Data protection notice for employees (O_IS_CN2)

August 2026

 

This Data Protection Notice sets out the basis on which Technoform Bautec (Suzhou) Thermal Insulation Materials Co., Ltd. collects, uses, discloses or otherwise processes the personal information of employees, in accordance with the Personal Information Protection Law (“PIPL”) and, where relevant, the Cybersecurity Law (“CSL”) and the Data Security Law (“DSL”). It applies to personal information in our possession or under our control, including personal information held by organisations we have engaged to process it on our behalf.

In this Notice, “employees” means all persons engaged in a contract of service with us (whether part-time, temporary or full-time), as well as interns and trainees working at or attached to us, and references to “employment” apply equally to internships and traineeships. “personal information” means all kinds of information, recorded electronically or otherwise, related to an identified or identifiable natural person, excluding information that has been anonymised.

1  Data Controller 

The organisation responsible for the processing of your personal data is:

Technoform Bautec (Suzhou) Thermal Insulation Materials Co., Ltd.
283, Qing Qiu Street, Modern Avenue East, 
S.I.P. Suzhou 215024, P.R.C.

T +86 512 6283 3188
E info [dot] tesg [at] ap [dot] technoform [dot] com (info[dot]tesg[at]ap[dot]technoform[dot]com)

For any questions regarding data protection, you may contact our Data Protection Contact using the details set out in Section 5 at any time.

2  Purpose and legal basis

We collect and process personal information where permitted or required under the PIPL, including where necessary for the conclusion or performance of a contract, compliance with legal obligations, or where separate consent has been obtained.

2.1  Employment relationship

We store information about our employees that is necessary for human resource administration and the remuneration process, including, without limitation, your:

  • name or alias, gender, resident identity card number or passport number, date of birth, nationality, and country and city of birth;
  • mailing address, telephone numbers, email address and other contact details;
  • employment and training history;
  • salary information and bank account details;
  • social insurance and housing fund contribution data;
  • details of your next-of-kin, spouse and other family members;
  • work-related health issues and disabilities;
  • records of leave of absence from work;
  • photographs and other audio-visual information;
  • performance assessments and disciplinary records; and
  • any additional information provided to us by you as a job applicant (prior to being engaged as an employee).

Where we process sensitive personal information, we will only do so where there is a specific purpose and sufficient necessity, and in accordance with applicable legal requirements. Where required, we will obtain your separate consent.

Your personal information will be collected and used, and may be disclosed where necessary, for purposes including: performing obligations under or in connection with your contract of employment (including payment of remuneration and tax); all administrative and human-resources matters (payroll, granting access to our premises and computer systems, processing leave, administering insurance and benefits, processing claims and expenses, investigating acts or defaults, and developing HR policies); managing and terminating the employment relationship (including monitoring internet and email use to investigate potential breaches of our compliance regulations, and resolving grievances); assessing your suitability for continued employment or appointment; ensuring business continuity; performing obligations in connection with the provision of our goods or services to our clients; fraud detection and prevention; detection and prevention of misuse of services; network analysis to prevent fraud and financial crime; the collection and use of personal information on company-issued devices to prevent data loss; and facilitating our compliance with applicable laws and regulations.

We process your personal information based on one or more of the following legal bases under the PIPL:

  • where necessary for the conclusion or performance of a contract to which you are a party;
  • where necessary for compliance with legal obligations or statutory duties;
  • where necessary to respond to a public health emergency or to protect the life, health or property of a natural person;
  • where your separate consent has been obtained; or
  • other circumstances permitted under applicable laws and administrative regulations.

3  Recipients of personal information

We will only disclose your personal information where necessary to fulfil the purposes set out above, and only to the following categories of recipient: affiliated companies within the Technoform Group; professional advisers; logistics providers; banks and payment service providers; IT service providers; and government authorities where required by law. Where we entrust a third party to process personal information on our behalf, we enter into an agreement governing the scope, purpose and protection measures, consistent with the PIPL and this Notice.

4  Your rights

Subject to the PIPL and applicable exceptions, you have the following rights in relation to your personal information:

4.1  Withdrawal of consent

Where processing is based on your consent, that consent remains valid until withdrawn in writing. You may withdraw consent by submitting a written request to our Data Protection Contact, and we shall generally seek to process your request within ten (10) business days. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal, or our right to continue processing personal information where such processing without consent is permitted or required under applicable law.

