GreenToken by SAP Privacy Statement

Protecting the individual's privacy on the Internet is crucial to the future of Internet-based business and the move toward a true Internet economy. We have created this privacy statement to demonstrate our firm commitment to the individual's right to privacy. This Privacy Statement outlines our personal information handling practices for GreenToken by SAP (the “Service”). If you use the Service as part of an entity or organization with an enterprise agreement with SAP, the term of your organization’s agreement with SAP may restrict our collection or use of your Personal Data. We refer to these types of users in this document as “enterprise users.”

For individual users, and for specific types of data collection and use listed below, the data controller for the Service is SAP America Inc., 3999 West Chester Pike, Newtown Square, PA 19073, United States (“SAP”), with its data protection officer Mathias Cellarius (privacy@sap.com). For enterprise users, the data controller is the organization that has an agreement with SAP.

General information

Global Privacy Fundamentals
Our privacy practices reflect current global principles and standards on handling personal information. These principles include notice of data use, choice of data use,data access, data integrity, security, onward transfer, and enforcement/oversight. We abide by the privacy laws in the countries where wedo business.
When does this Privacy Statement apply?
This Privacy Statement covers this Service and other sites that reference this Privacy Statement. Some SAP entities, programs and/or sites may have their own,possibly different, privacy statements. We encourage you to read the privacy statements of each of the SAP websites or program information you visit or review.If you use the Service as part of an entity or organization with an enterprise agreement with SAP, the term of your organization’s agreement with SAP may restrict our collection or use of your Personal Data.Even if you are not a user of this Service, some information may be gathered about you by virtue of your interaction with a user of the Service. Please see “Non-Users Interacting with Service Users” for more details.
What does SAP do with my personal data?
SAP collects and uses your data to provide individual users the Service, to improve our products and services, to communicate with you about offers that may be of interest, and for other administrative purposes. You can find detailed information in the “Personal Data Collected and Purposes” below.
Why am I required to provide personal data?
Any provision of personal data is voluntary. However, without providing certain personal data (see “Data we process to provide you the Service”), you will not be able to use the Service.
From what types of third parties does SAP obtain information?
In mostcases SAP collects Personal Data from you. SAP might also obtain Personal Data from third parties, if the applicable national law allows SAP to do so.  SAP will treat this Personal Data according to this Privacy Statement, plus any additional restrictions imposed by the third party that provided SAP with it or the applicable national law. These third-party sources include:
· SAP and/or SAP Group’s business dealings with your employer
· Third parties you directed to share your Personal Data with SAP

Personal Data Collected and Purposes

SAP collects certain information which can directly or indirectly identify you (“Personal Data”) to deliver the service, to understand your needs and interests and to help SAP deliver a consistent and personalized experience. We will use such information only as described in this Privacy Statement and/or in the way we specify at the time of collection. We will not subsequently change the way your personal data is used without your consent, as required by applicable law.
Data we process to provide you the Service
SAP requires your full name and e-mail address to deliver the Service to you, including allowing you to create personal profile areas, view protected content, provide customer feedback and receive support (including communicating with you via email). We will also collect Personal Data that you provide to us, such as when you fill in an optional field to let us know your job title. Depending on the integrations you use, we may also require user information to other sites where the Service can be integrated. For instance if you integrate with Box, we may ask you to provide your Box user name.
Data we process to create a better experience and improve our product
In addition to your Personal Data, we may collect other information about your use of our Service and certain details that your browser sends to our website such as your browser type and language, access times, and the address of the website from which you arrived at an SAP website. We use standard automated tools, which include Web beacons, embedded Web links, and other commonly used information-gathering tools to collect this information.  

