1. Introduction

Our commitment to data protection

At Prologis (“Prologis” or “we” or “us”) we are committed to protecting your personal data. As data controller, we manage your personal data in a responsible way and aim to be transparent in our personal data processing. Detailed information regarding our practices can be found in this Privacy Statement for Suppliers (“Privacy Statement”).

If you want to know more about Prologis and its subsidiaries (“Prologis”), please visit https://www.prologis.com/.

This Privacy Statement

This privacy statement (“Privacy Statement”) describes how Prologis collects and processes the personal data of Prologis’ suppliers who are individuals (such as self-employed persons) and the representatives, employees, or contact persons of our suppliers who are legal entities (“Supplier”, “you”) and is relevant for you.

Basic principles and Prologis data protection commitments

With regards to protecting your personal data we have committed ourselves to the following basic principles:

• You are under no obligation to provide Prologis your personal data. However, if you fail to provide personal data when requested which is necessary for us to manage our relationship with you or your employer as a service provider or supplier (e.g., information necessary to pay you, to evaluate your qualifications or meet our regulatory and legal obligations), we may not be able to retain your services.
• We only collect and process your personal data for the purposes set out in this Privacy Statement or for specific purposes that we share with you and/or that you have consented to. Your data will not be processed in a manner incompatible with those purposes.
• We will only collect, process and use the minimum required personal data and not more than is required for the purposes as described in this Privacy Statement.
• When we process your personal data, we take adequate measures to keep it as accurate and up to date as possible.
• We have implemented a number of security measures to protect your data from misuse, interference, loss, unauthorized access, modification or disclosure.
• As a rule, we keep your personal data for the time period necessary for processing purposes or for the time period expressly required by law. If data is no longer needed for any of the purposes as described in this Privacy Statement and we are not required by law to retain it, we will delete or anonymize it.
• Your personal data will not be shared, sold, rented or disclosed other than as described in this Privacy Statement. We may, however, share your data when required by law and/or government authorities.

Furthermore, we process your personal data in accordance with applicable data laws, i.e.:

• the EU General Data Protection Regulation and UK General Data Protection Regulation (“GDPR”);
• applicable Member State or UK laws;
• any mandatory guidelines or recommendations implementing the GDPR or applicable Member State or UK laws.

(together “Applicable Regulation”).

2. How do we collect your data?

Collected directly from you and generated by Prologis

Prologis collects your personal data either directly from you or through the supplier or service provider for whom you work.

Collected from third parties

We might also be provided with personal data about you from other sources, such as a third party (e.g., background information from third-party providers; our employees or business relationships, such as feedback on you we receive from other contractors or our employees; publicly available sources to confirm signatory powers).

3. What personal data we process?

This personal data may include:

• your personal details (e.g., first name, last name, email address, address, phone number, identification document or information, photo or video recording);
• information about your employer (e.g., name of your company and your title, position); and
• your financial information (e.g., bank account details) and national insurance number.

Additionally, for any person from our suppliers who has access to our computer systems, we may collect the following types of personal data, including:

• information regarding your function at Prologis (e.g., position, business unit, location, time zone, cost center, supervisor/manager);
• work related information (e.g., work order number, identification number, start date and end date, status of any required training, billing rate and amount);
• your electronic identification data where required for the purpose of delivering products or services to our company (e.g., login, passwords, badge number and photograph, IP address, online identifiers/cookies, logs, access and connection times, and CCTV footage or other video surveillance (only if legally permitted and where clearly indicated)); and
• certain compliance related information (e.g., records of required training).

4. Why do we collect and use your personal data?

Legal basis of the processing

According to Applicable Regulation, if you are located in the EU or the UK, we will only process your personal data pursuant to the following legal basis:

• Legitimate business interest: It is necessary for our legitimate interests and does not unduly affect your interests or fundamental rights and freedoms. Please note that, when processing your personal data on this basis, we always seek to maintain a balance between our legitimate interests and your privacy.
• Contract: The processing is necessary to take pre-contractual steps with you or to perform our contractual obligations towards you (or the supplier or service provider for whom you work);
• Legal obligation: The processing is necessary for us to comply with our legal obligations (not including contractual obligations, e.g., conducting supplier due diligence or exercising our audit rights).

Purposes for which we process your data

5. Retention period

We will only retain your personal data in our systems for the time necessary to achieve the purposes for which we collect it as described in this Privacy Statement, including to comply with any legal or accounting requirement. We will then remove the personal data from our systems or permanently and in an irreversible way make it anonymous for statistical purposes, meaning that you cannot be associated to it.

Please note that in accordance with Applicable Regulation, your personal data may be retained for a set period of time in Prologis’s legitimate interests and/or to comply with our legal obligations.

