Privacy Statement for the Yamaha Clavinova Space App
Preamble
This service (hereinafter referred to as "App") is provided by Yamaha Music Europe GmbH, Siemensstr. 22–34, 25462 Rellingen, Germany (hereinafter referred to as "we" or "us") as data controller within the meaning of the applicable data protection law.
Within the scope of the App we allow you to retrieve and display the following information: details, descriptions and illustrations of selected products using a variety of media including text, photography, videos, audio and augmented reality. When using the App, we process personal data about you. Personal data means any information relating to an identified or identifiable natural person. Because the protection of your privacy when using the App is important to us, we would like to provide you with the following information about which personal data we process when you use the App and how we handle this data. In addition, we inform you about the legal basis for the processing of your data and, if the processing is necessary to protect our legitimate interests, also about our legitimate interests.
You can access this Privacy Statement at any time under the “Privacy Policy” menu item within the App.
1. Information about the processing of your data
Certain information is automatically processed when you use the App. We have listed below exactly what personal data is processed:
1.1 Information collected during download
When the App is downloaded, certain required information is transmitted to the App Store you have selected (e.g. Google Play or Apple App Store); in particular the user name, email address, time of download and the individual device code may be processed. The processing of this data is done exclusively by the particular App Store and is outside of our control.
1.2 Information that is automatically collected
As part of your use of the App, we automatically collect certain data that is necessary for the use of the App. This includes: An anonymised device identifier, time of access and events within the app. The device identifier is expressed as a hexadecimal string which is then hashed using the MD5 method; this takes place locally within the app on the device (and so no non-anonymised data is collected by us).
This data is automatically transmitted to us, (1) to provide you with the service and the related functions; (2) to improve the functions and features of the App and (3) to prevent and eliminate abuse and malfunctions. This data processing is justified by the fact that (1) the processing is necessary for the fulfilment of the contract between you as the data subject and us pursuant to Article 6(1)(b) General Data Protection Regulation (GDPR) for the use of the App, or (2) we have a legitimate interest in ensuring the functionality and error-free operation of the App and in being able to offer a market and interest-oriented service that outweighs your rights and interests in the protection of your personal data within the meaning of Article 6(1)(f) GDPR.
1.3 Use of the App
The App allows you to learn about selected products from our range through various media including augmented reality.
The App also requires the following permissions:
- Internet Access: This is needed to retrieve and stream content data such as text, videos and audio files.
- Camera Access: This is required for to experience a visual illustration of selected products using augmented reality; a 3D model of a product is overlaid onto your camera’s live feed.
- Location access: This is required only if you wish to use the location-aware function of the online store finder webpage (which can be opened from within the app).
The processing and use of usage data is required for the provision of the service. This data processing is justified by the fact that the processing is necessary for the fulfilment of the contract between you as the data subject and us pursuant to Article 6(1)(b) GDPR for the use of the App, or the access to your camera is covered by your consent.
2. Data transfers to third countries
We also process data in countries outside the European Economic Area (“EEA”). This relates specifically to:
Usage data stored on Amazon Web Services in London, UK
The trade agreement between the EU and the UK declares that there is a transformation period after which the European Commission intends to / has issued an adequacy decision for data security in the UK.
3. Period of data storage
Data collected by us is hashed locally on the device; therefore, no personally identifiable data is received by us. We will delete your personal data as soon as it is no longer necessary for the purposes for which we have collected or used it in accordance with the preceding paragraphs.
Specific provisions in this Privacy Statement or legal requirements for the storage and deletion of personal data, especially that which we have to keep for tax reasons, remain unaffected.
4. Your rights as data subject
4.1 Right to Information
You have the right, at any time upon request, to receive information about your personal data which is processed by us, within the scope of Article 15 GDPR. To do this, you can submit a request by post or by email to the address below.
4.2 Right to rectification of inaccurate data
You have the right to ask us to correct your personal data immediately if it is inaccurate. To do this, please use the contact addresses below.
4.3 Right to deletion
You have the right to request the deletion by us of your personal data under the conditions described in Article 17 GDPR. In particular, these conditions provide for a right of deletion if the personal data is no longer necessary for the purposes for which it was collected or otherwise processed, as well as in cases of unlawful processing, the existence of an objection, or the existence of a deletion obligation under European Union law or the law of the Member State to which we are subject. For the period of data storage, see also section 5 of this Privacy Statement. To exercise your right to delete, please use the contact addresses below.
4.4 Right to restrict processing
You have the right to ask us to restrict processing in accordance with Article 18 GDPR. This right exists in particular if the accuracy of the personal data is disputed between the user and us, for the period needed to verify accuracy, and where a user requests restricted processing instead of deletion in the case of an existing right to deletion. Additionally, it exists where the data is no longer required for the purposes pursued by us, however, the user requires it for the assertion, exercise or defence of legal claims, and if the successful exercise of an objection between us and the user remains disputed. To exercise your right to restrict processing, please use the contact addresses below.
4.5 Right to data portability
You have the right to receive the personal data that you have provided to us in a structured, commonly used, machine-readable format according to Article 20 GDPR. To exercise your right to data portability, please use the contact addresses below.
5. Right to complain
You also have the right to contact the responsible supervisory authority in the event of complaints.
6. Contact us
If you have any questions or comments regarding our handling of your personal data, or if you wish to exercise the rights listed in section 4 as a data subject, please contact our Data Protection Officer: Dataprotection@contact.europe.yamaha.com.
7. Changes to this Privacy Statement
We keep this Privacy Statement up to date. Therefore, we reserve the right to amend it from time to time and to update any changes to the collection, processing or use of your data. The current version of the Privacy Statement is always available under “Privacy Policy” within the App.
As at: March 2021