SHIMANO APPS DATA PROTECTION NOTICE

Last Updated: October 2024

 

• 1. Introduction and Scope

This Data Protection Notice (the "Notice") describes the data processing activities in connection with your use of the following apps developed and offered by Shimano Inc.

§  E-TUBE PROJECT App ("E-TUBE PROJECT"); and

§  E-TUBE RIDE App ("E-TUBE RIDE", collectively the "Apps").

Unless stated otherwise, the information provided herein applies to all two Apps in general.

This Notice also informs you about the most relevant aspects of the arrangement concluded between the Shimano entities responsible for the data processing activities in connection with the Apps.

Personal Data means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental economic, cultural or social identity of that natural person ("Personal Data").

Special categories of personal data include data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data, data concerning health or data concerning a natural person's sex life or sexual orientation (also referred to as "Sensitive Data").

You can find more information about how we process the Personal Data of California consumers by reviewing the “Additional Disclosures for California Consumers” section of this Notice below.

• 2. Data controller

Shimano Inc. ("SIC")
3-77 Oimatsu-cho, Sakai-ku, Sakai City
Osaka 590-8577, Japan

together with

SHIMANO EUROPE B.V. ("SEU")
High Tech Campus 92, 5656 AG Eindhoven,
The Netherlands,

SHIMANO NORTH AMERICA HOLDING, INC. ("SNAH")
One Holland, Irvine, California 92618 U.S.A.

and

SHIMANO SALES CO., LTD. ("SSJ")
1-5-15 Chikukou-Shinmachi, Nishi-ku, Sakai-shi, Osaka, 592-8331, Japan

are the entities responsible for the processing of your Personal Data in relation to E-TUBE PROJECT and E-TUBE RIDE as joint data controllers (SIC, SEU, SNAH and SSJ together referred to hereinafter as "we", "our" or "us").

In derogation of the above, controller responsible for the processing of your Personal Data in relation to E-TUBE PROJECT and E-TUBE RIDE in

- Australia, Taiwan, New Zealand, South Korea, Brazil, Indonesia, Thailand, Argentina, Chile, Colombia, Costa Rica, Guatemala, India, Malaysia, Mexico, Panama, Philippines, Singapore, Uruguay, Ecuador and Venezuela is SIC,

- Switzerland, Israel Turkey, Andorra, Bosnia and Herzegovina, Monaco, and Republic of South Africa are SIC and SEU, and

- Canada are SIC and SNAH.

If you are from these countries, by referring to “we", "our" or "us” and by referring to SIC and/or SSJ and/or SNAH and/or SEU we only refer to the respective company or companies named above for the respective country.

You can contact each joint controller by postal mail at the address above.

• 3. Data Protection Officer

We have appointed a group Data Protection Officer ("DPO") to manage all matters related to data protection and privacy. If you have any questions regarding the processing of your Personal Data, please contact our DPO at privacy@shimano-eu.com

• 4. Information we collect

Our Apps offer you a variety of functionalities, services and features (the "Services") which require or allow you to provide us with Personal Data about you. Additionally, we automatically collect information about you, including Personal Data, upon download and installation of the Apps on your device.

• 4.1 Information you provide to us

When using our Apps you have the option to enjoy our contents and Services which may require or allow you to provide us with Personal Data. The specific categories of Personal Data concerned depend on the specific app involved, and may in particular include your Personal Data as described below.

If certain information is required for us to be able to provide you with a specific service, we will for us mark it as such. Failure to provide us with the information results in the impossibility of providing you with the requested service.

(a) E-TUBE PROJECT

§  User information: username (nickname), login password (encrypted), gender, birthday, home address (state/prefecture level), and email address; and

§  Bike information: nickname, components information (product name, gear teeth number, serial number, firmware version, unit log, component name pass key, and Universally Unique Identifier of wireless unit)

 

E-TUBE PROJECT offers you the option of using the app without logging in. If you choose this option, we will not process bike information as information relating to an identified or identifiable natural person

(b) E-TUBE RIDE

§  User information: username (nickname), login password (encrypted). gender, birthday, home address (state/prefecture level), and email address;

§  Health-related data: heart rate and weight information (max./ave. heart rate, body weight included in the bike ride log);

§  Bike information: nickname, components information (serial number, name and Universally Unique Identifier of wireless unit); and

§  Bike ride log: latitude/longitude, time, elevation, distance, speed, pedaling cadence, gear position, ave. power, assist mode, error log, calorie consumption based on health related information (max./ave. heart rate, body weight)

 

E-TUBE RIDE offers you the option of using the app without logging in. If you choose this option, we will not process health-related, bike, or bike ride log information as information relating to an identified or identifiable natural person.