4.2  Access and correction

Under the PIPL, you have the right to request access to, and correction of, your personal information held by us. Such requests should be submitted in writing to our Data Protection Contact. A reasonable fee may be charged for an access request, and we will inform you of the fee beforehand. We will generally respond within twenty-one (21) business days; if we are unable to do so within thirty (30) days, we will inform you in writing of the time by which we will respond. Where a record forms a negligible part of a document, we may provide confirmation of the personal information we hold rather than the entire document.

4.3  Accuracy of personal information

We generally rely on the personal information provided by you (or your authorised representative). To ensure your personal information remains current, complete and accurate, please inform our Data Protection Contact in writing of any changes to your personal information.

4.4  Protection of personal information

To safeguard your personal information from unauthorised access, collection, use, disclosure, copying, modification, disposal or similar risks, we have implemented appropriate administrative, physical and technical measures. These include minimised collection of personal information, authentication and access controls, encryption, data anonymisation, up-to-date antivirus protection, regular patching, secure disposal of storage media, and the use of two-factor or multi-factor authentication, together with regular security reviews and testing. While no method of transmission or storage is completely secure, we continually review and enhance our information security measures.

4.5  Retention of personal information

We retain your personal information only for the minimum period necessary to fulfil the purposes for which it was collected, or as required or permitted by applicable law. We will cease to retain your personal information, or remove the means by which it can be associated with you, as soon as it is reasonable to assume that retention no longer serves those purposes and is no longer necessary for legal or business purposes.

4.6  Cross-border transfers

We generally store personal information within mainland China. Where a cross-border transfer of personal information is necessary, we will first satisfy one of the following conditions under the PIPL: (a) enter into the Standard Contract issued by the Cyberspace Administration of China (CAC); (b) obtain personal information protection certification; or (c) complete a CAC security assessment. Where personal information is transferred outside China, we will inform the affected individuals of the identity of the overseas recipient, the purpose of the transfer, the categories of personal information transferred, and how they may exercise their rights, and we will obtain your separate consent where required by law.

4.7  Data localization

Where applicable under the CSL, DSL and PIPL, organisations that are required to localise personal information or important data within mainland China will comply with the applicable localisation requirements.

4.8  Data breach notification

In the event of a personal information breach, leakage, tampering or loss, we will promptly take remedial measures and notify the competent authorities and the affected individuals where required under applicable laws and regulations.

4.9  Direct marketing

We do not use your personal information for direct marketing unless we have obtained your explicit consent where required by applicable law. You may withdraw such consent at any time by contacting our Data Protection Contact.

5  Your rights under the PIPL

Under the PIPL, you have the right to:

  • know about, and decide on, the processing of your personal information, including to limit or refuse its processing by others;
  • access and obtain a copy of your personal information;
  • correct or supplement your personal information where it is inaccurate or incomplete;
  • delete your personal information in the circumstances provided under the PIPL;
  • withdraw your consent where processing is based on consent;
  • request an explanation of our personal information handling rules; and
  • exercise any other rights conferred under the PIPL.

To exercise any of these rights, please contact our Data Protection Contact using the details in Section 5. We will respond in accordance with the PIPL, generally within twenty-one (21) business days; if we are unable to do so within thirty (30) days, we will inform you in writing of the time by which we will respond.

6  Data Protection Contact

You may contact our Data Protection Contact if you have any enquiries or feedback on our personal data protection policies and procedures, or if you wish to make any request in relation to your personal data:

Contact number: +86 512 6283 3188
Email: info [dot] tesg [at] ap [dot] technoform [dot] com (info[dot]tesg[at]ap[dot]technoform[dot]com)

All enquiries sent to this mailbox will be reviewed and handled by our designated compliance staff in accordance with the PIPL.

7  Validity and modification of this Notice

This Notice is currently valid (see date in the heading) and applies in conjunction with any other policies, notices, contractual clauses and consent clauses relating to the collection, use and disclosure of your personal information by us. Due to the further development of our offerings, or changes in legal or regulatory requirements, it may become necessary to amend this Notice from time to time. You may determine whether any revision has taken place by referring to the date on which this Notice was last updated. Where changes materially affect your rights and interests, we will notify you through appropriate means before such changes take effect, where required by applicable law. Your continued employment with us constitutes your acknowledgement and acceptance of any such changes.