6. Transfer of your data to Third Parties and/or outside of your country of residence

Sharing your data with third parties:

When we share your personal data with affiliates, other organizations and trusted third parties, we make sure only to do so with entities that safeguard and protect your data and comply with Applicable Regulation in the same or similar way that we do.

Trusted third parties may assist us in providing IT services, such as platform providers, hosting services, maintenance and support on our databases as well as on our software and applications that may contain data about you or to perform on our behalf the statistical analyses associated with the use of the career website.

More precisely, the trusted third parties of your personal data can be:

• Outside of Prologis:
  • IT providers and suppliers (platform provider, hosting services);
  • Cloud service providers;
  • External advisors/agencies and consultants;
  • Public Authorities;
• Within Prologis:
  • Prologis’s personnel (e.g., employees, directors, investors, interns, contractors, etc., working in various departments or who are employed by Prologis’ affiliates and subsidiaries);
  • Other Prologis internal teams (such as IT and potential manager(s)), and only on a need-to-know basis and with the sole purpose to provide you with requested services.

Sharing your personal data internationally:

Our group companies and third-party contractors and consultants operate around the world. This means that we may process personal data outside the European Economic Area (EEA) and the UK. However, we have taken appropriate safeguards to require that your personal data will remain protected in accordance with this notice. These include implementing data transfer clauses with our third-party vendors, contractors and consultants and an intragroup agreement for transfers of personal data within our group.

7. How we protect your personal data

We understand that the security of your personal data is important. We protect your personal data from misuse, interference, loss, unauthorized access, modification or disclosure. We have implemented a number of security measures to help protect your personal data. For example, we implement access controls, use firewalls and secure servers, and we encrypt personal data. Please note however that where you are transmitting information to us over the internet this can never be guaranteed to be 100% secure.

8. Your rights

Where we process your personal data, according to Applicable Regulation, you are entitled to a number of rights and, when applicable, you can exercise these rights at any point.

If prescribed by Applicable Regulation, you might have the right to:

• Access to the personal data that we hold as well as how it is used. Note that we may refuse to provide you with information when it may reveal personal data of another person or negatively affect the rights of another person.
• Have your personal data rectified if it is inaccurate or incomplete.
• Have your personal data deleted when:
  • your personal data is no longer necessary in relation to the purposes for which we collected it; or
  • you withdraw the consent that you had previously given us to process your personal data, and there is no other legal ground to process that personal data; or
  • you object to us processing your personal data for direct marketing purposes; or
  • you object to us processing your personal data for Prologis’s legitimate interests;
  • the personal data is not being processed lawfully; or
  • your personal data needs to be deleted to comply with a legal obligation;
  • in another specific circumstances set forth by applicable local law.

Note that we will not delete such data if we are required to retain it by law.

• Restrict our processing of your personal data (i.e., permitting its storage but no further processing). You may have the right to restrict the processing of your personal data if:
  • you do not believe the personal data we have about you is accurate; or
  • the personal data is not being processed lawfully, but instead of deleting the personal data, you would prefer us to restrict processing instead; or
  • we no longer need your personal data for the purposes we collected it, but you require the data in order to establish, exercise or defend legal claims; or
  • you have objected to the processing of your personal data and are awaiting verification on whether your interests related to that objection outweigh the legitimate grounds for processing your data.
• Object to processing: You may have the right to object to the processing consisting in direct marketing and processing activities based on legitimate interest.
• Ask for your data portability: Your personal data may be portable. This means it may be moved, copied or transmitted electronically. However, this right only applies where:
  • the processing is based on your consent;
  • the processing takes place for the performance of a contract; or
  • the processing takes place by automated means.
• Lodge a complaint with the Data Protection supervisory authority of your country: See: https://edpb.europa.eu/about-edpb/board/members_en

Please keep in mind that these rights are not absolute and the exercise of each is subject to certain conditions in accordance with Applicable Regulation.

In all cases, if the personal data we collect is no longer needed for any purposes and we are not required by Applicable Regulation to retain it, we will do what we can to delete, permanently de-identify or anonymize it.

9. Exercise of your rights

If you have any questions, comments or complaints regarding this Privacy Statement or the processing of your personal data, or if you want to make a request regarding any of your data subject rights, please contact us at [email protected].

We will review all requests and provide our response within the time frames provided by Applicable Regulation. Note that we may need to ask you for specific information to help us confirm your identity to guarantee your right to access this information and to avoid the disclosure of your personal data to a person who does not have the right to receive it.

10. Changes to this Privacy Statement

Prologis is free to modify this Privacy Statement periodically to reflect the evolution of our practices in this area. If we make changes, we will provide notice of such changes by revising the date at the end of this Privacy Statement and, in some cases, we may provide you with more prominent notice (such as sending you a notification). We encourage you to periodically review this Privacy Statement to be updated on how Prologis protects your personal data.

This Privacy Statement was last updated in November 2023.