• 4.2 Information we automatically collect

When using our Apps and Services we automatically collect Personal Data. The specific categories of Personal Data concerned depend on the specific app involved, as described below:

(a) E-TUBE PROJECT

§  Device information: IP address, unique device ID (such as Instance ID, IDFV, Firebase ID), Model, OS version, Number of Processors ,Storage capacity, Language of device setting; and

§  App usage log information: For example information about your interactions with the app, including error logs and crash recovery logs, date/time stamps, information about server(such as Execution API Authentication information) and clickstream data

 

(b) E-TUBE RIDE

§  Device information: such as IP address, unique device ID (such as Instance ID, IDFV, Firebase ID); and

§  App usage log information: such as information about your interactions with the app, including error logs and crash recovery logs, date/time stamps and clickstream data

 

• 4.3 Information we receive from other sources

As a general rule we collect information directly from you. However, we also receive Personal Data about you from other sources in the following situations:

SHIMANO ID and Social Media

The use of our Apps does not require logging in or creating a profile. However, you are able to do so if you wish.

If you log into our Apps with your SHIMANO ID, we will merge the information we process about you in connection with our different Apps in order to simplify the registration for our Services.

You can register to SHIMANO ID by email address or by connecting with existing accounts on social media networks such as Facebook, Apple ID and Google.

If you choose to use a social media account to register to SHIMANO ID, we will process the data of your social media user account. This information varies depending on the settings of your social media account and can consist of the following: account name, location, gender, age, email address, etc.

• 4.4 Deidentified data

We may de-identify Personal Data so that it cannot be used to identify you and is no longer Personal Data. We will maintain and use this data only in deidentified form and will not attempt to re-identify the data.

• 4.5 Cookies and other tracking tools

Our Apps use cookies and other tracking mechanisms to collect information.

Cookies are small text files stored on your device with a variety of purposes. You can manage and delete the cookies on your device in the corresponding device settings.

(a)

Our Apps use strictly necessary cookies. Strictly necessary cookies are essential for the operation and use of our Apps. Without these cookies, we would not be able to offer you with our Apps and Services. Therefore, you cannot opt out of them.

(b)

We use tracking tools to collect information about the users' behaviour and interactions with our Apps and Services, e.g. what features are most frequently used. The processing of Personal Data collected via these tools is based on the user's consent. You can withdraw your consent at any time with effect for the future. Please see Section 9 below for more information on how to exercise your rights.

Our Apps use the following cookies:

 

At this time, the Apps do not respond to “do not track” signals sent by Internet browsers.

• 5. Purposes and legal bases

We process your Personal Data only for specified, explicit and legitimate purposes and provided that we have a legal basis to rely on. Your Personal Data will not be processed for any purpose other than the one they were originally collected, unless the new purpose is compatible with the initial one or in the event you give us your consent.

We have summarized the purposes for which we process your Personal Data and the legal bases we justify the processing with in the list below:

§  User identification (applicable for all Apps):

We use your Personal Data to verify your identity when registering and logging into our Apps.

The processing of your Personal Data for this purpose is necessary for the performance of the contract concluded with you for the use of the Apps, see Art. 6 (1)(b) General Data Protection Regulation ("GDPR").

§  Use of the Apps (for each app see the information applicable below):

(a) E-TUBE PROJECT

E-TUBE PROJECT offers you the option of using the app without logging in. In case of using the app with user log-in, the app operates on the basis of the user profile you have created. We use your Personal Data to manage your bike information associated with your user account. Our aim is to offer you a seamless experience by enabling you to access your data from any place and any device. We base the processing of your Personal Data for the above purposes on the performance of a contract to which you are party, see Art. 6 (1)(b) GDPR.

When configuring your user profile, you can choose to submit more information than the strictly required to provide you with our services. The provision of optional information to complete your user profile enables you to benefit from a more personalized experience on our Apps.

We rely on your consent to process any Personal Data you have freely chosen to provide us with, see Art. 6 (1)(a) GDPR. In case you withdraw your consent, for example, by updating your user profile, we will stop processing your Personal Data for this purpose.

