Privacy Policy

This site is operated by the Yokohama trading entity for the country you hold a trade account with. Each entity is the data controller for its own customers’ personal data — there is no single group-wide controller. The entities we’ve published details for so far are:

If your country isn’t listed above yet, contact your usual Yokohama account manager for the details of the entity you hold your trade account with.

• Trade account details already held in our ERP system: your account/customer code, company name, country, and assigned pricing/discount group. Accounts aren’t self-registered — they’re set up by us or your account manager, and you sign in with your account code and password. We also hold the contact name and email address used for your account, and your password (only ever stored in scrambled, one-way “hashed” form).
• Delivery and billing addresses used for orders, including any additional saved delivery addresses where that feature is enabled for your country.
• Order, basket, and invoice history — products searched for and ordered, quantities, prices, order status, and invoice/PDF records.
• Support interactions — messages sent through the built-in help/AI assistant feature, and any returns you raise.
• Technical and security data recorded at login — IP address, approximate location derived from it, device/browser type, and session activity — kept for account security and fraud-prevention purposes (see Section 9).
• An activity log of changes made on your account (for example orders placed, basket and address changes, settings saved) and who made them — kept so we can answer questions and investigate problems. Personal details you type (names, email addresses, phone numbers, addresses) are left out of it.
• With your consent only — first-party usage analytics: pages viewed, searches made, filters used, and whether you use the bulk CSV order-import or camera tyre-scan features. See Section 8 and our Cookie Policy.

We do not collect any special category data (Article 9 GDPR) about you, and we do not carry out any solely-automated decision-making that produces legal or similarly significant effects — the built-in AI assistant is a search/help aid over our own product catalogue, not a decision-maker.

• Performance of a contract — operating your trade account, taking and fulfilling orders, invoicing, and delivery.
• Legitimate interests — keeping the site and your account secure (fraud/abuse prevention, login rate-limiting), and improving the service.
• Legitimate interests — using your account’s order history to show you your own yearly summary and target progress, suggest replacements for tyres you order that we no longer offer, plan our stock, and help our sales team know when to contact you (for example, when your ordering changes). Staff see these summaries; they are not shared outside the Yokohama companies listed in this policy.
• Legal obligation — keeping tax and accounting records for the periods set out in Section 6.
• Consent — first-party usage analytics only, which you can withdraw at any time (see Section 8).

The Swiss FADP doesn’t require a documented lawful basis in the same way GDPR does for most ordinary business processing — Swiss law instead asks that processing stay proportionate and not unlawfully infringe a data subject’s personality rights. We apply the same discipline described above across every country we serve regardless, rather than maintaining a separate, more permissive standard for Switzerland.

• Our ERP/order-processing system (M3/Infor ION), which holds your account, pricing, and stock data.
• Our email delivery provider, used only to send account-security and order/invoice notifications — configured by our administrators. [name the specific provider here once confirmed].
• Our hosting provider, which operates the EU-based data centre our servers run in.
• Cloudflare, Inc., which sits in front of this site to protect it from attacks and abuse (for example floods of traffic meant to take the site down) and to deliver its images and files quickly. Every visit to the site passes through Cloudflare’s network on its way to our server, so Cloudflare handles your IP address, browser details and the pages you request, and the data you send and receive passes through it in encrypted form. Cloudflare acts only on our instructions, keeps its own logs of this traffic for a short time, and may set one cookie to tell people from automated bots (see our Cookie Policy).
• The provider of the AI model behind the built-in help assistant (configured by our administrators), which receives only the questions you type into the assistant and our product information — not your account details.
• [any delivery/logistics partner used to fulfil your order, once confirmed].
• Weather and place-name services (Open-Meteo, and postcodes.io for UK postcodes), for the dashboard’s Road Ahead forecast: only the town or postcode of your depot, or its approximate coordinates, is sent — never your name or account.

We don’t sell personal data, and we don’t share it with anyone for their own marketing purposes. Each processor above operates under a data processing agreement satisfying Article 28 GDPR (and the equivalent Swiss FADP requirement) — confirm each one is formally in place for this account before publishing this policy externally.