We use this information to:
· Help diagnose and resolve problems with our Service;
· Transfer your Personal Data within SAP’s group of undertakings to the extent necessary for internal administrative purposes;
· Prevent or prosecute criminal activities such as fraud, if required;
· Analyze  your individual usage patterns, interests and preferences in order to improve our products and make suggestions (manually or with use of machine learning techniques) that help you get the most value from our Service. For example, it allows us to provide you with specific information on features and services that may be of interest to you. We may occasionally provide related in-Service notifications or announcements;
· Create aggregated and anonymized data sets in order to understand Service usage, adoption, and virality, which will then be used to improve the Service. This aggregated and anonymized data may also be used to improve SAP’s and its affiliates’ other products and services;
· Invite you to participate in additional questionnaires and surveys. These questionnaires and surveys will be generally designed in a way that they can be answered without any Personal Data. If you nonetheless enter Personal Data in a questionnaire or survey, SAP may use such Personal Data to improve its products and services
· To keep you up-to-date or request feedback. Within an existing business relationship between you and SAP, SAP might inform you, where permitted in accordance with local laws, about its products or services (including webinars, seminars or events) which are similar or relate to such products and services you have already purchased or used from SAP. Furthermore, where you have attended a webinar, seminar or event of SAP or purchased products or services from SAP, SAP might contact you for feedback regarding the improvement of the relevant webinar, seminar, event, product or service.
Data we process based on your consent.
In the following cases SAP will only use your Personal Data as further detailed below after you have granted your prior consent. For enterprise users, please note that these activities constitute a separate controller activity of SAP.

· News about the Service. SAP mayuse your name, email, postal address, telephone number, job title and basic information about your employer (name, address, and industry), your individual usage patterns, interests and preferences, as well as an interaction profile based on prior interactions with SAP (prior purchases, participation in webinars,seminars, or events or the use of (web) services  - further details on this topic can be found in the displayed on the relevant SAP website) (together “Tailored Personal Data”) in order to communicate with you about the latest Service announcements,software updates, software upgrades, special offers, and other information about the Service.
Withdraw Consent
For processing based on consent, you may at any time withdraw a consent granted hereunder. If you withdraw your consent, SAP will not process Personal Data subject to this consent any longer unless legally required to do so. In caseSAP is required to retain your Personal Data for legal reasons your Personal Data will be restricted from further processing and only retained for the term required by law. However, any withdrawal has no effect on past processing of personal data by SAP up to the point in time of your withdrawal. Furthermore,if your use of an SAP offering requires your prior consent, SAP will not be(any longer) able to provide the relevant service (or services, if you revoke the consent for SAP to use your profile under the SAP Cloud Platform Identity Authentication Service for multiple SAP offerings), offer or event to you after your revocation. Please direct any such request for withdrawal to info[at]green-token[dot]io.

Duration of Storage

SAP will only store your Personal Data for the following periods as applicable:
· for Personal Data required to deliver the Service, for as long as it is required to allow you to participate in the Service;
· where SAP’s use of your Personal Data is based on SAP’s legitimate business interest as further stated herein, either until you delete your account or until you object to such use by SAP at the email address provided below; and
· where the processing of your Personal Data is based on your consent either until your you delete your account or until you revoke your consent granted hereunder;
· plus, in each case and where applicable, any additional periods under applicable laws during which SAP has to retain your Personal Data. Please direct any such objections Kindly note that inthis case the use of certain services or offerings may either be limited or notpossible any longer. In case there is a contradicting statutory obligation forSAP to retain your Personal Data, SAP will block it against further processigand then delete the relevant Personal Data when the requirement to retain ithas ceased.

Sharing your Personal Data

Recipent of Data
SAP will not send your personal data outside the SAP Group except to the recipients listed below, unless we are otherwise required to do so by applicable laws. Your Personal Data will be passed on to the following categories of third parties to process your Personal Data:
• companies within the SAP Group
• vicarious agents, e.g. third party servicers for consulting services and other additional related services
• other service providers, e.g. for the provision of the website or newsletter dispatch
• state agencies and bodies, e.g. based on entry requirements or police activities and investigations

Country-Specific Disclosures

European Economic Area
For persons in the European Economic Area, the following additional paragraphs apply:
Legal Bases for Processing
For individual users:
· Personal data listed in the section “Data we process to provide you the Service” is processed in order to perform our contractual obligations to you (i.e., to provide you the service).
· Personal data processed under “Data we process to create a better experience” is processed on the basis of SAP’s legitimate interest.
· “Data we process based on your consent” is processed based on your voluntary consent, and you may withdraw consent based on the instructions in that paragraph. For enterprise users: SAP generally processes Personal Data based on the agreement that your organization has with SAP. In most cases, if you wish to exercise your European data protection rights, you will need to contact your organization. However, with your explicit consent, we additionally process the following data as a Controller:
· “Data we process based on your consent” is processed based on your voluntary consent, and you may withdraw consent based on the instructions in that paragraph above.