(b) E-TUBE RIDE

E-TUBE RIDE offers you the option of using the app without logging in. In case of using the app with user registration, the app operates on the basis of the user profile you have created. We use your Personal Data to manage your bike information and riding log associated with user account. Our aim is to offer you a seamless experience by enabling you to access to your data from any place and any device. We base the processing of your Personal Data for the above purposes on the performance of a contract to which you are party, see Art. 6 (1)(b) GDPR.

When configuring your user profile, you can choose to submit more information than the strictly required to provide you with our services. This includes health-related data (heart rate and weight information). The provision of optional information to complete your user profile enables you to benefit from a more personalized experience on our Apps.

We rely on your consent to process any Personal Data you have freely chosen to provide us with, see Art. 6 (1)(a) GDPR. In case you withdraw your consent, for example, by updating your user profile, we will stop processing your Personal Data for this purpose.

§  Communication with you (applicable for all Apps):

We use your Personal Data to contact you (i) in order to provide you with information about the Apps and their functionalities for the purpose of providing you with the Services, (ii) to send you information about similar products and/or services, (iii) upon your request or consent (for example, to obtain feedback from you in order to improve our products, services and/or marketing).

We base the processing of your Personal Data on your consent, as well as on the performance of a contract to which you are party and our legitimate interests to provide customer support, and to provide you with product and/or service information, see Art. 6 (1)(a), (b) and (f) GDPR.

§  Product development (applicable for all Apps):

We process your Personal Data for quality improvement purposes, e.g. to detect and analyse problems in our products, to carry out predictive maintenance and calculate the necessary product replacement timing, to introduce new products and test their compatibility, etc.

We base the processing of your Personal Data on our legitimate interests to improve the quality of our products and services, for product development research and to expand and grow as a business, see Art. 6 (1)(f) GDPR.

§  App user measurement and usage analysis (applicable for all Apps):

We analyse the performance of our Apps and Services content in order to understand how users interact with them and improve them accordingly.

We rely on your consent to process your Personal Data for this purpose, see Art. 6 (1)(a) GDPR. In case you withdraw your consent, we will stop processing your Personal Data for this purpose.

We further aggregate user data collected in our database in order to provide data analysis services (e.g. regarding bike model usage (for example terrain information, battery use history, errors, etc.), gender ratio, average speed/distance/riding time, firmware status) to manufacturers of bikes, to bike brands and to bike dealers. In order to provide each party with the relevant aggregated data, as a first step, we match on our servers the serial number of Shimano components registered by users in the Apps with the serial numbers from our factory database. In a second step, by way of data aggregation, all Personal Data is anonymized by aggregation before it is included in the respective statistics so that it is not possible for the manufacturer or dealer to directly or indirectly identify you.

For this purpose, we rely on our legitimate interests to provide the added services to our cooperation partners and on the legitimate interests of our cooperation partners to be able to analyze model usage, see Art. 6 (1)(f) GDPR.

§  Detect and avoid misuse of the Apps (applicable for all Apps):

We analyse technical data gathered via the Apps to detect and avoid misuse thereof, for example, by a breach of the terms of use of the software license agreement.

We base the processing of your Personal Data on the performance of a contract to which you are party, as well as on our legitimate interests in prosecuting any misuse of our Apps which could affect us and could have legal consequences, see Art. 6 (1)(b) and (f) GDPR.

Where the above purposes require or involve the processing of Sensitive Data, we will ask for your express consent, as required by law, see Art. 9 (2)(a) GDPR.

• 6. Recipients of Personal Data

We share your Personal Data with the following recipients:

§  Other group companies and distributors. Given the international footprint of our business, our group companies work closely together. To be able to do so, we share data, including Personal Data, within the group. This means that your Personal Data will be shared to other group companies and distributors only to the extent necessary, e.g. for the fulfillment of data subjects’ rights or to respond to your inquiries. You can find a list of all the group companies and distributors with whom we share your Personal Data as attached.

§  Service providers acting on our behalf. We engage service providers to assist us in our daily business such as IT support and maintenance providers, web server providers. All service providers are legally and contractually required to respect and comply with applicable data protection legislation. Our service providers include:

§  Amazon Web Services Inc., 410 Terry Avenue North, Seattle, WA 98109-5210, USA (cloud service provider acting as sub-processor) ("AWS"); and

§  SAP, Dietmar-Hopp-Allee 16, 69190 Walldorf, Germany (data processor; provider of customer relations and identity management services)

§  Sonix Co., Ltd., 7-9-5, Nishigotanda, Shinagawa-ku, Tokyo, 141-0031 Japan (data processor; development and maintenance provider)

§  To other app users, if you have given us your consent to do so.