• EU customers: data stays within the EU — this isn’t an international transfer at all.
• UK customers: a transfer from the UK to the EU is covered by the UK Government’s own adequacy regulations (the UK recognises the EU/EEA as adequate), so no additional safeguard (e.g. Standard Contractual Clauses) is needed.
• Switzerland customers: the Swiss Federal Data Protection and Information Commissioner (FDPIC) includes the EU/EEA on its list of countries with an adequate level of protection under the revised Swiss FADP, so a transfer from Switzerland to our EU-based server is likewise permitted without extra safeguards.

Cloudflare is a US company whose network runs in data centres around the world, so a visit is usually handled by the Cloudflare site nearest to you, which may be outside the UK, EU or Switzerland. These transfers are covered by Cloudflare’s data processing agreement, which includes the EU Standard Contractual Clauses, the UK International Data Transfer Addendum and the Swiss equivalent, and by Cloudflare’s certification under the EU–US, UK and Swiss–US Data Privacy Frameworks.

Apart from Cloudflare, this assumes our hosting provider doesn’t itself move or replicate this account’s data outside the EU/EEA (confirm this in its data processing terms), and that no other processor named in Section 4 stores or accesses data outside the UK/EEA/Switzerland without equivalent safeguards.

• Order and invoice records: for as long as required by the tax and accounting rules of the country your entity operates in — typically a minimum of 6 years in the UK and across most EU member states, and 10 years in Switzerland (Swiss Code of Obligations, Art. 958f).
• Trade account and delivery-address data: for the life of the trade relationship, plus the same record-keeping period above afterwards.
• Login/security logs: login events (including the technical and security data listed above) are kept for 2 years for security monitoring and account-activity reporting, then deleted automatically.
• Activity log: pages viewed and clicks 30 days, searches 90 days, changes made on the account 1 year, then deleted automatically.
• Usage analytics (only if you’ve consented): kept for three years, then deleted.
• Backups: nightly backups of our database are kept for 7 days, then deleted.
• Records of data-protection requests (for example a request to see or erase your data): 6 years, as evidence of how and when we handled them. These hold what was done, not the data itself.
• Your cookie/analytics consent choice: kept until you change it or clear your browser’s site data.

Subject to the conditions and exemptions in the law that applies to you, you have the right to:

• be told how your data is used (this policy);
• access a copy of your personal data;
• have inaccurate data corrected;
• have your data erased, or its processing restricted, in some circumstances;
• receive certain data in a portable format;
• object to processing based on legitimate interests; and
• withdraw consent to usage analytics at any time (see Section 8) — this doesn’t affect processing that already happened.

To exercise any of these, contact the entity for your country listed in Section 1 above. We’ll check it’s really you before acting, and reply within one month. A copy of your data is sent as a summary document plus spreadsheet files. When we erase your data, we delete or anonymise it everywhere this site holds it, except records the law requires us to keep (such as orders and invoices, which we keep for tax), and send you a letter confirming what was done. Our backups can’t be edited, but they are deleted within 7 days, and if one were ever restored before then, the erasure is applied again automatically. You also have the right to complain to a supervisory authority: the Information Commissioner’s Office (ICO) in the UK, the Federal Data Protection and Information Commissioner (FDPIC) in Switzerland, or your local supervisory authority elsewhere in the EU/EEA (the EDPB maintains a list).

We set only a small set of strictly necessary cookies — never advertising or third-party tracking cookies. With your consent, we also collect basic first-party usage analytics; withdrawing that consent turns it off entirely, at any time, not just on your first visit. See our full Cookie Policy for the complete list of cookies, exact durations, and how to change your choice.

We apply the following technical and organisational measures:

• Encrypted transport (HTTPS) for the whole site.
• Signed, HttpOnly, Secure session cookies rather than storing raw credentials in your browser — see our Cookie Policy.
• Passwords stored only in hashed form (scrypt, with a unique salt), never as readable text, with an emailed link to reset a forgotten one.
• Progressive rate-limiting on login attempts to deter automated abuse.
• Protection from Cloudflare against attacks and floods of traffic, in front of our server.
• An account that is switched off (for example at your request) is signed out everywhere at once.
• A hardened server environment, with administrative access restricted to authorised staff.

If we become aware of a personal data breach likely to pose a risk to you, we’ll notify the relevant supervisory authority (within 72 hours where GDPR requires it, or as soon as possible where the Swiss FADP applies) and, where the risk to you is high, notify you directly without undue delay.

For any question about this policy or how we use your data, contact the entity for your country listed in Section 1 above. See also our Terms & Conditions and Cookie Policy.