the relevant time.

Your Rights Regarding Your Information and Accessing and Correcting Your Information

Applicable data protection laws may provide you with certain rights with regards to SMAI’s processing of your Personal Data. SMAI will respond to your request consistent with applicable law. Please note, however, that certain Personal Data may be exempt from requests pursuant to applicable data protection laws or other laws and regulations.

Access and Update. You can review and change your Personal Data by using the means described below in Employee Obligations. You may also notify SMAI through the contact information below of any changes or errors in any Personal Data SMAI has about you to ensure that it is complete, accurate, and as current as possible. SMAI may not be able to accommodate your request if SMAI believes it would violate any law or legal requirement or cause the information to be incorrect.
Restrictions. You have the right to restrict SMAI's processing of your Personal Data under certain circumstances. In particular, you can request SMAI to restrict its use of your Personal Data if you contest accuracy of such Personal Data, if the processing of your Personal Data is determined to be unlawful, or if SMAI no longer needs your Personal Data for processing, but SMAI has retained it as permitted by law.
Portability. To the extent the Personal Data you provide SMAI is processed based on your consent, you have the right to request that SMAI provide you a copy of, or access to, all or part of such Personal Data in structured, commonly used and machine-readable format. You also have the right to request that SMAI transmits this Personal Data to another controller, when technically feasible.

Object. In general, SMAI does not process your Personal Data if your rights override SMAI's legitimate interests. Nevertheless, you have the right to object to the Processing of your Personal Data if the Processing is based solely on SMAI's legitimate interests. But SMAI may refuse your request provided that SMAI is able to demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defense of legal claims.

Withdrawal of Consent. To the extent that SMAI's processing of your Personal Data is based on your consent, you may withdraw your consent at any time. Withdrawing your consent will not, however, affect the lawfulness of the processing based on your consent before its withdrawal, and will not affect the lawfulness of SMAI's continued processing that is based on any other lawful basis for processing your Personal Data.

Right to be Forgotten. You have the right to request that SMAI delete all of your Personal Data. Some Personal Data cannot be deleted until after you are no longer an employee of SMAI and SMAI will only delete your account when SMAI no longer has a lawful basis for processing your Personal Data or after a final determination that your Personal Data was unlawfully processed. SMAI may not accommodate a request to erase information if SMAI believes the deletion would violate any law or legal requirement or cause the information to be incorrect. In all other cases, SMAI will retain your Personal Data as set forth in this Employee Statement. In addition, SMAI cannot completely delete your Personal Data as some data may rest in previous backups. These will be retained for the periods set forth in SMAI's Record Retention policies.

Complaints. You have the right to lodge a complaint with the applicable supervisory authority in the state you live in, the state you work in, or the state where you believe your rights under applicable data protection laws have been violated. However, before doing so, SMAI requests that you contact SMAI directly in order to give SMAI an opportunity to work directly with you to resolve any concerns about your privacy.

How You May Exercise Your Rights.

You may exercise any of the above rights by contacting the Human Resources Department through any of the methods below. If you contact SMAI to exercise any of the foregoing rights, SMAI may ask you for additional information to verify your identity. SMAI reserves the right to limit or deny your request if you have failed to provide sufficient information to verify your identity or to satisfy SMAI's legal and business requirements.

Data Security

SMAI has implemented measures designed to secure your Personal Data from accidental loss and from unauthorized access, use, alteration, and disclosure.

The safety and security of your information also depends on you. Information privacy is the responsibility of every employee at SMAI. Employees must adhere to all information security, data privacy, and records retention policies. Employees must immediately report any breaches of privacy or security according to the SMAI Policy for Protecting Personally Identifiable Information.

Unfortunately, the transmission of information via the internet is not completely secure. Although SMAI does its best to protect your Personal Data, SMAI cannot guarantee the security of your Personal Data stored or transmitted on SMAI's information technology systems.

Data Retention Periods

How long SMAI retains your personal data depends on the purpose for which it was obtained and its nature. SMAI will retain your Personal Data for the period necessary to fulfill the purposes described in this Employee Statement unless a longer retention period is required. The criteria SMAI uses to decide how long to retain your personal data after you are no longer employed by SMAI are:

To provide you with retirement or other continuing benefits
When legal requirements and professional guidelines require it – such as tax and audit purposes, or information on aspects of health and safety
When SMAI needs to comply with a court order, law, or legal process

When SMAI has a another legitimate interest in retaining the data, and SMAI's interests are not outweighed by your rights and freedoms

When stored on SMAI's backup and disaster recovery systems in accordance with any backup and disaster policies and procedures

When SMAI has your consent
For data that has been aggregated or otherwise rendered anonymous in such a manner that you are no longer identifiable, indefinitely

Please see SMAI's Record Retention Policy for details.

Employee Obligations

SMAI expects employees to manage changes to their Personal Data in order to keep the data SMAI processes accurate. You can do this by logging in to your accounts for online Human Resources systems SMAI uses or by contacting the Human Resources Department. You agree to inform anyone whose Personal Data you provide to SMAI (e.g., your dependents) about the content of this Employee Statement, and ensure you have the right to provide that information to SMAI.

You further agree to follow applicable law and all applicable SMAI policies, standards, and procedures that are brought to your attention when handling any Personal Data to which you have access in the course of your relationship with SMAI. In particular, you will not access or use any Personal Data for any purpose other than in connection with and to the extent necessary for your work with SMAI. You understand that these obligations continue to exist after termination of your relationship with SMAI.

SMAI recognizes the importance of privacy for SMAI's employees and will enforce the privacy and security policies. SMAI's Policy for Protecting Personally Identifiable Information advises employees of their responsibilities to respect and protect the Personal Data they collect or maintain on behalf of SMAI. As stated in the Policy, non-compliance could result in disciplinary action and substantial sanctions for SMAI. A copy of all SMAI's data privacy related policies and procedures can be found on the SMAI intranet.

Changes to SMAI's Employee Statement

SMAI may change this Employee Statement at any time. It is SMAI's policy to notify you of any changes it makes to SMAI's Employee Statement. If SMAI makes material changes to how SMAI treats SMAI's employees' Personal Data, SMAI will notify you by email and/or mail. The date this Employee Statement was last revised is identified at the top of the page.

Contact Information

If you have any questions, concerns, complaints, or suggestions regarding this Employee Statement, have any requests related to your Personal Data pursuant to applicable laws, or otherwise need to contact SMAI, please contact the Human Resources Department.