The transfer of your Personal Data to recipients located in third countries outside of the European Economic Area ("EEA") is subject to the provisions set out in Section 7 below ("international data transfers").

• 7. International data transfers

All data collected via the Apps will be stored centrally in the European Union ("EU") on servers provided by AWS. As (joint) data controller, SIC has access to that database. Accordingly, your Personal Data will be transferred and/or disclosed to recipients located outside of the EEA in Japan which has been recognized by the European Commission in its adequacy decision (Commission Implementing Decision 2019/419 of 23 January 2019) as providing for an adequate level of data protection. AWS is located in the USA. The data transfer to AWS is based on the EU-US-Data Protection Framework which is an adequacy decision by the EU Commission determining that the USA provide an adequate level of data protection. In addition, standard contractual clauses for the transfer of personal data to processors established in third countries have been concluded. A copy of the clauses can be requested from the DPO. For more information on international data transfers in connection with the Apps and adequate safeguards implemented for this purpose you may contact our DPO.

• 8. Retention periods

We will not process your Personal Data longer than necessary for the purpose for which it was originally collected.

Subject to statutory retention periods, we will delete your Personal Data:

§  in the event of inactivity of your user profile for a period of 5 years; and/or

§  when you delete your user profile

• 9. Your rights

Under applicable data protection law, you have certain rights with regard to the processing of your Personal Data by us:

§  Right of access to your Personal Data;

§  Right to rectification of inaccurate or incomplete Personal Data;

§  Right to erasure of your Personal Data;

§  Right to restriction of processing;

§  Right to data portability, when the processing of your Personal Data is based on your consent or on a contract, and the processing is carried out by automated means;

§  Right to withdraw consent with effect for the future

§  Right to lodge a complaint with a supervisory authority; and

§  Right to object to the processing of your Personal Data on grounds relating to your particular situation, and right to object to the processing of your Personal Data for direct marketing purposes.

U.S. residents may also contact us to appeal any decision we make relating to requests to exercise your rights. To appeal a decision, please contact us using the contact details above.

• 10. Joint controllership agreement

SIC, SSJ, SNAH and SEU jointly determine the purposes and the means of the processing of your Personal Data in connection with the Apps as described in Section 2 above. Consequently, as required by law, SIC, SSJ, SNAH and SEU have entered into a joint controllership agreement for personal data of users located in the EEA pursuant to Art. 26 GDPR. SIC, SSJ, SNAH and SEU will coordinate and cooperate with each other in order to comply with their data protection obligations, to observe your rights and to process your request and reply to any of your inquiries.

SEU is the designated point of contact for Apps users requesting to exercise their rights under Section 9 above. If you want to do so, or in case you have questions regarding them, please contact SEU by phone at +31-40-2612222 or by email at privacy@shimano-eu.com In addition, If you are located in the EU, please note that in addition to your designated point of contact, you may also contact SIC, SNAH and SSJ to exercise your rights.

• 11. Data security

We have implemented standard industry practices internally and with our service providers to maintain the security of your Personal Data depending on its sensitivity and to avoid disclosure of such Personal Data unpermitted under this Notice.

• 12. Third-party links and websites

Our Services offer you the possibility of accessing third party content, such as websites, apps and online services. Please note that we are not responsible for the data processing activities of these third parties. We encourage you to read the data protection notices of any third party website, app or online service you connect with.

• 13. Children

We do not knowingly process Personal Data from individuals under the age of 16 without parental or guardian consent. If you are the parent or the guardian of a child and you believe that we have processed Personal Data about him or her, please contact our DPO using the contact details described above in Section 3.

• 14. Miscellaneous

This Notice may be revised from time to time to reflect and comply with changes in applicable legislation. We will inform you about any updates in an appropriate manner, e.g. via email or a message in the Apps. The date of the last update is available at the top of this Notice.

Attachment

 

Additional Disclosures for California Consumers

These disclosures describe how we collect, use, process, and disclose Personal Data of California consumers in the context of our Apps and Services (as defined above), as well as the rights you may have under California law. These disclosures are intended to supplement the Data Protection Notice with information required by California law.

Personal Data We Collect

California law requires that we describe the Personal Data we collect about California consumers, including by identifying specific categories of data. We collect Personal Data directly from consumers, automatically when consumers use our Apps and Services, and from other sources (such as from social networks, when you use a social media account to register to SHIMANO ID). As we describe in more detail above in the “Information We Collect” section of this Notice, we have collected the following categories of Personal Data in the past 12 months in the context of each App:

§  E-TUBE PROJECT

§  Identifiers (e.g., username and login password, home address, email address, IP address, unique device ID (such as Instance ID, IDFV, Firebase ID))

§  Demographics (e.g., gender, birthday)

§  Commercial Information (e.g., bike information such as nickname, components information (product name, gear teeth number, serial number, firmware version, unit log, component name pass key, and Universally Unique Identifier of wireless unit))

§  Internet Activity (e.g., app usage log information (error and crash recovery logs, date/time stamps, clickstream data))

§  Sensitive Data (e.g., precise geolocation data)

§  E-TUBE RIDE

§  Identifiers (e.g., username and login password, home address, email address, IP address, unique device ID (such as Instance ID, IDFV))

§  Demographics (e.g., gender, birthday)

§  Commercial Information (e.g., bike information such as nickname, components information (serial number, name and Universally Unique Identifier of wireless unit))

§  Biometric Information (e.g., bike ride log information such as pedaling cadence)

§  Internet Activity (e.g., bike ride log (time, distance, speed, gear position, assist mode, error log), app usage log information (error and crash recovery logs, date/time stamps, clickstream data))

§  Sensitive Data (e.g., health data such as heart rate and weight data; precise geolocation)

For information about our business or commercial purpose(s) for collecting, or possibly sharing, your Personal Data, please refer to the “Purposes and Legal Bases” section of the Notice above.

How We Disclose Personal Data

We may disclose your Personal Data to third parties as described in the “Recipients of Personal Data” section of the Notice above. We do not “sell” or “share” Personal Data as those terms are defined under California law. California law also requires that we provide you with information about certain disclosures of Personal Data to third parties, where the disclosures are made for “business purposes”, such as disclosures to service providers. We disclose the following types of Personal Data for our business purposes:

 

California Rights

California law grants certain rights to California consumers. These include the rights to:

§  Access specific pieces of Personal Data (“Right to Access”)

§  Learn about how we process and share Personal Data (“Right to Know”)

§  Correct inaccurate or incomplete Personal Data (“Right to Correct”)

§  Request deletion of Personal Data we collected from you (“Right to Request Deletion”)

§  Opt out of “sales” and “sharing” of Personal Data, as defined under California law

§  Restrict certain uses and disclosures of Personal Data that is considered sensitive personal information under California law

§  Not to be denied goods or services for exercising these rights

To exercise the Right to Access, Right to Know, Right to Correct, or Right to Request Deletion: please contact us at privacy@shimano-eu.com or +1-800-423-2420. Only you or a person that you authorize to act on your behalf may make a request related to your Personal Data. A request to exercise any of these rights must (1) provide sufficient information that allows us to reasonably verify that you are the person about whom we collected Personal Data (or an authorized representative of that person); and (2) describe your request with sufficient detail that allows us to understand, evaluate, and respond to your request. We will verify your identity by sending email to your registered email address and confirming reply from your email address. In certain cases, we may need to ask for more information. We may not be able to respond to your request or provide you with the information you requested if we are unable to verify your identity (or establish the authority of an authorized agent acting on your behalf). Authorized agents wishing to exercise rights on behalf of a California consumer should submit requests to privacy@shimano-eu.com along with a copy of the consumer’s signed authorization designating you as their agent. If you do not have an account with SHIMANO, while you may contact us at privacy@shimano-eu.com with questions or concerns, we may not be able to respond to requests to exercise your rights under California law, including the right to know or delete your Personal Data. Because we only collect limited data about individuals without an account, we are unable to verify requests from non-accountholders to the standard required by California law.

Additionally, under California Civil Code Section 1798.83, California residents have the right to request in writing from businesses with whom they have an established business relationship, (a) a list of the categories of personal data that a business has disclosed to third parties during the immediately preceding calendar year for the third parties’ direct marketing purposes and (b) the names and addresses of such third parties. To exercise this right, please contact us at privacy@shimano-eu.com

Contact Us

If you have any questions regarding the processing of your Personal Data, please contact us at privacy@shimano-eu.com